Federal double-regularization multi-error fusion time sequence anomaly detection method

Abstract

The invention belongs to the field of artificial intelligence, and relates to a federal double-regularization multi-error fusion time sequence anomaly detection method, which comprises the following steps that: a central server initializes a global model to obtain global model parameters, and distributes the global model parameters to a plurality of local clients; a plurality of local clients respectively receive the global model parameters, and perform local training by using the local private data to obtain local model parameters; the local client performs multi-error fusion detection on the local server based on the corresponding local model parameters to obtain a dynamic fusion anomaly score; the central server receives the local model parameters returned by the plurality of local clients and aggregates the plurality of local model parameters to obtain new global model parameters; based on the new global model parameters, multiple new local model parameters are obtained until the global model converges, and optimal global model parameters are obtained; distributing the optimal global model parameters to a plurality of local clients; and the detection precision and robustness are improved.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence, and specifically discloses a federated double-regularization multi-error fusion time series anomaly detection method. Background Art

[0002] With the prevalence of the Internet of Things and distributed computing, multivariate time series anomaly detection is becoming increasingly important in areas such as industrial monitoring and financial risk control. Traditional centralized approaches require aggregating data from various terminals to a central server, which poses a serious risk of privacy leakage. While existing federated learning solutions can protect data privacy, they face three major technical bottlenecks when processing time series data: 1) gradient instability caused by non-IID data; 2) mode collapse during adversarial training; and 3) excessive sensitivity to local noise. For example, GAN-based methods are unstable when trained in a federated environment, while LSTM prediction models struggle to capture complex time series dependencies.

[0003] In view of this, the present invention provides a federated dual-regularization multi-error fusion time series anomaly detection method, which integrates the privacy-preserving anomaly detection framework of the dual-regularized Wasserstein GAN and the multi-error fusion mechanism, and is suitable for scenarios such as financial fraud monitoring, industrial equipment fault diagnosis, and medical health monitoring. Summary of the Invention

[0004] The purpose of this invention is to provide a federated dual-regularization multi-error fusion time series anomaly detection method. This method solves the problems of adversarial training instability caused by client data heterogeneity in federated learning, insufficient modeling of complex dependencies in time series, false positives caused by the sensitivity of the discriminator under noise interference, and the limitations of a single detection metric (such as reconstruction error). The specific solution is as follows: A federated dual-regularization multi-error fusion time series anomaly detection method comprises: step S1: a central server initializes a global model, obtains global model parameters, and distributes the global model parameters to multiple local clients; step S2: multiple local clients respectively receive the global model parameters and perform local training using local private data to obtain local model parameters; step S3: local clients respectively perform multi-error fusion detection on the local server based on the corresponding local model parameters to obtain dynamic fusion anomaly scores; step S4: the central server receives the local model parameters returned by the multiple local clients, and aggregates the multiple local model parameters to obtain new global model parameters; step S5: based on the new global model parameters, repeating steps S2 to S4 to obtain multiple new local model parameters until the global model converges and the optimal global model parameters are obtained; and the optimal global model parameters are distributed to the multiple local clients.

[0005] Furthermore, both the global model and the local model include a generator network, a discriminator network, and a BiFA-LSTM predictor; and both the global model parameters and the local model parameters include the learning weights and biases of the generator network, the discriminator network, and the BiFA-LSTM predictor.

[0006] Furthermore, the generator network includes a temporal convolutional self-attention module and a decoder; the temporal convolutional self-attention module includes parallel convolution layers and multi-head self-attention modules; the decoder includes multi-layer temporal convolution; the discriminator network integrates a dual gradient regularization strategy, including interpolation gradient penalty and input gradient amplitude penalty; the BiFA-LSTM predictor includes bidirectional LSTM and feature alignment attention.

[0007] Furthermore, the expression of the temporal convolution self-attention module is: ;in, Represents the attention feature vector obtained by the temporal convolution self-attention module processing the potential vector z; LayerNorm represents normalization processing; Conv1D represents the extraction of local temporal features, and MultiHeadAttn represents the capture of global dependencies; the expression of the interpolation gradient penalty is: ; Among them, GP represents interpolation gradient penalty; represents the interpolation sample; represents the first penalty coefficient; Represents all possible interpolation samples Find the mathematical expectation; Represents the gradient operator, specifically the gradient of the input variable Find partial derivatives; Represents the discriminator network for interpolation samples The confidence score of the output; represents the Euclidean distance (L2 norm); the expression of the input gradient amplitude penalty is: ; Among them, IGMP represents gradient amplitude penalty; represents the second penalty coefficient; Represents all distributions from real data Samples sampled from Find the mathematical expectation; Represents the gradient operator, specifically the partial derivative of the real data of the input variable; Represents the discriminator network for real data The confidence score of the output; Represents real data; Represents the square of the Euclidean distance; the expression of the forward calculation process of the BiFA-LSTM predictor is: ; ;in, represents the forward hidden state, which refers to the hidden state vector generated by the Bi-LSTM when processing the forward sequence at time point t. This vector contains the historical information from the beginning of the sequence to the current time point t; t represents the time point variable; Reverse hidden state refers to the hidden state vector generated by the bidirectional LSTM network when processing the reverse sequence at time point t. This vector contains the future information from the end of the sequence to the current time point t. Indicates BiLSTM processing; represents the real data at time point t; Represents the predicted data at time point t; MLP stands for Multi-Layer Perceptron, a feedforward neural network, which is used here as the final output layer and is responsible for mapping the feature vector processed by the attention mechanism into the final predicted value; "Attn" represents the vector concatenation operation, which refers to concatenating the forward hidden state vector and the reverse hidden state vector along the feature dimension into a longer feature vector containing bidirectional context information. "Attn" represents the attention mechanism, which specifically refers to a feature-aligned attention calculation process that identifies and focuses on the most important time steps for the prediction task by performing a weighted summation on the hidden state sequence, thereby capturing key contextual information.

[0008] Furthermore, the input of the generator network is a latent vector, and the output is a generated time series; the input of the discriminator network is a real time series or a generated time series, and the output is a discriminant score; the input of the BiFA-LSTM predictor is a time series window, and the output is a predicted value; the predicted value indicates whether the future time series is abnormal.

[0009] Furthermore, the loss function for local training of the generator network is expressed as: ;in, represents the mixed loss function; represents the generator loss weight; It means fighting against loss; represents the reconstruction loss; represents a real time series; represents the discriminant score of the generated time series; Indicates the generation of time series; represents the Euclidean distance (L2 norm); the loss function for local training of the discriminator network is expressed as: ;in, represents the loss function including double regularization; Represents the distribution of all generated data from The generated time series sampled from the client c Find the mathematical expectation; Represents the time series generated by the discriminator network for client c The confidence score of the output; Represents all distributions from real data Find the mathematical expectation of the real samples sampled from client c; Represents the confidence score of the discriminator network for the true sample output of client c; Represents the penalty coefficient hyperparameter of the interpolation gradient penalty term (GP); Indicates the mathematical expectation of all interpolation samples from client c; Represents the gradient operator, specifically the partial derivative of the interpolated sample; represents the confidence score of the discriminator network for the interpolated sample output of client c; Represents the penalty coefficient hyperparameter of the input gradient magnitude penalty term (IGMP); It means to find the mathematical expectation of all real samples sampled from the real data distribution and belonging to client c; Represents the gradient operator, specifically the partial derivative of the real sample; represents the Euclidean distance (L2 norm); represents the square of the Euclidean distance; the loss function for local training of the BiFA-LSTM predictor is expressed as: ;in, represents the MSE loss; Represents the true value of the next time series; Represents the predicted value of the next time series.

[0010] Furthermore, a dynamic fusion anomaly score is obtained, including: determining a reconstruction error based on the real data and the generated data; determining a discrimination error based on the discrimination score of the generated data; determining a prediction error based on the real data and the predicted data; and dynamically fusing the reconstruction error, the discrimination error, and the prediction error to obtain a dynamic fusion anomaly score.

[0011] Furthermore, the expression of the reconstruction error is: ; The expression of discrimination error is: ; The expression of prediction error is: ; The expression of dynamic fusion anomaly score is: ;in, represents the reconstruction error; represents the real data at time point t; represents the generated data at time point t; represents the discrimination error; represents the discriminant score of the generated data at time point t; Forecast error; represents the predicted data at time point t; Denotes the dynamic fusion abnormality score.

[0012] Furthermore, it also includes: comparing the dynamic fusion anomaly score with a preset score threshold; when the dynamic fusion anomaly score is greater than the preset frequency threshold, the local system determines that an anomaly exists; when the dynamic fusion anomaly score is less than or equal to the preset frequency threshold, the local system determines that it is normal.

[0013] Furthermore, the expression for aggregating multiple local model parameters is: ;in, represents the global model parameters at the k+1th iteration; Indicates the total number of local clients; c indicates the local client variable; represents the local model parameters at the kth iteration.

[0014] The present invention has the following advantages and beneficial effects: 1. Improved detection accuracy and robustness: Through dual regularization constraints and a multi-error fusion mechanism, the model's ability to identify complex time series anomaly patterns is significantly enhanced, achieving more reliable detection results in various data distribution scenarios, surpassing the baseline performance of existing federated learning frameworks. 2. Enhanced privacy protection: Adopting a federated learning paradigm, the system ensures that the original data remains on the local client throughout the entire process. Collaborative training is achieved only through encrypted parameter interaction, meeting the strict compliance requirements for data privacy in fields such as healthcare and finance. 3. Noise immunity: The innovatively designed Input Gradient Magnitude Penalty (IGMP) effectively suppresses the discriminator's sensitivity to local noise, reduces misjudgments caused by data perturbations, and improves the model's practicality in high-noise scenarios such as industrial sensors.

[0015] 4. Optimized time series modeling capabilities: The Temporal Convolutional Self-Attention (TCSA) module combines local feature extraction with long-range dependency capture to address the inadequacy of traditional methods in modeling sudden and gradual anomalies, and enhances the ability to express multi-dimensional time series correlation features.

[0016] 5. Computing and Deployment Efficiency: Through lightweight module design and parallel training mechanisms, the resource usage of edge devices is reduced, supporting real-time inference on low-computing terminals (such as IoT devices), meeting the low-latency requirements of scenarios such as industrial monitoring.

[0017] 6. Multi-scenario adaptability: The framework supports flexible adjustment of error fusion weights, optimizing detection strategies for diverse scenarios such as financial transaction fraud, medical device failures, and industrial sensor anomalies, demonstrating its potential for cross-domain generalization. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 An exemplary schematic diagram of a multi-error fusion mechanism provided by an embodiment of the present invention; Figure 2 An exemplary structural diagram of a TCSA module provided in an embodiment of the present invention; Figure 3 An exemplary flowchart of federated training provided for an embodiment of the present invention. DETAILED DESCRIPTION

[0019] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions of the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings herein can be arranged and designed in various different configurations.

[0020] The proposed method for time series anomaly detection with federated dual-regularized multi-error fusion includes a federated dual-regularized Wasserstein GAN and multi-error fusion framework (FedDR-MEF), which contains the following core modules: Double Regularized Discriminator (DWGAN): Interpolated Gradient Penalty (GP): imposes a 1-Lipschitz constraint on the convex combination of real samples and generated samples to ensure stable gradient propagation; Input Gradient Magnitude Penalty (IGMP): limits the discriminator’s sensitivity to perturbations within the true data manifold and suppresses noise interference.

[0021] Temporal Convolutional Self-Attention Module (TCSA): The generator combines 1D convolution (to extract local features) with multi-head self-attention (to capture long-range dependencies) to enhance temporal modeling capabilities.

[0022] BiFA-LSTM predictor: Bidirectional LSTM combined with feature alignment attention mechanism improves time series prediction accuracy; The residual connection fuses the original LSTM output with the attention-weighted features to preserve the contextual information.

[0023] Multi-error fusion mechanism: Synthesized generator reconstruction error ( ), discriminator confidence ( ), predictor error ( ), a unified anomaly score is generated by weighted summation.

[0024] The present invention proposes a federated double regularization multi-error fusion time series anomaly detection method, such as Figure 3 As shown, including the following: Step S1: Federated model initialization: the central server initializes the global model, obtains the global model parameters, and distributes the global model parameters to multiple local clients.

[0025] The server initializes the global model components, including the following core modules (structured as Figure 1 shown): 1. Generator Network: Input latent vector By pre-defined high-dimensional latent space (whose dimension is ) is sampled from the standard normal distribution, that is, in Denotes the dimension of the latent space. The generator network consists of a temporal convolutional self-attention module and a decoder. The temporal convolutional self-attention module consists of a parallel convolutional layer and a multi-head self-attention module. The decoder consists of multiple layers of temporal convolution.

[0026] The temporal convolutional self-attention module (TCSA) is introduced, and its structure is as follows Figure 2 As shown in Figure 2. TCSA consists of a 1D convolutional layer and a multi-head self-attention module in parallel. The expression of the temporal convolutional self-attention module is: ; in, It represents the attention feature vector obtained by the temporal convolution self-attention module processing the potential vector z; LayerNorm represents the normalization processing; Conv1D represents the extraction of local temporal features, and MultiHeadAttn represents the capture of global dependencies.

[0027] Then the latent vector is transformed into Decoding to Synthetic Timing , Represents a set of real numbers with dimensions T×M, where T represents the length of the time window and M represents the number of features.

[0028] 2. Discriminator network (double regularization adversarial discriminant module): receiving the real time series Or generate timing , integrated dual gradient regularization strategy, including interpolation gradient penalty (GP) and input gradient magnitude penalty (IGMP), c represents the local client variable, representing the client number.

[0029] Interpolation gradient penalty (GP) is used to constrain the discriminator to The gradient norm on , which is forced to satisfy 1-Lipschitz continuity, the expression of the interpolation gradient penalty is: ; Among them, GP represents interpolation gradient penalty; represents an interpolated sample, which is a data point artificially synthesized by linearly mixing a real data sample with a generated data sample; Is a hyperparameter, indicating the first penalty coefficient; Represents all possible interpolation samples Find the mathematical expectation; Represents the gradient operator, specifically the gradient of the input variable Find partial derivatives; Represents the discriminator network for interpolation samples The confidence score of the output; represents the Euclidean distance (L2 norm).

[0030] Input gradient magnitude penalty (IGMP) is used to suppress the discriminator’s bias towards real data. Gradient sensitivity, reducing noise interference, the expression of input gradient amplitude penalty is: ; Among them, IGMP represents gradient amplitude penalty; Is a hyperparameter, representing the second penalty coefficient; Represents all distributions from real data Find the mathematical expectation of the real samples sampled from the dataset; Represents the gradient operator, specifically the partial derivative of the input variable real data x; Represents the confidence score of the discriminator network output for the real data x; Represents real data; Represents the square of the Euclidean distance.

[0031] 3. BiFA-LSTM predictor: This includes bidirectional LSTM and feature alignment attention. The forward computation of the BiFA-LSTM predictor is expressed as: ; ; in, represents the forward hidden state, which refers to the hidden state vector generated by the Bi-LSTM when processing the forward sequence at time point t. This vector contains the historical information from the beginning of the sequence to the current time point t; t represents the time point variable; Reverse hidden state refers to the hidden state vector generated by the bidirectional LSTM network when processing the reverse sequence at time point t. This vector contains the future information from the end of the sequence to the current time point t. Indicates BiLSTM processing; represents the real data at time point t; Represents the predicted data at time point t; MLP stands for Multi-Layer Perceptron, a feedforward neural network, which is used here as the final output layer and is responsible for mapping the feature vector processed by the attention mechanism into the final predicted value; "Attn" represents the vector concatenation operation, which refers to concatenating the forward hidden state vector and the reverse hidden state vector along the feature dimension into a longer feature vector containing bidirectional context information. "Attn" represents the attention mechanism, which specifically refers to a feature-aligned attention calculation process that identifies and focuses on the most important time steps for the prediction task by performing a weighted summation on the hidden state sequence, thereby capturing key context information.

[0032] The learned weights and biases of the generator network, discriminator network, and BiFA-LSTM predictor in the central server are taken as global model parameters.

[0033] Step S2: Client local training: multiple local clients receive global model parameters respectively, and use local private data to perform local training to obtain local model parameters.

[0034] Each client performs the following training process on local private data: Generator training phase: The input of the generator network is the latent vector and the output is the generated time series. The generator synthesizes realistic time series through the latent representation while maintaining the ability to distinguish. Each client c directly inputs the latent vector It is obtained by sampling from the standard normal distribution, that is, in Represents the latent space dimension. The latent input encodes the implicit temporal changes and is used to generate time series The expression of the hybrid loss function for local training of the generator network is: ; in, represents the mixed loss function; represents the generator loss weight, ; It means fighting against loss; represents the reconstruction loss; represents the real time series, i.e., the real value of the local sample in the local client (real time series); Represents the discriminant score of the generated time series (generated samples); Represents generating a time series (generating samples); Represents the square of the Euclidean distance.

[0035] Discriminator training phase: The input of the discriminator network is the real time series or the generated time series, and the output is the discriminant score.

[0036] 1. For real samples and generate samples Calculate the discriminant score and .

[0037] 2. Optimize the loss function including double regularization. The loss function expression for local training of the discriminator network is: ; in, represents Wassersteinadversarial loss; represents GP loss; Indicates IGMP loss; represents the loss function including double regularization; Represents the distribution of all generated data from Find the mathematical expectation of the generated samples sampled in and belonging to client c; Represents the time series generated by the discriminator network for client c The confidence score of the output; Represents all distributions from real data Find the mathematical expectation of the real samples sampled from client c; represents the confidence score of the real sample output by the discriminator network for client c; is the first penalty coefficient, which represents the penalty coefficient hyperparameter of the interpolation gradient penalty term (GP); Indicates the mathematical expectation of all interpolation samples from client c; represents the gradient operator, specifically the partial derivative of the interpolated sample of client c; represents the confidence score of the discriminator network for the interpolated sample output of client c; is the second penalty coefficient, which represents the penalty coefficient hyperparameter of the input gradient magnitude penalty term (IGMP); Represents all distributions from real data Find the mathematical expectation of the real samples sampled from client c; represents the gradient operator, specifically the partial derivative of the real sample of client c; represents the Euclidean distance; Represents the square of the Euclidean distance.

[0038] The generator and discriminator form a double-regularized adversarial network.

[0039] Predictor training phase: The input of the BiFA-LSTM predictor is the time series window, and the output is the predicted value; the predicted value indicates whether the future time series is abnormal.

[0040] 1. Input a time series window of length T To BiFA-LSTM. Among them, 1 and T both represent different time variable indices in the time series window. 1 represents the first time point in the x-th time series window, T represents the T-th time point in the x-th time series window, and 1:T represents the time points in the time series window x from the first 1 time point to the T-th time point. For example, assuming the window length T = 100, the current processing may be the 101st to 200th data points, which can be recorded as .

[0041] 2. Output the predicted value for the next moment Calculate the MSE loss: ; in, represents the MSE loss; Represents the true value of the next time series; Represents the predicted value of the next time series.

[0042] The learned weights and biases of the generator network, discriminator network and BiFA-LSTM predictor trained locally are used as local model parameters.

[0043] Step S3: Multi-error fusion detection: The local client performs multi-error fusion detection on the local server based on the corresponding local model parameters to obtain a dynamic fusion anomaly score.

[0044] 1. Real-time calculation of three types of error signals: Based on the real data and the generated data, the reconstruction error is determined. The expression of the reconstruction error is: ; Based on the discriminant score of the generated data, the discrimination error is determined. The expression of the discrimination error is: ; Based on the actual data and the predicted data, the prediction error is determined. The expression of the prediction error is: ; in, represents the reconstruction error; represents the real data at time point t; represents the generated data at time point t; represents the discrimination error; represents the discriminant score of the generated data at time point t; Forecast error; Represents the predicted data at time point t.

[0045] 2. Dynamically fuse the reconstruction error, discrimination error, and prediction error to obtain a dynamic fusion anomaly score. The expression of the dynamic fusion anomaly score is: ; in, represents the dynamic fusion abnormality score; Represents the square of the Euclidean distance. The weight coefficient is determined by grid search optimization on the validation set; the weight coefficient can also be other coefficients, which can also be determined by grid search optimization on the validation set.

[0046] Reconstruction error, discrimination error, and prediction error together form a comprehensive judgment system for abnormal events. Their core role is to improve the accuracy and robustness of anomaly detection. Specifically, reconstruction error excels at detecting "pattern anomalies," where data points do not conform to the learned normal data distribution. Discrimination error excels at detecting "distribution anomalies," where data points appear to the discriminator to be sampled from a true healthy data distribution. Prediction error excels at detecting "behavioral anomalies," where the appearance of data points disrupts the normal evolution of the time series.

[0047] These three errors improve the robustness of the detection system: a single error metric may be insensitive to certain types of anomalies, resulting in missed detections. For example, some slowly changing, progressive anomalies may not cause significant reconstruction errors, but they can cause their temporal behavior to deviate from normal trajectory, thus being captured by the prediction error. By fusing three complementary error signals, the present invention can effectively address a wider range of more complex anomaly types, avoiding the limitations of a single metric.

[0048] By weighted summing these three independent error signals, we can fuse them into a unified anomaly score. This can generate a more reliable basis for final decision-making, making this comprehensive score more stable and reliable than any single error. It can effectively reduce false alarms caused by data noise or single model defects, providing a more reliable basis for the final decision on whether to trigger an alarm. The dynamic fusion anomaly score is compared with the preset score threshold. When the dynamic fusion anomaly score is greater than the preset frequency threshold, the local system determines that an anomaly exists. When the dynamic fusion anomaly score is less than or equal to the preset frequency threshold, the local system determines that the situation is normal.

[0049] Step S4: federated parameter aggregation: the central server receives local model parameters sent back by multiple local clients, and aggregates the multiple local model parameters to obtain new global model parameters.

[0050] 1. The server collects the model parameters uploaded by the client in each round ; Model parameters can include parameters of the generator network (Generator) , parameters of the discriminator network (Discriminator) and the parameters of the BiFA-LSTM predictor network (Predictor) ,Right now, .

[0051] 2. Perform FedAvg aggregation. The expression for aggregating multiple local model parameters is: ; in, represents the global model parameters at the k+1th iteration; Indicates the total number of local clients; c indicates the local client variable; represents the local model parameters at the kth iteration.

[0052] Step S5: Obtain optimal global model parameters. Based on the new global model parameters, repeat steps S2 to S4 to obtain multiple new local model parameters until the global model converges and the optimal global model parameters are obtained; distribute the optimal global model parameters to multiple local clients.

[0053] Determine whether the global model has converged (validation loss decreases by <1% for three consecutive rounds). If not, repeat steps S2-S4. Finally, deploy the optimal model from the validation set for online testing.

[0054] Technical features: 1. The generator and discriminator form a dual-regularized adversarial network. The generator uses TCSA to generate synthetic data to deceive the discriminator. The discriminator uses GP+IGMP to improve robustness and negatively constrain the generator. Through adversarial training, the two achieve a dynamic balance, allowing the generator to gradually approach the real data distribution.

[0055] 2. Double regularized discriminator: through formula The GP constraint generates a continuous distribution, the formula IGMP suppresses the sensitivity of real data disturbances and improves noise robustness 3.TCSA generation module: using Figure 2 The "convolution + self-attention" parallel structure shown above captures local patterns and global temporal dependencies simultaneously. 4. The BiFA-LSTM predictor is a parallel component that is independent of the adversarial network and focuses on temporal context modeling to provide prediction error signals.

[0056] 5. Dynamic error fusion: Set configurable weight coefficients to support adjustment of detection sensitivity according to different scenarios (such as γ, increasing γ can enhance the ability to capture sudden anomalies) Example 1 Taking the industrial equipment fault diagnosis application case as an example, the application of the present invention in the online fault diagnosis of a large server cluster is described: To make the objectives, technical solutions, and advantages of the present invention more clear, the technical solutions of the present invention are described in detail below. It should be understood that the following specific embodiments are only part of the embodiments of the present invention, and not all of them. This example is intended to illustrate in detail how the system and method described in the present invention can be applied to a fault diagnosis scenario of a real industrial-grade device—a server cluster in a large data center.

[0057] 1. Scenario Description Diagnostic object: A large cloud data center consisting of hundreds of servers. Each server is an independent operating entity, but their health status collectively determines the stability and service quality of the entire cluster.

[0058] Data source: The monitoring system of each server continuously collects multi-dimensional real-time performance indicators (Multivariate Time Series), a time series containing 38 dimensional features, such as CPU usage, memory usage, disk I / O, network throughput, number of processes, etc. Represented by , where c is the client (server) number, T is the time series length, and M is the number of features.

[0059] Diagnostic goal: Without transferring sensitive operating data from each server outside the local area, collaboratively train a high-precision fault detection model to identify early-stage faults such as memory leaks, disk I / O anomalies, and network attacks.

[0060] 2. System and method implementation process This embodiment strictly follows the technical solution proposed in the present invention, and the specific process is as follows: Step S1: Federated Model Initialization The central management platform of the data center serves as the server and is responsible for initializing the global anomaly detection model. This model consists of three core components: a double-regularized Wasserstein GAN (DWGAN) module, a bidirectional feature alignment long short-term memory network (BiFA-LSTM) predictor module, and a multi-error fusion module. The server initializes the global model parameters of these three components. , and distribute these parameters through the network broadcast to the server cluster (client) designated to participate in the training.

[0061] Step S2: Client Local Training Each server acts as a client and, after receiving the global model parameters, uses its locally stored private performance indicator data to perform model training. The local training process performs the following two core tasks in parallel: Adversarial training of DWGAN: Generator: It integrates a temporal convolutional self-attention (TCSA) module. The TCSA module captures the local, short-term dependency characteristics of performance indicators through a one-dimensional (1D) convolutional layer, while capturing the global, long-range temporal correlation through a multi-head self-attention mechanism. The goal of the generator is to learn the data distribution of the local server in a healthy state and generate highly realistic synthetic time series data. .

[0062] Discriminator: A dual regularization strategy is employed to improve training stability and robustness. First, an interpolated gradient penalty (GP) is employed to impose a 1-Lipschitz constraint on the interpolation between real and generated samples, ensuring the stability of the training process when aggregating models across different clients (where data is not independent and identically distributed). Second, the proposed input gradient magnitude penalty (IGMP) is employed. By limiting the discriminator's sensitivity to perturbations within the real data manifold, this strategy effectively suppresses the model's overreaction to normal system noise (such as sudden but legitimate CPU usage spikes), significantly reducing the false positive rate.

[0063] Supervised training of the BiFA-LSTM predictor: This module acts as a parallel forecasting component responsible for modeling the temporal context. It receives as input a sliding window of historical time steps (e.g., window size is 6) and makes a forecast for the last time step within the window.

[0064] It uses a bidirectional LSTM network to simultaneously capture the forward and reverse dependencies of the time series. Subsequently, the LSTM output is weighted through a feature-aligned attention mechanism, and the weighted features are fused with the original LSTM output using a residual connection. This structure retains rich contextual information and significantly improves the prediction accuracy of complex time series dynamics. The predictor minimizes the mean square error (MSE) loss function. Conduct training.

[0065] Step S3: Multi-error fusion and online detection After the model training converges and is deployed, the local model on each server can perform online anomaly detection on the real-time performance data stream. The detection process is as follows: Parallel calculation of three types of errors: For each new time point, the system synchronously calculates three independent error scores: Reconstruction error ( ): Through the generator to the current real data Perform reconstruction and calculate the Euclidean distance between the original value and the reconstructed value The reconstruction error is low for normal data and high for abnormal data.

[0066] Discrimination error ( ): The current real data Input the discriminator, whose score reflects the confidence that the data is "real healthy data". The discrimination error is defined as The discrimination error for normal data is low, while that for abnormal data is high.

[0067] Prediction error ( : Calculate the predicted value of the BiFA-LSTM predictor for the current data and the true value The mean square error between The prediction error for normal data is low, while that for abnormal data is high.

[0068] Dynamic fusion anomaly score: The three error signals are weighted and fused to generate a unified final anomaly score ( The weight coefficients can be determined based on experience or by optimization on the validation set. In this embodiment, the weights can be set to α=0.35, β=0.15, and γ=0.5, and the final anomaly score is: .

[0069] Abnormal judgment: The calculated Compare the score with the threshold. If the score exceeds the threshold, the current time point is marked as abnormal and the alarm mechanism is triggered.

[0070] Step S4: Federated Parameter Aggregation To achieve knowledge sharing and model co-evolution among clients, the system periodically performs federated aggregation: After completing one or more rounds of local training, each client server will use the locally trained model parameters For example, the weights of the discriminator and predictor are uploaded to the central server. During this process, any raw performance data is retained locally, ensuring data privacy.

[0071] After collecting parameter updates from multiple clients, the central server aggregates them using the FedAvg algorithm to generate a new generation of global model parameters with better performance. ; The central server distributes the aggregated new global model to each client again, and the client uses it to update its local model and enter the next round of local training. This process (S2-S4) is iterated until the performance of the global model converges.

[0072] The method described in this embodiment demonstrates excellent detection performance when applied to this type of server cluster fault diagnosis task. In a specific test environment, its anomaly detection F1 score reached 93.98, significantly outperforming existing technologies and demonstrating the significant benefits of this invention in terms of detection accuracy and robustness.

[0073] The above are merely preferred embodiments of the present invention and are not intended to limit the present invention. Those skilled in the art will readily appreciate that various modifications and variations of the present invention are possible. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present invention shall be included within the scope of protection of the present invention.

Claims

1. A federated dual-regularization multi-error fusion time series anomaly detection method, characterized by: include: Step S1: The central server initializes the global model, obtains the global model parameters, and distributes the global model parameters to multiple local clients; Step S2: Multiple local clients receive global model parameters respectively, and perform local training using local private data to obtain local model parameters; Step S3: The local client performs multi-error fusion detection on the local server based on the corresponding local model parameters to obtain a dynamic fusion anomaly score; Step S4: The central server receives the local model parameters sent back by the multiple local clients, and aggregates the multiple local model parameters to obtain new global model parameters; Step S5: Based on the new global model parameters, repeat steps S2 to S4 to obtain multiple new local model parameters until the global model converges and the optimal global model parameters are obtained; and distribute the optimal global model parameters to multiple local clients.

2. The method for time series anomaly detection using federated dual regularization and multiple error fusion according to claim 1, characterized in that: Both the global model and the local model include a generator network, a discriminator network, and a BiFA-LSTM predictor; Both global and local model parameters include the learned weights and biases of the generator network, discriminator network, and BiFA-LSTM predictor.

3. The method for detecting anomalies in time series using a federated dual-regularization multi-error fusion algorithm according to claim 2, wherein: The generator network includes a temporal convolutional self-attention module and a decoder; the temporal convolutional self-attention module includes a parallel convolution layer and a multi-head self-attention module; the decoder includes multiple layers of temporal convolution; The discriminator network integrates a dual gradient regularization strategy, including interpolation gradient penalty and input gradient magnitude penalty; The BiFA-LSTM predictor consists of a bidirectional LSTM with feature-aligned attention.

4. The method for detecting anomalies in time series using a federated dual-regularization multi-error fusion algorithm according to claim 3, wherein: The expression of the temporal convolution self-attention module is: ； in, Represents the attention feature vector obtained by the temporal convolution self-attention module processing the potential vector z; LayerNorm represents normalization processing; Conv1D represents the extraction of local temporal features, and MultiHeadAttn represents the capture of global dependencies; The expression of interpolation gradient penalty is: ； Among them, GP represents interpolation gradient penalty; represents the interpolation sample; represents the first penalty coefficient; Represents interpolation samples The mathematical expectation of represents the gradient operator associated with the interpolated sample; Denotes the discriminator network for interpolated samples The confidence score of the output; represents the Euclidean distance; The expression of the input gradient magnitude penalty is: ； Among them, IGMP represents gradient amplitude penalty; represents the second penalty coefficient; Indicates that from real data Samples drawn from a distribution The mathematical expectation of represents the gradient operator associated with the real data; Represents the discriminator network for real data The confidence score of the output; Represents real data; represents the square of the Euclidean distance; The expression of the forward calculation process of the BiFA-LSTM predictor is: ； ； in, represents the forward hidden state; t represents the time point variable; represents the reverse hidden state; Indicates BiLSTM processing; represents the real data at time point t; Represents the predicted data at time point t; MLP represents multi-layer perceptron; Represents the vector concatenation operation; Attn represents the attention mechanism.

5. The method for detecting anomalies in time series using a federated dual-regularization multi-error fusion algorithm according to claim 2, wherein: The input of the generator network is a potential vector and the output is a generated time series; The input of the discriminator network is a real time series or a generated time series, and the output is a discriminant score; The input of the BiFA-LSTM predictor is a time series window, and the output is a predicted value; the predicted value is used to compare with the future true value to calculate the prediction error.

6. The method for detecting anomalies in time series using a federated dual-regularization multi-error fusion algorithm according to claim 5, wherein: The expression of the hybrid loss function for local training of the generator network is: ； in, represents the mixed loss function; represents the generator loss weight; It means fighting against loss; represents the reconstruction loss; represents a real time series; represents the discriminant score of the generated time series; Indicates the generation of time series; represents the square of the Euclidean distance; The loss function for local training of the discriminator network is expressed as: ； in, represents the loss function including double regularization; Represents the data distribution generated from The mathematical expectation of the generated samples belonging to client c sampled in; Represents the generated data distribution; represents the confidence score of the discriminator network for the generated sample output by client c; Represents the distribution of real data The mathematical expectation of the real samples belonging to client c sampled in; Represents the real data distribution; Represents the confidence score of the discriminator network for the true sample output of client c; represents the first penalty coefficient; Represents the mathematical expectation of the interpolated sample synthesized by the real sample and the generated sample of client c; represents the gradient operator associated with the interpolation sample of client c; Represents the confidence score of the discriminator network for the true sample output of client c; represents the second penalty coefficient; represents the gradient operator associated with the real sample of client c; represents the L2 norm; represents the square of L2 norm; The loss function for local training of the BiFA-LSTM predictor is expressed as: ； in, represents the MSE loss; Represents the true value of the next time series; Represents the predicted value of the next time series.

7. The method for time series anomaly detection using federated dual regularization and multiple error fusion according to claim 1, characterized in that: Get a dynamic fusion abnormality score, including: Determine the reconstruction error based on the real data and the generated data; Determine the discrimination error based on the discrimination score of the generated data; Determine the forecast error based on the actual data and the forecast data; The reconstruction error, discrimination error and prediction error are dynamically fused to obtain a dynamic fusion anomaly score.

8. The method for time series anomaly detection using federated dual regularization and multiple error fusion according to claim 7, characterized in that: The expression of reconstruction error is: ； The expression of discrimination error is: ； The expression of prediction error is: ； The expression of dynamic fusion anomaly score is: ； in, represents the reconstruction error; represents the real data at time point t; represents the generated data at time point t; represents the discrimination error; represents the discriminant score of the generated data at time point t; Forecast error; represents the predicted data at time point t; represents the dynamic fusion abnormality score; Represents the square of the Euclidean distance.

9. The method for time series anomaly detection using federated dual regularization and multiple error fusion according to claim 7, wherein: Also includes: Comparing the dynamic fusion anomaly score with a preset score threshold; When the dynamic fusion anomaly score is greater than the preset frequency score threshold, the local system determines that an anomaly exists; When the dynamic fusion anomaly score is less than or equal to the preset frequency score threshold, the local system is considered normal.

10. The method for time series anomaly detection using federated dual regularization and multiple error fusion according to claim 1, characterized in that: The expression for aggregating multiple local model parameters is: ； in, represents the global model parameters at the k+1th iteration; Indicates the total number of local clients; c indicates the local client variable; represents the local model parameters at the kth iteration.

Images