Abnormality detection method and device for time series data, and storage medium

Abstract

The invention discloses a time series data anomaly detection method and device and a storage medium. In the method, a plurality of key indexes of the time sequence data in a specific time period can be comprehensively considered, and the key indexes comprise an amplitude difference (namely, a difference between a maximum value and a minimum value of the data in the time period), an accumulated amplitude sum, an over-average value rate, a crest value and a trough value. And aiming at the indexes, calculation is carried out according to different time window scales, so that a multi-dimensional index system is formed. According to the abnormal indexes obtained through multi-dimension calculation, tiny abnormal intervals can be detected more sensitively. And different index values can be screened by calculating a standard score sequence, so that the influence of abnormal values in the index values can be effectively removed.

Description

Technical Field

[0001] The present invention relates to the technical field of data processing and analysis, and in particular to a method, device, and storage medium for detecting anomalies in time series data. Background Art

[0002] In today's big data era, time series data, as an important data type, is widely present in various fields, such as finance, medical care, industry, transportation, etc. Time series data refers to data collected in chronological order. Each data point is associated with a specific time point, and these data points are usually measured and recorded at uniform time intervals. For example: daily stock prices, monthly sales, annual population, etc. With the development of science and technology and the advancement of data collection technology, the magnitude and complexity of time series data are constantly increasing, and the demand for data analysis and mining is becoming increasingly urgent.

[0003] Among them, anomaly detection, as one of the mainstream applications in time series data analysis, aims to identify abnormal events or behaviors from normal time series. Accurate anomaly detection technology has a wide range of application value in the real world, which can involve many fields such as quantitative trading, network security detection, self-driving cars, and daily maintenance of large industrial equipment. Taking on-orbit spacecraft as an example, due to the expensive cost and complex system of spacecraft, failure to detect danger may cause serious or even irreparable damage, and anomalies may develop into serious failures at any time. Therefore, accurate and timely anomaly detection is crucial to remind aerospace engineers to take measures as soon as possible.

[0004] At present, the commonly used method for anomaly detection for time series data is the standard score outlier detection method, which is an outlier detection technology based on statistical principles. This method determines whether a data point is an outlier by calculating the standardized distance between the data point and the mean of the data set. However, this method has certain limitations. In time series data, the mean and standard deviation are greatly affected by outliers, especially when the calculation time window is small, the standard deviation will be more unstable, which may lead to reduced accuracy of anomaly detection and cannot meet the needs of high-precision anomaly detection in practical applications. Summary of the invention

[0005] This specification provides a method, device, and storage medium for detecting anomalies in time series data to partially solve the above-mentioned problems existing in the prior art.

[0006] This manual adopts the following technical solutions: This specification provides a method for detecting anomalies in time series data, including: Obtain a reference index value sequence of multiple dimensions corresponding to the to-be-detected point in the target time series data; wherein the reference index value sequence includes an index value of at least one reference point; the time interval between the reference point and the to-be-detected point is within a specified range; the index value of the reference point is used to reflect the fluctuation characteristics or statistical characteristics of the target time series data at the reference point; For each dimension, a standard score value of the point to be detected is determined according to the reference indicator value sequence of the dimension and the indicator value of the point to be detected; the standard score value is used to reflect the relative deviation of the indicator value of the point to be detected in the overall data distribution composed of the indicator value of the point to be detected and each indicator value in the reference indicator value sequence; A global standard score value is determined according to each standard score value corresponding to the point to be detected, and whether the point to be detected has an abnormality is determined according to the global standard score value.

[0007] Optionally, the index value of each dimension includes at least one of the amplitude difference calculated at different time window scales, the cumulative amplitude value calculated at different time window scales, the over-average rate calculated at different time window scales, the peak value calculated at different time window scales, the trough value calculated at different time window scales, and the peak-to-trough difference calculated at different time window scales.

[0008] Optionally, determining a standard score value of the point to be detected according to the reference indicator value sequence of the dimension and the indicator value of the point to be detected specifically includes: According to the standard score value of each reference point in the reference indicator value sequence of the dimension, the reference indicator value sequence of the dimension is filtered to obtain a filtered indicator value sequence; The standard score value of the point to be detected is determined according to the filtered indicator value sequence and the indicator value of the point to be detected.

[0009] Optionally, filtering the reference indicator value sequence of the dimension according to the standard score value of each reference point in the reference indicator value sequence of the dimension to obtain a filtered indicator value sequence specifically includes: For each reference point in the reference indicator value sequence of the dimension, determine whether the standard score value of the reference point corresponding to the dimension exceeds a preset screening threshold; If not, the index value of the reference point in the dimension is retained in the filtered index value sequence.

[0010] Optionally, determining the standard score value of the point to be detected according to the filtered indicator value sequence and the indicator value of the point to be detected specifically includes: If it is determined that the number of indicator values ​​included in the filtered indicator value sequence is less than a preset number threshold, determining that the standard score value of the point to be detected corresponding to the dimension is a preset maximum standard score value; Otherwise, the standard score value of the point to be detected corresponding to the dimension is determined according to the statistical characteristic value of each indicator value contained in the filtered indicator value sequence and the indicator value of the point to be detected under the dimension.

[0011] Optionally, determining a global standard score value according to each standard score value corresponding to the point to be detected specifically includes: The maximum value among the standard score values ​​corresponding to the points to be detected is taken as the global standard score value.

[0012] Optionally, the method further comprises: The standard score values ​​corresponding to the point to be detected are input into a preset anomaly detection model to obtain an anomaly detection result of the point to be detected, and the anomaly detection result is used to characterize whether there is an anomaly at the point to be detected.

[0013] Optionally, determining whether the point to be detected has an abnormality according to the global standard score value specifically includes: Determining whether the global standard score value is higher than a preset reference threshold; If so, then determine the time-related reference points of the point to be detected. When it is determined that the global standard score values ​​of the time-related reference points are all higher than the reference threshold, it is determined that there is an abnormality in the point to be detected; the time interval between the time-related reference point and the point to be detected is within the preset associated time range.

[0014] This specification provides a time series data anomaly detection device, comprising: An acquisition module is used to acquire a reference index value sequence of multiple dimensions corresponding to a point to be detected in the target time series data; wherein the reference index value sequence includes an index value of at least one reference point; the time interval between the reference point and the point to be detected is within a specified range; the index value of the reference point is used to reflect the fluctuation characteristics or statistical characteristics of the target time series data at the reference point; A determination module, for determining, for each dimension, a standard score value of the point to be detected according to a reference indicator value sequence of the dimension and the indicator value of the point to be detected; the standard score value is used to reflect the relative deviation of the indicator value of the point to be detected in the overall data distribution constituted by the indicator value of the point to be detected and each indicator value in the reference indicator value sequence; The detection module is used to determine a global standard score value according to each standard score value corresponding to the point to be detected, and determine whether the point to be detected has an abnormality according to the global standard score value.

[0015] This specification provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the above-mentioned anomaly detection method for time series data is implemented.

[0016] This specification provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned method for detecting anomalies in time series data when executing the program.

[0017] At least one of the above technical solutions adopted in this specification can achieve the following beneficial effects: In the anomaly detection method for time series data provided in the present specification, first, a reference indicator value sequence of multiple dimensions corresponding to the point to be detected in the target time series data is obtained, wherein the reference indicator value sequence includes an indicator value of at least one reference point, and the time interval between the reference point and the point to be detected is within a specified range. The indicator value of the reference point is used to reflect the fluctuation characteristics or statistical characteristics of the target time series data at the reference point. For each dimension, the standard score value of the point to be detected is determined according to the reference indicator value sequence of the dimension and the indicator value of the point to be detected. The standard score value is used to reflect the relative deviation of the indicator value of the point to be detected in the overall data distribution constituted by the indicator value of the point to be detected and each indicator value in the reference indicator value sequence. According to each standard score value corresponding to the point to be detected, a global standard score value is determined, and according to the global standard score value, it is determined whether there is an abnormality in the point to be detected.

[0018] It can be seen from the above method that in this method, not only can the reference index value sequence of the point to be detected in multiple different dimensions be extracted for accurate detection of data points contained in small abnormal intervals, but also a standard score value can be introduced for each point to be detected, so as to determine the global standard score value of the point to be detected after comprehensively considering the reference index value sequence of each dimension and the data characteristics reflected by the index value of the point to be detected, so that when performing anomaly detection on the target time series data, the deviation can be effectively removed to ensure the accuracy and reliability of the anomaly detection results. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The drawings described herein are used to provide a further understanding of this specification and constitute a part of this specification. The illustrative embodiments and descriptions of this specification are used to explain this specification and do not constitute an improper limitation on this specification. In the drawings: Figure 1A flowchart of a method for detecting anomalies in time series data provided in this specification; Figure 2A A schematic diagram of the first and second indicator value sequences provided in this specification; Figure 2B Schematic diagram of the third and fourth indicator value sequences provided in this specification; Figure 2C Schematic diagram of the fifth and sixth indicator value sequences provided in this specification; Figure 3 A schematic diagram of a global standard score sequence provided in this specification; Figure 4 A schematic diagram of the anomaly detection process provided in this specification; Figure 5 A schematic diagram of a device for detecting anomalies in time series data provided in this specification; Figure 6 A method corresponding to the Figure 1 Schematic diagram of electronic equipment. DETAILED DESCRIPTION

[0020] In order to make the purpose, technical solutions and advantages of this specification more clear, the technical solutions of this specification will be clearly and completely described below in combination with the specific embodiments of this specification and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of this specification, not all of them. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this specification.

[0021] At present, time series data is a type of structured data with time-dependent characteristics. The observation values ​​of its data points strictly correspond to specific time points and present continuous observation characteristics in equally spaced sampling scenarios (such as minute-level sensor readings, daily financial indicators, monthly economic statistics, etc.). This type of data constitutes the core analysis object in key areas such as industrial monitoring, financial transactions, and spacecraft operation and maintenance. Among them, anomaly detection technology, as one of the core tasks of time series analysis, aims to identify data points or event sequences that deviate from normal patterns through algorithm models, thereby achieving risk warning and decision support.

[0022] Taking the health management of on-orbit spacecraft as an example, the time series generated by its sensor network (such as attitude angle, propellant pressure, and thermal control temperature) need to be monitored in real time for micro-anomalies to prevent catastrophic failures. Although the existing standard score method can detect some obvious anomalies (such as sudden change outliers caused by sensor failure), it is not sensitive enough to identify early slow-changing anomalies (such as trend shifts caused by progressive degradation of components), and it is easy to cause the missed detection rate to rise due to statistical distortion in a high-noise background. In addition, the working conditions of spacecraft change frequently during their on-orbit missions, and the fixed parameterized detection model is difficult to accurately identify the anomalies in the time series data, which further restricts the reliability of the detection results and poses a major operation and maintenance risk to high-value aerospace assets.

[0023] The technical solutions provided by the embodiments of this specification are described in detail below in conjunction with the accompanying drawings.

[0024] Figure 1 The following is a flow chart of a method for detecting anomalies in time series data provided in this specification, comprising the following steps: S101: Obtain a reference indicator value sequence of multiple dimensions corresponding to the points to be detected in the target time series data; wherein the reference indicator value sequence includes an indicator value of at least one reference point; the time interval between the reference point and the acquisition of the point to be detected is within a specified range; the indicator value of the reference point is used to reflect the fluctuation characteristics or statistical characteristics of the target time series data at the reference point.

[0025] In this specification, the business platform can perform anomaly detection on the points to be detected contained in the collected target time series data, and send an alarm message when it is determined that the points to be detected have an abnormality, so that business personnel can perform exception handling tasks based on the alarm information.

[0026] Specifically, the target time series data mentioned above can be complete time series data collected in advance. At this time, the business platform can use each data point contained in the target time series data as a point to be detected, and then obtain a reference indicator value sequence of multiple dimensions corresponding to the point to be detected, so as to determine whether there is an abnormality in the target time series data at the point to be detected based on the reference indicator value sequence of multiple dimensions corresponding to the point to be detected.

[0027] Among them, the above-mentioned reference indicator value sequence includes the indicator value of at least one reference point, where the time interval between the reference point and the point to be detected is within the specified range. In other words, the interval between the time point of collecting the reference point and the time point of collecting the point to be detected is within the specified range.

[0028] For example: if the above target time series data consists of 10 data points (i.e., data points collected by the sensor from the 1st second to the 10th second), the point to be detected is the data point collected at the 6th second in the target time series data. At this time, the business platform can use the data points whose time intervals are within the specified range between the time points corresponding to the points to be detected (e.g., when the specified range is within 2 seconds, the data points within the specified range are the data points collected at the 4th second, 5th second, 7th second, and 8th second in the target data) as reference points for the points to be detected according to actual needs. These reference points together constitute the reference time period data sequence corresponding to the points to be detected, and the index values ​​corresponding to each of these reference points together constitute the reference index value sequence corresponding to the points to be detected.

[0029] Furthermore, in order to be able to detect tiny abnormal intervals contained in the target time series data, the index value of each data point contained in the above-mentioned target time series data can be an index value of different dimensions, and the index value of each dimension here can include: amplitude difference (i.e., the difference between the maximum amplitude value and the minimum amplitude value in the preset time window), cumulative amplitude value (i.e., the cumulative sum of the absolute values ​​of the difference between the amplitude values ​​of every two adjacent data points in the preset time window), over-mean rate (i.e., among the data points contained in the preset time window, the values ​​of two adjacent data points are respectively located on different sides of the average value of the entire target time series data, that is, the ratio of the number of times that the value of one data point is higher than the average value and the value of the other data point is lower than the average value to the maximum possible over-mean number of the target time series data), peak value (i.e., the maximum peak value contained in the preset time window), trough value (i.e., the minimum trough value contained in the preset time window), peak-to-trough difference (i.e., the cumulative sum of the differences between all adjacent peak values ​​and trough values ​​contained in the preset time window).

[0030] It should be noted that when the time window scales of the above-mentioned time windows are different, the sensitivity of detecting tiny abnormal intervals contained in the target time series data is also different. Therefore, the index value of each dimension mentioned above may also include at least one of the amplitude difference calculated at different time window scales, the cumulative amplitude value calculated at different time window scales, the over-mean rate calculated at different time window scales, the peak value calculated at different time window scales, the trough value calculated at different time window scales, and the peak-to-valley difference calculated at different time window scales.

[0031] For example, the amplitude difference of the data points determined by the time window with a time window scale of 10 and the amplitude difference of the data points determined by the time window with a time window scale of 20 are the indicator values ​​of the two dimensions.

[0032] For another example, the amplitude difference of the data points determined by the time window with a time window scale of 10 and the cumulative amplitude value of the data points determined by the time window with a time window scale of 10 can also be indicator values ​​of two dimensions.

[0033] Based on this, for each dimension, the index values ​​of each reference point in the target time series data under this dimension together constitute a reference index value sequence corresponding to the point to be detected. It can be understood that the business platform can obtain multiple reference index value sequences of the point to be detected, and different reference index value sequences contain index values ​​of different dimensions, such as Figure 2A , Figure 2B , Figure 2C shown.

[0034] Figure 2A A schematic diagram of the first and second indicator value sequences provided in this specification.

[0035] exist Figure 2A In the figure, 100 is the target time series data, 101 is the indicator value sequence composed of the amplitude difference values ​​calculated on one time window scale for each data point contained in the target time series data, and 102 is the indicator value sequence composed of the amplitude difference values ​​calculated on another time window scale for each data point contained in the target time series data.

[0036] Figure 2B This is a schematic diagram of the third and fourth indicator value sequences provided in this specification.

[0037] exist Figure 2B 201 is an indicator value sequence composed of the cumulative amplitude values ​​calculated on a time window scale for each data point included in the target time series data, and 202 is an indicator value sequence composed of the cumulative amplitude values ​​calculated on another time window scale for each data point included in the target time series data.

[0038] Figure 2C This is a schematic diagram of the fifth and sixth indicator value sequences provided in this specification.

[0039] exist Figure 2B 301 is the index value sequence composed of the peak-to-valley difference calculated on a time window scale for each data point included in the target time series data, and 302 is the index value sequence composed of the peak-to-valley difference calculated on another time window scale for each data point included in the target time series data. By analogy, the business platform can obtain the reference index value sequences of multiple dimensions corresponding to the points to be detected in the target time series data according to actual needs, and this specification will not list them one by one here.

[0040] It should be noted that in application scenarios such as on-orbit spacecraft health management, it is often necessary to monitor the time series data (such as attitude angle, propellant pressure, thermal control temperature) generated by the sensor network in real time for micro-anomalies to prevent catastrophic failures.

[0041] At this time, the business platform can also use the time series data that needs to be collected through the sensor network as the target time series data. In the process of collecting the target time series data through the sensor network, each newly collected data point can be used as the point to be detected, and at least part of the data points that have been collected before the point to be detected that constitute the target time series data can be used as the reference point of the point to be detected. According to the reference point of the point to be detected, the point to be detected can be detected in real time for anomalies, so as to timely discover possible anomalies in the point to be detected and send alarm information, thereby avoiding losses.

[0042] For example, if the above-mentioned point to be detected is the data point at the 6th second in the target time series data, the business platform can use the data points that have been collected before the point to be detected and that constitute the target time series data and whose time intervals with the time points corresponding to the point to be detected are within the specified range as the reference points of the point to be detected. For example, when the specified range is within 3 seconds, the reference points of the point to be detected can be the data points at the 3rd, 4th, and 5th seconds in the target time series data that have been collected.

[0043] In this specification, the execution entity used to implement the anomaly detection method for time series data may refer to a designated device such as a server set up on a business platform, or may refer to a terminal device such as a desktop computer or a laptop computer. For the sake of ease of description, the following only takes the server as the execution entity as an example to illustrate the anomaly detection method for time series data provided in this specification.

[0044] S102: For each dimension, determine the standard score value of the point to be detected based on the reference indicator value sequence of the dimension and the indicator value of the point to be detected; the standard score value is used to reflect the relative deviation of the indicator value of the point to be detected in the overall data distribution constituted by the indicator value of the point to be detected and each indicator value in the reference indicator value sequence.

[0045] From the above content, it can be seen that the server can use each data point in the target time series data as the point to be detected, and calculate the index values ​​of different dimensions of the point to be detected according to different time window scales. And according to the index values ​​of each reference point of the point to be detected in different dimensions, multiple reference index value sequences corresponding to the point to be detected can be obtained. Then, according to the index values ​​of different dimensions of the point to be detected and the reference index value sequences of multiple dimensions corresponding to the point to be detected, the point to be detected can be detected for abnormality.

[0046] Among them, the server can determine the standard score value of the point to be detected corresponding to the dimension for the indicator value of each dimension according to the reference indicator value sequence of the dimension and the indicator value of the point to be detected under the dimension (the standard score value here is used to reflect the relative deviation of the indicator value of the point to be detected in the overall data distribution composed of the indicator value of the point to be detected and the indicator values ​​in the reference indicator value sequence), for use in anomaly detection for the point to be detected.

[0047] Specifically, the server may filter the reference indicator value sequence of each dimension according to the standard score value of each reference point in the reference indicator value sequence of the dimension to obtain a filtered indicator value sequence. Then, the standard score value of the point to be detected corresponding to the dimension may be determined according to the filtered indicator value sequence and the indicator value of the point to be detected under the dimension.

[0048] The server filters the reference indicator value sequence of the dimension, and the method for obtaining the filtered indicator value sequence may be to determine, for each reference point in the reference indicator value sequence of the dimension, whether the standard score value of the reference point corresponding to the dimension exceeds a preset screening threshold (the screening threshold here may be a priori parameter set in advance according to actual needs). If not, the indicator value of the reference point in the dimension is retained in the filtered indicator value sequence.

[0049] It should be noted that in the field of on-orbit spacecraft health monitoring, when the collected spacecraft telemetry data is used as the target time series data, since the spacecraft telemetry data usually does not strictly follow the normal distribution, it may show skewed distribution, heavy-tailed distribution and other characteristics, which may lead to the presence of more outliers and noise in the spacecraft telemetry data, and thus make it easy for abnormal data to be mixed into each reference point in the above reference indicator value sequence. In order to improve the accuracy of screening out abnormal data from each reference point in the above reference indicator value sequence, the above screening threshold can be set to 4 to reduce the false positive rate and missed positive rate of abnormal detection and ensure the reliable operation of the spacecraft.

[0050] In actual application scenarios, there may be an abnormal situation where the filtered indicator value sequence is empty. In this case, when the server determines that the number of indicator values ​​included in the filtered indicator value sequence is less than the preset number threshold, it determines that the standard score value of the point to be detected corresponding to the dimension is the preset maximum standard score value (the maximum standard score value here can be a preset priori parameter).

[0051] Otherwise, the server can determine the standard score value of the point to be detected corresponding to the dimension according to the statistical characteristic value of each indicator value contained in the filtered indicator value sequence and the indicator value of the point to be detected under the dimension. For details, refer to the following formula:

[0052]

[0053]

[0054] In the above formula, That is, the average value of each indicator value contained in the filtered indicator value sequence. That is, the standard deviation of each indicator value contained in the filtered indicator value sequence. That is, the nth indicator value in the filtered indicator value sequence. The point to be detected corresponds to the standard score value of the dimension.

[0055] It can be seen from the above formula that the server can calculate the standard score value of the point to be detected corresponding to each reference indicator value sequence corresponding to the point to be detected based on the reference indicator value sequence through the above method.

[0056] It should be noted that Figure 2A 103 is a standard score value sequence composed of the standard score value of each data point contained in the target time series data calculated according to a reference indicator value sequence 101 of the target time series data. Figure 2A 104 in the figure is a standard score value sequence composed of the standard score values ​​of each data point contained in the target time series data calculated according to a reference indicator value sequence 102 of the target time series data. By analogy, it can be known that Figure 2B , Figure 2C 203, 204, 303, 304 are the standard score value sequences corresponding to the target time series data.

[0057] S103: Determine a global standard score value according to each standard score value corresponding to the point to be detected, and determine whether the point to be detected has an abnormality according to the global standard score value.

[0058] Furthermore, after determining the standard score values ​​corresponding to the points to be detected, the server can determine the global standard score value according to the standard score values ​​corresponding to the points to be detected, and perform anomaly detection on the points to be detected according to the global standard score value to obtain an anomaly detection result of the points to be detected. The anomaly detection result here is used to reflect whether there is an anomaly at the points to be detected. Figure 3 shown.

[0059] Figure 3 A schematic diagram of the global standard score sequence provided in this specification.

[0060] exist Figure 3In the example, 401 is a global standard score value sequence composed of the global standard score value corresponding to each data point included in the target time series data. The length of the global standard score value sequence here is the same as the length of the target time series data.

[0061] There are two methods for the server to determine the global standard score value according to the standard score values ​​corresponding to the points to be detected. The following describes these two methods in detail.

[0062] The first method may be that the server may determine the global standard score value according to the standard score values ​​corresponding to the points to be detected according to the preset calculation rules. The above calculation rules may be set according to actual needs.

[0063] For example: the maximum value among the standard score values ​​corresponding to the points to be detected is used as the global standard score value.

[0064] For another example: if it is determined that the standard score values ​​corresponding to the point to be detected meet the preset rules (the rules here can be: when it is determined that there is one standard score value greater than 5 among the standard score values, it can be regarded as meeting the preset rules, or, when it is determined that there are at least two standard score values ​​greater than 4 among the standard score values, it can be regarded as meeting the preset rules, or, when it is determined that there are at least three standard score values ​​greater than 3 among the standard score values, it can be regarded as meeting the preset rules), the preset specified global standard score value can be determined as the global standard score value corresponding to the point to be detected.

[0065] The second method may be to input each standard score value corresponding to the point to be detected into a preset anomaly detection model to obtain an anomaly detection result of the point to be detected.

[0066] It should be noted that the above-mentioned anomaly detection model needs to be trained before it can be deployed to the server. The method for training the above-mentioned anomaly detection model can be to obtain the standard score values ​​of each sample corresponding to the sample detection point, and obtain the actual anomaly detection result corresponding to the sample detection point, and input the standard score values ​​of each sample corresponding to the sample detection point into the preset anomaly detection model to obtain the reference anomaly detection result, and then determine the target loss value according to the deviation between the reference anomaly detection result and the actual anomaly detection result (the deviation between the reference anomaly detection result and the actual anomaly detection result is positively correlated with the target loss value), and train the anomaly detection model with minimizing the target loss value as the training goal to obtain the trained anomaly detection model.

[0067] Furthermore, the server performs anomaly detection on the point to be detected according to the global standard score value. The method for obtaining the anomaly detection result of the point to be detected can be that the server can determine whether the global standard score value is higher than the preset reference threshold value. If so, the server determines the time-related reference points of the point to be detected. When the global standard score values ​​of the time-related reference points are all higher than the reference threshold value, it is determined that the point to be detected has an anomaly. The time interval between the time-related reference point and the point to be detected is within the preset associated time range. The associated time range and the reference threshold value can be a priori parameters determined in advance according to actual needs. Specifically, Figure 4 shown.

[0068] Figure 4 A schematic diagram of the anomaly detection process provided in this specification.

[0069] Combination Figure 4 It can be seen that when the server determines that the global standard score values ​​corresponding to the reference points before the point to be detected are continuously greater than the reference threshold within the preset associated time range, it can be determined that the global standard score values ​​contained in the associated time range between the point to be detected and the point to be detected that are greater than the preset reference threshold together constitute the abnormal interval in the target time series data.

[0070] For example: From Figure 4 It can be seen that Figure 4 501, 502, 503, 504, and 505 are the candidate abnormal intervals whose global standard score values ​​are greater than the reference threshold in the global standard score value sequence corresponding to the target time series data. Among them, since the time range corresponding to the data points constituting the candidate abnormal interval 501 is smaller than the above-mentioned associated actual range, the data points constituting the candidate abnormal interval 501 are not abnormal data points, while the data points constituting the candidate abnormal intervals 502, 503, 504, and 505 are abnormal data points.

[0071] From the above method, it can be seen that the server not only considers the amplitude difference of the time series data within a certain time period (that is, the difference between the maximum and minimum values ​​of the data within the time period), but also comprehensively analyzes the cumulative amplitude sum, the rate of over-average, the peak value and the trough value. These indicators reflect the fluctuation characteristics and statistical characteristics of the time series data from different angles, forming a comprehensive multi-dimensional indicator system. In addition, the server can also calculate the above indicators on different time scales, so that the server can capture the changing trends and abnormal characteristics of the time series data in different time windows. For example, a short-term window can capture sudden anomalies, while a long-term window can detect trend anomalies.

[0072] On this basis, in order to further improve the accuracy of detection, the server can also introduce a standard score sequence for each dimension. By calculating the standard score of each data point, the influence of outliers can be effectively removed when calculating the mean and standard deviation, making the statistical analysis more robust and reliable.

[0073] The above are one or more implementations of the anomaly detection method for time series data of this specification. Based on the same idea, this specification also provides a corresponding anomaly detection device for time series data, such as Figure 5 shown.

[0074] Figure 5 A schematic diagram of a time series data anomaly detection device provided in this specification includes: The acquisition module 501 is used to acquire a reference index value sequence of multiple dimensions corresponding to the to-be-detected point in the target time series data; wherein the reference index value sequence includes an index value of at least one reference point; the time interval between the reference point and the to-be-detected point is within a specified range; the index value of the reference point is used to reflect the fluctuation characteristics or statistical characteristics of the target time series data at the reference point; A determination module 502 is used to determine, for each dimension, a standard score value of the point to be detected according to the reference indicator value sequence of the dimension and the indicator value of the point to be detected; the standard score value is used to reflect the relative deviation of the indicator value of the point to be detected in the overall data distribution constituted by the indicator value of the point to be detected and each indicator value in the reference indicator value sequence; The detection module 503 is used to determine a global standard score value according to each standard score value corresponding to the point to be detected, and determine whether the point to be detected has an abnormality according to the global standard score value.

[0075] Optionally, the index value of each dimension includes at least one of the amplitude difference calculated at different time window scales, the cumulative amplitude value calculated at different time window scales, the over-average rate calculated at different time window scales, the peak value calculated at different time window scales, the trough value calculated at different time window scales, and the peak-to-trough difference calculated at different time window scales.

[0076] Optionally, the determination module 502 is specifically used to filter the reference indicator value sequence of the dimension according to the standard score value of each reference point in the reference indicator value sequence of the dimension to obtain a filtered indicator value sequence; determine the standard score value of the point to be detected according to the filtered indicator value sequence and the indicator value of the point to be detected.

[0077] Optionally, the determination module 502 is specifically used to determine, for each reference point in the reference indicator value sequence of the dimension, whether the standard score value of the reference point corresponding to the dimension exceeds a preset filtering threshold; if not, retaining the indicator value of the reference point under the dimension in the filtered indicator value sequence.

[0078] Optionally, the determination module 502 is specifically used to, if it is determined that the number of indicator values ​​contained in the filtered indicator value sequence is less than a preset number threshold, determine that the standard score value of the point to be detected corresponding to the dimension is a preset maximum standard score value; otherwise, determine the standard score value of the point to be detected corresponding to the dimension based on the statistical characteristic values ​​of each indicator value contained in the filtered indicator value sequence and the indicator value of the point to be detected under the dimension.

[0079] Optionally, the detection module 503 is specifically configured to use the maximum value of each standard score value corresponding to the point to be detected as the global standard score value.

[0080] Optionally, the detection module 503 is specifically used to input each standard score value corresponding to the point to be detected into a preset anomaly detection model to obtain an anomaly detection result of the point to be detected, and the anomaly detection result is used to characterize whether there is an anomaly at the point to be detected.

[0081] Optionally, the detection module 503 is specifically used to determine whether the global standard score value is higher than a preset reference threshold; if so, determine each time-related reference point of the point to be detected, and when it is determined that the global standard score value of each time-related reference point is higher than the reference threshold, it is determined that there is an abnormality in the point to be detected; the time interval between the time-related reference point and the point to be detected is within a preset associated time range.

[0082] This specification also provides a computer-readable storage medium, which stores a computer program, which can be used to execute the above Figure 1 A method for anomaly detection in time series data is provided.

[0083] This manual also provides Figure 6 The one shown corresponds to Figure 1 A schematic diagram of the electronic device. Figure 6 As mentioned above, at the hardware level, the electronic device includes a processor, an internal bus, a network interface, a memory, and a non-volatile memory, and may also include other hardware required for the business. The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs it to achieve the above Figure 1The anomaly detection method for time series data. Of course, in addition to the software implementation, this specification does not exclude other implementation methods, such as logic devices or a combination of software and hardware, etc., that is, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0084] For the improvement of a technology, it can be clearly distinguished whether it is a hardware improvement (for example, improvement of the circuit structure of diodes, transistors, switches, etc.) or a software improvement (improvement of the method flow). However, with the development of technology, many improvements of the method flow today can be regarded as direct improvements of the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that the improvement of a method flow cannot be implemented with a hardware entity module. For example, a programmable logic device (PLD) (such as a field programmable gate array (FPGA)) is such an integrated circuit whose logical function is determined by the user's programming of the device. Designers can "integrate" a digital system on a PLD by programming themselves, without having to ask chip manufacturers to design and make dedicated integrated circuit chips. Moreover, nowadays, instead of manually making integrated circuit chips, this kind of programming is mostly implemented by "logic compiler" software, which is similar to the software compiler used when developing and writing programs, and the original code before compilation must also be written in a specific programming language, which is called hardware description language (HDL). There is not only one kind of HDL, but many kinds, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used ones are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also know that it is only necessary to program the method flow slightly in the above-mentioned hardware description languages ​​and program it into the integrated circuit, and then it is easy to obtain the hardware circuit that implements the logic method flow.

[0085] The controller may be implemented in any suitable manner, for example, the controller may take the form of a microprocessor or processor and a computer-readable medium storing a computer-readable program code (e.g., software or firmware) executable by the (micro)processor, a logic gate, a switch, an application-specific integrated circuit (ASIC), a programmable logic controller, and an embedded microcontroller, examples of which include but are not limited to the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320, and the memory controller may also be implemented as part of the control logic of the memory. It is also known to those skilled in the art that, in addition to implementing the controller in a purely computer-readable program code manner, the controller may be implemented in the form of a logic gate, a switch, an application-specific integrated circuit, a programmable logic controller, and an embedded microcontroller by logically programming the method steps. Therefore, such a controller may be considered as a hardware component, and the devices for implementing various functions included therein may also be considered as structures within the hardware component. Or even, the devices for implementing various functions may be considered as both software modules for implementing the method and structures within the hardware component.

[0086] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0087] For the convenience of description, the above device is described in various units according to their functions. Of course, when implementing this specification, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0088] Those skilled in the art will appreciate that the embodiments of this specification may be provided as methods, systems, or computer program products. Therefore, this specification may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0089] This specification is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of this specification. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0090] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0091] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0092] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0093] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0094] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0095] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0096] It should be understood by those skilled in the art that the embodiments of this specification may be provided as methods, systems or computer program products. Therefore, this specification may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0097] This specification may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. This specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0098] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0099] The above description is only an embodiment of the present specification and is not intended to limit the present specification. For those skilled in the art, the present specification may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present specification shall be included in the scope of the claims of the present specification.

Claims

1. A method for detecting anomalies in time series data, characterized in that: include: Obtain a reference index value sequence of multiple dimensions corresponding to the to-be-detected point in the target time series data; wherein the reference index value sequence includes an index value of at least one reference point; the time interval between the reference point and the to-be-detected point is within a specified range; the index value of the reference point is used to reflect the fluctuation characteristics or statistical characteristics of the target time series data at the reference point; For each dimension, a standard score value of the point to be detected is determined according to the reference indicator value sequence of the dimension and the indicator value of the point to be detected; the standard score value is used to reflect the relative deviation of the indicator value of the point to be detected in the overall data distribution composed of the indicator value of the point to be detected and each indicator value in the reference indicator value sequence; A global standard score value is determined according to each standard score value corresponding to the point to be detected, and whether the point to be detected has an abnormality is determined according to the global standard score value.

2. The method according to claim 1, characterized in that The indicator value of each dimension includes at least one of the amplitude difference calculated at different time window scales, the cumulative amplitude value calculated at different time window scales, the over-average rate calculated at different time window scales, the peak value calculated at different time window scales, the trough value calculated at different time window scales, and the peak-to-trough difference calculated at different time window scales.

3. The method according to claim 2, characterized in that Determining the standard score value of the point to be detected according to the reference indicator value sequence of the dimension and the indicator value of the point to be detected specifically includes: According to the standard score value of each reference point in the reference indicator value sequence of the dimension, the reference indicator value sequence of the dimension is filtered to obtain a filtered indicator value sequence; The standard score value of the point to be detected is determined according to the filtered indicator value sequence and the indicator value of the point to be detected.

4. The method according to claim 3, characterized in that According to the standard score value of each reference point in the reference indicator value sequence of the dimension, the reference indicator value sequence of the dimension is filtered to obtain a filtered indicator value sequence, which specifically includes: For each reference point in the reference indicator value sequence of the dimension, determine whether the standard score value of the reference point corresponding to the dimension exceeds a preset screening threshold; If not, the index value of the reference point in the dimension is retained in the filtered index value sequence.

5. The method according to claim 3, characterized in that Determining the standard score value of the point to be detected according to the filtered indicator value sequence and the indicator value of the point to be detected specifically includes: If it is determined that the number of indicator values ​​included in the filtered indicator value sequence is less than a preset number threshold, determining that the standard score value of the point to be detected corresponding to the dimension is a preset maximum standard score value; Otherwise, the standard score value of the point to be detected corresponding to the dimension is determined according to the statistical characteristic value of each indicator value contained in the filtered indicator value sequence and the indicator value of the point to be detected under the dimension.

6. The method according to claim 1, characterized in that Determining a global standard score value according to each standard score value corresponding to the point to be detected specifically includes: The maximum value among the standard score values ​​corresponding to the points to be detected is taken as the global standard score value.

7. The method according to claim 1, characterized in that The method further comprises: The standard score values ​​corresponding to the point to be detected are input into a preset anomaly detection model to obtain an anomaly detection result of the point to be detected, and the anomaly detection result is used to characterize whether there is an anomaly at the point to be detected.

8. The method according to claim 1, characterized in that Determining whether the point to be detected has an abnormality according to the global standard score value specifically includes: Determining whether the global standard score value is higher than a preset reference threshold; If so, then determine the time-related reference points of the point to be detected. When it is determined that the global standard score values ​​of the time-related reference points are all higher than the reference threshold, it is determined that there is an abnormality in the point to be detected; the time interval between the time-related reference point and the point to be detected is within the preset associated time range.

9. A device for detecting anomalies in time series data, characterized in that: include: An acquisition module is used to acquire a reference index value sequence of multiple dimensions corresponding to a point to be detected in the target time series data; wherein the reference index value sequence includes an index value of at least one reference point; the time interval between the reference point and the point to be detected is within a specified range; the index value of the reference point is used to reflect the fluctuation characteristics or statistical characteristics of the target time series data at the reference point; A determination module, for determining, for each dimension, a standard score value of the point to be detected according to a reference indicator value sequence of the dimension and the indicator value of the point to be detected; the standard score value is used to reflect the relative deviation of the indicator value of the point to be detected in the overall data distribution constituted by the indicator value of the point to be detected and each indicator value in the reference indicator value sequence; The detection module is used to determine a global standard score value according to each standard score value corresponding to the point to be detected, and determine whether the point to be detected has an abnormality according to the global standard score value.

10. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by a processor, the method described in any one of claims 1 to 8 is implemented.

Images