Time series data anomaly detection method based on adaptive spectrum block
By combining adaptive spectral blocks and interactive convolution blocks, the problems of long-range dependency and noise resistance of traditional models in time series data detection are solved, and efficient and accurate anomaly detection is achieved.
Patent Information
- Application Number
- CN202510835509.6
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-06-20
- Publication Date
- 2025-09-26
AI Technical Summary
Traditional convolutional neural networks and Transformer models have limitations in detecting anomalies in time series data. They cannot effectively capture long-range dependencies, have insufficient noise resistance, and have high computational complexity, making them unable to meet real-time detection needs.
Adaptive spectral block (ASB) and interactive convolution block (ICB) are used to remove high-frequency noise through adaptive threshold filter, combine frequency domain and time domain feature extraction, use lightweight convolution layer to capture long-term and short-term dependencies, and combine linear classifier for anomaly detection.
It improves the accuracy and computational efficiency of anomaly detection, reduces model complexity, has noise resistance, and is suitable for real-time detection.
Smart Images
Figure CN120705776A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of data processing, and in particular to a time series data anomaly detection method based on adaptive spectral blocks. Background Art
[0002] Time series data is widely found in fields such as finance, healthcare, and environmental monitoring. It is characterized by inherent long- and short-term dependencies and noise interference. Traditional convolutional neural networks (CNNs), due to their local receptive fields, excel at capturing short-term dependencies, but are limited in capturing long-term dependencies and cannot fully understand the global patterns of time series. While the Transformer model can capture long-term dependencies, its self-attention mechanism is sensitive to noise and prone to overfitting on small datasets, affecting model stability. Furthermore, high-frequency noise in time series data can interfere with the model's learning of real-world signals, leading to false positives and false negatives in anomaly detection and reducing its accuracy. Furthermore, the complex model structure and large number of parameters increase computational overhead, making it unable to meet the requirements of real-time anomaly detection. Summary of the Invention
[0003] The technical problem to be solved by this invention is to provide a time series data anomaly detection method based on adaptive spectral blocks, which is robust to noise and computationally efficient. By introducing adaptive spectral blocks (ASBs) and interactive convolutional blocks (ICBs), this method improves anomaly detection accuracy while reducing the model's computational complexity, meeting the requirements of real-time detection.
[0004] To solve the above technical problems, the technical solution adopted by the present invention is: a time series data anomaly detection method based on adaptive spectral blocks, comprising the following steps: S1. Data preprocessing: Standardize and normalize the original time series data to remove non-stationary components such as trend and seasonality; S2, Patch Embedding and Position Encoding: Divide the preprocessed time series into multiple patches (segments), perform embedding operations, and add position encoding to preserve timing information; S3, Adaptive Spectral Processing: Use Fast Fourier Transform to convert time series data from the time domain to the frequency domain, use adaptive threshold filters to intelligently identify and remove high-frequency noise, retain key frequency components, and use global and local filtering methods to extract frequency domain features; S4, inverse FFT conversion: convert the filtered frequency domain features back to the time domain through IFFT; S5. Interactive convolutional feature extraction: Use multiple convolutional layers with different kernel sizes to extract temporal features, and enhance the model's ability to capture and understand complex temporal dependencies through feature interaction; S6. Anomaly detection decision: The extracted time domain features are input into a linear classifier or other types of classifiers. The classifier learns and infers based on the features to detect abnormal events.
[0005] Preferably, the step S1 specifically includes the following steps: Standardization and normalization: Standardize time series data ( , where z is the standardized value of data x, μ is the mean of x, is the standard deviation of x) and normalized ( ,in is the value after data normalization, is the minimum value of x, is the maximum value of x), so that the data meets the requirements of model training; Detrending and deseasonalization: Use differencing and moving average methods to remove trend and seasonal components in the data to obtain a stationary time series.
[0006] Preferably, step S2 includes the following steps: Patch partitioning: Divide the time series of length L into fixed length p to obtain M patches, each of which is represented by , where C is the number of channels and p is the fixed partition length; Embedding mapping: Perform a linear transformation on each patch and map it to an embedding space of fixed dimension to obtain an embedding vector ; Position encoding: Add position encoding to each patch , retaining temporal information; the positional encoding is a learnable parameter or a fixed encoding based on sine and cosine functions; Embedding representation: The final embedding representation is ; in, represents the embedding vector obtained after the linear transformation of the i-th patch, represents the position encoding of the i-th patch, .
[0007] Preferably, step S3 includes the following steps: FFT transformation: Perform FFT transformation on each embedded patch to obtain frequency domain features ; Power spectrum calculation: Calculate the power spectrum of frequency domain features Used to identify the main frequency components; Adaptive threshold filtering: This includes threshold setting, introducing a learnable threshold θ, which is dynamically adjusted according to data characteristics; filtering operation, using the threshold θ to filter the power spectrum, retaining frequency components with power greater than θ: ; Where ⊙ represents element-wise multiplication, (P>θ) is a binary mask matrix; Define global and local filters: Global filter, define a learnable global filter WG, applied to the original frequency domain features: ; Local filter, defines a learnable local filter, which is applied to the filtered frequency domain features: ; Feature integration: Add global and local features to obtain integrated frequency domain features: ; Preferably, step S4 includes the following steps: Time domain recovery: Perform inverse FFT on the integrated frequency domain features to obtain the time domain feature representation .
[0008] Preferably, step S5 includes the following steps: Multi-scale convolution: Use two convolutional layers Conv1 and Conv2 with kernel sizes k1 and k2 respectively to capture features at different scales; Activation function: GELU activation function is used to perform nonlinear transformation on the convolution result; Feature interaction: Interaction between features of different scales is achieved through element-level multiplication: A1=GELU(Conv1(S′))⊙Conv2(S′); A2=GELU(Conv2(S′))⊙Conv1(S′); Output calculation: Add the interaction features and pass them through the third convolutional layer Conv3 to get the output of ICB: OICB=Conv3(A1+A2).
[0009] Preferably, step S6 includes the following steps: Anomaly detection, input OICB into the linear layer or other classifier, and output the anomaly detection result.
[0010] Preferably, the method further includes step S7 of model training, wherein the model training includes self-supervised pre-training and supervised fine-tuning; Preferably, the self-supervised pre-training adopts a masking strategy to randomly mask part of the patch so that the model learns to reconstruct the masked part. The loss function uses the mean square error as the loss function, specifically: ; in, is the predicted value of the i-th sample model, is the true value of the i-th sample; Preferably, the supervised fine-tuning uses labeled data, and uses labeled normal and abnormal data for fine-tuning, and the loss function uses a binary cross entropy loss function, specifically: ; Where N is the number of samples, is the true value of the i-th sample, The abnormal probability of the i-th sample predicted by the model.
[0011] The present invention provides a time series data anomaly detection method based on adaptive spectral blocks, which has the following beneficial effects: 1. Improve anomaly detection accuracy: Through adaptive spectral blocks, the model can effectively remove high-frequency noise, enhance the capture of real signals, and improve the accuracy of anomaly detection.
[0012] 2. Taking into account both long-term and short-term dependencies: Combining feature extraction methods in the frequency domain and time domain, the model can simultaneously capture the long-term and short-term dependencies of the time series.
[0013] 3. High computational efficiency: The use of FFT and lightweight convolution operations reduces the computational complexity of the model and meets the needs of real-time detection.
[0014] 4. Strong noise resistance: The adaptive threshold filter is dynamically adjusted according to the data characteristics, which enhances the robustness of the model and adapts to data with different noise levels.
[0015] 5. Wide applicability: The model structure is universal and applicable to various types of time series data, including finance, healthcare, industrial monitoring and other fields. BRIEF DESCRIPTION OF THE DRAWINGS
[0016] The present invention will be further described below with reference to the accompanying drawings and embodiments: Figure 1 Flow chart of the method of the present invention. DETAILED DESCRIPTION
[0017] like Figure 1 As shown, a time series data anomaly detection method based on adaptive spectral blocks includes the following steps: S1. Data preprocessing: Standardize and normalize the original time series data to remove trend and seasonal non-stationary components; S2, Patch Embedding and Position Encoding: Divide the preprocessed time series into multiple patches (segments), perform embedding operations, and add position encoding to preserve timing information; S3, Adaptive Spectral Processing: Use Fast Fourier Transform to convert time series data from the time domain to the frequency domain, use adaptive threshold filters to intelligently identify and remove high-frequency noise, retain key frequency components, and use global and local filtering methods to extract frequency domain features; S4, inverse FFT conversion: convert the filtered frequency domain features back to the time domain through IFFT; S5. Interactive convolutional feature extraction: Use multiple convolutional layers with different kernel sizes to extract temporal features, and enhance the model's ability to capture and understand complex temporal dependencies through feature interaction; S6. Anomaly detection decision: The extracted time domain features are input into a linear classifier or other types of classifiers. The classifier learns and infers based on the features to detect abnormal events.
[0018] Preferably, the step S1 specifically includes the following steps: Standardization and normalization: Standardize time series data ( , where z is the standardized value of data x, μ is the mean of x, is the standard deviation of x) and normalized ( ,in is the value after data normalization, is the minimum value of x, is the maximum value of x), so that the data meets the requirements of model training; Detrending and deseasonalization: Use differencing and moving average methods to remove trend and seasonal components in the data to obtain a stationary time series.
[0019] Preferably, step S2 includes the following steps: Patch partitioning: Divide the time series of length L into fixed length p to obtain M patches, each of which is represented by , where C is the number of channels and p is the fixed partition length; Embedding mapping: Perform a linear transformation on each patch and map it to an embedding space of fixed dimension to obtain an embedding vector ; Position encoding: Add position encoding to each patch , retaining temporal information; the positional encoding is a learnable parameter or a fixed encoding based on sine and cosine functions; Embedding representation: The final embedding representation is ; in, represents the embedding vector obtained after the linear transformation of the i-th patch, represents the position encoding of the i-th patch, .
[0020] Preferably, step S3 includes the following steps: FFT transformation: Perform FFT transformation on each embedded patch to obtain frequency domain features ; Power spectrum calculation: Calculate the power spectrum of frequency domain features Used to identify the main frequency components; Adaptive threshold filtering: This includes threshold setting, introducing a learnable threshold θ, which is dynamically adjusted according to data characteristics; filtering operation, using the threshold θ to filter the power spectrum, retaining frequency components with power greater than θ: ; Where ⊙ represents element-wise multiplication, (P>θ) is a binary mask matrix; Define global and local filters: Global filter, define a learnable global filter WG, applied to the original frequency domain features: ; Local filter, defines a learnable local filter, which is applied to the filtered frequency domain features: ; Feature integration: Add global and local features to obtain integrated frequency domain features: ; The attention mechanism is also incorporated: After obtaining the integrated frequency-domain features Fintegrated, the attention mechanism is introduced. First, the attention weights are calculated and Fintegrated is input into a multi-layer perceptron (MLP), which consists of a fully connected layer, a ReLU activation function, and another fully connected layer. After processing by the MLP, an attention score is obtained. This score is normalized using the Softmax function to obtain the attention weight A. The attention weights are then weighted and summed with Fintegrated to obtain the frequency-domain feature representation with the attention mechanism: Fattended = A·Fintegrated (where "·" represents element-wise multiplication). The attention mechanism enables the model to focus on the frequency components that are more critical for anomaly detection, enhancing the representation of important features.
[0021] The performance of anomaly detection after adding the attention mechanism can be evaluated from three perspectives: accuracy, stability, and efficiency. Accuracy measures prediction accuracy by calculating precision, recall, and F1 score. Stability is measured by observing the model's performance under different data and noise conditions through cross-validation and robustness testing. Efficiency assesses resource consumption by measuring computation time and memory usage.
[0022] Accuracy assessment Precision, Recall, and F1 Score: Divide the data into training, validation, and test sets. Use the test set data to train the model for anomaly detection predictions. Precision reflects the proportion of data predicted as anomalies by the model that are actually anomalies, while recall reflects the proportion of anomalies correctly detected by the model. The F1 score is the harmonic mean of precision and recall, providing a comprehensive assessment of model performance. For example, for 100 test samples, if the model predicts 30 anomalies, 20 of which are actually anomalies, and there are actually 25 anomalies, the precision is 20 ÷ 30 = 66.7%, the recall is 20 ÷ 25 = 80%, and the F1 score is 2 × (66.7% × 80%) ÷ (66.7% + 80%) = 72.7%.
[0023] Confusion Matrix: Construct a confusion matrix to visually visualize model predictions. The rows represent the actual category (normal or abnormal), and the columns represent the predicted category. The confusion matrix clearly shows the number of correct and incorrect predictions, allowing calculations of metrics such as precision and recall. It also identifies areas where the model is prone to misclassification. For example, if a large number of actual abnormal samples in the matrix are misclassified as normal, this indicates that the model's ability to identify abnormal data needs improvement.
[0024] Stability assessment Cross-validation: Use k-fold cross-validation (e.g., k=5). Split the training data into five parts, using four parts for model training and one part for validation, repeating five times. Calculate performance metrics (such as precision and recall) for each validation run, observing any fluctuations. If precision fluctuates slightly between 60% and 70% across the five validation runs, the model is relatively stable. If the fluctuation range is large, such as from 40% to 80%, the model is less stable and may be significantly affected by the data partitioning.
[0025] Robustness testing: Add varying degrees of noise (such as Gaussian noise) to the test data to simulate real-world interference and observe changes in model performance. If adding a small amount of noise causes the model's accuracy to drop from 70% to 50%, this indicates weak noise immunity and poor robustness. If the accuracy drops only slightly, to 65%, the model demonstrates good robustness and can operate stably in a moderately noisy environment.
[0026] Efficiency evaluation Computation time: Record the time it takes the model to process the test data, comparing the time before and after adding the attention mechanism. Use a stopwatch or the time function in the code to measure the time it takes for the model to process the input data and output the predicted result. If it takes 10 seconds to process 100 samples before adding the attention mechanism and 15 seconds after, the attention mechanism increases the computation time and requires further optimization.
[0027] Memory usage: Use system monitoring tools (such as Python's memory_profiler library) to monitor the model's memory usage during runtime. If the model's memory usage increases from 100MB to 150MB after adding the attention mechanism, this indicates increased memory resource requirements, which may be limited in practical applications. You need to evaluate whether your system can support this.
[0028] Preferably, step S4 includes the following steps: Time domain recovery: Perform inverse FFT on the integrated frequency domain features to obtain the time domain feature representation .
[0029] Preferably, step S5 includes the following steps: Multi-scale convolution: Use two convolutional layers Conv1 and Conv2 with kernel sizes k1 and k2 respectively to capture features at different scales; Activation function: GELU activation function is used to perform nonlinear transformation on the convolution result; Feature interaction: Interaction between features of different scales is achieved through element-level multiplication: A1=GELU(Conv1(S′))⊙Conv2(S′); A2=GELU(Conv2(S′))⊙Conv1(S′); Output calculation: Add the interaction features and pass them through the third convolutional layer Conv3 to get the output of ICB: OICB=Conv3(A1+A2).
[0030] Preferably, step S6 includes the following steps: Anomaly detection, input OICB into the linear layer or other classifier, and output the anomaly detection result.
[0031] Preferably, the method further includes step S7 of model training, wherein the model training includes self-supervised pre-training and supervised fine-tuning; The self-supervised pre-training adopts a masking strategy to randomly mask some patches so that the model can learn to reconstruct the masked parts. The loss function uses the mean square error as the loss function, specifically: ; in, is the predicted value of the i-th sample model, is the true value of the i-th sample; The supervised fine-tuning uses labeled data and marked normal and abnormal data for fine-tuning. The loss function uses a binary cross entropy loss function, specifically: ; Where N is the number of samples, is the true value of the i-th sample, The abnormal probability of the i-th sample predicted by the model.
[0032] When the present invention is actually used, it is necessary to strictly follow specific steps to ensure the scientificity and accuracy of the detection process.
[0033] Data preparation: First determine the applicable scenario, such as stock price fluctuation monitoring in the financial field, ECG signal analysis in the medical industry, and equipment operation status monitoring in industrial production. Collect raw time series data according to the scenario, such as collecting temperature data every minute when a factory equipment is running continuously. Then standardize the data and use the formula Calculations are performed to uniformly quantify the data, making it more suitable for model training. Trends and seasonal non-stationary components are then removed through methods such as differencing and moving averages to obtain stable data. For example, first-order differences are used to eliminate long-term upward or downward trends in device temperature data, and moving averages are used to eliminate cyclical fluctuations.
[0034] Model Construction and Training: The preprocessed data is divided into multiple patches of fixed length. For example, if the data length is 1000 and the fixed length is set to 50, 20 patches will be obtained. Each patch is embedded and mapped to a fixed-dimensional space. Positional encoding is also added to preserve temporal information. Adaptive spectral processing is then performed, using a fast Fourier transform to convert the data to the frequency domain. An adaptive threshold filter intelligently removes high-frequency noise, preserving key frequency components. For example, in device temperature data, this can effectively filter out high-frequency noise generated by electrical interference. The filtered frequency domain features are converted back to the time domain using an inverse FFT. Time domain features are then extracted through convolutional layers with different kernel sizes, enhancing the ability to capture complex temporal dependencies. During model training, self-supervised pre-training is performed, randomly masking patches to allow the model to learn and reconstruct, and optimizing using a mean square error loss function. Supervised fine-tuning is then performed using labeled normal and abnormal data, using a binary cross-entropy loss function to improve model detection accuracy.
[0035] Anomaly Detection: After the model is trained, new time series data is processed according to the preprocessing and feature extraction steps described above. The resulting features are then fed into a linear classifier or other classifier. The classifier infers and judges based on the patterns learned during training, outputting anomaly detection results. For example, when monitoring equipment temperature, the model can determine in real time whether the current temperature change is abnormal. If an anomaly is detected, an alert is issued, notifying relevant personnel to take appropriate measures to ensure normal operation of the equipment.
[0036] This method effectively removes high-frequency noise, and its adaptive threshold filter dynamically adjusts to data characteristics, a feature lacking in other methods. It also accounts for both long-term and short-term dependencies, combining frequency and time domain feature extraction, a feature that other methods struggle to capture simultaneously, both global and local. Furthermore, it boasts high computational efficiency, making it more lightweight and computationally efficient than complex models like the Transformer.
[0037] The above embodiments are merely preferred technical solutions of the present invention and should not be construed as limiting the present invention. The scope of protection of the present invention shall be the technical solutions set forth in the claims, including equivalent alternatives to the technical features of the technical solutions set forth in the claims. In other words, equivalent alternatives and improvements within this scope are also within the scope of protection of the present invention.
Claims
1. A time series data anomaly detection method based on adaptive spectral blocks, characterized in that: The following steps are involved: S1. Data preprocessing: Standardize and normalize the original time series data to remove non-stationary components such as trend and seasonality; S2, Patch Embedding and Position Encoding: Divide the preprocessed time series into multiple patches and perform embedding operations, while adding position encoding to preserve the timing information; S3, Adaptive Spectral Processing: Use Fast Fourier Transform to convert time series data from the time domain to the frequency domain, use adaptive threshold filters to intelligently identify and remove high-frequency noise, retain key frequency components, and use global and local filtering methods to extract frequency domain features; S4, inverse FFT conversion: convert the filtered frequency domain features back to the time domain through IFFT; S5. Interactive convolutional feature extraction: Use multiple convolutional layers with different kernel sizes to extract temporal features, and enhance the model's ability to capture and understand complex temporal dependencies through feature interaction; S6. Anomaly detection decision: The extracted time domain features are input into a linear classifier or other types of classifiers. The classifier learns and infers based on the features to detect abnormal events.
2. The method for detecting anomalies in time series data based on adaptive spectral blocks according to claim 1, characterized in that: The step S1 specifically includes the following steps: Standardization and normalization: Standardize and normalize time series data to make the data meet the requirements of model training; Detrending and deseasonalization: Use differencing and moving average methods to remove trend and seasonal components in the data to obtain a stationary time series.
3. The method for detecting anomalies in time series data based on adaptive spectral blocks according to claim 1, characterized in that: The step S2 comprises the following steps: Patch partitioning: Divide the time series of length L into fixed length p to obtain M patches, each of which is represented by , where C is the number of channels and p is the fixed partition length; Embedding mapping: Perform a linear transformation on each patch and map it to an embedding space of fixed dimension to obtain an embedding vector ; Position encoding: Add position encoding to each patch , retaining temporal information; the positional encoding is a learnable parameter or a fixed encoding based on sine and cosine functions; Embedding representation: The final embedding representation is ； in, represents the embedding vector obtained after the linear transformation of the i-th patch, represents the position encoding of the i-th patch, .
4. The method for detecting anomalies in time series data based on adaptive spectral blocks according to claim 1, characterized in that: The step S3 comprises the following steps: FFT transformation: Perform FFT transformation on each embedded patch to obtain frequency domain features ; Power spectrum calculation: Calculate the power spectrum of frequency domain features Used to identify the main frequency components; Adaptive threshold filtering: This includes threshold setting, introducing a learnable threshold θ, which is dynamically adjusted according to data characteristics; filtering operation, using the threshold θ to filter the power spectrum, retaining frequency components with power greater than θ: ； Where ⊙ represents element-wise multiplication, (P>θ) is a binary mask matrix; Define global and local filters: Global filter, define a learnable global filter WG, applied to the original frequency domain features: ； Local filter, defines a learnable local filter, which is applied to the filtered frequency domain features: ； Feature integration: Add global and local features to obtain integrated frequency domain features: 。 5. The method for detecting anomalies in time series data based on adaptive spectral blocks according to claim 1, wherein: The step S4 comprises the following steps: Time domain recovery: Perform inverse FFT on the integrated frequency domain features to obtain the time domain feature representation .
6. The method for detecting anomalies in time series data based on adaptive spectral blocks according to claim 1, characterized in that: Step S5 shown includes the following steps: Multi-scale convolution: Use two convolutional layers Conv1 and Conv2 with kernel sizes k1 and k2 respectively to capture features at different scales; Activation function: GELU activation function is used to perform nonlinear transformation on the convolution result; Feature interaction: Interaction between features of different scales is achieved through element-level multiplication: A1=GELU(Conv1(S′))⊙Conv2(S′); A2=GELU(Conv2(S′))⊙Conv1(S′); Output calculation: Add the interaction features and pass them through the third convolutional layer Conv3 to get the output of ICB: OICB=Conv3(A1+A2).
7. The method for detecting anomalies in time series data based on adaptive spectral blocks according to claim 1, characterized in that: The step S6 comprises the following steps: Anomaly detection, input OICB into the linear layer or other classifier, and output the anomaly detection result.
8. The method for detecting anomalies in time series data based on adaptive spectral blocks according to claim 1, characterized in that: The process also includes step S7 model training, wherein the model training includes self-supervised pre-training and supervised fine-tuning.
9. The method for detecting anomalies in time series data based on adaptive spectral blocks according to claim 8, characterized in that: The self-supervised pre-training adopts a masking strategy to randomly mask some patches so that the model can learn to reconstruct the masked parts. The loss function uses the mean square error as the loss function, specifically: ； in, is the predicted value of the i-th sample model, is the true value of the i-th sample.
10. The method for detecting anomalies in time series data based on adaptive spectral blocks according to claim 8, characterized in that: The supervised fine-tuning uses labeled data and marked normal and abnormal data for fine-tuning. The loss function uses a binary cross entropy loss function, specifically: ； Where N is the number of samples, is the true value of the i-th sample, The abnormal probability of the i-th sample predicted by the model.