Time sequence anomaly detection method based on vertical federated learning
Through the vertical federated learning method, the LSTM and CNN model combined with encryption technology is used to realize the abnormal detection of time series data scattered in different enterprises, solving privacy and security issues, and improving detection efficiency and data security.
Patent Information
- Application Number
- CN202510462005.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-04-14
- Publication Date
- 2025-08-01
AI Technical Summary
The prior art is difficult to detect abnormalities in time series data scattered among different enterprises, especially because data cannot be processed centrally due to privacy and security issues.
Using a method based on vertical federated learning, the LSTM model is constructed by each participant to capture long-term dependencies, the server builds a CNN model to capture local dependencies, and uses encryption to process intermediate result vectors to achieve secure sharing and joint training of data.
It effectively solves the problem of abnormal detection of dispersed data, enhances the effectiveness and data security of the model, and improves data privacy during training and prediction.
Smart Images
Figure CN120408660A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical fields of data privacy protection and time series analysis, and specifically provides a time series anomaly detection method based on vertical federated learning. Background Art
[0002] With the rapid development of Internet and sensor technologies, a large amount of time series data has been generated in various industries, such as sensor data, transaction records, and user behaviors. The rapid growth and diversification of these data have made it an urgent need to automatically detect anomalies among them. However, these time series data are often scattered in different places. For example, sensor data is stored in different edge devices, and transaction record information is stored in different enterprises respectively. Due to privacy and security issues, it is difficult to centralize these data to identify abnormal devices, abnormal transactions, and other abnormal data. These abnormal data may be signals of system failures, frauds, health problems, etc. If these anomalies can be discovered and processed in a timely manner, losses can be reduced, and efficiency and service quality can be improved.
[0003] Currently, there are many centralized time series anomaly detection models, whose main goal is to identify or detect abnormal models or behaviors in time series data. However, these models are difficult to be directly applied to dispersed time series data. In view of the phenomenon that Internet of Things devices in industry are easily attacked, the federated learning framework is applied to time series anomaly detection, which proves the feasibility of federated learning in anomaly detection. However, it is not suitable for the case where different feature data of the same sample are distributed in different enterprises, that is, it is not suitable for time series data with the same sample space but different feature spaces. Due to privacy and security issues, each enterprise will not share local data, and how to perform anomaly detection on these time series data has not been effectively solved.
[0004] By studying the time series anomaly detection method based on vertical federation, it is of great significance for the current anomaly detection of time series data features scattered in different enterprises. Summary of the Invention
[0005] For many industries currently having time series data, but these data are often distributed in different enterprises, and due to privacy and security issues, enterprises will not share local data. How to perform anomaly detection on these time series data scattered in different enterprises is a problem. The present invention provides a method for time series anomaly detection based on vertical federated learning, and performs anomaly detection on these time series data scattered in different enterprises through vertical federated learning.
[0006] The object of the present invention is achieved through the following technical solutions:
[0007] A time series anomaly detection method based on vertical federation, the method comprising the following steps:
[0008] Step (1), each participating party respectively collects local time series data, and the time series data of each participating party has the same sample space but different and non-overlapping feature spaces.
[0009] Step (2), preprocess the local time series data collected by each participating party, including but not limited to normalization processing, so that the data meets the requirements of subsequent processing.
[0010] Step (3), each participating party performs an alignment operation on the preprocessed local time series data set to generate a new joint data set with the same sample ID, so as to achieve collaboration at the sample level of the data.
[0011] Step (4), each participating party inputs the new joint data set into its own constructed local time series model and performs encryption processing to obtain an encrypted intermediate result vector, and the local time series model is a model that can capture the characteristics of time series data.
[0012] Step (5), the server receives the encrypted intermediate result vectors uploaded by each participating party, performs an aggregation operation, and then inputs the aggregated result into the model constructed by the server for training to obtain the loss gradients required for each participating party and the server to update the parameters. Update the server model parameters through the loss gradients, and pass the gradients required for each participating party to update the parameters to each participating party. The server model is a model that can perform data fusion and analysis.
[0013] Step (6), each participating party updates its own model according to the loss gradients transmitted by the server through optimization algorithms such as backpropagation to obtain its own target model, so as to improve the fitting and analysis ability of the model for local data.
[0014] Step (7), when there is an anomaly detection request, each participating party first preprocesses the time series data to be detected, then generates a new joint data set with the same sample ID through algorithm alignment, and then inputs the joint data set into its own target model and performs encryption processing to obtain an encrypted intermediate result vector.
[0015] Step (8), the server aggregates the encrypted intermediate result vectors uploaded by each participating party, and then inputs them into the server model, and finally obtains the anomaly detection result to judge whether the time series data to be detected is abnormal.
[0016] Advantages of the present invention: By having each participating party upload the intermediate result vectors to the server, the problem of how to perform joint training effectively is solved under the condition that the time series data features are scattered among different participating parties and the participating parties do not share their local time series data, enhancing the effectiveness of the model; By locally constructing an LSTM model at the participating party, the long-term dependence relationship of the local time series data can be captured and the time series features can be learned; By constructing a CNN model at the server, the local dependence relationship can be well captured and the computing time can be reduced; The participating party can prevent attackers from reconstructing the original feature vectors using the intermediate result vectors by encrypting the intermediate result vectors, improving the data security and data privacy during the training process and the prediction process. Brief Description of the Drawings
[0017] Figure 1 It is a flowchart of the method according to an embodiment of the present invention. Detailed Embodiments
[0018] To make the objectives, features, and advantages of the present disclosure more obvious and understandable, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present disclosure. Obviously, the embodiments described below are only a part of the embodiments of the present disclosure, rather than all of the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by those of ordinary skill in the art without creative efforts belong to the scope of protection of the present disclosure.
[0019] As Figure 1 shown, an embodiment of the present application provides a method for time series anomaly detection based on vertical federation, including the following steps:
[0020] Step (1): Each participating party collects local time series data (where i represents the i-th timestamp of the time series data, and A, B,..., D, etc. represent the feature spaces of the time series data of different participating parties, and it is assumed that the feature spaces of the time series data of these participating parties do not overlap).
[0021] Step (2): Normalize the local time series data collected by each of the above participating parties.
[0022] Step (3): Each participating party aligns the normalized local time series data sets through an algorithm to generate a new joint data set with the same sample ID.
[0023] Step (4): The participating party inputs the new joint data set into the locally constructed LSTM time series model and performs encryption processing to obtain an encrypted intermediate result vector.
[0024] Step (5): The server aggregates using the encrypted intermediate result vectors, and then inputs the aggregated result into the CNN model constructed by the server for training to obtain the loss gradients required for updating the parameters of each participant and the server. The server updates the model parameters of its CNN using the loss gradients it needs, and transmits the gradients required for each participant to update their parameters to each participant.
[0025] Step (6): Each participant updates its CNN model using the loss gradients transmitted by the server to obtain its target model.
[0026] Step (7): When there is a request for anomaly detection, the participant first normalizes the time series data to be anomalously detected, and then aligns it through an algorithm to generate a new joint dataset with the same sample ID. The participant inputs this joint dataset into its target model and performs encryption processing to obtain an encrypted intermediate result vector.
[0027] Step (8): The server aggregates the encrypted intermediate result vectors, and then inputs them into the server's CNN model to obtain an anomaly detection result, i.e., the result of whether the time series data to be anomalously detected is abnormal.
[0028] In an exemplary embodiment, step (2) includes the following steps:
[0029] (2-1) Each participant k has its own local dataset X k , X k which is time series data and is normalized by the following method:
[0030]
[0031] where min(τ) is the minimum vector calculated by pattern, max(τ) is the maximum vector calculated by pattern, and ∈ is a very small constant vector.
[0032] In an exemplary embodiment, step (3) is specifically:
[0033] m participants generate a new joint dataset {D1, D2,..., D m} with the same sample ID by aligning their respective local datasets through an Oblivious Pseudo-Random Function (OPRF), where all share the same sample space (i represents the timestamp of the sample, and j represents the feature).
[0034] In an exemplary embodiment, step (4) includes the following steps:
[0035] (4-1) The participating party inputs the new combined dataset into the LSTM model of the participating party to obtain an intermediate result vector.
[0036] (4-2) The participating party encrypts the multiple intermediate result vectors through secure multi-party computation. Specifically, the above intermediate result vectors are encrypted through the Secure Practical Aggregation protocol (PSA) to obtain the encrypted intermediate result vectors.
[0037] Furthermore, step (4-2) includes the following steps:
[0038] (a) In the first stage, namely the Gen stage, first, the participating party with the sample labels sends the list of participants to all participating parties and initiates the PSA process. Then each participant uses the ECDSA algorithm to generate a public and private key pair (p k , s k ). Each participating party spreads its public key to each other. Finally, each participating party calculates a series of masks Gen(sk, pk′) through the ECDH algorithm, where sk is its own private key and pk′ is the public key of other participating parties.
[0039] (b) The second stage, that is, the Enc stage, is the encryption stage. Each participating party uses its own mask to encrypt the data, and the encryption method is [x] = Enc(x, masks).
[0040] (c) To protect the privacy of the local time-series data of each participating party, the participating party encrypts the intermediate result vector through the above encryption method. The specific method is:
[0041]
[0042] In an exemplary embodiment, step (5) includes the following steps:
[0043] (5-1) The server aggregates the encrypted intermediate result vectors and then inputs them into the CNN model of the server to obtain the prediction results for the corresponding samples.
[0044] (5-2) The server determines the training error through the predicted sample results and the training sample labels corresponding to the encrypted intermediate result vectors.
[0045] (5-3) The server calculates the loss gradients required for updating the server model and each participating party model according to the training error, updates the server CNN model through the loss gradients required for the server model, and transmits the loss gradients required for updating each participating party model to each participating party.
[0046] In an exemplary embodiment, step (6) includes the following steps:
[0047] (6-1) The participating party updates the participating party's LSTM model according to the loss gradient transmitted by the server through the backpropagation algorithm to obtain optimal network parameters.
[0048] (6-2) The participating party updates its own target model by using the optimal network parameters.
[0049] In an exemplary embodiment, step (7) includes the following steps:
[0050] (7-1) When there is the abnormal detection request to be processed, the participating party first normalizes the time series data to be abnormally detected, and then aligns it through an algorithm to generate a new joint data set with the same sample ID. The participating party inputs this joint data set into its own target model to obtain an intermediate result vector.
[0051] (7-2) The participating party encrypts the intermediate result vector through secure multi-party computation. Specifically, the intermediate result vector is encrypted through a secure practical aggregation protocol (PSA) to obtain an encrypted intermediate result vector.
[0052] The method further includes a step of visualizing the abnormal detection result, and displays the timestamp and eigenvalue of the abnormal data through a graphical interface, which is convenient for users to quickly locate and analyze abnormal situations.
[0053] In summary, in this application, the LSTM model constructed by each participating party can well capture long-term dependencies and learn time series features, and the CNN model constructed by the server can well capture local dependencies; by each participating party transmitting the intermediate result vector to the server, it can be ensured that each participating party does not share its own time series data while still being able to learn the effective information in its own data of each participating party, enhancing the effectiveness of the model; the participating party encrypts the intermediate result vector to prevent attackers from using the intermediate result vector to reconstruct the original feature vector, which can improve the data security and data privacy in the training process and prediction process.
[0054] As described above, the above embodiments are only used to illustrate the technical solutions of the present disclosure, rather than to limit them; although the present disclosure has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: they can still modify the technical solutions recorded in the foregoing embodiments, or perform equivalent replacements for some of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present disclosure.
Claims
1. A time series anomaly detection method based on vertical federated learning, characterized in that Including the following steps: Step (1): Each participant separately collects local time series data. The time series data of each participant has the same sample space but different and non-overlapping feature spaces; Step (2): Preprocess the local time series data collected by each participant, including but not limited to normalization processing, so that the data meets the requirements of subsequent processing; Step (3): Each participant performs an alignment operation on the preprocessed local time series data set to generate a new joint data set with the same sample ID, so as to achieve collaboration at the sample level of the data; Step (4): Each participant inputs the new joint data set into the local time series model constructed by itself and performs encryption processing to obtain an encrypted intermediate result vector. The local time series model is a model capable of capturing the characteristics of time series data; Step (5): The server receives the encrypted intermediate result vectors uploaded by each participant, performs an aggregation operation, and then inputs the aggregated result into the model constructed by the server for training to obtain the loss gradients required for updating the parameters of each participant and the server. Update the server model parameters through the loss gradients, and pass the gradients required for each participant to update the parameters to each participant. The server model is a model capable of performing data fusion and analysis; Step (6): Each participant updates its own model according to the loss gradients transmitted by the server through optimization algorithms such as backpropagation to obtain its own target model, so as to improve the fitting and analysis ability of the model for local data; Step (7): When there is an anomaly detection request, each participant first preprocesses the time series data to be detected, then generates a new joint data set with the same sample ID through algorithm alignment, and then inputs the joint data set into its own target model and performs encryption processing to obtain an encrypted intermediate result vector; Step (8): The server aggregates the encrypted intermediate result vectors uploaded by each participant, then inputs them into the server model, and finally obtains the anomaly detection result to determine whether the time series data to be detected is abnormal.
2. The time series anomaly detection method based on vertical federated learning according to claim 1, wherein In step (3), each participant aligns the local data set through the oblivious pseudorandom function algorithm.
3. The method for time series anomaly detection based on vertical federated learning according to claim 1 or 2, characterized in that, In step (4), the specific encryption processing of the intermediate result vector by each participant is as follows: The secure and practical aggregation protocol in secure multi-party computation is used to encrypt the intermediate result vector. Specifically, it includes the following steps: Each participant generates a public key and private key pair using the elliptic curve digital signature algorithm and exchanges the public keys with each other; Each participant calculates a mask through the elliptic curve Diffie-Hellman algorithm for encrypting the intermediate result vector; Use the mask to encrypt the intermediate result vector to obtain the encrypted intermediate result vector.
4. The time series anomaly detection method based on vertical federated learning according to claim 3, wherein In step (5), the specific steps for the server to train the aggregated intermediate result vector include: Input the aggregated intermediate result vector into the convolutional neural network model constructed by the server; Obtain the training error by calculating the loss function between the prediction result and the true label; Calculate the loss gradients required for updating the server model and each participant model according to the training error; Update the CNN model parameters of the server using the loss gradients, and pass the loss gradients required by each participant to each participant.
5. The time series anomaly detection method based on vertical federated learning according to claim 1, characterized in that, In step (6), the specific method for each participant to update the local model according to the loss gradients transmitted by the server is as follows: Use the backpropagation algorithm, combined with the loss gradients transmitted by the server, to update the parameters of the local long short-term memory network model; Through multiple iterative optimizations, obtain the optimal network parameters, thereby updating the local model.
6. The method for time series anomaly detection based on vertical federated learning according to claim 1 or 5, characterized in that In step (7), the specific steps for preprocessing and aligning the time series data to be anomaly detected include: Perform normalization processing on the time series data to be detected; Use the OPRF algorithm to align the data to be detected with the local data, and generate a new joint data set with the same sample ID.
7. The time series anomaly detection method based on vertical federated learning according to claim 6, characterized in that In step 8, the specific method for the server to output the anomaly detection result is as follows: Input the aggregated encrypted intermediate result vector into the CNN model of the server; Through the forward propagation of the model, obtain the prediction result of the anomaly detection; According to the set threshold, determine whether the time series data to be detected is abnormal, and output the final anomaly detection result.
8. The time series anomaly detection method based on vertical federated learning according to claim 1, characterized in that The local time series model is a long short-term memory network LSTM model, the server model is a convolutional neural network CNN model, the LSTM model is used to capture the long-term dependencies of time series data, and the CNN model is used to capture the local features of the data.
9. The time series anomaly detection method based on vertical federated learning according to claim 1, wherein The method further includes a step of visualizing the anomaly detection result, and displaying the timestamp and feature values of the abnormal data through a graphical interface, which is convenient for users to quickly locate and analyze the abnormal situation.