Abnormality detection method and device for time series data, electronic equipment and storage medium

Abstract

The invention discloses a time series data anomaly detection method and device, electronic equipment and a storage medium, and relates to the technical field of computers, the time series data anomaly detection method comprises the steps of obtaining time series data of a to-be-detected index, and performing correlation analysis and stability analysis based on the time series data, according to the method, the importance degree parameter and the stability parameter are obtained, then the mask proportion for mask processing of the time series data can be determined based on the importance degree parameter and the stability parameter, the mask processing result of the time series data is determined according to the mask proportion, anomaly detection is carried out based on the mask processing result, and the anomaly detection result is obtained. In other words, the mask proportion is dynamically determined according to the characteristics of the time series data, and compared with a fixed mask proportion, the mask proportion determined based on the importance degree parameter and the stability parameter can effectively avoid the condition that the mask processing of the index to be detected is unreasonable.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computers, and particularly relates to a time series data anomaly detection method and device, electronic equipment and a storage medium. BACKGROUND

[0002] With the development of cloud technology, cloud computing systems also expose many problems, such as frequent failures, capacity planning difficulties, uneven resource allocation, etc., which directly affect service quality and user experience. In order to deal with these problems, anomaly detection technology has become the first line of defense to maintain the stable operation of cloud computing systems.

[0003] At present, in the anomaly detection process, the time series data of the indicators is usually monitored in real time, and then the time series data is analyzed through an anomaly detection algorithm. Specifically, the anomaly detection algorithm obtains a mask result by performing mask processing on the time series data, and then performs anomaly detection through the mask result.

[0004] However, since the fixed mask proportion is usually used to mask the time series data when the time series data is masked, there may be unreasonable mask processing of some time series data, which affects the accuracy of the anomaly detection of the time series data. SUMMARY

[0005] The present application provides a time series data anomaly detection method, device, electronic equipment and storage medium to at least solve the problem that the fixed mask proportion affects the accuracy of anomaly detection in related technologies.

[0006] The present application provides a time series data anomaly detection method, comprising: obtaining time series data of a to-be-detected indicator of a target device; performing correlation analysis on the time series data to determine an importance degree parameter of the to-be-detected indicator, and performing stability analysis on the time series data to determine a stability parameter of the to-be-detected indicator; determining a mask proportion for mask processing of the time series data based on the importance degree parameter and the stability parameter; determining a mask processing result of the time series data based on the mask proportion, and determining an anomaly detection result of the corresponding time series data based on the mask processing result.

[0007] The application further provides an abnormality detection device of time series data, comprising: an acquisition module configured to acquire time series data of a to-be-detected index of a target device; an analysis module configured to perform correlation analysis on the time series data to determine an importance parameter of the to-be-detected index, and perform stability analysis on the time series data to determine a stability parameter of the to-be-detected index; a determination module configured to determine a mask proportion of mask processing of the time series data based on the importance parameter and the stability parameter; and a detection module configured to determine a mask processing result of the time series data based on the mask proportion, and determine an abnormality detection result of the corresponding time series data based on the mask processing result.

[0008] The application further provides an electronic device, comprising: a memory configured to store a computer program; and a processor configured to implement the steps of the abnormality detection method of time series data when executing the computer program.

[0009] The application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and the computer program is configured to implement the steps of the abnormality detection method of time series data when executed by a processor.

[0010] The application further provides a computer program product, comprising a computer program, and the computer program is configured to implement the steps of the abnormality detection method of time series data when executed by a processor.

[0011] According to the application, the time series data of the to-be-detected index is acquired, and the correlation analysis and the stability analysis are performed based on the time series data to obtain the importance parameter and the stability parameter of the to-be-detected index. Then, the mask proportion of mask processing of the time series data is determined based on the importance parameter and the stability parameter, the mask processing result of the time series data is determined based on the mask proportion, and the abnormality detection is performed based on the mask processing result to obtain the abnormality detection result. That is, the mask proportion is determined according to the importance parameter and the stability parameter of the to-be-detected index, and the importance parameter and the stability parameter are obtained by performing the correlation analysis and the stability analysis on the time series data. Therefore, the mask proportion is dynamically determined according to the characteristics of the time series data. Compared with setting a fixed mask proportion, the mask proportion determined based on the importance parameter and the stability parameter can effectively avoid the unreasonable mask processing of the to-be-detected index, and thus the accuracy of the abnormality detection of the time series data can be effectively improved. BRIEF DESCRIPTION OF DRAWINGS

[0012] In order to more clearly illustrate the embodiments of the present application, the drawings needed to be used in the embodiments will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without any creative effort.

[0013] Figure 1 The structural block diagram of a computer device for a time series data anomaly detection method provided by the embodiments of the present application is shown in FIG. 1.

[0014] Figure 2 One of the flowcharts of a time series data anomaly detection method provided by the embodiments of the present application is shown in FIG. 2.

[0015] Figure 3 The second flowchart of a time series data anomaly detection method provided by the embodiments of the present application is shown in FIG. 3.

[0016] Figure 4 The third flowchart of a time series data anomaly detection method provided by the embodiments of the present application is shown in FIG. 4.

[0017] Figure 5 The fourth flowchart of a time series data anomaly detection method provided by the embodiments of the present application is shown in FIG. 5.

[0018] Figure 6 The structural block diagram of a time series data anomaly detection device provided by the embodiments of the present application is shown in FIG. 6. DETAILED DESCRIPTION

[0019] The technical solutions in the embodiments of the present application will be described clearly and completely in combination with the drawings in the embodiments of the present application. Obviously, the described embodiments are only some embodiments of the present application, but not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without any creative effort are within the protection scope of the present application.

[0020] It should be noted that, in the description of the present application, the terms “include”, “contain” or any other variants thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such process, method, article or device. The terms “first”, “second” and the like in the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence.

[0021] In order to make those skilled in the art better understand the present application, the present application will be further described in detail below in combination with the drawings and specific embodiments.

[0022] The method for detecting time series data anomaly provided in the embodiments of the present application can be executed in a computer device or similar computing device, and is taken as an example of running on a computer device, Figure 1 is a hardware structure block diagram of a computer device of a method for detecting time series data anomaly according to an embodiment of the present application. As shown in Figure 1 , the computer device can include one or more (only one is shown in Figure 1 ) processor 102 (the processor 102 can include but not limited to a central processing unit CPU, a microprocessor MCU or a programmable logic device FPGA processing device) and a memory 104 for storing data, wherein the above computer device can further include a transmission device 106 for communication function and an input and output device 108. Those skilled in the art can understand that Figure 1 the structure shown is only schematic, which does not limit the structure of the above computer device. For example, the computer device can further include more or less components than those shown in Figure 1 , or have a different configuration from that shown in Figure 1 .

[0023] The memory 104 can be used to store computer programs, such as software programs of application software and modules, such as the computer program corresponding to the method for detecting time series data anomaly in the embodiments of the present application. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, that is, implements the above method. The memory 104 can include a high-speed random access memory, and can also include a non-volatile memory, such as one or more magnetic storage devices, flash memories, or other non-volatile solid state memories. In some examples, the memory 104 can further include a memory remotely arranged with respect to the processor 102, which can be connected to the computer device through a network. Examples of the above network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network and a combination thereof.

[0024] The transmission device 106 is used to receive or transmit data via a network. The specific examples of the above network can include a wireless network provided by a communication provider of the computer device. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, NIC) which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (Radio Frequency, RF) module which is used to communicate with the Internet in a wireless manner.

[0025] Embodiments of the present application provide an anomaly detection method for time series data, which is applied to the above computer device. The anomaly detection method for time series data is described in detail in combination with the execution flow of the anomaly detection method for time series data. As shown in Figure 2 The method comprises the following steps S202-S208:

[0026] S202, acquiring time series data of a to-be-detected index of a target device.

[0027] The target device refers to a physical or virtual server, network device, storage device, or application service node that needs to be monitored and analyzed for performance status. In a cloud computing system, the target device can be a basic component of the cloud computing system, and its health status and performance directly affect the stability and efficiency of the entire cloud computing system.

[0028] It should be noted that the to-be-detected index refers to a key parameter that can reflect the running state or performance of the target device. For the target device, at the infrastructure level, the to-be-detected index can include: CPU (Central Processing Unit Utilization) usage, GPU (Graphics Processing Unit Load) load, memory occupancy, disk I / O (Input / Output Operations per Second) operation rate, network bandwidth usage, network delay, etc. At the application program level, the to-be-detected index can include: response time, request success rate, error rate, number of concurrent users, process resource consumption, etc.

[0029] The time series data refers to data collected in time sequence to represent the state change of the to-be-detected index. The time series data includes a plurality of data points, each data point including a timestamp and a data value corresponding to the timestamp. The time series data can be obtained by periodic sampling, and is used for analyzing target device running trends, predicting future states, anomaly detection, etc. For example, CPU usage data recorded once every minute, network traffic data collected every 5 minutes, etc. all belong to time series data.

[0030] In some embodiments, in an industrial automation environment, the target device of the production line needs to be detected for anomaly. Taking an automated production line producing automobile parts as an example, the target device can include various robots, conveyors, machining centers, etc. The to-be-detected index can cover temperature, pressure, speed, vibration frequency, current consumption, etc. The time series data of these indexes reflects the running state and health level of the device. By periodically collecting (e.g., every minute or every 5 minutes) data of these indexes and recording timestamps, time series data is formed.

[0031] S204, performing correlation analysis on the time series data to determine an importance parameter of the to-be-detected indicators, and performing stability analysis on the time series data to determine a stability parameter of the to-be-detected indicators.

[0032] It should be noted that correlation analysis is used to measure the degree of mutual dependence between two or more variables. In the context of anomaly detection, correlation analysis is specifically used to identify which to-be-detected indicators are more likely to be affected by changes in abnormal states, which helps to determine which to-be-detected indicators are more critical for detecting abnormal states. Specifically, when performing correlation analysis, mutual information, Pearson correlation coefficient or other correlation measures can be calculated to quantify the strength of the correlation between the degree of mutual dependence between variables.

[0033] The importance parameter refers to the quantitative evaluation of the sensitivity and contribution of the to-be-detected indicators to the overall system state in anomaly detection. Indicators with higher importance parameters mean that their changes are more likely to indicate abnormalities, so they should be given more attention in anomaly detection algorithms. The determination of the importance parameter is based on the results of correlation analysis, by identifying which indicators have the strongest correlation with abnormal states, to determine which indicators are most critical in detecting anomalies.

[0034] Stability analysis refers to the process of evaluating the volatility or degree of change of time series data. Stability analysis is used to determine whether the to-be-detected indicators have stable numerical characteristics, i.e., whether the values of the indicators are relatively stable under normal operating conditions, or whether they are easily affected by environmental and load changes to produce large fluctuations. To-be-detected indicators with high volatility (i.e., poor stability) may be more difficult to predict and more likely to produce false positives, so they need to be handled with caution in anomaly detection.

[0035] The stability parameter is an indicator that quantifies the degree of volatility of time series data. It is usually obtained by calculating statistical quantities such as the coefficient of variation, standard deviation, etc. of the indicators. The coefficient of variation is the ratio of the standard deviation to the mean, which is used to standardize the degree of volatility of the indicators, especially when the magnitudes of different indicators differ greatly. The coefficient of variation can provide a fair volatility comparison standard.

[0036] In some embodiments, the computer device can obtain time series data of multiple performance indicators, including CPU usage, GPU load, memory occupancy, disk I / O operation rate, network bandwidth usage, etc. Through correlation analysis, the computer device can determine that CPU usage and memory occupancy have a high importance degree parameter in detecting anomalies, especially for identifying anomalies related to resource overload. Through stability analysis, the computer device can identify that network bandwidth usage is a less stable indicator, as it has significant fluctuations between high-traffic and low-traffic periods, while disk I / O operation rate shows high stability, as its value is relatively stable even when server load changes. Therefore, the stability parameter of network bandwidth usage is low, indicating that its volatility needs to be considered in anomaly detection.

[0037] In S206, a mask ratio for masking the time series data is determined based on the importance degree parameter and the stability parameter.

[0038] The mask ratio refers to the ratio between the selected data points for hiding (i.e., masking) and the total data points in the time series data. This ratio is determined based on the importance degree parameter and the stability parameter of the to-be-detected indicator, maximizing the accuracy of anomaly detection.

[0039] In some embodiments, based on correlation analysis and stability analysis, the computer device determines the mask ratio by combining the importance degree parameter and the stability parameter. If the computer determines that CPU usage and network bandwidth usage are two indicators with high importance degree parameters, and the stability parameters of CPU usage and network bandwidth usage are low, the computer device can set the weights of the importance degree parameter and the stability parameter, and then determine the mask ratio based on the weights.

[0040] In S208, the masking result of the time series data is determined based on the mask ratio, and the anomaly detection result of the corresponding time series data is determined based on the masking result.

[0041] The masking result refers to the data set obtained after the hiding operation on the time series data according to the determined mask ratio. The anomaly detection result is the pattern or value that is significantly different from the normal operation behavior identified after analyzing the processed time series data.

[0042] Specifically, for the time series data of the to-be-detected indicator, a certain proportion of data points can be randomly selected for hiding according to the pre-calculated mask ratio. This process aims to simulate the situation where some data may be missing or affected by noise in the anomaly detection scenario, and also serves as a data augmentation technique to help learn the internal dependencies and anomaly patterns of the to-be-detected indicator.

[0043] The steps S202-S208 described above obtain time series data of the to-be-detected indicator, and perform correlation analysis and stability analysis based on the time series data respectively to obtain the importance degree parameter and the stability parameter of the to-be-detected indicator. Then, the mask proportion of the mask processing on the time series data can be determined based on the importance degree parameter and the stability parameter, and the mask processing result of the time series data is determined by the mask proportion. The abnormality detection is performed based on the mask processing result, and the abnormality detection result is obtained. That is, the mask proportion is determined according to the importance degree parameter and the stability parameter of the to-be-detected indicator, and the importance degree parameter and the stability parameter are obtained by performing correlation analysis and stability analysis on the time series data respectively. That is, the mask proportion is dynamically determined according to the characteristics of the time series data. Compared with setting a fixed mask proportion, the mask proportion determined based on the importance degree parameter and the stability parameter can effectively avoid unreasonable mask processing on the to-be-detected indicator, and thus the accuracy of the abnormality detection can be effectively improved.

[0044] In some example embodiments, as shown in FIG. 3, Figure 3 The correlation analysis on the time series data to determine the importance degree parameter of the to-be-detected indicator can be implemented by the following steps S302-S306.

[0045] S302, based on a preset time splitting step, splitting the time series data to obtain time series sub-data corresponding to a plurality of time windows respectively;

[0046] S304, performing correlation analysis on the time series sub-data corresponding to the plurality of time windows respectively to determine the importance degree parameters of the plurality of time windows;

[0047] S306, determining the importance degree parameter of the to-be-detected indicator based on the importance degree parameters of the plurality of time windows.

[0048] It should be noted that the time splitting step refers to the step or frequency of dividing continuous time series data into a series of fixed length segments (i.e., time windows) when processing the time series data. The time splitting step can be determined by the data sampling frequency and the time resolution requirement of the abnormality detection. For example, if the time series data is collected at a frequency of once per minute, and the abnormality detection needs to be evaluated every 10 minutes, the time splitting step can be 10 data points (i.e., 10 minutes).

[0049] The time series sub-data refers to the data segment in each time window after the time series data is divided into a plurality of time windows according to the time splitting step.

[0050] Specifically, time series data of the CPU usage rate, the memory occupancy rate, the network delay, the disk I / O waiting detection index, etc. can be split based on a set time split step, for example, 5 minutes, and split into a series of time window data every 5 minutes, each time window data containing a sequence of values of each index in the time window. Correlation analysis, such as mutual information and Pearson correlation coefficient, is performed on the time series data in each time window to evaluate the correlation between the to-be-detected index and the abnormal state. For example, the memory occupancy rate has a high mutual information value in a certain time window, indicating that the memory occupancy rate has high importance in detecting abnormalities in the time window.

[0051] In some embodiments, according to the results of the correlation analysis, an importance parameter can be assigned to the to-be-detected index in each time window. The importance parameter can be a direct quantification of the mutual information value, or a result obtained by sorting and normalizing the mutual information value.

[0052] In the above embodiments, the time series data is split into a plurality of time window data by using a time split step, and the importance parameter of the to-be-detected index is determined by performing correlation analysis on the time window data, and then the importance parameter can be used to guide the determination of the mask ratio, optimize the abnormality detection process, and improve the accuracy of abnormality detection.

[0053] In some example embodiments, the correlation analysis is performed on the time series data corresponding to the plurality of time windows to determine the importance parameters of the plurality of time windows, including: determining a probability distribution value of any time window of the plurality of time windows for the time series data of the any time window; wherein the probability distribution value includes a joint probability distribution value between the time series data of the any time window and the set abnormal time series data, a first edge probability distribution value of the time series data of the any time window, and a second edge probability distribution value of the set abnormal time series data of the any time window; taking the logarithm of the joint probability distribution value, the first edge probability distribution value, and the second edge probability distribution value of the time series data of the any time window to obtain a logarithmic value; the logarithmic value is used to represent the correlation degree between the time series data of the any time window and the abnormal time series data; and the importance parameter of the any time window is assigned based on the product of the probability distribution value and the logarithmic value of the any time window to determine the importance parameters of the plurality of time windows.

[0054] The joint probability distribution value refers to the probability distribution of the co-occurrence of two or more random variables. In the abnormality detection scenario, it refers to the co-occurrence probability between the time series data in the any time window and the pre-defined abnormal time series data pattern. The first edge probability distribution value reflects the probability of the occurrence of the time series data in the any time window, and the second edge probability distribution value reflects the probability of the occurrence of the abnormal time series data in the any time window.

[0055] The logarithmic value is obtained by taking the logarithm of the joint probability distribution value, the first marginal probability distribution value, and the second marginal probability distribution value. The magnitude of the logarithmic value can reflect the degree of association between the time series sub-data and the abnormal time series data. The greater the logarithmic value, the stronger the association.

[0056] Specifically, for each time window, based on the joint probability distribution function, the joint probability distribution value between the time series sub-data and the abnormal time series data in each window can be determined, and based on the marginal probability distribution function, the first marginal probability distribution value and the second marginal probability distribution value can be determined. According to the obtained joint probability distribution value, the first marginal probability distribution value and the second marginal probability distribution value, the data in each time window is logarithmically converted to obtain a logarithmic value. The magnitude of the logarithmic value reflects the degree of association between the data in the time window and the abnormal state.

[0057] In some embodiments, the importance degree parameters of the plurality of time windows can be analyzed to obtain the importance degree of the to-be-detected indicator. Specifically, this can be done by simple average, weighted average or more complex statistical methods. When summarizing, the dynamic characteristics of time series data can be considered, that is, the importance degree parameters at different time points can change with the environment, and the weights of the importance degree parameters of the time windows can be appropriately adjusted to reflect the importance of recent data or the influence of long-term trends. The importance degree parameter obtained by the summary analysis can represent the importance degree of the to-be-detected indicator in the abnormal detection as a whole.

[0058] In the above embodiments, by deeply analyzing the probability distribution and logarithmic conversion of the data in multiple time windows, the correlation between the data in different time windows and the specific abnormal state can be effectively quantified, and then a reasonable importance degree parameter can be assigned to each time window, which is of great significance for optimizing the abnormal detection strategy and improving the accuracy and timeliness of abnormal detection.

[0059] In some example embodiments, the stability analysis on the time series data to determine the stability parameter of the to-be-detected indicator comprises: determining the mean and standard deviation of the time series data, and determining the stability parameter of the time series data based on the quotient of the mean and standard deviation of the time series data; and determining the stability parameter of the time series data as the stability parameter of the to-be-detected indicator.

[0060] The mean is the average of all observations in the time series data, which represents the general level or central position of the data. The mean can help understand the average performance of the to-be-detected indicator over a period of time, such as average CPU usage, average network latency, etc.

[0061] The standard deviation is a measure of the degree of fluctuation of observations around the mean in time series data. The larger the standard deviation, the more significant the difference between data points and the mean, i.e. the higher the volatility or instability of the data. The standard deviation can reveal the fluctuation of a certain indicator over a period of time, helping to identify the stability of the data.

[0062] Specifically, the stability parameter is calculated based on the mean and standard deviation of the time series data. By calculating the quotient of the mean and the standard deviation (i.e. the coefficient of variation), a numerical value that measures the stability of the data can be obtained. The smaller the coefficient of variation, the higher the stability of the data, i.e. the change in data points is relatively small and the fluctuation around the mean is not large; on the contrary, the larger the coefficient of variation, the lower the stability of the data, the difference between data points is significant and more susceptible to abnormal factors.

[0063] In the above embodiments, the volatility of the to-be-detected indicator is identified based on the stability parameter, and the determination of the mask proportion is further based on the stability parameter, which can improve the overall performance and reliability of the anomaly detection.

[0064] In some example embodiments, based on the importance parameter and the stability parameter, the mask proportion for masking the time series data is determined, including: determining a first weight and a second weight; wherein the first weight is greater than the second weight; obtaining a first product based on the importance parameter and the first weight, and obtaining a second product based on the stability parameter and the second weight; determining the mask proportion for masking the time series data based on the sum of the first product and the second product.

[0065] The first weight is used to emphasize the influence of the importance parameter on the mask proportion. Since the importance parameter is directly related to the contribution of the indicator to anomaly detection, the first weight can be set to a higher value. The second weight is used to measure the influence of the to-be-detected stability parameter in the determination of the mask proportion. Compared with the first weight, the second weight is usually set to be lower, because the stability parameter reflects the volatility of the to-be-detected indicator itself, and the to-be-detected indicator with higher volatility may have lower contribution to anomaly detection.

[0066] The mask proportion refers to the proportion of indicator values in the time series data that are masked (i.e. hidden or not involved in model training) in each time window. The determination of the mask proportion is based on two aspects: the importance of the indicator and the stability of the indicator. The calculation of this proportion aims to balance the learning needs of the model for key indicators and the processing strategy for unstable indicators to achieve the best anomaly detection effect.

[0067] In some embodiments, the importance degree parameters of the plurality of time windows can be subjected to a summary analysis to obtain an importance degree parameter of the to-be-detected indicator. Specifically, the summary analysis can be completed by simple averaging, weighted averaging, or more complex statistical methods. When summarizing, the dynamic characteristics of the time series data can be considered, i.e., the importance degree parameters at different time points can change with the environment, and the weights of the importance degree parameters of the time windows can be appropriately adjusted to reflect the importance of recent data or the influence of long-term trends. The importance degree parameter obtained through the summary analysis can represent the importance degree of the to-be-detected indicator in anomaly detection as a whole. When determining the mask proportion, the mask proportion can be determined based on the stability parameter of the to-be-detected indicator and the importance degree parameter obtained through the summary analysis, and the mask proportion can be subjected to weighted processing, so that the time series sub-data of different time windows of the same to-be-detected indicator can be subjected to uniform mask processing, thereby improving the mask efficiency. Of course, the mask proportions used for the time series sub-data of different time windows of the same to-be-detected indicator can also be different, i.e., the importance degree parameters of each time window do not need to be summarized, and the importance degree parameters of each time window and the stability parameter of the to-be-detected indicator can be respectively expanded for calculation when calculating the mask proportion. This more fine-grained determination of the mask proportion is determined according to time windows with finer granularity, which can effectively improve the accuracy of subsequent anomaly detection.

[0068] In one specific application, a higher weight (assumed to be 0.7) is assigned to the importance degree parameter, and a lower weight (assumed to be 0.3) is assigned to the stability parameter. The importance degree parameter can be processed first (such as determining the difference between 1 and the importance degree parameter), the difference obtained is multiplied by the first weight (0.7) to obtain a first product, and because the higher the importance degree determined by the importance degree parameter, the mask proportion can be adaptively reduced, and the lower the importance degree, the mask proportion can be adaptively increased, this dynamic adjustment effectively improves the accuracy of anomaly detection; at the same time, the stability parameter is multiplied by the second weight (0.3) to obtain a second product. For example, for the CPU usage rate indicator, assuming that the importance degree parameter is 0.8 and the stability parameter is 0.2, the first product is (1-0.8)*0.7=0.14, and the second product is 0.2*0.3=0.06. Based on the sum of the first product and the second product, the mask proportion of the CPU usage rate indicator in each time window is determined. For example, if the sum of the first product and the second product is 0.2 (i.e., 0.14+0.06), the mask proportion can be set to 20%.

[0069] In the above embodiments, by setting different weights and dynamically adjusting the mask proportion based on the importance degree and the stability parameter, more accurate anomaly detection can be achieved.

[0070] In some example embodiments, determining the first weight and the second weight comprises: determining a first number of first detection indicators in the to-be-detected indicators, and a second number of second detection indicators in the to-be-detected indicators; wherein the first detection indicators refer to detection indicators whose importance degree parameters are greater than a preset importance degree threshold; the second detection indicators refer to detection indicators whose stability parameters are less than a preset stability threshold; comparing the first number with a first number threshold to obtain a first comparison result, and comparing the second number with a second number threshold to obtain a second comparison result; determining the first weight based on the first comparison result, and determining the second weight based on the second comparison result.

[0071] In some example embodiments, the first detection indicators refer to indicators in the to-be-detected indicators whose importance degree parameters are greater than a preset importance degree threshold. These indicators are considered to play a key role in anomaly detection. In contrast, indicators whose stability parameters are less than a preset stability threshold are considered as the second detection indicators.

[0072] Specifically, the computer device can count the number of all first detection indicators, i.e., how many indicators have importance degree parameters exceeding the first number threshold. The number of all second detection indicators is counted, i.e., how many indicators have stability parameters less than the second preset threshold. The first number is compared with a preset first number threshold, which aims to evaluate the density of key indicators. If the first number is much greater than the first number threshold, it means that there are a large number of key indicators, and vice versa. Similarly, the second number is compared with a preset second number threshold to check the density of unstable indicators. A high second number can mean that there are more volatile indicators, and a low second number indicates that the data is relatively stable. If the first number is much greater than the first number threshold (i.e., there are a large number of key indicators), the first weight can be set to be relatively high, such as 0.7 or 0.8, to ensure more attention to these key indicators and improve the accuracy of anomaly detection. If the second number is much greater than the second number threshold (i.e., there are more volatile indicators), the second weight can be set to be relatively low, such as 0.2 or 0.3, to reduce the excessive dependence on these unstable indicators and avoid the increased false positive rate due to data fluctuations.

[0073] In the above embodiments, in the process of determining the first weight and the second weight, the key is to count the number according to the importance degree and stability of the indicators and compare the number with the threshold, and dynamically adjust the weight based on the comparison result, so as to achieve the purpose of optimizing the model training and anomaly detection strategy in different business scenarios and time windows. This method can be flexibly applied to anomaly detection scenarios to improve the robustness and accuracy of anomaly detection.

[0074] In some example embodiments, determining the mask processing result of the time series data based on the mask proportion comprises: determining time series sub-data of a plurality of time windows of the time series data; wherein the time series sub-data of any time window is obtained by splitting the time series data based on a preset time splitting step; and selecting data from the time series sub-data of the plurality of time windows respectively for mask processing based on the mask proportion to obtain mask data and unmasked data corresponding to the plurality of time windows respectively; wherein the mask processing result comprises the mask data and the unmasked data corresponding to the plurality of time windows respectively.

[0075] Specifically, for the time series sub-data of each time window, part of the data is selected for mask processing according to the mask proportion randomly or according to a specific strategy. The mask operation can be replacement of data values (such as replacement with zero or a specific value) or complete deletion of data values, thereby simulating data loss or abnormality in a real scenario. In addition to the data that is processed by mask, the remaining data in each time window is retained as unmasked data, which can be used as prompt information or input features for training a model to predict the data values that are masked.

[0076] In the above embodiments, determining the mask processing result of the time series data based on the mask proportion is a key step for anomaly detection. By dividing the time series data into a plurality of time windows and dynamically adjusting the mask proportion according to the importance and stability parameters of the indicators in each window, and then performing mask processing on the time series sub-data of the plurality of time windows according to the mask proportion, the mask processing result obtained can effectively improve the accuracy of subsequent anomaly detection.

[0077] In some example embodiments, as shown in Figure 4 The above determination of the anomaly detection result of the corresponding time series data based on the mask processing result can be implemented through the following steps S402-S406:

[0078] S402, determining time series sub-data corresponding to a plurality of time windows of the time series data respectively; wherein the time series sub-data of any time window is obtained by splitting the time series data based on a preset time splitting step;

[0079] S404, performing anomaly prediction on the time series sub-data of any time window based on a pre-trained anomaly detection model, the mask data and the unmasked data of the time series sub-data of any time window in the plurality of time windows, to obtain a detection result for the time series sub-data of any time window;

[0080] S406, determining the anomaly detection result of the corresponding time series data based on the detection results corresponding to the plurality of time windows respectively.

[0081] The anomaly detection model is a neural network model based on a deep learning architecture that has been pre-trained on a large amount of data and has basic ability to process time series data. The anomaly detection model can be a large model, which is a machine learning model with a large parameter size and complexity. Specifically, it can refer to a neural network model with tens to hundreds of billions of parameters. The large model itself has good text understanding and generation capabilities.

[0082] Specifically, the unmasked data of any time window can be input to the anomaly detection model as a prompt prefix. At the same time, the anomaly detection model needs to predict the masked data, i.e., the masked data. The unmasked data and the masked data together constitute the input and target output of the anomaly detection model. The anomaly detection model predicts the value of the masked data based on the unmasked data (prompt prefix). The prediction process is essentially an attempt to reconstruct the complete time series sub-data. Based on this reconstruction process, the anomaly detection model can learn the correlation between different indicators and the behavior patterns of normal data. If the difference between the predicted value of the anomaly detection model and the actual masked data value is too large, it is considered that the time window is abnormal, otherwise it is considered normal.

[0083] In some embodiments, for each time window, the anomaly detection model predicts the corresponding detection result, including determining whether the window is abnormal and the degree of abnormality. These detection results provide immediate feedback on the status of the target device, helping to quickly locate potential problem areas. After determining the detection results of all time windows, a comprehensive analysis is performed to determine whether the entire time series data stream is abnormal and the duration and severity of the abnormality. This step can be completed by calculating the proportion of abnormal windows, the average degree of abnormality, or the sequence pattern of abnormal windows, so that the operation and maintenance personnel have a clear understanding of the overall system status.

[0084] In the above embodiments, under the framework of dynamic mask prompt learning, the anomaly detection result of the time series data is determined based on the mask processing result, which is a multi-step process involving data slicing, model prediction, and result integration. Through time window division and mask strategy, combined with pre-trained anomaly detection model, real-time and accurate detection of abnormal state can be achieved, providing reliable data support for decision makers and effectively dealing with emergencies and system failures.

[0085] In some example embodiments, based on the pre-trained anomaly detection model, the mask data of the time series sub-data of any of the plurality of time windows, and the unmasked data, the time series sub-data of any of the plurality of time windows is subjected to anomaly prediction, and a detection result for the time series sub-data of any of the plurality of time windows is obtained, including: performing text processing on the unmasked data of the time series sub-data of any of the plurality of time windows to obtain a text processing result; inputting the text processing result into the anomaly detection model to enable the anomaly detection model to perform anomaly prediction based on the text processing result to obtain a prediction value; comparing the prediction value with a true value determined by the mask data to obtain an error result; and comparing the error result with a set dynamic error threshold to obtain an anomaly detection result for any of the plurality of time windows.

[0086] It should be noted that text processing is a step of converting a numerical sequence into an input format that can be understood by the anomaly detection model. For example, for a time series sub-data containing CPU usage, memory occupancy and other indicators, the numerical sequence is first converted into a text sequence through a mapping rule (such as one-to-one correspondence between numerical values and words) to facilitate subsequent input into the anomaly detection model for prediction. After conversion, the obtained text sequence is in a form ready for input into the anomaly detection model. This text processing result contains all the information in the time series sub-data that is not hidden and is the basis for the anomaly detection model to predict the mask data.

[0087] In some embodiments, for any of the plurality of time windows, the obtained text processing result is input into the pre-trained anomaly detection model as input. The anomaly detection model outputs a prediction value for the mask data based on the input text processing result. This process involves complex calculations inside the model, including but not limited to activation attention mechanisms, feedforward layers, and normalization layers, to capture the association rules between different indicators and apply these rules to the prediction. The prediction value of the model is compared with the actual mask data value to calculate the difference or error between them. Common error metrics include mean squared error (MSE), which is the average of the squared differences between the model's prediction value and the true value. The smaller the MSE, the more accurate the model's prediction. The error result is obtained by error calculation, and the error result is compared with the dynamic error threshold. If the error exceeds the dynamic error threshold, it means that the anomaly detection model's prediction of some indicators in the current time window deviates significantly, which may be due to the presence of abnormal conditions. Therefore, if the error is greater than the dynamic error threshold, the current time window is marked as abnormal, and vice versa.

[0088] In some embodiments, the dynamic error threshold is not fixed, but is dynamically adjusted according to the trend and changes of recent data. The dynamic error threshold can be set according to the distribution characteristics of historical time window data, and the setting of the dynamic error threshold can ensure that the anomaly detection model can adapt to the seasonal, periodic or other fluctuation characteristics of the data distribution.

[0089] In the above embodiments, the unmasked data is converted into text and input into the model for anomaly prediction, and then compared with the actual value of the masked data for error comparison, and finally combined with the dynamic error threshold to determine the anomaly detection result of each time window, which is a highly adaptive and accurate detection scheme.

[0090] In some exemplary embodiments, the determination method of the dynamic error threshold comprises: in the case that the time window of the time series sub-data belongs to the initial time window of the plurality of time windows, based on the set number of time windows, taking the first window in the plurality of time windows as the starting window, determining a first target time window of the number of time windows, and calculating the dynamic error threshold based on the mean and standard deviation of the time series sub-data of the first target time window; in the case that the time window of the time series sub-data does not belong to the initial time window of the plurality of time windows, based on the set number of time windows, taking the time window of the time series sub-data as the terminal window, determining a second target time window of the number of time windows, and calculating the dynamic error threshold based on the mean and standard deviation of the terminal window, the mean and standard deviation of the time series sub-data of the second target time window.

[0091] Wherein, the initial time window refers to the first or first few time windows (such as the first 5, the first 10, the first 15) selected in the anomaly detection process for the initialization of the model or statistical method.

[0092] Specifically, when the processed time window is the initial time window in the sequence of multiple time windows, the determination of the dynamic error threshold is based on the statistical analysis of a sliding window. Specifically, based on the set number of time windows (for example, the last 10 time windows), taking the first window in the sequence as the starting point, a sequence containing consecutive time windows is determined as the first target time window. Statistical analysis is performed on all time series sub-data in the first target time window, and the overall mean and standard deviation of the data in these windows are calculated, and then the dynamic error threshold is calculated.

[0093] For non-initial time windows, i.e. the processed time window is not the initial time window in the sequence, the determination method of the dynamic error threshold is slightly different, based on the set number of time windows (for example, still the last 10 time windows), taking the currently processed time window as the terminal point, and determining a sequence containing consecutive time windows as the second target time window by backtracking. Further calculate the mean and standard deviation of all time series sub-data in the second target time window, and then calculate the dynamic error threshold.

[0094] In the above embodiment, the determination of the dynamic error threshold, whether for the initial time window or the subsequent non-initial time windows, is based on statistical analysis and a sliding window mechanism to adapt to the dynamic characteristics of time series data, so as to improve the accuracy of anomaly detection.

[0095] In some exemplary embodiments, text processing is performed on the unmasked data of the time series sub-data of any time window to obtain a text processing result, including: splicing the unmasked data of the time series sub-data in chronological order to obtain a spliced ​​numerical sequence; and performing text conversion on the spliced ​​numerical sequence to obtain a text processing result.

[0096] Specifically, within each time window, according to the dynamic masking strategy, a portion of the indicator data is masked, while the other portion is retained as unmasked data. The unmasked data contains all indicator information that can be directly utilized by the model within the current time window. According to the inherent order of the time series, all unmasked indicator data within the same time window are spliced ​​to form a continuous numerical sequence. In order for the numerical sequence to be processed by the anomaly detection model, these numerical values ​​need to be converted into text form. This usually involves defining a mapping rule from numerical values ​​to text vocabulary, for example, mapping numerical values ​​in a specific range to a specific vocabulary or character sequence. According to the defined conversion rule, each numerical value in the spliced ​​numerical sequence is converted into the corresponding text vocabulary. In this way, the entire numerical sequence is converted into a sequence composed of text vocabulary, that is, the text processing result.

[0097] In the above embodiment, text processing is performed on the unmasked data of the time series sub-data through the splicing of numerical sequences and text conversion, and the original data is converted into an input format that can be processed by the anomaly detection model. This process can effectively utilize the advantages of the anomaly detection model in text understanding and improve the accuracy and efficiency of anomaly detection.

[0098] In some exemplary embodiments, the training steps of the anomaly detection model include: obtaining sample time series data of the indicator to be detected of the target device; performing correlation analysis on the sample time series data to determine the sample importance parameter of the indicator to be detected, and performing stability analysis on the sample time series data to determine the sample stability parameter of the indicator to be detected; determining the sample mask ratio for masking the sample time series data based on the sample importance parameter and the sample stability parameter; determining the mask processing result of the sample time series data based on the sample mask ratio, and fine-tuning the first parameter of the attention mechanism layer, the second parameter of the feedforward layer, and the third parameter of the normalization layer of the anomaly detection model to be trained based on the sample mask processing result to obtain a trained anomaly detection model.

[0099] It can be understood that when training the anomaly detection model, the sample time series data of the to-be-detected indicators can be obtained from the target device (such as a server, a network node, etc.), arranged in chronological order, and formed into a time series data set. Similarly, the sample time series data is also subjected to correlation analysis and stability analysis, and the mask proportion is determined based on the sample importance parameter and the sample stability parameter. The way of determining the mask proportion in training is the same as above, and will not be repeated here. Generally, for indicators with high sample importance parameters and low sample stability parameters, the mask proportion should be reduced so that they can participate more in model learning during the training process; and for indicators with low sample importance parameters and high sample stability parameters, the mask proportion can be appropriately increased to avoid the model paying too much attention to these indicators with large fluctuations and ignoring the real abnormal signals.

[0100] Based on the determined sample mask proportion, the sample time series data is subjected to mask processing, that is, part of the indicator data is hidden randomly or according to a specific strategy. This processing produces two parts of masked data and unmasked data. The unmasked data will be used as the input of the to-be-trained anomaly detection model, referred to as "prompt word" or "prefix input". The unmasked data (prompt word prefix) is input into the to-be-trained anomaly detection model to activate and fine-tune the parameters of the attention mechanism layer, the feed-forward layer and the normalization layer of the to-be-trained anomaly detection model to adapt to the characteristics of the multi-indicator data and the input format after mask processing.

[0101] In a specific application, the unmasked data can be spliced into a numerical sequence in chronological order, and then converted into a text sequence as the prompt word input of the to-be-trained anomaly detection model. During model training, the parameters of the attention mechanism layer (Attention Layers), the feed-forward network layer (Feed-Forward Networks) and the layer normalization layer (LayerNormalization) are updated to minimize the prediction error (such as MSE) of the model on the masked data. Through iterative training, the to-be-trained anomaly detection model can learn how to accurately predict the masked indicator values without abnormal labels, thereby enhancing the model's ability to recognize abnormal patterns.

[0102] In the above embodiments, the training process of the anomaly detection model is a meticulous and complex process, which covers multiple links such as data collection, analysis, mask processing and parameter fine-tuning. Through the strategy of dynamic mask prompt learning, the model can effectively learn the complex characteristics of multi-indicator time series and improve the accuracy and efficiency of anomaly detection.

[0103] In some example embodiments, the first parameters of the attention mechanism layer, the second parameters of the feedforward layer and the third parameters of the normalization layer of the trained anomaly detection model are fine-tuned based on the sample mask processing result, and a trained anomaly detection model is obtained, including: determining a plurality of sample time windows corresponding to sample time sequence sub-data respectively, wherein the sample time sequence sub-data is obtained by splitting the sample time sequence data based on a preset sample time splitting step; performing text processing on the sample unmasked data of the sample time sequence sub-data of any sample time window to obtain a text processing sample; inputting the text processing sample into the trained anomaly detection model to enable the trained anomaly detection model to perform sample anomaly prediction based on the text processing sample to obtain a sample prediction value; comparing the sample prediction value with a sample true value determined by the sample mask data to obtain a sample error result; in the case where the sample error result is greater than a preset sample error threshold, performing parameter adjustment processing on the first parameters of the attention mechanism layer, the second parameters of the feedforward layer and the third parameters of the normalization layer of the anomaly detection model, and continuing to train the anomaly detection model according to the parameter adjustment processing result until the training end condition is met to stop, and a trained anomaly detection model is obtained.

[0104] It should be noted that before model training, a plurality of time windows can be determined from the sample time sequence data, each window including a set of continuous sample time sequence sub-data. The size of the time window can be adjusted according to the specific business scenario and data characteristics. Based on a preset time splitting step, the sample time sequence data is split into a plurality of sample time sequence sub-data. This step ensures the continuity of the data and the representativeness in time, and also facilitates model processing. For the sample time sequence sub-data of each sample time window, the part not masked is spliced in time sequence to convert into a numerical sequence, and then further converted into a text processing sample. This process converts the numerical time sequence data into a text format that can be understood and processed by the language model.

[0105] Specifically, the text processing sample is input into the anomaly detection model to be trained, and the model uses existing parameters and structures to predict the sample anomaly and output the sample prediction value. This step is part of the model learning process, and through multiple iterations of training, the model gradually optimizes its parameters to improve prediction accuracy. The true value of the sample mask data is obtained, and the sample prediction value output by the model is compared with it to calculate the difference between the two. Usually, mean squared error (MSE) or other error indicators suitable for time series prediction are used. According to the calculated error, the prediction performance of the model under the current parameter setting is evaluated. The sample error result is important feedback information in model training, which is used to guide the fine-tuning of parameters. If the sample error result exceeds the preset sample error threshold (which usually indicates that the prediction performance of the model is poor), the parameters of the attention mechanism layer, the feedforward layer, and the normalization layer of the model are adjusted (parameter adjustment processing). The adjustment is usually done through the backpropagation algorithm, which updates the model parameters based on the error gradient. According to the results of the parameter adjustment processing, the model continues to be trained, constantly receiving new text processing samples and predicting sample anomalies until the prediction error of the model meets the training end condition. This usually means that the prediction error of the model has been reduced to an acceptable level, or the preset number of training rounds has been reached.

[0106] In the above embodiments, the fine-tuning of the parameters of the attention mechanism layer, the feedforward layer, and the normalization layer of the anomaly detection model is achieved through repeated iterations based on the error between the sample prediction value and the sample true value. This process fully utilizes the structural advantages of large language models and can effectively capture complex patterns in multi-index data, improving the accuracy and robustness of anomaly detection.

[0107] The above-described embodiments are only part of the embodiments of the present application, not all. In order to better understand the above method, the above process is described below in conjunction with the embodiments, but it is not used to limit the technical solutions of the embodiments of the present application, specifically:

[0108] In order to solve the problem of low accuracy of anomaly detection, the present application provides a time series data anomaly detection method, as shown in Figure 5 The flowchart of the time series data anomaly detection method provided by the present application is shown in

[0109] S501, data preprocessing: collect sample time series data, fill in missing values in sample time series data, use linear interpolation method to process short time missing (missing time point ≤5), use forward fill to process continuous missing (missing time point >5); correct the abnormal value in the sample time series data, through 3 The principle is to identify abnormal values beyond the normal range and replace them with the mean value of the adjacent time window of the abnormal value. The sample time series data is standardized to convert index data of different magnitudes to the same magnitude, generally as follows:

[0110] For example: wherein is the mean value, is the standard deviation, so that sample time series data of different magnitudes can be directly input into the model to be trained, facilitating model processing.

[0111] S502, dividing time window: the processed sample time series data is divided into several time windows according to the set time window size, which can be dynamically adjusted according to the business scenario. In cloud computing scenarios, 50-100 time points are recommended, and in industrial scenarios and other scenarios with higher real-time requirements, the time points can be shortened to 30.

[0112] S503, correlation analysis and stability analysis. For correlation analysis, the importance of each index in each time window is calculated, and the correlation between the mutual information and the abnormal label is calculated. In the unsupervised scenario, the pseudo label based on the initial model reconstruction error is used instead of the real label, and the formula is as follows:

[0113]

[0114] wherein is the joint probability distribution function of X and Y, and and are the marginal probability distribution functions of X and Y, The higher the value, the more critical the index to anomaly detection. X can refer to time series sub-data, and Y can refer to abnormal time series data.

[0115] For stability analysis, the mask proportion is dynamically adjusted according to the importance and volatility of each index. The volatility can be calculated by the coefficient of variation , wherein μ is the mean value and σ is the standard deviation. The higher the value, the more volatile the index.

[0116] S504, determine the sample mask proportion: for indexes with high importance and low volatility, appropriately reduce the mask proportion; for indexes with low importance and high volatility, appropriately increase the mask proportion.

[0117] S505, mask processing: according to the dynamic mask proportion, mask operation is performed on each time window to obtain the unmasked part and the masked part. First, normalize and to the [0, 1] interval based on the maximum value of all time windows to ensure dimensional consistency. Then calculate the dynamic mask proportion, and the calculation formula is as follows:

[0118]

[0119] wherein, represents the weight, and the default is 0.6, mainly considering that the importance of the index is directly related to the accuracy of the abnormality identification, and the mask proportion of the high importance index (such as importance > 0.7) can be generally lower than 20%; and the volatility more reflects the stability of the index itself, and the high volatility index itself is easy to be disturbed, and the contribution to the abnormality detection is relatively low. Therefore, a higher weight is given to the importance to preferentially guarantee that the key index has a lower mask probability, and the loss of core features is avoided. Of course, the value of the weight a can also be dynamically adjusted according to the data set, and the importance- volatility distribution of all indexes in the data set is calculated: if the proportion of high importance indexes in the data set is more than 75%, it means that the importance index dominates the abnormality detection, and a can be increased to 0.7-0.8 to reduce the mask proportion; if the proportion of low importance and high volatility indexes is more than 60%, a can be reduced to 0.05 to balance the mask strategy of the two types of indexes. Exemplarily: the mask proportion: r = 0.6 (1-0.8) + 0.4 x 0.05 = 0.14, which means that the index has a 14% probability of being masked. According to the dynamic proportion r, each index is selected for masking in each time window to obtain the unmasked part (prompt prefix) and the masked part.

[0120] S506, sample unmasked data input into the trained abnormality detection model: the index values of the unmasked part are spliced in order into a numerical sequence, converted into a text sequence as a prompt prefix, and input into an open source large language model for fine tuning.

[0121] S507, parameter adjustment: activate the attention mechanism, feed-forward layer and normalization layer of the model. In the fine tuning process, the parameters of the attention layer (Attention Layers), feed-forward network layer (Feed-Forward Networks) and normalization layer (Layer Normalization) of the model are updated, and the model is fine tuned using the training data with MSE as the loss function, so that the model can accurately predict the index values of the masked part.

[0122] S508, based on the trained abnormality detection model, the threshold is expanded to obtain the predicted value: in the test stage, the test data is preprocessed and dynamically masked according to the above steps to obtain the unmasked part, and the fine-tuned model is input to obtain the predicted value of the masked part.

[0123] S509, calculate the mean square error (MSE) of the predicted value and the actual masked part.

[0124] S510, determine the dynamic error threshold, which is determined by the distribution characteristics of each time window. For the current time window dynamic error threshold The formula for calculation is as follows:

[0125]

[0126] wherein, , are the mean and standard deviation of the MSE of the past 10 windows respectively. The initial stage (the first 10 windows) uses the statistics of the first 10 windows to calculate the threshold. This formula can calculate the threshold using the historical data of the sliding window, and automatically adjust the threshold when the data distribution of the current time window changes greatly.

[0127] S511, determining whether the mean square error is greater than the dynamic error threshold;

[0128] S512: if the current window , it is determined that the time window is abnormal;

[0129] S513: if the current window , it is determined that the time window is normal.

[0130] The anomaly detection method for time series data provided in the application dynamically determines the mask proportion and mask index according to the importance and volatility of the index, and the mask proportion calculation formula based on mutual information and coefficient of variation can implement a low mask probability rule for high importance indexes. Fine-tuning by activating the attention mechanism of a large language model: make full use of the attention mechanism to capture the dependency between indexes, which is different from the prior art of only activating the feedforward layer and the normalization layer. Dynamic threshold selection method: dynamically adjust the threshold according to the data distribution characteristics of the time window, which overcomes the limitations of the fixed threshold.

[0131] Through the description of the above implementation, those skilled in the art can clearly understand that the method according to the above embodiment can be realized by means of software and the necessary general hardware platform, of course, it can also be realized by hardware, but in many cases the former is a better implementation.

[0132] The embodiments of the application also provide an anomaly detection device for time series data for realizing the above embodiments and preferred embodiments, which have been described. As used below, the term "module" can be a combination of software and / or hardware that realizes a predetermined function. Although the modules described in the following embodiments are preferably realized in software, realization by hardware, or a combination of software and hardware is also possible and is conceived.

[0133] Figure 6 is a structural block diagram of an anomaly detection device for time series data according to an embodiment of the application, and the device comprises:

[0134] The acquisition module 602 is configured to acquire time sequence data of a to-be-detected index of a target device.

[0135] The analysis module 604 is configured to perform correlation analysis on the time sequence data to determine an importance parameter of the to-be-detected index, and perform stability analysis on the time sequence data to determine a stability parameter of the to-be-detected index.

[0136] The determination module 606 is configured to determine a mask proportion for mask processing of the time sequence data based on the importance parameter and the stability parameter.

[0137] The detection module 608 is configured to determine a mask processing result of the time sequence data based on the mask proportion, and determine an abnormality detection result of corresponding time sequence data based on the mask processing result.

[0138] Through the above device, time sequence data of a to-be-detected index is acquired, and correlation analysis and stability analysis are respectively performed on the time sequence data to obtain an importance parameter and a stability parameter of the to-be-detected index. Then, a mask proportion for mask processing of the time sequence data can be determined based on the importance parameter and the stability parameter, and a mask processing result of the time sequence data is determined based on the mask proportion, so that abnormality detection is performed based on the mask processing result to obtain an abnormality detection result. That is, the mask proportion is determined according to the importance parameter and the stability parameter of the to-be-detected index, and the importance parameter and the stability parameter are obtained by performing correlation analysis and stability analysis on the time sequence data, that is, the mask proportion is dynamically determined according to the characteristics of the time sequence data. Compared with setting a fixed mask proportion, the mask proportion determined based on the importance parameter and the stability parameter can effectively avoid unreasonable mask processing of the to-be-detected index, and thus the accuracy of abnormality detection can be effectively improved.

[0139] In one example embodiment, the analysis module 604 is further configured to split the time sequence data based on a preset time splitting step to obtain time sequence sub-data corresponding to a plurality of time windows respectively; perform correlation analysis on the time sequence sub-data corresponding to the plurality of time windows respectively to determine importance parameters of the plurality of time windows; and determine the importance parameter of the to-be-detected index based on the importance parameters of the plurality of time windows.

[0140] In an example embodiment, the analysis module 604 is further configured to determine, for the time series sub-data of any of the plurality of time windows, a probability distribution value of the any of the plurality of time windows, wherein the probability distribution value comprises a joint probability distribution value between the time series sub-data of the any of the plurality of time windows and the set abnormal time series data, a first marginal probability distribution value of the time series sub-data of the any of the plurality of time windows, and a second marginal probability distribution value of the set abnormal time series data of the any of the plurality of time windows, take logarithm of the joint probability distribution value, the first marginal probability distribution value, and the second marginal probability distribution value of the time series sub-data of the any of the plurality of time windows to obtain a logarithm value, and use the logarithm value to represent a degree of association between the time series sub-data of the any of the plurality of time windows and the abnormal time series data, and multiply the probability distribution value of the any of the plurality of time windows and the logarithm value to determine the importance parameter of the any of the plurality of time windows.

[0141] In an example embodiment, the analysis module 604 is further configured to determine a mean value and a standard deviation of the time series data, and determine a stability parameter of the time series data based on a quotient of the mean value and the standard deviation of the time series data, and determine the stability parameter of the time series data as the stability parameter of the to-be-detected indicator.

[0142] In an example embodiment, the determination module 606 is further configured to determine a first weight and a second weight, wherein the first weight is greater than the second weight, determine a first product based on the importance parameter and the first weight, and determine a second product based on the stability parameter and the second weight, and determine a mask proportion for the mask processing of the time series data based on a sum of the first product and the second product.

[0143] In an example embodiment, the determination module 606 is further configured to determine a first number of a first to-be-detected indicator in the to-be-detected indicators and a second number of a second to-be-detected indicator in the to-be-detected indicators, wherein the first to-be-detected indicator refers to a to-be-detected indicator whose importance parameter is greater than a preset importance threshold, and the second to-be-detected indicator refers to a to-be-detected indicator whose stability parameter is less than a preset stability threshold, compare the first number with a first number threshold to obtain a first comparison result, and compare the second number with a second number threshold to obtain a second comparison result, determine the first weight based on the first comparison result, and determine the second weight based on the second comparison result.

[0144] In an example embodiment, the determining module 606 is further configured to determine time sequence sub-data of a plurality of time windows of the time sequence data; wherein the time sequence sub-data of any time window is obtained by splitting the time sequence data based on a preset time splitting step; and based on the mask ratio, select data from the time sequence sub-data of the plurality of time windows respectively for mask processing to obtain mask data and unmasked data corresponding to the plurality of time windows respectively; wherein the mask processing result includes the mask data and the unmasked data corresponding to the plurality of time windows respectively.

[0145] In an example embodiment, the detecting module 608 is further configured to determine time sequence sub-data corresponding to a plurality of time windows of the time sequence data; wherein the time sequence sub-data of any time window is obtained by splitting the time sequence data based on a preset time splitting step; and based on the pre-trained anomaly detection model, the mask data and the unmasked data of the time sequence sub-data of the any time window in the plurality of time windows, perform anomaly prediction on the time sequence sub-data of the any time window to obtain a detection result for the time sequence sub-data of the any time window; and based on the detection results corresponding to the plurality of time windows, determine an anomaly detection result of the corresponding time sequence data.

[0146] In an example embodiment, the detecting module 608 is further configured to perform text processing on the unmasked data of the time sequence sub-data of the any time window to obtain a text processing result; input the text processing result into the anomaly detection model to enable the anomaly detection model to perform anomaly prediction based on the text processing result to obtain a prediction value; compare the prediction value with a true value determined by the mask data to obtain an error result; compare the error result with a set dynamic error threshold to obtain an anomaly detection result of the any time window.

[0147] In an example embodiment, the detecting module 608 is further configured to, in a case where the time window of the time sequence sub-data belongs to an initial time window in the plurality of time windows, based on a set number of time windows, determine a first target time window from the first window in the plurality of time windows as a starting window, and based on a mean value and a standard deviation of the time sequence sub-data of the first target time window, calculate the dynamic error threshold; and in a case where the time window of the time sequence sub-data does not belong to the initial time window in the plurality of time windows, based on a set number of time windows, determine a second target time window from the time window of the time sequence sub-data as a terminal window, and based on a mean value and a standard deviation of the time sequence sub-data of the second target time window, calculate the dynamic error threshold.

[0148] In an example embodiment, the detection module 608 is further configured to splice the unmasked data of the time sequence sub-data in chronological order to obtain a spliced value sequence, and perform text conversion on the spliced value sequence to obtain a text processing result.

[0149] In an example embodiment, the device further comprises a training module. The training module is configured to obtain sample time sequence data of a to-be-detected index of a target device, perform correlation analysis on the sample time sequence data to determine a sample importance parameter of the to-be-detected index, and perform stability analysis on the sample time sequence data to determine a sample stability parameter of the to-be-detected index. The training module is further configured to determine a sample mask proportion for mask processing of the sample time sequence data based on the sample importance parameter and the sample stability parameter, determine a mask processing result of the sample time sequence data based on the sample mask proportion, and fine-tune first parameters of an attention mechanism layer, second parameters of a feedforward layer, and third parameters of a normalization layer of a to-be-trained anomaly detection model based on the sample mask processing result to obtain a trained anomaly detection model.

[0150] In an example embodiment, the training module is further configured to determine a plurality of sample time windows of the sample time sequence data, each corresponding to a sample time sequence sub-data. The sample time sequence sub-data is obtained by splitting the sample time sequence data based on a preset sample time splitting step. The training module is further configured to perform text processing on sample unmasked data of the sample time sequence sub-data of each sample time window to obtain a text processing sample, input the text processing sample into the to-be-trained anomaly detection model to enable the to-be-trained anomaly detection model to perform sample anomaly prediction based on the text processing sample to obtain a sample prediction value, compare the sample prediction value with a sample true value determined by the sample mask data to obtain a sample error result, and perform parameter tuning on the first parameters of the attention mechanism layer, the second parameters of the feedforward layer, and the third parameters of the normalization layer of the anomaly detection model in a case where the sample error result is greater than a preset sample error threshold, and continue to train the anomaly detection model according to the parameter tuning result until a training end condition is met to stop, thereby obtaining a trained anomaly detection model.

[0151] The features of the embodiments of the anomaly detection device for time sequence data can be understood with reference to the related descriptions of the embodiments of the anomaly detection method for time sequence data, and the features of the embodiments of the device startup method can be understood with reference to the related descriptions of the embodiments of the device startup method, which will not be described herein.

[0152] An embodiment of the present application further provides an electronic device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute the steps in any of the above-mentioned embodiments of the method for detecting anomaly in time series data.

[0153] An embodiment of the present application further provides a computer-readable storage medium, which stores a computer program, wherein the computer program is configured to execute the steps of any of the above-mentioned time series data anomaly detection method embodiments when running.

[0154] In an exemplary embodiment, the computer-readable storage medium may include, but is not limited to, various media that can store computer programs, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk, or an optical disk.

[0155] An embodiment of the present application further provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the steps in any of the above-mentioned time series data anomaly detection method embodiments are implemented.

[0156] An embodiment of the present application also provides another computer program product, including a non-volatile computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the steps in any of the above-mentioned time series data anomaly detection method embodiments.

[0157] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the components and steps of each example according to their functions. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0158] The above is a detailed introduction to a method for detecting anomalies in time series data provided by this application. This article uses specific examples to illustrate the principles and implementation methods of this application. The description of the above embodiments is only applicable to help understand the method and core ideas of this application. It should be pointed out that for ordinary technicians in this technical field, without departing from the principles of this application, several improvements and modifications can be made to this application, and these improvements and modifications also fall within the scope of protection of the claims of this application.

Claims

1. A method for detecting anomalies in time series data, characterized in that: include: Obtain the time series data of the target device's indicators to be tested; Performing a correlation analysis on the time series data to determine the importance parameter of the indicator to be detected, and performing a stability analysis on the time series data to determine the stability parameter of the indicator to be detected; Determining a mask ratio for performing masking on the time series data based on the importance parameter and the stability parameter; A mask processing result of the time series data is determined based on the mask ratio, and an anomaly detection result of the corresponding time series data is determined based on the mask processing result.

2. The method according to claim 1, characterized in that The performing of correlation analysis on the time series data to determine the importance parameter of the indicator to be detected includes: Splitting the time series data based on a preset time splitting step to obtain time series sub-data corresponding to multiple time windows; Performing correlation analysis on the time series sub-data corresponding to the multiple time windows respectively to determine importance parameters of the multiple time windows; The importance parameter of the indicator to be detected is determined based on the importance parameters of the multiple time windows.

3. The method according to claim 2, characterized in that The performing correlation analysis on the time series sub-data corresponding to the multiple time windows to determine the importance parameters of the multiple time windows includes: For the time series sub-data of any time window among the multiple time windows, determine the probability distribution value of the any time window; wherein the probability distribution value includes: the joint probability distribution value between the time series sub-data of the any time window and the set abnormal time series data, the first marginal probability distribution value of the time series sub-data of the any time window, and the second marginal probability distribution value of the abnormal time series data set for the any time window; Taking the logarithm of the joint probability distribution value, the first marginal probability distribution value, and the second marginal probability distribution value of the time series sub-data of any time window to obtain a logarithmic value; the logarithmic value is used to represent the degree of correlation between the time series sub-data of any time window and the abnormal time series data; Based on the product of the probability distribution value of any time window and the logarithmic value, an importance parameter of any time window is assigned a value to determine the importance parameters of the multiple time windows.

4. The method according to claim 1, wherein The performing stability analysis on the time series data to determine the stability parameter of the indicator to be detected includes: Determining a mean and a standard deviation of the time series data, and determining a stability parameter of the time series data based on a quotient of the mean and the standard deviation of the time series data; The stability parameter of the time series data is determined as the stability parameter of the indicator to be detected.

5. The method according to claim 1, wherein The determining, based on the importance parameter and the stability parameter, a mask ratio for performing masking on the time series data includes: Determine a first weight and a second weight; wherein the first weight is greater than the second weight; Obtaining a first product based on the importance parameter and the first weight, and obtaining a second product based on the stability parameter and the second weight; A mask ratio for performing mask processing on the time series data is determined based on the sum of the first product and the second product.

6. The method according to claim 5, characterized in that The determining of the first weight and the second weight includes: Determining a first number of first detection indicators among the indicators to be detected and a second number of second detection indicators among the indicators to be detected; wherein the first detection indicator refers to a detection indicator whose importance parameter is greater than a preset importance threshold; and the second detection indicator refers to a detection indicator whose stability parameter is less than a preset stability threshold; Comparing the first quantity with a first quantity threshold to obtain a first comparison result, and comparing the second quantity with a second quantity threshold to obtain a second comparison result; The first weight is determined based on the first comparison result, and the second weight is determined based on the second comparison result.

7. The method according to claim 1, characterized in that The determining the mask processing result of the time series data based on the mask ratio includes: Determining time series sub-data of multiple time windows of the time series data; wherein the time series sub-data of any time window is obtained by splitting the time series data based on a preset time splitting step; Based on the mask ratio, data are selected from the time series sub-data of the multiple time windows for mask processing to obtain masked data and unmasked data corresponding to the multiple time windows respectively; wherein the mask processing results include: masked data and unmasked data corresponding to the multiple time windows respectively.

8. The method according to claim 1, characterized in that The determining of anomaly detection results of corresponding time series data based on the mask processing results includes: Determine time series sub-data corresponding to a plurality of time windows of the time series data; wherein the time series sub-data of any time window is obtained by splitting the time series data based on a preset time splitting step; Based on a pre-trained anomaly detection model, masked data and unmasked data of the time series sub-data of any time window in the multiple time windows, perform anomaly prediction on the time series sub-data of any time window to obtain a detection result for the time series sub-data of any time window; Based on the detection results corresponding to the multiple time windows, an abnormality detection result of the corresponding time series data is determined.

9. The method according to claim 8, characterized in that The method of performing anomaly prediction on the time series sub-data of any time window based on the pre-trained anomaly detection model and the masked data and unmasked data of the time series sub-data of any time window in the multiple time windows to obtain a detection result for the time series sub-data of any time window includes: Performing text processing on the unmasked data of the time series sub-data of any time window to obtain a text processing result; Inputting the text processing result into the anomaly detection model, so that the anomaly detection model performs an anomaly prediction based on the text processing result to obtain a prediction value; Performing an error comparison between the predicted value and the true value determined by the mask data to obtain an error result; The error result is compared with a set dynamic error threshold to obtain an anomaly detection result for any time window.

10. The method according to claim 9, characterized in that The method for determining the dynamic error threshold includes: In a case where the time window of the time series sub-data belongs to an initial time window among the multiple time windows, based on a set number of time windows, taking the first window among the multiple time windows as the starting window, determining a first target time window equal to the number of time windows, and calculating the dynamic error threshold based on the mean and standard deviation of the time series sub-data in the first target time window; In the case that the time window of the time series sub-data does not belong to the initial time window among the multiple time windows, based on the set number of time windows, the time window of the time series sub-data is used as the termination window, and the second target time windows of the number of time windows are determined, and the dynamic error threshold is calculated based on the mean and standard deviation of the time series sub-data of the second target time window.

11. The method according to claim 9, characterized in that The performing text processing on the unmasked data of the time series sub-data of any time window to obtain a text processing result includes: splicing the unmasked data of the time series sub-data in chronological order to obtain a spliced ​​numerical sequence; Perform text conversion on the concatenated numerical sequence to obtain a text processing result.

12. The method according to claim 8, characterized in that The training steps of the anomaly detection model include: Obtain sample time series data of the target device's indicators to be tested; Performing a correlation analysis on the sample time series data to determine a sample importance parameter of the indicator to be detected, and performing a stability analysis on the sample time series data to determine a sample stability parameter of the indicator to be detected; Determining a sample mask ratio for performing masking on the sample time series data based on the sample importance parameter and the sample stability parameter; The mask processing result of the sample time series data is determined based on the sample mask ratio, and the first parameter of the attention mechanism layer, the second parameter of the feedforward layer, and the third parameter of the normalization layer of the anomaly detection model to be trained are fine-tuned based on the sample mask processing result to obtain a trained anomaly detection model.

13. The method according to claim 12, characterized in that The method further comprises fine-tuning a first parameter of an attention mechanism layer, a second parameter of a feedforward layer, and a third parameter of a normalization layer of the anomaly detection model to be trained based on the sample mask processing result to obtain a trained anomaly detection model, including: Determining sample time series sub-data corresponding to a plurality of sample time windows of the sample time series data; wherein the sample time series sub-data are obtained by splitting the sample time series data based on a preset sample time splitting step; Performing text processing on sample unmasked data of the sample time series sub-data of any sample time window to obtain a text-processed sample; Inputting the text processing sample into the anomaly detection model to be trained, so that the anomaly detection model to be trained performs sample anomaly prediction based on the text processing sample to obtain a sample prediction value; Performing an error comparison between the sample prediction value and the sample true value determined by the sample mask data to obtain a sample error result; When the sample error result is greater than a preset sample error threshold, the first parameter of the attention mechanism layer, the second parameter of the feedforward layer, and the third parameter of the normalization layer of the anomaly detection model are adjusted, and the anomaly detection model is continued to be trained according to the parameter adjustment results until the training end condition is met, thereby obtaining a trained anomaly detection model.

14. A device for detecting anomalies in time series data, characterized in that: include: An acquisition module is used to obtain time series data of the target device's indicators to be tested; An analysis module, configured to perform a correlation analysis on the time series data to determine an importance parameter of the indicator to be detected, and to perform a stability analysis on the time series data to determine a stability parameter of the indicator to be detected; a determination module, configured to determine a mask ratio for performing masking on the time series data based on the importance parameter and the stability parameter; A detection module is configured to determine a mask processing result of the time series data based on the mask ratio, and determine an anomaly detection result of the corresponding time series data based on the mask processing result.

15. An electronic device, characterized in that: include: Memory for storing computer programs; A processor, configured to implement the steps of the method for detecting anomalies in time series data as claimed in any one of claims 1 to 13 when executing the computer program.

Images