Multivariable time series data anomaly detection method based on coupling network

Abstract

The invention discloses a multivariable time series data anomaly detection method based on a coupling network, and relates to the technical field of adversarial learning. Comprising the following steps: acquiring labeled data samples and label-free data samples, performing label mixing on the labeled data samples according to a preset proportion, combining the label-free data samples according to a specific rule to form a sample data set, preprocessing the sample data set by adopting a data specification and data dimension reduction mode, and obtaining the label-free data set. Generating a training data set according to a certain proportion, constructing a deep learning model, inputting original data in the training data set into the deep learning model to learn data sample features, dynamically adjusting model parameters, obtaining the trained deep learning model, and generating feature data; and comparing the difference between the original data and the feature data as an abnormal score, and judging abnormal data and difference data based on the abnormal score. According to the invention, multivariable time series data anomaly detection based on the coupling network can be realized.

Description

Technical Field

[0001] The present invention relates to the field of adversarial learning technology, and in particular to a multivariate time series data anomaly detection method based on a coupled network. Background Art

[0002] Information systems usually use physical devices or virtual devices (for example, temperature sensors, barcodes, buried points, etc.) to collect data from different components or functional modules of the information system, which are usually presented in multidimensional data (or multivariate data, multivariate time series data) to reflect the operating status of the information system. Efficient multivariate time series data anomaly detection is of great significance for early warning of anomalies in information systems and ensuring stable operation. In recent years, multivariate time series data anomaly detection has been widely used in industrial manufacturing, financial transactions, network security and other fields. By identifying and marking abnormal information in various application scenarios, it plays an important role in promoting the development of intelligent operation and maintenance in various fields. However, with the continuous improvement of Internet hardware facilities and the deepening of system applications, the scale of multivariate time series data continues to expand, making multivariate time series data anomaly detection increasingly challenging. In addition, the lack of sensitivity of data sampling technology in application scenarios, the poor timeliness of system state change response speed, and the difficulty in estimating the strength of sampling data time series dependence have led to a high missed detection rate. In the context of large-scale multivariate time series data and complex coupling relationships, it is a crucial basic work to carry out the description of the coupling relationship between multiple variables, the research on multivariate time series data time dependency misalignment and multivariate time series data anomaly detection under the lag causal effect, and improve the level of intelligent operation and maintenance.

[0003] Therefore, a multivariate time series data anomaly detection method based on a coupled network is proposed. Based on the multivariate coupled network, the anomaly problem caused by data noise caused by time series dependency misalignment and the causal effect of time lag is overcome, which is an urgent problem to be solved by technical personnel in this field. Summary of the invention

[0004] In view of this, the present invention provides a multivariate time series data anomaly detection method based on a coupling network, which concisely and efficiently constructs a multivariate coupling network to describe the complex correlation relationship between multiple variables, and realizes multivariate time series data anomaly detection based on a coupling network.

[0005] In order to achieve the above object, the present invention adopts the following technical solution:

[0006] A method for detecting anomalies in multivariate time series data based on a coupled network comprises the following steps:

[0007] Sample acquisition step: obtain labeled data samples of normal operation and abnormal operation of the information system as labeled data samples, and data samples of unknown operation status of the information system as unlabeled data samples;

[0008] Data construction steps: Labeled data samples are mixed according to a preset ratio, and unlabeled data samples are combined according to specific rules to form a sample data set;

[0009] Data preprocessing step: preprocess the sample data set by using data standardization and data dimension reduction, and generate a training data set according to a certain ratio;

[0010] Rule learning steps: Build a deep learning model, input the original data in the training data set into the deep learning model to learn the data sample features, dynamically adjust the model parameters, obtain the trained deep learning model and generate feature data;

[0011] Detection and classification step: compare the difference between the original data and the feature data as the anomaly score, and judge the abnormal data and the difference data based on the anomaly score.

[0012] In the above method, optionally, in the data construction step, the construction methods include: full batch construction, batch construction, bagged construction, scenario construction, graph structure construction and sliding window construction.

[0013] In the above method, optionally, in the data preprocessing step, data specification is used to perform dimensionless processing on variables, including: data standardization, data normalization and data regularization;

[0014] Data dimensionality reduction is used to reduce data dimensions to 1, 2, or 3 dimensions, including: PCA, t-SNE, and UMAP.

[0015] In the above method, optionally, the data sample features learned in the rule learning step include spatial features, temporal features and spatiotemporal features.

[0016] In the above method, the optional detection and classification step also includes determining an abnormality threshold based on extreme value theory or exhaustive threshold, and judging the data situation based on whether the abnormality score exceeds the abnormality threshold.

[0017] In the above method, optionally, the detection and classification step further includes using a confusion matrix to measure anomaly detection performance.

[0018] It can be seen from the above technical solution that compared with the prior art, the present invention provides a multivariate time series data anomaly detection method based on a coupling network, which has the following beneficial effects: the present invention focuses on the key technologies of complex network construction, integrates the potential coupling representation of multivariate time series data, and concisely and efficiently constructs a multivariate coupling network to describe the complex correlation between multiple variables, thereby realizing multivariate time series data anomaly detection based on a coupling network. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0020] Figure 1 It is a schematic diagram of a multivariate time series data anomaly detection method based on a coupling network disclosed in the present invention;

[0021] Figure 2 It is a schematic diagram of the structure of the multilayer perceptron disclosed in the present invention;

[0022] Figure 3 It is a schematic diagram of the convolutional neural network structure disclosed in the present invention;

[0023] Figure 4 Schematic diagram of the graph convolutional neural network disclosed in the present invention;

[0024] Figure 5 This is a schematic diagram of calculating the GAT attention coefficient disclosed in the present invention;

[0025] Figure 6 This is a schematic diagram of the multi-head attention mechanism disclosed in the present invention;

[0026] Figure 7 This is a schematic diagram of the VAE structure disclosed in the present invention;

[0027] Figure 8 This is the RNN timing feature modeling diagram disclosed in the present invention. DETAILED DESCRIPTION

[0028] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0029] In this application, relational terms such as first and second, etc. are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. The terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of more restrictions, the elements defined by the sentence "comprise one..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0030] Reference Figure 1 As shown, the present invention discloses a multivariate time series data anomaly detection method based on a coupling network, comprising the following steps:

[0031] Sample acquisition step: obtain labeled data samples of normal operation and abnormal operation of the information system as labeled data samples, and data samples of unknown operation status of the information system as unlabeled data samples;

[0032] Data construction steps: Labeled data samples are mixed according to a preset ratio, and unlabeled data samples are combined according to specific rules to form a sample data set;

[0033] Data preprocessing step: preprocess the sample data set by using data standardization and data dimension reduction, and generate a training data set according to a certain ratio;

[0034] Rule learning steps: Build a deep learning model, input the original data in the training data set into the deep learning model to learn the data sample features, dynamically adjust the model parameters, obtain the trained deep learning model and generate feature data;

[0035] Detection and classification step: compare the difference between the original data and the feature data as the anomaly score, and judge the abnormal data and the difference data based on the anomaly score.

[0036] Furthermore, in the data construction step, the construction methods include: full batch construction, batch construction, bagged construction, scenario construction, graph structure construction and sliding window construction.

[0037] Furthermore, the full batch construction includes: the data is split according to the ratio ε, usually ε is taken as 0.7 or 0.8;

[0038] Batch construction includes: the data is initially divided into training set and test set according to the ratio ε, and then the divided data set is divided again according to the batch size S;

[0039] The bagging construction includes: the data is divided according to the ratio ε, the divided data set is divided again according to the batch size S, and the predictability of the data set is analyzed. If the predictability of the data set does not meet the predictability threshold, it is re-extracted from the data set and recombined into a data set of length S, and repeated several times until the length of the predictable data set meets the requirements; among them, the predictability indicators include entropy index and spectral gap index:

[0040] For each data block S constructed i ,The entropy index is used to analyze whether the semantic distribution of data sample features is balanced. The higher the entropy, the more S i The richer the semantics of the internal data sample features, the more conducive it is to learning data detection rules. First, i Perform singular value matrix decomposition to calculate singular values, the expression is: λ = SVD (S i ),λ={λ1,…,λ B}, where SVD is the singular value matrix and λ is the singular value; then calculate S according to the singular value λ i The feature semantic distribution entropy H(t i ), the expression is: Among them, P(λ j ) is λ j The probability of B is S i The characteristic dimension of

[0041] In terms of link prediction in complex networks, for the predictability of data sets, S i Abstracted as a graph structure, the subgraph centrality proposed based on the characteristic spectrum of the graph believes that the smaller the path length of the closed loop, the more convenient the loop information exchange, the closer the connection between nodes, and the greater the contribution to the centrality of the node. The graph centrality expression of the node is as follows:

[0042]

[0043] Among them, SC i is the center of the node graph, is the i-th component of the j-th eigenvector of the adjacency matrix, N is represented by S i The characteristic dimension of SC even (i) is a closed path of even length, SC odd (i) is a closed path of odd length. According to the definition of graph centrality, when there is a huge spectrum gap in the network, the network has good prediction performance. The expression for evaluating the predictability of the network is as follows:

[0044] P(t i )=exp[-∑((SC odd (i)-(ξ12 ) 2 sinh(λ1)) / (B*SC odd (i))) 1 / 2 ],

[0045] Among them, P(t j ) is S i predictability indicator.

[0046] In the spectral gap index, the data block is abstracted into a graph structure, and the subgraph centrality is proposed based on the characteristic spectrum of the graph. It is believed that the smaller the path length of the closed loop, the more convenient the loop information exchange, the closer the connection between the nodes, and the greater the contribution to the centrality of the node.

[0047] The scenario construction includes: selecting a fixed number of categories in the test sample, and selecting k+l samples from each class again, where k samples are used as support data sets and l samples are used as query data sets;

[0048] The graph structure construction includes: the entire data set is abstracted into a graph, the node represents a data sample, and the edge represents whether the data samples have similarities or differences, thereby generating edge relationships;

[0049] The sliding window construction includes: using a specified sliding window length for multivariate time series data to divide the sequence data into independent but interrelated data blocks.

[0050] Furthermore, in the data preprocessing step, data specification is used to perform dimensionless processing on variables, including: data standardization, data normalization, and data regularization;

[0051] Data dimensionality reduction is used to reduce data dimensions to 1, 2, or 3 dimensions, including: PCA, t-SNE, and UMAP.

[0052] Furthermore, data standardization refers to scaling the value of a column of numerical features in a data set to a state with a mean of 0 and a standard deviation of 1. Deviation standardization and Z-score standardization are usually used. The expression is as follows:

[0053]

[0054] Among them, x * is the result of data preprocessing, x is a numerical feature of a column in the data set, x min is the minimum value of x, x max is the maximum value of x, μ is the mean value of x, and σ is the standard deviation of x.

[0055] Data normalization refers to scaling the value of a column of numerical features in a data set to the range of 0 to 1. Robust normalization and maximum absolute value normalization are usually used. The expression is as follows:

[0056]

[0057] Among them, x med is the median of x, x 75 and x 25 are the upper and lower quartiles of x, respectively, |x max | is the absolute value of the maximum value of x.

[0058] Data regularization refers to scaling a sample in a data set to a unit standard. The expression is as follows:

[0059]

[0060] Among them, P is selected according to the actual situation.

[0061] Data dimensionality reduction means that the number of data samples is much smaller than the feature dimension of the data, and high-dimensional feature samples carry a lot of noise, so direct model training will have low accuracy and poor reliability.

[0062] PCA includes: finding the directions with the largest variance in the data and projecting the data onto these directions to achieve dimensionality reduction. The expression is as follows:

[0063]

[0064] Among them, the original data μ is the mean vector of x, Σ is the covariance matrix between features, and Σ is subjected to eigenvalue decomposition to obtain eigenvalues ​​λ1,λ2,…,λ d and the corresponding eigenvectors v1,v2,…,v d , sort the eigenvalues ​​in descending order, and select the eigenvectors corresponding to the first k eigenvalues ​​as v k , k is the desired feature dimension, and Y is the data after dimensionality reduction.

[0065] t-SNE includes: mapping high-dimensional data to a low-dimensional space by optimizing the loss function while trying to preserve the local relationship between samples. The expression is as follows:

[0066] p ij =exp(-||x i -x i || 2 / 2σ i 2 ) / ∑ k≠i exp(-||x i -x k || 2 / 2σ i 2 ),

[0067]

[0068] q ij =(1+||y i -y j || 2 ) -1 / ∑ k≠l (1+||y k -y l || 2 ) -1 ;

[0069] Among them, p ij Represents sample x i and x j The conditional probability, σ i For x i The variance of t-SNE in low-dimensional space is q ij , by minimizing the KL divergence, we can get the representation Y,y in the low-dimensional space i and j They are x i and x j Low-dimensional space mapping.

[0070] UMAP includes: minimizing the similarity loss between high-dimensional space and low-dimensional space through cross entropy loss. The overall optimization objective function expression of UMAP is as follows:

[0071]

[0072] Among them, γ is used to weigh the similarity loss between high-dimensional space and low-dimensional space.

[0073] Furthermore, the data sample features learned in the rule learning step include spatial features, temporal features and spatiotemporal features.

[0074] Furthermore, the spatial characteristics of data samples are the basic elements that constitute different categories of data. Samples of different categories show differences in spatial characteristics, and abnormal data and normal data are distinguished by differences; including the use of multi-layer perceptron, convolutional neural network, graph convolutional neural network, GAT, multi-head attention mechanism and VAE.

[0075] Multilayer Perceptron MLP is a feedforward artificial neural network model used for classification and regression problems. Figure 2 As shown, MLP consists of one or more fully connected layers, each of which consists of multiple neurons;

[0076] The MLP structure consists of an input layer, a hidden layer, and an output layer. The data format of the input layer is n is the number of samples, d is the feature dimension. The output expression of the hidden layer neuron is: in, represents the output of the jth neuron in the ith hidden layer, where n i-1 is the number of neurons in the i-1th layer, is the weight between the jth neuron in the i-th layer and the kth neuron in the i-1-th layer, is the error term of the jth neuron in the i-th layer, and σ is the activation function.

[0077] The neuron output expression of the output layer is: Among them, n h is the number of neurons in the penultimate layer, is the weight between the jth neuron in the output layer and the jth neuron in the last hidden layer, b (o) is the error term of the output layer.

[0078] The core idea of ​​​​the convolutional neural network is to use convolutional layers to automatically and progressively extract the features of the input data; refer to Figure 3 As shown in the figure, the core of CNN includes convolution and pooling operations. The convolution layer performs convolution operations on the input data through a sliding window to generate a feature map F. Each convolution kernel extracts different features of the input data, such as edges, corners, textures, etc. Multiple convolution layers can be stacked to form a hierarchical feature extractor; the pooling layer is used to reduce the size of the feature map while retaining important information, such as MaxPooling and AveragePooling.

[0079] The convolution operation expression is:

[0080]

[0081] Among them, X is the input data, K is the convolution kernel, * is the convolution operation, i conv , j conv is the coordinate of the output feature map, m conv , n conv is the convolution kernel size;

[0082] The maximum pooling expression is:

[0083]

[0084] Among them, s MaxPool is the pooling layer window, is the number of steps the pooling window moves, m MaxPool , n MaxPool is the maximum pooling kernel size;

[0085] The average pooling expression is:

[0086]

[0087] Among them, s AvePool is the pooling layer window, is the number of steps the pooling window moves, m AvePool , n AvePool is the average pooling kernel size.

[0088] The graph convolutional neural network (GCN) directly applies convolution operations on the graph to capture the dependencies between nodes and the structural information of the graph. The basic idea of ​​GCN is to use the structural information of the graph to update the features of each node by aggregating the feature information of neighboring nodes; refer to Figure 4 As shown, GCN includes an output layer, a hidden layer, and an output layer, which is similar to the MLP structure. The difference is that the input and output of GCN are both graph structures;

[0089] The hidden layer expression of GCN is Among them, H (l) is the node feature matrix of the lth layer, W (l) is the weight matrix of the lth layer, A is the adjacency matrix, I is the identity matrix, is the degree matrix,

[0090] GAT captures the dependencies between nodes in the graph through the self-attention mechanism. Figure 5 As shown in Figure 1, GAT assigns different weights to each node to represent the importance of its neighbor nodes, and weights and aggregates the features of the neighbor nodes into the features of the target node. This enables GAT to effectively handle complex relationships between nodes and exhibit excellent performance in tasks such as node classification and link prediction. The input of GAT is represented as The output is represented as Where N represents the number of nodes and F represents the node feature dimension. The attention coefficient between nodes needs to consider the characteristics of both node i and node j;

[0091] The importance of node j to node i ij The expression is: in, It is a linear transformation applied to the features of nodes i and j, || represents the concatenation operation, and LeakRelu is the activation function;

[0092] The weight α of node i ij The expression is Among them, N i is the neighbor set of node i;

[0093] The update characteristic expression of node i is After introducing the node output features of the multi-head attention mechanism, the expression is Among them, Head is an independent attention mechanism.

[0094] Each head in the multi-head attention mechanism performs attention calculations separately to reveal the associations between different parts of the input data. Each head independently calculates the attention between the query vector (Q), the key vector (K), and the value vector (V), and applies these attention weights to the value vector to generate the output of each head, and finally fuses the outputs of all heads as the result; refer to Figure 6 As shown, the number of heads H of the multi-head attention mechanism is set to 3, and the linear transformation expression of the query vector Q, key vector K and value vector V is: i (X i )=X i θ i Q , K i (X i )=X i θ i K , V i (X i )=X i θ i V ,in, and are the weights of Q, K, and V;

[0095] The calculation expression of a single head of the multi-head attention mechanism is:

[0096]

[0097] The output calculation expression of multiple channels is: in, represents the scaling factor of the weight matrix, and d is the feature dimension of the input data.

[0098] VAE consists of an encoder and a decoder. The encoder maps the input data to a vector in a latent space, while the decoder generates output data from this latent vector. In VAE, the encoder does not directly output a fixed latent vector, but outputs the probability distribution of the latent variable, usually a Gaussian distribution. In this way, VAE can learn effective low-dimensional representations of the input data, which have good clustering properties in the latent space. Figure 7 As shown, VAE consists of an input layer, an encoder, a decoder, and an output layer.

[0099] Input data x for conditional distribution p θ The reconstruction of (z|x) is expressed as:

[0100] p θ (z|x)=pθ (z|x)p θ (z)p θ (x),

[0101] in, is the vector representation of the latent space;

[0102] The true posterior probability density p of the input data x θ (x) The calculation expression is:

[0103] p θ (x) = ∫p θ (z)p θ (x|z)dz;

[0104] Encoder q θ (z|x) and decoder The reconstruction loss expression is:

[0105]

[0106] in, is the expected negative log-likelihood for a given input, D KL (q φ (z|x)||p θ (z)) is the evaluation distribution q θ (z|x) and p θ (z) difference.

[0107] Among the spatial characteristics of multivariate time series data, the characteristics that characterize the current observation state have significant advantages, and making full use of historical prior knowledge can further enhance the data representation capabilities.

[0108] The schematic diagram of the RNN principle is as follows Figure 8 As shown in Figure 2, the output of each time step is used as the input of the next time step. This cyclic structure enables RNN to capture the temporal relationship in the data. t and the hidden state h of the previous time step t-1 Get the current hidden state h t .

[0109] LSTM introduces concepts such as memory cells, input gates, output gates, and forget gates, which enable it to perform excellently in processing long sequence problems. Memory cells are responsible for storing key information to ensure that important data in the sequence is not lost. The input gate determines whether to write the current input information into the memory cell so that it can be used in subsequent processing. The forget gate is responsible for determining which information in the memory cell needs to be retained and which information can be forgotten. Finally, the output gate determines whether to use the information in the memory cell as the current output result. The control strategies of these gates enable LSTM to effectively capture important long-term dependencies in the sequence while avoiding the problems of gradient vanishing and gradient exploding during gradient calculation. During the calculation process of LSTM,

[0110] The input gate calculation expression is:

[0111] i t =σ(w i ×[h t-1 ,x t ]+b i ),

[0112] Among them, x t is the input data, w i is the weight matrix, b i is the bias term, σ(·) is the Sigmoid activation function, and h t-1 is the output of the hidden layer at the previous moment;

[0113] The calculation expression of the forget gate is:

[0114] f t =σ(w f ×[h t-1 ,x t ]+b f ),

[0115] Among them, w f is the weight matrix, b f For paranoid items;

[0116] The memory unit update calculation expression is:

[0117] c t =f t ⊙c t-1 +i t ⊙τ(w c ×[h t-1 ,x t ]+b c ),

[0118] Among them, ⊙ is the calculation of HadamardProduct, f t is the output of the forget gate, i tis the output of the input gate, w c is the weight matrix, b c is the bias term, and τ(·) is the Tanh activation function. t-1 is the memory unit output of the previous moment;

[0119] The output gate calculation expression is:

[0120] o t =σ(w o ×[h t-1 ,x t ]+b o ),

[0121] Among them, w o is the weight matrix, b o For paranoid items;

[0122] The updated calculation expression of the hidden state is:

[0123] h t =o t ⊙τ(c t ),

[0124] Among them, t is the result of the current output gate, c t is the memory unit output at the current moment.

[0125] The core idea of ​​using convolutional long short-term memory network is to add convolutional layers to the LSTM loop structure, use convolution operations to capture local features and patterns in the spatial dimension, and use LSTM to learn long-term dependencies in sequence data in the temporal dimension. The main difference between Conv-LSTM and LSTM is the ability to process spatial information. Conv-LSTM combines the time series modeling ability of LSTM and the spatial feature extraction ability of CNN, making it suitable for processing time series data with obvious spatial structure. LSTM, on the other hand, focuses more on long-term dependencies in time series data and is suitable for modeling sequence data problems without obvious spatial structure or where spatial information is not a key factor.

[0126] The input gate calculation expression is:

[0127] i t =σ(w xi *x t +w hi *h t-1 +w ci ⊙c t-1 +b i ),

[0128] Among them, x t is the input data, wxi ,w hi ,w ci is the weight matrix, b i is the bias term, σ(·) is the Sigmoid activation function, and h t-1 is the output of the hidden layer at the previous moment, c t-1 is the memory unit output at the previous moment, ⊙ is the Hadamard Product calculation, and * is the convolution operation;

[0129] The calculation expression of the forget gate is:

[0130] f t =σ(w xf *x t +w hf *h t-1 +w cf ⊙c t-1 +b f ),

[0131] Among them, w xf ,w hf ,w cf is the weight matrix, b f For paranoid items;

[0132] The cell update calculation expression is:

[0133] c t =f t ⊙c t-1 +i t ⊙τ(w xc *x t +w hc *h t-1 +b c ),

[0134] Among them, f t is the output of the forget gate, w xc ,w hc is the weight matrix, i t is the output of the input gate, b c is the bias term, and τ(·) is the Tanh activation function. t-1 is the memory unit output of the previous moment;

[0135] The output gate calculation expression is: t =σ(w xo *x t +w ho *h t-1 +w co ⊙c t +b o ), where w xo ,who ,w co is the weight matrix, b o For paranoid items;

[0136] The updated calculation expression of the hidden state is: t =o t ⊙τ(c t ), where o t is the result of the current output gate, c t is the memory unit output at the current moment.

[0137] Furthermore, the detection and classification step also includes determining an abnormality threshold based on extreme value theory or exhaustive threshold, and judging the data situation based on whether the abnormality score exceeds the abnormality threshold.

[0138] Specifically, the data discriminant expression is:

[0139]

[0140] in, is the abnormal score calculation function, and λ is the abnormality discrimination threshold. i =1 indicates abnormality, y i =0 represents normal. Therefore, the core tasks of the abnormal data classification stage can be divided into the calculation of the anomaly score and the selection of the anomaly discrimination threshold, both of which have a significant impact on the performance improvement of the multivariate time series data anomaly detection model.

[0141] Furthermore, the anomaly score is calculated by comparing x and The difference between features is used as an anomaly score. The degree of difference is usually measured using metrics such as probability distribution difference, distance difference, or similarity.

[0142] CE is measured by the difference between the probability distribution output by the model and the true distribution. The CE calculation expression is:

[0143] λ=CE(P,Q)=-∑P(x)*log(Q(x)),

[0144] Among them, P(x) is the real data sample distribution, Q(x) is the data sample distribution output by the model;

[0145] Compared with CE, KL divergence is an asymmetric measure, which is the difference between probability distribution P(x) and probability distribution Q(x). Similar to the principle of CE, the calculation expression of KL divergence is:

[0146] λ=KL(P||Q)=∑P(x)*log(P(x) / Q(x));

[0147] The Minkowski distance expression is: Where P is a positive real number. When P<2, the Minkowski distance exhibits a "square root convex" characteristic, and the degree of penalty for larger differences is higher than that for smaller differences. It is more suitable when there are outliers or the data needs to be smoothed. Conversely, when P>2, the Minkowski distance exhibits a "square root concave" characteristic, and the degree of penalty for larger differences is lower than that for smaller differences. This distance metric can effectively reduce the sensitivity to outliers;

[0148] The cosine similarity metric expression is: A measure of the cosine of the angle between two vectors, which reflects how similar the two vectors are in direction.

[0149] Furthermore, the extreme value theory POT is specifically as follows: Since POT does not require assumptions about data distribution when the original data distribution is very complex, it is still possible to estimate the occurrence of abnormal events. Therefore, the POT method is selected to select the abnormal threshold, and the generalized Pareto distribution with parameters is used to fit the tail of the extreme value distribution to select the threshold λ, and the expression is:

[0150] F(Sc)=P(th-Sc|Sc>th)~(1+γs / β) -1 / γ ,

[0151] Among them, Sc is the anomaly score at a certain moment, th is the initial anomaly score threshold, β and γ are the shape and scale parameters of the GPD distribution, and is the approximation of β and γ estimated by maximum likelihood, q is the expected probability that the anomaly score is less than the threshold, Sc is the low quantile of the GPD distribution, and h is the data length of the anomaly score.

[0152] The exhaustive threshold is as follows: sort in descending order by behavior, select the sum of the top-ranked anomaly values ​​as the anomaly score of each sample, sort the sample data based on the anomaly score, assign a threshold for the specified comparison length sample, assign the actual anomaly score corresponding to the threshold, assign the model evaluation index corresponding to the threshold, calculate the actual performance of the N assigned thresholds, store the intermediate process, select the index with the largest index value, and obtain the value in the actual anomaly score as the optimal threshold based on the index. The algorithm is as follows:

[0153] Optimal Threshold γ Selection Algorithm for Anomaly Detection

[0154]

[0155] Furthermore, the detection and classification step also includes using a confusion matrix to measure the anomaly detection performance.

[0156] Specifically, the true categories in the data set and the categories predicted by the model are summarized in the form of a matrix, where the rows of the confusion matrix represent the true values ​​and the columns represent the predicted values, as shown in Table 1. In the anomaly detection process, positive examples correspond to normal data, and negative examples correspond to abnormal data.

[0157] Table 1 Confusion matrix

[0158]

[0159] Among them, True Positive (TP) means that the model prediction is consistent with the actual positive example result. False Negative (FN) means that the model predicts a negative example, but the actual result is a positive example. False Positive (FP) means that the model predicts a positive example, but the actual result is a negative example. False Negative (TN) means that the model predicts a negative example, but the actual result is a negative example.

[0160] Furthermore, the indicator measurement model is as follows:

[0161] 1. Precision (Pre): The ratio of the positive examples correctly predicted by the model to the total number of positive examples, which reflects the accuracy of the anomaly detection model for the existing prediction results. The expression is:

[0162] Pre = TP / (TP+FP);

[0163] 2. Recall (Rec): The ratio of the positive examples correctly predicted by the model to the actual positive examples, which reflects the accuracy of the anomaly detection model in predicting true anomalies. The expression is:

[0164] Rec = TP / (TP+FN);

[0165] 3. F1 (F Score, F Score ), since Pre and Rec are negatively correlated, F Score is the harmonic mean of the two, where β focuses on Pre and Rec. In the anomaly detection task, it is expected that Pre and Rec are equally important, so F Score β=1, that is, F1, and the expression is:

[0166] F Score =(1+b 2 )(Pre Rec) / (b 2 Pre+Rec);

[0167] 4. AUC (Area Under the ROC Curve) is the area under the ROC curve. Randomly sample positive samples PTrue and negative samples PFalse, use the anomaly detection model to predict, and predict that the probability of positive samples is greater than the probability of negative samples. AUC = P(P True >P False ), the expression is:

[0168]

[0169] Where M is the number of positive samples and N is the number of negative samples. The higher the AUC value, the better the anomaly detection model performance.

[0170] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can refer to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system or system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can refer to the partial description of the method embodiment. The system and system embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without creative work.

[0171] The above description of the disclosed embodiments enables one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A multivariate time series data anomaly detection method based on a coupling network, characterized in that: The following steps are involved: Sample acquisition step: obtain labeled data samples of normal operation and abnormal operation of the information system as labeled data samples, and data samples of unknown operation status of the information system as unlabeled data samples; Data construction steps: Labeled data samples are mixed according to a preset ratio, and unlabeled data samples are combined according to specific rules to form a sample data set; Data preprocessing step: preprocess the sample data set by using data standardization and data dimension reduction, and generate a training data set according to a certain ratio; Rule learning steps: Build a deep learning model, input the original data in the training data set into the deep learning model to learn the data sample features, dynamically adjust the model parameters, obtain the trained deep learning model and generate feature data; Detection and classification step: compare the difference between the original data and the feature data as the anomaly score, and judge the abnormal data and the difference data based on the anomaly score.

2. According to the method for detecting anomalies of multivariate time series data based on coupling network in claim 1, it is characterized in that: In the data construction step, the construction methods include: full batch construction, batch construction, bagged construction, scenario construction, graph structure construction and sliding window construction.

3. The method for detecting anomalies of multivariate time series data based on a coupling network according to claim 1, characterized in that: In the data preprocessing step, data specification is used to perform dimensionless processing on variables, including: data standardization, data normalization, and data regularization; Data dimensionality reduction is used to reduce data dimensions to 1, 2, or 3 dimensions, including: PCA, t-SNE, and UMAP.

4. The method for detecting anomalies of multivariate time series data based on a coupling network according to claim 1, characterized in that: The data sample features learned in the rule learning step include spatial features, temporal features, and spatiotemporal features.

5. The method for detecting anomalies of multivariate time series data based on a coupling network according to claim 1, characterized in that: The detection and classification step also includes determining an anomaly threshold based on extreme value theory or an exhaustive threshold, and judging the data situation based on whether the anomaly score exceeds the anomaly threshold.

6. The method for detecting anomalies of multivariate time series data based on a coupling network according to claim 1, characterized in that: The detection and classification step also includes using a confusion matrix to measure the anomaly detection performance.

Images