Multi-dimensional time sequence anomaly detection method based on correlation characteristics and multi-scale integrated decoding

Abstract

The invention discloses a multi-dimensional time sequence anomaly detection method based on correlation characteristics and multi-scale integrated decoding. The method comprises a coding stage, a decoding stage and an anomaly detection stage. In the encoding stage, by investigating the correlation between dimensions and the dependency of time, calculating a correlation feature matrix between the dimensions, and mining effective implicit features by using a convolution encoder; in the decoding stage, decoders with different scales are used for decoding the output of the coding layer, the outputs of the decoders are fused, and finally a reconstructed feature matrix is obtained; in the anomaly detection stage, the anomaly is identified by using errors of the reconstruction matrix and the original feature matrix; the method effectively solves the problems that in the prior art, correlation between the sequences is not considered, and a decoder is prone to error accumulation in the decoding process, and has the advantage that the correlation between the sequences and the time dependence of data can be effectively modeled.

Description

Technical Field

[0001] The present invention belongs to the technical field of anomaly detection, and in particular relates to a multidimensional time series anomaly detection method based on correlation features and multi-scale integrated decoding. Background Art

[0002] Multi-dimensional time series anomaly detection methods based on deep learning are currently a hot topic of research. The methods currently proposed by the academic community are mainly divided into three categories: algorithms based on recurrent neural networks, autoencoders, and graph neural networks. Algorithms based on recurrent neural networks are mainly used to learn the temporal nature of data, retain valuable historical information, predict data at future moments, and identify anomalies based on the error between the predicted value and the true value. Methods based on autoencoders are more inclined to learn the hidden features of data in normal mode, and then identify anomalies through the reconstruction error after decoding. Recently, algorithms based on graph neural networks have also gradually emerged, using graph neural networks to learn the temporal nature of multiple time series and the correlation between series, which helps to identify entity anomalies; the shortcomings of existing technologies are as follows: Although the recurrent neural network-based method can effectively process the temporal nature of data, it does not consider the correlation between sequences; the autoencoder-based method models the correlation between sequences, but the decoder is prone to error accumulation during the sequential decoding process; the graph neural network-based method provides a good idea for representing the relationship between sequences, but how to use graphs to model time series data and how to effectively update node status during message passing are still difficulties of this type of method.

[0003] Therefore, it is necessary to propose a multidimensional time series anomaly detection method based on correlation features and multi-scale integrated decoding to solve the above problems. Summary of the Invention

[0004] The technical problem to be solved by the present invention is to provide a multi-dimensional time series anomaly detection method based on correlation features and multi-scale integrated decoding, which includes an encoding stage, a decoding stage and an anomaly detection stage. In the encoding stage, the correlation feature matrix between dimensions and the time dependence are examined to calculate the correlation feature matrix, and a convolutional encoder is used to mine effective implicit features. In the decoding stage, decoders of different scales are used to decode the output of the encoding layer and fuse the outputs of multiple decoders to finally obtain a reconstructed feature matrix. In the anomaly detection stage, the error between the reconstructed matrix and the original feature matrix is used to identify anomalies.

[0005] In order to achieve the above technical effects, the technical solution adopted by the present invention is: A multidimensional time series anomaly detection method based on correlation features and multi-scale integrated decoding includes the following steps: S1, encoding stage: Segment the multidimensional time series data through a sliding window, extract the correlation features between the dimensions, generate a feature matrix sequence under multiple time windows, and use the convolutional encoder and ConvLSTM integrated encoding to encode the spatial and temporal dependencies of the feature matrix sequence to obtain implicit feature representation; S2, decoding stage: using multiple decoders of different network depths to perform multi-scale integrated decoding on the implicit feature representation, and fusing the outputs of different decoders to obtain a reconstructed feature matrix; S3, anomaly detection stage: calculate the error matrix between the reconstructed feature matrix and the original feature matrix, determine the anomaly based on the anomaly score of the error matrix and a preset threshold, and locate the anomaly source by counting the dimensions in the error matrix that exceed the threshold.

[0006] Preferably, in step S1, the specific steps of extracting correlation features include: The multidimensional time series is divided into multiple time segments through a sliding window, and the correlation between the two dimensional data in each time segment is calculated to generate an n×n correlation feature matrix; Repeat the above process with different time window sizes to obtain feature matrix sequences under multiple different time windows, and concatenate the feature matrix sequences along the new dimension as tensor input to the convolution encoder: Assume a set of time window sizes , by processing the entire multidimensional time series, we can obtain A different sequence of feature matrices is used as the convolutional encoder for the subsequent time series.

[0007] Preferably, the correlation feature matrix is calculated as follows: Calculate the correlation between each dimension data in the current time series segment and other different dimension data in the segment through the inner product, and construct a Correlation matrix The i-th row and j-th column in the matrix represent the correlation between the j-th dimension data in the current time series segment and the i-th dimension data in the same time series segment, that is, ; The calculation is: ; in, represents the data of the i-th dimension sequence at time t, is the scaling factor, ; w is the sliding window size, Represents the correlation value between the i-th dimension and the j-th dimension at time t.

[0008] Preferably, in step S1, the encoding process of the convolutional encoder includes: The feature matrices under different time windows are input into the multi-layer convolutional network, and the SELU activation function is combined to extract spatial features. The specific method is as follows: The convolutional encoder is composed of multiple convolutional coding layers stacked together. The output of the previous convolutional layer is processed by an activation layer and then sent to the subsequent convolutional layer. Output of the layer , No. Output of the layer Expressed as: ; Where * represents the convolution operation, SELU is the activation function, Indicates that the mth layer uses The size is The convolution kernel, For bias top; The time dependency of the feature matrix sequence is modeled through the ConvLSTM unit, and the hidden state sequence is output. The specific method is as follows: ; ConvLSTM represents a ConvLSTM unit, and the hidden state of the mth convolutional layer at time t is The implicit state of layer m at time t-1 Input at time t Joint decision.

[0009] Preferably, the specific steps of multi-scale integrated decoding in step S2 include: Use multiple decoders corresponding to the number of encoding layers. Each decoder is composed of a stack of deconvolution layers and receives the output of different encoding layers. Reconstruct the data through a convolutional decoder; Adopting the idea of ensemble learning, the outputs of decoders of different scales are fused to jointly train all decoders, and the weighted average of the outputs of each decoder is used as the reconstructed feature matrix.

[0010] Preferably, the specific method of reconstructing data by the convolution decoder is: Let the set of decoders be , a decoder that receives the output of the mth convolutional coding layer When the number of encoding layers of the encoder is m, then It is composed of m stacked decoding layers. The decoding order is opposite to the encoding order. In the decoding stage, the output of the m-1th layer is determined by the output of the mth layer and the hidden state. When the mth layer is in the initial state, the input is only determined by the hidden state of the current layer. The specific time series decoding process is as follows: ; ; in represents the deconvolution operation, Indicates a join operation. is the activation function, Indicates that the i-th layer uses The size is The convolution kernel, is the bias term, is the implicit feature output by the ConvLSTM layer; the entire decoding process is a joint and the output of the previous layer As the input of the current layer, it is decoded and then input into the next deconvolution layer.

[0011] Preferably, the idea of ensemble learning is adopted to fuse the outputs of decoders of different scales and jointly train all decoders. The specific method is as follows: For different decoders , take part of the output tensor as the reconstructed feature matrix, that is ; The final output is: ; ; in is the weighting coefficient, and the final output is the weighted average of multiple decoder outputs.

[0012] Preferably, in step S3, the mean square error between the reconstructed feature matrix and the original feature matrix is used as the anomaly score; the maximum value of the anomaly score in the validation set is used to define the threshold, and if the score value exceeds the threshold during the detection process, it is determined to be an anomaly; the specific positioning of the threshold is as follows: ; Where th represents the threshold value, represents the maximum value of the anomaly score in the validation set, is the threshold scaling parameter.

[0013] Preferably, in step S1, the sliding window is divided as follows: Assuming multidimensional time series data X =[X1, X2, · · · , X n ], where the dimension of the time series is n, assuming that the length of the time series is T, the size of the time window is w, and the sliding distance is s, the time series segment obtained by segmenting the i-th dimension data through the sliding window is expressed as: ; in Represents the data of the i-th dimension sequence at time t; the time series is divided into A time segment.

[0014] Preferably, the reconstructed feature matrix Expressed as: ; Original feature matrix sequence Expressed as: ; The loss function is represented by the reconstruction error of the two; the objective function of the model is as follows: ; in Represents the F-norm of the matrix.

[0015] Furthermore, the network structure of the convolutional encoder and decoder includes: The encoder is composed of multiple convolutional layers stacked together, and the output of each layer is processed by the activation function and then input into the next layer; The decoder is composed of a stack of deconvolutional layers, and the hidden state is reconstructed together with the output of the previous layer during the decoding process.

[0016] The beneficial effects of the present invention are as follows: 1. This invention uses a feature matrix to process input data. From the perspective of the overall sequence, it preserves the dependencies of time series data; from the perspective of the local feature matrix, it effectively captures the correlation between dimensions. The model uses multiple convolutional coding layers to extract features from the input data, learning features from simple to complex layer by layer. ConvLSTM is also used to capture the temporal dependencies of feature data and obtain a compressed representation of the input data. In the decoding process, multiple convolutional decoders are introduced to reconstruct the compressed representation, combining the ideas of ensemble learning. The outputs of different decoders are then fused to obtain the final reconstructed data.

[0017] 2. In the training phase, an overall loss function is designed, which is composed of the error values of the correlation feature matrix and the reconstruction matrix sequence. In the detection phase, anomalies are detected using the error matrix between the correlation feature matrix and the reconstruction matrix. The number of all values in the matrix greater than the threshold is defined as the anomaly score. The anomaly score of each row in the error matrix is calculated and sorted, and the dimensions that may cause anomalies are located based on the scores. The introduction of multi-scale integrated decoding improves the overall anomaly detection effect, proving the role of multi-scale information in anomaly detection in multidimensional time series.

[0018] 3. Use the feature matrix to process the input data. From the perspective of the overall sequence, it retains the dependency of the time series data; from the perspective of the local feature matrix, it well characterizes the correlation between dimensions; most methods usually process multidimensional data as a whole, and the detected anomalies are also relative to the moment, that is, the data at the current moment has anomalies, and it is often impossible to accurately locate the dimension that caused the anomaly. Therefore, anomaly location is an extension and extension of the multidimensional time series anomaly detection task, which is rarely involved in existing methods. The method proposed in this patent benefits from the definition method of using the feature matrix. The abnormal dimension can be located by summing the number of values that exceed the threshold in the error matrix, and counting in rows or columns. The more values a row (dimension) exceeds the threshold, the more likely it is to be the cause of the anomaly.

[0019] 4. From the experimental results, the method proposed in this patent has achieved good results on most data sets, indicating that the model can effectively model the correlation between sequences and the time dependence of data, and also illustrates the feasibility of the multi-scale integrated decoding scheme. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 This is a module diagram of the MSED-CF method in the present invention; Figure 2 Schematic diagram of sliding window segmentation in an embodiment of the present invention; Figure 3 This is a diagram of the model network structure in an embodiment of the present invention; Figure 4 Schematic diagram of abnormal dimension detection in an embodiment of the present invention. DETAILED DESCRIPTION

[0021] Example 1: A multidimensional time series anomaly detection method based on correlation features and multi-scale integrated decoding includes the following steps: S1, encoding stage: Segment the multidimensional time series data through a sliding window, extract the correlation features between the dimensions, generate a feature matrix sequence under multiple time windows, and use the convolutional encoder and ConvLSTM integrated encoding to encode the spatial and temporal dependencies of the feature matrix sequence to obtain implicit feature representation; S2, decoding stage: using multiple decoders of different network depths to perform multi-scale integrated decoding on the implicit feature representation, and fusing the outputs of different decoders to obtain a reconstructed feature matrix; S3, anomaly detection stage: calculate the error matrix between the reconstructed feature matrix and the original feature matrix, determine the anomaly based on the anomaly score of the error matrix and a preset threshold, and locate the anomaly source by counting the dimensions in the error matrix that exceed the threshold.

[0022] Preferably, in step S1, the specific steps of extracting correlation features include: The multidimensional time series is divided into multiple time segments through a sliding window, and the correlation between the two dimensional data in each time segment is calculated to generate an n×n correlation feature matrix; Repeat the above process with different time window sizes to obtain feature matrix sequences under multiple different time windows, and concatenate the feature matrix sequences along the new dimension as tensor input to the convolution encoder: Assume a set of time window sizes , by processing the entire multidimensional time series, we can obtain A different sequence of feature matrices is used as the convolutional encoder for the subsequent time series.

[0023] Preferably, the correlation feature matrix is calculated as follows: Calculate the correlation between each dimension data in the current time series segment and other different dimension data in the segment through the inner product, and construct a Correlation matrix The i-th row and j-th column in the matrix represent the correlation between the j-th dimension data in the current time series segment and the i-th dimension data in the same time series segment, that is, ; The calculation is: ; in, represents the data of the i-th dimension sequence at time t, is the scaling factor, ; w is the sliding window size, Represents the correlation value between the i-th dimension and the j-th dimension at time t.

[0024] Preferably, in step S1, the encoding process of the convolutional encoder includes: The feature matrices under different time windows are input into the multi-layer convolutional network, and the SELU activation function is combined to extract spatial features. The specific method is as follows: The convolutional encoder is composed of multiple convolutional coding layers stacked together. The output of the previous convolutional layer is processed by an activation layer and then sent to the subsequent convolutional layer. Output of the layer , No. Output of the layer Expressed as: ; Where * represents the convolution operation, SELU is the activation function, Indicates that the mth layer uses The size is The convolution kernel, For bias top; The time dependency of the feature matrix sequence is modeled through the ConvLSTM unit, and the hidden state sequence is output. The specific method is as follows: ; ConvLSTM represents a ConvLSTM unit, and the hidden state of the mth convolutional layer at time t is The implicit state of layer m at time t-1 Input at time t Joint decision.

[0025] Preferably, the specific steps of multi-scale integrated decoding in step S2 include: Use multiple decoders corresponding to the number of encoding layers. Each decoder is composed of a stack of deconvolution layers and receives the output of different encoding layers. Reconstruct the data through a convolutional decoder; Adopting the idea of ensemble learning, the outputs of decoders of different scales are fused to jointly train all decoders, and the weighted average of the outputs of each decoder is used as the reconstructed feature matrix.

[0026] Preferably, the specific method of reconstructing data by the convolution decoder is: Let the set of decoders be , a decoder that receives the output of the mth convolutional coding layer When the number of encoding layers of the encoder is m, then It is composed of m stacked decoding layers. The decoding order is opposite to the encoding order. In the decoding stage, the output of the m-1th layer is determined by the output of the mth layer and the hidden state. When the mth layer is in the initial state, the input is only determined by the hidden state of the current layer. The specific time series decoding process is as follows: ; ; in represents the deconvolution operation, Indicates a join operation. is the activation function, Indicates that the i-th layer uses The size is The convolution kernel, is the bias term, is the implicit feature output by the ConvLSTM layer; the entire decoding process is a joint and the output of the previous layer As the input of the current layer, it is decoded and then input into the next deconvolution layer.

[0027] Preferably, the idea of ensemble learning is adopted to fuse the outputs of decoders of different scales and jointly train all decoders. The specific method is as follows: For different decoders , take part of the output tensor as the reconstructed feature matrix, that is ; The final output is: ; ; in is the weighting coefficient, and the final output is the weighted average of multiple decoder outputs.

[0028] Preferably, in step S3, the mean square error between the reconstructed feature matrix and the original feature matrix is used as the anomaly score; the maximum value of the anomaly score in the validation set is used to define the threshold, and if the score value exceeds the threshold during the detection process, it is determined to be an anomaly; the specific positioning of the threshold is as follows: ; Where th represents the threshold value, represents the maximum value of the anomaly score in the validation set, is the threshold scaling parameter.

[0029] Preferably, in step S1, the sliding window is divided as follows: Assuming multidimensional time series data X =[X1, X2, · · · , X n ], where the dimension of the time series is n, assuming that the length of the time series is T, the size of the time window is w, and the sliding distance is s, the time series segment obtained by segmenting the i-th dimension data through the sliding window is expressed as: ; in Represents the data of the i-th dimension sequence at time t; the time series is divided into A time segment.

[0030] Preferably, the reconstructed feature matrix Expressed as: ; Original feature matrix sequence Expressed as: ; The loss function is represented by the reconstruction error of the two; the objective function of the model is as follows: ; in Represents the F-norm of the matrix.

[0031] Furthermore, the network structure of the convolutional encoder and decoder includes: The encoder is composed of multiple convolutional layers stacked together, and the output of each layer is processed by the activation function and then input into the next layer; The decoder is composed of a stack of deconvolutional layers, and the hidden state is reconstructed together with the output of the previous layer during the decoding process.

[0032] Example 2: The Multivariate Time Series Detection Based on Correlation Features and Multi-scale Ensemble Decoding (MSED-CF) method proposed in this example is mainly divided into four parts: Correlation feature extraction, feature matrix convolutional coding, multi-scale ensemble decoding and anomaly detection.

[0033] Figure 1 The module division of the overall solution is demonstrated. The focus of the correlation feature extraction research is on how to effectively characterize the correlation between dimensions. The feature matrix convolutional coding and multi-scale integrated decoding mainly focus on the fusion of feature information at multiple scales, in order to maximize the use of feature information for anomaly detection.

[0034] Generally, research suggests that correlations exist between the dimensions of multidimensional time series, and changes in data from a single dimension may cause changes in data from other related dimensions. Furthermore, anomalies may also cause changes in the correlations between time series. Therefore, correlations between different dimensions are a key factor in effectively characterizing multidimensional time series. This patent uses a sliding window to segment multidimensional time series data, obtaining multiple time series segments. It then extracts correlation features from sequences across all dimensions within the time series segments, obtaining effective feature representations as input to the model's encoding layer.

[0035] Feature matrix convolution coding and multi-scale ensemble coding are the core parts of this method. Unlike the correlation feature extraction stage that focuses on the correlation between different dimensions, the encoding stage focuses more on the temporal nature of the sequence. By encoding the feature data, implicit variables that contain both temporal information and inter-dimensional correlation information are obtained.

[0036] In the decoding stage, the network depth of the model is a key factor affecting the overall decoding effect. On the one hand, a network depth that is too shallow may not be able to effectively represent the data; on the other hand, a network depth that is too deep may lead to problems such as gradient vanishing, gradient explosion, and overfitting. In view of this, this patent innovatively adopts the idea of ensemble learning, using decoders with different network depths and a fusion mechanism of deep features and shallow features to complete decoding. Decoders of different network depths can capture information of different scales. Decoders with deeper depths accept low-scale inputs and pay more attention to the deep features of the data, while decoders with shallower depths accept high-scale inputs and have a better ability to learn shallow features. Multi-scale ensemble decoding can make full use of feature information of different scales, combined with the idea of ensemble learning, to improve the model's ability to obtain information from implicit variables.

[0037] Correlation feature extraction primarily considers the correlations between different dimensions of a multidimensional time series. It converts the raw time series data into a correlation matrix, which is then used as input to the encoding layer. The current state of a time series is influenced by historical data, and data from a single moment cannot fully reflect the characteristics of the time series data. However, overly long sequences are also difficult for the model to process. Therefore, in actual processing, we typically use a sliding window approach to divide the entire time series data into multiple time periods.

[0038] like Figure 2 As shown in the figure, a sliding window refers to a given time window size, which is used to intercept a time series segment from the beginning of the time series with the given window size. The window then slides along the time direction at a certain distance, and the entire time series is divided into a set of time series segments.

[0039] By calculating the correlation between the dimensional data in the current time series segment and the data of other different dimensions in the segment through the inner product, a Correlation matrix , the i-th row and j-th column in the matrix represent the correlation between the j-th dimension data in the current time series segment and the i-th dimension data in the same time series segment, that is, .

[0040] Feature Matrix It can capture the correlation between different dimensions of the time series. On the other hand, this calculation method makes the noise of a specific time series have little impact on the feature matrix and is robust to input noise. In addition, in order to describe the sequence information under different time windows, this embodiment constructs multiple feature matrices with different time window sizes at each time point. Assume that the set of time window sizes is ,By processing the entire multidimensional time series, we can get different feature matrix sequences and use them as convolutional encoders for subsequent time series.

[0041] An effective latent representation of the feature matrix is key to anomaly detection in multidimensional time series. Convolutional encoding of the feature matrix captures the temporal nature of the data while preserving correlations across different dimensions, as well as the spatial information of the feature matrix across different time windows. During correlation feature extraction, multidimensional time series data is processed using time windows of varying sizes to generate multiple feature matrices. During the encoding phase, the feature matrices across different time windows are combined and their spatial patterns are encoded using a convolutional encoder.

[0042] Specifically, when using a sliding window to segment a time series, select time windows of different sizes, window size , moving the window along the time direction, we can get different feature matrix sequences. The sequence length is determined by the original time series length T and the time window The length of the sequence obtained by using different time windows is different, and the size of the feature matrix is determined by the time series dimension Determine that the size of the feature matrix under different time windows remains the same, that is Therefore, the feature matrices of different time windows can be concatenated into a tensor along the new dimension , will eventually as input to the convolutional encoder.

[0043] Figure 3 The network structure of the model is shown, which mainly consists of two parts: the convolutional encoder and the integrated encoder. The convolutional encoder is composed of multiple stacked convolutional coding layers. The output of the previous convolutional layer is processed by an activation layer and then fed into the subsequent convolutional layer.

[0044] The convolutional coding layer can not only capture the spatial features of the feature sequence well, but the feature matrix also contains the features of the time series data. That is, the feature matrix generated by the sliding window has time dependence, and the convolutional coding layer does not model the time information well. Therefore, ConvLSTM is used to model the time information in the feature matrix sequence, and the spatial information of the convolutional coding layer is combined to output the potential representation of the feature data.

[0045] like Figure 3 As shown in the figure, during the encoding phase, convolutional layers with different kernel sizes are used to capture spatial information at different scales, and ConvLSTM encodes the temporal information of the feature matrix sequence. During the decoding phase, to fully utilize information at different scales, multiple convolutional encoders are integrated to encode the encoded latent features, and the outputs of all encoders are fused to obtain the reconstructed feature matrix. The specific construction method is as follows.

[0046] First, let's explain a single convolutional decoder. Similar to a convolutional encoder, a convolutional decoder is also composed of multiple stacked convolutional decoding layers, but the difference is that deconvolution is used during the decoding process.

[0047] Then as Figure 3 As shown in , the convolutional decoder receives the output from different encoding layers. The number of decoders is determined by the number of encoder layers. The difference between different convolutional decoders lies in the different scales of the input data and the number of decoding layers. The role of the convolutional decoder is to reconstruct the data. Let the set of decoders be , the following is a decoder that receives the output of the mth convolutional coding layer For example, considering that the number of encoding layers of the encoder is m, It also needs to be stacked by m decoding layers. In contrast to the encoding order, in the decoding stage, the output of the m-1th layer is determined by the output of the mth layer and the hidden state. In particular, the mth layer is in the initial state, and the input is only determined by the hidden state of the current layer; the entire decoding process is a joint and the output of the previous layer As the input of the current layer, it is decoded and then input into the next deconvolution layer, and so on.

[0048] Finally, the idea of ensemble learning is adopted to fuse the outputs of decoders of different scales and jointly train all decoders. , take part of the output tensor as the reconstructed feature matrix, that is .

[0049] From the above, we can see that the final reconstruction matrix is fused from the outputs of multiple decoders; the reconstructed feature matrix It can be expressed as , the original feature matrix sequence It can be expressed as , the loss function can be expressed by the reconstruction error of the two.

[0050] When applying the trained model to perform anomaly detection tasks, you only need to pay attention to the output of the model; to determine whether the data at the current moment is abnormal, the primary goal is to define the anomaly score, that is, to establish an indicator that can describe the abnormal situation, and then define the threshold, and identify data that exceeds the threshold as abnormal. Generally speaking, the definition of the anomaly score is highly correlated with the loss function of model training. The reason why the model can perform anomaly detection is that it learns the characteristics and distribution of normal data through training, reduces the loss of normal data, and distinguishes it from abnormal data. Based on this, the starting point of the anomaly score and the loss function is consistent. The difference is that the definition of the anomaly score exists in the detection stage, and the loss function exists in the training stage. Therefore, similar to the definition of the loss function, this patent uses the mean square error of the reconstructed feature matrix and the original feature matrix as the anomaly score.

[0051] The definition of the threshold is closely related to the detection effect of the model. This patent uses the maximum value of the anomaly score in the validation set to define the threshold. If the score value exceeds the threshold during the detection process, it is judged as an anomaly.

[0052] This embodiment defines the abnormal dimension by summing the number of values exceeding the threshold in the error matrix and counting them in rows or columns, such as Figure 4 As shown in the figure, the more rows (dimensions) exceed the threshold, the more likely it is that this is the cause of the exception.

[0053] Example 3: The experimental results disclosed in this embodiment are analyzed as follows: In terms of data sets, in order to verify the effectiveness of the method, this embodiment conducted experiments on five real data sets and one artificially generated data set. The real data sets are shown in Table 1.

[0054] Table 1: Real dataset situation;

[0055] In terms of evaluation metrics, accuracy describes the percentage of correctly predicted results out of the total number of samples. However, it is not a good metric for evaluating results in tasks with imbalanced samples, such as anomaly detection. Therefore, precision, recall, and F1 score are very commonly used model evaluation metrics in the field of anomaly detection.

[0056] In the comparative experiment, a total of 6 comparison methods were selected. Table 2 divides the methods into three aspects: classification, anomaly score definition method, and threshold definition method, and intuitively shows the basic situation of each comparison method.

[0057] Table 2: Basic information of comparison methods

[0058] Based on the above method, this embodiment conducts experiments on five real datasets and one artificial dataset. Table 3 shows the correlation between the precision and recall rates of each algorithm in different datasets. The two algorithms proposed in this embodiment and the optimal results on each dataset are shown in bold. Win indicates the number of times the evaluation index of the comparison method is higher than that of the comparison method in all datasets, and Lose indicates the number of times the evaluation index of the comparison method is lower than that of the comparison method in all datasets.

[0059] Table 3: Precision and recall of different algorithms in different datasets;

[0060] By observing and analyzing the data in Table 3, we can obtain the following results: Judging from the overall results, the method proposed in this patent has achieved good results on most data sets, indicating that the model can effectively model the correlation between sequences and the time dependence of data, and also illustrates the feasibility of the multi-scale integrated decoding scheme.

[0061] Methods that consider modeling inter-sequence correlations, such as MTAD-GAT and MSED-CF, can better learn the correlations between data and more complex data relationships compared to other methods that only consider the temporal relationship of data, and the model effect is also better.

[0062] From a dataset perspective, most methods perform better on artificial datasets than on real datasets. MSCRED and MSED-CF perform better on artificial datasets than other methods. This may be due to the relatively stable periodicity of artificial datasets and the fact that these two methods model data correlations by considering the correlations between all pairwise sequences, which is consistent with artificial datasets.

Claims

1. A multidimensional time series anomaly detection method based on correlation features and multi-scale integrated decoding, characterized in that: The following steps are involved: S1, encoding stage: Segment the multidimensional time series data through a sliding window, extract the correlation features between the dimensions, generate a feature matrix sequence under multiple time windows, and use the convolutional encoder and ConvLSTM integrated encoding to encode the spatial and temporal dependencies of the feature matrix sequence to obtain implicit feature representation; S2, decoding stage: using multiple decoders of different network depths to perform multi-scale integrated decoding on the implicit feature representation, and fusing the outputs of different decoders to obtain a reconstructed feature matrix; S3, anomaly detection stage: calculate the error matrix between the reconstructed feature matrix and the original feature matrix, determine the anomaly based on the anomaly score of the error matrix and a preset threshold, and locate the anomaly source by counting the dimensions in the error matrix that exceed the threshold.

2. The multidimensional time series anomaly detection method based on correlation features and multi-scale integrated decoding according to claim 1 is characterized in that: In step S1, the specific steps of extracting correlation features include: The multidimensional time series is divided into multiple time segments through a sliding window, and the correlation between the two dimensional data in each time segment is calculated to generate an n×n correlation feature matrix; Repeat the above process with different time window sizes to obtain feature matrix sequences under multiple different time windows, and concatenate the feature matrix sequences along the new dimension as tensor input to the convolution encoder: Assume a set of time window sizes , by processing the entire multidimensional time series, we can obtain A different sequence of feature matrices is used as the convolutional encoder for the subsequent time series.

3. The multidimensional time series anomaly detection method based on correlation features and multi-scale integrated decoding according to claim 2 is characterized in that: The calculation of the correlation feature matrix is: Calculate the correlation between each dimension data in the current time series segment and other different dimension data in the segment through the inner product, and construct a Correlation matrix The i-th row and j-th column in the matrix represent the correlation between the j-th dimension data in the current time series segment and the i-th dimension data in the same time series segment, that is, ; The calculation is: ； in, represents the data of the i-th dimension sequence at time t, is the scaling factor, ; w is the sliding window size, Represents the correlation value between the i-th dimension and the j-th dimension at time t.

4. The multidimensional time series anomaly detection method based on correlation features and multi-scale integrated decoding according to claim 1 is characterized in that: In step S1, the encoding process of the convolutional encoder includes: The feature matrices under different time windows are input into the multi-layer convolutional network, and the SELU activation function is combined to extract spatial features. The specific method is as follows: The convolutional encoder is composed of multiple convolutional coding layers stacked together. The output of the previous convolutional layer is processed by an activation layer and then sent to the subsequent convolutional layer. Output of the layer , No. Output of the layer Expressed as: ； Where * represents the convolution operation, SELU is the activation function, Indicates that the mth layer uses The size is The convolution kernel, For bias top; The time dependency of the feature matrix sequence is modeled through the ConvLSTM unit, and the hidden state sequence is output. The specific method is as follows: ； ConvLSTM represents a ConvLSTM unit, and the hidden state of the mth convolutional layer at time t is The implicit state of layer m at time t-1 Input at time t Joint decision.

5. The multidimensional time series anomaly detection method based on correlation features and multi-scale integrated decoding according to claim 1 is characterized in that: The specific steps of multi-scale integrated decoding in step S2 include: Use multiple decoders corresponding to the number of encoding layers. Each decoder is composed of a stack of deconvolution layers and receives the output of different encoding layers. Reconstruct the data through a convolutional decoder; Adopting the idea of ensemble learning, the outputs of decoders of different scales are fused to jointly train all decoders, and the weighted average of the outputs of each decoder is used as the reconstructed feature matrix.

6. The multidimensional time series anomaly detection method based on correlation features and multi-scale integrated decoding according to claim 5 is characterized in that: The specific method of reconstructing data through the convolution decoder is: Let the set of decoders be , a decoder that receives the output of the mth convolutional coding layer When the number of encoding layers of the encoder is m, then It is composed of m stacked decoding layers. The decoding order is opposite to the encoding order. In the decoding stage, the output of the m-1th layer is determined by the output of the mth layer and the hidden state. When the mth layer is in the initial state, the input is only determined by the hidden state of the current layer. The specific time series decoding process is as follows: ； ； in represents the deconvolution operation, Indicates a join operation. is the activation function, Indicates that the i-th layer uses The size is The convolution kernel, is the bias term, is the implicit feature output by the ConvLSTM layer; The decoding process is a joint and the output of the previous layer As the input of the current layer, it is decoded and then input into the next deconvolution layer.

7. The multidimensional time series anomaly detection method based on correlation features and multi-scale integrated decoding according to claim 6 is characterized in that: Using the idea of ensemble learning, the outputs of decoders of different scales are integrated to jointly train all decoders. The specific method is as follows: For different decoders , take part of the output tensor as the reconstructed feature matrix, that is ; The final output is: ； ； in is the weighting coefficient, and the final output is the weighted average of multiple decoder outputs.

8. The multidimensional time series anomaly detection method based on correlation features and multi-scale integrated decoding according to claim 7 is characterized in that: In step S3, the mean square error between the reconstructed feature matrix and the original feature matrix is used as the anomaly score. The maximum anomaly score in the validation set is used to define the threshold. During the detection process, if the score exceeds the threshold, it is considered an anomaly. The specific positioning of the threshold is as follows: ； Where th represents the threshold value, represents the maximum value of the anomaly score in the validation set, is the threshold scaling parameter.

9. The multidimensional time series anomaly detection method based on correlation features and multi-scale integrated decoding according to claim 2 is characterized in that: In step S1, the sliding window is divided as follows: Assuming multidimensional time series data X =[X1, X2, · · · , X n ], where the dimension of the time series is n, assuming that the length of the time series is T, the size of the time window is w, and the sliding distance is s, the time series segment obtained by segmenting the i-th dimension data through the sliding window is expressed as: ； in Represents the data of the i-th dimension sequence at time t; the time series is divided into A time segment.

10. The multidimensional time series anomaly detection method based on correlation features and multi-scale integrated decoding according to claim 7, characterized in that: Reconstructed feature matrix Expressed as: ； Original feature matrix sequence Expressed as: ； The loss function is represented by the reconstruction error of the two; the objective function of the model is as follows: ； in Represents the F-norm of the matrix.

Images