Time series anomaly detection method based on multi-scale double-flow graph attention network

Abstract

The invention discloses a time sequence anomaly detection method based on a multi-scale double-flow graph attention network. The method comprises the steps of obtaining a to-be-processed multi-dimensional time sequence and preprocessing the to-be-processed multi-dimensional time sequence; features are extracted through a multi-scale feature extraction module, and mixed representation with rich time domain context information is formed; inputting the mixed representation into a double-flow heterogeneous graph attention feature mining module to obtain a new feature sum; splicing the features to obtain a spliced new feature; encoding the new features by using a long-short term memory network to generate a hidden representation sensitive to a time sequence; performing prediction and reconstruction through a full connection layer to obtain a prediction value of a future time point and a reconstruction sequence of a current window; further calculating according to the true value to obtain a prediction error and a reconstruction error; and finally, the abnormal score and an abnormal threshold value are judged to realize abnormal detection. According to the method, the reliability and the intelligent level of space-based network operation and maintenance are remarkably improved.

Description

Technical Field

[0001] The present disclosure belongs to the fields of artificial intelligence and signal processing technology, and particularly relates to a time series anomaly detection method based on a multi-scale dual-stream graph attention network. Background Art

[0002] As space-based information systems evolve toward cloud-edge collaborative architectures, satellite networks must process massive amounts of heterogeneous telemetry data (such as sensor logs, communication traffic, and attitude parameters). Traditional anomaly detection methods rely on manual rules or a single data modality, making them difficult to handle dynamic topologies, multi-source noise, and complex anomaly propagation. Existing technical shortcomings include: static graph models that cannot capture dynamic correlations between variables; single-scale feature extraction that is insufficiently sensitive to sudden anomalies and long-term drift; and isolated optimization of prediction and reconstruction models, resulting in high rates of missed detections and false alarms. Summary of the Invention

[0003] To solve the above problems, the present disclosure provides a time series anomaly detection method based on a multi-scale dual-stream graph attention network, which includes the following steps:

[0004] S100: Obtain a multidimensional time series to be processed and preprocess the multidimensional time series;

[0005] S200: Extract the features of the preprocessed multidimensional time series through the multi-scale feature extraction module to form a hybrid representation with rich temporal context information ;

[0006] S300: Characterizing the mixture Input into the dual-stream heterogeneous graph attention feature mining module to obtain new features of the feature dimension that represent the relationship between variables and new features of the time dimension that characterize time dependencies ;

[0007] S400: The mixed feature and the new features 、 Feature splicing is performed along the feature dimension to obtain the new features after splicing ;

[0008] S500: Use long short-term memory network LSTM to analyze the new features Encode and generate time-sensitive hidden representations , where: B represents the batch size, H represents the hidden state dimension of the custom parameter in the LSTM network;

[0009] S600: Based on the timing-sensitive hidden representation , prediction and reconstruction are performed through the fully connected layer to obtain the predicted value of the future time point and the reconstructed sequence of the current window;

[0010] S700: Combining the predicted value of the future time point and the reconstructed sequence of the current window, further calculating the prediction error based on the true value and reconstruction error ;

[0011] S800: Combining the prediction error and reconstruction error Generate anomaly scores and finally compare them with anomaly thresholds to achieve anomaly detection.

[0012] In addition, the present invention also discloses a time series anomaly detection device based on a multi-scale dual-stream graph attention network, comprising:

[0013] A device for obtaining a multidimensional time series to be processed and preprocessing the multidimensional time series;

[0014] It is used to extract the features of the pre-processed multi-dimensional time series through the multi-scale feature extraction module to form a hybrid representation with rich time domain context information device;

[0015] For characterizing the mixture Input into the dual-stream heterogeneous graph attention feature mining module to obtain new features of the feature dimension that represent the relationship between variables and new features of the time dimension that characterize time dependencies device;

[0016] For the hybrid feature and the new features 、 Feature splicing is performed along the feature dimension to obtain the new features after splicing device;

[0017] Long short-term memory network LSTM is used to process the new features Encode and generate time-sensitive hidden representations , where: B represents the batch size, H represents the device for customizing the hidden state dimension of the parameter in the LSTM network;

[0018] For the timing-sensitive hidden representation based on , a device that performs prediction and reconstruction through a fully connected layer to obtain the predicted value of the future time point and the reconstructed sequence of the current window;

[0019] It is used to combine the predicted value of the future time point and the reconstructed sequence of the current window, and further calculate the prediction error based on the true value and reconstruction error device;

[0020] For combining the prediction error and reconstruction error A device that generates anomaly scores and finally compares them with anomaly thresholds to achieve anomaly detection.

[0021] In addition, the present invention also discloses a computer storage medium, wherein the storage medium includes computer instructions, and when the computer instructions are run on the computer, the computer executes the method.

[0022] In addition, the present invention also discloses an electronic device, wherein the electronic device includes:

[0023] A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein:

[0024] When the processor executes the program, the method described is implemented.

[0025] Compared with the prior art, the present invention has the following beneficial effects:

[0026] In multivariate time series anomaly detection in spatial information networks, a multi-scale structure can simultaneously capture both transient device-level anomalies and slow system-level degradation, and meet the multi-granularity analysis required for cross-dimensional correlations in multivariate time series. This significantly enhances the model's ability to represent complex temporal patterns while maintaining compatibility with the original system. Two-stream heterogeneous graph attention, through heterogeneous dynamic modeling and spatiotemporal joint optimization, provides a highly sensitive, highly generalizable, and interpretable solution for multivariate time series anomaly detection in spatial information networks. The "reconstruction + prediction" joint loss function achieves full coverage of multivariate time series anomalies through dual-dimensional spatiotemporal modeling, noise suppression, and dynamic weight allocation, demonstrating higher detection accuracy, robustness, and interpretability in the complex dynamic environments of spatial information networks. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 This is a flow chart of a method for detecting anomalies in spatial information network signals based on a multi-scale dual-stream graph attention network, provided in one embodiment of the present disclosure;

[0028] Figure 2 It is the first dimension data of a partial time series of an MSL data set provided in one embodiment of the present disclosure;

[0029] Figure 3 Schematic diagram of abnormal scores of all telemetry parameters on an MSL dataset for a certain period of time provided in one embodiment of the present disclosure;

[0030] Figure 4(a) to Figure 4(c)This is a schematic diagram of the real data of a telemetry parameter during an abnormal period and the predicted data and reconstructed data of a time series anomaly detection method based on a multi-scale dual-stream graph attention network provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0031] In one embodiment, Figure 1 As shown, the present disclosure provides a time series anomaly detection method based on a multi-scale dual-stream graph attention network, which includes the following steps:

[0032] S100: Obtain a multidimensional time series to be processed and preprocess the multidimensional time series;

[0033] S200: Extract the features of the preprocessed multidimensional time series through the multi-scale feature extraction module to form a hybrid representation with rich temporal context information ;

[0034] S300: Characterizing the mixture Input into the dual-stream heterogeneous graph attention feature mining module to obtain new features of the feature dimension that represent the relationship between variables and new features of the time dimension that characterize time dependencies ;

[0035] S400: The mixed feature and the new features 、 Feature splicing is performed along the feature dimension to obtain the new features after splicing ;

[0036] S500: Use long short-term memory network LSTM to analyze the new features Encode and generate time-sensitive hidden representations , where: B represents the batch size, H represents the hidden state dimension of the custom parameter in the LSTM network;

[0037] S600: Based on the timing-sensitive hidden representation , prediction and reconstruction are performed through the fully connected layer to obtain the predicted value of the future time point and the reconstructed sequence of the current window;

[0038] S700: Combining the predicted value of the future time point and the reconstructed sequence of the current window, further calculating the prediction error based on the true value and reconstruction error ;

[0039] S800: Combining the prediction error and reconstruction error Generate anomaly scores and finally compare them with anomaly thresholds to achieve anomaly detection.

[0040] In this embodiment, this method preprocesses raw spatial information network signals through multi-scale feature extraction, then feeds them into a dual-stream heterogeneous graph attention feature mining module for feature extraction. An LSTM network is used to encode temporal features, and model parameters are optimized using a joint "reconstruction + prediction" loss function. Adaptive graph structure learning dynamically updates the association weights between variables, and anomaly scores are generated by combining prediction errors and reconstruction probabilities to achieve anomaly detection and traceability. This method is suitable for real-time monitoring and fault warning in scenarios such as space-based cloud service systems and satellite internet.

[0041] This method achieves an anomaly detection F1 value of 0.96 on NASA's SMAP and MSL datasets, with a missed alarm rate of less than 5% and a false alarm rate of less than 10%, significantly improving the reliability and intelligence level of space-based network operation and maintenance.

[0042] The multi-scale feature extraction module described in S200 constructs parallel convolution branches with multiple kernel sizes (e.g., odd sizes like 5, 7, and 9) to capture short-term, medium-term, and long-term temporal patterns. Each branch is padded with equal length to maintain the sequence length. This design is mathematically equivalent to building a multi-resolution analysis framework: smaller convolution kernels focus on high-frequency details, while larger kernels capture low-frequency trends. Their weighted combination forms a hybrid representation rich in temporal context.

[0043] In S200, the multi-scale feature extraction module extracts the features of the pre-processed multi-dimensional time series, and uses convolution kernels of different widths to extract the local detail features and global trend features of the time series respectively, and performs feature fusion to form a hybrid representation with rich time domain context information. , where B represents the batch size, K represents the time step length of the sliding window, and D represents the feature dimension size.

[0044] The obtained mixed representation in S300 Input into the dual-stream heterogeneous graph attention feature mining module to obtain new features of the feature dimension that represent the relationship between variables (The output shape is consistent with the input, but the features of each time step are enhanced by the multi-scale attention mechanism to capture the heterogeneous relationship between features) and the new time dimension features that represent the temporal dependency relationship (The output shape is consistent with the input, but the features at each time step are enhanced through spatiotemporal attention to capture dynamic spatiotemporal relationships).

[0045] The feature concatenation in S400 uses a function to concatenate features along the feature dimension to obtain a new concatenated feature. The (known) function can concatenate features along a specified dimension, as follows:

[0046]

[0047] in, is the fusion feature after splicing, The function represents feature concatenation along the specified dimension.

[0048] S500 uses the long short-term memory network (LSTM) to concatenate the features obtained from S400 Encode and generate time-sensitive hidden representations , where: B represents the batch size, H represents the hidden state dimension of the custom parameter in the LSTM network, and the encoding process continuously updates the cell state through the input gate, forget gate and output gate in the LSTM algorithm and hidden state (i.e., generating time-sensitive hidden representations ), the update process is:

[0049]

[0050]

[0051]

[0052] ,

[0053] in, and Initialized to zero vector. Forget gate AND input gate Respectively through sigmoid ( ) function dynamically adjusts the retention of historical information and the fusion of new features, Represents element-by-element multiplication to achieve selective memory update, and is a learnable parameter, Represents the output gate; the long short-term memory network described in S400 captures the long-term dependencies and complex spatiotemporal associations of multivariate time series through a dynamic gating mechanism.

[0054] The prediction model in S600 uses a fully connected layer network (MLP) to output the predicted value at a future time point.

[0055] in For the predicted future time point, , are the parameters of the linear layer, represents the activation function;

[0056] The reconstruction model in S600 uses an RNN decoder connected to a one-layer fully connected layer network (MLP). The RNN decoding layer expands the hidden state into a sequence and decodes the reconstructed input. The fully connected layer adjusts the output dimension to the original input feature dimension. The reconstruction model outputs the reconstructed sequence of the current window

[0057] in is the reconstruction sequence of the current window, , are the parameters of the linear layer, Represents the activation function, and the meanings of B and K are the same as above.

[0058] Prediction error in S700 and reconstruction error The mean square error (MSE) is used for calculation, and the formula is ,in Representative The predicted value of the sample, Representative The true value of the sample, represents the total number of samples, the formula ,in Represents the first Reconstructed values, Represents the sequence The meanings of B and K are the same as above.

[0059] The S800 anomaly score generation process first Kazushige Perform Z-Score method standardization to generate standardized prediction error and the normalized reconstruction error , and then use the weighted sum , is the weight coefficient, and the abnormal score is obtained .

[0060] The input to the two-stream heterogeneous graph neural network model is preprocessed multivariate time series data, specifically blocks of time series data within a sliding window. Each input sample has dimensions K × D, where K represents the time step length of the sliding window and D represents the dimension of the telemetry parameter (such as the number of sensors or feature dimensions). The output of the network is an anomaly score for each timestamp, which is used to determine whether the time point is abnormal. The anomaly score is calculated by combining the prediction error and the reconstruction probability, and a threshold is used to determine the abnormal state.

[0061] The two-stream heterogeneous graph neural network can be used to deal with non-convergence through regularization and model simplification. Regularization can add Dropout or L2 regularization (weight decay 1e-4), and model simplification can reduce the hidden layer dimension of the graph network to stabilize the training.

[0062] In another embodiment, the preprocessing in S100 includes normalization, sliding window partitioning and padding.

[0063] For this embodiment, the data set is first introduced and data preprocessing is performed. The MSL data set comes from NASA's "Mars Science Laboratory" mission, the core of which is to test the Curiosity rover, which landed on Mars in 2012. The MSL data set contains a large amount of Martian surface environment measurement data and consists of 27 time series. Each time series includes 55-dimensional parameters such as atmospheric composition, temperature, wind speed, geological characteristics, and rock mineral composition analysis. It is widely used in planetary science, geological evolution, and future Mars exploration research. Since the timestamp information in the MSL data set is unknown, it is impossible to align different time series. For example, the data length of time series P-10 in the MSL data set is 6100, while the data length of time series T-4 is 2217. Therefore, it is impossible to use a single time series as a sample for model training, and the data set needs to be preprocessed.

[0064] First, multiple time series test data of the above dataset are spliced ​​into a multidimensional time series according to the time dimension To make the model more robust, the data is normalized and converted into time series windows for training and testing. We normalize the time series as follows:

[0065]

[0066] Where min(T) and max(T) are the minimum and maximum vectors in the training time series. With the known parameter variation range as prior knowledge, we normalize the data to be in the range [0,1).

[0067] To model temporal dependencies, we adopt a local context window of length K We are t < K The timestamps of are padded with replication and the input time series T is converted into a series of sliding window sequences For any timestamp t < K , we copy and fill a constant vector of length K-1 in front of the sequence , to ensure the window length of each timestamp t. Finally, the multidimensional time series is divided into multiple samples , where K is the length of the time series in the time dimension and D is the dimension of the time series. The training and test sequences are processed in the same way to form the training dataset and the test dataset.

[0068] In another embodiment, the step S200 further includes the following steps:

[0069] S201: Construct multiple parallel convolution branches based on a preset convolution kernel size set, and use equal-length padding on each branch to keep the sequence length unchanged;

[0070] S202: Each branch extracts features independently, and introduces the ReLU activation function after the first convolution layer for nonlinear changes;

[0071] S203: stack the outputs of each branch and sum them along the branch dimension to achieve multi-resolution feature fusion, and finally restore the original dimension to form a hybrid time domain representation.

[0072] In this embodiment, the multi-scale convolution module includes parallel convolution branches, and the convolution kernel size is an odd size such as 5, 7, 9, etc. The sequence length is maintained by equal-length padding. After the nonlinear transformation, the output of each branch is added by tensor, and their weighted combination forms a mixed representation with rich time domain context information.

[0073] By constructing multiple parallel convolution branches with different kernel sizes (e.g., odd sizes such as 5, 7, and 9), we can capture short-term, medium-term, and long-term temporal patterns respectively. Each branch uses equal-length padding to maintain the same sequence length. Each branch uses a ReLU activation function after the first convolution layer for nonlinear transformation, followed by tensor addition for feature fusion. This design is mathematically equivalent to building a multi-resolution analysis framework: smaller convolution kernels focus on high-frequency details, while larger kernels capture low-frequency trends. Their weighted combination forms a hybrid representation rich in temporal context.

[0074] This module implements parallel convolutional layers, equal-length padding strategies, and tensor addition fusion, significantly improving the detection sensitivity of heterogeneous anomalies (such as sudden changes in attitude control parameters in MSL data) in spatial information network signals, and providing a highly discriminative temporal feature basis for subsequent two-stream attention modeling. The process can be divided into three core steps:

[0075] (1) Construction of multi-scale convolution branches: The input feature dimension of the MSL dataset is , for the preset convolution kernel size set , construct multiple parallel 1D convolution layers. The convolution operation of each branch can be expressed as:

[0076]

[0077] Among them, the filling strategy of Conv1D is , ensuring that the output sequence length is consistent with the input.

[0078] (2) Feature extraction and nonlinear activation:

[0079] Input Tensor (B is the batch size, T is the time step) is transposed to After that, each branch extracts features independently: The ReLU activation function is used to enhance nonlinear expression capabilities and focus on significant patterns.

[0080] (3) Cross-scale feature fusion:

[0081] The outputs of each branch are stacked and summed along the branch dimension to achieve multi-resolution feature fusion:

[0082]

[0083] Finally restore the original dimension , forming a hybrid time domain representation.

[0084] In another embodiment, the step S300 further includes the following steps:

[0085] S301: The feature flow heterogeneous graph attention layer automatically identifies heterogeneous interaction patterns between features based on multi-head transformation and dynamic type discovery mechanisms. Through a learnable type interaction matrix and multi-head attention weights, the feature flow captures such heterogeneous correlations through dynamic type partitioning.

[0086] S302: The time stream heterogeneous graph attention layer models the heterogeneity of temporal dependencies by calculating the similarity between time steps and the dynamic relationship matrix. The time stream introduces a feature similarity-driven attention mechanism to identify local mutations and global periodic pattern changes between time steps, and fuses contextual information of different time scales through multi-head attention.

[0087] In this embodiment, the dynamic relationship between the feature dimension and the time series dimension is integrated, and the cross-feature interaction and time series evolution law of multivariate time series are synchronously modeled through the heterogeneous attention mechanism.

[0088] (1) Feature-oriented graph attention layer: On the one hand, we need to detect multivariate correlations without any prior knowledge. Therefore, we regard the multivariate time series as a complete graph, where each node represents a specific feature and each edge represents the relationship between two corresponding features. In this way, the relationship between adjacent nodes can be captured by the graph attention mechanism. Specifically, each node is a sequential vector , a total of nodes, of which is the total number of timestamps, is the total number of multivariate features.

[0089] Feature Stream Attention: Based on multi-head transformation and dynamic type discovery mechanisms, it automatically identifies heterogeneous interaction patterns between features. Through a learnable type interaction matrix and multi-head attention weights, the feature stream can distinguish the semantic types of different sensors or nodes (such as transient features and trend features) and adaptively assign attention weights.

[0090] (2) Time-oriented graph attention layer: We use the power of graph attention network to capture the temporal dependencies in time series. We regard all timestamps within the sliding window as a complete graph. Specifically, the nodes Indicates timestamp The feature vector at , whose neighboring nodes include all other timestamps in the current sliding window.

[0091] Temporal Stream Attention: This approach models the heterogeneity of temporal dependencies by calculating similarities between time steps and using a dynamic relationship matrix. Temporal Stream introduces a feature-similarity-driven attention mechanism to identify local mutations (such as network congestion) and global cyclical patterns (such as orbital periodic drift) between time steps, and fuses information from different time scales through multi-head attention.

[0092] Two-stream heterogeneous graph attention feature mining:

[0093] (1) Feature Stream Heterogeneous Attention:

[0094] Multi-head feature transformation: input (B: batch size, W: time window, K: number of features) After transposition, each attention head is mapped to the embedding space through a linear layer: depth( are learnable parameters);

[0095] Dynamic type discovery:

[0096] Generate feature type distribution through Gumbel-Softmax , distinguishing between instantaneous features (such as CPU utilization) and trend features (such as memory usage): ;

[0097] Type-aware attention computation:

[0098] Utilizing the Type Interaction Matrix Calculate cross-type attention: , after weighted aggregation, we get multi-head output , and finally merged into .

[0099] (2) Temporal Stream Heterogeneous Attention:

[0100] Dynamic Relationship Discovery: Computing Time-Step Relationship Matrix by Feature Similarity : ;

[0101] Relation-enhanced attention: combining the relationship matrix R with multi-head transformation features , through the implicit relationship matrix Compute dependencies across time steps: , the final output The temporal pattern is preserved after Sigmoid activation.

[0102] In another embodiment, the joint loss function of reconstruction and prediction is defined as:

[0103]

[0104] in Indicates the current input The next timestamp of express Middle The value of a feature; is the value predicted by the forecast-based model, where is the expectation of the negative log-likelihood for a given input, is the encoder distribution and The Kullback-Leibler divergence between , as a regularizer, To balance the hyperparameters.

[0105] In this embodiment, the prediction-based model accurately captures instantaneous anomalies (such as sudden interruption of satellite signals) through time series prediction errors, but is not sensitive enough to long-term drift (such as sensor aging) and is easily disturbed by training data noise; while the reconstruction-based model effectively identifies systematic offsets (such as cumulative errors in orbital parameters) through latent space distribution modeling, but may miss single-point sudden anomalies and has high computational complexity. The model includes a prediction-based model to predict the value of the next timestamp, and a reconstruction-based model to capture the data distribution of the entire time series. During the training process, the parameters of the two models are updated simultaneously. The loss function is defined as the sum of two optimization objectives, namely ,in represents the loss function of the prediction-based model, represents the loss function of the reconstruction-based model.

[0106] Prediction-based model: The model predicts the value of the next timestamp. The loss function can be expressed as the root mean square error (RMSE):

[0107]

[0108] in Indicates the current input The next timestamp of express Middle The value of a feature; is the value predicted by the model based on the prediction.

[0109] Reconstruction-based model: This model aims to learn the marginal distribution of data on the latent representation z. We adopt variational autoencoder (VAE), which provides a probabilistic way to describe observations in the latent space. By treating the values ​​of the time series as variables, the VAE model is able to capture the data distribution of the entire time series. Given an input , which should be distributed by the condition Reconstruction, where z is a vector representation in the latent space. The optimization goal is to find the reconstruction with the closest data distribution The best model parameters.

[0110] Introducing a recognition model To approximate the posterior distribution. Given the recognition model (encoder) and the generative model (decoder) , the reconstruction-based loss function can be calculated as follows:

[0111]

[0112] The first term is the expected negative log-likelihood for a given input. The second term is the encoder distribution and The Kullback-Leibler divergence between and can be seen as a regularizer.

[0113] Temporal relationship modeling based on long short-term memory network (LSTM): Capturing the long-term dependency and complex spatiotemporal correlation of multivariate time series through dynamic gating mechanism. Taking satellite network multi-sensor data as an example, let the input be ( is the number of sensors, is the time window length), LSTM models normal patterns through the following core steps:

[0114] (1) Temporal feature encoding: hidden state and cell status Iterative updates:

[0115]

[0116] The forget gate AND input gate Dynamically adjust the retention of historical information and the fusion of new features through the sigmoid function respectively, denoted as element-wise multiplication, to achieve selective memory update and effectively suppress the interference of sensor noise (such as the random fluctuations in the thermal control system), and are learnable parameters.

[0117] (2) Anomaly detection mechanism: Construct an anomaly score based on the prediction or reconstruction error. For example, in the LSTM-Encoder-Decoder framework, the decoder reconstructs the sequence , and calculate the reconstruction error:

[0118]

[0119] When the error exceeds the dynamic threshold (such as Peak Over Threshold), it is determined as an anomaly.

[0120] The experiment selects the upper quartile of on the validation data during the training process as the threshold indicating anomalies, to compare the precision (%), recall (%), and F1 value of the proposed method and the baseline methods on the datasets MSL and SMAP. The experimental results are shown in Table 1. In the table, the best performance among all baseline methods is marked with an underline, and the performance of the proposed method is marked in bold. In this paper, experiments are implemented on some baseline methods using publicly available code sources, and the data of another part of the baseline methods comes from the literature. On the MSL dataset, the time series anomaly detection method based on the multi-scale two-stream graph attention network achieves a relatively high recall rate while ensuring high precision. This fully demonstrates the effectiveness of this method in the multi-variable time series anomaly detection task.

[0121]

[0122] Table 1

[0123] Figure 2 shows the anomaly scores of all telemetry parameters on the MSL dataset during a certain period , where the correctly predicted anomalies become shaded. It can be obtained that at 55000 < t < 56000 . The high anomaly score of the telemetry parameter indicates that it may be in an abnormal condition or closely related to the parameter in an abnormal condition, so this method locates the moment when the anomaly occurs and the parameter most likely to have an anomaly. It can be seen from this figure that this method can basically accurately detect the anomaly moment. As can be seen from the figure, at the anomaly moments detected by the proposed method above, the telemetry parameter is in an abnormal condition, and this method successfully locates the telemetry parameter with an anomaly. The real data, the predicted data, and the reconstructed data of the telemetry parameter during the abnormal period are as Figure 3A case study of anomalies in telemetry parameters demonstrates that this method has the ability to accurately detect and precisely locate anomalies and can provide explanations for the detected anomalies.

[0124] Figure 4(a) to Figure 4(c) Figure 4 shows the learned adjacency matrix graph structures at different time dimensions. Figure 4(a) shows the 68,000th sequence (normal); Figure 4(b) shows the 73,400th sequence (point anomaly); and Figure 4(c) shows the 2100th sequence (sequence anomaly). As can be seen from the figure, the learned graph structure is not fixed but changes with the timestamp, demonstrating that graph structure learning can effectively capture the dynamic characteristics of data over time. Furthermore, a comparison of the adjacency matrices of normal and anomalous samples shows that when no anomalies occur, the correlations between features are relatively evenly distributed. However, when an anomaly occurs, the correlation between a particular channel and any other channel is much higher than that between all other channels. This demonstrates the feasibility of using graph structure learning to trace the source of anomaly channels. The attention scores of point anomalies and sequence anomalies in the time dimension can be clearly distinguished.

[0125] In another embodiment, the anomaly scoring formula is:

[0126]

[0127] in To generate standardized forecast errors, is the normalized reconstruction error, is the weight coefficient.

[0128] In this embodiment, corresponding to the joint optimization goal, each timestamp also has two inference results. One is the predicted value Calculated by the prediction-based model, the other is the reconstruction probability , obtained from the reconstruction-based model. The final inference score balances their strengths to maximize the overall effectiveness of anomaly detection. The inference score for each feature is calculated , and the sum of all features is used as the final inference score. A timestamp is considered an anomaly if its corresponding inference score is greater than a threshold. The threshold is automatically selected using the Peak Over Threshold (POT). Specifically, the inference score can be calculated using the following formula:

[0129]

[0130] in is the predicted value With actual value The squared error between the features The degree of deviation between the actual value and the forecast; The features encountered according to the reconstruction model Probability of outliers; is the total number of features; is a hyperparameter that combines the prediction-based error and the reconstruction-based probability.

[0131] In another embodiment, a peak exceeding threshold method is used to automatically select the abnormality determination threshold.

[0132] In this embodiment, a peak over-threshold (POT) method is used to automatically select an anomaly determination threshold. The peak over-threshold method is based on extreme value theory and achieves adaptive selection of anomaly thresholds by statistically modeling the distribution of extreme events in the signal that exceed a preset threshold.

[0133] In another embodiment, a time series anomaly detection device based on a multi-scale dual-stream graph attention network includes:

[0134] A device for obtaining a multidimensional time series to be processed and preprocessing the multidimensional time series;

[0135] It is used to extract the features of the pre-processed multi-dimensional time series through the multi-scale feature extraction module to form a hybrid representation with rich time domain context information device;

[0136] For characterizing the mixture Input into the dual-stream heterogeneous graph attention feature mining module to obtain new features of the feature dimension that represent the relationship between variables and new features of the time dimension that characterize time dependencies device;

[0137] For the hybrid feature and the new features 、 Feature splicing is performed along the feature dimension to obtain the new features after splicing device;

[0138] Long short-term memory network LSTM is used to process the new features Encode and generate time-sensitive hidden representations , where: B represents the batch size, H represents the device for customizing the hidden state dimension of the parameter in the LSTM network;

[0139] For the timing-sensitive hidden representation based on , a device that performs prediction and reconstruction through a fully connected layer to obtain the predicted value of the future time point and the reconstructed sequence of the current window;

[0140] It is used to combine the predicted value of the future time point and the reconstructed sequence of the current window, and further calculate the prediction error based on the true value and reconstruction error device;

[0141] For combining the prediction error and reconstruction error A device that generates anomaly scores and finally compares them with anomaly thresholds to achieve anomaly detection.

[0142] In addition, the present invention also discloses a computer storage medium, wherein the storage medium includes computer instructions, which, when executed on a computer, enable the computer to execute any of the methods described above.

[0143] In addition, the present invention also discloses an electronic device, wherein the electronic device includes:

[0144] A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein:

[0145] When the processor executes the program, any of the above methods is implemented.

[0146] Although the embodiments of the present invention have been described above with reference to the accompanying drawings, the present invention is not limited to the above-mentioned specific embodiments and application fields. The above-mentioned specific embodiments are merely illustrative and instructive, and are not restrictive. A person skilled in the art, guided by this specification and without departing from the scope of protection of the claims of the present invention, may also devise various forms, all of which fall within the scope of protection of the present invention.

Claims

1. A time series anomaly detection method based on a multi-scale dual-stream graph attention network, comprising the following steps: S100: Obtain a multidimensional time series to be processed and preprocess the multidimensional time series; S200: Extract the features of the preprocessed multidimensional time series through the multi-scale feature extraction module to form a hybrid representation with rich temporal context information ; S300: Characterizing the mixture Input into the dual-stream heterogeneous graph attention feature mining module to obtain new features of the feature dimension that represent the relationship between variables and new features of the time dimension that characterize time dependencies ; S400: The mixed feature and the new features 、 Feature splicing is performed along the feature dimension to obtain the new features after splicing ; S500: Use long short-term memory network LSTM to analyze the new features Encode and generate time-sensitive hidden representations ,in: B represents the batch size, and H represents the hidden state dimension of the custom parameters in the LSTM network; S600: Based on the timing-sensitive hidden representation , prediction and reconstruction are performed through the fully connected layer to obtain the predicted value of the future time point and the reconstructed sequence of the current window; S700: Combining the predicted value of the future time point and the reconstructed sequence of the current window, further calculating the prediction error based on the true value and reconstruction error ; S800: Combining the prediction error and reconstruction error Generate anomaly scores and finally compare them with anomaly thresholds to achieve anomaly detection.

2. The method according to claim 1, preferably, the preprocessing in S100 includes normalization, sliding window division and padding.

3. The method according to claim 1, wherein S200 further comprises the following steps: S201: Construct multiple parallel convolution branches based on a preset convolution kernel size set, and use equal-length padding on each branch to keep the sequence length unchanged; S202: Each branch extracts features independently, and introduces the ReLU activation function after the first convolution layer for nonlinear changes; S203: stack the outputs of each branch and sum them along the branch dimension to achieve multi-resolution feature fusion, and finally restore the original dimension to form a hybrid time domain representation.

4. The method according to claim 1, wherein S300 further comprises the following steps: S301: The feature flow heterogeneous graph attention layer automatically identifies heterogeneous interaction patterns between features based on multi-head transformation and dynamic type discovery mechanisms. Through a learnable type interaction matrix and multi-head attention weights, the feature flow captures such heterogeneous correlations through dynamic type partitioning. S302: The time stream heterogeneous graph attention layer models the heterogeneity of temporal dependencies by calculating the similarity between time steps and the dynamic relationship matrix. The time stream introduces a feature similarity-driven attention mechanism to identify local mutations and global periodic pattern changes between time steps, and fuses contextual information of different time scales through multi-head attention.

5. The method according to claim 1, wherein the joint loss function of prediction and reconstruction is defined as: ； in Indicates the current input The next timestamp of express Middle The value of a feature; is the value predicted by the forecast-based model, where is the expectation of the negative log-likelihood for a given input, is the encoder distribution and The Kullback-Leibler divergence between , as a regularizer, To balance the hyperparameters.

6. The method according to claim 1, wherein the abnormality scoring formula is: ， in To generate standardized forecast errors, is the normalized reconstruction error, is the weight coefficient.

7. The method according to claim 1 adopts a peak over-threshold method to automatically select an abnormality determination threshold.

8. A time series anomaly detection device based on a multi-scale dual-stream graph attention network, comprising: A device for obtaining a multidimensional time series to be processed and preprocessing the multidimensional time series; It is used to extract the features of the pre-processed multi-dimensional time series through the multi-scale feature extraction module to form a hybrid representation with rich time domain context information device; For characterizing the mixture Input into the dual-stream heterogeneous graph attention feature mining module to obtain new features of the feature dimension that represent the relationship between variables and new features of the time dimension that characterize time dependencies device; For the hybrid feature and the new features 、 Feature splicing is performed along the feature dimension to obtain the new features after splicing device; Long short-term memory network LSTM is used to process the new features Encode and generate time-sensitive hidden representations , where: B represents the batch size, H represents the device for customizing the hidden state dimension of the parameter in the LSTM network; For the timing-sensitive hidden representation based on , a device that performs prediction and reconstruction through a fully connected layer to obtain the predicted value of the future time point and the reconstructed sequence of the current window; It is used to combine the predicted value of the future time point and the reconstructed sequence of the current window, and further calculate the prediction error based on the true value and reconstruction error device; For combining the prediction error and reconstruction error A device that generates anomaly scores and finally compares them with anomaly thresholds to achieve anomaly detection.

9. A computer storage medium, wherein: The storage medium includes computer instructions, which, when executed on a computer, enable the computer to execute the method according to any one of claims 1 to 7.

10. An electronic device, wherein: The electronic device comprises: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the method according to any one of claims 1 to 7 is implemented.

Images