A federal double-regularization multi-error fusion time series anomaly detection method

Abstract

The application belongs to the field of artificial intelligence and relates to a federated double-regularization multi-error fusion time series anomaly detection method, which comprises the following steps: a central server initializes a global model, obtains global model parameters, and distributes the global model parameters to multiple local clients; the multiple local clients respectively receive the global model parameters and perform local training by using local private data to obtain local model parameters; the local clients respectively perform multi-error fusion detection based on the corresponding local model parameters on local servers to obtain dynamic fusion anomaly scores; the central server receives the local model parameters returned by the multiple local clients, aggregates the multiple local model parameters, and obtains new global model parameters; based on the new global model parameters, multiple new local model parameters are obtained until the global model converges, and optimal global model parameters are obtained; and the optimal global model parameters are distributed to the multiple local clients; and the detection precision and robustness are improved.

Description

TECHNICAL FIELD

[0001] The application relates to the field of artificial intelligence, and discloses a federated double-regularization multi-error fusion time series anomaly detection method. BACKGROUND

[0002] With the popularity of the Internet of Things and distributed computing, multivariate time series anomaly detection is increasingly important in industrial monitoring, financial risk control and other fields. Traditional centralized methods need to collect terminal data to the central server, which has a serious risk of privacy leakage. Although the existing federated learning scheme can protect data privacy, it still faces three technical bottlenecks when dealing with time series data: 1) gradient instability caused by non-independent and identically distributed data; 2) mode collapse problem in adversarial training; 3) excessive sensitivity to local noise. For example, the GAN-based method is unstable in the federated environment, and the LSTM prediction model is difficult to capture complex time series dependencies.

[0003] Therefore, the application provides a federated double-regularization multi-error fusion time series anomaly detection method, which combines a privacy protection type anomaly detection framework of double-regularization Wasserstein GAN and multi-error fusion mechanism, and is suitable for financial fraud monitoring, industrial equipment fault diagnosis, medical health monitoring and other scenes. SUMMARY

[0004] The application aims to provide a federated double-regularization multi-error fusion time series anomaly detection method, which solves the problems of instability of adversarial training caused by heterogeneity of client data in federated learning, insufficient modeling of complex dependencies in time series, sensitivity of the discriminator under noise interference, and limitations of a single detection index (such as reconstruction error); the specific scheme is as follows:

[0005] A federated double-regularization multi-error fusion time series anomaly detection method comprises the following steps: step S1: a central server initializes a global model to obtain global model parameters, and distributes the global model parameters to a plurality of local clients; step S2: the plurality of local clients respectively receive the global model parameters, and perform local training using local private data to obtain local model parameters; step S3: the local clients respectively perform multi-error fusion detection based on the corresponding local model parameters on the local servers to obtain dynamic fusion anomaly scores; step S4: the central server receives the local model parameters returned by the plurality of local clients, and aggregates the plurality of local model parameters to obtain new global model parameters; step S5: based on the new global model parameters, steps S2 to S4 are repeated to obtain a plurality of new local model parameters until the global model converges to obtain optimal global model parameters; and the optimal global model parameters are distributed to the plurality of local clients.

[0006] Further, the global model and the local model both comprise a generator network, a discriminator network and a BiFA-LSTM predictor; the global model parameters and the local model parameters both comprise learning weights and biases of the generator network, the discriminator network and the BiFA-LSTM predictor.

[0007] Further, the generator network comprises a temporal convolution self-attention module and a decoder; the temporal convolution self-attention module comprises a convolution layer and a multi-head self-attention module in parallel; the decoder comprises a multi-layer time convolution; the discriminator network integrates a double gradient regularization strategy, comprising an interpolation gradient penalty and an input gradient magnitude penalty; the BiFA-LSTM predictor comprises a bidirectional LSTM and a feature alignment attention.

[0008] Further, an expression of the temporal convolution self-attention module is as follows: ; wherein, represents that the temporal convolution self-attention module processes the latent vector z to obtain an attention feature vector; LayerNorm represents a normalization processing; Conv1D represents extracting local time sequence features, and MultiHeadAttn represents capturing global dependency relationships; an expression of the interpolation gradient penalty is as follows: ; wherein, GP represents the interpolation gradient penalty; represents an interpolation sample; represents a first penalty coefficient; represents that all possible interpolation samples mathematical expectation is calculated; represents a gradient operator, and is specifically a partial derivative with respect to an input variable derivative is calculated; represents that the discriminator network processes the interpolation sample outputs a confidence score; represents an Euclidean distance (L2 norm); an expression of the input gradient magnitude penalty is as follows: ; wherein, IGMP represents the gradient magnitude penalty; represents a second penalty coefficient; represents that all samples sampled from a real data distribution are processed; mathematical expectation is calculated; represents a gradient operator, and is specifically a partial derivative with respect to an input variable real data; represents that the discriminator network processes the real data outputs a confidence score; represents real data; represents a square of the Euclidean distance; an expression of a forward calculation process of the BiFA-LSTM predictor is as follows: ; ; wherein, denotes the forward hidden state, which refers to the hidden state vector generated by the Bi-LSTM when processing the forward sequence at time point t, and the vector contains the history information from the beginning of the sequence to the current time point t; t denotes the time point variable; denotes the backward hidden state, which refers to the hidden state vector generated by the Bi-LSTM when processing the backward sequence at time point t, and the vector contains the future information from the end of the sequence to the current time point t; denotes the BiLSTM processing; denotes the real data at time point t; denotes the predicted data at time point t; MLP denotes a multi-layer perceptron, which is a kind of feedforward neural network, and is used as the final output layer here, responsible for mapping the feature vector processed by the attention mechanism into the final prediction value; denotes the vector concatenation operation, which refers to connecting the forward hidden state vector and the backward hidden state vector along the feature dimension into a longer feature vector containing bidirectional context information; Attn denotes the attention mechanism: specifically refers to a feature alignment attention calculation process, which identifies and focuses on the most important time step for the prediction task by weighted summation of the hidden state sequence, so as to capture the key context information.

[0009] Further, the input of the generator network is a latent vector, and the output is a generated time sequence; the input of the discriminator network is a real time sequence or a generated time sequence, and the output is a discrimination score; the input of the BiFA-LSTM predictor is a time sequence window, and the output is a prediction value; the prediction value indicates whether the future time sequence is abnormal.

[0010] Further, the expression of the loss function for locally training the generator network is: ; wherein, denotes the hybrid loss function; denotes the generator loss weight; denotes the adversarial loss; denotes the reconstruction loss; denotes the real time sequence; denotes the discrimination score of the generated time sequence; denotes the generated time sequence; denotes the Euclidean distance (L2 norm); the expression of the loss function for locally training the discriminator network is: ; wherein, denotes the loss function containing double regularization; denotes the loss function containing double regularization; a sampled, generated time series belonging to client c a mathematical expectation; a confidence score output by the discriminator network for a generated time series of client c a confidence score output by the discriminator network for a real sample of client c a mathematical expectation; a mathematical expectation; a confidence score output by the discriminator network for an interpolated sample of client c a penalty coefficient hyperparameter of an interpolation gradient penalty term (GP) a mathematical expectation; a gradient operator, specifically a partial derivative with respect to an interpolated sample a confidence score output by the discriminator network for an interpolated sample of client c a penalty coefficient hyperparameter of an input gradient magnitude penalty term (IGMP) a mathematical expectation; a gradient operator, specifically a partial derivative with respect to a real sample a Euclidean distance (L2 norm) a square of a Euclidean distance; an expression of a loss function for local training of a BiFA-LSTM predictor is: ; wherein, a MSE loss a real value of a next time series a predicted value of a next time series

[0011] Further, a dynamic fusion anomaly score is obtained, including: determining a reconstruction error based on real data and generated data; determining a discrimination error based on a discrimination score of the generated data; determining a prediction error based on the real data and predicted data; and dynamically fusing the reconstruction error, the discrimination error and the prediction error to obtain the dynamic fusion anomaly score.

[0012] Further, an expression of the reconstruction error is: ; an expression of the discrimination error is: ; an expression of the prediction error is: ; and an expression of the dynamic fusion anomaly score is: ; wherein, a reconstruction error real data at a time point t generated data at a time point t a discrimination error a discriminative score representing the generated data at time point t; a prediction error; a predicted data at time point t; a dynamic fusion anomaly score.

[0013] Further, the method further comprises: comparing the dynamic fusion anomaly score with a preset score threshold; when the dynamic fusion anomaly score is greater than the preset score threshold, the local system determines that there is an anomaly; and when the dynamic fusion anomaly score is less than or equal to the preset score threshold, the local system determines that it is normal.

[0014] Further, the expression for aggregating the plurality of local model parameters is: wherein, represents the global model parameter of the k+1th iteration; represents the total number of local clients; c represents a local client variable; represents the local model parameter of the kth iteration.

[0015] The present application has the following advantages and beneficial effects:

[0016] 1. Improved detection accuracy and robustness: Through double regularization constraints and multi-error fusion mechanism, the recognition ability of the model for complex time series anomaly patterns is significantly enhanced, and more reliable detection results are achieved in various data distribution scenarios, which is better than the benchmark performance of existing federated learning frameworks.

[0017] 2. Strengthened privacy protection: The federated learning paradigm is adopted to ensure that the original data is kept on the local client throughout the process, and collaborative training is realized only through encrypted parameter interaction, meeting the strict compliance requirements of data privacy in medical, financial and other fields.

[0018] 3. Anti-noise interference ability: The innovative design of input gradient amplitude penalty (IGMP) effectively suppresses the sensitivity of the discriminator to local noise, reduces the misjudgment caused by data disturbance, and improves the practicability of the model in high-noise scenarios such as industrial sensors.

[0019] 4. Optimization of time series modeling capability: The time series convolution self-attention module (TCSA) integrates local feature extraction and long-range dependence capture, solving the problem of insufficient modeling of sudden and gradual anomalies in traditional methods, and enhancing the expression ability of multi-dimensional time series correlation features.

[0020] 5. Calculation and deployment efficiency: Through lightweight module design and parallel training mechanism, the resource occupation of edge devices is reduced, supporting real-time inference on low-power terminals such as Internet of Things devices, meeting the demand for low latency in industrial monitoring and other scenarios.

[0021] 6. Multi-scenario adaptability: The framework supports flexible adjustment of error fusion weights, which can optimize detection strategies for different scenarios such as financial transaction fraud, medical device failure, and industrial sensor anomalies, and has the potential for cross-domain generalization applications. BRIEF DESCRIPTION OF DRAWINGS

[0022] Figure 1 An exemplary schematic diagram of the multi-error fusion mechanism provided for the embodiments of the present application is shown in the following figure:

[0023] Figure 2 An exemplary structural diagram of the TCSA module provided for the embodiments of the present application is shown in the following figure:

[0024] Figure 3 An exemplary flowchart of federated training provided for the embodiments of the present application is shown in the following figure. DETAILED DESCRIPTION

[0025] To make the objectives, technical solutions, and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described below in conjunction with the accompanying drawings of the embodiments of the present application. Obviously, the described embodiments are some but not all of the embodiments of the present application. The components of the embodiments of the present application described and shown in the accompanying drawings herein can be arranged and designed in various different configurations.

[0026] The federated dual-regularization multi-error fusion time series anomaly detection method proposed in the present application includes a federated dual-regularization Wasserstein GAN and a multi-error fusion framework (FedDR-MEF), which contains the following core modules:

[0027] Dual-regularization discriminator (DWGAN):

[0028] Interpolation gradient penalty (GP): 1-Lipschitz constraint is imposed on the convex combination of real samples and generated samples to ensure stable gradient transmission;

[0029] Input gradient magnitude penalty (IGMP): limits the sensitivity of the discriminator to perturbations within the real data manifold, and suppresses noise interference.

[0030] Temporal convolution self-attention module (TCSA):

[0031] In the generator, 1D convolution (extracting local features) and multi-head self-attention (capturing long-range dependencies) are fused to enhance the time series modeling capability.

[0032] BiFA-LSTM predictor:

[0033] Bi-directional LSTM combined with feature alignment attention mechanism to improve time series prediction accuracy;

[0034] The residual connection fuses the original LSTM output with the attention-weighted features to preserve the contextual information.

[0035] Multi-error fusion mechanism:

[0036] Synthesized generator reconstruction error ( ), discriminator confidence ( ), predictor error ( ), a unified anomaly score is generated by weighted summation.

[0037] The present invention proposes a federated double regularization multi-error fusion time series anomaly detection method, such as Figure 3 As shown, including the following:

[0038] Step S1: Federated model initialization: the central server initializes the global model, obtains the global model parameters, and distributes the global model parameters to multiple local clients.

[0039] The server initializes the global model components, including the following core modules (structured as Figure 1 shown):

[0040] 1. Generator Network:

[0041] Input latent vector By pre-defined high-dimensional latent space (whose dimension is ) is sampled from the standard normal distribution, that is, in Denotes the dimension of the latent space. The generator network consists of a temporal convolutional self-attention module and a decoder. The temporal convolutional self-attention module consists of a parallel convolutional layer and a multi-head self-attention module. The decoder consists of multiple layers of temporal convolution.

[0042] The temporal convolutional self-attention module (TCSA) is introduced, and its structure is as follows Figure 2 As shown in Figure 2. TCSA consists of a 1D convolutional layer and a multi-head self-attention module in parallel. The expression of the temporal convolutional self-attention module is:

[0043] ;

[0044] in, It represents the attention feature vector obtained by the temporal convolution self-attention module processing the potential vector z; LayerNorm represents the normalization processing; Conv1D represents the extraction of local temporal features, and MultiHeadAttn represents the capture of global dependencies.

[0045] Then the latent vector is transformed into Decoding to synthetic timing , denotes a set of real numbers with dimension T x M, T denotes the length of the time window, and M denotes the number of features.

[0046] 2. Discriminator network (Dual Regularized Adversarial Discriminator Module): receives real time series or generated time series , integrates dual gradient regularization strategies, including interpolation gradient penalty (GP) and input gradient magnitude penalty (IGMP), c denotes a local client variable, representing the number of clients (Client).

[0047] Interpolation gradient penalty (GP) is used to constrain the gradient norm of the discriminator on interpolation samples , forcing to satisfy 1-Lipschitz continuity, the expression of interpolation gradient penalty is:

[0048] ;

[0049] where GP denotes the interpolation gradient penalty; denotes the interpolation sample, which is an artificially synthesized data point by linearly mixing a real data sample with a generated data sample; is a hyperparameter, denoting the first penalty coefficient; denotes the mathematical expectation of all possible interpolation samples ; denotes the gradient operator, specifically the partial derivative with respect to the input variable ; denotes the confidence score output by the discriminator network on the interpolation sample ; denotes the Euclidean distance (L2 norm).

[0050] Input gradient magnitude penalty (IGMP) is used to suppress the gradient sensitivity of the discriminator to real data , reducing noise interference, the expression of input gradient magnitude penalty is:

[0051] ;

[0052] where IGMP denotes the gradient magnitude penalty; is a hyperparameter, denoting the second penalty coefficient; denotes the mathematical expectation of all real samples sampled from the real data distribution ; denotes the gradient operator, specifically the partial derivative with respect to the input variable real data x; denotes the confidence score output by the discriminator network on the real data x; denotes the real data; denotes the square of the Euclidean distance.

[0053] 3. BiFA-LSTM predictor: including bidirectional LSTM and feature-aligned attention, the expression of the forward calculation process of the BiFA-LSTM predictor is as follows:

[0054] ;

[0055] ;

[0056] wherein, represents a forward hidden state, which refers to a hidden state vector generated by the bidirectional long short-term memory network (Bi-LSTM) when processing a forward sequence at a time point t, and the vector contains historical information from the beginning of the sequence to the current time point t; t represents a time point variable; represents a reverse hidden state, which refers to a hidden state vector generated by the bidirectional LSTM network when processing a reverse sequence at a time point t, and the vector contains future information from the end of the sequence to the current time point t; represents BiLSTM processing; represents real data at a time point t; represents predicted data at a time point t; MLP represents a multi-layer perceptron, which is a kind of feedforward neural network and is used as a final output layer here, responsible for mapping the feature vector processed by the attention mechanism into the final prediction value; represents a vector concatenation operation, which refers to connecting the forward hidden state vector and the reverse hidden state vector along the feature dimension into a longer feature vector containing bidirectional context information; Attn represents an attention mechanism, specifically a feature-aligned attention calculation process, which identifies and focuses on the most important time step for the prediction task by weighted summation of the hidden state sequence, so as to capture key context information.

[0057] The learning weights and biases of the generator network, the discriminator network and the BiFA-LSTM predictor in the central server are taken as global model parameters.

[0058] Step S2: local training of the client, a plurality of local clients respectively receive the global model parameters, and perform local training by using local private data to obtain local model parameters.

[0059] Each client performs the following training process on the local private data:

[0060] Generator training stage:

[0061] The input of the generator network is a latent vector and the output is a generated time series. The generator synthesizes realistic time series through the latent representation while maintaining discriminative ability. Each client c receives an input latent vector is sampled from a standard normal distribution, i.e. where denotes the latent space dimensionality. This latent input encodes the underlying temporal variation used to generate the time series The expression of the hybrid loss function for locally training the generator network is:

[0062] ;

[0063] where, denotes the hybrid loss function; denotes the generator loss weight, ; denotes the adversarial loss; denotes the reconstruction loss; denotes the real time series, i.e., the true value of the local sample in the local client (real time series); denotes the discriminative score of the generated time series (generated sample); denotes the generated time series (generated sample); denotes the squared Euclidean distance.

[0064] Discriminator training phase:

[0065] The input of the discriminator network is either a real time series or a generated time series and the output is a discriminative score.

[0066] 1. Compute the discriminative score for real samples and generated samples .

[0067] 2. Optimize the loss function containing dual regularization. The expression of the loss function for locally training the discriminator network is:

[0068] ;

[0069] where, denotes the Wasserstein adversarial loss; denotes the GP loss; denotes the IGMP loss; denotes the loss function containing dual regularization; denotes the mathematical expectation of all generated samples belonging to client c that are sampled from the generated data distribution . ​denotes the confidence score output by the discriminator network for a client c the confidence score output by the discriminator network for a real sample belonging to client c denotes the mathematical expectation over all real samples belonging to client c sampled from the real data distribution denotes the confidence score output by the discriminator network for a real sample belonging to client c denotes the confidence score output by the discriminator network for a real sample belonging to client c denotes the penalty coefficient hyperparameter of the interpolation gradient penalty term (GP) denotes the mathematical expectation over all interpolation samples of client c denotes the gradient operator, specifically the partial derivative with respect to an interpolation sample of client c denotes the confidence score output by the discriminator network for an interpolation sample of client c denotes the penalty coefficient hyperparameter of the input gradient magnitude penalty term (IGMP) denotes the mathematical expectation over all real samples belonging to client c sampled from the real data distribution denotes the confidence score output by the discriminator network for a real sample belonging to client c denotes the gradient operator, specifically the partial derivative with respect to a real sample of client c denotes the Euclidean distance denotes the square of the Euclidean distance

[0070] The generator and discriminator constitute a doubly regularized adversarial network.

[0071] Predictor training phase:

[0072] The input of the BiFA-LSTM predictor is a time series window, and the output is a prediction value; the prediction value indicates whether the future time series is abnormal.

[0073] 1. Input a time series window of length T to the BiFA-LSTM. Wherein 1 and T both represent different time variable indexes in the time series window, 1 represents the first time point in the xth time series window, T represents the Tth time point in the xth time series window, 1: T represents the time points of the time series window x from the first 1 time point to the Tth time point. For example, assuming that the window length T = 100, the current processing is likely to be the 101st to 200th data points, which can be denoted as .

[0074] 2. Output the prediction value at the next time point Calculate the MSE loss:

[0075] ;

[0076] wherein, denotes the MSE loss; a true value of the next time series; a predicted value of the next time series.

[0077] The learning weights and biases of the generator network, the discriminator network and the BiFA-LSTM predictor obtained through local training are taken as local model parameters.

[0078] Step S3: Multi-error fusion detection. The local client performs multi-error fusion detection based on the corresponding local model parameters in the local server to obtain a dynamic fusion anomaly score.

[0079] 1. Real-time calculation of three types of error signals:

[0080] Based on the real data and the generated data, a reconstruction error is determined, and the expression of the reconstruction error is:

[0081] ;

[0082] Based on the generated data, a discrimination score is determined, and the expression of the discrimination error is:

[0083] ;

[0084] Based on the real data and the predicted data, a prediction error is determined, and the expression of the prediction error is:

[0085] ;

[0086] wherein, represents the reconstruction error; represents the real data at the time point t; represents the generated data at the time point t; represents the discrimination error; represents the discrimination score of the generated data at the time point t; represents the prediction error; represents the predicted data at the time point t.

[0087] 2. Dynamic fusion of the reconstruction error, the discrimination error and the prediction error to obtain a dynamic fusion anomaly score, and the expression of the dynamic fusion anomaly score is:

[0088] ;

[0089] wherein, represents the dynamic fusion anomaly score; represents the square of the Euclidean distance. The weight coefficient is determined through grid search optimization in the validation set; the weight coefficient can also be other coefficients, which can be determined through grid search optimization in the validation set.

[0090] The reconstruction error, the discrimination error and the prediction error jointly constitute a comprehensive judgment system for abnormal events, and their core role is to improve the accuracy and robustness of anomaly detection. The specific roles include: the reconstruction error is good at finding "pattern anomalies", that is, data points do not conform to the learned normal data distribution pattern. The discrimination error is good at finding "distribution anomalies", that is, the data points do not look like they are sampled from the real healthy data distribution in the discriminator. The prediction error is good at finding "behavior anomalies", that is, the appearance of the data points disrupts the normal evolution rule of the time series.

[0091] The robustness of the detection system can be improved through the three errors: a single error indicator may not be sensitive to some types of anomalies, resulting in false negatives. For example, some slow-changing progressive anomalies may not cause a large reconstruction error, but their time series behavior deviates from the normal trajectory, so they are captured by the prediction error. By fusing the three complementary error signals, the present application can effectively deal with more diverse and complex anomaly types, avoiding the limitations of a single indicator.

[0092] By weighting and summing the three independent error signals, a unified anomaly score is fused A more reliable final decision basis can be generated so that the comprehensive score is more stable and reliable than any single error, which can effectively reduce false positives caused by data noise or single model defects, and provides a more reliable decision basis for whether to trigger an alarm. Compare the dynamically fused anomaly score with the preset score threshold; when the dynamically fused anomaly score is greater than the preset frequency division threshold, the local system judges that there is an anomaly; when the dynamically fused anomaly score is less than or equal to the preset frequency division threshold, the local system judges that it is normal.

[0093] Step S4: federated parameter aggregation, the central server receives the local model parameters returned by the plurality of local clients, and aggregates the plurality of local model parameters to obtain new global model parameters.

[0094] 1. The server collects the model parameters uploaded by the clients in each round The model parameters can include the parameters of the generator network (Generator) , the parameters of the discriminator network (Discriminator) , and the parameters of the BiFA-LSTM predictor network (Predictor) , that is, .

[0095] 2. Perform FedAvg aggregation, and the expression for aggregating the plurality of local model parameters is:

[0096] ;

[0097] wherein, denotes the global model parameters of the k+1th iteration; denotes the total number of local clients; c denotes the local client variable; denotes the local model parameters of the kth iteration.

[0098] Step S5: Obtain the optimal global model parameters, repeat steps S2 to S4 based on the new global model parameters to obtain a plurality of new local model parameters until the global model converges to obtain the optimal global model parameters; and distribute the optimal global model parameters to the plurality of local clients.

[0099] Determine whether the global model converges (the verification loss decreases by less than 1% for three consecutive rounds), and if not, repeat steps S2-S4. Finally, deploy the optimal model of the verification set to perform online detection.

[0100] Technical feature description:

[0101] 1. The generator and the discriminator constitute a double regularization adversarial network, the generator generates synthetic data through TCSA to deceive the discriminator; the discriminator improves the robustness through GP+IGMP and reversely constrains the generator. The two form a dynamic balance through adversarial training, and the generator gradually approaches the real data distribution.

[0102] 2. Double regularization discriminator: through the formula GP constraint to generate distribution continuity, formula IGMP suppresses the sensitivity of real data disturbance and improves noise robustness

[0103] 3. TCSA generation module: adopts the "convolution + self-attention" parallel structure shown in Figure 2 to synchronously capture local patterns and global temporal dependencies

[0104] 4. BiFA-LSTM predictor as a parallel component, independent of the adversarial network, focusing on temporal context modeling, and providing a prediction error signal.

[0105] 5. Dynamic error fusion: set a configurable weight coefficient to support adjusting the detection sensitivity according to different scenarios (such as γ, increasing γ can enhance the ability to capture burst-type anomalies)

[0106] Embodiment 1

[0107] Taking an industrial equipment fault diagnosis application case as an embodiment, the application of the application in online fault diagnosis of a large server cluster is described:

[0108] To make the objectives, technical solutions and advantages of the present application clearer, the technical solutions of the present application will be described in detail below. It should be understood that the following specific embodiments are only some of the embodiments of the present application, but not all the embodiments. The present embodiments aim to explain in detail how the system and method described in the present application are applied to the fault diagnosis scenario of a real industrial-grade device, a server cluster of a large data center.

[0109] 1. Scene description

[0110] Diagnosis object: a large cloud data center composed of hundreds of servers. Each server is an independent running entity, but their health status collectively determines the stability and service quality of the entire cluster.

[0111] Data source: the monitoring system of each server continuously collects multivariate real-time performance indicators (Multivariate Time Series), a time series containing 38 dimensional features, such as CPU usage, memory occupancy, disk I / O, network throughput, process number, etc. It is represented by a matrix , where c is the client (server) number, T is the time series length, and M is the number of features.

[0112] Diagnosis goal: without transmitting sensitive running data of each server out of the local, collaboratively train a high-precision fault detection model to identify early faults such as memory leaks, disk I / O abnormalities, network attacks, etc.

[0113] 2. System and method implementation process

[0114] The present embodiments strictly follow the technical solutions proposed in the present application, and the specific process is as follows:

[0115] Step S1: Federal model initialization The central management platform of the data center serves as the server side, responsible for initializing the global anomaly detection model. The model is composed of three core components: a double-regularized Wasserstein GAN (DWGAN) module, a bidirectional feature alignment long short-term memory network (BiFA-LSTM) predictor module, and a multi-error fusion module. The server side initializes the global model parameters of the three components , and broadcasts these parameters to the designated server cluster (client) participating in training through the network.

[0116] Step S2: Client local training Each server as a client, after receiving the global model parameters, uses its locally stored private performance indicator data to perform model training. The local training process performs the following two core tasks in parallel:

[0117] Adversarial training of DWGAN:

[0118] Generator: A temporal convolution self-attention (TCSA) module is integrated inside the generator. The TCSA module captures local, short-term dependency features through a one-dimensional (1D) convolution layer, and captures global, long-range temporal correlations through a multi-head self-attention mechanism. The goal of the generator is to learn the data distribution of the local server in a healthy state and generate highly realistic synthetic time series data .

[0119] Discriminator: A double regularization strategy is adopted to improve the stability and robustness of the training. First, an interpolation gradient penalty (GP) is used to impose a 1-Lipschitz constraint on the interpolation of real and generated samples, ensuring the stability of the training process when aggregating models across different clients (data is not independent and identically distributed). Second, an input gradient magnitude penalty (IGMP) proposed by the present application is used. This strategy limits the sensitivity of the discriminator to perturbations within the real data manifold, effectively suppressing the overreaction of the model to normal system noise (such as sudden but legitimate CPU usage spikes), thereby significantly reducing the false positive rate.

[0120] Supervised training of BiFA-LSTM predictor:

[0121] This module serves as a parallel prediction component responsible for modeling the temporal context. It receives a sliding window containing historical time steps (e.g., window size of 6) as input and predicts the last time step within the window.

[0122] It internally uses a bidirectional LSTM network to capture both forward and backward dependencies of the time series. Subsequently, a feature-aligned attention mechanism is used to weight the LSTM output, and a residual connection is used to fuse the attention-weighted features with the original LSTM output. This structure preserves rich contextual information, significantly improving the prediction accuracy of complex temporal dynamics. The predictor is trained by minimizing the mean squared error (MSE) loss function .

[0123] Step S3: Multi-error fusion and online detection When the model training converges and is deployed, the local model on each server can perform online anomaly detection on real-time performance data streams. The detection process is as follows:

[0124] Parallel computing three types of errors: for each new time point, the system synchronously calculates three independent error scores:

[0125] Reconstruction error (ReconErr) ): the Euclidean distance between the original value and the reconstructed value is calculated by reconstructing the current real data with the generator . The reconstruction error of normal data is low, and the abnormal data is high.

[0126] Discrimination error (DiscErr) ): the current real data is input into the discriminator, and its score reflects the confidence that the data is "real healthy data". The discrimination error is defined as . The discrimination error of normal data is low, and the abnormal data is high.

[0127] Prediction error (PredErr : the mean square error between the predicted value of the current data by the BiFA-LSTM predictor and the real value is calculated . The prediction error of normal data is low, and the abnormal data is high.

[0128] Dynamic fusion of abnormal score: the above three error signals are fused by weighting to generate a unified final abnormal score (Score ). The weight coefficient can be determined according to experience or optimized on the validation set. In this embodiment, the weight can be set as α=0.35, β=0.15, γ=0.5, and the final abnormal score is: .

[0129] Abnormality determination: compare the calculated with the threshold value. If the score exceeds the threshold value, the current time point is marked as abnormal, and the alarm mechanism is triggered.

[0130] Step S4: federated parameter aggregation To realize knowledge sharing and model co-evolution among clients, the system periodically performs federated aggregation:

[0131] After completing one or more rounds of local training, each client server uploads the locally trained model parameters , such as the weights of the discriminator and the predictor, to the central server. During this process, any original performance data is retained locally, ensuring the privacy and security of the data.

[0132] After collecting parameter updates from multiple clients, the central server aggregates them using the federated average (FedAvg) algorithm to generate new generation of global model parameters with better performance;

[0133] The central server distributes the aggregated new global model to each client again, the client updates the local model with it, and enters the next round of local training. This process (S2-S4) is iterated until the global model performance converges.

[0134] The method described in the embodiment shows excellent detection performance when applied to such server cluster fault diagnosis tasks. In a specific test environment, the F1 score of its anomaly detection can reach 93.98, which is significantly better than the prior art, proving that the application has significant beneficial effects in terms of detection accuracy and robustness.

[0135] The above is only a preferred embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application can have various modifications and changes. Any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. A federated dual-regularization multi-error fusion time series anomaly detection method, characterized by: include: Step S1: The central server initializes the global model, obtains the global model parameters, and distributes the global model parameters to multiple local clients; both the global model and the local model include a generator network, a discriminator network, and a BiFA-LSTM predictor; both the global model parameters and the local model parameters include the learning weights and biases of the generator network, the discriminator network, and the BiFA-LSTM predictor; the generator network includes a temporal convolutional self-attention module and a decoder; the temporal convolutional self-attention module includes a parallel convolution layer and a multi-head self-attention module; the decoder includes multi-layer temporal convolution; the discriminator network integrates a dual gradient regularization strategy, including interpolation gradient penalty and input gradient amplitude penalty; the BiFA-LSTM predictor includes a bidirectional LSTM and feature alignment attention; the expression of the interpolation gradient penalty is: ； Among them, GP represents interpolation gradient penalty; represents the interpolation sample; represents the first penalty coefficient; Represents interpolation samples The mathematical expectation of represents the gradient operator associated with the interpolated sample; Denotes the discriminator network for interpolated samples The confidence score of the output; represents the Euclidean distance; The expression of the input gradient magnitude penalty is: ； Among them, IGMP represents gradient amplitude penalty; represents the second penalty coefficient; Indicates that from real data Samples drawn from a distribution The mathematical expectation of represents the gradient operator associated with the real data; Represents the discriminator network for real data The confidence score of the output; Represents real data; represents the square of the Euclidean distance; Step S2: Multiple local clients receive global model parameters respectively, and perform local training using local private data to obtain local model parameters; Step S3: The local client performs multi-error fusion detection on the local server based on the corresponding local model parameters to obtain a dynamic fusion anomaly score, including: determining a reconstruction error based on the real data and the generated data; determining a discrimination error based on the discrimination score of the generated data; determining a prediction error based on the real data and the predicted data; and dynamically fusing the reconstruction error, the discrimination error, and the prediction error to obtain a dynamic fusion anomaly score. Step S4: The central server receives the local model parameters sent back by the multiple local clients, and aggregates the multiple local model parameters to obtain new global model parameters; Step S5: Based on the new global model parameters, repeat steps S2 to S4 to obtain multiple new local model parameters until the global model converges and the optimal global model parameters are obtained; and distribute the optimal global model parameters to multiple local clients.

2. The federated dual-regularization multi-error fusion time series anomaly detection method according to claim 1, characterized in that: The expression of the temporal convolution self-attention module is: ； in, Represents the attention feature vector obtained by the temporal convolution self-attention module processing the potential vector z; LayerNorm represents normalization processing; Conv1D represents the extraction of local temporal features, and MultiHeadAttn represents the capture of global dependencies; The expression of the forward calculation process of the BiFA-LSTM predictor is: ； ； in, represents the forward hidden state; t represents the time point variable; represents the reverse hidden state; Indicates BiLSTM processing; represents the real data at time point t; Represents the predicted data at time point t; MLP represents multi-layer perceptron; Represents the vector concatenation operation; Attn represents the attention mechanism.

3. The federated dual-regularization multi-error fusion time series anomaly detection method according to claim 1, characterized in that: The input of the generator network is a potential vector and the output is a generated time series; The input of the discriminator network is a real time series or a generated time series, and the output is a discriminant score; The input of the BiFA-LSTM predictor is a time series window, and the output is a predicted value; the predicted value is used to compare with the future true value to calculate the prediction error.

4. The method for detecting anomalies in time series using a federated dual-regularization multi-error fusion algorithm according to claim 3, wherein: The expression of the hybrid loss function for local training of the generator network is: in, represents the mixed loss function; represents the generator loss weight; It means fighting against loss; represents the reconstruction loss; represents a real time series; represents the discriminant score of the generated time series; Indicates the generation of time series; represents the square of the Euclidean distance; The loss function for local training of the discriminator network is expressed as: ； in, represents the loss function including double regularization; Represents the data distribution generated from The mathematical expectation of the generated samples belonging to client c sampled in; Represents the generated data distribution; represents the confidence score of the discriminator network for the generated sample output by client c; Represents the distribution of real data The mathematical expectation of the real samples belonging to client c sampled in; Represents the real data distribution; Represents the confidence score of the discriminator network for the true sample output of client c; represents the first penalty coefficient; Represents the mathematical expectation of the interpolated sample synthesized by the real sample and the generated sample of client c; represents the gradient operator associated with the interpolation sample of client c; Represents the confidence score of the discriminator network for the true sample output of client c; represents the second penalty coefficient; represents the gradient operator associated with the real sample of client c; represents the L2 norm; represents the square of L2 norm; The loss function for local training of the BiFA-LSTM predictor is expressed as: ； in, represents the MSE loss; Represents the true value of the next time series; Represents the predicted value of the next time series.

5. The method for time series anomaly detection using federated dual regularization and multiple error fusion according to claim 1, wherein: The expression of reconstruction error is: ； The expression of discrimination error is: ； The expression of prediction error is: ； The expression of dynamic fusion anomaly score is: ； in, represents the reconstruction error; represents the real data at time point t; represents the generated data at time point t; represents the discrimination error; represents the discriminant score of the generated data at time point t; Forecast error; represents the predicted data at time point t; represents the dynamic fusion abnormality score; Represents the square of the Euclidean distance.

6. The method for time series anomaly detection using federated dual regularization and multiple error fusion according to claim 1, characterized in that: Also includes: Comparing the dynamic fusion anomaly score with a preset score threshold; When the dynamic fusion anomaly score is greater than the preset frequency score threshold, the local system determines that an anomaly exists; When the dynamic fusion anomaly score is less than or equal to the preset frequency score threshold, the local system is considered normal.

7. The method for time series anomaly detection using federated dual regularization and multiple error fusion according to claim 1, characterized in that: The expression for aggregating multiple local model parameters is: ； in, represents the global model parameters at the k+1th iteration; Indicates the total number of local clients; c indicates the local client variable; represents the local model parameters at the kth iteration.

Images