Mixing anomaly detection method for non-uniform multivariate time series

Abstract

The invention provides a hybrid anomaly detection method for a non-uniform multivariate time sequence, and belongs to the field of data anomaly detection. The method comprises the following steps: dividing original data into a sparse sequence and a dense sequence based on a variance-entropy joint density discriminator; wherein the sparse sequence enters the depth semantic information extraction module for feature extraction, and the dense sequence is guided to the depth period information extraction module for feature extraction. Performing standardization processing on the extracted features, performing multi-scale partitioning operation on the standardized features, and then performing multi-granularity sequence division, a double-view attention mechanism and feature space expansion to obtain a local reconstruction feature tensor and a global reconstruction feature tensor; and carrying out anomaly discrimination by adopting symmetric KL divergence measurement of double-flow feature reconstruction. According to the method, the problems of density abrupt change region feature drift, dynamic feature adaptation capability deficiency and single granularity detection limitation in the anomaly detection task are effectively solved, and the anomaly detection performance is greatly improved.

Description

Technical Field

[0001] The present invention relates to the field of data anomaly detection, and in particular to a mixed anomaly detection method for non-uniform multivariate time series. Background Art

[0002] In the fields of smart customs, industrial Internet of Things, financial transactions, medical monitoring, etc., time series data are usually characterized by multivariate and temporal non-uniformity. Multivariate mainly refers to the fact that the data contains multiple related variables or features (such as temperature, pressure, vibration, etc. monitored by sensors). These variables may have complex interdependencies, and it is necessary to model the dynamic relationship between multiple variables. Temporal non-uniformity is caused by non-equally spaced sampling, multivariate asynchrony, data missing, etc. Among them, non-equally spaced sampling refers to the inconsistent collection timestamp intervals of data points (such as the randomness of time intervals caused by sensor failure or event triggering). Multivariate asynchrony means that the sampling frequency or timestamp of different variables may be different (such as temperature is collected every 1 minute and pressure is collected every 5 minutes).

[0003] Taking customs supervision as an example, the core challenge currently facing customs supervision stems from the non-uniform distribution of import and export data. Influenced by differences in cargo types, fluctuations in trade cycles, and seasonal demand, customs data exhibit significant density heterogeneity: a sharp decline in customs clearance during major holidays leads to data sparsification, while sudden surges in trade (such as the concentrated declaration of electronic products before the Spring Festival) trigger data overload. This dynamically changing density distribution not only degrades the performance of traditional anomaly detection models but also may lead to missed detection of key risk signals. Algorithms assuming a uniform distribution struggle to effectively handle the loss of detail in sparse areas and the redundant interference in dense areas, resulting in a dual dilemma of "high false positive rates in low-density areas and low recall rates in high-density areas."

[0004] Existing data detection methods have multiple deficiencies when dealing with non-uniform multivariate time series. On the one hand, traditional methods have some inherent flaws. First, statistical models based on the linear stationary assumption cannot effectively characterize nonlinear, multivariate coupled non-stationary time series relationships, and are prone to modeling bias in complex scenarios. Second, key parameters such as the sliding window length and residual threshold need to be manually preset, lacking the ability to adaptively adjust in an online environment. In addition, methods based on distance metrics have difficulty capturing the complex dependencies of multivariate time series, resulting in the failure of multidimensional anomaly correlation.

[0005] On the other hand, deep learning methods also have core deficiencies. First, the feature extraction process of existing deep learning architectures does not fully consider the local heterogeneity of data distribution. For example, the nested sliding window mechanism uniformly samples time-frequency features and does not distinguish between the differences in signal characteristics of sparse and dense areas, resulting in feature drift in areas with sudden density changes. The attention mechanism does not incorporate density-sensitive weights, making it difficult to effectively suppress noise interference in high-density areas. Second, there is a lack of dynamic feature adaptation mechanisms for changes in data distribution. Reconstruction models generate overly smooth features in areas with heterogeneous density, weakening the significance of abnormal signals. Prediction models produce temporal dependency misjudgments when density changes suddenly, leading to accumulated prediction errors. Finally, existing methods use a fixed-scale detection mechanism and do not achieve multi-granularity feature fusion. In complex scenarios, they are prone to missed detection of low-density anomalies and false positives of high-density noise. Summary of the Invention

[0006] In view of the shortcomings of the existing technology, the present invention proposes a hybrid anomaly detection method for non-uniform multivariate time series. To achieve the above object, the present invention provides the following technical solutions:

[0007] The present invention provides a method for detecting anomalies in a heterogeneous multivariate time series, comprising the following steps:

[0008] S1: For the input non-uniform multivariate time series to be detected, the variance-entropy joint density discriminator is used to determine the density of the data. Based on the density, the input data is divided into a sparse sequence rich in semantic information and a dense sequence rich in periodic information.

[0009] S2: Extract features from sparse sequences and dense sequences respectively; after feature extraction, perform standardization on the extracted features;

[0010] S3: Perform multi-scale block operations on the standardized features, and then perform multi-granularity sequence division, dual-view attention mechanism and feature space expansion to obtain local reconstruction feature tensors and global reconstruction feature tensors;

[0011] S4: Based on the local and global reconstruction feature tensors obtained in S3, the symmetric KL divergence metric of the two-stream feature reconstruction is used for anomaly discrimination.

[0012] According to a preferred solution of the present invention, in S2, a deep semantic information extraction module is used to extract features from the sparse sequence; the deep semantic information extraction module constructs a binary missing identification matrix, calculates interpolation weights based on feature similarity, aggregates valid observations based on adaptive weights, and performs in-situ replacement and layer normalization to replace missing values and standardize features.

[0013] According to a preferred solution of the present invention, in S2, a deep periodic information extraction module is used to extract features from dense sequences; the deep periodic information extraction module uses the triple technologies of cyclic sampling, Fourier transform and embedding representation to realize multi-granularity periodic pattern mining for dense sequences, and realizes cross-domain feature fusion through the triple attention mechanism.

[0014] According to a preferred solution of the present invention, S3 includes: given a normalized feature input sequence as First, a multi-scale block strategy is used to divide the time step T into R continuous sub-segments, each of which is of length N, satisfying T = R × N; for the local perspective, feature aggregation is performed on each sub-segment to generate a primitive sequence that represents the local temporal pattern For the global perspective, we construct a primitive sequence containing global context information by sampling features across sub-segments

[0015] The local primitive sequence X1 and the global primitive sequence Y1 are input into independent multi-head self-attention layers respectively, and the dependency relationship of key time steps is strengthened through the dynamic weight distribution mechanism; the process outputs local features with enhanced temporal dependency With global features Its dimension remains N;

[0016] Perform dimension expansion operation on X2 and Y2: copy X2 along the time axis R times to generate a local reconstruction feature tensor Simultaneously perform the same operation on Y2 to generate the global reconstruction feature tensor

[0017] According to a preferred solution of the present invention, the S4 includes: given a local reconstruction feature tensor and the global reconstruction feature tensor Where B is the batch size, T is the time step, and D is the feature dimension. The KL divergence is used to construct a two-way distribution difference metric; the anomaly score S is calculated by symmetric KL divergence fusion. anomaly :Set threshold δ, if S anomaly If it is greater than or equal to δ, it means that the data of the current time step is abnormal, otherwise it is normal.

[0018] Compared with existing methods, the present invention establishes a dynamic density discrimination mechanism based on variance entropy, and realizes real-time partitioning and feature decoupling of sparse / dense subsequences through local variance analysis of sliding windows and calculation of global distribution entropy.

[0019] The present invention designs heterogeneous processing pathways for density discrimination results: the sparse sequence processing pathway adopts an adaptive weight interpolation method; the dense sequence processing pathway adopts the triple technologies of cyclic sampling, Fourier transform and embedding representation to realize multi-granularity periodic pattern mining, and realizes cross-domain feature fusion through the triple attention mechanism.

[0020] The present invention implements a multi-scale blocking operation on the standardized features, and then executes multi-granularity sequence division, a dual-view attention mechanism, and feature space expansion to obtain local and global reconstructed feature tensors. By optimizing the anomaly criterion through multi-scale feature alignment, the limitations of traditional single-granularity detection are overcome.

[0021] The present invention effectively solves the problem of feature drift in density mutation areas, the lack of dynamic feature adaptation capabilities, and the limitation of single-granularity detection in anomaly detection tasks. The present invention significantly improves the performance of anomaly detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 It is a schematic diagram of the overall process of the method of the present invention.

[0023] Figure 2 is a performance comparison chart of the F1 score on the benchmark dataset. DETAILED DESCRIPTION

[0024] In order to make the purpose, technical solutions and advantages of the present invention clearer, the present invention is described in detail below with reference to specific embodiments. Specific embodiments are described below to simplify the present invention. However, it should be understood that the present invention is not limited to the illustrated embodiments, and that various modifications of the present invention are possible without departing from the underlying principles, and these equivalent forms also fall within the scope defined by the appended claims.

[0025] Multivariate non-uniform time series can be formally defined as: Let the observation points form a finite set where Δt k =t k+1 -t k Non-constant. At each moment t k Corresponding to the m-dimensional observation vector The entire multivariate non-uniform time series can be expressed as a set of ordered pairs: S = {(t k ,X(t k ))|t k ∈T,k=1,2,…,N}.

[0026] The purpose of the present invention is to detect mixed anomalies in non-uniform multivariate time series. Therefore, the present invention can be described as given a non-uniform training sequence S (i.e., a multivariate non-uniform time series, which serves as the input of the method of the present invention), a test sequence S corresponding to the training sequence is generated.test We want to predict y test ={y1,y2,…,y N′}, where y t ∈{0,1}, 0 represents no abnormality, and 1 represents an abnormality.

[0027] Figure 1 The basic process of the method of the present invention is shown. The mixed anomaly detection method of the non-uniform multivariate time series of the present invention mainly includes the following steps:

[0028] S1: For the input non-uniform multivariate time series to be detected, the variance-entropy joint density discriminator is used to judge the density of the data, and the input data is divided into sparse sequences rich in semantic information and dense sequences rich in periodic information based on the density.

[0029] Specifically, let the input non-uniform multivariate time series to be detected be Where B is the batch size, T is the time step, D is the feature dimension, and the variance-entropy joint density discriminator is used to determine the density of the data DensityFlag:

[0030]

[0031] H(X)=-∑p(x)log(p(x))

[0032] Among them, σ 2 is the variance of the current time step, is x t,d The mean of x t,d is the data corresponding to the current time step and feature dimension; H(X) is the distribution entropy, p(x) is the probability obtained by performing adaptive equal-frequency binning on the input non-uniform multivariate time series according to the feature dimension to obtain K intervals, and then counting the number of samples in each interval; τ v and τ h is a learnable parameter.

[0033] In S1 of the present invention, the variance is greater than the threshold τ v And the distribution entropy is less than the threshold τ h The discriminator identifies the data as sparse if it is not, and as dense otherwise. This discriminator avoids misjudgment based on a single indicator by simultaneously capturing both the fluctuation intensity (variance) and the distribution complexity (entropy). Through dynamic distribution analysis, it effectively identifies the density features in the input sequence, providing a quantitative basis for subsequent processing.

[0034] S2: Extract features from sparse sequences and dense sequences respectively; after feature extraction, standardize the extracted features.

[0035] In a specific embodiment of the present invention, different feature extraction methods are used for sparse sequences and dense sequences. Specifically, the present invention uses a deep semantic information extraction module to extract features from sparse sequences, and this module implements high-order semantic representation learning by completing missing values. A deep period information extraction module is used to extract features from dense sequences. Further, as Figure 1 As shown, the deep semantic information extraction module of the present invention constructs a binary missing identification matrix, calculates interpolation weights based on feature similarity, aggregates valid observations based on adaptive weights, and performs in-situ replacement and layer normalization to replace missing values and standardize features. Figure 1 The deep periodic information extraction module uses the triple technologies of cyclic sampling, Fourier transform and embedding representation to mine multi-granularity periodic patterns in dense sequences, and realizes cross-domain feature fusion through the triple attention mechanism.

[0036] Specifically, in an optional embodiment, the feature extraction process of the deep semantic feature extraction module specifically includes:

[0037] Assume that the sparse sequence is Construct a binary missing identity matrix M∈{0,1} B×T×D , the element M in the matrix b,t,d Press the following button to set:

[0038]

[0039] The subscripts b, t, and d indicate the location of the element or data, where b∈B, t∈T, and d∈D;

[0040] Then the interpolation weight w is calculated based on the feature similarity t′,d′ , the formula is as follows:

[0041]

[0042] Among them, t,d represents the time step and feature dimension of the current missing value; is the time neighborhood window, defined as {t′||t′-t|≤Δt}, where Δt is the preset time radius; t′, d′ represents the time step and feature dimension of the non-missing values within the preset time radius, which is used to calculate the similarity weight of the numerator; t″, d″ represents the time step and feature dimension of the non-missing values within the preset time radius, which is used to calculate the normalization factor of the denominator; is the characteristic neighborhood set; d(X t′,d′ ,X t,d ) is the feature similarity distance, which is calculated using the cosine distance formula. The formula is λ d ,λ tis the learnable attenuation coefficient, constrained by λ d >0,λ t >0, optimized by gradient descent.

[0043] For each missing location, valid observations are aggregated based on adaptive weights. Valid data with high similarity and temporal proximity contribute more to interpolation. The proposed formula is as follows:

[0044]

[0045] in, is the missing value calculated using the valid observations and their imputation weights, (1-M t′,d′ ) indicates masking missing data;

[0046] Finally, in-situ replacement and layer normalization are performed to replace missing values and standardize features; the formula for in-situ replacement is ⊙ represents element-by-element multiplication, ensuring that only the missing areas are replaced; the formula for layer normalization is X out =LayerNorm(X imputed ), LayerNorm represents the layer normalization operation, which can improve the stability of subsequent model training. This design has two advantages: one is dynamic adaptability, which can learn the attenuation coefficient λ d ,λ t Through gradient descent optimization, the time series correlation strength of different scenarios can be adaptively adjusted; secondly, noise resistance and robustness are improved. The cosine distance suppresses the interference of irrelevant features, enhances the semantic consistency of cross-sensor data, and adopts time proximity constraints to make recent data more weighted, reducing the impact of long-term noise on interpolation.

[0047] In another optional embodiment of the present invention, the feature extraction process of the deep semantic feature extraction module specifically includes:

[0048] A) Cyclic sampling: for input features A phase-shifted circular convolution kernel is used to extract features. k is defined as the sampling interval parameter, i represents the i-th sample in the batch, and j represents the j-th position in the output sequence. The circular index is implemented through the following modular operation, and the output is a time domain slice:

[0049]

[0050] B) Fourier transform: Let the input feature be For each feature dimension in each sample, extract its time step sequence; perform discrete Fourier transform on each time step sequence to map it from the time domain to the frequency domain; discrete Fourier transform calculates the complex coefficient of each frequency component, which consists of real and imaginary parts; determine the retained center frequency band range through the configurable band selection parameter M; calculate the band offset Then, a frequency band extending δ frequency units from the center frequency is retained to filter out high-frequency noise. The real and imaginary parts of the Fourier coefficients within the retained frequency band are extracted respectively. The amplitude spectrum is calculated based on the real and imaginary parts. The amplitude spectrum reflects the energy distribution of the signal at each frequency component within the retained frequency band. The final output frequency domain feature is the amplitude spectrum, which retains the energy distribution characteristics of the main frequency components of the signal.

[0051] C) Embedding representation: Let the input feature be Based on the Transformer architecture in deep neural networks, high-dimensional raw data is encoded and mapped to a low-dimensional space to achieve nonlinear abstraction of the feature space and output as an embedding vector;

[0052] D) Cross-domain feature aggregation: The triple attention mechanisms of temporal attention, frequency-domain attention, and cross-modal attention are used to collaboratively optimize time slices, amplitude spectra, and embedding vectors. Temporal attention is used to weightedly focus on key time nodes, and frequency-domain attention is used to enhance the contribution of significant periodic components. Cross-modal attention establishes dynamic associations among temporal, frequency, and semantic features.

[0053] The present invention further performs normalization on the extracted features. Normalization is a commonly used data processing method in the field. By scaling the features to a uniform dimension, it eliminates model bias caused by differences in dimension or numerical range between different features, thereby accelerating algorithm convergence. The present invention does not limit the normalization method; any characterization method that achieves the desired goal is applicable to the present invention.

[0054] S3: This step uses a dual-view feature modeling strategy to achieve a joint perception of temporal patterns at both the local and global contexts. Specifically, the normalized features are subjected to multi-scale block partitioning, followed by multi-granularity sequence segmentation, a dual-view attention mechanism, and feature space expansion to generate local and global reconstruction feature tensors.

[0055] Specifically, in one embodiment, S3 is implemented using the following method:

[0056] Given the normalized feature input sequence is First, a multi-scale block strategy is used to divide the time step T into R continuous sub-segments, each of which is N in length, satisfying T = R × N; for the local perspective, feature aggregation is performed on each sub-segment to generate a primitive sequence that represents the local temporal pattern For the global perspective, we construct a primitive sequence containing global context information by sampling features across sub-segments

[0057] The local primitive sequence X1 and the global primitive sequence Y1 are input into independent multi-head self-attention layers respectively, and the dependency of key time steps is strengthened through a dynamic weight distribution mechanism. Specifically, for the input sequence Z∈{X1,Y1}, its attention is calculated as:

[0058]

[0059] Where Q = ZW Q ,K=ZW K , V=ZW V The query, key, and value matrix generated by the linear projection, d k is the scaling factor. The process outputs local features with enhanced temporal dependence With global features Its dimension remains N;

[0060] Perform dimension expansion operation on X2 and Y2: copy X2 along the time axis R times to generate a local reconstruction feature tensor Simultaneously perform the same operation on Y2 to generate the global reconstruction feature tensor

[0061] S4: Based on the local and global reconstruction feature tensors obtained in S3, the symmetric KL divergence metric of the two-stream feature reconstruction is used for anomaly discrimination.

[0062] In one embodiment, the S4 includes: given a local reconstruction feature tensor and the global reconstruction feature tensor Where B is the batch size, T is the time step, and D is the feature dimension. The KL divergence is used to construct a two-way distribution difference metric:

[0063]

[0064] Where ∈ is a numerical stability term;

[0065] Calculate the anomaly score S by symmetric KL divergence fusion anomaly :

[0066]

[0067] The design is based on the following theoretical assumptions: normal time series data has a strong correlation in the local feature space and the global feature space (i.e., the distribution similarity of normal time series data is high), while abnormal points cause distribution deviation due to the destruction of time series consistency. In addition, the higher the KL divergence, the greater the difference between the two distributions. The present invention sets the threshold δ, if S anomaly If it is greater than or equal to δ, it means that the data of the current time step is abnormal, otherwise it is normal.

[0068] The following embodiment provides a system for implementing the aforementioned hybrid anomaly detection method for non-uniform multivariate time series. The system mainly includes three modules: a data processing module, a global and local processing module, and an anomaly judgment module.

[0069] The data processing module is used to implement the aforementioned steps S1 and S2 of the present invention, that is, for the input non-uniform multivariate time series to be detected, the variance-entropy joint density discriminator is used to judge the density of the data, and the input data is divided into a sparse sequence rich in semantic information and a dense sequence rich in periodic information based on the density. Different information extraction processes are entered according to the different data densities. The deep semantic information extraction module is used to extract features for sparse sequences; the deep periodic information extraction module is used to extract features for dense sequences. The deep semantic information extraction module constructs a binary missing identification matrix, calculates interpolation weights based on feature similarity, aggregates valid observations based on adaptive weights, and performs in-situ replacement and layer normalization to replace missing values and standardize features. The deep periodic information extraction module uses the triple technology of cyclic sampling, Fourier transform and embedded representation to realize multi-granularity periodic pattern mining for dense sequences, and realizes cross-domain feature fusion through the triple attention mechanism. After the information extraction is completed, the data is standardized.

[0070] The global and local processing module, used to implement step S3 of the present invention, divides the data into two different perspectives, local and global, to learn time series representations. Representations are learned by comparing the features extracted and reconstructed by the local and global methods. Because the connections between normal time series are relatively close, while the correlations between anomalies are relatively weak, comparing the time series reconstructed by the two methods can make the display of anomalies more obvious. Furthermore, the local and global methods can capture both the local features of the sequence and the temporal dependencies between time series.

[0071] Specifically, the global and local processing modules perform multi-scale blocking operations on the standardized features, and then perform multi-granularity sequence division, dual-view attention mechanism and feature space expansion to obtain local reconstructed feature tensors and global reconstructed feature tensors.

[0072] The anomaly judgment module is used to implement the aforementioned step S4 of the present invention. The module uses the symmetric KL divergence metric of dual-stream feature reconstruction to perform anomaly judgment based on the local reconstructed feature tensor and the global reconstructed feature tensor obtained by the local and local processing modules.

[0073] To illustrate the present invention in detail, different public datasets are used to evaluate and simulate the method of the present invention (abbreviated as HADN) and existing methods. The public datasets used include SMD, MSL, SMAP, SWAT and PSM. SMD is a server machine dataset, MSL is a Mars rover telemetry dataset provided by NASA, SMAP is a soil moisture monitoring satellite dataset provided by NASA, SWAT is a dataset collected from sewage treatment facilities in industrial environments, and PSM is an internal application server node dataset provided by eBay.

[0074] The existing methods compared include Transformer (Vaswani, A., Shazeer, N., Parmar, N., Uszkoreit, J., Jones, L., Gomez, AN,... &Polosukhin, I. (2017). Attention is all you need. Advances in neural information processing systems, 30.), Autoformer (Wu, H., Xu, J., Wang, J., & Long, M. (2021). Autoformer: Decomposition transformers with auto-correlation for long-term series forecasting. Advances in neural information processing systems, 34, 22419-22430.), TimesNet (Wu, H., Hu, T., Liu, Y., Zhou, H., Wang, J., & Long, M. (2022). Timesnet: Temporal 2d-variation modeling for general timeseries analysis. arXiv preprint arXiv:2210.02186.) and DCDetector (ang, Y., Zhang, C., Zhou, T., Wen, Q., & Sun, L. (2023, August). Dcdetector: Dual attention contrastive representation learning for time series anomaly detection. In Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining(pp.3033-3045).).

[0075] Since the public dataset is not a multivariate inhomogeneous time series, the present invention converts the data in the public dataset into a multivariate inhomogeneous time series by adjusting the sampling frequency, random deletion, and event-driven sampling, and then evaluates the corresponding methods.

[0076] Table 1 shows the performance comparison of precision P and recall R on the benchmark dataset.

[0077] Table 1 Performance comparison on benchmark datasets

[0078]

[0079] Figure 2 The performance comparison of the F1 score on the benchmark dataset is shown in Table 1 and Figure 2 It can be seen that HADN demonstrates significant performance advantages in time series anomaly detection tasks. Through systematic verification on five authoritative benchmark datasets, namely SMD, MSL, SMAP, SWaT, and PSM, the model has achieved performance breakthroughs in data covering typical industrial scenarios such as spacecraft telemetry, server cluster monitoring, water treatment system control, and distributed operation and maintenance. Compared with the four current mainstream baseline methods, namely Transformer, Autoformer, TimesNet, and DCDetector, the model comprehensively surpasses existing methods in the comprehensive evaluation indicator F1 score, reaching SOTA. Among them, the F1 value on the SMD dataset and SWaT dataset increased by 2.83% and 2.19% respectively. Further analysis shows that while maintaining a high recall rate (anomaly capture ability), the model's accuracy on the SMD, MSL, and SMAP datasets is 3.99%, 6.61%, and 3.25% higher than the optimal baseline, respectively.

[0080] In summary, this performance consistency across datasets verifies the method's ability to analyze complex time series features, as well as its robustness in dealing with non-stationary data distributions and abnormal pattern mutation scenarios.

[0081] The above-described embodiments merely illustrate several implementations of the present invention, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present invention. Persons skilled in the art will readily appreciate that variations and modifications may be made without departing from the scope of the present invention, all of which fall within the scope of protection of the present invention.

Claims

1. A hybrid anomaly detection method for non-uniform multivariate time series, characterized in that: The steps include: S1: For the input non-uniform multivariate time series to be detected, the variance-entropy joint density discriminator is used to determine the density of the data. Based on the density, the input data is divided into a sparse sequence rich in semantic information and a dense sequence rich in periodic information. S2: Extract features from sparse sequences and dense sequences respectively; after feature extraction, perform standardization on the extracted features; S3: Perform multi-scale block operations on the standardized features, and then perform multi-granularity sequence division, dual-view attention mechanism and feature space expansion to obtain local reconstruction feature tensors and global reconstruction feature tensors; S4: Based on the local and global reconstruction feature tensors obtained in S3, the symmetric KL divergence metric of the two-stream feature reconstruction is used for anomaly discrimination.

2. The hybrid anomaly detection method for non-uniform multivariate time series according to claim 1, characterized in that: The S1 is specifically: Assume that the input non-uniform multivariate time series to be detected is Where B is the batch size, T is the time step, D is the feature dimension, and the variance-entropy joint density discriminator is used to determine the density of the data DensityFlag: H(X)=-Σp(x)log(p(x)); Among them, σ 2 is the variance of the current time step, is x t,d The mean of x t,d is the data corresponding to the current time step and feature dimension; H(X) is the distribution entropy, p(x) is the probability obtained by performing adaptive equal-frequency binning on the input non-uniform multivariate time series according to the feature dimension to obtain K intervals, and then counting the number of samples in each interval; τ v and τ h is a learnable parameter; The variance is greater than the threshold τ v And the distribution entropy is less than the threshold τ h The data is considered to be a sparse sequence, otherwise it is a dense sequence.

3. The hybrid anomaly detection method for non-uniform multivariate time series according to claim 1, characterized in that: In S2, a deep semantic information extraction module is used to extract features from the sparse sequence; the deep semantic information extraction module constructs a binary missing identification matrix, calculates interpolation weights based on feature similarity, aggregates valid observations based on adaptive weights, and performs in-situ replacement and layer normalization to replace missing values and standardize features.

4. The hybrid anomaly detection method for non-uniform multivariate time series according to claim 1 or 3, characterized in that: The feature extraction process of the deep semantic feature extraction module specifically includes: Assume that the sparse sequence is Construct a binary missing identity matrix M∈{0,1} B×T×D , the element M in the matrix b,t,d Press the following button to set: The subscripts b, t, and d indicate the location of the element or data, where b∈B, t∈T, and d∈D; Then the interpolation weight w is calculated based on the feature similarity t′,d′ , the formula is as follows: Among them, t,d represents the time step and feature dimension of the current missing value; is the time neighborhood window, defined as {t′||t′-t|≤Δt}, where Δt is the preset time radius; t′, d′ represents the time step and feature dimension of the non-missing values within the preset time radius, which is used to calculate the similarity weight of the numerator; t″, d″ represents the time step and feature dimension of the non-missing values within the preset time radius, which is used to calculate the normalization factor of the denominator; is the characteristic neighborhood set; d(X t′,d′ ,X t,d ) is the feature similarity distance, calculated using the cosine distance formula, λ d ,λ t is the learnable attenuation coefficient, constrained by λ d >0,λ t >0, optimized by gradient descent; Aggregate valid observations based on adaptive weights, the formula is as follows: in, is the missing value calculated using the valid observations and their imputation weights, (1-M t′,d′ ) indicates masking missing data; Finally, in-situ replacement and layer normalization are performed to replace missing values and standardize features; the formula for in-situ replacement is ⊙ represents element-by-element multiplication, ensuring that only the missing areas are replaced; the formula for layer normalization is X out =LayerNorm(X imputed ), LayerNorm represents the layer normalization operation.

5. The hybrid anomaly detection method for non-uniform multivariate time series according to claim 1, characterized in that: In S2, a deep periodic information extraction module is used to extract features from dense sequences. The deep periodic information extraction module uses the triple technologies of cyclic sampling, Fourier transform and embedding representation to mine multi-granularity periodic patterns in dense sequences, and realizes cross-domain feature fusion through the triple attention mechanism.

6. The hybrid anomaly detection method for non-uniform multivariate time series according to claim 1 or 5, characterized in that: The feature extraction process of the deep semantic feature extraction module specifically includes: A) Cyclic sampling: for input features A phase-shifted circular convolution kernel is used to extract features. k is defined as the sampling interval parameter, i represents the i-th sample in the batch, and j represents the j-th position in the output sequence. The circular index is implemented through the following modular operation, and the output is a time domain slice: B) Fourier transform: Let the input feature be For each feature dimension in each sample, extract its time step sequence; perform discrete Fourier transform on each time step sequence to map it from the time domain to the frequency domain; discrete Fourier transform calculates the complex coefficient of each frequency component, which consists of real and imaginary parts; determine the retained center frequency band range through the configurable band selection parameter M; calculate the band offset Then, a frequency band extending δ frequency units from the center frequency is retained to filter out high-frequency noise. The real and imaginary parts of the Fourier coefficients within the retained frequency band are extracted respectively. The amplitude spectrum is calculated based on the real and imaginary parts. The amplitude spectrum reflects the energy distribution of the signal at each frequency component within the retained frequency band. The final output frequency domain feature is the amplitude spectrum, which retains the energy distribution characteristics of the main frequency components of the signal. C) Embedding representation: Let the input feature be Based on the Transformer architecture in deep neural networks, high-dimensional raw data is encoded and mapped to a low-dimensional space to achieve nonlinear abstraction of the feature space and output as an embedding vector; D) Cross-domain feature aggregation: The triple attention mechanisms of temporal attention, frequency-domain attention, and cross-modal attention are used to collaboratively optimize time slices, amplitude spectra, and embedding vectors. Temporal attention is used to weightedly focus on key time nodes, and frequency-domain attention is used to enhance the contribution of significant periodic components. Cross-modal attention establishes dynamic associations among temporal, frequency, and semantic features.

7. The hybrid anomaly detection method for non-uniform multivariate time series according to claim 1, characterized in that: The S3 includes: Given the normalized feature input sequence is First, a multi-scale block strategy is used to divide the time step T into R continuous sub-segments, each of which is of length N, satisfying T = R × N; for the local perspective, feature aggregation is performed on each sub-segment to generate a primitive sequence that represents the local temporal pattern For the global perspective, we construct a primitive sequence containing global context information by sampling features across sub-segments The local primitive sequence X1 and the global primitive sequence Y1 are input into independent multi-head self-attention layers respectively, and the dependency relationship of key time steps is strengthened through the dynamic weight distribution mechanism; the process outputs local features with enhanced temporal dependency With global features Its dimension remains N; Perform dimension expansion operation on X2 and Y2: copy X2 along the time axis R times to generate a local reconstruction feature tensor Simultaneously perform the same operation on Y2 to generate the global reconstruction feature tensor 8. The hybrid anomaly detection method for non-uniform multivariate time series according to claim 7, characterized in that: The S4 includes: Given a local reconstruction feature tensor and the global reconstruction feature tensor Where B is the batch size, T is the time step, and D is the feature dimension. The KL divergence is used to construct a two-way distribution difference metric: Where ∈ is a numerical stability term; Calculate the anomaly score S by symmetric KL divergence fusion anomaly : Set the threshold δ, if S anomaly If it is greater than or equal to δ, it means that the data of the current time step is abnormal, otherwise it is normal.

Images