Time series data anomaly detection method, device and equipment

Abstract

The invention provides a time series data anomaly detection method, device and equipment, and belongs to the field of data processing. The method comprises the following steps: mapping target time sequence data to a potential space through a preset encoder to obtain an initial potential variable; performing fuzzy reasoning on the initial potential variable to obtain a target potential variable and a membership degree of the initial potential variable in a target category, wherein the target category indicates a normal data category or an abnormal data category; obtaining generation data corresponding to the target potential variable according to the target potential variable and a preset generator; obtaining a judgment score according to the generated data and a preset discriminator, wherein the preset discriminator is used for judging whether the generated data is real data or not; and obtaining a target score according to the target time sequence data, the generation data, the membership degree and the judgment score, wherein the target score is used for indicating whether the target time sequence data is abnormal or not. The accuracy of abnormal data judgment and the generalization ability of the model are improved.

Description

Technical Field

[0001] The present invention relates to a method, device and apparatus for detecting anomalies in time series data. Background Art

[0002] In complex data environments, anomaly detection has important applications in areas such as financial fraud detection, industrial equipment failure prediction, and network security intrusion detection. Time series data is highly complex and diverse, and abnormal behavior can stem from a variety of factors. Furthermore, time series data anomalies often exhibit distinct patterns and appear alternately in network environments, increasing the difficulty of detection. Due to the diversity and variability of abnormal behavior, labeling anomalous samples is often an expensive and time-consuming process. Furthermore, in many time series data anomaly detection tasks, normal and abnormal behavior can share similar characteristics, especially in complex network environments. Therefore, effectively distinguishing normal fluctuations from true abnormal behavior remains a challenge that needs to be addressed.

[0003] Currently, deep learning models used for time series anomaly detection are prone to overfitting, especially when there are few data samples or high noise, which may lead to insufficient generalization ability of the model in practical applications. Summary of the Invention

[0004] The present application provides a time series data anomaly detection method, apparatus and equipment to overcome problems such as high noise, data scarcity, and abnormal behavior diversity in time series data anomaly detection, so as to improve the accuracy of abnormal data judgment and the generalization ability of the model.

[0005] This application provides a time series data anomaly detection method, including: The target time series data is mapped to the latent space through a preset encoder to obtain the initial latent variables; Performing fuzzy inference on the initial latent variables to obtain target latent variables and the membership of the initial latent variables in a target category, wherein the target category indicates a normal data category or an abnormal data category; Acquire generated data corresponding to the target latent variable according to the target latent variable and a preset generator; Obtaining a judgment score based on the generated data and a preset discriminator, wherein the preset discriminator is used to determine whether the generated data is real data; A target score is obtained according to the target time series data, the generated data, the membership degree, and the judgment score, where the target score is used to indicate whether the target time series data has an abnormality.

[0006] According to the time series data anomaly detection method provided in the present application, the target score is obtained based on the target time series data, the generated data, the membership and the judgment score, including: obtaining a reconstruction error based on the generated data and the target time series data; obtaining a fuzzy membership penalty based on the membership; and obtaining a target score based on the judgment score, the reconstruction error and the fuzzy membership penalty.

[0007] According to the time series data anomaly detection method provided by the present application, the preset encoder is trained based on the following method: obtaining sample input data; mapping the sample input data to the latent space through the pre-trained encoder to obtain the distribution function of the sample initial latent variable and the sample generation data corresponding to the sample initial latent variable; obtaining the sample reconstruction error based on the sample generation data and the sample input data; determining the KL divergence based on the distribution function; determining the target entropy value of the distribution function of the sample initial latent variable; obtaining the entropy regularization constraint function based on the target entropy value; obtaining the loss function of the pre-trained encoder based on the sample reconstruction error, the KL divergence and the regularization constraint function; training the pre-trained encoder based on the loss function of the pre-trained encoder to obtain a preset encoder.

[0008] According to the time series data anomaly detection method provided by the present application, the fuzzy inference of the initial latent variable to obtain the target latent variable and the membership of the initial latent variable in the target category includes: obtaining a first distance between the initial latent variable and the normal sample and a second distance between the initial latent variable and the abnormal sample; obtaining a fuzziness parameter, wherein the fuzziness parameter is associated with the output value of the preset discriminator; determining a first true value membership of the initial latent variable in the normal sample based on the fuzziness parameter and the first distance, the true value membership being used to indicate the degree of proximity between the initial latent variable and the category to which the sample belongs; determining a second true value membership of the initial latent variable in the abnormal sample based on the fuzziness parameter and the second distance; obtaining a first false value membership based on the first true value membership, the false value membership being used to indicate the degree of distance between the initial latent variable and the category to which the sample belongs; obtaining a second false value membership based on the second true value membership; and obtaining the target latent variable and the membership of the initial latent variable in the target category based on the first true value membership, the second true value membership, the first false value membership, and the second false value membership.

[0009] According to the time series data anomaly detection method provided by the present application, the target latent variable and the membership of the initial latent variable in the target category are obtained according to the first true value membership, the second true value membership, the first false value membership and the second false value membership, including: obtaining the forward weight and reverse weight of each preset rule; determining the true value activation value of each preset rule according to the first true value membership, the second true value membership and the forward weight; determining the false value activation value of each preset rule according to the first false value membership, the second false value membership and the reverse weight; determining the membership of the initial latent variable in the target category according to the true value activation value and the false value activation value; weighting and processing the true value activation values ​​and false value activation values ​​of all preset rules and normalizing them respectively to obtain target true value activation value and target false value activation value; obtaining the target latent variable according to the target true value activation value and the target false value activation value.

[0010] According to the time series data anomaly detection method provided by the present application, the target latent variable is obtained according to the target true value activation value and the target false value activation value, including: obtaining the true value output value and the false value output value of each preset rule; obtaining the true value part of the initial latent variable according to the target true value activation value and the true value output value; obtaining the false value part of the latent variable according to the target false value activation value and the false value output value; and obtaining the target latent variable according to the true value part, the false value part and the initial latent variable.

[0011] According to the time series data anomaly detection method provided in the present application, the preset discriminator is trained based on the following method: obtaining sample interpolation data based on the sample generation data and the sample input data; obtaining a first output result of the pre-trained discriminator for the sample interpolation data; obtaining a second output result of the pre-trained discriminator for the sample generation data; determining a dual gradient penalty value based on the first output result, the second output result and the sample reconstruction error; obtaining a first expected value of the pre-trained discriminator for the sample input data and a second expected value for the sample generation data; obtaining a loss function of the pre-trained discriminator based on the dual gradient penalty value, the first expected value and the second expected value; training the pre-trained discriminator according to the loss function of the pre-trained discriminator to obtain a preset discriminator.

[0012] According to the time series data anomaly detection method provided in the present application, the target time series data is mapped to the latent space through a trained variational autoencoder to obtain initial latent variables and generated data corresponding to the initial latent variables, including: mapping the target time series data to the latent space through a trained variational autoencoder to obtain initial latent variables; inputting the initial latent variables into a preset generator to obtain generated data, the preset generator is constructed based on a time series convolutional network, and the activation function in the deep residual block of the preset generator is an ELU activation function.

[0013] The present application also provides a time series data anomaly detection device, comprising: A mapping unit, configured to map the target time series data to a latent space through a preset encoder to obtain an initial latent variable; an inference unit, configured to perform fuzzy inference on the initial latent variables to obtain a target latent variable and a degree of membership of the initial latent variable in a target category, wherein the target category indicates a normal data category or an abnormal data category; A first acquisition unit, configured to acquire generated data corresponding to the target latent variable according to the target latent variable and a preset generator; a judgment unit, configured to obtain a judgment score based on the generated data and a trained discriminator, wherein the discriminator is configured to judge whether the generated data is real data; The second acquisition unit is used to acquire a target score according to the target time series data, the generated data, the membership degree and the judgment score, where the target score is used to indicate whether the target time series data has an abnormality.

[0014] The present application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, any of the above-mentioned time series data anomaly detection methods is implemented.

[0015] The present application also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements any of the above-mentioned time series data anomaly detection methods.

[0016] The present application also provides a computer program product, including a computer program, which implements any of the above-mentioned time series data anomaly detection methods when executed by a processor.

[0017] The time series data anomaly detection method, device and equipment provided in the present application first maps the target time series data to the latent space through a preset encoder to obtain an initial latent variable, then performs fuzzy inference on the initial latent variable to obtain the target latent variable and the membership of the initial latent variable in the target category, the target category indicates a normal data category or an abnormal data category, then obtains the generated data corresponding to the target latent variable based on the target latent variable and a preset generator, then obtains a judgment score based on the generated data and a preset discriminator, the preset discriminator is used to judge whether the generated data is real data, finally obtains a target score based on the target time series data, the generated data, the membership and the judgment score, and the target score is used to indicate whether the target time series data has an anomaly.

[0018] This solution leverages the latent space optimization capabilities of VAEs and the adversarial learning mechanism of GANs to more effectively capture subtle differences between normal and abnormal data and enhance the model's detection of unknown anomalies. Furthermore, a fuzzy inference module is introduced, utilizing membership calculations to flexibly model the fuzzy boundary between normal and abnormal samples, thereby improving the accuracy of anomaly detection. Ultimately, the model comprehensively evaluates the anomaly score of a data sample by calculating the discriminator output, the membership values ​​calculated by the fuzzy inference module, and the resulting reconstruction error, thereby achieving anomaly detection. This approach overcomes challenges such as high noise, data scarcity, and the diversity of abnormal behavior in time series data anomaly detection, improving the accuracy of anomaly detection and enhancing the model's generalization capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions in the present invention or the prior art, a brief introduction is given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0020] Figure 1 This is a flowchart of a time series data anomaly detection method provided by this application.

[0021] Figure 2 This is a structural diagram of an anomaly detection network provided by this application.

[0022] Figure 3 This is a block diagram of the functional units of a time series data anomaly detection device provided by this application.

[0023] Figure 4 It is a structural diagram of the electronic device provided in this application. DETAILED DESCRIPTION

[0024] To make the objectives, technical solutions, and advantages of the present invention more clear, the technical solutions of the present invention will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the embodiments described are only some of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0025] The terms "first," "second," and the like in the specification and claims of this application and the accompanying drawings are used to distinguish between different objects, not to describe a particular order. Furthermore, the terms "including," "having," and any variations thereof, are intended to cover non-exclusive inclusions. For example, a process, method, system, product, or apparatus comprising a series of steps or elements is not limited to the listed steps or elements but may optionally include steps or elements not listed, or may optionally include other steps or elements inherent to the process, method, product, or apparatus.

[0026] References herein to "embodiments" mean that a particular feature, structure, or characteristic described in connection with the embodiments may be included in at least one embodiment of the present application. The appearance of this phrase in various places in the specification does not necessarily refer to the same embodiment, nor does it constitute an independent or alternative embodiment that is mutually exclusive of other embodiments. It is understood, both explicitly and implicitly, by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0027] Currently, deep learning models used for time series anomaly detection are prone to overfitting, especially when there are few data samples or high noise, which may lead to insufficient generalization ability of the model in practical applications.

[0028] To address the above issues, this application provides a method, device, and apparatus for detecting anomalies in time series data. Figure 1 ,The time series data anomaly detection method includes the following steps.

[0029] S101, mapping the target time series data to the latent space through a preset encoder to obtain initial latent variables.

[0030] The preset encoder can be a variational autoencoder (VAE). The encoder maps input data (X) to a latent space, obtaining a latent variable (z), typically by modeling the probability distribution of the input data. The goal of the encoder is to find a latent representation of the input data.

[0031] S102: Perform fuzzy reasoning on the initial latent variable to obtain a target latent variable and the degree of membership of the initial latent variable in a target category.

[0032] The target category indicates a normal data category or an abnormal data category. When determining the membership of the initial latent variable in the target category, the initial latent variable's membership in each target category can be determined first, and the category with the highest membership can be determined as the target category. When performing fuzzy inference, the following steps can be included: first, determining the membership values ​​of the initial latent variable in normal samples and abnormal samples; then, performing fuzzy rule inference based on the membership values ​​to obtain an output inference result; and finally, defuzzifying the inference result and converting it into a precise value, thereby obtaining a target latent vector.

[0033] S103: Acquire generated data corresponding to the target latent variable according to the target latent variable and a preset generator.

[0034] This solution uses a hybrid model that combines VAEs and generative adversarial networks (GANs), namely the VAE-GAN model. This model aims to combine the strengths of VAEs in latent space learning with the strengths of GANs in generating data quality, thereby generating higher-quality samples. The VAE-GAN architecture combines the structures of VAEs and GANs and consists of three main components: The encoder is responsible for compressing input data (such as images) into a latent space distribution (typically a Gaussian distribution). Through the encoder, the input data (x) is mapped to a latent space distribution (q(z|x)). The decoder (the pre-set generator) generates data from samples in the latent space (the latent vector (z) sampled from (q(z|x))), that is, reconstructing data (X') from the latent variables (z). The decoder attempts to transform the latent space representation back into generated samples that are similar to the input data (x). The discriminator is the GAN component responsible for distinguishing generated data from real data. By judging the generated data, the discriminator guides the generator to improve its generation process.

[0035] S104: Obtain a judgment score based on the generated data and a preset discriminator.

[0036] The preset discriminator is used to determine whether the generated data is real data. The discriminator can use a bidirectional gated recurrent unit (GRU) to model time series features.

[0037] S105 , obtaining a target score according to the target time series data, the generated data, the membership degree, and the judgment score.

[0038] The target score is used to indicate whether the target time series data is abnormal.

[0039] As can be seen, in this embodiment, the latent space optimization capabilities of VAE and the adversarial learning mechanism of GAN are used to more effectively capture the subtle differences between normal and abnormal data and enhance the model's detection of unknown anomalies. At the same time, the fuzzy inference module is introduced, and membership calculation is used to flexibly model the fuzzy boundary between normal and abnormal samples to improve the accuracy of anomaly determination. Ultimately, the model comprehensively evaluates the anomaly score of the data sample by calculating the discriminator output, the membership value calculated by the fuzzy inference module, and the generated reconstruction error, thereby achieving anomaly detection. This can overcome problems such as high noise, data scarcity, and the diversity of abnormal behavior in time series data anomaly detection, improve the accuracy of anomaly determination, and enhance the generalization ability of the model.

[0040] In a possible instance, obtaining a target score based on the target time series data, the generated data, the membership and the judgment score includes: obtaining a reconstruction error based on the generated data and the target time series data; obtaining a fuzzy membership penalty based on the membership; and obtaining a target score based on the judgment score, the reconstruction error and the fuzzy membership penalty.

[0041] Among them, when calculating the target score, the GAN discriminator score can be calculated separately: Here, G(X) represents the data generated by the generator, that is, the above-mentioned decoder.

[0042] Calculate the fuzzy membership penalty: Among them, μ true is the membership of the initial latent variable in the target category.

[0043] Calculate the VAE reconstruction error: Where X is the target time series data and X' is the generated data.

[0044] Then calculate the final anomaly score: Among them, w1, w2 and w3 are the weights of the discriminator score, fuzzy membership penalty and reconstruction error respectively.

[0045] It can be seen that in this embodiment, the model comprehensively evaluates the anomaly score of the data sample by calculating the discriminator output, the membership value calculated by the fuzzy reasoning module, and the generated reconstruction error, thereby realizing anomaly detection.

[0046] In one possible embodiment, the preset encoder is trained based on the following method: obtaining sample input data; mapping the sample input data to a latent space through a pre-trained encoder to obtain a distribution function of the sample initial latent variable and sample generation data corresponding to the sample initial latent variable; obtaining a sample reconstruction error based on the sample generation data and the sample input data; determining the KL divergence based on the distribution function; determining a target entropy value of the distribution function of the sample initial latent variable; obtaining an entropy regularization constraint function based on the target entropy value; obtaining a loss function of the pre-trained encoder based on the sample reconstruction error, the KL divergence and the regularization constraint function; training the pre-trained encoder based on the loss function of the pre-trained encoder to obtain a preset encoder.

[0047] Among them, the VAE encoder is used to map the input data to the latent space to achieve efficient data representation and reconstruction. First, through the encoder Calculate the mean of the latent variable z and standard deviation , then resample the latent variable z ,in Normal distribution .

[0048] VAE measures the difference between sample input data X and sample generated data through reconstruction loss The difference between them, the sample reconstruction error is calculated by the following formula: The KL divergence is used to ensure that the latent variable z follows a normal distribution. The specific formula is: Where p(z) is the prior distribution that the latent variable is expected to obey.

[0049] Due to the constraints of KL divergence, the distribution of the latent space of traditional VAE is usually too smooth, which may cause abnormal samples to be incorrectly projected into the distribution area of ​​normal samples, thus affecting the accuracy of anomaly detection. Entropy regularization encourages high entropy of the latent distribution and increases the degree of freedom of the latent space, so that the model can adapt to complex data distribution more flexibly. , the target entropy is defined as: In order to optimize the entropy regularization of VAE, this scheme does not directly use the negative entropy term Instead of optimizing, a nonlinear constraint function is designed To perform the soft constraint of entropy regularization, the entropy regularization constraint function calculation formula is as follows: Finally, the loss function of VAE is as follows: in, 、 and Control the weights of reconstruction error, KL divergence regularization, and entropy regularization respectively.

[0050] It can be seen that in this embodiment, the VAE encoder maps the input data to the latent space, and at the same time, through entropy regularization, encourages high entropy of the latent distribution to increase the degrees of freedom of the latent space, so that the model can adapt to complex data distribution more flexibly.

[0051] In a possible embodiment, performing fuzzy inference on the initial latent variable to obtain the target latent variable and the membership of the initial latent variable in the target category includes: obtaining a first distance between the initial latent variable and a normal sample and a second distance between the initial latent variable and the abnormal sample; obtaining a fuzziness parameter, wherein the fuzziness parameter is associated with an output value of the preset discriminator; determining a first true value membership of the initial latent variable in the normal sample based on the fuzziness parameter and the first distance, the true value membership being used to indicate the degree of proximity between the initial latent variable and the category to which the sample belongs; determining a second true value membership of the initial latent variable in the abnormal sample based on the fuzziness parameter and the second distance; obtaining a first false value membership based on the first true value membership, the false value membership being used to indicate the degree of distance between the initial latent variable and the category to which the sample belongs; obtaining a second false value membership based on the second true value membership; and obtaining the membership of the target latent variable and the initial latent variable in the target category based on the first true value membership, the second true value membership, the first false value membership, and the second false value membership.

[0052] First, for each initial latent variable , the true membership and false membership are calculated based on the distance from normal samples and abnormal samples. The true membership function is used to measure the degree of membership of a sample in a certain category, that is, how close the sample is to the category; while the false membership function measures how far away the sample is from a certain category.

[0053] Initial latent variables The calculation formula of the first true value membership in normal samples is as follows: Initial latent variables The calculation formula for the second true value membership of abnormal samples is as follows: The false membership indicates the possibility that the sample does not belong to a certain category by calculation.

[0054] Initial latent variables The calculation formula for the first false value membership in normal samples is as follows: Initial latent variables The calculation formula for the second false value membership of abnormal samples is as follows: To accommodate differences in sample generation quality and dynamically adjust the strictness of the membership function, a fuzziness parameter is used in the formula. This parameter is directly affected by the GAN discriminator output and is used to adjust the flexibility of the membership function. When the discriminator output is close to 1, it indicates that the generated sample quality is high, and in this case, a stricter membership function is desired, that is, the fuzziness is reduced, thereby lowering the value; when the discriminator output is close to 0, it indicates that the generated sample quality is low, and in this case, a looser membership function is desired, that is, the fuzziness is increased, thereby increasing the value. The dynamic adjustment formula for fuzziness is: is the minimum fuzzy value, is the initial fuzziness, which represents the minimum fuzziness of the membership function, is a hyperparameter that controls how much the blur changes.

[0055] It can be seen that in this embodiment, by using both true value membership and false value membership, the fuzzy reasoning module can more flexibly capture the complex attribution relationship of samples, rather than simply classifying samples as normal or abnormal. This continuous probability can better adapt to the processing of fuzzy boundary samples in anomaly detection.

[0056] In a possible embodiment, obtaining the target latent variable and the membership of the initial latent variable in the target category based on the first true value membership, the second true value membership, the first false value membership and the second false value membership includes: obtaining the forward weight and the reverse weight of each preset rule; determining the true value activation value of each preset rule based on the first true value membership, the second true value membership and the forward weight; determining the false value activation value of each preset rule based on the first false value membership, the second false value membership and the reverse weight; determining the membership of the initial latent variable in the target category based on the true value activation value and the false value activation value; performing weighted sum processing and normalization processing on the true value activation values ​​and false value activation values ​​of all preset rules respectively to obtain target true value activation value and target false value activation value; obtaining the target latent variable based on the target true value activation value and the target false value activation value.

[0057] Among them, the rule layer can automatically learn and weight the output of each rule through a neural network. The weight of the rule is adjusted through the network training process, thereby affecting the final reasoning result.

[0058] Each implicit rule The activation value is calculated based on the membership of the input sample, and the forward weight of the implicit rule is and reverse They represent the positive contribution of the rule to the normal category and the negative contribution to the abnormal category respectively.

[0059] The true activation value of each rule is calculated as: The false activation value for each rule is calculated as: Among them, t(A1) and t(A2) are the true value membership of the fuzzy sets A1 and A2 corresponding to the input samples, respectively. and are the false value memberships of the fuzzy sets A1 and A2 corresponding to the input samples. In a specific implementation, the fuzzy sets A1 and A2 can indicate the normal sample category and the abnormal sample category, respectively.

[0060] Then the true value activation values ​​and false value activation values ​​of all rules are weighted and normalized separately: The target ground truth activation value is calculated as follows: The target false activation value is calculated as follows: The true activation value indicates the degree to which the rule supports the target category, while the false activation value indicates the degree to which the rule opposes the target category. This mechanism allows the rule layer to consider both supporting and opposing evidence during the reasoning process.

[0061] The calculation formula for the membership of the initial latent variable in the normal category is: The calculation formula for the membership of the initial latent variable in the abnormal category is: It can be seen that in this embodiment, through the membership calculation and dynamic adjustment mechanism, the module quantifies the degree to which samples belong to normal and abnormal categories based on fuzzy set theory, and realizes flexible modeling of fuzzy boundary samples.

[0062] In a possible embodiment, obtaining the target latent variable based on the target true value activation value and the target false value activation value includes: obtaining the true value output value and the false value output value of each preset rule; obtaining the true value part of the initial latent variable based on the target true value activation value and the true value output value; obtaining the false value part of the latent variable based on the target false value activation value and the false value output value; and obtaining the target latent variable based on the true value part, the false value part, and the initial latent variable.

[0063] The main goal of the defuzzification layer is to fuse the output information of the fuzzy rule layer and convert it into a clear non-fuzzified result. The specific calculation part can be expressed as: z t and z f represent the true and false parts of the latent variables, respectively. and Represents the true value output and false value output of rule j. The true value and false value parts of the generated latent variable are concatenated with the original latent variable to generate the final target latent variable .

[0064] It can be seen that in this embodiment, the target latent variable is obtained based on the false value part, the true value part and the original latent variable, and a more accurate input value can be obtained through fuzzy processing.

[0065] In a possible embodiment, the preset discriminator is trained based on the following method: obtaining sample interpolation data based on the sample generation data and the sample input data; obtaining a first output result of the pre-trained discriminator for the sample interpolation data; obtaining a second output result of the pre-trained discriminator for the sample generation data; determining a dual gradient penalty value based on the first output result, the second output result and the sample reconstruction error; obtaining a first expected value of the pre-trained discriminator for the sample input data and a second expected value for the sample generation data; obtaining a loss function of the pre-trained discriminator based on the dual gradient penalty value, the first expected value and the second expected value; training the pre-trained discriminator based on the loss function of the pre-trained discriminator to obtain a preset discriminator.

[0066] To improve training stability, a gradient penalty mechanism was introduced. The core idea of ​​gradient penalty is to penalize the discriminator's gradient on interpolated data to ensure that the discriminator's gradient meets the Lipschitz continuity condition. Lipschitz continuity requires that the discriminator's gradient cannot be too large during training, otherwise it may lead to training instability or gradient explosion.

[0067] To achieve this, the data can be interpolated Calculate the gradient and regularize it. The interpolation data is obtained by and generate data The weighted sum is obtained, that is: in, Uniform distribution , ensuring that the interpolated data is evenly distributed between the real data and the generated data.

[0068] In this scheme, the gradient of the discriminator in the data space and the gradient of the generator in the latent space are regularized to improve the training stability. The gradient penalty term is defined as follows: in: in, is the first output result, is the second output result, is the first expected value, is the second expected value, is a hyperparameter.

[0069] On the basis of the standard discriminator loss, a dual gradient penalty term is added, and the final discriminator loss function is defined as follows: in, is a hyperparameter used to control the strength of the dual gradient penalty term.

[0070] As can be seen, this embodiment uses a gradient penalty mechanism to ensure training stability and discriminative power, preventing gradient explosion or vanishing. Not only does it impose a gradient penalty on the discriminator, but it also imposes constraints on the generator to prevent mode collapse. When sample reconstruction errors are large, the constraints on the generator are reduced, allowing it to more freely generate anomalous samples.

[0071] In a possible example, the preset generator is constructed based on a temporal convolutional network, and the activation function in the deep residual block of the preset generator is an ELU activation function.

[0072] Among them, such as Figure 2As shown, the preset generator is built on a Temporal Convolutional Network (TCN) and incorporates a residual block design to achieve efficient time series modeling. In the TCN's convolution operation, the preset generator uses the ELU activation function to address the neuron "death" issue caused by the traditional ReLU activation function. While simple and efficient, the ReLU always outputs 0 for negative inputs, which results in a zero gradient, preventing neuron updates and potentially causing some neurons to "die."

[0073] Therefore, in the deep residual block, replacing the ReLU activation function with the ELU activation function can avoid neuron death. The ELU function retains non-zero output and gradient in the negative region, avoiding the problem of neuron death and improving the network's ability to express negative features. The calculation formula is: in, Can be set to 1 to control the degree of nonlinearity in the negative region.

[0074] In the original network, the features output by the Dropout layer are first processed through dilated causal convolution, followed by weight normalization and activation function. In the deep network, batch normalization and activation function are moved forward before the convolution operation. Before the features output by the Dropout layer enter the dilated causal convolution, their distribution is normalized. The formula is: Among them, z is the input feature, is the mean of the current batch features, is the variance of the current batch feature, is a small constant that prevents the denominator from being zero. Since the data distribution of time series usually has large dynamic changes, the design of batch normalization in advance helps to reduce the uncertainty of feature distribution, thereby providing more consistent input for convolution operations.

[0075] It can be seen that in this embodiment, through the improved temporal convolutional network, the multi-scale time series features are captured by dilated causal convolution, and the residual block is combined to optimize the gradient transfer, thereby improving the generator's modeling ability for long-term dependent time series data.

[0076] The following describes this solution in detail with reference to specific examples.

[0077] In enterprise networks or data centers, attackers may attempt to invade servers or disrupt network services through port scanning, DDoS (Distributed Denial of Service) attacks, abnormal traffic, and other means. Traditional threshold- or rule-based detection methods are prone to false positives or false negatives. Therefore, we aim to utilize a fuzzy-based VAE-GAN network time series anomaly detection model for intelligent anomaly detection.

[0078] First, obtain network traffic data, whose data characteristics are as follows:

[0079] S1, then use the VAE encoder to map the network traffic data to the latent space to obtain the latent variable of normal traffic F1 , the latent variable of abnormal traffic F2 , the latent variable of normal flow F3 .

[0080] Traditional VAE may make the latent space too smooth, causing abnormal traffic to be projected into the normal traffic area, leading to misjudgment. Entropy regularization increases the degrees of freedom of the latent variables. First, VAE calculates the entropy : Entropy of normal traffic , entropy of abnormal traffic Adding a negative entropy term to the VAE loss function makes the abnormal traffic distribution more discrete and improves the discrimination.

[0081] S2. Assume that the center of normal traffic in the latent space is , the center of abnormal traffic is First, calculate the distance to normal traffic and abnormal traffic: Then calculate the true membership: Calculate false membership: Then set the assumption rules and perform weight calculation to obtain the R1 weight: , the R2 weight is So the final support of the abnormal category is: S3. Input target latent variables , then generate samples through the TCN improved generator, and then calculate the reconstruction error: Then calculate the GAN discriminator score , calculate the fuzzy membership penalty , the VAE reconstruction error is The comprehensive score is calculated as , assuming the weight .

[0082] The final score is higher, and F2 is judged as abnormal traffic.

[0083] It can be seen that since the boundary between normal samples and abnormal samples is not always clear, traditional binary classification methods are prone to misjudgment when processing boundary samples. The present invention calculates the membership of samples to normal and abnormal categories, so that the samples are no longer simply classified into two categories, but their ambiguity is represented by continuous values. In addition, the GAN generator and the discriminator work together to optimize anomaly detection. The generation architecture of TCN and residual blocks is adopted, and the ELU activation function is used to avoid neuron death. The discriminator uses a bidirectional GRU to model temporal features, and combines the gradient penalty mechanism to ensure training stability and prevent gradient explosion or disappearance.

[0084] By combining VAE and GAN, and leveraging the potential space optimization capabilities of VAE and the high-quality generation capabilities of GAN, it is possible to better capture the subtle differences between normal and abnormal data in anomaly detection and improve the model's ability to detect unknown anomalies. The fuzzy reasoning module uses membership calculation and a dynamic adjustment mechanism. Based on fuzzy set theory, this module quantifies the degree to which samples belong to normal and abnormal categories, achieving flexible modeling of fuzzy boundary samples. In addition, an improved temporal convolutional network is designed to capture multi-scale time series features through dilated causal convolution, while combining residual blocks to optimize gradient transfer, thereby improving the generator's ability to model long-term dependent time series data. This scheme demonstrates good anomaly detection performance and provides an efficient and flexible solution for anomaly detection in complex network environments.

[0085] The following describes a time series data anomaly detection device provided by the present application. The time series data anomaly detection device described below corresponds to the time series data anomaly detection method described above.

[0086] See also Figure 3The time series data anomaly detection device 300 includes: a mapping unit 301, which is used to map the target time series data to a latent space through a preset encoder to obtain an initial latent variable and generated data corresponding to the initial latent variable; an inference unit 302, which is used to perform fuzzy inference on the initial latent variable to obtain the target latent variable and the membership of the initial latent variable in a target category, where the target category indicates a normal data category or an abnormal data category; a first acquisition unit 303, which is used to obtain the generated data corresponding to the target latent variable according to the target latent variable and a preset generator; a judgment unit 304, which is used to obtain a judgment score according to the generated data and a trained discriminator, where the discriminator is used to judge whether the generated data is real data; a second acquisition unit 305, which is used to obtain a target score according to the target time series data, the generated data, the membership and the judgment score, where the target score is used to indicate whether the target time series data has an anomaly.

[0087] In a possible embodiment, in terms of obtaining the target score based on the target time series data, the generated data, the membership and the judgment score, the second acquisition unit 305 is specifically used to: obtain the reconstruction error based on the generated data and the target time series data; obtain the fuzzy membership penalty based on the membership; obtain the target score based on the judgment score, the reconstruction error and the fuzzy membership penalty.

[0088] In a possible embodiment, the time series data anomaly detection device 300 also includes a first training unit, which is used to: obtain sample input data; map the sample input data to a latent space through a pre-trained encoder to obtain a distribution function of the sample initial latent variable and sample generation data corresponding to the sample initial latent variable; obtain a sample reconstruction error based on the sample generation data and the sample input data; determine the KL divergence based on the distribution function; determine the target entropy value of the distribution function of the sample initial latent variable; obtain an entropy regularization constraint function based on the target entropy value; obtain the loss function of the pre-trained encoder based on the sample reconstruction error, the KL divergence and the regularization constraint function; train the pre-trained encoder based on the loss function of the pre-trained encoder to obtain a preset encoder.

[0089] In a possible embodiment, in performing fuzzy inference on the initial latent variable to obtain the target latent variable and the membership of the initial latent variable in the target category, the reasoning unit 302 is specifically used to: obtain a first distance between the initial latent variable and the normal sample and a second distance between the initial latent variable and the abnormal sample; obtain a fuzziness parameter, wherein the fuzziness parameter is associated with the output value of the preset discriminator; determine a first true value membership of the initial latent variable in the normal sample based on the fuzziness parameter and the first distance, the true value membership being used to indicate the degree of proximity between the initial latent variable and the category to which the sample belongs; determine a second true value membership of the initial latent variable in the abnormal sample based on the fuzziness parameter and the second distance; obtain a first false value membership based on the first true value membership, the false value membership being used to indicate the degree of distance between the initial latent variable and the category to which the sample belongs; obtain a second false value membership based on the second true value membership; and obtain the target latent variable and the membership of the initial latent variable in the target category based on the first true value membership, the second true value membership, the first false value membership, and the second false value membership.

[0090] In a possible embodiment, in terms of obtaining the target latent variable and the membership of the initial latent variable in the target category based on the first true value membership, the second true value membership, the first false value membership and the second false value membership, the reasoning unit 302 is specifically used to: obtain the forward weight and reverse weight of each preset rule; determine the true value activation value of each preset rule based on the first true value membership, the second true value membership and the forward weight; determine the false value activation value of each preset rule based on the first false value membership, the second false value membership and the reverse weight; determine the membership of the initial latent variable in the target category based on the true value activation value and the false value activation value; perform weighted sum processing and normalization processing on the true value activation values ​​and false value activation values ​​of all preset rules respectively to obtain target true value activation value and target false value activation value; and obtain the target latent variable based on the target true value activation value and the target false value activation value.

[0091] In one possible embodiment, in terms of obtaining the target latent variable based on the target true value activation value and the target false value activation value, the reasoning unit 302 is specifically used to: obtain the true value output value and the false value output value of each preset rule; obtain the true value part of the initial latent variable based on the target true value activation value and the true value output value; obtain the false value part of the latent variable based on the target false value activation value and the false value output value; obtain the target latent variable based on the true value part, the false value part and the initial latent variable.

[0092] In a possible embodiment, the time series data anomaly detection device 300 also includes a second training unit, which is used to: obtain sample interpolation data based on the sample generation data and the sample input data; obtain a first output result of the pre-trained discriminator for the sample interpolation data; obtain a second output result of the pre-trained discriminator for the sample generation data; determine a dual gradient penalty value based on the first output result, the second output result and the sample reconstruction error; obtain a first expected value of the pre-trained discriminator for the sample input data and a second expected value for the sample generation data; obtain a loss function of the pre-trained discriminator based on the dual gradient penalty value, the first expected value and the second expected value; train the pre-trained discriminator according to the loss function of the pre-trained discriminator to obtain a preset discriminator.

[0093] In a possible embodiment, the preset generator is constructed based on a temporal convolutional network, and the activation function in the deep residual block of the preset generator is an ELU activation function.

[0094] See also Figure 4 , Figure 4 This is a schematic diagram of the structure of the electronic device provided by this application. Figure 4 As shown, the electronic device may include: a processor 410, a communication interface 420, a memory 430, and a communication bus 440, wherein the processor 410, the communication interface 420, and the memory 430 communicate with each other via the communication bus 440. The processor 410 may call logic instructions in the memory 430 to execute a time series data anomaly detection method, which includes: mapping target time series data to a latent space using a preset encoder to obtain initial latent variables and generated data corresponding to the initial latent variables; performing fuzzy inference on the initial latent variables to obtain the target latent variables and the membership of the initial latent variables in a target category, wherein the target category indicates a normal data category or an abnormal data category; obtaining generated data corresponding to the target latent variables based on the target latent variables and a preset generator; obtaining a judgment score based on the generated data and a preset discriminator, wherein the preset discriminator is used to determine whether the generated data is real data; and obtaining a target score based on the target time series data, the generated data, the membership, and the judgment score, wherein the target score is used to indicate whether the target time series data is abnormal.

[0095] Furthermore, the logic instructions in the aforementioned memory 430 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the portion that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product, stored in a storage medium, includes instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, a mobile hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0096] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute the time series data anomaly detection method provided by the above-mentioned methods, the method comprising: mapping the target time series data to a latent space through a preset encoder to obtain an initial latent variable and generated data corresponding to the initial latent variable; performing fuzzy inference on the initial latent variable to obtain the target latent variable and the membership of the initial latent variable in a target category, wherein the target category indicates a normal data category or an abnormal data category; obtaining the generated data corresponding to the target latent variable based on the target latent variable and a preset generator; obtaining a judgment score based on the generated data and a preset discriminator, wherein the preset discriminator is used to judge whether the generated data is real data; obtaining a target score based on the target time series data, the generated data, the membership and the judgment score, wherein the target score is used to indicate whether the target time series data has an anomaly.

[0097] On the other hand, the present application also provides a computer program product, including a computer program, which, when executed by a processor, implements any of the above-mentioned time series data anomaly detection methods, the method including: mapping the target time series data to a latent space through a preset encoder to obtain an initial latent variable and generated data corresponding to the initial latent variable; performing fuzzy inference on the initial latent variable to obtain the target latent variable and the membership of the initial latent variable in a target category, wherein the target category indicates a normal data category or an abnormal data category; obtaining the generated data corresponding to the target latent variable based on the target latent variable and a preset generator; obtaining a judgment score based on the generated data and a preset discriminator, wherein the preset discriminator is used to judge whether the generated data is real data; obtaining a target score based on the target time series data, the generated data, the membership and the judgment score, wherein the target score is used to indicate whether the target time series data has an anomaly.

[0098] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e., they may be located in one location or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of the present embodiment. Persons of ordinary skill in the art will be able to understand and implement the present invention without inventive effort.

[0099] Through the above description of the embodiments, those skilled in the art will clearly understand that each embodiment can be implemented using software plus a necessary general-purpose hardware platform, or of course, hardware. Based on this understanding, the essence of the above technical solution, or the portion that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, or an optical disk, and includes a number of instructions for causing a computer device (such as a personal computer, server, or network device) to execute the methods described in each embodiment or certain portions of the embodiments.

[0100] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A time series data anomaly detection method, characterized in that: include: The target time series data is mapped to the latent space through a preset encoder to obtain the initial latent variables; Performing fuzzy inference on the initial latent variables to obtain target latent variables and the membership of the initial latent variables in a target category, wherein the target category indicates a normal data category or an abnormal data category; Acquire generated data corresponding to the target latent variable according to the target latent variable and a preset generator; Obtaining a judgment score based on the generated data and a preset discriminator, wherein the preset discriminator is used to determine whether the generated data is real data; A target score is obtained according to the target time series data, the generated data, the membership degree, and the judgment score, where the target score is used to indicate whether the target time series data has an abnormality.

2. The method according to claim 1, characterized in that The obtaining of a target score according to the target time series data, the generated data, the membership degree, and the judgment score includes: Obtaining a reconstruction error according to the generated data and the target time series data; Obtaining a fuzzy membership penalty according to the membership; A target score is obtained according to the judgment score, the reconstruction error and the fuzzy membership penalty.

3. The method according to claim 1, characterized in that The preset encoder is trained based on the following method: Get sample input data; Mapping the sample input data to the latent space through a pre-trained encoder to obtain a distribution function of the sample initial latent variables and the sample generated data corresponding to the sample initial latent variables; Obtaining a sample reconstruction error according to the sample generation data and the sample input data; determining the KL divergence based on the distribution function; Determining a target entropy value of a distribution function of an initial latent variable of the sample; Obtaining an entropy regularization constraint function according to the target entropy value; Obtaining a loss function of the pre-trained encoder according to the sample reconstruction error, the KL divergence and the regularization constraint function; The pre-trained encoder is trained according to the loss function of the pre-trained encoder to obtain a preset encoder.

4. The method according to claim 1, wherein The step of performing fuzzy reasoning on the initial latent variable to obtain the target latent variable and the degree of membership of the initial latent variable in the target category includes: Obtaining a first distance between the initial latent variable and a normal sample and a second distance between the abnormal sample; Obtaining a fuzziness parameter, wherein the fuzziness parameter is associated with an output value of the preset discriminator; Determining a first true value membership of the initial latent variable in the normal sample according to the fuzziness parameter and the first distance, where the true value membership is used to indicate how close the initial latent variable is to the category to which the sample belongs; Determining a second true value membership of the initial latent variable in the abnormal sample according to the fuzziness parameter and the second distance; Obtaining a first false value membership according to the first true value membership, where the false value membership is used to indicate the degree of distance between the initial latent variable and the category to which the sample belongs; Obtaining a second false value membership according to the second true value membership; The membership of the target latent variable and the initial latent variable in the target category is obtained according to the first true value membership, the second true value membership, the first false value membership, and the second false value membership.

5. The method according to claim 3, characterized in that The obtaining, according to the first true value membership, the second true value membership, the first false value membership, and the second false value membership, of the target latent variable and the initial latent variable in the target category includes: Get the forward weight and reverse weight of each preset rule; Determining a truth activation value of each preset rule according to the first truth membership, the second truth membership, and the forward weight; determining a false value activation value of each preset rule according to the first false value membership, the second false value membership and the reverse weight; Determining the membership of the initial latent variable in the target category according to the true value activation value and the false value activation value; The true value activation values ​​and false value activation values ​​of all preset rules are weighted and normalized to obtain the target true value activation value and target false value activation value; A target latent variable is obtained according to the target true value activation value and the target false value activation value.

6. The method according to claim 4, characterized in that The obtaining of a target latent variable according to the target true value activation value and the target false value activation value includes: Obtaining a true value output value and a false value output value of each preset rule; Obtaining a true value portion of the initial latent variable according to the target true value activation value and the true value output value; obtaining a false value portion of the latent variable according to the target false value activation value and the false value output value; A target latent variable is obtained according to the true value part, the false value part and the initial latent variable.

7. The method according to claim 3, characterized in that The preset discriminator is trained based on the following method: Acquire sample interpolation data according to the sample generation data and the sample input data; Obtaining a first output result of the pre-trained discriminator on the sample interpolation data; Obtaining a second output result of the pre-trained discriminator on the sample generated data; Determine a dual gradient penalty value according to the first output result, the second output result and the sample reconstruction error; Obtaining a first expected value of the pre-trained discriminator for the sample input data and a second expected value of the sample generated data; Obtaining a loss function of the pre-trained discriminator according to the dual gradient penalty value, the first expected value, and the second expected value; The pre-trained discriminator is trained according to the loss function of the pre-trained discriminator to obtain a preset discriminator.

8. The method according to claim 1, characterized in that The preset generator is constructed based on a temporal convolutional network, and the activation function in the deep residual block of the preset generator is an ELU activation function.

9. A time series data anomaly detection device, characterized in that: include: A mapping unit, configured to map the target time series data to a latent space through a preset encoder to obtain an initial latent variable; an inference unit, configured to perform fuzzy inference on the initial latent variables to obtain a target latent variable and a degree of membership of the initial latent variable in a target category, wherein the target category indicates a normal data category or an abnormal data category; A first acquisition unit, configured to acquire generated data corresponding to the target latent variable according to the target latent variable and a preset generator; a judgment unit, configured to obtain a judgment score based on the generated data and a trained discriminator, wherein the discriminator is configured to judge whether the generated data is real data; The second acquisition unit is used to acquire a target score according to the target time series data, the generated data, the membership degree and the judgment score, where the target score is used to indicate whether the target time series data has an abnormality.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that: When the processor executes the computer program, the time series data anomaly detection method according to any one of claims 1 to 8 is implemented.

Images