Time series anomaly detection method and system based on diffusion model

Abstract

The present invention discloses a time series anomaly detection method and system based on a diffusion model, which belongs to the technical field of time series anomaly detection. The method comprises the following steps: obtaining multidimensional time series data; performing multi-scale convolution and block operations on the multidimensional time series data to obtain multiple feature blocks of fixed size; gradually adding noise to the feature blocks in the time series to model the distribution of the time series and obtain a noise-added fusion feature map; constructing a sliding window local attention-based method, taking the noise-added fusion feature map as input, iterating and denoising it over multiple time steps to generate a noise-free feature map, and mapping it to a reconstructed time series through a convolutional layer; calculating an anomaly score based on the reconstructed time series and comparing it with a set threshold to obtain an anomaly detection result. The present invention can effectively model temporal dependencies, effectively reduce computational complexity while maintaining accuracy, and improve lightweightness.

Description

Technical Field

[0001] The present invention belongs to the technical field of time series anomaly detection, and in particular relates to a time series anomaly detection method and system based on a diffusion model. Background Art

[0002] The statements herein merely provide background information related to the present invention and do not necessarily constitute prior art.

[0003] In the field of time series anomaly detection, deep learning methods have gradually become an important technical tool due to their powerful automatic feature learning capabilities and ability to model complex data patterns. Deep learning methods are mainly divided into two categories: reconstruction-based deep learning methods and prediction-based deep learning methods. Prediction-based deep learning methods detect anomalies by predicting future data points or sequences. These methods typically use historical time series data as input, train a deep learning model to predict future data, and identify anomalies by comparing the predicted values ​​with the actual observed values. Common prediction-based deep learning models include long short-term memory networks (LSTMs), gated recurrent units (GRUs), and Transformer models. Reconstruction-based deep learning methods typically rely on neural network models such as autoencoders (AEs). The core idea of ​​these methods is to use the model to learn normal patterns in time series data and use the reconstruction error to determine whether the data is anomalous. Common reconstruction-based deep learning models include autoencoders, variational autoencoders (VAEs), and generative adversarial networks (GANs).

[0004] However, the inventors discovered that the latent space of the autoencoder is the information bottleneck of the model, and the generative adversarial network suffers from training instability. Recently, the denoising diffusion probability model (DDPM), as an emerging deep generative model, has demonstrated excellent performance in multiple fields, including computer vision, natural language processing, and interpolation and prediction of time series data. Compared with automatic prediction (AE) and generative adversarial networks (GAN), DDPM shows significant advantages in generation quality, data distribution modeling, and training stability. These features have inspired researchers to explore its potential in time series anomaly detection tasks. Existing methods for applying diffusion models to time series anomalies include MadSGM and ImDiffusion, but these methods suffer from high computational overhead and insufficient understanding of the details of local feature dependency.

[0005] Time series anomaly detection technology based on the Transformer architecture has also attracted widespread attention. TranAD was proposed to learn the potential representation of normal data and measure the reconstruction error to determine anomalies. MAAT introduces an adaptive attention mechanism, combined with local and global dependency modeling, to improve the ability to detect anomalies in complex time series. However, although the above-mentioned methods based on the Transformer architecture have strong ability to capture local feature dependencies, they lack the ability to model the potential uncertainty and multimodal distribution in time series, which is insufficient when dealing with the diversity of abnormal behaviors in complex systems. In addition, most models based on the Transformer architecture have complex structures, low operating efficiency, and their lightweightness needs to be improved. Summary of the Invention

[0006] The purpose of this invention is to address the current deficiencies in temporal dependency modeling and lightweighting, and propose a time series anomaly detection method and system based on a diffusion model. By applying the generation characteristics of the diffusion model to the sample optimization process, temporal dependencies can be effectively modeled; an improved Transformer module (TFBlock) is proposed. By systematically reconstructing the attention mechanism in the Transformer module, a local attention mechanism based on a sliding window is introduced to more accurately represent local information. At the same time, it can effectively reduce the computational complexity and improve the lightweightness of the model while ensuring accuracy.

[0007] In order to achieve the above object, the present invention is implemented through the following technical solutions:

[0008] On the one hand, the technical solution of the present invention provides a time series anomaly detection method based on a diffusion model, comprising:

[0009] Obtain multidimensional time series data;

[0010] Perform multi-scale convolution and block operations on multi-dimensional time series data to obtain multiple feature blocks of fixed size, each of which represents the local features of the time series;

[0011] Gradually add noise to the feature blocks in the time series, model the distribution of the time series, and obtain the noise fusion feature map;

[0012] Constructing a sliding window local attention , taking the noisy fused feature map as input, iterates and denoises it over multiple time steps to generate a noise-free feature map, which is then mapped to a reconstructed time series through a convolutional layer;

[0013] The anomaly score is calculated based on the reconstructed time series and compared with the set threshold to obtain the anomaly detection result.

[0014] In at least one embodiment, the multidimensional time series data is obtained by:

[0015] Obtain raw multidimensional time series data from multiple public real-world datasets;

[0016] Normalize the different feature data in the original multidimensional time series data, map the feature values ​​to the interval [0, 1], ensure the consistency of the input feature value range, and obtain multidimensional time series data.

[0017] In at least one embodiment, multi-scale convolution and blocking operations are performed on multi-dimensional time series data. The specific process is as follows:

[0018] Feature extraction of multidimensional time series data using convolution kernels of different sizes;

[0019] Combine all extracted features into a complete feature map;

[0020] The complete feature map is divided into multiple fixed-size feature blocks, each of which represents the local features of the time series.

[0021] In at least one embodiment, noise is gradually added to feature blocks in a time series to model the distribution of the time series and obtain a noise-added fusion feature map. The specific process is as follows:

[0022] Add Gaussian noise to the feature block at each time step to obtain the noise latent variable;

[0023] Encode each time step into an embedding vector to obtain a time step embedding representation;

[0024] The noise latent variable is fused with the time step embedding representation to obtain the noisy fused feature map.

[0025] In at least one embodiment, sliding window local attention based It includes sequentially connected linear normalization layers, expansion and transformation layers, and sliding window-based local attention layers.

[0026] In at least one embodiment, the process of generating a noise-free feature map specifically includes:

[0027] Based on the linear normalization layer, all channel dimensions within each token in the noise fusion feature map are normalized to generate a standard noise fusion feature map;

[0028] After scaling and shifting the time step embedding representation, the features are fused with the standard noise addition. Figure 1 The input is sent to the expansion and transformation layer for linear transformation to generate an enhanced noise fusion feature map;

[0029] A sliding window-based local attention layer introduces sparse masks in the local attention constraint and updates the feature map;

[0030] The noise term of the current time step is predicted through the noise prediction network, and the feature map of the previous time step is updated based on the prediction result;

[0031] Through the step-by-step iterative denoising of multiple time steps, a set of noise-free feature blocks is finally generated and reconstructed into a noise-free feature map, which is mapped into a reconstructed time series through the convolution layer.

[0032] In at least one embodiment, the anomaly score is calculated as follows:

[0033] ;

[0034] Where, is the original multidimensional time series, is the reconstructed time series; is a hyperparameter used to control the weight of reconstruction error and contrastive learning loss; is the loss calculated by contrastive learning and is expressed as:

[0035] ;

[0036] Where, represents the sample batch size, and Respectively represent The feature representation of the original view and enhanced view of the sample after being encoded by the Encoder, represents the cosine similarity function, is a temperature parameter used to control the difficulty of contrastive learning.

[0037] In at least one embodiment, the threshold is calculated as follows:

[0038] ;

[0039] Where, t is the time step, T is the total length of the time step, is the original multidimensional time series.

[0040] In at least one embodiment, if the anomaly score of a data point exceeds a set threshold, the data point is determined to be anomaly; otherwise, the data point is considered normal.

[0041] On the other hand, the technical solution of the present invention also provides a time series anomaly detection system based on a diffusion model, comprising:

[0042] The data acquisition module is configured to: acquire multidimensional time series data;

[0043] The feature block generation module is configured to: perform multi-scale convolution and block operations on the multi-dimensional time series data to obtain multiple feature blocks of fixed size, each of which represents a local feature of the time series;

[0044] The reconstructed time series generation module is configured to: gradually add noise to the feature blocks in the time series, model the distribution of the time series, and obtain the noise fusion feature map; construct a sliding window local attention based , taking the noisy fused feature map as input, iterates and denoises it over multiple time steps to generate a noise-free feature map, which is then mapped to a reconstructed time series through a convolutional layer;

[0045] The anomaly detection module is configured to calculate an anomaly score based on the reconstructed time series and compare it with a set threshold to obtain an anomaly detection result.

[0046] The beneficial effects of the technical solution of the present invention are as follows:

[0047] The time series anomaly detection method based on the diffusion model of the present invention improves the accuracy and expressiveness of time series modeling by applying the generative characteristics of the diffusion model to the sample optimization process and using TF Block as the core modeling network in the denoising stage. A local attention mechanism based on a sliding window is introduced to achieve a more refined focus on local features. At the same time, this mechanism implements local attention constraints by limiting the attention calculation range to ensure that it is sufficiently lightweight without losing accuracy. It has the advantage of effectively reducing computational complexity while maintaining accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] The accompanying drawings, which constitute a part of the present invention, are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.

[0049] Figure 1 1 is a flow chart of the time series anomaly detection method based on the diffusion model disclosed in Example 1 of the present invention;

[0050] Figure 2 Schematic diagram of the structure of the time series anomaly detection method based on the diffusion model disclosed in Example 1 of the present invention;

[0051] Figure 3 Schematic diagram of the structure of the denoising diffusion probability model disclosed in Example 1 of the present invention;

[0052] Figure 4 is a schematic structural diagram of the TF Block disclosed in Example 1 of the present invention;

[0053] Figure 5 This is a schematic diagram of the local attention mechanism based on sliding windows disclosed in Example 1 of the present invention. DETAILED DESCRIPTION

[0054] It should be noted that the following detailed description is illustrative and is intended to provide further explanation of the present invention. Unless otherwise specified, all technical and scientific terms used in the present invention have the same meaning as commonly understood by those skilled in the art to which the present invention belongs.

[0055] As introduced in the background technology, the purpose of the present invention is to address the current deficiencies in temporal dependency modeling and lightweighting, and propose a time series anomaly detection method and system based on a diffusion model. By applying the generation characteristics of the diffusion model to the sample optimization process, the temporal dependency can be effectively modeled; an improved Transformer module (TF Block) is proposed, which systematically reconstructs the attention mechanism in the Transformer module and introduces a local attention mechanism based on a sliding window to more accurately represent local information. At the same time, it can effectively reduce the computational complexity and improve the lightweightness of the model while ensuring accuracy.

[0056] Example 1

[0057] In a typical embodiment of the present invention, Figure 1 As shown, this embodiment discloses a time series anomaly detection method based on a diffusion model, comprising the following steps:

[0058] Step 1: Obtain multidimensional time series data.

[0059] Specifically, we first construct a training dataset by acquiring raw multidimensional time series data from multiple public, real-world industrial control datasets, such as SWaT and WADI. This dataset is then preprocessed. During preprocessing, the different eigenvalues ​​in the acquired raw multidimensional time series data are normalized and mapped to the [0, 1] interval to ensure a consistent input eigenvalue range. This results in the resulting multidimensional time series data.

[0060] Step 2: Perform multi-scale convolution and block operations on the multidimensional time series data to obtain multiple feature blocks of fixed size, each of which represents the local features of the time series.

[0061] Specifically, step 2.1: For a time series with a length of , the feature dimension is Multidimensional time series , features are extracted through convolution kernels Conv1, Conv3, Conv5, and Conv7 of different sizes. Conv1 is used to extract high-frequency features of a short time window, while Conv7 is used to capture low-frequency or global features of a longer time range. The feature extraction process can be expressed as:

[0062] ;

[0063] in, Indicates that the convolution kernel size is The convolution operation, It is the feature extracted by the corresponding convolution kernel.

[0064] Step 2.2: All the features extracted Combined into a complete feature map , the process can be expressed as:

[0065] ;

[0066] Among them, C is the feature dimension generated by convolution, that is, the sum of the number of feature channels extracted by multiple convolution kernels.

[0067] Step 2.3: Complete feature map Divide into N fixed-size feature blocks, and set the length of each feature block to be , then each feature block Expressed as:

[0068] ;

[0069] ;

[0070] The final block result is expressed as:

[0071] ;

[0072] Each feature block Represents the local characteristics of the time series.

[0073] Step 3: Gradually add noise to the feature blocks in the time series, model the distribution of the time series, and obtain the noisy fusion feature map.

[0074] Specifically, step 3.1: Based on Figure 3 The denoising diffusion probability model shown, for each given time step , to multiple feature blocks Composed of a collection Add Gaussian noise to get the time step t Noise latent variable , the process can be expressed as:

[0075] ;

[0076] in, It is the cumulative noise retention factor to control the noise intensity at different time steps; Time index The noise retention factor under is used to control the noise intensity between different time steps; is Gaussian noise.

[0077] Step 3.2: Each time step Encoded into an embedding vector, we obtain the time-step embedding representation and express it as:

[0078] .

[0079] Step 3.3: Substitute the noise latent variable and time-step embedding representation Perform fusion to obtain the noise fusion feature map , the process can be expressed as:

[0080] .

[0081] Step 4: Build a sliding window local attention based , taking the noisy fused feature map as input, iterates denoising over multiple time steps to generate a noise-free feature map, which is then mapped to a reconstructed time series through a convolutional layer.

[0082] In this step, a sliding window local attention based , the attention mechanism is systematically reconstructed in the Transformer module, and a local attention mechanism based on sliding windows is proposed to capture local feature dependencies in a more fine-grained manner. At the same time, the attention calculation range is limited and local attention constraints are implemented to ensure that it is lightweight enough without losing accuracy. Figure 4 As shown, the It includes linear normalization layers, expansion and transformation layers, and local attention layers based on sliding windows, which can simulate the denoising process of the diffusion model and fusion feature maps from the noise. Initially, at each time step Through multi-step processing, a noise-free feature map is finally generated.

[0083] Specifically, step 4.1: Based on the linear normalization layer, the noise fusion feature map All channel dimensions C within each token are normalized to generate a standard noise fusion feature map , in order to eliminate the distribution differences between different feature channels, thereby accelerating training and improving stability. The process can be expressed as:

[0084] ;

[0085] ;

[0086] ;

[0087] in, Indicates the The feature vector of a token, is the number of channels per token, is the mean, is the variance, and j is the index.

[0088] Step 4.2: Embed the time steps in step 3.2 After scaling and offset operations, the feature map is fused with the standard noise generated in step 4.1. Input together to the expansion and transformation layer for linear transformation to enhance the representation ability of the feature map and generate an enhanced noise fusion feature map , this process can be expressed as:

[0089] ;

[0090] ;

[0091] in, and are the scaling factor and offset of the feature map, respectively.

[0092] Step 4.3: In this embodiment, The sliding window-based local attention mechanism is theoretically based on the assumption of local correlation of time series data: in a time series, the correlation between the observation value of a certain time node and its adjacent time nodes is usually significantly higher than its correlation with distant time nodes. Based on this characteristic, limiting the attention range of the query to its adjacent time window not only conforms to the inherent characteristics of time series data and can focus on capturing local features, allowing the model to more effectively capture local correlations in time series data, but also is an effective way to optimize computational efficiency. This local attention constraint can significantly reduce computational complexity. Its main advantage is that only pairs of elements with potentially high correlation need to be calculated and stored, thereby reducing the amount of computation and accelerating the training and inference process.

[0093] Figure 5 The local attention mechanism based on sliding window is shown. In the figure, the horizontal direction represents the key , vertical representation query , each grid position Represents the attention calculation relationship between the query and the key. The blue area in the figure marks the "perception window", indicating that only the query is considered when calculating the attention. and the keys in the perception window The similarity between them. This local connection strategy ensures that only adjacent queries and keys are included in the computation, while distant queries and keys are ignored, reflecting the sparse attention property. This mechanism aligns with the assumption of local correlation in time series data, whereby observations at a given time point have stronger relationships with neighboring nodes and weaker relationships with distant nodes. Therefore, the sliding window local attention mechanism effectively captures local features in time series tasks.

[0094] Based on this, this step introduces sparse mask in the local attention constraint based on the local attention layer of the sliding window To limit the scope of attention calculation. is a sparse matrix, where Indicates location and location The dependencies between Indicates ignoring the dependency. When calculating the attention weight, the sparse mask is applied to the unnormalized attention score matrix. Add before The illegal positions are assigned negative infinity, making their attention weight zero. In this way, the attention mechanism only focuses on the context area within the sliding window where each token is located, thereby achieving local modeling, reducing computational complexity, and improving the ability to model local dependency structures in time series. The process can be expressed as:

[0095] ;

[0096] ;

[0097] in, , , are query, key, and value matrices respectively; is the dimension of the key vector.

[0098] Step 4.4: At each step Internally, a local attention mechanism is used to model the local dependency of the time series and fuse the time step condition information. The internal update form of is: the output of the local attention layer based on the sliding window is combined with the noise fusion feature map Perform residual fusion to retain the original features and increase stability to obtain fusion features And output, the process can be expressed as:

[0099] ;

[0100] in, is the current time step Output fusion features; are learnable weights.

[0101] Step 4.5: Multiple Layers After stacking, a noise prediction network is formed , the noise fusion feature map of the current noise representation Perform noise estimation and predict the noise term of the current time step:

[0102] .

[0103] Step 4.6: Based on the prediction results Perform reverse sampling and update the current state to the feature map of the previous time step. This process can be expressed as:

[0104] ;

[0105] in, is the feature map of the previous time step of time step t; is the decay factor of time step t, which is used to control the degree of state update between the current time step t and the previous time step t-1; is the cumulative noise retention factor, which controls the noise intensity at different time steps; is the standard deviation; is the noise term, which has a mean of zero and a variance of the unit matrix The standard normal distribution of .

[0106] Step 4.7: Through the gradual iteration of multiple time steps, the noise components in the features are gradually reduced. The model finally generates a denoised feature block set after removing the time step condition. , and reconstruct it into a feature map , mapped to a reconstructed time series through the convolution layer, specifically expressed as:

[0107] ;

[0108] in, is the reconstructed time series.

[0109] Step 5: Calculate the anomaly score based on the reconstructed time series and compare it with the set threshold to obtain the anomaly detection result.

[0110] Specifically, step 5.1: calculate the anomaly score based on the reconstructed time series. The calculation method of the anomaly score is:

[0111] ;

[0112] Where, is the original multidimensional time series, is the reconstructed time series; are hyperparameters with values ​​of 0.6 and 0.4, respectively, used to control the weights of reconstruction error and contrastive learning loss; It is the loss calculated by contrastive learning. It measures the similarity or distance between samples and is usually used to enhance the model's recognition of abnormal patterns. It is expressed as:

[0113] ;

[0114] in, represents the sample batch size, and Respectively represent The feature representation of the original view and enhanced view of the sample after being encoded by the Encoder, represents the cosine similarity function, is a temperature parameter used to control the difficulty of contrastive learning.

[0115] Step 5.2: Set anomaly threshold for time series anomaly detection. The threshold is calculated as follows:

[0116] ;

[0117] Where, t is the time step, T is the total length of the time step, is the original multidimensional time series.

[0118] Step 5.3: Compare the calculated anomaly score with the set threshold. If the anomaly score of a data point exceeds the set threshold, the data point is judged to be anomaly; otherwise, the data point is considered normal.

[0119] In this example, the performance of this method is compared with the baseline method on the SWaT and WADI datasets. The indicators are accuracy, precision, recall and F1 score. The comparison results are shown in Tables 1 and 2:

[0120] Table 1 Comparison of this method with the baseline method on the SWaT dataset

[0121]

[0122] Table 2 Comparison of this method with the baseline method on the WADI dataset

[0123]

[0124] From the accuracy, precision, recall, and F1 score in Tables 1 and 2, we can see that in the SWaT and WADI datasets, this method performs best in all four indicators, demonstrating its superiority in the time series anomaly detection task.

[0125] In this example, the lightweight performance analysis of this method is performed on the SWaT and WADI datasets. The indicators are the number of parameters and the average inference time per sample. The results are shown in Tables 3 and 4:

[0126] Table 3 Comparison of lightweight performance analysis on the SWaT dataset

[0127]

[0128] Table 4 Comparison of lightweight performance analysis on the WADI dataset

[0129]

[0130] From the parameter count and inference time indicators in Tables 3 and 4, it can be seen that in the SWaT and WADI datasets, the parameter count and single-sample average inference time of this method are always at the lowest values, and it has better lightweight performance.

[0131] Example 2

[0132] In a typical implementation of the present invention, this embodiment discloses a time series anomaly detection system based on a diffusion model, including:

[0133] The data acquisition module is configured to: acquire multidimensional time series data;

[0134] The feature block generation module is configured to: perform multi-scale convolution and block operations on the multi-dimensional time series data to obtain multiple feature blocks of fixed size, each of which represents a local feature of the time series;

[0135] The reconstructed time series generation module is configured to: gradually add noise to the feature blocks in the time series, model the distribution of the time series, and obtain the noise fusion feature map; construct a sliding window local attention based , taking the noisy fused feature map as input, iterates and denoises it over multiple time steps to generate a noise-free feature map, which is then mapped to a reconstructed time series through a convolutional layer;

[0136] The anomaly detection module is configured to calculate an anomaly score based on the reconstructed time series and compare it with a set threshold to obtain an anomaly detection result.

[0137] The foregoing description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Those skilled in the art will readily appreciate that various modifications and variations of the present invention are possible. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present invention are intended to be within the scope of protection of the present invention.

Claims

1. A time series anomaly detection method based on a diffusion model, characterized in that: include: Obtain multidimensional time series data; Perform multi-scale convolution and block operations on multi-dimensional time series data to obtain multiple feature blocks of fixed size, each of which represents the local features of the time series; Gradually add noise to the feature blocks in the time series, model the distribution of the time series, and obtain the noise fusion feature map; Constructing a sliding window local attention , taking the noisy fused feature map as input, iterates and denoises it over multiple time steps to generate a noise-free feature map, which is then mapped to a reconstructed time series through a convolutional layer; Calculate the anomaly score based on the reconstructed time series and compare it with the set threshold to obtain the anomaly detection result; Sliding window local attention It includes a linear normalization layer, an expansion and transformation layer, and a sliding window-based local attention layer connected in sequence; The process of generating noise-free feature maps includes: Based on the linear normalization layer, all channel dimensions within each token in the noise fusion feature map are normalized to generate a standard noise fusion feature map; After the time step embedding representation is scaled and offset, it is input into the expansion and transformation layer together with the standard noise fusion feature map for linear transformation to generate the enhanced noise fusion feature map; A sliding window-based local attention layer introduces sparse masks in the local attention constraint and updates the feature map; The noise term of the current time step is predicted through the noise prediction network, and the feature map of the previous time step is updated based on the prediction result; Through the step-by-step iterative denoising of multiple time steps, a set of noise-free feature blocks is finally generated and reconstructed into a noise-free feature map, which is mapped into a reconstructed time series through the convolution layer.

2. The time series anomaly detection method based on the diffusion model according to claim 1, characterized in that: Obtain multidimensional time series data. The specific process is as follows: Obtain raw multidimensional time series data from multiple public real-world datasets; Normalize the different feature data in the original multidimensional time series data, map the feature values ​​to the interval [0, 1], ensure the consistency of the input feature value range, and obtain multidimensional time series data.

3. The time series anomaly detection method based on the diffusion model according to claim 1, characterized in that: Perform multi-scale convolution and block operations on multi-dimensional time series data. The specific process is as follows: Feature extraction of multidimensional time series data using convolution kernels of different sizes; Combine all extracted features into a complete feature map; The complete feature map is divided into multiple fixed-size feature blocks, each of which represents the local features of the time series.

4. The time series anomaly detection method based on the diffusion model according to claim 1, characterized in that: Gradually add noise to the feature blocks in the time series, model the distribution of the time series, and obtain the noise fusion feature map. The specific process is as follows: For each time step, Gaussian noise is added to the feature block to obtain the noise latent variable; Encode each time step into an embedding vector to obtain a time step embedding representation; The noise latent variable is fused with the time step embedding representation to obtain the noisy fused feature map.

5. The time series anomaly detection method based on the diffusion model according to claim 1, characterized in that: The anomaly score is calculated as: ； Where, is the original multidimensional time series, is the reconstructed time series; is a hyperparameter used to control the weight of reconstruction error and contrastive learning loss; is the loss calculated by contrastive learning and is expressed as: ； Where, represents the sample batch size, and Respectively represent The feature representation of the original view and enhanced view of the sample after being encoded by the Encoder, represents the cosine similarity function, is a temperature parameter used to control the difficulty of contrastive learning.

6. The time series anomaly detection method based on the diffusion model according to claim 1, characterized in that: The threshold is calculated as follows: ； Where, t is the time step, T is the total length of the time step, is the original multidimensional time series.

7. The time series anomaly detection method based on the diffusion model according to claim 1, characterized in that: If the anomaly score of a data point exceeds the set threshold, the data point is considered an anomaly; otherwise, the data point is considered normal.

8. A time series anomaly detection system based on a diffusion model, characterized in that: include: The data acquisition module is configured to: acquire multidimensional time series data; The feature block generation module is configured to: perform multi-scale convolution and block operations on the multi-dimensional time series data to obtain multiple feature blocks of fixed size, each of which represents a local feature of the time series; The reconstructed time series generation module is configured to: gradually add noise to the feature blocks in the time series, model the distribution of the time series, and obtain the noise fusion feature map; construct a sliding window local attention based , taking the noise fusion feature map as input, iterates and denoises iteratively over multiple time steps to generate a noise-free feature map, which is then mapped to a reconstructed time series through a convolutional layer; based on the sliding window local attention It includes a linear normalization layer, an expansion and transformation layer, and a sliding window-based local attention layer connected in sequence; The process of generating noise-free feature maps includes: Based on the linear normalization layer, all channel dimensions within each token in the noise fusion feature map are normalized to generate a standard noise fusion feature map; After the time step embedding representation is scaled and offset, it is input into the expansion and transformation layer together with the standard noise fusion feature map for linear transformation to generate the enhanced noise fusion feature map; A sliding window-based local attention layer introduces sparse masks in the local attention constraint and updates the feature map; The noise term of the current time step is predicted through the noise prediction network, and the feature map of the previous time step is updated based on the prediction result; Through the step-by-step iterative denoising of multiple time steps, a set of noise-free feature blocks is finally generated and reassembled into a noise-free feature map, which is mapped into a reconstructed time series through the convolution layer; The anomaly detection module is configured to calculate an anomaly score based on the reconstructed time series and compare it with a set threshold to obtain an anomaly detection result.

Images