A method and device for detecting anomalies in time series data

Abstract

The present invention provides a method and device for detecting anomalies in time series data. The method is used to detect anomalies in time series data based on a trained anomaly detection model. The anomaly detection model includes a multi-perspective slice alignment module, a multi-scale state perception module, and a consistent representation reconstruction module. The method comprises: slicing the time series data to be detected using different slicing parameters to obtain multiple sets of first-perspective slice sets, and performing matrix reorganization on each of the multiple sets of first-perspective slice sets to obtain multiple sets of second-perspective slice sets; performing feature fusion on the first-perspective slice sets and the second-perspective slice sets based on the multi-perspective slice alignment module to obtain multi-perspective features; performing multi-scale state perception on the multi-perspective features based on the multi-scale state perception module to obtain state-space perception features; and performing overall consistency assessment on the state-space perception features based on the consistent representation reconstruction module to obtain detection results. The present invention improves the accuracy of anomaly detection in time series data.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a method and device for detecting anomalies in time series data. Background Art

[0002] Time series anomaly detection is widely used in various fields, including medical device testing, financial fraud detection, and industrial control system testing. With the continuous development of the Internet of Things and the rapid growth of various sensors, operational systems are constantly generating large amounts of high-dimensional, multivariate time series data. However, large-scale systems inevitably experience anomalies, and sudden problems often lead to irreversible and significant losses. Therefore, quickly and accurately processing massive amounts of information and detecting anomalies are crucial to ensuring system security and preventing economic losses.

[0003] Recurrent neural networks (RNNs) or long short-term memory (LSTM) structures are commonly used for anomaly prediction in time series data. However, these networks suffer from long-term forgetfulness, making it difficult to learn a global normal model for the sequence. Furthermore, these linear structures prevent parallel computation, significantly slowing model training. In other words, both LSTM and Transformer processing modes can only extract features at a limited scale, inevitably resulting in loss of deep information and, in turn, low accuracy in anomaly detection for time series data.

[0004] Therefore, there is an urgent need to provide a method and device for anomaly detection in time series data to avoid the loss of deep information and comprehensively combine features of multiple scales to improve the accuracy of anomaly detection in time series data. Summary of the Invention

[0005] In view of this, it is necessary to provide a method and device for anomaly detection of time series data to solve the technical problem in the existing technology that features can only be extracted from partial scales, resulting in deep information loss, and thus leading to low accuracy of anomaly detection results of time series data.

[0006] On one hand, in order to solve the above technical problems, the present invention provides a method for anomaly detection in time series data, which is used to detect anomalies in time series data to be detected based on a trained anomaly detection model. The anomaly detection model includes a multi-view slice alignment module, a multi-scale state perception module, and a consistent representation reconstruction module. The method includes:

[0007] Slicing the time series data to be detected with different slicing parameters to obtain multiple groups of first-view slice sets, and performing matrix reorganization on the multiple groups of first-view slice sets to obtain multiple groups of second-view slice sets;

[0008] Performing feature fusion on the first-view slice set and the second-view slice set based on the multi-view slice alignment module to obtain multi-view features;

[0009] Performing multi-scale state perception on the multi-view features based on the multi-scale state perception module to obtain state space perception features;

[0010] An overall consistency evaluation is performed on the state space perception features based on the consistent representation reconstruction module to obtain a detection result.

[0011] In a possible implementation, the slice parameters include the number of slices and the unit slice length.

[0012] In a possible implementation, the multi-view slice alignment module includes an intra-slice embedding unit, an inter-slice embedding unit, and an information alignment unit; then, performing feature fusion on the first-view slice set and the second-view slice set based on the multi-view slice alignment module to obtain multi-view features includes:

[0013] Performing feature embedding on the multiple groups of first-view slice sets based on the intra-slice embedding unit to obtain multiple groups of intra-slice features;

[0014] Performing feature embedding on the multiple sets of second-view slice sets based on the inter-slice embedding unit to obtain multiple sets of inter-slice features;

[0015] Based on the information alignment unit, feature fusion is performed on the multiple groups of intra-slice features and the multiple groups of inter-slice features to obtain the multi-view features.

[0016] In a possible implementation, the multi-view feature is:

[0017]

[0018] Where Z p is a multi-view feature; q is the number of groups of the first-view slice set and the second-view slice set; is the i-th group of first-view slices Corresponding intra-slice features; is the i-th set of second-view slices Corresponding inter-slice features; ⊕ is the matrix concatenation operator; E inter () is the embedding operation in the slice; P i () is the linear projection operation within the slice; E cross () is the inter-slice embedding operation; P c () is the linear projection operation between slices.

[0019] In one possible implementation, the multi-scale state perception module includes a global attention unit, a state space perception unit, and a mutual attention unit; then performing multi-scale state perception on the multi-view features based on the multi-scale state perception module to obtain state space perception features includes:

[0020] Performing global attention learning on the multi-view features based on the global attention unit to obtain attention features;

[0021] Determining latent variables of the attention feature at different time steps based on the state space perception unit, and determining output features at different time steps based on the latent variables and the attention feature;

[0022] Based on the mutual attention unit, mutual attention learning is performed on the multi-view features and the output features to obtain the state space perception features.

[0023] In a possible implementation, the multi-scale state perception module further includes a local feature extraction unit disposed between the global attention unit and the state space perception unit; the local feature extraction unit is used to extract local information of the attention feature to obtain a local feature.

[0024] In a possible implementation, the state space perception feature is:

[0025]

[0026] Where V is the spatial state perception feature; V i is the output of the i-th attention head in the mutual attention learning unit; M is the number of attention heads in the mutual attention learning unit; d k is the dimension of each attention head; is the output feature of the i-th time step; N i 、 Both are learnable parameter matrices; is the local feature of the t-th time step; is the latent variable at the t-th time step; I is the identity matrix; is the latent variable at the t-1th time step.

[0027] In one possible implementation, the consistent representation reconstruction module includes an encoder and a decoder; and performing an overall consistency evaluation on the state space perception feature based on the consistent representation reconstruction module to obtain a detection result includes:

[0028] a fitted distribution for determining the state-space perceptual features based on the encoder;

[0029] Based on the estimated fitting distribution used by the decoder to determine the state-space perceptual features, an overall consistency evaluation is performed on the fitting distribution and the estimated fitting distribution to determine the detection result.

[0030] In one possible implementation, the total loss function of the anomaly detection model during training is:

[0031]

[0032] L re =-E q(z│x) [log(p(x|z))]+D KL [q(z|x)||p(x|z)]

[0033]

[0034] Where, is the total loss function; L a is the similarity loss function; L re is the reconstruction loss function; E q(z│x) [log(p(x|z))] is the maximum likelihood estimate of q(z│x) for log(p(x|z)); p(x|z) is the fitted distribution; q(z│x) is the estimated fitted distribution; D KL [q(z|x)||p(z)] is the KL divergence between q(z│x) and p(x|z); Z in is the feature within the slice; Z cr is the inter-slice feature; || ||2 is the Euclidean norm.

[0035] On the other hand, the present invention also provides an anomaly detection device for time series data, which is used to detect anomalies in time series data based on a trained anomaly detection model. The anomaly detection model includes a multi-view slice alignment module, a multi-scale state perception module, and a consistent representation reconstruction module. The device includes:

[0036] a slicing unit, configured to slice the time series data to be detected using different slicing parameters to obtain multiple sets of first-view slice sets, and to perform matrix reorganization on the multiple sets of first-view slice sets to obtain multiple sets of second-view slice sets;

[0037] a multi-view feature determination unit, configured to perform feature fusion on the first-view slice set and the second-view slice set based on the multi-view slice alignment module to obtain multi-view features;

[0038] a state space perception feature determination unit, configured to perform multi-scale state perception on the multi-view features based on the multi-scale state perception module to obtain a state space perception feature;

[0039] An anomaly detection unit is used to perform an overall consistency evaluation on the state space perception feature based on the consistent representation reconstruction module to obtain a detection result.

[0040] The beneficial effect of the present invention is that: the anomaly detection method for time series data provided by the present invention, after slicing the time series data to be detected with different slicing parameters to obtain multiple groups of first-perspective slice sets, matrix reorganizes the multiple groups of first-perspective slice sets to obtain multiple groups of second-perspective slice sets, so that the overall slice set finally obtained includes both the different dimensions of a slice within a batch and the same dimensions of different slices between batches as different perspective data to embed data, thereby realizing comprehensive perception of the time series data to be detected, improving the comprehensiveness of the multi-perspective features after feature fusion, and improving the detection accuracy of time series data anomaly detection based on multi-perspective features.

[0041] Furthermore, the present invention sets a multi-scale state perception module to perform multi-scale state perception on multi-view features, which can take into account the time series state while fully perceiving multi-dimensional time series data, further realizing deep perception of time series data, so as to further improve the accuracy of the detection results. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0043] Figure 1 A schematic diagram of the structure of an embodiment of the anomaly detection model provided by the present invention;

[0044] Figure 2 A flow chart of an embodiment of the method for detecting anomalies in time series data provided by the present invention;

[0045] Figure 3 This is a flow chart of an embodiment of step S202 of the present invention;

[0046] Figure 4 This is a flow chart of an embodiment of step S203 of the present invention;

[0047] Figure 5 This is a schematic structural diagram of an embodiment of the device for detecting anomalies in time series data provided by the present invention. DETAILED DESCRIPTION

[0048] The following will provide a clear and complete description of the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only some of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0049] It should be understood that the schematic drawings are not drawn to scale. The flowcharts used in the present invention illustrate operations implemented according to some embodiments of the present invention. It should be understood that the operations of the flowcharts can be implemented out of sequence, and steps that have no logical contextual relationship can be reversed in order or implemented simultaneously. In addition, those skilled in the art, guided by the content of the present invention, can add one or more other operations to the flowcharts or remove one or more operations from the flowcharts. Some of the block diagrams shown in the accompanying drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in the form of software, or in one or more hardware modules or integrated circuits, or in different networks and / or processor systems and / or microcontroller systems.

[0050] References herein to "embodiments" mean that a particular feature, structure, or characteristic described in connection with the embodiments may be included in at least one embodiment of the present invention. The appearance of this phrase in various places in the specification does not necessarily refer to the same embodiment, nor does it constitute a separate or alternative embodiment that is mutually exclusive of other embodiments. It is understood, both explicitly and implicitly, by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0051] The present invention provides a method and device for detecting anomalies in time series data, which are described below.

[0052] Before describing the specific embodiments, we first want to explain that the anomaly detection method for time series data in the embodiment of the present invention is based on an anomaly detection model. Figure 1 A schematic diagram of the structure of an embodiment of the anomaly detection model provided by the present invention is shown as follows: Figure 1 As shown in , the anomaly detection model includes a multi-view slice alignment module, a multi-scale state perception module, and a consistent representation reconstruction module. Figure 2 As shown in Figure 2, anomaly detection methods for time series data include:

[0053] S201, slicing the time series data to be detected using different slicing parameters to obtain multiple groups of first-view slice sets, and performing matrix reorganization on the multiple groups of first-view slice sets to obtain multiple groups of second-view slice sets;

[0054] S202, performing feature fusion on the first-view slice set and the second-view slice set based on the multi-view slice alignment module to obtain multi-view features;

[0055] S203, performing multi-scale state perception on the multi-view features based on the multi-scale state perception module to obtain state space perception features;

[0056] S204: Based on the consistent representation reconstruction module, an overall consistency evaluation is performed on the state space perception features to obtain a detection result.

[0057] It should be understood that the time series data to be detected is also acquired from the original time series data through the data acquisition window.

[0058] The first perspective refers to the different time spans in the time series data to be detected, and the second perspective can be the data type dimension in the time series data to be detected. In other words, the time series data to be detected is reorganized from two completely different dimensions to achieve multi-perspective perception.

[0059] Compared with the prior art, the anomaly detection method for time series data provided by an embodiment of the present invention, after slicing the time series data to be detected with different slicing parameters to obtain multiple groups of first-perspective slice sets, performs matrix reorganization on the multiple groups of first-perspective slice sets to obtain multiple groups of second-perspective slice sets, so that the overall slice set finally obtained includes both the different dimensions of a slice within a batch and the same dimensions of different slices between batches as different perspective data to embed data, thereby realizing comprehensive perception of the time series data to be detected, improving the comprehensiveness of the multi-perspective features after feature fusion, and improving the detection accuracy of time series data anomaly detection based on multi-perspective features.

[0060] Furthermore, the embodiment of the present invention sets a multi-scale state perception module to perform multi-scale state perception on multi-view features, which can take into account the time series state while fully perceiving multi-dimensional time series data, further realizing deep perception of time series data, so as to further improve the accuracy of the detection results.

[0061] In some embodiments of the present invention, the slice parameters include the number of slices and the unit slice length, and the slice parameters satisfy: τ=e×sub, τ is the size of the acquisition window, sub is the number of slices; e is the unit slice length.

[0062] Multiple sets of first-person perspective slice sets can be obtained based on different slice parameters q is the total number of slice parameters.

[0063] In a specific embodiment of the present invention, Figure 1 As shown, the multi-view slice alignment module includes an intra-slice embedding unit, an inter-slice embedding unit, and an information alignment unit; Figure 3 As shown, step S202 includes:

[0064] S301, performing feature embedding on multiple sets of first-view slice sets based on an intra-slice embedding unit to obtain multiple sets of intra-slice features;

[0065] S302, performing feature embedding on multiple sets of second-view slice sets based on an inter-slice embedding unit to obtain multiple sets of inter-slice features;

[0066] S303 : Based on the information alignment unit, feature fusion is performed on multiple groups of intra-slice features and multiple groups of inter-slice features to obtain multi-view features.

[0067] Specifically, Perform feature embedding, and w i is the slice data in the i-th first-view slice set. Then use the CNN network as the slice embedding network E inter , and then through the linear projection P in the slice i Project all embedded representations into a unified space to obtain more detailed intra-slice feature representations

[0068]

[0069] right Perform feature embedding, where u i is the combined information of the i-th dimension of all sub-slices. Similarly, CNN network is used to embed E between slices. cross , and then through the linear projection P between slices c , to obtain relatively macroscopic inter-slice characterization

[0070]

[0071] Finally, the inter-slice and intra-slice features under different slicing methods are fused to obtain multi-view features:

[0072]

[0073] Where Z p is a multi-view feature; q is the number of first-view slice sets and second-view slice sets; ⊕ is a matrix concatenation operator.

[0074] In order to learn a stronger representation, in some embodiments of the present invention, such as Figure 1 As shown in , the multi-scale state perception module includes a global attention unit, a state space perception unit, and a mutual attention unit; Figure 4 As shown, step S103 includes:

[0075] S401, performing global attention learning on multi-view features based on the global attention unit to obtain attention features;

[0076] S402, determining the latent variables of the attention feature at different time steps based on the state space perception unit, and determining the output features at different time steps based on the latent variables and the attention feature;

[0077] S403: Perform mutual attention learning on multi-view features and output features based on the mutual attention unit to obtain state space perception features.

[0078] The embodiment of the present invention sets a global attention unit to perform global attention learning on multi-view features, so as to obtain the mutual relationship of time series data at different scales. By setting a state space perception unit, the features that retain the time state relationship can be improved from the coherent time domain, and then the deep features of the state space perception features can be extracted to further improve the accuracy of the anomaly detection results.

[0079] In order to better sense abnormal emergencies, in some embodiments of the present invention, such as Figure 1 As shown, the multi-scale state perception module also includes a local feature extraction unit arranged between the global attention unit and the state space perception unit; the local feature extraction unit is used to extract local information of the attention feature to obtain local features.

[0080] The embodiment of the present invention acquires local information by setting a local feature extraction unit, and can obtain the local relationship between features after global attention, so as to increase the perception of abnormal mutations and improve the robustness of anomaly detection.

[0081] In summary, the global attention unit first obtains Q, K, and V from each attention head and calculates global self-attention to obtain comprehensive correlations. The local feature extraction unit then extracts local feature relationships. After normalization using an activation function, a state-space machine is used to extract features that preserve temporal state relationships from the coherent time domain. The mutual attention mechanism then adjusts the weights of information at different scales in the original structure.

[0082] Specifically: The global attention unit obtains preliminary overall correlation. Using the multi-view feature Z obtained in the previous step p , respectively, obtain the Q, K, V matrices in each attention head, where the output S of each attention head is i as follows:

[0083]

[0084] Among them, d k is the dimension of each attention head, and f(·) is the linear projection.

[0085] The local feature extraction unit uses the CNN convolution module c(·) to further obtain local information relationships:

[0086] C i =c(s(Z p ))

[0087] Where C i It is a local feature.

[0088] In time series data, it is usually necessary to consider the characteristics of time series state transition. The local relationship C obtained in the previous step i The number of batches in a batch can be viewed as D time steps. i It can also be expressed as In order to further improve the perception of specific time series data, the state space perception unit is used to establish a latent variable space to store the time state. The latent variable at the t-th time step can be expressed as:

[0089]

[0090] Where, Both are learnable parameter matrices; is the local feature of the t-th time step; is the latent variable at the t-th time step; I is the identity matrix; is the latent variable at the t-1th time step.

[0091] At this time, the output representation o corresponding to time step t t It can be characterized as:

[0092]

[0093] Where, is the state space perception feature; N i Both are learnable parameter matrices; is the local feature of the t-th time step; is the latent variable at the t-th time step.

[0094] Mutual attention: The Q and K matrices of the attention projection here are the outputs of the state space model And the initial batch projection output Z of this module p After activation, the matrix is ​​obtained by matrix cross multiplication, and the V matrix is ​​directly obtained by using the activated Z p Therefore, an attention head of the mutual attention module can be expressed as:

[0095]

[0096] Finally, the state space perception features are:

[0097]

[0098] Where M is the number of attention heads in the mutual attention learning unit.

[0099] In some embodiments of the present invention, Figure 1 As shown, the consistent representation reconstruction module includes an encoder and a decoder; then step S104 includes:

[0100] Based on the fitted distribution used by the encoder to determine the state-space perceptual features;

[0101] Based on the estimated fitting distribution used by the decoder to determine the state-space perceptual features, an overall consistency evaluation is performed on the fitting distribution and the estimated fitting distribution to determine the detection result.

[0102] The consistent representation reconstruction module in this embodiment of the present invention first uses the encoder to learn the distribution of the latent variables, then samples this distribution to ensure that the model closely fits the regular structure of the time series while avoiding overfitting to anomalous samples. Finally, the decoder is used to predict an estimate of the input features. This ensures a certain variance and uses the reconstructed estimate to learn the overall distribution, thereby amplifying the differences from potential anomalous samples and achieving accurate anomaly detection.

[0103] Among them, the encoder structure is expressed as:

[0104] E v (V)=proj(s(V))

[0105] This is equivalent to fitting the distribution q(z│x), where z|x~N(a,b); a,b are the mean and variance of the distribution respectively.

[0106] The decoder is used to fit the estimated distribution P(x│z), which can be expressed as: D v (V) = s(proj(V)).

[0107] Because the training adopts unsupervised learning, a reconstruction method is used here to find the subtle differences between normal samples and abnormal samples. That is, in a specific embodiment of the present invention, the total loss function of the anomaly detection model during training is:

[0108]

[0109] L re =-E q(z│x) [log(p(x|z))]+D KL [q(z|x)||p(x|z)]

[0110]

[0111] Where, is the total loss function; L a is the similarity loss function; L re is the reconstruction loss function; E q(z│x) [log(p(x|z))] is the maximum likelihood estimate of q(z│x) for log(p(x|z)); p(x|z) is the fitted distribution; q(z│x) is the estimated fitted distribution; D KL [q(z|x)||p(z)] is the KL divergence between q(z│x) and p(x|z); Z in is the feature within the slice; Z cr is the inter-slice feature; || ||2 is the Euclidean norm.

[0112] The embodiments of the present invention utilize a reconstruction loss function to maximize the decoder's fitting capabilities, achieving stronger representational capabilities, regardless of the encoder. KL divergence is used to regularize the encoder and decoder, thereby planning the structure of the latent space. Furthermore, by aligning features at different angles using a similarity loss function, the accuracy of the loss value during training can be further improved, thereby enhancing the model detection performance of the anomaly detection model determined using this loss function.

[0113] In summary, the anomaly detection method for time series data proposed in an embodiment of the present invention uses a multi-perspective slice alignment structure in the information embedding stage, divides the data into batches of different sizes, and each group contains the different dimensions of a slice within the batch and the same dimensions of different slices between batches as different perspectives to embed the data. At the same time, the input data is three-dimensionalized by aligning different embeddings. This can fully perceive the regional correlation of the data. Then, a multi-scale state space perception module is used to fully perceive the multi-dimensional time series data while considering the time series state. The latent state space is used to extract deep features from multiple scales of global correlation, local correlation, and time series state transition. Features about time series patterns in the data are amplified. Finally, consistent representation reconstruction is used to fit normal sequence features, ensuring the excellent fitting ability of the model.

[0114] In order to better implement the anomaly detection method for time series data in the embodiment of the present invention, based on the anomaly detection method for time series data, the embodiment of the present invention also provides an anomaly detection device for time series data, such as Figure 5 As shown, the anomaly detection device 500 for time series data includes:

[0115] a slicing unit 501 configured to slice the time series data to be detected using different slicing parameters to obtain multiple first-view slice sets, and to perform matrix reorganization on the multiple first-view slice sets to obtain multiple second-view slice sets;

[0116] A multi-view feature determination unit 502 is configured to perform feature fusion on the first-view slice set and the second-view slice set based on the multi-view slice alignment module to obtain multi-view features;

[0117] A state space perception feature determination unit 503 is configured to perform multi-scale state perception on multi-view features based on a multi-scale state perception module to obtain a state space perception feature;

[0118] The anomaly detection unit 504 is configured to perform an overall consistency evaluation on the state space perception features based on the consistent representation reconstruction module to obtain a detection result.

[0119] The anomaly detection device 500 for time series data provided in the above embodiment can implement the technical solution described in the above embodiment of the anomaly detection method for time series data. The specific implementation principles of the above modules or units can refer to the corresponding contents in the above embodiment of the anomaly detection method for time series data, and will not be repeated here.

[0120] Those skilled in the art will appreciate that all or part of the process steps of the above-described embodiments can be implemented by instructing related hardware (such as a processor, a controller, etc.) through a computer program, and the computer program can be stored in a computer-readable storage medium. The computer-readable storage medium may be a magnetic disk, an optical disk, a read-only memory, or a random access memory.

[0121] The above is a detailed introduction to the anomaly detection method and device for time series data provided by the present invention. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core ideas. At the same time, for those skilled in the art, based on the ideas of the present invention, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A method for detecting anomalies in time series data, characterized in that: Applied to medical device detection, it is used to detect anomalies in time series data to be detected based on a trained anomaly detection model. The anomaly detection model includes a multi-view slice alignment module, a multi-scale state perception module, and a consistent representation reconstruction module. The method includes: Slicing the time series data to be detected with different slicing parameters to obtain multiple sets of first-perspective slice sets, and performing matrix reorganization on the multiple sets of first-perspective slice sets to obtain multiple sets of second-perspective slice sets; the first perspective is different time spans in the time series data to be detected, and the second perspective is different data types in the time series data to be detected; Performing feature fusion on the first-view slice set and the second-view slice set based on the multi-view slice alignment module to obtain multi-view features; Performing multi-scale state perception on the multi-view features based on the multi-scale state perception module to obtain state space perception features; Performing an overall consistency evaluation on the state space perception features based on the consistent representation reconstruction module to obtain a detection result; The multi-view slice alignment module includes an intra-slice embedding unit, an inter-slice embedding unit, and an information alignment unit; performing feature fusion on the first-view slice set and the second-view slice set based on the multi-view slice alignment module to obtain multi-view features includes: Performing feature embedding on the multiple groups of first-view slice sets based on the intra-slice embedding unit to obtain multiple groups of intra-slice features; Performing feature embedding on the multiple sets of second-view slice sets based on the inter-slice embedding unit to obtain multiple sets of inter-slice features; Based on the information alignment unit, feature fusion is performed on the multiple groups of intra-slice features and the multiple groups of inter-slice features to obtain the multi-view features.

2. The anomaly detection method for time series data according to claim 1, characterized in that: The slice parameters include the number of slices and the unit slice length.

3. The anomaly detection method for time series data according to claim 1, characterized in that: The multi-view features are: Where, It is a multi-view feature; is the number of groups of first-view slice sets and second-view slice sets; is the i-th group of first-view slices Corresponding intra-slice features; is the i-th set of second-view slices Corresponding inter-slice features; is the matrix concatenation operator; Embed operations within slices; It is the linear projection operation within the slice; It is the inter-slice embedding operation; It is the linear projection operation between slices.

4. The anomaly detection method for time series data according to claim 1, characterized in that: The multi-scale state perception module includes a global attention unit, a state space perception unit and a mutual attention unit; Then, performing multi-scale state perception on the multi-view features based on the multi-scale state perception module to obtain state space perception features includes: Performing global attention learning on the multi-view features based on the global attention unit to obtain attention features; Determining latent variables of the attention feature at different time steps based on the state space perception unit, and determining output features at different time steps based on the latent variables and the attention feature; Based on the mutual attention unit, mutual attention learning is performed on the multi-view features and the output features to obtain the state space perception features.

5. The anomaly detection method for time series data according to claim 4, characterized in that: The multi-scale state perception module also includes a local feature extraction unit arranged between the global attention unit and the state space perception unit; the local feature extraction unit is used to extract local information of the attention feature to obtain local features.

6. The anomaly detection method for time series data according to claim 5, characterized in that: The state space perception features are: Where, It is the spatial state perception feature; is the output of the i-th attention head in the mutual attention learning unit; M is the number of attention heads in the mutual attention learning unit; is the dimension of each attention head; is the output feature of the tth time step; 、 、 、 Both are learnable parameter matrices; is the local feature of the t-th time step; is the latent variable at the t-th time step; is the identity matrix; is the latent variable at the t-1th time step; It is a multi-view feature; is a linear projection.

7. The anomaly detection method for time series data according to claim 1, characterized in that: The consistent representation reconstruction module includes an encoder and a decoder; and performing an overall consistency evaluation on the state space perception feature based on the consistent representation reconstruction module to obtain a detection result includes: a fitted distribution for determining the state-space perceptual features based on the encoder; Based on the estimated fitting distribution used by the decoder to determine the state-space perceptual features, an overall consistency evaluation is performed on the fitting distribution and the estimated fitting distribution to determine the detection result.

8. The anomaly detection method for time series data according to claim 7, characterized in that: The total loss function of the anomaly detection model during training is: Where, is the total loss function; is the similarity loss function; is the reconstruction loss function; for right The maximum likelihood estimate of ; is the fitted distribution; To estimate the fitted distribution; for and The KL divergence between is the intra-slice feature; is the inter-slice feature; || ||2 is the Euclidean norm.

9. A device for detecting anomalies in time series data, characterized in that: Applied to medical equipment detection, it is used to detect anomalies in time series data to be detected based on a trained anomaly detection model. The anomaly detection model includes a multi-view slice alignment module, a multi-scale state perception module, and a consistent representation reconstruction module. The device includes: a slicing unit, configured to slice the time series data to be detected using different slicing parameters to obtain multiple sets of first-view slice sets, and to perform matrix reorganization on the multiple sets of first-view slice sets to obtain multiple sets of second-view slice sets; the first view represents different time spans in the time series data to be detected, and the second view represents different data types in the time series data to be detected; a multi-view feature determination unit, configured to perform feature fusion on the first-view slice set and the second-view slice set based on the multi-view slice alignment module to obtain multi-view features; a state space perception feature determination unit, configured to perform multi-scale state perception on the multi-view features based on the multi-scale state perception module to obtain a state space perception feature; an anomaly detection unit, configured to perform an overall consistency evaluation on the state space perception features based on the consistent representation reconstruction module to obtain a detection result; The multi-view slice alignment module includes an intra-slice embedding unit, an inter-slice embedding unit, and an information alignment unit; performing feature fusion on the first-view slice set and the second-view slice set based on the multi-view slice alignment module to obtain multi-view features includes: Performing feature embedding on the multiple groups of first-view slice sets based on the intra-slice embedding unit to obtain multiple groups of intra-slice features; Performing feature embedding on the multiple sets of second-view slice sets based on the inter-slice embedding unit to obtain multiple sets of inter-slice features; Based on the information alignment unit, feature fusion is performed on the multiple groups of intra-slice features and the multiple groups of inter-slice features to obtain the multi-view features.

Images