Methods, devices, electronic equipment, and storage media for anomaly detection of time-series data

Abstract

This application discloses a method, apparatus, electronic device, and storage medium for anomaly detection of time-series data, relating to the field of computer technology. The method includes: acquiring time-series data of the indicator to be detected; performing correlation analysis and stability analysis on the time-series data to obtain importance parameters and stability parameters; determining a masking ratio for masking the time-series data based on the importance and stability parameters; determining the masking result of the time-series data based on the masking ratio; and performing anomaly detection based on the masking result to obtain anomaly detection results. In other words, the masking ratio is dynamically determined according to the characteristics of the time-series data. Compared to setting a fixed masking ratio, this masking ratio determined based on importance and stability parameters can effectively avoid unreasonable masking of the indicator to be detected.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a method, apparatus, electronic device, and storage medium for detecting anomalies in time-series data. Background Technology

[0002] With the development of cloud technology, cloud computing systems have also exposed many problems, such as frequent failures, difficulties in capacity planning, and uneven resource allocation. These problems directly affect service quality and user experience. To address these issues, anomaly detection technology has become the first line of defense in maintaining the stable operation of cloud computing systems.

[0003] Currently, anomaly detection typically involves real-time monitoring of time-series data of indicators, followed by analysis of this data using anomaly detection algorithms. Specifically, these algorithms perform masking on the time-series data to obtain a masking result, which is then used for anomaly detection.

[0004] However, since a fixed masking ratio is usually used when masking time series data, there may be cases where the masking of some time series data is not handled properly, which in turn affects the accuracy of anomaly detection in time series data. Summary of the Invention

[0005] This application provides a method, apparatus, electronic device, and storage medium for anomaly detection of time-series data, to at least solve the problem in related technologies where the accuracy of anomaly detection is affected by masking time-series data with a fixed mask ratio.

[0006] This application provides an anomaly detection method for time-series data, comprising: acquiring time-series data of a target device's indicator to be detected; performing correlation analysis on the time-series data to determine the importance parameter of the indicator to be detected, and performing stability analysis on the time-series data to determine the stability parameter of the indicator to be detected; determining a masking ratio for masking the time-series data based on the importance parameter and the stability parameter; determining a masking result for the time-series data based on the masking ratio, and determining an anomaly detection result for the corresponding time-series data based on the masking result.

[0007] This application also provides an anomaly detection device for time-series data, comprising: an acquisition module for acquiring time-series data of a target device's indicator to be detected; an analysis module for performing correlation analysis on the time-series data to determine the importance parameter of the indicator to be detected, and performing stability analysis on the time-series data to determine the stability parameter of the indicator to be detected; a determination module for determining a masking ratio for masking the time-series data based on the importance parameter and the stability parameter; and a detection module for determining the masking result of the time-series data based on the masking ratio, and determining the corresponding anomaly detection result of the time-series data based on the masking result.

[0008] This application also provides an electronic device, including: a memory for storing a computer program; and a processor for implementing the steps of any of the above-described methods for detecting anomalies in timing data when executing the computer program.

[0009] This application also provides a computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, it implements the steps of any of the above-described methods for detecting anomalies in timing data.

[0010] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of any of the above-described methods for detecting anomalies in timing data.

[0011] This application obtains time-series data of the indicator to be detected, and performs correlation and stability analyses on the time-series data to obtain the importance and stability parameters of the indicator. Based on these parameters, a masking ratio for masking the time-series data can be determined. This masking ratio determines the masking result, enabling anomaly detection based on the masking result. In other words, the masking ratio is determined based on the importance and stability parameters of the indicator to be detected, which are obtained through correlation and stability analyses of the time-series data. The masking ratio is dynamically determined based on the characteristics of the time-series data. Compared to setting a fixed masking ratio, this ratio, determined based on importance and stability parameters, effectively avoids unreasonable masking of the indicator to be detected, thereby significantly improving the accuracy of anomaly detection in the time-series data. Attached Figure Description

[0012] To more clearly illustrate the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0013] Figure 1 A structural block diagram of a computer device for an anomaly detection method for time-series data provided in this application embodiment;

[0014] Figure 2 One of the flowcharts for an anomaly detection method for time-series data provided in this application embodiment;

[0015] Figure 3 A second flowchart illustrating an anomaly detection method for time-series data provided in this application embodiment;

[0016] Figure 4 A flowchart of a method for detecting anomalies in time-series data provided in this application embodiment;

[0017] Figure 5 A flowchart of a time-series data anomaly detection method provided in this application embodiment;

[0018] Figure 6 This is a structural block diagram of an anomaly detection device for time-series data provided in an embodiment of this application. Detailed Implementation

[0019] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the protection scope of this application.

[0020] It should be noted that, in the description of this application, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. The terms "first," "second," etc., in this application are used to distinguish similar objects and are not used to describe a specific order or sequence.

[0021] To enable those skilled in the art to better understand the present application, the present application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0022] The anomaly detection method for time-series data provided in this application can be executed on a computer device or similar computing device. Taking running on a computer device as an example... Figure 1 This is a hardware structure block diagram of a computer device for an anomaly detection method for time-series data according to an embodiment of this application. For example... Figure 1 As shown, a computer device may include one or more ( Figure 1 Only one is shown in the diagram. A processor 102 (which may include, but is not limited to, a central processing unit (CPU), a microprocessor (MCU), or a programmable logic device (FPGA), etc.) and a memory 104 for storing data are also shown. The computer device may further include a transmission device 106 for communication functions and an input / output device 108. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the computer device described above. For example, the computer device may also include components that are more... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0023] The memory 104 can be used to store computer programs, such as application software programs and modules, like the computer program corresponding to the anomaly detection method for timing data in this embodiment. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, thus implementing the aforementioned method. The memory 104 may include high-speed random access memory and non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to computer devices via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0024] The transmission device 106 is used to receive or transmit data via a network. Specific examples of the network described above may include a wireless network provided by a communication provider for the computer equipment. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module used for wireless communication with the Internet.

[0025] This application provides an embodiment of a time-series data anomaly detection method, applied to the aforementioned computer device. The execution flow of the time-series data anomaly detection method is described in detail below. Figure 2 As shown, the method includes the following steps S202-S208:

[0026] S202, Obtain the time-series data of the target device's indicators to be tested.

[0027] In this context, target devices refer to physical or virtual servers, network devices, storage devices, or application service nodes whose performance status needs to be monitored and analyzed. In cloud computing systems, target devices can be fundamental components, and their health and performance directly impact the stability and efficiency of the entire cloud computing system.

[0028] It should be noted that the metrics to be monitored refer to key parameters that reflect the operating status or performance of the target device. For the target device, at the infrastructure level, the metrics to be monitored may include: CPU (Central Processing Unit Utilization) utilization, GPU (Graphics Processing Unit Load) load, memory usage, disk I / O (Input / Output Operations per Second) rate, network bandwidth utilization, network latency, etc. At the application level, the metrics to be monitored may include: response time, request success rate, error rate, number of concurrent users, and resource consumption by processes, etc.

[0029] Time-series data refers to data collected chronologically to characterize changes in the state of a monitored indicator. It comprises multiple data points, each containing a timestamp and a corresponding data value. Time-series data is obtained through periodic sampling and is used to analyze target device operating trends, predict future states, and detect anomalies. Examples include CPU usage data recorded every minute and network traffic data collected every 5 minutes.

[0030] In some embodiments, within an industrial automation environment, target equipment on a production line needs to undergo anomaly detection. Taking an automated production line manufacturing automotive parts as an example, the target equipment may include various robots, conveyors, machining centers, etc. The indicators to be detected may cover temperature, pressure, rotational speed, vibration frequency, current consumption, etc., and the time-series data of these indicators reflects the operating status and health level of the equipment. Time-series data is formed by periodically collecting data on these indicators (e.g., every minute or every 5 minutes) and recording timestamps.

[0031] S204. Perform correlation analysis on time series data to determine the importance parameters of the indicator to be detected, and perform stability analysis on time series data to determine the stability parameters of the indicator to be detected.

[0032] It's important to note that correlation analysis measures the degree of interdependence between two or more variables. In the context of anomaly detection, correlation analysis specifically identifies which indicators are more likely to be affected by changes in anomalous states, helping to determine which indicators are more critical for detecting anomalies. Specifically, when conducting correlation analysis, mutual information, Pearson correlation coefficients, or other correlation measures can be calculated to quantify the strength of the interdependence between variables.

[0033] Importance parameters refer to the quantitative assessment of the sensitivity and contribution of the detected indicator to the overall system state in anomaly detection. Indicators with higher importance parameters mean that their changes are more likely to indicate anomalies, and therefore should be given more attention in anomaly detection algorithms. The determination of importance parameters is based on the results of correlation analysis, identifying which indicators have the strongest correlation with abnormal states, thereby determining which indicators are most critical in anomaly detection.

[0034] Stability analysis is the process of assessing the volatility or degree of change in time-series data. It is used to determine whether the indicator under test has stable numerical characteristics, that is, whether the value of the indicator is relatively stable under normal operating conditions, or whether it is easily affected by changes in the environment or load, resulting in large fluctuations. Indicators with high volatility (i.e., poor stability) may be more difficult to predict and more prone to false alarms, so they need to be handled with caution in anomaly detection.

[0035] Stability parameters are indicators that quantify the degree of volatility in time series data. They are typically derived by calculating statistics such as the coefficient of variation and standard deviation. The coefficient of variation, which is the ratio of the standard deviation to the mean, is used to standardize the degree of volatility of an indicator. Especially when different indicators differ significantly in magnitude, the coefficient of variation provides a fair standard for comparing volatility.

[0036] In some embodiments, the computer device can acquire time-series data of multiple performance metrics, including CPU utilization, GPU load, memory usage, disk I / O operation rate, and network bandwidth utilization. Through correlation analysis, the computer device can determine that CPU utilization and memory usage are parameters of high importance in anomaly detection, especially for identifying anomalies related to resource overload. Through stability analysis, the computer device can identify network bandwidth utilization as a less stable metric because it fluctuates significantly between high and low traffic periods, while disk I / O operation rate shows higher stability, remaining relatively stable even when server load changes. Therefore, the lower stability of network bandwidth utilization indicates that its volatility needs to be considered in anomaly detection.

[0037] S206, based on the importance parameter and stability parameter, determine the masking ratio for masking the time series data.

[0038] The masking ratio refers to the ratio of data points selected for hiding (i.e., masking) to the total number of data points in the time-series data. This ratio can be determined based on the importance and stability parameters of the indicator to be detected, thereby maximizing the accuracy of anomaly detection.

[0039] In some embodiments, the computer device determines the mask ratio by combining importance parameters and stability parameters based on correlation analysis and stability analysis. If the computer determines that CPU utilization and network bandwidth utilization are two indicators with high importance parameters, and that the stability parameters of CPU utilization and network bandwidth utilization are low, the computer device can set weights for the importance parameters and stability parameters, and then determine the mask ratio based on these weights.

[0040] S208, determine the masking result of the time series data based on the mask ratio, and determine the anomaly detection result of the corresponding time series data based on the masking result.

[0041] The masking result refers to the dataset obtained after hiding the time-series data according to a determined masking ratio. The anomaly detection result is the pattern or value identified that is significantly different from normal operating behavior after analyzing the processed time-series data.

[0042] Specifically, for the time series data of the indicator to be detected, a certain proportion of data points can be randomly selected to be hidden according to the pre-calculated mask ratio. This process aims to simulate the situation in anomaly detection scenarios where some data may be missing or affected by noise. It is also a data augmentation technique that can help learn the inherent dependencies and anomaly patterns of the indicator to be detected.

[0043] Steps S202-S208 above involve acquiring time-series data of the indicator to be detected, and performing correlation and stability analyses on the time-series data to obtain the importance and stability parameters of the indicator. Based on these parameters, a masking ratio for masking the time-series data can be determined. This masking ratio determines the masking result, enabling anomaly detection based on the result. In other words, the masking ratio is determined based on the importance and stability parameters of the indicator to be detected, which are obtained through correlation and stability analyses of the time-series data. The masking ratio is dynamically determined based on the characteristics of the time-series data. Compared to setting a fixed masking ratio, this ratio, determined based on importance and stability parameters, effectively avoids unreasonable masking of the indicator to be detected, thus significantly improving the accuracy of anomaly detection.

[0044] In some exemplary embodiments, such as Figure 3 As shown, the correlation analysis of time-series data described above, which determines the importance parameters of the indicator to be detected, can be achieved through the following steps S302-S306:

[0045] S302, based on a preset time splitting step size, splits the time series data to obtain time series sub-data corresponding to multiple time windows;

[0046] S304, perform correlation analysis on the time series sub-data corresponding to multiple time windows to determine the importance parameters of multiple time windows;

[0047] S306, based on the importance parameters of multiple time windows, determines the importance parameters of the indicator to be detected.

[0048] It's important to note that time-series data splitting step size refers to the step size or frequency at which continuous time-series data is divided into a series of fixed-length segments (i.e., time windows) when processing time-series data. The time-series data splitting step size can be determined by the data sampling frequency and the temporal resolution requirements of anomaly detection. For example, if time-series data is collected at a frequency of once per minute, and anomaly detection requires evaluation every 10 minutes, then the time-series data splitting step size could be 10 data points (i.e., 10 minutes).

[0049] Time series subdata refers to the data segments within each time window after time series data has been divided into multiple time windows according to the time splitting step size.

[0050] Specifically, this involves time-series data for indicators such as CPU utilization, memory usage, network latency, and disk I / O wait times. Based on a set time-series splitting step, such as 5 minutes, the data can be divided into 5-minute time windows, forming a series of time-series sub-data. Each sub-data contains the numerical sequence of each indicator within that time window. Correlation analysis, such as mutual information and Pearson correlation coefficient, is then performed on the sub-data within each time window to assess the correlation between the detected indicator and the abnormal state. For example, a high mutual information value for memory usage within a certain time window indicates that memory usage is of high importance for detecting anomalies within that time window.

[0051] In some embodiments, based on the results of correlation analysis, an importance parameter can be assigned to the indicator to be detected within each time window. The importance parameter can be a direct quantification of the mutual information value, or the result of sorting and normalizing the mutual information values.

[0052] In the above embodiments, time series data is divided into time series sub-data of multiple time windows by using time splitting step size. Then, the importance parameter of the indicator to be detected is determined by performing correlation analysis on the time series sub-data. Based on the importance parameter, the determination of the mask ratio can be guided, the anomaly detection process can be optimized, and the accuracy of anomaly detection can be improved.

[0053] In some exemplary embodiments, correlation analysis is performed on time series sub-data corresponding to multiple time windows to determine the importance parameters of multiple time windows. This includes: determining the probability distribution value of any time window for the time series sub-data of any time window; wherein the probability distribution value includes: the joint probability distribution value between the time series sub-data of any time window and the set abnormal time series data, the first marginal probability distribution value of the time series sub-data of any time window, and the second marginal probability distribution value of the set abnormal time series data of any time window; taking the logarithm of the joint probability distribution value, the first marginal probability distribution value, and the second marginal probability distribution value of the time series sub-data of any time window to obtain a logarithmic value; the logarithmic value is used to characterize the degree of correlation between the time series sub-data of any time window and the abnormal time series data; and assigning a value to the importance parameter of any time window based on the product of the probability distribution value and the logarithmic value of any time window to determine the importance parameters of multiple time windows.

[0054] The joint probability distribution value refers to the probability distribution of two or more random variables occurring together. In anomaly detection scenarios, it refers to the co-occurrence probability between time-series sub-data and predefined anomalous time-series data patterns within any time window. The first marginal probability distribution value reflects the probability of time-series sub-data occurring within any time window, while the first marginal probability distribution value reflects the probability of anomalous time-series data occurring within any time window.

[0055] The logarithm value is obtained by taking the logarithm of the joint probability distribution value, the first marginal probability distribution value, and the second marginal probability distribution value. The magnitude of the logarithm value can reflect the degree of correlation between the time series sub-data and the anomalous time series data; the larger the logarithm value, the stronger the correlation.

[0056] Specifically, for each time window, based on the joint probability distribution function, the joint probability distribution value between the time series sub-data and the abnormal time series data within each window can be determined. Furthermore, based on the marginal probability distribution function, the first marginal probability distribution value and the second marginal probability distribution value can be determined. Based on the obtained joint probability distribution value, the first marginal probability distribution value, and the second marginal probability distribution value, a logarithmic transformation is performed on the data within each time window to obtain a logarithmic value. The magnitude of the logarithmic value reflects the degree of correlation between the data within that time window and the abnormal state.

[0057] In some embodiments, the importance parameters calculated for multiple time windows can be summarized and analyzed to determine the importance of the indicator to be detected. Specifically, this can be accomplished through simple averaging, weighted averaging, or more complex statistical methods. When summarizing, the dynamic characteristics of time-series data can be considered; that is, the importance parameters at different time points may change with environmental changes. The weights of the importance parameters for each time window can be appropriately adjusted to reflect the importance of recent data or the impact of long-term trends. The importance parameters obtained through summary analysis can represent the overall importance of the indicator to be detected in anomaly detection.

[0058] In the above embodiments, by performing in-depth analysis of the probability distribution and logarithmic transformation of data from multiple time windows, the correlation between data and specific abnormal states within different time windows can be effectively quantified. This allows for the allocation of a reasonable importance parameter to each time window, which is of great significance for optimizing anomaly detection strategies and improving the accuracy and timeliness of anomaly detection.

[0059] In some exemplary embodiments, the step of performing stability analysis on the time series data to determine the stability parameters of the indicator to be detected includes: determining the mean and standard deviation of the time series data, and determining the stability parameters of the time series data based on the quotient of the mean and standard deviation of the time series data; and determining the stability parameters of the time series data as the stability parameters of the indicator to be detected.

[0060] The mean is the average of all observations in a time-series dataset; it represents the general level or central location of the data. The mean helps to understand the average performance of a metric over a period of time, such as average CPU utilization or average network latency.

[0061] Standard deviation is a measure of how much observations in time-series data fluctuate around the mean. A larger standard deviation indicates a more significant difference between the data points and the mean, meaning higher volatility or instability. Standard deviation reveals the fluctuation of a particular indicator over a period of time, helping to identify the stability of the data.

[0062] Specifically, the stability parameter is calculated based on the mean and standard deviation of time-series data. By calculating the quotient of the mean and standard deviation (i.e., the coefficient of variation), a value measuring the stability of the data can be obtained. The smaller the coefficient of variation, the higher the stability of the data, meaning that the data points vary relatively little and fluctuate little around the mean; conversely, the larger the coefficient of variation, the lower the stability of the data, the more significant the differences between data points, and the more susceptible it is to the influence of outliers.

[0063] In the above embodiments, the volatility of the indicator to be detected is identified based on the stability parameter, and then the mask ratio is determined based on the stability parameter, which can improve the overall performance and reliability of anomaly detection.

[0064] In some exemplary embodiments, determining the masking ratio for masking time-series data based on an importance parameter and a stability parameter includes: determining a first weight and a second weight; wherein the first weight is greater than the second weight; obtaining a first product based on the importance parameter and the first weight, and obtaining a second product based on the stability parameter and the second weight; and determining the masking ratio for masking time-series data based on the sum of the first product and the second product.

[0065] The first weight emphasizes the influence of the importance parameter on the mask ratio. Since the importance parameter is directly related to the contribution of the indicator to anomaly detection, the first weight can be set to a relatively high value. The second weight measures the influence of the stability parameter to be detected in the mask ratio determination process. Compared with the first weight, the second weight is usually set lower because the stability parameter reflects the volatility of the indicator to be detected, and indicators with greater volatility may contribute less to anomaly detection.

[0066] The masking ratio refers to the proportion of metric values ​​in time-series data that are masked (i.e., hidden or not involved in model training) within each time window. The masking ratio is determined based on two aspects: the importance of the metric and its stability. This ratio is calculated to balance the model's learning needs for key metrics with its strategy for handling unstable metrics, in order to achieve optimal anomaly detection performance.

[0067] In some embodiments, the importance parameters of multiple time windows can be summarized and analyzed to obtain the importance parameters of the indicator to be detected. Specifically, this can be done through simple averaging, weighted averaging, or more complex statistical methods. When summarizing, the dynamic characteristics of time series data can be considered; that is, the importance parameters at different time points may change with environmental changes. The weights of the importance parameters of the time windows can be appropriately adjusted to reflect the importance of recent data or the impact of long-term trends. The importance parameters obtained through summary analysis can represent the overall importance of the indicator to be detected in anomaly detection. When determining the masking ratio, a weighted processing can be performed based on the stability parameters of the indicator to be detected and the importance parameters after summary analysis to determine the masking ratio. In this way, a uniform masking ratio can be used for masking sub-data of the same indicator in different time windows, thereby improving masking efficiency. Of course, the mask ratio can be different for time series sub-data of the same indicator under test in different time windows. That is, there is no need to summarize the importance parameters of each time window. When calculating the mask ratio, it can be calculated separately according to the importance parameters of each time window and the stability parameters of the indicator under test. This more granular method of determining the mask ratio is determined according to the finer granular time window, which can effectively improve the accuracy of subsequent anomaly detection.

[0068] In a specific application, the importance parameter is assigned a higher weight (let's say 0.7), while the stability parameter is assigned a lower weight (let's say 0.3). The importance parameter can be processed first (e.g., determining the difference between 1 and the importance parameter), and then multiplied by the first weight (0.7) to obtain the first product. Since a higher importance parameter allows for a more adaptive reduction in the mask ratio, and a lower importance parameter allows for a more adaptive increase in the mask ratio, this dynamic adjustment effectively improves anomaly detection accuracy. Simultaneously, the stability parameter is multiplied by the second weight (0.3) to obtain the second product. For example, for the CPU utilization metric, assuming its importance parameter is 0.8 and its stability parameter is 0.2, the first product is (1-0.8)*0.7=0.14, and the second product is 0.2*0.3=0.06. Based on the sum of the first and second products, the mask ratio for the CPU utilization metric within each time window is determined. For example, if the sum of the first and second products is 0.2 (i.e., 0.14 + 0.06), then the mask ratio can be set to 20%.

[0069] In the above embodiments, by setting different weights and dynamically adjusting the mask ratio based on importance and stability parameters, more accurate anomaly detection can be achieved.

[0070] In some exemplary embodiments, determining the first weight and the second weight includes: determining a first number of first detection indicators among the indicators to be detected, and a second number of second detection indicators among the indicators to be detected; wherein, the first detection indicator refers to a detection indicator whose importance parameter is greater than a preset importance threshold; the second detection indicator refers to a detection indicator whose stability parameter is less than a preset stability threshold; comparing the first number with the first number threshold to obtain a first comparison result, and comparing the second number with the second number threshold to obtain a second comparison result; determining the first weight based on the first comparison result, and determining the second weight based on the second comparison result.

[0071] The first detection indicator refers to the indicators whose importance parameter is higher than a preset importance threshold. These indicators are considered to play a key role in anomaly detection. Conversely, indicators whose stability parameter is lower than a preset stability threshold are considered the second detection indicator.

[0072] Specifically, the computer equipment can count the number of all first detection indicators, i.e., how many indicators have importance parameters exceeding a first threshold. It can also count the number of all second detection indicators, i.e., how many indicators have stability parameters below a second preset threshold. Comparing the first count to a preset first threshold assesses the density of key indicators. If the first count is significantly greater than the first threshold, it indicates a large number of key indicators; conversely, a smaller count indicates fewer key indicators. Similarly, comparing the second count to a preset second threshold checks the density of unstable indicators. A high second count may indicate a greater number of volatile indicators, while a low second count indicates relatively stable data. If the first count is significantly greater than the first threshold (i.e., a large number of key indicators), the first weight can be set higher, such as 0.7 or 0.8, to ensure greater focus on these key indicators and improve the accuracy of anomaly detection. If the second count is significantly greater than the second threshold (i.e., a greater number of volatile indicators), the second weight can be set lower, such as 0.2 or 0.3, to reduce over-reliance on these unstable indicators and avoid increased false alarm rates due to data fluctuations.

[0073] In the above embodiments, the key to determining the first and second weights lies in statistically analyzing and comparing the indicators with thresholds based on their importance and stability. The weights are then dynamically adjusted based on the comparison results to optimize model training and anomaly detection strategies under different business scenarios and time windows. This method can be flexibly applied to anomaly detection scenarios, improving the robustness and accuracy of anomaly detection.

[0074] In some exemplary embodiments, determining the masking result of time-series data based on the mask ratio includes: determining time-series sub-data for multiple time windows of the time-series data; wherein, the time-series sub-data for any time window is obtained by splitting the time-series data based on a preset time splitting step size; and selecting data from the time-series sub-data of the multiple time windows for masking processing based on the mask ratio to obtain masked data and unmasked data corresponding to the multiple time windows respectively; wherein, the masking result includes: masked data and unmasked data corresponding to the multiple time windows respectively.

[0075] Specifically, for each time-series sub-data within a time window, a portion of the data is randomly selected or processed using a specific strategy based on the masking ratio. The masking operation can involve replacing data values ​​(e.g., replacing them with zero or a specific value) or completely deleting data values, thereby simulating data loss or anomalies in real-world scenarios. Besides the masked data, the remaining data within each time window is retained as unmasked data. This data can be used as prompts or input features to train the model to predict the masked data values.

[0076] In the above embodiments, determining the masking result of time-series data based on the mask ratio is a key step in anomaly detection. By dividing the time-series data into multiple time windows and dynamically adjusting the mask ratio according to the importance and stability parameters of the indicators within each window, the time-series sub-data of multiple time windows are masked according to the mask ratio. The resulting masking result can effectively improve the accuracy of subsequent anomaly detection.

[0077] In some exemplary embodiments, such as Figure 4 As shown, the anomaly detection result of the corresponding time series data determined based on the mask processing result can be achieved through the following steps S402-S406:

[0078] S402, determine the time series sub-data corresponding to multiple time windows of the time series data; wherein, the time series sub-data of any time window is obtained by splitting the time series data based on a preset time splitting step size;

[0079] S404, based on a pre-trained anomaly detection model, masked data and unmasked data of time series sub-data in any time window of multiple time windows, performs anomaly prediction on time series sub-data in any time window, and obtains the detection result for time series sub-data in any time window.

[0080] S406, based on the detection results corresponding to multiple time windows, determines the anomaly detection results of the corresponding time series data.

[0081] Among them, the anomaly detection model is a neural network model based on a deep learning architecture that has been pre-trained on a large amount of data and possesses the basic ability to process time series data. Specifically, an anomaly detection model can be a large-scale model, which is a machine learning model with a huge number of parameters and high complexity, specifically referring to a neural network model with tens to hundreds of billions of parameters. Large-scale models themselves possess good text understanding and generation capabilities.

[0082] Specifically, unmasked data from any time window can be used as a cue word prefix input to the anomaly detection model. Simultaneously, the anomaly detection model needs to predict the masked portion of the data, i.e., the masked data. The unmasked and masked data together constitute the input and target output of the anomaly detection model. The anomaly detection model predicts the value of the masked data based on the unmasked data (cue word prefix). The prediction process essentially attempts to reconstruct the complete time-series sub-data. Based on this reconstruction process, the anomaly detection model can learn the correlations between different indicators and the behavioral patterns of normal data. If the difference between the anomaly detection model's predicted value and the actual masked data value is too large, the time window is considered an anomaly; otherwise, it is considered normal.

[0083] In some embodiments, for each time window, the anomaly detection model predicts the corresponding detection results, including determining whether the window is abnormal and the degree of abnormality. These detection results provide immediate feedback on the status of the target device, helping to quickly locate potential problem areas. After determining the detection results for all time windows, a comprehensive analysis is performed to determine whether there are anomalies in the entire time-series data stream, as well as the duration and severity of the anomalies. This step can be accomplished by calculating the proportion of abnormal windows, the average degree of anomaly, or the sequence pattern of abnormal windows, so that maintenance personnel can have a clear understanding of the overall system status.

[0084] In the above embodiments, within the framework of dynamic masking cue learning, determining the anomaly detection results of time-series data based on the masking processing results is a multi-step process involving data slicing, model prediction, and result integration. By using time window division and masking strategies, combined with a pre-trained anomaly detection model, abnormal states can be detected in real time and accurately, providing reliable data support for decision-makers and effectively responding to emergencies and system failures.

[0085] In some exemplary embodiments, based on a pre-trained anomaly detection model, masked data and unmasked data of time series sub-data in any time window across multiple time windows, anomaly prediction is performed on the time series sub-data of any time window to obtain a detection result for the time series sub-data of any time window. This includes: performing text processing on the unmasked data of the time series sub-data of any time window to obtain a text processing result; inputting the text processing result into the anomaly detection model so that the anomaly detection model performs anomaly prediction based on the text processing result to obtain a predicted value; comparing the predicted value with the true value determined by the masked data to obtain an error result; and comparing the error result with a set dynamic error threshold to obtain an anomaly detection result for any time window.

[0086] It's important to note that text processing is a step that transforms a numerical sequence into an input format that an anomaly detection model can understand. For example, given a time-series data set containing metrics such as CPU usage and memory consumption, its numerical sequence is first converted into a text sequence using mapping rules (such as a one-to-one correspondence between numerical values ​​and words). This facilitates subsequent input into the anomaly detection model for prediction. After conversion, the resulting text sequence provides the formal premise for the anomaly detection model's input. This text processing result contains all the unhidden information in the time-series data and forms the basis for the anomaly detection model's prediction mask data.

[0087] In some embodiments, for any given time window, the obtained text processing results are fed into a pre-trained anomaly detection model as input. The anomaly detection model outputs predicted values ​​for the masked data based on the input text processing results. This process involves complex internal model computations, including but not limited to activation attention mechanisms, feedforward layers, and normalization layers, to capture the correlation patterns between different indicators and apply these patterns to the predictions. The model's predicted values ​​are compared with the actual masked data values ​​to calculate the difference or error. Commonly used error metrics include mean squared error (MSE), which is the average of the squared differences between the model's predicted values ​​and the true values; a smaller MSE indicates a more accurate prediction. The error result is obtained through error calculation and compared with a dynamic error threshold. If the error exceeds the dynamic error threshold, it means that the anomaly detection model has significantly deviated from predicting certain indicators within the current time window, which may be due to anomalies. Therefore, if the error is greater than the dynamic error threshold, the current time window is marked as anomaly; otherwise, it is considered normal.

[0088] In some embodiments, the dynamic error threshold is not fixed, but is dynamically adjusted based on the trends and changes in recent data. The dynamic error threshold can be set according to the distribution characteristics of historical time window data, and the setting of the dynamic error threshold can ensure that the anomaly detection model can adapt to the seasonality, periodicity, or other fluctuation characteristics of the data distribution.

[0089] In the above embodiments, by converting unmasked data into text and inputting it into the model for anomaly prediction, then comparing the error with the actual value of the masked data, and finally combining the dynamic error threshold to determine the anomaly detection result for each time window, a highly adaptable and accurate detection scheme is proposed.

[0090] In some exemplary embodiments, the determination of the dynamic error threshold includes: when the time window of the time series sub-data belongs to the initial time window of multiple time windows, based on a set number of time windows, taking the first window of the multiple time windows as the starting window, determining a number of first target time windows, and calculating the dynamic error threshold based on the mean and standard deviation of the time series sub-data in the first target time windows; when the time window of the time series sub-data does not belong to the initial time window of multiple time windows, based on a set number of time windows, taking the time window of the time series sub-data as the ending window, determining a number of second target time windows, and calculating the dynamic error threshold based on the mean and standard deviation of the ending window and the mean and standard deviation of the time series sub-data in the second target time windows.

[0091] The initial time window refers to the first or first few time windows (such as the first 5, first 10, or first 15) selected during the anomaly detection process to initialize the model or statistical method.

[0092] Specifically, when the time window being processed is the initial time window in a sequence of multiple time windows, the determination of the dynamic error threshold is based on a sliding window statistical analysis. Specifically, based on a set number of time windows (e.g., the most recent 10 time windows), starting with the first window in the sequence, a sequence containing consecutive time windows is determined as the first target time window. Statistical analysis is performed on all time-series sub-data within this first target time window to calculate the overall mean and standard deviation of the data within these windows, and then the dynamic error threshold is calculated.

[0093] For non-initial time windows, i.e., when the processed time window is not the initial time window in the sequence, the method for determining the dynamic error threshold is slightly different. Based on a set number of time windows (e.g., still the most recent 10 time windows), the current processed time window is used as the endpoint to backtrack and determine a sequence containing consecutive time windows as the second target time window. The mean and standard deviation of all time series sub-data within the second target time window are then calculated, and the dynamic error threshold is subsequently calculated.

[0094] In the above embodiments, the determination of the dynamic error threshold, whether for the initial time window or subsequent non-initial time windows, is based on statistical analysis and a sliding window mechanism to adapt to the dynamic characteristics of time series data, thereby improving the accuracy of anomaly detection.

[0095] In some exemplary embodiments, text processing is performed on the unmasked data of time series sub-data in any time window to obtain a text processing result, including: concatenating the unmasked data of time series sub-data in chronological order to obtain a concatenated numerical sequence; and performing text conversion on the concatenated numerical sequence to obtain a text processing result.

[0096] Specifically, within each time window, according to a dynamic masking strategy, a portion of the indicator data is masked, while the other portion is retained as unmasked data. The unmasked data contains all the indicator information that the model can directly utilize within the current time window. Following the inherent order of the time series, all unmasked indicator data within the same time window are concatenated to form a continuous numerical sequence. To enable the anomaly detection model to process this numerical sequence, it needs to be converted into text form. This typically involves defining a mapping rule from numerical values ​​to text words; for example, mapping a specific range of numerical values ​​to a specific word or character sequence. Based on the defined conversion rule, each numerical value in the concatenated numerical sequence is converted into its corresponding text word. In this way, the entire numerical sequence is transformed into a sequence of text words, i.e., the text processing result.

[0097] In the above embodiments, by concatenating numerical sequences and converting text, the unmasked data of the time series sub-data is processed to convert the original data into an input format that the anomaly detection model can handle. This process can effectively utilize the advantages of the anomaly detection model in text understanding and improve the accuracy and efficiency of anomaly detection.

[0098] In some exemplary embodiments, the training steps of the anomaly detection model include: acquiring sample time-series data of the target device's indicators to be detected; performing correlation analysis on the sample time-series data to determine the sample importance parameter of the indicator to be detected, and performing stability analysis on the sample time-series data to determine the sample stability parameter of the indicator to be detected; determining the sample masking ratio for masking the sample time-series data based on the sample importance parameter and the sample stability parameter; determining the masking result of the sample time-series data based on the sample masking ratio, and fine-tuning the first parameter of the attention mechanism layer, the second parameter of the feedforward layer, and the third parameter of the normalization layer of the anomaly detection model to be trained based on the sample masking result, thereby obtaining the trained anomaly detection model.

[0099] Understandably, when training an anomaly detection model, sample time-series data of the indicators to be detected can be obtained from target devices (such as servers, network nodes, etc.), arranged in chronological order to form a time-series dataset. Similarly, correlation and stability analyses are performed on the sample time-series data, and the mask ratio is determined based on the sample importance parameter and sample stability parameter. The method for determining the mask ratio during training is the same as above and will not be repeated here. Generally, for indicators with high sample importance parameters and low sample stability parameters, the mask ratio should be reduced to allow them to participate more in model learning during training; while for indicators with low sample importance parameters and high sample stability parameters, the mask ratio can be appropriately increased to prevent the model from over-focusing on these volatile indicators and ignoring true anomaly signals.

[0100] Based on a predetermined sample masking ratio, the time-series sample data is masked, meaning that some indicator data is randomly hidden or according to a specific strategy. This process generates two parts: masked data and unmasked data. The unmasked data will be used as input to the anomaly detection model to be trained, referred to as "cue words" or "prefix input." Inputting the unmasked data (cue word prefix) into the anomaly detection model activates and fine-tunes the parameters of the attention mechanism layer, feedforward layer, and normalization layer to adapt to the characteristics of multi-indicator data and the masked input format.

[0101] In a specific application, unmasked data can be concatenated into a numerical sequence in chronological order, then converted into a text sequence, and used as the input prompt words for the anomaly detection model to be trained. During model training, the parameters of the attention layers, feed-forward networks, and layer normalization layers are updated to minimize the model's prediction error (such as MSE) on the masked data. Through iterative training, the anomaly detection model can learn how to accurately predict the masked indicator values ​​even without anomaly labels, thereby enhancing the model's ability to identify anomalous patterns.

[0102] In the above embodiments, the training process of the anomaly detection model is a meticulous and complex process, encompassing multiple stages such as data collection, analysis, masking, and parameter fine-tuning. By employing a strategy based on dynamic masking cue learning, the model can effectively learn the complex characteristics of multi-indicator time series data, improving the accuracy and efficiency of anomaly detection.

[0103] In some exemplary embodiments, the first parameter of the attention mechanism layer, the second parameter of the feedforward layer, and the third parameter of the normalization layer of the anomaly detection model to be trained are fine-tuned based on the sample masking processing results to obtain a trained anomaly detection model. This includes: determining sample time-series sub-data corresponding to multiple sample time windows of the sample time-series data; wherein the sample time-series sub-data is obtained by splitting the sample time-series data based on a preset sample time-splitting step size; performing text processing on the unmasked sample data of the sample time-series sub-data of any sample time window to obtain a text-processed sample; inputting the text-processed sample into the anomaly detection model to be trained, so that the anomaly detection model to be trained performs sample anomaly prediction based on the text-processed sample to obtain a sample prediction value; comparing the sample prediction value with the sample true value determined by the sample masking data to obtain a sample error result; if the sample error result is greater than a preset sample error threshold, performing parameter tuning on the first parameter of the attention mechanism layer, the second parameter of the feedforward layer, and the third parameter of the normalization layer of the anomaly detection model, and continuing to train the anomaly detection model according to the parameter tuning results until the training termination condition is met, thus obtaining a trained anomaly detection model.

[0104] It's important to note that before model training, multiple time windows can be defined from the sample time-series data. Each window includes a set of consecutive sample time-series sub-data. The size of the time window can be adjusted according to the specific business scenario and data characteristics. Based on a preset time-splitting step size, the sample time-series data is divided into multiple sample time-series sub-data. This step ensures the continuity and temporal representativeness of the data, while also facilitating model processing. For the sample time-series sub-data within each sample time window, the unmasked portions are concatenated in chronological order to convert them into a numerical sequence, which is then further converted into text processing samples. This process transforms the numerical time-series data into a text format that the language model can understand and process.

[0105] Specifically, text processing samples are input into the anomaly detection model to be trained. The model uses existing parameters and structure to predict anomalies in the samples and outputs predicted values. This step is part of the model learning process; through multiple iterations of training, the model gradually optimizes its parameters to improve prediction accuracy. The true values ​​of the sample mask data are obtained, and the model's output predicted values ​​are compared with them. The difference between the two is calculated, typically using mean squared error (MSE) or other error metrics suitable for time series prediction. Based on the calculated error, the model's prediction performance under the current parameter settings is evaluated. The sample error result is important feedback information during model training, guiding parameter fine-tuning. If the sample error result exceeds a preset sample error threshold (which usually indicates poor prediction performance), the parameters of the model's attention mechanism layer, feedforward layer, and normalization layer are adjusted (parameter tuning). Adjustment is usually done through backpropagation, updating model parameters based on the error gradient. Following the parameter tuning results, the model continues training, continuously receiving new text processing samples and predicting anomalies until the model's prediction error meets the training termination condition. This usually means that the model's prediction error has dropped to an acceptable level, or that the preset number of training rounds has been reached.

[0106] In the above embodiments, the fine-tuning of the parameters of the attention mechanism layer, feedforward layer, and normalization layer of the anomaly detection model is achieved through repeated iterations based on the error between the predicted and actual values ​​of the samples. This process fully utilizes the structural advantages of large language models, effectively capturing complex patterns in multi-indicator data and improving the accuracy and robustness of anomaly detection.

[0107] The embodiments described above are merely some embodiments of this application, and not all embodiments. To better understand the above methods, the following description, in conjunction with embodiments, illustrates the process, but is not intended to limit the technical solutions of the embodiments of this application. Specifically:

[0108] To address the issue of low accuracy in anomaly detection, this application provides an anomaly detection method for time-series data, such as... Figure 5 The diagram shown is a flowchart of the anomaly detection method for time-series data provided in this application:

[0109] S501, Data Preprocessing: Collect sample time-series data, impute missing values ​​in the sample time-series data, use linear interpolation to handle short-term missing values ​​(missing time points ≤ 5), and use forward fill to handle consecutive missing values ​​(missing time points > 5); correct outliers in the sample time-series data through 3... The principle is to identify outliers that exceed the normal range and replace them with the mean of the adjacent time windows of the outlier. The sample time series data is then standardized to transform data from different magnitudes to the same magnitude, generally using the following standardization formula:

[0110] like: ,in The mean, The standard deviation is used to ensure that time series data of different magnitudes can be directly input into the model to be trained, making it easier for the model to process.

[0111] S502, Divide the time window: Divide the processed sample time series data into several time windows according to the set time window size. This can be dynamically adjusted according to the business scenario. For cloud computing scenarios, 50-100 time points are recommended. In scenarios with higher real-time requirements, such as industrial scenarios, it can be shortened to 30 time points.

[0112] S503, Correlation Analysis and Stability Analysis. For correlation analysis, the importance of each indicator in each time window is calculated. The correlation between the indicator and the anomaly label is calculated based on mutual information. In unsupervised scenarios, pseudo-labels based on the initial model reconstruction error are used to replace the true labels. The formula is as follows:

[0113]

[0114] in It is the joint probability distribution function of X and Y, while and These are the marginal probability distribution functions of X and Y, respectively. The higher the value obtained, the more critical the indicator is for anomaly detection. X can refer to time series sub-data, and Y can refer to abnormal time series data.

[0115] For stability analysis, the mask ratio is dynamically adjusted based on the importance and volatility of each indicator. Volatility can be measured using the coefficient of variation. The calculation is performed, where μ is the mean and σ is the standard deviation. A higher value indicates more drastic fluctuations in the indicator.

[0116] S504, Determine the sample mask ratio: For indicators with high importance and low volatility, appropriately reduce the mask ratio; for indicators with low importance and high volatility, appropriately increase the mask ratio.

[0117] S505, Masking Processing: According to the dynamic masking ratio, a masking operation is performed on each time window to obtain the unmasked portion and the masked portion. First, for... and Normalization is performed, scaling the values ​​across all time windows to the [0, 1] interval to ensure consistent dimensions. Then, the dynamic mask ratio is calculated using the following formula:

[0118]

[0119] in, The weight α is set to 0.6 by default. This value primarily considers the direct correlation between the importance of the indicator and the accuracy of anomaly detection, ensuring that the masking ratio of highly important indicators (e.g., importance > 0.7) is generally below 20%. Volatility, on the other hand, reflects the stability of the indicator itself; highly volatile indicators are easily affected by interference and contribute relatively less to anomaly detection. Therefore, assigning higher weights to important indicators prioritizes ensuring key indicators have a lower masking probability, avoiding the loss of core features. Alternatively, the weight α can be dynamically adjusted based on the dataset. This can be achieved by calculating the importance-volatility distribution of all indicators in the dataset: if highly important indicators account for more than 75%, it indicates that important indicators dominate anomaly detection, and α can be increased to 0.7~0.8 to reduce their masking ratio; if low-importance and highly volatile indicators account for more than 60%, α can be reduced to 0.05 to balance the masking strategies for the two types of indicators. For example, a masking ratio of r = 0.6(1-0.8) + 0.4 × 0.05 = 0.14 indicates that this indicator is only masked with a 14% probability. Based on a dynamic ratio r, each indicator is selected and masked within each time window to obtain the unmasked portion (prompt word prefix) and the masked portion.

[0120] S506, Input unmasked sample data into the anomaly detection model to be trained: Concatenate the index values ​​of the unmasked part into a numerical sequence in order, convert it into a text sequence as a prompt word prefix, and input it into the open-source large language model for fine-tuning.

[0121] S507, Parameter Tuning: Activate the model's attention mechanism, feed-forward layers, and normalization layers. During fine-tuning, update the parameters of the model's attention layers, feed-forward networks, and layer normalization layers, and use MSE as the loss function to fine-tune the model using training data, enabling the model to accurately predict the metric values ​​of the masked portion.

[0122] S508, based on the trained anomaly detection model, expand the threshold to obtain the predicted value: In the testing phase, the test data is preprocessed and dynamically masked according to the above steps to obtain the unmasked part, and input into the fine-tuned model to obtain the predicted value for the masked part.

[0123] S509 calculates the mean square error (MSE) between the predicted value and the actual mask portion.

[0124] S510, Determine the dynamic error threshold, which is determined by the distribution characteristics of each time window, for the current time window. Dynamic error threshold The calculation formula is as follows:

[0125]

[0126] in, , These are the mean and standard deviation of the MSE over the past 10 windows, respectively. The threshold is calculated using statistics from the first 10 windows in the initial phase. This formula can calculate the threshold using historical data from a sliding window, and automatically adjusts the threshold when the data distribution in the current time window changes significantly.

[0127] S511, determine whether the mean square error is greater than the dynamic error threshold;

[0128] S512: If the current window If so, the time window is judged to be abnormal;

[0129] S513: If the current window If so, then the time window is considered normal.

[0130] The anomaly detection method for time-series data provided in this application dynamically determines the masking ratio and masking index based on the importance and volatility of the indicators. The masking ratio calculation formula, based on mutual information and the coefficient of variation, enables the implementation of low masking probability rules for high-importance indicators. Fine-tuning is achieved by activating the attention mechanism of a large language model: fully utilizing the attention mechanism to capture the dependencies between indicators, unlike existing techniques that only activate the feedforward and normalization layers. A dynamic threshold selection method is used: the threshold is dynamically adjusted according to the data distribution characteristics of the time window, overcoming the limitations of fixed thresholds.

[0131] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method.

[0132] Embodiments of this application also provide an anomaly detection device for time-series data, used to implement the above embodiments and preferred embodiments; details already described will not be repeated. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the modules described in the following embodiments are preferably implemented in software, hardware implementations, or a combination of software and hardware, are also possible and contemplated.

[0133] Figure 6 This is a structural block diagram of a time-series data anomaly detection device according to an embodiment of this application. The device includes:

[0134] The acquisition module 602 is used to acquire the time-series data of the indicators to be detected of the target device;

[0135] Analysis module 604 is used to perform correlation analysis on the time series data to determine the importance parameter of the indicator to be detected, and to perform stability analysis on the time series data to determine the stability parameter of the indicator to be detected.

[0136] The determining module 606 is used to determine the masking ratio for masking the time series data based on the importance parameter and the stability parameter;

[0137] The detection module 608 is used to determine the masking result of the time series data based on the masking ratio, and to determine the anomaly detection result of the corresponding time series data based on the masking result.

[0138] The aforementioned device acquires time-series data of the indicator to be detected, and performs correlation and stability analyses on the time-series data to obtain the importance and stability parameters of the indicator. Based on these parameters, a masking ratio for masking the time-series data is determined. This masking ratio determines the masking result, enabling anomaly detection based on the result. In other words, the masking ratio is determined based on the importance and stability parameters of the indicator to be detected, which are obtained through correlation and stability analyses of the time-series data. The masking ratio is dynamically determined based on the characteristics of the time-series data. Compared to setting a fixed masking ratio, this ratio, determined based on importance and stability parameters, effectively avoids unreasonable masking of the indicator to be detected, thus significantly improving the accuracy of anomaly detection.

[0139] In an exemplary embodiment, the analysis module 604 is further configured to split the time series data based on a preset time splitting step size to obtain time series sub-data corresponding to multiple time windows; perform correlation analysis on the time series sub-data corresponding to the multiple time windows to determine the importance parameters of the multiple time windows; and determine the importance parameters of the indicator to be detected based on the importance parameters of the multiple time windows.

[0140] In an exemplary embodiment, the analysis module 604 is further configured to determine the probability distribution value of any time window for any time-series sub-data within the plurality of time windows; wherein the probability distribution value includes: the joint probability distribution value between the time-series sub-data of any time window and the set abnormal time-series data, the first marginal probability distribution value of the time-series sub-data of any time window, and the second marginal probability distribution value of the set abnormal time-series data of any time window; taking the logarithm of the joint probability distribution value, the first marginal probability distribution value, and the second marginal probability distribution value of the time-series sub-data of any time window to obtain a logarithmic value; the logarithmic value is used to characterize the degree of correlation between the time-series sub-data of any time window and the abnormal time-series data; and assigning a value to the importance parameter of any time window based on the product of the probability distribution value of any time window and the logarithmic value to determine the importance parameter of the plurality of time windows.

[0141] In an exemplary embodiment, the analysis module 604 is further configured to determine the mean and standard deviation of the time series data, and based on the quotient of the mean and standard deviation of the time series data, determine the stability parameter of the time series data; and determine the stability parameter of the time series data as the stability parameter of the indicator to be detected.

[0142] In an exemplary embodiment, the determining module 606 is further configured to determine a first weight and a second weight; wherein the first weight is greater than the second weight; to obtain a first product based on the importance parameter and the first weight, and to obtain a second product based on the stability parameter and the second weight; and to determine a masking ratio for masking the time-series data based on the sum of the first product and the second product.

[0143] In an exemplary embodiment, the determining module 606 is further configured to determine a first quantity of a first detection indicator among the indicators to be detected, and a second quantity of a second detection indicator among the indicators to be detected; wherein, the first detection indicator refers to a detection indicator whose importance parameter is greater than a preset importance threshold; the second detection indicator refers to a detection indicator whose stability parameter is less than a preset stability threshold; the first quantity is compared with the first quantity threshold to obtain a first comparison result, and the second quantity is compared with the second quantity threshold to obtain a second comparison result; the first weight is determined based on the first comparison result, and the second weight is determined based on the second comparison result.

[0144] In an exemplary embodiment, the determining module 606 is further configured to determine time-series sub-data of multiple time windows of the time-series data; wherein, the time-series sub-data of any time window is obtained by splitting the time-series data based on a preset time-splitting step size; based on the masking ratio, data is selected from the time-series sub-data of the multiple time windows for masking processing to obtain masked data and unmasked data corresponding to the multiple time windows respectively; wherein, the masking processing result includes: masked data and unmasked data corresponding to the multiple time windows respectively.

[0145] In an exemplary embodiment, the detection module 608 is further configured to determine time-series sub-data corresponding to multiple time windows of the time-series data; wherein, the time-series sub-data of any time window is obtained by splitting the time-series data based on a preset time-splitting step size; based on a pre-trained anomaly detection model, masked data and unmasked data of the time-series sub-data of any time window in the multiple time windows, anomaly prediction is performed on the time-series sub-data of any time window to obtain a detection result for the time-series sub-data of any time window; based on the detection results corresponding to the multiple time windows, anomaly detection results for the corresponding time-series data are determined.

[0146] In an exemplary embodiment, the detection module 608 is further configured to perform text processing on the unmasked data of the time series sub-data of any time window to obtain a text processing result; input the text processing result into the anomaly detection model so that the anomaly detection model performs anomaly prediction based on the text processing result to obtain a predicted value; compare the predicted value with the true value determined by the masked data to obtain an error result; and compare the error result with a set dynamic error threshold to obtain the anomaly detection result of any time window.

[0147] In an exemplary embodiment, the detection module 608 is further configured to: when the time window of the time series sub-data belongs to the initial time window among the plurality of time windows, determine the number of first target time windows based on a set number of time windows, taking the first window among the plurality of time windows as the starting window, and calculate the dynamic error threshold based on the mean and standard deviation of the time series sub-data in the first target time window; and when the time window of the time series sub-data does not belong to the initial time window among the plurality of time windows, determine the number of second target time windows based on a set number of time windows, taking the time window of the time series sub-data as the ending window, and calculate the dynamic error threshold based on the mean and standard deviation of the time series sub-data in the second target time window.

[0148] In an exemplary embodiment, the detection module 608 is further configured to concatenate the unmasked data of the time-series sub-data in chronological order to obtain a concatenated numerical sequence; and to perform text conversion on the concatenated numerical sequence to obtain a text processing result.

[0149] In an exemplary embodiment, the device further includes a training module; the training module is configured to acquire sample time-series data of the target device's detection index; perform correlation analysis on the sample time-series data to determine the sample importance parameter of the target index, and perform stability analysis on the sample time-series data to determine the sample stability parameter of the target index; determine the sample masking ratio for masking the sample time-series data based on the sample importance parameter and the sample stability parameter; determine the masking result of the sample time-series data based on the sample masking ratio, and fine-tune the first parameter of the attention mechanism layer, the second parameter of the feedforward layer, and the third parameter of the normalization layer of the anomaly detection model to be trained based on the sample masking result, thereby obtaining the trained anomaly detection model.

[0150] In an exemplary embodiment, the training module is further configured to determine sample time series sub-data corresponding to multiple sample time windows of the sample time series data; wherein, the sample time series sub-data is obtained by splitting the sample time series data based on a preset sample time splitting step size; perform text processing on the unmasked sample data of the sample time series sub-data of any sample time window to obtain a text-processed sample; input the text-processed sample into the anomaly detection model to be trained, so that the anomaly detection model to be trained performs sample anomaly prediction based on the text-processed sample to obtain a sample prediction value; compare the sample prediction value with the sample true value determined by the sample mask data to obtain a sample error result; if the sample error result is greater than a preset sample error threshold, perform parameter tuning on the first parameter of the attention mechanism layer, the second parameter of the feedforward layer, and the third parameter of the normalization layer of the anomaly detection model, and continue training the anomaly detection model according to the parameter tuning result until the training termination condition is met, thereby obtaining a trained anomaly detection model.

[0151] For a description of the features in the embodiment corresponding to the time series data anomaly detection device, please refer to the relevant description of the embodiment corresponding to the time series data anomaly detection method. For a description of the features in the embodiment corresponding to the device startup device, please refer to the relevant description of the embodiment corresponding to the device startup method. They will not be repeated here.

[0152] Embodiments of this application also provide an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to perform the steps in any of the above embodiments of the anomaly detection method for timing data.

[0153] Embodiments of this application also provide a computer-readable storage medium storing a computer program, wherein the computer program is configured to execute the steps in any of the above-described embodiments of the anomaly detection method for time-series data when running.

[0154] In one exemplary embodiment, the aforementioned computer-readable storage medium may include, but is not limited to, various media capable of storing computer programs, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard disk, magnetic disk, or optical disk.

[0155] The embodiments of this application also provide a computer program product, which includes a computer program that, when executed by a processor, implements the steps in any of the above-described embodiments of the anomaly detection method for timing data.

[0156] Embodiments of this application also provide another computer program product, including a non-volatile computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps in any of the above-described embodiments of the anomaly detection method for timing data.

[0157] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0158] The above provides a detailed description of an anomaly detection method for time-series data provided in this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only intended to help understand the method and its core ideas. It should be noted that those skilled in the art can make various improvements and modifications to this application without departing from its principles, and these improvements and modifications also fall within the protection scope of the claims of this application.

Claims

1. A method for anomaly detection in time-series data, characterized in that, include: Obtain time-series data of the indicators to be tested for the target device; A correlation analysis is performed on the time-series data to determine the importance parameter of the indicator to be detected, and a stability analysis is performed on the time-series data to determine the stability parameter of the indicator to be detected; the importance parameter is used to characterize the correlation between the indicator to be detected and the abnormal state. Determine a first number of first detection indicators among the indicators to be detected, and a second number of second detection indicators among the indicators to be detected; wherein, the first detection indicator refers to the detection indicator whose importance parameter is greater than a preset importance threshold; and the second detection indicator refers to the detection indicator whose stability parameter is less than a preset stability threshold. The first quantity is compared with a first quantity threshold to obtain a first comparison result, and the second quantity is compared with a second quantity threshold to obtain a second comparison result; A first weight is determined based on the first comparison result, and a second weight is determined based on the second comparison result; wherein the first weight is greater than the second weight. A first product is obtained based on the importance parameter and the first weight, and a second product is obtained based on the stability parameter and the second weight; Based on the sum of the first product and the second product, the masking ratio for masking the time-series data is determined; The masking result of the time series data is determined based on the masking ratio, and the anomaly detection result of the corresponding time series data is determined based on the masking result.

2. The method according to claim 1, characterized in that, The step of performing correlation analysis on the time-series data to determine the importance parameter of the indicator to be detected includes: Based on a preset time-segmentation step size, the time-series data is segmented to obtain time-series sub-data corresponding to multiple time windows; Correlation analysis is performed on the time series sub-data corresponding to the multiple time windows to determine the importance parameters of the multiple time windows; The importance parameters of the indicator to be detected are determined based on the importance parameters of the multiple time windows.

3. The method according to claim 2, characterized in that, The step of performing correlation analysis on the time series sub-data corresponding to the multiple time windows to determine the importance parameters of the multiple time windows includes: For time series sub-data of any time window among the plurality of time windows, determine the probability distribution value of any time window; wherein, the probability distribution value includes: the joint probability distribution value between the time series sub-data of any time window and the set abnormal time series data, the first marginal probability distribution value of the time series sub-data of any time window, and the second marginal probability distribution value of the abnormal time series data set for any time window; The logarithm of the joint probability distribution value, the first marginal probability distribution value, and the second marginal probability distribution value of the time series sub-data in any time window is taken to obtain the logarithm value; the logarithm value is used to characterize the degree of correlation between the time series sub-data in any time window and the abnormal time series data; The importance parameter of any time window is assigned a value based on the product of the probability distribution value and the logarithmic value of any time window, so as to determine the importance parameters of the multiple time windows.

4. The method according to claim 1, characterized in that, The step of performing stability analysis on the time-series data to determine the stability parameters of the indicator to be detected includes: Determine the mean and standard deviation of the time series data, and determine the stability parameters of the time series data based on the quotient of the mean and standard deviation of the time series data; The stability parameters of the time series data are determined as the stability parameters of the index to be detected.

5. The method according to claim 1, characterized in that, The process of determining the masking result of the time-series data based on the mask ratio includes: Determine time series sub-data for multiple time windows of the time series data; wherein, the time series sub-data for any time window is obtained by splitting the time series data based on a preset time splitting step size; Based on the masking ratio, data is selected from the time-series sub-data of the multiple time windows for masking processing to obtain masked data and unmasked data corresponding to the multiple time windows respectively; wherein, the masking processing result includes: masked data and unmasked data corresponding to the multiple time windows respectively.

6. The method according to claim 1, characterized in that, The determination of the anomaly detection result of the corresponding time series data based on the mask processing result includes: Determine the time series sub-data corresponding to multiple time windows of the time series data; wherein, the time series sub-data of any time window is obtained by splitting the time series data based on a preset time splitting step size; Based on a pre-trained anomaly detection model, masked data and unmasked data of time series sub-data in any of the multiple time windows, anomaly prediction is performed on the time series sub-data of any of the time windows to obtain the detection result of the time series sub-data for any of the time windows. Based on the detection results corresponding to the multiple time windows, the anomaly detection results of the corresponding time series data are determined.

7. The method according to claim 6, characterized in that, The anomaly detection model based on the pre-trained model, masked data and unmasked data of time series sub-data in any of the multiple time windows, performs anomaly prediction on the time series sub-data of any time window to obtain the detection result for the time series sub-data of any time window, including: Text processing is performed on the unmasked data of the time series sub-data of any of the time windows to obtain the text processing result; The text processing result is input into the anomaly detection model so that the anomaly detection model can make anomaly prediction based on the text processing result and obtain a predicted value. The predicted value is compared with the true value determined by the mask data to obtain the error result; The error result is compared with the set dynamic error threshold to obtain the anomaly detection result for any given time window.

8. The method according to claim 7, characterized in that, The method for determining the dynamic error threshold includes: When the time window of the time series sub-data belongs to the initial time window among the multiple time windows, based on the set number of time windows, the first window among the multiple time windows is taken as the starting window, the number of time windows and the first target time window are determined, and the dynamic error threshold is calculated based on the mean and standard deviation of the time series sub-data in the first target time window. If the time window of the time series sub-data does not belong to the initial time window among the multiple time windows, based on the set number of time windows, the time window of the time series sub-data is used as the termination window to determine the number of second target time windows. Based on the mean and standard deviation of the time series sub-data in the second target time window, the dynamic error threshold is calculated.

9. The method according to claim 7, characterized in that, The step of performing text processing on the unmasked data of the time series sub-data of any time window to obtain the text processing result includes: The unmasked data of the time-series sub-data are concatenated in chronological order to obtain a concatenated numerical sequence. The concatenated numerical sequence is converted into text to obtain the text processing result.

10. The method according to claim 6, characterized in that, The training steps of the anomaly detection model include: Obtain sample time-series data of the target device's indicators to be tested; Correlation analysis is performed on the time series data of the samples to determine the sample importance parameter of the indicator to be detected, and stability analysis is performed on the time series data of the samples to determine the sample stability parameter of the indicator to be detected. Based on the sample importance parameter and the sample stability parameter, determine the sample masking ratio for masking the sample time series data; Based on the sample mask ratio, the masking result of the sample time series data is determined, and based on the sample masking result, the first parameter of the attention mechanism layer, the second parameter of the feedforward layer, and the third parameter of the normalization layer of the anomaly detection model to be trained are fine-tuned to obtain the trained anomaly detection model.

11. The method according to claim 10, characterized in that, The process of fine-tuning the first parameter of the attention mechanism layer, the second parameter of the feedforward layer, and the third parameter of the normalization layer of the anomaly detection model to be trained based on the sample masking processing result, to obtain the trained anomaly detection model, includes: The sample time series data is determined to correspond to multiple sample time windows respectively; wherein, the sample time series data is obtained by splitting the sample time series data based on a preset sample time splitting step size; Text processing is performed on the unmasked sample time series sub-data of any of the sample time windows to obtain a text-processed sample; The text processing sample is input into the anomaly detection model to be trained, so that the anomaly detection model to be trained can make anomaly prediction based on the text processing sample and obtain the sample prediction value. The sample prediction value is compared with the sample true value determined by the sample mask data to obtain the sample error result; If the sample error result is greater than the preset sample error threshold, the first parameter of the attention mechanism layer, the second parameter of the feedforward layer, and the third parameter of the normalization layer of the anomaly detection model are tuned, and the anomaly detection model is trained according to the tuning result until the training termination condition is met, and the trained anomaly detection model is obtained.

12. An anomaly detection device for time-series data, characterized in that, include: The acquisition module is used to acquire time-series data of the indicators to be tested from the target device; The analysis module is used to perform correlation analysis on the time series data to determine the importance parameter of the indicator to be detected, and to perform stability analysis on the time series data to determine the stability parameter of the indicator to be detected. The importance parameter is used to characterize the correlation between the indicator to be detected and the abnormal state; A determining module is configured to determine a first quantity of a first detection indicator among the indicators to be detected, and a second quantity of a second detection indicator among the indicators to be detected; wherein, the first detection indicator refers to a detection indicator whose importance parameter is greater than a preset importance threshold; the second detection indicator refers to a detection indicator whose stability parameter is less than a preset stability threshold; the first quantity is compared with the first quantity threshold to obtain a first comparison result, and the second quantity is compared with the second quantity threshold to obtain a second comparison result; a first weight is determined based on the first comparison result, and a second weight is determined based on the second comparison result; wherein, the first weight is greater than the second weight; a first product is obtained based on the importance parameter and the first weight, and a second product is obtained based on the stability parameter and the second weight; and a masking ratio for masking the time-series data is determined based on the sum of the first product and the second product. The detection module is used to determine the masking result of the time series data based on the mask ratio, and to determine the anomaly detection result of the corresponding time series data based on the masking result.

13. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor, configured to implement the steps of the anomaly detection method for time-series data as described in any one of claims 1 to 11 when executing the computer program.

Images