Time series anomaly detection method, device, equipment and medium based on large model

Abstract

The present application discloses a method, apparatus, device and medium for detecting anomalies in a time series based on a large model, and relates to the field of data processing technology, including inputting initial multidimensional time series data into a model convolutional layer to obtain a convolutional layer output result, which is then input into a long short-term memory network of a model recurrent layer to determine a single recurrent layer output result and a time step prediction matrix; using the convolutional layer output result, the time step prediction matrix and the model self-attention recurrent layer to obtain a self-attention recurrent layer output result, and determining a fusion output result through a first preset result fusion mechanism; using a model linear learning layer and initial multidimensional time series data to determine a linear output result, combining the fusion output result with a second preset result fusion mechanism to obtain a target output result; finally, determining target multidimensional time series data using the target output result and a decoder, and determining the abnormality of the initial data in combination with a preset threshold. Therefore, the accuracy of anomaly detection of multidimensional time series can be improved.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a time series anomaly detection method, device, equipment and medium based on a large model. Background Art

[0002] Anomaly detection is a key area in machine learning, where the goal is to identify abnormal points that are significantly different from the regular patterns in a dataset.

[0003] However, current mainstream anomaly detection technologies for multidimensional time series have significant shortcomings. Traditional methods based on distance or distribution are adequate for low-dimensional data, but when faced with high-dimensional data, detection performance declines significantly due to the exacerbated data sparsity caused by the curse of dimensionality. Advanced solutions developed for specific scenarios, while effective within limited environments, are highly specialized and struggle to adapt to diverse anomaly types across domains. Furthermore, anomalous samples account for a very small proportion of a dataset, significantly outnumbering normal samples. Manually labeling anomalous data requires significant manpower, expertise, and is extremely costly. This forces most anomaly detection algorithms to employ unsupervised learning. However, unsupervised learning lacks the guidance of labeled information, significantly increasing the difficulty of anomaly detection and the uncertainty of the results.

[0004] Therefore, how to improve the accuracy of anomaly detection in multidimensional time series is a technical problem that needs to be solved urgently. Summary of the Invention

[0005] In view of this, the purpose of the present invention is to provide a method, device, equipment, and medium for detecting anomalies in time series based on a large model, which can improve the accuracy of anomaly detection in multidimensional time series. The specific scheme is as follows:

[0006] In a first aspect, the present application provides a time series anomaly detection method based on a large model, wherein the large model is an anomaly detection large model constructed based on a variational autoencoder, a recurrent neural network, and a convolutional neural network; wherein the method comprises:

[0007] Determining a convolutional layer output result based on the model convolutional layer of the anomaly detection large model and the initial multidimensional time series data, and determining a single recurrent layer output result and a time step prediction matrix based on the convolutional layer output result and the long short-term memory network of the model recurrent layer of the anomaly detection large model; wherein the model convolutional layer includes a filter and the convolutional neural network;

[0008] Determine a self-attention recurrent layer output result using the convolutional layer output result, the time step prediction matrix, the dimension of the single recurrent layer output result, and the model self-attention recurrent layer of the anomaly detection large model, and determine a fusion output result based on the single recurrent layer output result, the self-attention recurrent layer output result, and a first preset result fusion mechanism; the model self-attention recurrent layer includes a self-attention mechanism and the long short-term memory network;

[0009] Determine a linear output result based on the model linear learning layer of the anomaly detection large model and the initial multidimensional time series data, and determine a target output result using the linear output result, the fusion output result, and a second preset result fusion mechanism;

[0010] Target multidimensional time series data is determined based on the target output result and the decoder of the variational autoencoder, and anomaly detection is performed using the target multidimensional time series data, the initial multidimensional time series data, and a preset anomaly detection threshold to determine anomalies in the initial multidimensional time series data.

[0011] Optionally, determining a convolution layer output result based on the model convolution layer of the anomaly detection large model and the initial multidimensional time series data includes:

[0012] Determining the height of the filter in the convolutional layer of the model based on the number of data features in the initial multidimensional time series data to complete the filter height configuration operation;

[0013] Determining the width of the filter in the model convolution layer based on the period of the initial multidimensional time series data to complete a filter width configuration operation;

[0014] Configuring parameters of the filter based on the filter height configuration operation and the filter width configuration operation, and obtaining a configured filter;

[0015] The initial multidimensional time series data is input into the model convolution layer of the anomaly detection large model, and the convolution layer output result is generated using the ReLU activation function and the configured post-filter.

[0016] Optionally, the determining of a single recurrent layer output result and a time step prediction matrix based on the convolutional layer output result and the long short-term memory network of the model recurrent layer of the large anomaly detection model includes:

[0017] Inputting the output result of the convolutional layer into the long short-term memory network of the model recurrent layer of the large anomaly detection model, and processing the output result of the convolutional layer using the forget gate, input gate, and output gate in the long short-term memory network to obtain a processing result;

[0018] A hidden state and a time step prediction matrix are obtained from the processing result, and the hidden state is determined as a single recurrent layer output result.

[0019] Optionally, the determining the self-attention recurrent layer output result using the convolutional layer output result, the time step prediction matrix, the dimension of the single recurrent layer output result, and the model self-attention recurrent layer of the large anomaly detection model includes:

[0020] Inputting the convolutional layer output result and the time step prediction matrix into the model self-attention recurrent layer, and determining the current time series data based on the convolutional layer output result, the time step prediction matrix, and the long short-term memory network in the model self-attention recurrent layer;

[0021] Determine a Query vector, a Key vector, and a Value vector based on the current time series data and the self-attention mechanism in the self-attention recurrent layer of the model;

[0022] Performing a dot product on the Query vector and the Key vector to obtain a dot product result, and determining a weight score using the dot product result and a normalized exponential function;

[0023] A weighted Value vector is determined based on the weight score and the Value vector, and the weighted Value vector is used to determine the output result of the self-attention mechanism, so as to determine the self-attention recurrent layer output result based on the dimension of the self-attention mechanism output result and the single recurrent layer output result.

[0024] Optionally, determining a fusion output result based on the output result of the single recurrent layer, the output result of the self-attention recurrent layer, and a first preset result fusion mechanism includes:

[0025] Concatenating the single recurrent layer output result and the self-attention recurrent layer output result, and determining a first weight coefficient based on the obtained concatenated result, a tanh activation function, and a preset bias term;

[0026] performing a scaling operation on the first weight coefficient to obtain a second weight coefficient;

[0027] A fusion output result is determined based on the second weight coefficient, the single recurrent layer output result, and the self-attention recurrent layer output result.

[0028] Optionally, determining a linear output result based on a model linear learning layer of the anomaly detection large model and the initial multidimensional time series data includes:

[0029] Inputting the initial multidimensional time series data into the model linear learning layer;

[0030] The initial multidimensional time series data is processed using an autoregressive model in the linear learning layer of the model to obtain a processed linear output result.

[0031] Optionally, performing anomaly detection using the target multidimensional time series data, the initial multidimensional time series data, and a preset anomaly detection threshold to determine anomalies in the initial multidimensional time series data includes:

[0032] Determining a sample set containing only normal multidimensional time series data as a validation set, and determining a first anomaly score based on the validation set;

[0033] performing statistical analysis on the first anomaly scores to determine corresponding means and standard deviations;

[0034] Determining a preset abnormality detection threshold based on the sum of the average value and a preset multiple of the standard deviation;

[0035] A second anomaly score is determined based on the target multidimensional time series data and the initial multidimensional time series data, so as to determine an anomaly of the initial multidimensional time series data using the second anomaly score and the preset anomaly detection threshold.

[0036] In a second aspect, the present application provides a time series anomaly detection device based on a large model, wherein the large model is an anomaly detection large model constructed based on a variational autoencoder, a recurrent neural network, and a convolutional neural network; wherein the device includes:

[0037] A recurrent layer output module, configured to determine a convolutional layer output result based on the model convolutional layer of the anomaly detection large model and the initial multidimensional time series data, and to determine a single recurrent layer output result and a time step prediction matrix based on the convolutional layer output result and the long short-term memory network of the model recurrent layer of the anomaly detection large model; wherein the model convolutional layer includes a filter and the convolutional neural network;

[0038] a first output result fusion module, configured to determine a self-attention recurrent layer output result using the convolutional layer output result, the time step prediction matrix, the dimension of the single recurrent layer output result, and the model self-attention recurrent layer of the large anomaly detection model, and determine a fused output result based on the single recurrent layer output result, the self-attention recurrent layer output result, and a first preset result fusion mechanism; the model self-attention recurrent layer includes a self-attention mechanism and the long short-term memory network;

[0039] a second output result fusion module, configured to determine a linear output result based on the model linear learning layer of the anomaly detection large model and the initial multidimensional time series data, and determine a target output result using the linear output result, the fused output result, and a second preset result fusion mechanism;

[0040] an anomaly detection module, configured to determine target multidimensional time series data based on the target output result and the decoder of the variational autoencoder, and perform anomaly detection using the target multidimensional time series data, the initial multidimensional time series data, and a preset anomaly detection threshold to determine anomalies in the initial multidimensional time series data.

[0041] In a third aspect, the present application provides an electronic device, comprising:

[0042] Memory, used to store computer programs;

[0043] A processor is used to execute the computer program to implement the aforementioned large model-based time series anomaly detection method.

[0044] In a fourth aspect, the present application provides a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, the aforementioned large model-based time series anomaly detection method is implemented.

[0045] In the present application, the convolution layer output result is determined based on the model convolution layer of the anomaly detection large model and the initial multidimensional time series data, and the single loop layer output result and the time step prediction matrix are determined based on the convolution layer output result and the long short-term memory network of the model loop layer of the anomaly detection large model; wherein the model convolution layer includes a filter and the convolution neural network; the self-attention loop layer output result is determined using the convolution layer output result, the time step prediction matrix, the dimension of the single loop layer output result and the model self-attention loop layer of the anomaly detection large model, and the single loop layer output result, the self-attention loop layer output result and the first preset The result fusion mechanism determines the fusion output result; the model self-attention cycle layer includes the self-attention mechanism and the long short-term memory network; based on the model linear learning layer of the anomaly detection large model and the initial multidimensional time series data, the linear output result is determined, and the linear output result, the fusion output result and the second preset result fusion mechanism are used to determine the target output result; based on the target output result and the decoder of the variational autoencoder, the target multidimensional time series data is determined, and the target multidimensional time series data, the initial multidimensional time series data and the preset anomaly detection threshold are used for anomaly detection to determine the anomaly in the initial multidimensional time series data. As can be seen from the above, in this application, the initial multidimensional time series data is first input into the model convolution layer of the anomaly detection large model, and after the convolution layer processing, the convolution layer output result is obtained. Then, the convolution layer output result is input into the long short-term memory network of the model cycle layer of the anomaly detection large model, and after the calculation of the long short-term memory network, the single cycle layer output result and the time step prediction matrix are determined. Then, using the convolutional layer output results, the time step prediction matrix, and the dimensional information of the single recurrent layer output results, they are input into the model self-attention recurrent layer of the anomaly detection large model. After processing by the self-attention recurrent layer, the self-attention recurrent layer output results are obtained. Subsequently, according to the first preset result fusion mechanism, the single recurrent layer output results and the self-attention recurrent layer output results are fused to determine the fused output results. After that, the initial multidimensional time series data is input into the model linear learning layer of the anomaly detection large model, and the linear output results are determined after processing by this layer. Then, according to the second preset result fusion mechanism, the linear output results and the fused output results are fused to obtain the target output results. Finally, the target output results are input into the decoder of the variational autoencoder, and the decoder outputs the target multidimensional time series data. The target multidimensional time series data is compared with the initial multidimensional time series data, and anomaly detection is performed in combination with a preset anomaly detection threshold to determine whether there are any anomalies in the initial multidimensional time series data. In this way, the present application can improve the accuracy of anomaly detection for multidimensional time series. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0047] Figure 1 This is a flow chart of a time series anomaly detection method based on a large model disclosed in this application;

[0048] Figure 2 This is a flow chart of a specific large-model-based time series anomaly detection method disclosed in this application;

[0049] Figure 3 The operating process of a self-attention mechanism with a length of 2 for a multidimensional time series disclosed in this application;

[0050] Figure 4 This is a schematic diagram of the structure of a time series anomaly detection device based on a large model disclosed in this application;

[0051] Figure 5 This is a structural diagram of an electronic device disclosed in this application. DETAILED DESCRIPTION

[0052] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0053] At present, the mainstream anomaly detection technology for multi-dimensional time series has obvious shortcomings. Traditional methods based on distance or distribution can handle low-dimensional data. When faced with high-dimensional data, the data sparsity is aggravated due to the dimensionality curse, and the detection performance drops significantly. Advanced solutions developed for specific scenarios, although they are effective in limited environments, are difficult to adapt to various cross-domain anomaly types due to their strong specificity. At the same time, abnormal samples account for a very small proportion of the data set, which is far different from the number of normal samples, and manual labeling of abnormal data requires a lot of manpower and professional knowledge, and the cost is extremely high. This means that most anomaly detection algorithms can only use unsupervised learning. However, unsupervised learning lacks annotation information guidance, which greatly increases the difficulty of anomaly detection and the uncertainty of the results. To this end, the present application provides a time series anomaly detection method, device, equipment and medium based on a large model, which can improve the accuracy of anomaly detection in multi-dimensional time series.

[0054] See also Figure 1 and Figure 2 As shown, an embodiment of the present invention discloses a time series anomaly detection method based on a large model, wherein the large model is an anomaly detection large model constructed based on a variational autoencoder, a recurrent neural network, and a convolutional neural network, wherein the method includes:

[0055] Step S11: Determine the convolution layer output result based on the model convolution layer of the anomaly detection large model and the initial multidimensional time series data, and determine the single recurrent layer output result and the time step prediction matrix based on the convolution layer output result and the long short-term memory network of the model recurrent layer of the anomaly detection large model; wherein the model convolution layer includes a filter and the convolution neural network.

[0056] First, it should be noted that multidimensional time series have different connotations and manifestations in different specific application scenarios. The following is an explanation based on financial monitoring, industrial maintenance, and medical diagnosis scenarios.

[0057] Specifically, in financial monitoring scenarios, multidimensional time series contain a variety of information. For example, in the stock market, data such as the price trend, trading volume, price-to-earnings ratio, and price-to-book ratio of each stock constitute multiple dimensions. The data in these dimensions changes continuously over time, forming a certain time series. The data between different stocks are interrelated, for example, the price fluctuations of stocks in the same industry may have similarities or correlations. By analyzing these multidimensional time series and utilizing the anomaly detection model of this application, it is possible to promptly detect abnormal fluctuations in stock prices, abnormal changes in trading volume, and other situations, thereby helping investors and regulators make accurate decisions and prevent financial risks.

[0058] In industrial maintenance scenarios, multidimensional time series mainly come from data monitored by various sensors. Taking large engines as an example, sensors will collect data in multiple dimensions such as engine temperature, pressure, speed, vibration frequency, etc. in real time. These data change dynamically over time and reflect the operating status of the engine. The parameters of different components of the engine affect each other. For example, changes in temperature may affect pressure and vibration. By using the anomaly detection model of this application to perform anomaly detection on these multidimensional time series, potential engine failures such as component wear and abnormal vibration can be discovered in advance, thereby achieving preventive maintenance and reducing equipment downtime and maintenance costs.

[0059] In medical diagnosis scenarios, multidimensional time series contain data on various physiological indicators of patients. For example, the changes in indicators such as electrocardiogram, blood pressure, heart rate, body temperature, and blood sugar over time. There are inherent connections between different physiological indicators. For example, changes in heart rate may be related to blood pressure and body temperature. By analyzing these multidimensional time series, doctors can gain a more comprehensive understanding of the patient's health status. The anomaly detection model of this application can promptly detect abnormal changes in the patient's physiological indicators, which helps diagnose and treat diseases at an early stage and improves the accuracy and timeliness of medical diagnosis.

[0060] In this embodiment, in order to effectively extract features from the initial multi-dimensional time series data, it is necessary to reasonably configure the model convolution layer of the large anomaly detection model.

[0061] First, the filter height configuration operation is completed by determining the filter height in the model's convolutional layer based on the number of data features in the initial multidimensional time series data. The number of features in the initial multidimensional time series data reflects the complexity and dimensionality of the data, while the filter height plays a key role in the convolution operation, determining the processing range within the data feature dimensions. By analyzing the number of data features and using a reasonable algorithm, an appropriate filter height can be determined, allowing the convolutional layer to effectively capture key features when processing the initial multidimensional time series data while avoiding excessive redundant information.

[0062] Next, the filter width in the model's convolutional layer is determined based on the period of the initial multidimensional time series data to complete the filter width configuration operation. Specifically, the periodic nature of multidimensional time series data is one of its key characteristics, and different multidimensional time series may have different period lengths. The filter width determines the processing range in the time dimension. For time series data with a clear period, appropriately setting the filter width can better capture the temporal changes in the data.

[0063] Based on the filter height and width configuration operations described above, the filter parameters are configured to obtain a configured filter. The configured filter parameters include the filter height, width, and other related parameters. Properly setting these parameters can improve the performance of the model's convolutional layer to a certain extent, allowing it to better extract features from the initial multidimensional time series data.

[0064] Furthermore, the initial multidimensional time series data is input into the convolutional layer of the anomaly detection model, and the convolutional layer output is generated using the ReLU (Rectified Linear Unit) activation function and configured post-filters. It should be noted that in the convolution operation, the kth (i.e., the number of filters in the convolutional layer of the anomaly detection model) filter scans the input matrix X (i.e., the initial multidimensional time series data, where the multidimensional time series is represented in matrix form). According to the rules of the convolution operation, the output of the kth filter is as follows:

[0065] ;

[0066] Where, represents the convolution operation, is the weight matrix of the filter, is the bias vector. The RELU function is specifically RELU (x) = max (0, x). This function can perform nonlinear transformation on the convolution result, so that the convolution layer can learn more complex feature representations. After the convolution layer is processed, the time series will reduce the sequence length and the number of variables, and increase the number of channels. In addition, the output of the convolution layer The size is , where ch is the number of channels of the output matrix, t is the length of the initial multidimensional time series input, and n is the dimension of the initial multidimensional time series input. is the width of the filter, and m is the height of the filter.

[0067] After obtaining the output of the convolutional layer, it is input into the Long Short-Term Memory (LSTM) network in the recurrent layer of the large anomaly detection model. The forget gate, input gate, and output gate in the LSTM network are used to process the output of the convolutional layer to obtain the processed result. The LSTM network is a special type of recurrent neural network whose core feature is its ability to effectively capture the temporal dependencies in multidimensional time series data. Specifically, the calculation formula in the LSTM network is as follows:

[0068]

[0069] Among the above five formulas, is the calculation formula of the forget gate, where represents the sigmoid (s-shaped) activation function, represents the input at time t, express To the weight matrix of the forget gate, h t-1 represents the hidden state of the long short-term memory network at time t-1, express To the weight matrix of the forget gate, Represents the bias vector of the forget gate;

[0070] is the calculation formula of the input gate, specifically, express to the weight matrix of the input gate, express to the weight matrix of the input gate, represents the bias vector of the input gate;

[0071] is the calculation formula of the unit state at time t, where represents the Hadamard product (multiplication of elements at corresponding positions of two matrices), represents the cell state at time t-1, represents the tanh activation function, express to the weight matrix of the candidate cell state, express to the weight matrix of the candidate cell state, A bias vector representing the candidate cell state;

[0072] is the calculation formula of the output gate, where express The weight matrix to the output gate, express The weight matrix to the output gate, Represents the bias vector of the output gate;

[0073] The calculation formula for the hidden state.

[0074] Through the above calculation formula, the output of the convolution layer can be processed to obtain the hidden state and time step prediction matrix from the processing results, and the hidden state is determined as the output of a single recurrent layer. When processing the data of each time step, the long short-term memory network will retain the information of the previous time step, thereby realizing dynamic modeling of sequence data. By analyzing and extracting the processing results, the hidden state of each time step can be obtained. 、 、……、 、 These hidden states contain the characteristic representations of the time series data at different time steps. Furthermore, the computational process of the LSTM network also yields a time-step prediction matrix, which reflects the LSTM network's predictions about future values ​​of the time series. Using the hidden states as the output of a single recurrent layer provides important feature representations for subsequent model processing.

[0075] Step S12: Determine the self-attention loop layer output result using the convolutional layer output result, the time step prediction matrix, the dimension of the single loop layer output result, and the model self-attention loop layer of the anomaly detection large model, and determine the fusion output result based on the single loop layer output result, the self-attention loop layer output result, and the first preset result fusion mechanism; the model self-attention loop layer includes a self-attention mechanism and the long short-term memory network.

[0076] In this embodiment, the convolutional layer output and the time-step prediction matrix are input into the model self-attention recurrent layer of the large anomaly detection model. The convolutional layer output has already undergone feature extraction of the initial multidimensional time series data, preserving local correlations and characteristic information in the data. The time-step prediction matrix, on the other hand, reflects the long-short-term memory network's prediction of the future values ​​of the time series. These two are then input into the long-short-term memory network in the model self-attention recurrent layer. The long-short-term memory network processes these inputs using its own forget gate, input gate, and output gate mechanisms to obtain the current time series data.

[0077] Furthermore, based on the current time series data, the self-attention mechanism in the model's self-attention recurrent layer comes into play. The core of the self-attention mechanism is to weight the input data by calculating the relationship between the input query vector (i.e., query vector), key vector (i.e., key vector), and value vector (i.e., value vector). Specifically, through a specific linear transformation, the current time series data is mapped into query vectors, key vectors, and value vectors. The dimensions of these vectors are typically set according to the output dimensions of the convolutional layer to ensure that the correlation between the data is effectively captured in subsequent calculations.

[0078] See also Figure 3 Specifically, a dot product operation is performed on the query vector and the key vector to obtain a dot product result. The dot product operation measures the similarity between the query vector and the key vector; the higher the similarity, the larger the dot product result. To address the vanishing gradient problem that may occur when the SoftMax function (i.e., the normalized exponential function) processes large dot product values, the dot product result is divided by a scaling factor, typically the square root of the dimensions of the query and key vectors. The scaled dot product result is then processed using the SoftMax function to obtain a weighted score. The weighted score represents the importance of each value vector in the final output; a higher score indicates a greater proportion of the corresponding value vector in the output.

[0079] Next, based on the obtained weight scores and Value vectors, a weighted Value vector is calculated. Specifically, each Value vector is multiplied by its corresponding weight score, and then all weighted Value vectors are added together to obtain the self-attention mechanism output. Finally, based on the dimension of the single recurrent layer output, the self-attention mechanism output is dimensionally adjusted to match the dimension of the single recurrent layer output, thereby obtaining the self-attention recurrent layer output. Furthermore, the self-attention mechanism output is generated as follows:

[0080] ;

[0081] In the formula, Q is the Query vector, K is the Key vector, and V is the Value vector. Represents the dimensions of the Query vector and Key vector, and T represents the transpose of the matrix.

[0082] Furthermore, in this embodiment, the output of the single recurrent layer and the output of the self-attention recurrent layer are concatenated to produce a concatenated result. Based on this concatenated result, a nonlinear transformation is performed using the tanh activation function, and a preset bias term is added to obtain a first weight coefficient. The tanh activation function maps the input value to a range of -1 to 1, giving the output a certain nonlinear characteristic, which can better fit complex data relationships.

[0083] In addition, the first weight coefficient needs to be scaled from the range of -1 to 1 to the range of 0 to 1 to obtain the second weight coefficient. The purpose of this scaling operation is to enable the second weight coefficient to be used as a weight factor for combining the output of the single recurrent layer and the output of the self-attention recurrent layer.

[0084] Finally, the fusion output result is determined based on the second weight coefficient, the output result of the single loop layer, and the output result of the self-attention loop layer. Specifically, the output result of the single loop layer is multiplied by the second weight coefficient, and the output result of the self-attention loop layer is multiplied by the difference between 1 and the second weight coefficient. The two are then added together to obtain the final fusion output result. This fusion mechanism can dynamically adjust the proportion of the output results of the single loop layer and the output results of the self-attention loop layer in the final output according to different data sets and specific circumstances, thereby improving the anomaly detection performance of the model. In addition, the determination process of the above fusion output result is expressed as follows:

[0085]

[0086] In the above three formulas, represents the first weight coefficient, represents the second weight coefficient, Represents the output result of a single cycle layer, Represents the output result of the self-attention cycle layer, represents the preset bias term, Express and The concatenated matrix is ​​subjected to linear transformation operation. Represents the fusion output result.

[0087] Step S13: Determine a linear output result based on the model linear learning layer of the anomaly detection large model and the initial multidimensional time series data, and determine a target output result using the linear output result, the fusion output result and a second preset result fusion mechanism.

[0088] In this embodiment, the initial multidimensional time series data is input into the model linear learning layer of the anomaly detection model, and the autoregressive model in this layer begins to process the initial multidimensional time series data. The autoregressive model is a common time series analysis model that can predict future values ​​based on past observations. In the anomaly detection model of this embodiment, the autoregressive model can capture the linear change trend in the initial multidimensional time series. The formula for processing the initial multidimensional time series data using the autoregressive model is as follows:

[0089] ;

[0090] Where, Represents the linear prediction result of the AR model (i.e. Autoregressive model, autoregressive model), Represents the trainable weight matrix in the AR model.

[0091] Specifically, the autoregressive model is expressed as a linear output obtained by matrix multiplication and addition. This linear output reflects a relatively stable, linear change pattern in the time series.

[0092] After obtaining the linear output and the fused output in step S12, they need to be fused using the second preset result fusion mechanism to obtain the target output. The purpose of this fusion is to comprehensively utilize the linear features captured by the linear learning layer and the complex nonlinear features captured by the fusion of the previous recurrent layer and the self-attention recurrent layer, thereby improving the model's overall modeling capabilities for multidimensional time series.

[0093] Furthermore, the second preset result fusion mechanism also uses a learnable approach. Similar to the fusion mechanism of the previous recurrent layer and self-attention recurrent layer, the linear output and the fused output are concatenated to produce a concatenated matrix containing more information.

[0094] Step S14: determining target multidimensional time series data based on the target output result and the decoder of the variational autoencoder, and performing anomaly detection using the target multidimensional time series data, the initial multidimensional time series data, and a preset anomaly detection threshold to determine anomalies in the initial multidimensional time series data.

[0095] In this embodiment, the target output result is the feature representation obtained after processing through the previous multiple steps, and the task of the decoder of the variational autoencoder is to reconstruct this feature representation into target multidimensional time series data. The decoder is a neural network that maps the target output result to the same dimensional space as the initial multidimensional time series data through a series of linear transformations and nonlinear activation functions. In other words, the decoder can reconstruct this target output result into the original input data. By continuously adjusting the parameters of the decoder, the reconstruction error is minimized, allowing the decoder to learn how to generate time series data similar to the original data from the feature representation of the latent space. In other words, the decoder uses the trained parameters to convert the target output result into target multidimensional time series data. This target multidimensional time series data is a reconstruction of the initial multidimensional time series data by the anomaly detection large model, which reflects the multidimensional time series pattern under normal conditions considered by the anomaly detection large model.

[0096] To perform anomaly detection, a preset anomaly detection threshold needs to be determined. First, a validation set consisting only of normal multidimensional time series data is selected. This validation set should be as representative as possible of the distribution of normal data in real applications.

[0097] Furthermore, a first anomaly score is calculated based on the validation set. This score is typically obtained by calculating the reconstruction error for each sample in the validation set. The reconstruction error can be defined as the difference between the sample in the validation set and the sample reconstructed by the decoder. These first anomaly scores are statistically analyzed to calculate their mean and standard deviation.

[0098] In addition, according to statistical principles, under normal circumstances, the first anomaly scores of most data should be concentrated near the average value. Therefore, the preset anomaly detection threshold (using ), where the preset multiple can be 3. Therefore, when a certain anomaly score exceeds this threshold, it can be considered that the data point may be abnormal.

[0099] Finally, based on the target multidimensional time series data and the initial multidimensional time series data, the second anomaly score (represented by score) is calculated. The calculated second anomaly score is compared with the preset anomaly detection threshold. If the second anomaly score is greater than the preset anomaly detection threshold, that is, , then the corresponding part of the initial multidimensional time series data is judged to be abnormal (using If the second anomaly score is less than or equal to the preset anomaly detection threshold, that is, , it is judged to be normal (using In this way, anomaly detection can be performed on each time step or data segment in the initial multidimensional time series data, thereby determining the anomalies in the entire time series data.

[0100] As can be seen from the above, in this application, the initial multidimensional time series data is first input into the model convolutional layer of the large anomaly detection model. After processing by the convolutional layer, the convolutional layer output result is obtained. Next, the convolutional layer output result is input into the long short-term memory network of the model recurrent layer of the large anomaly detection model. After calculation by the long short-term memory network, the single recurrent layer output result and the time step prediction matrix are determined. Then, using the convolutional layer output result, the time step prediction matrix, and the dimensional information of the single recurrent layer output result, it is input into the model self-attention recurrent layer of the large anomaly detection model. After processing by the self-attention recurrent layer, the self-attention recurrent layer output result is obtained. Subsequently, according to the first preset result fusion mechanism, the single recurrent layer output result and the self-attention recurrent layer output result are fused to determine the fused output result. After that, the initial multidimensional time series data is input into the model linear learning layer of the large anomaly detection model. After processing by this layer, the linear output result is determined. Then, according to the second preset result fusion mechanism, the linear output result and the fused output result are fused to obtain the target output result. Finally, the target output result is input into the decoder of the variational autoencoder, and the decoder outputs the target multidimensional time series data. The target multidimensional time series data is compared with the initial multidimensional time series data, and anomaly detection is performed in combination with a preset anomaly detection threshold to determine whether there are any anomalies in the initial multidimensional time series data. In this way, the present application can improve the accuracy of anomaly detection for multidimensional time series.

[0101] The technical solution of the embodiment of this application is described in detail below in conjunction with industrial maintenance scenarios.

[0102] Specifically, sensors located throughout key engine locations play a crucial role in the operation of large engines. These sensors collect real-time data on multiple dimensions, including engine temperature, pressure, speed, and vibration frequency. For example, temperature sensors continuously monitor temperature changes in various engine locations, including cylinder and coolant temperatures. Pressure sensors measure key parameters such as fuel and oil pressures. Speed ​​sensors obtain engine speed information, while vibration frequency sensors capture engine vibrations during operation. The data collected by these sensors is continuously updated over time, forming a multidimensional time series of the engine's operating status.

[0103] The collected multidimensional time series data is input into the anomaly detection model of this application. First, the model's convolutional layer processes this initial multidimensional time series data. The filters and convolutional neural network in the convolutional layer act like a "data sieve," extracting local features and patterns in the data. For example, it might identify a fixed relationship pattern between engine temperature, pressure, and speed during normal operation.

[0104] The output from the convolutional layer is fed into the Long Short-Term Memory (LSTM) network in the model's recurrent layer. The LSTM network has powerful time series analysis capabilities, memorizing information about the engine's operating status at different points in time to determine the output of a single recurrent layer and the time-step prediction matrix. By analyzing these results, we can understand the development trend of the engine's operating status.

[0105] Next, the output of the convolutional layer, the time-step prediction matrix, and the model's self-attention recurrent layer are used to determine the output of the self-attention recurrent layer. The self-attention mechanism allows the model to focus on important relationships between different dimensions in the data, such as the correlation between temperature changes and pressure or vibration frequency. Then, according to the first preset result fusion mechanism, the output of the single recurrent layer and the output of the self-attention recurrent layer are fused to obtain more comprehensive and accurate information.

[0106] The model's linear learning layer determines a linear output based on the initial multidimensional time series data. This is then combined with the previously fused output to produce a target output through a second, pre-defined result fusion mechanism. This target output incorporates information from multiple analyses and processing steps to more accurately reflect the engine's operating status.

[0107] Finally, the target multidimensional time series data is determined based on the target output and the decoder. This target multidimensional time series data is compared with the initial multidimensional time series data and combined with the preset anomaly detection threshold to determine whether the engine is abnormal.

[0108] When the anomaly detection model detects an anomaly in the engine's multidimensional time series data, it indicates a potential engine failure, such as component wear or abnormal vibration. Based on these detection results, companies can schedule preventive maintenance, such as replacing worn parts and debugging the engine. This prevents further escalation of the failure, reduces equipment downtime, and ultimately lowers maintenance costs, improving productivity and economic benefits.

[0109] Accordingly, see Figure 4 As shown, an embodiment of the present application provides a time series anomaly detection device based on a large model, wherein the large model is an anomaly detection large model constructed based on a variational autoencoder, a recurrent neural network, and a convolutional neural network; wherein the device includes:

[0110] A recurrent layer output module 11 is configured to determine a convolutional layer output result based on the model convolutional layer of the anomaly detection large model and the initial multidimensional time series data, and to determine a single recurrent layer output result and a time step prediction matrix based on the convolutional layer output result and the long short-term memory network of the model recurrent layer of the anomaly detection large model; wherein the model convolutional layer includes a filter and the convolutional neural network;

[0111] a first output result fusion module 12, configured to determine a self-attention recurrent layer output result using the convolutional layer output result, the time step prediction matrix, the dimension of the single recurrent layer output result, and the model self-attention recurrent layer of the large anomaly detection model, and determine a fused output result based on the single recurrent layer output result, the self-attention recurrent layer output result, and a first preset result fusion mechanism; the model self-attention recurrent layer includes a self-attention mechanism and the long short-term memory network;

[0112] a second output result fusion module 13, configured to determine a linear output result based on the model linear learning layer of the anomaly detection large model and the initial multidimensional time series data, and determine a target output result using the linear output result, the fused output result, and a second preset result fusion mechanism;

[0113] The anomaly detection module 14 is used to determine the target multidimensional time series data based on the target output result and the decoder of the variational autoencoder, and perform anomaly detection using the target multidimensional time series data, the initial multidimensional time series data and a preset anomaly detection threshold to determine anomalies in the initial multidimensional time series data.

[0114] As can be seen from the above, in this application, the initial multidimensional time series data is first input into the model convolutional layer of the large anomaly detection model. After processing by the convolutional layer, the convolutional layer output result is obtained. Next, the convolutional layer output result is input into the long short-term memory network of the model recurrent layer of the large anomaly detection model. After calculation by the long short-term memory network, the single recurrent layer output result and the time step prediction matrix are determined. Then, using the convolutional layer output result, the time step prediction matrix, and the dimensional information of the single recurrent layer output result, it is input into the model self-attention recurrent layer of the large anomaly detection model. After processing by the self-attention recurrent layer, the self-attention recurrent layer output result is obtained. Subsequently, according to the first preset result fusion mechanism, the single recurrent layer output result and the self-attention recurrent layer output result are fused to determine the fused output result. After that, the initial multidimensional time series data is input into the model linear learning layer of the large anomaly detection model. After processing by this layer, the linear output result is determined. Then, according to the second preset result fusion mechanism, the linear output result and the fused output result are fused to obtain the target output result. Finally, the target output result is input into the decoder of the variational autoencoder, and the decoder outputs the target multidimensional time series data. The target multidimensional time series data is compared with the initial multidimensional time series data, and anomaly detection is performed in combination with a preset anomaly detection threshold to determine whether there are any anomalies in the initial multidimensional time series data. In this way, the present application can improve the accuracy of anomaly detection for multidimensional time series.

[0115] In some specific implementations, the circulation layer output module 11 specifically includes:

[0116] A height configuration unit, used to determine the height of the filter in the convolutional layer of the model based on the number of data features in the initial multidimensional time series data, so as to complete the filter height configuration operation;

[0117] A width configuration unit, configured to determine the width of the filter in the model convolution layer based on the period of the initial multidimensional time series data, so as to complete the filter width configuration operation;

[0118] a filter configuration unit, configured to configure parameters of the filter based on the filter height configuration operation and the filter width configuration operation, and obtain a configured filter;

[0119] A convolutional layer result generation unit is used to input the initial multidimensional time series data into the model convolution layer of the anomaly detection large model, and generate a convolutional layer output result using the ReLU activation function and the configured post-filter.

[0120] In some specific implementations, the circulation layer output module 11 specifically includes:

[0121] A convolutional layer result processing unit, configured to input the convolutional layer output result into the long short-term memory network of the model recurrent layer of the large anomaly detection model, and process the convolutional layer output result using the forget gate, input gate, and output gate in the long short-term memory network to obtain a processing result;

[0122] A single cycle layer result determination unit is used to obtain a hidden state and a time step prediction matrix from the processing result, and determine the hidden state as a single cycle layer output result.

[0123] In some specific implementations, the first output result fusion module 12 specifically includes:

[0124] a data determination unit, configured to input the convolutional layer output result and the time step prediction matrix into the model self-attention recurrent layer of the anomaly detection large model, and determine current time series data based on the convolutional layer output result, the time step prediction matrix, and the long short-term memory network in the model self-attention recurrent layer;

[0125] A vector determination unit, configured to determine a Query vector, a Key vector, and a Value vector based on the current time series data and the self-attention mechanism in the self-attention recurrent layer of the model;

[0126] a weight score determining unit, configured to perform a dot product on the Query vector and the Key vector to obtain a dot product result, and determine a weight score using the dot product result and a normalized exponential function;

[0127] A self-attention recurrent layer result determination unit is used to determine a weighted Value vector based on the weight score and the Value vector, and use the weighted Value vector to determine the output result of the self-attention mechanism, so as to determine the self-attention recurrent layer output result based on the dimension of the self-attention mechanism output result and the single recurrent layer output result.

[0128] In some specific implementations, the first output result fusion module 12 specifically includes:

[0129] A first weight coefficient determining unit is configured to concatenate the output result of the single recurrent layer and the output result of the self-attention recurrent layer, and determine a first weight coefficient based on the concatenated result, a tanh activation function, and a preset bias term;

[0130] a second weight coefficient determining unit, configured to perform a scaling operation on the first weight coefficient to obtain a second weight coefficient;

[0131] A result fusion unit is used to determine a fusion output result based on the second weight coefficient, the single loop layer output result and the self-attention loop layer output result.

[0132] In some specific implementations, the second output result fusion module 13 specifically includes:

[0133] A data input unit, configured to input the initial multidimensional time series data into the model linear learning layer;

[0134] A data processing unit is used to process the initial multidimensional time series data using the autoregressive model in the linear learning layer of the model to obtain a processed linear output result.

[0135] In some specific implementations, the anomaly detection module 14 specifically includes:

[0136] a score determining unit, configured to determine a sample set containing only normal multidimensional time series data as a validation set, and determine a first anomaly score based on the validation set;

[0137] an information determining unit, configured to perform statistical analysis on the first anomaly score to determine a corresponding mean value and standard deviation;

[0138] a threshold determination unit, configured to determine a preset abnormality detection threshold based on the sum of the average value and a preset multiple of the standard deviation;

[0139] The anomaly detection unit is configured to determine a second anomaly score based on the target multidimensional time series data and the initial multidimensional time series data, so as to determine an anomaly of the initial multidimensional time series data using the second anomaly score and the preset anomaly detection threshold.

[0140] Furthermore, the embodiment of the present application also discloses an electronic device, Figure 5 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content in the diagram should not be considered as any limitation on the scope of use of this application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the large model-based time series anomaly detection method disclosed in any of the aforementioned embodiments. In addition, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0141] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device. The communication protocol it follows is any communication protocol that can be applied to the technical solution of this application and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world. Its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0142] In addition, the memory 22 as a carrier for resource storage can be a read-only memory, random access memory, disk or optical disk, etc. The resources stored thereon can include an operating system 221, a computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0143] The operating system 221 is used to manage and control the hardware devices and computer program 222 on the electronic device 20, and can be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program capable of implementing the large model-based time series anomaly detection method performed by the electronic device 20 as disclosed in any of the aforementioned embodiments, the computer program 222 may further include computer programs capable of performing other specific tasks.

[0144] Furthermore, this application discloses a computer-readable storage medium for storing a computer program. When executed by a processor, the computer program implements the aforementioned large-model-based time series anomaly detection method. The specific steps of this method can be found in the corresponding content disclosed in the aforementioned embodiments and will not be further elaborated here.

[0145] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from the other embodiments. Reference can be made to the descriptions of the identical or similar parts between the various embodiments. For the devices disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple, and the relevant parts can be referred to the descriptions of the methods.

[0146] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the components and steps of each example according to their functions. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0147] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0148] Finally, it should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or device comprising the element.

[0149] The above is a detailed introduction to the technical solution provided by the present application. Specific examples are used herein to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for those skilled in the art, according to the ideas of the present application, there may be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A time series anomaly detection method based on a large model, characterized in that: The large model is an anomaly detection large model built based on a variational autoencoder, a recurrent neural network, and a convolutional neural network; wherein the method includes: Determining a convolutional layer output result based on the model convolutional layer of the anomaly detection large model and initial multidimensional time series data of the engine, and determining a single recurrent layer output result and a time step prediction matrix based on the convolutional layer output result and the long short-term memory network of the recurrent layer of the anomaly detection large model; wherein the model convolutional layer includes a filter and the convolutional neural network; and the multidimensional time series data includes data obtained by collecting the temperature, pressure, speed, and vibration frequency of the engine; Determine a self-attention recurrent layer output result using the convolutional layer output result, the time step prediction matrix, the dimension of the single recurrent layer output result, and the model self-attention recurrent layer of the anomaly detection large model, and determine a fusion output result based on the single recurrent layer output result, the self-attention recurrent layer output result, and a first preset result fusion mechanism; the model self-attention recurrent layer includes a self-attention mechanism and the long short-term memory network; Determine a linear output result based on the model linear learning layer of the anomaly detection large model and the initial multidimensional time series data, and determine a target output result using the linear output result, the fusion output result, and a second preset result fusion mechanism; Target multidimensional time series data is determined based on the target output result and the decoder of the variational autoencoder, and anomaly detection is performed using the target multidimensional time series data, the initial multidimensional time series data of the engine, and a preset anomaly detection threshold to determine anomalies in the initial multidimensional time series data, so as to discover potential faults of the engine based on the anomalies in the initial multidimensional time series data.

2. The time series anomaly detection method based on a large model according to claim 1 is characterized in that: The determining of the convolution layer output result based on the model convolution layer of the anomaly detection large model and the initial multi-dimensional time series data of the engine includes: determining a height of a filter in a convolutional layer of the model based on the number of data features in the initial multidimensional time series data of the engine to complete a filter height configuration operation; Determining the width of the filter in the model convolution layer based on the period of the initial multidimensional time series data to complete a filter width configuration operation; Configuring parameters of the filter based on the filter height configuration operation and the filter width configuration operation, and obtaining a configured filter; The initial multidimensional time series data is input into the model convolution layer of the anomaly detection large model, and the convolution layer output result is generated using the ReLU activation function and the configured post-filter.

3. The time series anomaly detection method based on a large model according to claim 1 is characterized in that: The determining of a single recurrent layer output result and a time step prediction matrix based on the convolutional layer output result and the long short-term memory network of the model recurrent layer of the large anomaly detection model includes: Inputting the output result of the convolutional layer into the long short-term memory network of the model recurrent layer of the large anomaly detection model, and processing the output result of the convolutional layer using the forget gate, input gate, and output gate in the long short-term memory network to obtain a processing result; A hidden state and a time step prediction matrix are obtained from the processing result, and the hidden state is determined as a single recurrent layer output result.

4. The time series anomaly detection method based on a large model according to claim 1 is characterized in that: The method of determining the self-attention recurrent layer output result by using the convolutional layer output result, the time step prediction matrix, the dimension of the single recurrent layer output result, and the model self-attention recurrent layer of the anomaly detection large model includes: Inputting the convolutional layer output result and the time step prediction matrix into the model self-attention recurrent layer, and determining the current time series data based on the convolutional layer output result, the time step prediction matrix, and the long short-term memory network in the model self-attention recurrent layer; Determine a Query vector, a Key vector, and a Value vector based on the current time series data and the self-attention mechanism in the self-attention recurrent layer of the model; Performing a dot product on the Query vector and the Key vector to obtain a dot product result, and determining a weight score using the dot product result and a normalized exponential function; A weighted Value vector is determined based on the weight score and the Value vector, and the weighted Value vector is used to determine the output result of the self-attention mechanism, so as to determine the self-attention recurrent layer output result based on the dimension of the self-attention mechanism output result and the single recurrent layer output result.

5. The time series anomaly detection method based on a large model according to claim 1 is characterized in that: The determining of the fusion output result based on the single recurrent layer output result, the self-attention recurrent layer output result, and the first preset result fusion mechanism includes: Concatenating the single recurrent layer output result and the self-attention recurrent layer output result, and determining a first weight coefficient based on the obtained concatenated result, a tanh activation function, and a preset bias term; performing a scaling operation on the first weight coefficient to obtain a second weight coefficient; A fusion output result is determined based on the second weight coefficient, the single recurrent layer output result, and the self-attention recurrent layer output result.

6. The time series anomaly detection method based on a large model according to claim 1 is characterized in that: The determining of a linear output result based on the model linear learning layer of the anomaly detection large model and the initial multidimensional time series data includes: Inputting the initial multidimensional time series data into the model linear learning layer; The initial multidimensional time series data is processed using an autoregressive model in the linear learning layer of the model to obtain a processed linear output result.

7. The time series anomaly detection method based on a large model according to any one of claims 1 to 6, characterized in that: The performing anomaly detection using the target multidimensional time series data, the initial multidimensional time series data of the engine, and a preset anomaly detection threshold to determine anomalies in the initial multidimensional time series data includes: Determining a sample set containing only normal multidimensional time series data as a validation set, and determining a first anomaly score based on the validation set; performing statistical analysis on the first anomaly scores to determine corresponding means and standard deviations; Determining a preset abnormality detection threshold based on the sum of the average value and a preset multiple of the standard deviation; A second anomaly score is determined based on the target multidimensional time series data and the initial multidimensional time series data of the engine, so as to determine an abnormality of the initial multidimensional time series data using the second anomaly score and the preset anomaly detection threshold.

8. A time series anomaly detection device based on a large model, characterized in that: The large model is an anomaly detection large model built based on a variational autoencoder, a recurrent neural network, and a convolutional neural network; wherein the device includes: a recurrent layer output module, configured to determine a convolutional layer output result based on the model convolutional layer of the anomaly detection large model and initial multidimensional time series data of the engine, and to determine a single recurrent layer output result and a time step prediction matrix based on the convolutional layer output result and the long short-term memory network of the model recurrent layer of the anomaly detection large model; wherein the model convolutional layer includes a filter and the convolutional neural network; and the multidimensional time series data includes data obtained by collecting the temperature, pressure, speed, and vibration frequency of the engine; a first output result fusion module, configured to determine a self-attention recurrent layer output result using the convolutional layer output result, the time step prediction matrix, the dimension of the single recurrent layer output result, and the model self-attention recurrent layer of the large anomaly detection model, and determine a fused output result based on the single recurrent layer output result, the self-attention recurrent layer output result, and a first preset result fusion mechanism; the model self-attention recurrent layer includes a self-attention mechanism and the long short-term memory network; a second output result fusion module, configured to determine a linear output result based on the model linear learning layer of the anomaly detection large model and the initial multidimensional time series data, and determine a target output result using the linear output result, the fused output result, and a second preset result fusion mechanism; an anomaly detection module, configured to determine target multidimensional time series data based on the target output result and the decoder of the variational autoencoder, and perform anomaly detection using the target multidimensional time series data, the initial multidimensional time series data of the engine, and a preset anomaly detection threshold to determine anomalies in the initial multidimensional time series data, so as to discover potential faults of the engine based on the anomalies in the initial multidimensional time series data.

9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to execute the computer program to implement the large model-based time series anomaly detection method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that Used to store a computer program; wherein, when the computer program is executed by a processor, the time series anomaly detection method based on a large model according to any one of claims 1 to 7 is implemented.

Images