Unsupervised anomaly detection method based on enhanced variational auto-encoder

Abstract

The invention relates to an unsupervised anomaly detection method based on an enhanced variational auto-encoder, and the method comprises the following steps: S1, data collection and preprocessing: obtaining a multi-dimensional airborne pollutant monitoring data set, and carrying out the filtering and denoising, and missing value interpolation data cleaning; s2, model construction: two layers of TCN residual blocks are adopted, each residual block internally comprises two layers of one-dimensional expansion causal convolution, and a TCN-based encoder totally comprises four layers of expansion causal convolution; the method comprises the following steps: constructing a full connection layer behind an encoder output layer based on TCN, and mapping output feature dimensions into a two-dimensional submerged space; the VAE decoder module uses two layers of full connection layers, and outputs a feature dimension as an input data dimension; s3, constructing an exception score calculation function and an automatic threshold exception detection function: calculating an exception score of each sample based on a reconstruction loss calculation method, setting an exception threshold, and identifying an exception sample; and S4, model training.

Description

Technical Field

[0001] The present invention belongs to the field of data processing and anomaly detection technology, and specifically relates to an unsupervised anomaly detection method for time series data based on a temporal convolutional neural network (TCN) enhanced variational autoencoder (VAE), which can be applied to scenarios where time series data exists, such as industrial production monitoring, financial transaction analysis, and environmental monitoring. Background Art

[0002] Time series data is a common data format that contains information and patterns that change over time. Accurately and promptly detecting outliers in time series data is crucial for ensuring system operation and preventing potential risks.

[0003] Traditional anomaly detection methods, such as statistical methods, rely on specific data distribution assumptions. They are often difficult to accurately model in complex and changing real-world time series data, resulting in poor detection results. Clustering-based methods are easily affected by the initial state of the data and the parameters of the clustering algorithm. For non-convex distributions or noisy data, the clustering results are unstable, resulting in low anomaly detection accuracy and reliability. Traditional methods are susceptible to the "curse of dimensionality" when processing high-dimensional time series data, and the performance of distance-based anomaly detection methods will significantly degrade in high-dimensional space. Furthermore, traditional unsupervised outlier detection methods, which are common and use density or distance metrics to measure the degree of data anomaly, treat time series data as a collection of high-dimensional data points and ignore the inherent temporal dependencies in the data, resulting in poor outlier detection results.

[0004] Ensemble-based outlier detection models face the challenge of balancing outlier detection performance with the cost of generalized deployment given the complex and volatile characteristics of time series data. The algorithm selection mechanism for ensemble algorithm models is also a major challenge. Conventional algorithm matching mechanisms include two types: those based on data features and those based on model evaluation. These are only suitable for statistical algorithm ensemble models and often suffer from poor data processing performance. Model evaluation-based algorithms, on the other hand, often result in lengthy computational times and high complexity.

[0005] In recent years, deep learning has been widely used in the field of anomaly detection. A common algorithm design approach for time series outlier detection using deep learning is to use it to extract low-dimensional feature representations from high-dimensional data for downstream anomaly detection. Researchers have proposed a time series outlier detection algorithm based on a temporal convolutional network and a Gaussian mixture model. This algorithm extracts time series features through a temporal convolutional network and combines the Gaussian mixture model with Bayesian reasoning to detect system anomalies. Focusing on the critical high-dimensional data processing challenges in time series monitoring data, some have proposed a hybrid model, DBN-1SVM, which uses a deep belief network (DBN) as a feature extraction module and a one-class support vector machine (OneClass SVM) as a classification tool. This model leverages the deep feature extraction capabilities of the DBN to address the "curse of dimensionality" problem in time series outlier detection. Similarly, other research uses graph anomaly detection methods, using anomaly metrics based on unsupervised clustering in a latent representation space to compute anomalies at graph vertices or edges. These methods leverage the feature extraction capabilities of deep learning algorithms, effectively reducing the dimensionality of high-dimensional time series data and easily integrating with a wide range of existing classifiers for anomaly detection. However, the feature extraction component of these algorithms is disconnected from the anomaly scoring algorithm, often resulting in suboptimal anomaly score calculations.

[0006] Variational autoencoder models have shown great potential in unsupervised anomaly detection due to their ability to learn the underlying probability distribution of data.

[0007] A variational autoencoder is an unsupervised learning algorithm based on probabilistic graphical models and deep neural network architectures. It maps input data into a latent space and learns the underlying distribution of the data by maximizing the posterior probability. The core idea of ​​a VAE is to transform input data into a distribution of latent variables through an encoder and then reconstruct the latent variables into input data through a decoder.

[0008] In addition, in view of the long-term and strong causal characteristics of data distribution in the time series data outlier detection scenario, a temporal convolutional neural network (TCN) is used to capture the distribution information in long-term historical data, which is used to assist the variational autoencoder in constructing a more accurate probability distribution latent space and comprehensively improve the outlier detection performance.

[0009] The present invention aims to improve the accuracy and reliability of unsupervised anomaly detection by improving the encoder structure of VAE, enhancing the ability to extract time series data features, and optimizing the learning of data distribution. Summary of the Invention

[0010] This paper proposes an unsupervised anomaly detection method based on a temporal convolutional neural network (TCN) enhanced variational autoencoder (VAE) for outlier detection in time series data. By improving the VAE's encoder structure, the ability to extract time series data features is enhanced, and the learning of data distribution is optimized, thereby improving the accuracy and reliability of unsupervised anomaly detection. The technical solution is as follows:

[0011] An unsupervised anomaly detection method based on enhanced variational autoencoder includes the following steps:

[0012] S1 Data acquisition and preprocessing: Acquire multidimensional airborne pollutant monitoring data sets and perform filtering, denoising, and missing value interpolation data cleaning.

[0013] S2 model construction: A two-layer TCN residual block is used, each of which contains two layers of one-dimensional dilated causal convolutions. The TCN-based encoder contains a total of four layers of dilated causal convolutions, with the number of neurons in each layer being 4, 4, 8, and 8 respectively; the dilation coefficients are 1, 2, 4, and 8 respectively, and the convolution kernel size is 4; after the output layer of the TCN-based encoder, a fully connected layer is constructed to map the output feature dimension to a two-dimensional latent space; the VAE decoder module uses two fully connected layers, and the output feature dimension is the input data dimension;

[0014] S3 builds anomaly score calculation function and automatic threshold anomaly detection function: calculates the anomaly score of each sample based on the reconstruction loss calculation method, sets the anomaly threshold, and identifies abnormal samples;

[0015] S4 model training.

[0016] The technical solution provided by the present invention has the following beneficial effects:

[0017] 1. Efficient Time Series Feature Extraction: A time series convolutional neural network replaces the encoder of the traditional VAE. Its dilated causal convolutional structure can effectively expand the receptive field and capture long-range dependencies in time series data without increasing excessive computational effort. Compared with traditional encoders, it can more accurately extract the features of time series data, providing richer and more effective information for subsequent anomaly detection.

[0018] 2. Accurate distribution learning: Combined with the effective features extracted by the time series convolutional neural network, the posterior distribution output by the encoder can more accurately reflect the intrinsic structure of the time series data. Under the constraint of KL divergence, the latent space distribution is made more reasonable, thereby more accurately learning the distribution of normal data, improving sensitivity to abnormal data, and reducing false detection and missed detection rates.

[0019] 3. Advantages of unsupervised detection: The method of the present invention does not require a large amount of labeled data. It can realize unsupervised anomaly detection of time series data by using only normal time series data for training. It is suitable for situations where it is difficult to obtain labeled data in actual scenarios, and has strong versatility and practicality. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 Flowchart of the architecture of the present invention.

[0021] Figure 2 Loss function and anomaly score change curve during model training. DETAILED DESCRIPTION

[0022] The specific technical solutions of the present invention are as follows:

[0023] 1. Data collection and preprocessing: Collect the original time series data of the target field and complete basic preprocessing such as filtering, denoising, and missing value interpolation.

[0024] 2. According to the online data batch size batch_size and the number of collected data feature variables n_inputs in the algorithm deployment scenario, the collected received data is converted into a tensor of the shape [batch_size, n_inputs, seq_length]

[0025] 3. Define the input variable dimension size input_size, latent space dimension size z_dim, convolution layer dimension channel_sizes, convolution kernel size kernel_size, and dropout parameters of the algorithm model (the convolution layer dimension channel_sizes parameter is in array form, indicating the dimension size of each layer of convolution)

[0026] 4. According to the defined input_size and other parameter values, the residual block of the dilated convolution is constructed. This is the core structure of the temporal convolutional network TCN. The specific implementation method is:

[0027] a) First, define the expansion coefficient d according to the requirements. This parameter affects the depth of the TCN receptive field.

[0028] b) Construct the first layer of dilated convolution and trim the excess padding through padding to keep the input and output sequence lengths consistent.

[0029] c) Normalize the weights of the upper dilated convolution layer. The basic idea of ​​this operation is to decompose the weight parameter ω into two parameters: direction v and scalar g, as shown in formula (1). The norm of the weight is controlled by g, while the direction is controlled by v. Therefore, when normalizing the weights, the weight norm g of the convolution layer is normalized to avoid the gradient explosion or vanishing problem.

[0030]

[0031] d) Use the ReLU activation function, as calculated in formula (2), and use dropout to randomly discard some neurons to achieve regularization and prevent overfitting.

[0032] ReLU(x)=max(0,x) (2)

[0033] e) Dropout randomly discards the activation outputs of some neurons to reduce overfitting.

[0034] f) Constructing residual connections: The network output after dilated convolution, weight normalization, ReLU activation function, and dropout is added to the initial input of the dilated convolution layer. The resulting sum serves as the input to the next layer of the neural network. This processing method provides a direct gradient path for the above-mentioned multi-layer neural network architecture, thereby alleviating the vanishing gradient problem.

[0035] g) Steps b) to f) construct a set of standard TCN residual block structures. In the present invention, the number of residual blocks is determined according to the array length of the channel_sizes parameter of the convolutional layer dimension set by the user, and they are connected together in sequence.

[0036] 5. Add a fully connected layer after the convolutional layer to calculate the mean and log-variance required to reparameterize the latent space distribution. The specific implementation method is as follows:

[0037] a) Construct a fully connected layer to map the algorithm model input data from the channel_sizes[-1] features of the upper layer (convolutional layer) to the z_dim features of the lower layer (the output layer of the TCN-based VAE encoder network).

[0038] b) Use the fully connected layer to calculate the mean and logarithmic variance of the latent space distribution of the batch of input samples

[0039] In VAE, the core idea is to assume that the data is generated by a latent variable (latent variable), and the latent variable obeys a prior distribution, usually a standard normal distribution, that is:

[0040] At this point, after the encoder operation output, the probability distribution of the batch of input data (observation data) in the latent space has been constructed. However, the process of directly sampling the latent variables is not differentiable, so it is difficult to perform gradient optimization. Therefore, reparameterization is used to achieve it.

[0041] 6. Obtain the mean and logarithmic variance of the latent space distribution through the encoder network output and perform reparameterization. The specific implementation method is as follows:

[0042] a) Perform exponential operation on the logarithmic variance using formula (3) to obtain the standard deviation std

[0043]

[0044] b) Draw a random noise ∈ from the standard normal distribution N(0,1) with the same size as mean μ and standard deviation σ.

[0045] c) Use formula (4) to perform reparameterized sampling to obtain the latent variable z, thereby achieving the purpose of optimizing the gradient through random sampling.

[0046] z=μ+σ⊙ε (4)

[0047] Here, ⊙ represents element-wise multiplication.

[0048] 7. Build the VAE decoder. The specific implementation method is:

[0049] a) Use Sequential to build a decoder network structure consisting of a fully connected layer, a ReLU activation function layer, and a fully connected layer. This multi-layer network structure and nonlinear activation function provide stronger data feature learning capabilities.

[0050] b) The decoder receives the latent space reparameterization sampling result z and passes it to the first fully connected layer, which maps the input data from the z_dim features of the upper layer to the batch_size features of the next ReLU layer

[0051] c) In the ReLU layer, use formula (5) to calculate the activation function:

[0052] ReLU(x)=max(0,x) (5)

[0053] This activation function facilitates the decoder to learn the complex nonlinear relationship between input (latent space reparameter sampling) and output (reconstructed sample), while avoiding negative input, thereby generating a sparse activation matrix, which helps to reduce overfitting.

[0054] d) The second fully connected layer is connected to batch_size nodes in the upper layer and input_size*seq_length nodes in the lower layer. This layer is used to further transform features and extract more complex representations.

[0055] e) Finally, a fully connected layer is used to map it to the output_size features of the output layer, so that the decoder network output dimension matches the sample reconstruction dimension, and the decoder outputs the reconstructed sample.

[0056] 8. For the decoder output, calculate the reconstruction probability to evaluate the similarity between the data generated by the decoder and the original observed data. The specific implementation method is:

[0057] a) Calculate the log-likelihood of the input data x at the decoder output according to formula (6):

[0058]

[0059] b) Perform the exponential transformation of the calculated log-likelihood using formula (7) to obtain the reconstruction probability of the input under the latent variable:

[0060] p(x|z)=exp(logp(x|z)) (7)

[0061] 9. Calculate the loss function. The specific implementation method is:

[0062] a) Define the loss function in the VAE algorithm model as the sum of the reconstruction error and the KL divergence. Introducing the KL divergence into the VAE loss function plays an important role. It not only prevents the encoder from mapping different input data to very discrete points in the latent space, but also ensures that the latent space distribution is continuous, just like the prior normal distribution. This ensures that when sampling from the continuous latent space (probability distribution), a coherent reconstruction sample result is obtained. It also regularizes the latent space, prevents model overfitting, and improves generalization ability.

[0063] b) Reconstruction error The error between the observed data and the reconstructed output is calculated by the mean square error (MSE), which is calculated as follows:

[0064]

[0065] c) KL divergence is used to measure the difference between the distribution of latent variables and the prior normal distribution. It is calculated as formula (9):

[0066] KL=0.5·∑(1+logσ 2 -μ 2 -σ 2 ) (9)

[0067] 10. Error back propagation and iterative calculation.

[0068] The anomaly score is calculated based on the negative logarithmic probability, as shown in formula (10):

[0069] anomaly_score = -logp(x|x recon ) (10)

[0070] Assuming that the anomaly score approximately follows a normal distribution, the quantile is used to determine the threshold for classifying samples by anomaly score. The anomaly score calculated by the algorithm model of the observed data is compared with the anomaly threshold to obtain the anomaly class label of the observed sample, thereby realizing adaptive anomaly detection and judgment.

[0071] The method of the present invention is further described below in conjunction with specific embodiments:

[0072] Example

[0073] The present invention provides an unsupervised anomaly detection method based on a temporal convolutional neural network enhanced variational autoencoder, which mainly includes the following steps:

[0074] S1, data collection and preprocessing;

[0075] A multidimensional airborne pollutant monitoring dataset was obtained from a residential building indoor air quality monitoring dataset, and data cleaning processes such as filtering, denoising, and missing value interpolation were performed. The anomaly labels between the multidimensional feature variables in this dataset exhibited some correlation, but not complete overlap. This aligns with the reality that sensors in actual monitoring applications vary in lifespan, susceptibility to failure, and damage.

[0076] The monitoring feature dimensions of the dataset are shown in Table 1.

[0077] Table 1. Parameters related to characteristic variables in the dataset

[0078] Feature variables dimension Data Type Abnormal sample ratio (%) temperature ℃ FLOAT 1.8 relative humidity ％ FLOAT 7.1 HCHO concentration <![CDATA[ug / m 3 ]]> FLOAT 44.0 CO2 concentration ppm FLOAT 12.4 Timestamp -- INT --

[0079] The dataset is divided into training set and test set in a ratio of 8:2. The training set has 104,690 samples and the test set has 26,173 samples.

[0080] S2, model construction;

[0081] In this embodiment of the present invention, a two-layer TCN residual block is used. Due to the TCN architecture, each residual block contains two layers of one-dimensional dilated causal convolutions. Therefore, the TCN-based encoder contains a total of four layers of dilated causal convolutions, with the number of neurons in each layer being 4, 4, 8, and 8, respectively. The dilation coefficients are 1, 2, 4, and 8, respectively, and the convolution kernel size is 4. After the output layer of the TCN-based encoder, a fully connected layer is constructed to map the output feature dimension to a two-dimensional latent space. The VAE decoder module uses two fully connected layers, each containing 256 neurons, and the output feature dimension is the input data dimension.

[0082] S3, build anomaly score calculation function and automatic threshold anomaly detection function;

[0083] The anomaly score of each sample is calculated based on the reconstruction loss calculation method, and the 90% quantile is used as the anomaly threshold to identify abnormal samples.

[0084] S4, model training;

[0085] The platform parameters for algorithm model training are shown in Table 2.

[0086] Table 2 Algorithm model training platform parameters

[0087] GPU processor GPUP100 CPU Processor i7-11800H Development language Python Deep Learning Framework PyTorch

[0088] The model hyperparameters are shown in Table 3:

[0089] Table 3 Algorithm model hyperparameters

[0090] Input Dimension n_inputs 4 Sequence step length seq_length 1 Latent space dimension z_dim 2 Convolution kernel size kernel_size 4 Residual block dimension structure channel_sizes [4,8] Dropout parameters dropout 0.2 Activation Function activationfunction ReLU Optimizer optimizer Adam Initial learning rate lr 0.001 Learning rate controller scheduler ExponentialLR Learning rate decay rate gamma 0.99 Batch size batch_size 256 Number of iterations epoch 150

[0091] S5, model testing, outputting the outlier detection results under the test set;

[0092] The loss function and anomaly score changes during model training are shown in Figure 2 .

[0093] After model training is complete, the model is tested. The model's detection results on the test set are compared with the actual anomaly class labels to obtain quantitative performance indicators such as precision, recall, and F1 score.

[0094] Based on the applicability of outlier detection algorithms in the field of time series data processing, we selected three mainstream unsupervised outlier detection algorithms for time series data: box plots, one-class support vector machines (SVMs), and Z-scores. These algorithms were used as baselines for performance comparison with the TVAE outlier detection algorithm model. The performance of each unsupervised outlier detection algorithm for time series data on the test set is shown in Table 4.

[0095] Table 4 Performance comparison of the proposed algorithm and the baseline algorithm

[0096]

[0097] As shown in Table 4, the proposed TCN-enhanced VAE outlier detection algorithm (TVAE algorithm) demonstrates significant advantages in all four feature variable anomaly detection tasks. In particular, it achieves a 0.60 accuracy for HCHO concentration detection, a 42.9% improvement over the best baseline (0.42 for One Class SVM), demonstrating its robustness to data with high anomaly ratios. Furthermore, while maintaining high precision, the TVAE algorithm significantly outperforms the baseline in recall, demonstrating its effectiveness in reducing missed detections.

[0098] Compared with the other three baseline algorithms, although the three baseline algorithms have high precision in the temperature feature detection task, the corresponding recall rate is very low, which indicates that the threshold settings of the baseline algorithms are often too strict and cannot adapt to dynamic timing fluctuations.

[0099] At the same time, the TVAE algorithm maintains stable performance in high-difficulty scenarios such as HCHO (abnormality ratio 44%), verifying the ability of TCN-VAE joint modeling to capture complex temporal dependencies.

[0100] In summary, the unsupervised anomaly detection method based on time series convolutional neural network enhanced variational autoencoder proposed in the present invention has been verified through testing and quantitative analysis of the implementation examples to have the ability to comprehensively improve the accuracy and generalization of unsupervised anomaly detection tasks for time series data, and has significant innovative advantages.

[0101] The embodiments disclosed above are readily implementable by professionals skilled in the art and related industries. Modifications to various details in the embodiments are also readily possible. The methods defined herein may also be appropriately modified and applied to other specific embodiments. Therefore, the scope of protection of the present invention is not limited to the embodiments presented herein, but should be based on the claims and should be consistent with the broadest scope consistent with the methods and features disclosed herein.

Claims

1. An unsupervised anomaly detection method based on enhanced variational autoencoder, comprising the following steps: S1 data acquisition and preprocessing; S2 model construction: A two-layer TCN residual block is used, each of which contains two layers of one-dimensional dilated causal convolutions. The TCN-based encoder contains a total of four layers of dilated causal convolutions, with the number of neurons in each layer being 4, 4, 8, and 8 respectively; the dilation coefficients are 1, 2, 4, and 8 respectively, and the convolution kernel size is 4; after the output layer of the TCN-based encoder, a fully connected layer is constructed to map the output feature dimension to a two-dimensional latent space; the VAE decoder module uses two fully connected layers, and the output feature dimension is the input data dimension; S3 builds anomaly score calculation function and automatic threshold anomaly detection function: defines the loss function, calculates the anomaly score of each sample based on the reconstruction loss calculation method, sets the anomaly threshold, and identifies abnormal samples; S4 model training.

2. The method according to claim 1, wherein: In S1, a multidimensional airborne pollutant monitoring dataset is obtained, and filtering, denoising, and missing value interpolation data cleaning processing are performed.

3. The method according to claim 1, wherein: The loss function is equal to the sum of the reconstruction error and the KL divergence.

Images