Method and system for detecting anomaly of multivariate time series of two-channel architecture

Abstract

The invention provides a multivariate time sequence anomaly detection method and system of a two-channel architecture, and relates to the technical field of data processing. In the two-channel network architecture provided by the embodiment of the invention, the Fourier operator and the Mama model are integrated, and the advantages of frequency domain feature enhancement and time domain sequence modeling can be utilized at the same time. In the calculation process, the two-channel network architecture regards an independent time sequence as a variable mark and regards a plurality of variables with the same timestamp as a time mark, and the time dependence of time sequence data and potential interaction between the variables are captured in parallel through the two-channel architecture; therefore, the accurate reconstruction of the original time sequence and the accurate positioning of the abnormity are realized.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data processing, and in particular to a multi-element time series anomaly detection method and system based on a dual-channel architecture. BACKGROUND

[0002] In recent years, many industries have adopted sensors to monitor facilities and systems to ensure their normal operation. This practice has led to an explosion of related time series data. In order to improve production efficiency, safety and security, time series anomaly detection has become a key part of intelligent monitoring systems. Time series anomaly detection is a fundamental component of time series analysis, which refers to identifying abnormal patterns or events in normal time series data. Traditional anomaly detection algorithms mainly focus on detecting anomalies in univariate time series. However, in the real world, time series data is often multi-dimensional. Multivariate time series (MTS) with multiple variables provides a more comprehensive perspective for the monitored system, but as the number of variables increases, anomaly detection in large-scale databases becomes increasingly challenging.

[0003] Traditional anomaly detection methods are generally unable to effectively model the complex temporal dynamics and interdependence between variables possessed by multivariate time series. Therefore, as deep learning models have become increasingly capable of learning rich representations of complex time series (e.g., multi-dimensional time series), deep learning methods have been widely applied to multi-dimensional time series anomaly detection in multi-dimensional data with spatial and temporal characteristics.

[0004] However, the scarcity of labeled data and the heterogeneity of anomalies limit the effectiveness of supervised learning models in this field. Therefore, recent research on multi-dimensional time series anomaly detection has focused on the development of unsupervised methods. These methods are mainly based on prediction or reconstruction methods. Due to the complex variation patterns of multi-dimensional time series data and the fact that not all influencing factors can be recorded, prediction-based methods perform poorly in practical applications.

[0005] Recent studies have shown that reconstruction-based methods have superior performance on various real-world datasets. These reconstruction-based methods aim to learn a latent representation of the normal time series data trend in an unsupervised manner and reconstruct the multi-dimensional time series through a decoder. The deviation between the reconstructed sequence and the original sequence is then used as an anomaly score, and various extreme value analysis methods are used to determine certain timestamps as anomalies based on the anomaly score. The most common anomaly detection neural network model is based on RNN and its variants LSTM and GRU. They usually reconstruct time series by identifying sequence patterns, such as OmniAnomaly, LSTM-NDT, LSTM-VAE, GGM-VAE, etc.

[0006] However, recurrent neural networks (RNNs) and their variants are recursive models that are slow and computationally expensive. Graph neural network (GNN)-based models, such as GDN, can learn relationships between different variables, but they ignore the varying importance of variables at each time period in multivariate time series (MTS). Furthermore, GNN-based methods are computationally expensive. This has prompted researchers to seek faster, more cost-effective models that capture powerful latent representations. Transformer-based models, such as TranAD, can effectively address the significant computational overhead of recursion while effectively modeling long-term trends. The Transformer model's structure allows for parallel reasoning on the entire input sequence after positional encoding, replacing recursive reasoning. This significantly accelerates anomaly detection and offers significant advantages in capturing long-term dependencies. However, both recursive and Transformer-based models, due to their excessive focus on dependencies between time points, often overlook the underlying relationships between variables in multivariate time series. Summary of the Invention

[0007] The present invention provides a multivariate time series anomaly detection method and system with a dual-channel architecture to at least partially solve the above-mentioned problems.

[0008] A first aspect of the present invention provides a multivariate time series anomaly detection method with a dual-channel architecture, the method comprising: Obtain the multivariate time series to be detected; Inputting the multivariate time series to be detected into a pre-trained multivariate time series anomaly detection network to obtain an anomaly detection result; The multivariate time series anomaly detection network has a dual-channel architecture, with each channel integrating a Fourier operator and a Mamba group. The multivariate time series anomaly detection network uses the time series of each variable as a variable tag and multiple variable observations with the same timestamp as time tags. The dual-channel architecture is used to capture the temporal dependencies of time series data and the potential interactions between variables in parallel.

[0009] Optionally, the multivariate time series to be detected is input into a pre-trained multivariate time series anomaly detection network to obtain an anomaly detection result, including: The adaptive normalization module of the multivariate time series anomaly detection network normalizes the multivariate time series to obtain data embedding; The time Fourier operator of the multi-dimensional time series anomaly detection network performs Fourier transform and frequency domain feature enhancement on the time-labeled data embedding to obtain time-transformed data, the time Mamba group of the multi-dimensional time series anomaly detection network encodes the time-transformed data to extract the time state of the multi-dimensional time series data to obtain time-encoded data, and the time decoder of the multi-dimensional time series anomaly detection network decodes the time-encoded data to obtain a time reconstruction sequence; The variable Fourier operator of the multi-dimensional time series anomaly detection network performs Fourier transform and frequency domain feature enhancement on the variable-labeled data embedding to obtain variable-transformed data; the variable Mamba group of the multi-dimensional time series anomaly detection network encodes the variable-transformed data to extract the potential state between multiple variables of the multi-dimensional time series data to obtain variable-encoded data, and the variable decoder of the multi-dimensional time series anomaly detection network decodes the variable-encoded data to obtain a variable reconstruction sequence; The time reconstruction sequence and the variable reconstruction sequence are fused to obtain a reconstruction sequence; Based on the reconstruction sequence and the multi-dimensional time series, a reconstruction error is obtained, and based on the reconstruction error, an anomaly detection result is obtained.

[0010] Optionally, the training set of the multi-dimensional time series anomaly detection network is: , wherein T represents the number of timestamps in the time series, M represents the number of variables in the time series, and the training set only contains normal timestamps; The test set of the multi-dimensional time series anomaly detection network is: , and the label is , wherein represents the timestamp t is a normal timestamp, represents the timestamp t is abnormal.

[0011] Optionally, the multi-dimensional time series anomaly detection network is obtained by reverse propagation training using mean square error as a loss function:

[0012] , wherein, wherein represents an input sequence, R represents a reconstruction sequence.

[0013] Optionally, the adaptive normalization module of the multi-dimensional time series anomaly detection network normalizes the multi-dimensional time series to obtain a data embedding, including: Let all data of the time series be , N Indicates the number of time points of the data, is the index of the variable, W To adapt the normalization window size, the normalization calculation process for each point in the initial normalization window is as follows:

[0014] in, and is the mean and variance of the data in the initial standardized window. These values ​​are used to standardize each point in the initial standardized window to obtain the standardized data ; For each point after the initial normalization window , determine its corresponding mean and variance , according to the sequence state of the nearest window of each point, the statistics in the normalization calculation are smoothly adjusted to obtain the standardized data , to ensure that the normal point is always as close to zero as possible when the sequence state does not change suddenly, thereby reducing the reconstruction error of the normal point; the normalization calculation process for each point outside the initial normalization window is as follows: , , .

[0015] Optionally, the temporal decoder and the variable decoder integrate a linear attention mechanism, use linear normalization instead of a nonlinear Softmax function, and Q and K Using additional kernel functions σ ; Based on the associative law of matrix multiplication, Convert to , reducing the computational complexity to ; set up Indicates that D Variable dimensions N A sequence of time points; The linear attention calculation process of the temporal decoder and the variable decoder is as follows: , , , ; The time decoder and the variable decoder are added with convolution layers for feature aggregation before modal conversion, and are also added with multiple activation functions to give the decoder nonlinear characteristics. The time decoder and the variable decoder are also added with a skip connection and a point multiplication operation to realize selective memory and increase the weight of important memory.

[0016] The second aspect of the present application provides a dual-channel architecture multi-variate time series anomaly detection device, which comprises: An acquisition module is configured to acquire a multi-variate time series to be detected. A detection module is configured to input the multi-variate time series to be detected into a pre-trained multi-variate time series anomaly detection network to obtain an anomaly detection result. The multi-variate time series anomaly detection network is of a dual-channel architecture, each channel integrates a Fourier operator and a Mamba group, the multi-variate time series anomaly detection network takes a time series of each variable as a variable label and takes multiple variable observations with the same timestamp as a time label, and captures time-dependent relationships of time series data and potential interactions between variables in parallel through the dual-channel architecture.

[0017] The third aspect of the present application provides an electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the processor implements the dual-channel architecture multi-variate time series anomaly detection method according to the time aspect of the present application.

[0018] The fourth aspect of the present application provides a computer readable storage medium having a computer program stored thereon, wherein the program is executable on a processor to implement the dual-channel architecture multi-variate time series anomaly detection method according to the time aspect of the present application.

[0019] The fifth aspect of the present application provides a computer program product comprising a computer program / instruction, wherein the computer program / instruction is executable on a processor to implement the steps in the dual-channel architecture multi-variate time series anomaly detection method according to the time aspect of the present application.

[0020] In the embodiment of the present application, the time continuity of time series data is utilized, statistical parameters are adaptively adjusted according to the local historical context of each point, and point-by-point standardization is performed. This method preserves the intrinsic characteristics of data while enhancing the detection ability of the model for abnormal situations. In the embodiment of the present application, normal points and abnormal points are distinguished within the adaptive standardization window, thereby improving the sensitivity and robustness of anomaly detection.

[0021] In the dual-channel network architecture provided in the embodiment of the present application, the Fourier operator and the Mamba model are integrated, and the advantages of frequency domain feature enhancement and time domain sequence modeling can be utilized simultaneously. In the calculation process, the dual-channel network architecture respectively regards independent time sequences as variable labels and multiple variables with the same timestamp as time labels, and captures the time dependence of the time sequence data and the potential interaction between variables in parallel through the dual-channel architecture, so as to realize accurate reconstruction of the original time sequence and accurate positioning of the anomaly. BRIEF DESCRIPTION OF DRAWINGS

[0022] In order to more clearly illustrate the technical solutions of the present application, the drawings needed to be used in the description of the present application will be briefly introduced as follows. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can also be obtained by those skilled in the art without creative labor on the basis of these drawings.

[0023] Figure 1 is a step flow chart of the multivariate time series anomaly detection method of the dual-channel architecture provided by the present application; Figure 2 is a data processing flowchart of the multivariate time series anomaly detection network of the multivariate time series anomaly detection method of the dual-channel architecture provided by the present application; Figure 3 is a hardware structure diagram of a device with data processing capability in which the dual-channel architecture multivariate time series anomaly detection device provided by the present application is located. DETAILED DESCRIPTION

[0024] In order to make the above-mentioned purposes, features and advantages of the present application more obvious and easy to understand, the present application will be further described in detail below in combination with the drawings and specific embodiments.

[0025] As shown in Figure 1 , it shows a step flow chart of the multivariate time series anomaly detection method of the dual-channel architecture provided by the embodiment of the present application, and specifically, the method comprises the following steps: S101, obtaining a multivariate time series to be detected.

[0026] S102, inputting the multivariate time series to be detected into a pre-trained multivariate time series anomaly detection network to obtain an anomaly detection result.

[0027] In the embodiment of the present application, the multivariate time series anomaly detection network is a double-channel architecture, each channel integrates a Fourier operator and a Mamba group, the multivariate time series anomaly detection network takes the time series of each variable as a variable label, takes multiple variable observations with the same timestamp as a time label, and captures the time dependence of the time series data and the potential interaction between variables in parallel through the double-channel architecture.

[0028] In the embodiment of the present application, two factors are considered simultaneously: a) the inherent complex time dependence and randomness in multivariate time series data, and b) the potential interaction between variables. From the perspective of network architecture, the present application integrates the selective state space model (i.e. Mamba model) with the Fourier operator, and builds a double-channel Mamba through a variable explicit modeling strategy. The double-channel structure can capture the correlation between variables by taking the entire time series of each variable as a label, while encoding the time relationship of the time series. The Mamba model has been proven to have excellent sequence modeling ability, even surpassing the Transformer in many fields. The Fourier operator can adaptively enhance the normal features of the input sequence in the frequency domain and send them to the subsequent module for sequence reconstruction, thereby reducing the influence of abnormal values on the sequence reconstruction process. Finally, based on the model design of Mamba and the linear attention mechanism, the present application designs a faster and more effective decoder for the Mamba-based network. The decoding process includes decoding the time and variable relationships by the time decoder and the variable decoder respectively, and then organically combining them to accurately reconstruct the original time series.

[0029] Specifically, in the embodiment of the present application, the step S102 includes: S1021, the adaptive standardization module of the multivariate time series anomaly detection network standardizes the multivariate time series to obtain data embedding.

[0030] The previous research on neural network anomaly detection mainly focuses on the construction of network architecture, and ignores data processing. They usually use the most common min-max normalization method to preprocess the data before network training. When normalizing the test set using the maximum and minimum values of the training set, due to the uncertainty of abnormal values, the absolute distance between some abnormal values and their surrounding normal points may be compressed, thus reducing the reconstruction error of abnormal values and decreasing the accuracy of anomaly detection. If the classic Z-score standardization method is used, due to the constant change of sequence state, not all normal points are close to the mean value, which will cause the normal points to move away from zero after standardization, thus increasing the reconstruction error. Based on this, the present application proposes a novel standardization method for time series anomaly detection, called adaptive standardization. This method considers the anomaly in time series as a local property of the sequence. Anomaly detection is only related to the nearest time point, not the distant time period. Based on the continuity of time series data, the statistical value corresponding to each point is adaptively calculated according to the past data state in the window, and then standardized. After adaptive standardization, the sequence not only does not destroy the inherent difference between abnormal points and their surrounding normal points, but also due to the adaptive change of statistical value, the normal points will tend to be distributed around the zero value after standardization, thus reducing the subsequent reconstruction error. In fact, in the anomaly detection work, there is no need to worry too much about the change of data distribution. Extremly, the ideal standardization sequence should make the value of all normal points 0 and the value of all abnormal points 1, so that the present application can easily find the anomaly in the sequence. Adaptive standardization is proposed based on this idea.

[0031] The adaptive standardization module proposed by the present application uses the continuity of time series data to adaptively adjust the relevant statistics according to the local past data state of each point, and standardizes point by point. This process preserves the inherent difference between abnormal values and their adjacent normal points, and makes normal points distribute around zero. The method of the present application reduces the reconstruction error of normal observations while maintaining the sensitivity to abnormal conditions.

[0032] When using the classical normalization method or the standardization method, in order not to change the data distribution, the usual practice is to first calculate the statistics such as mean, variance, maximum and minimum on the training set. Then use these statistics to normalize or standardize the test set. In the time series anomaly detection process, since there is no abnormal value in the training set, and the data state of the training set is quite different from that of some local segments in the test set, when using the statistics of the training set to process the test set, due to the randomness and locality of the abnormal value, the distance between the abnormal value and the surrounding normal points in the test set may be compressed, and the inherent difference between the abnormal value and the surrounding normal points will be destroyed, thereby reducing the reconstruction error of the abnormal value. In fact, in time series anomaly detection, since there is no need to predict data, it is not necessary to worry too much about the change of data distribution. To put it bluntly, the ideal standardized sequence should make the value of all normal points 0 and the value of all abnormal points 1, so that the abnormal value can be easily found in the sequence. Based on this idea, an adaptive standardization method is proposed. The present application uses the continuity of time series and proposes an adaptive standardization module to realize the adaptive standardization method.

[0033] Specifically, in the embodiment of the present application, the step S1021 comprises: Let all the data of the time series be , N denote the number of time points of the data, is the index of the variable, W is the adaptive standardization window size, and the standardization calculation process of each point in the initial standardization window is as follows:

[0034] wherein, and are the mean and variance of the data in the initial standardization window, respectively, and the standardized data is obtained by standardizing each point in the initial standardization window using these values. For each point after the initial standardization window, determine its corresponding mean and variance , and adjust the statistics in the normalization calculation smoothly according to the sequence state of the recent window to obtain the standardized data , so as to ensure that the normal points are always as close to zero as possible when the sequence state does not change suddenly, thereby reducing the reconstruction error of the normal points; the standardization calculation process of each point outside the initial standardization window is as follows: , , .

[0035] During the processing of the adaptive normalization module, when the state at a certain time point changes suddenly (the possibility of anomaly is high), since this point is very different from the most recent sequence state, normalization will move it away from zero, thereby increasing the reconstruction error.

[0036] In this embodiment of the present invention, the hyperparameter adaptive normalization window size is used W To control how recent the past is, we ignore more distant periods. This hyperparameter setting is related to factors such as the frequency of change of the time series data and the stability of the state.

[0037] In the embodiment of the present invention, Figure 2 The data processing flow diagram of the multivariate time series anomaly detection network of the multivariate time series anomaly detection method of the dual-channel architecture provided by the present invention is shown as follows: Figure 2 As shown in Figure 1, part (a) represents the adaptive standardization module (AdaptiveStandardization) of the multivariate time series anomaly detection network provided by the embodiment of the present invention. The multivariate time series input to the network is first processed by the adaptive standardization module to obtain the data embedding , and then enter the subsequent dual-channel architecture for further processing.

[0038] S1022, the time Fourier operator of the multivariate time series anomaly detection network performs Fourier transform and frequency domain feature enhancement on the embedded data with time tags to obtain time-transformed data, the time Mamba group of the multivariate time series anomaly detection network encodes the time-transformed data, extracts the time state of the multivariate time series data, and obtains time-coded data, and the time decoder of the multivariate time series anomaly detection network decodes the time-coded data to obtain a time reconstructed sequence.

[0039] S1023, the variable Fourier operator of the multivariate time series anomaly detection network performs Fourier transform and frequency domain feature enhancement on the data embedded with variable labels to obtain variable transformed data; the variable Mamba group of the multivariate time series anomaly detection network encodes the variable transformed data, extracts the potential states between multiple variables of the multivariate time series data, and obtains variable encoded data; the variable decoder of the multivariate time series anomaly detection network decodes the variable encoded data to obtain a variable reconstructed sequence.

[0040] The main goal of the multivariate time series anomaly detection network described in the embodiment of the present invention is to reconstruct the time series by learning the normal pattern of the multivariate time series (MTS) and output an anomaly score for each timestamp.

[0041] In the embodiment of the present application, the multivariate time series anomaly detection network is composed of four components: an adaptive standardization module, a Fourier operator, a Mamba group and a decoder. In the network architecture of the present application, the multivariate observation value of each time step and the complete time series corresponding to each variable are respectively regarded as separate labels in the dual-channel architecture. Then the dual-channel encoding mechanism is used to capture the complex dependence relationship in the time dimension and the variable dimension in parallel.

[0042] In the embodiment of the present application, the Fourier operator and the Mamba model are integrated into the dual-channel architecture, effectively utilizing the advantages of the Fourier operator in frequency domain feature enhancement and the advantages of the Mamba model in time domain sequence modeling.

[0043] In the dual-channel architecture of the present application, one channel regards the time series of each variable as a variable label, and the other channel regards the multivariate observation value with the same timestamp as a time label, thereby capturing the time dependence relationship of the time series data and the potential interaction between variables in parallel through the dual-channel architecture.

[0044] In the multivariate time series anomaly detection network provided by the embodiment of the present application, the Fourier operator can adaptively enhance the normal features of the input sequence, so that it enters the subsequent module for sequence reconstruction, thereby reducing the influence of abnormal points on the sequence reconstruction process. As shown in part (b) of the above table, the Fourier operator (Fourier operator) is introduced in the embodiment of the present application to perform Fourier transform (Fast Fourier transform) and frequency domain feature enhancement (Frequency domain convolution and filtering) on the input data, and to use fewer and more important frequency domain features to reconstruct the original data, so as to reduce the influence of anomalies on data reconstruction and expand the reconstruction error of anomalies. The Fourier operator is defined as follows: Figure 2 ; , wherein represents the Fourier transform, represents the inverse Fourier transform. represents matrix multiplication, is a parameterized complex-valued tensor. In the calculation process, the present application only selects lower Fourier modes and filters out higher modes. During the operation of the network, the present application can use fast Fourier transform (FFT) and fast inverse Fourier transform (IFFT) for efficient calculation: .

[0045] ​​The Mamba model is a model based on a state space model SSM (specifically a structured state space sequential model S4). The aim is to improve the long sequence reasoning capability of the model based on context by S4. The SSM model maps a one-dimensional sequence or function h ( t ) to another one-dimensional function y ( t ) through a state function x ( t ): ; ; where is the evolution parameter, , is the projection parameter. denotes h ( t ) the derivative with respect to time t . To handle discrete sequences, the parameters need to be discretized. The continuous parameters A , B , C are discretized by a time step parameter .

[0046] In the Mamba model, the parameters are usually discretized using a zero-order holder (ZOH), which is defined as follows: ; ; After discretizing A and B , the equation can be expressed as: ; .

[0047] To train the model more efficiently and feasibly, the output of the above recursive process can be parallelized by convolution: ; ; where L denotes the length of the input sequence x , * denotes the convolution operation; the vector is the core of the structured convolution SSM, and on this basis, the Mamba also introduces a selection mechanism, so that the dimension of the parameter depends on the dimension of the input sequence, so that it can handle dynamic input: ; ; Assume that , . Since the parameter matrix is now dynamic, it can no longer be calculated using the convolution representation (convolutional neural networks require fixed convolution kernels), so the Mamba model uses a hardware-aware algorithm to efficiently calculate the selective SSM. The hardware-aware algorithm uses three classic techniques: parallel scanning, convolution kernel fusion, and recalculation.

[0048] Considering that the one-way selection mechanism of the Mamba model makes it unable to process global variables like the Transformer. In the embodiments of the present application, the selection uses a bidirectional Mamba model composed of two Mambas to encode global variables, as shown in (c) of Figure 2 , which is called a Mamba block. The Mamba block is defined as follows: ; ; .

[0049] In the architecture of the present application, the Mamba block is used to extract the contextual latent state representation of the original input sequence data. The present application uses two Mamba blocks (time Mamba block and variable Mamba block) in a dual-channel architecture to extract the time state of the multivariate time series data and the latent state between multiple variables, respectively. For the encoding of variable relationships, the present application calculates the entire time series of each variable as a token.

[0050] As shown in Figure 2 , after the Fourier operator and the Mamba block in the dual-channel architecture are processed, the time encoding data ( ) and the variable encoding data ( ) are obtained, respectively, and then decoded by the decoder to obtain the time reconstruction sequence and the variable reconstruction sequence.

[0051] In the embodiments of the present application, the time decoder and the variable decoder integrate linear attention mechanisms, use linear normalization instead of the nonlinear Softmax function, and use additional kernel functions Q and K ; based on the associative law of matrix multiplication, convert σ to , and reduce the computational complexity to ; ; Let represent a D variable dimension Na sequence of time points; the linear attention computation process of the temporal decoder and the variable decoder is as follows: , , , ; The temporal decoder and the variable decoder are added with a convolution layer before modal conversion for feature aggregation, and are also added with multiple activation functions to give the decoder nonlinear characteristics; The temporal decoder and the variable decoder are also added with a skip connection and a dot product operation to realize selective memory and increase the weight of important memory.

[0052] Recent studies have shown that the performance of the Mamba model often outperforms the Transformer model in many applications. Related research has made a detailed analysis of the similarities and differences between the Mamba model and the linear attention Transformer, and pointed out that the forget gate and the modular design are the key factors of the high efficiency of the Mamba model. This finding shows that Mamba can be regarded as a variant of the linear attention Transformer, which is characterized by the use of a special linear attention mechanism and an improved modular design. Therefore, a new decoder is developed for the Mamba-based network in the embodiment of the present application.

[0053] In the embodiment of the present application, the decoder (such as Figure 2 shown in part (d) of the above) adopts a unique Mamba module design and reduces the complexity by integrating a linear attention mechanism, so as to efficiently and effectively decode the input sequence data. In the decoder of the embodiment of the present application, LePE, CPE and RoPE are used to replace the local bias of the forget gate. This method uses the input of the relevant position information and the global position information, thereby avoiding the recursive calculation required by the forget gate and improving the throughput of the model.

[0054] Since the linear attention mechanism cannot provide sufficient nonlinear characteristics for the decoder, a convolution layer is added before modal conversion for feature aggregation, and multiple activation functions are added to give the decoder nonlinear characteristics. The embodiment of the present application also adds a skip connection and a dot product operation in the decoder to realize selective memory and increase the weight of important memory.

[0055] S1024, fuse the temporal reconstruction sequence and the variable reconstruction sequence to obtain a reconstruction sequence.

[0056] After decoding by the decoder, in the embodiment of the application, a time reconstruction sequence and a variable reconstruction sequence are obtained through two parallel paths based on time relationship and variable relationship respectively. The application connects them and performs weight distribution and deep fusion through a multi-layer perception (MLP) to obtain a final reconstruction sequence.

[0057] In S1025, a reconstruction error is obtained based on the reconstruction sequence and the multivariate time sequence, and an anomaly detection result is obtained based on the reconstruction error.

[0058] In the embodiment of the application, a time sequence is generally defined as a continuous observation value collected at an equal-interval timestamp. In the embodiment of the application, a multivariate time sequence (MTS) is mainly concerned, which can describe the overall state of a system. The application divides the continuous MTS into a training set and a test set to train a multivariate time sequence anomaly detection network.

[0059] The training set of the multivariate time sequence anomaly detection network is: , wherein T represents the number of timestamps in the time sequence, M represents the number of variables in the time sequence, and the training set only contains normal timestamps; The test set of the multivariate time sequence anomaly detection network is: , and the label is , wherein, represents the timestamp t is a normal timestamp, represents the timestamp t is abnormal.

[0060] As shown in Figure 2 , in the embodiment of the application, the multivariate time sequence anomaly detection network is obtained through back propagation training using mean square error as a loss function:

[0061] , wherein, wherein represents an input sequence, R represents a reconstruction sequence.

[0062] The adaptive normalization method in the multivariate time series anomaly detection method provided in the embodiment of the application utilizes the continuity of time series data and the locality of anomalies, and performs normalization in the local sequence of each timestamp. By adopting the adaptive normalization method, when an anomaly occurs, it can be more easily distinguished from normal points in the local sequence, thereby improving the anomaly detection accuracy of the model. The combination of the adaptive normalization module and the Fourier operator can greatly improve the quality of data utilization. One of the significant advantages of the multivariate time series anomaly detection method provided in the embodiment of the application is the enhanced attention to the interaction between multiple variables, which makes it different from previous anomaly detection models. The multivariate time series anomaly detection model takes the entire time series of each variable as a label to calculate variable-related attention, so that the potential feature representation of the sequence can be utilized from the perspectives of variables and time.

[0063] Based on the same inventive concept, the application further provides a multivariate time series anomaly detection device with a dual-channel architecture, comprising: An acquisition module is configured to acquire a multivariate time series to be detected. A detection module is configured to input the multivariate time series to be detected into a pre-trained multivariate time series anomaly detection network to obtain an anomaly detection result. The multivariate time series anomaly detection network has a dual-channel architecture, and integrates a Fourier operator and a Mamba group in each channel. The multivariate time series anomaly detection network takes the time series of each variable as a variable label and takes multiple variable observations with the same timestamp as a time label, and captures the time dependence of time series data and the potential interaction between variables in parallel through the dual-channel architecture.

[0064] Optionally, the detection module is configured to: An adaptive normalization module of the multivariate time series anomaly detection network normalizes the multivariate time series to obtain data embedding. A time Fourier operator of the multivariate time series anomaly detection network performs Fourier transform and frequency domain feature enhancement on the data embedding with the time label to obtain time-transformed data. A time Mamba group of the multivariate time series anomaly detection network encodes the time-transformed data to extract the time state of the multivariate time series data and obtain time-encoded data. A time decoder of the multivariate time series anomaly detection network decodes the time-encoded data to obtain time-reconstructed sequences. The variable Fourier operator of the multivariate time series anomaly detection network performs Fourier transform and frequency domain feature enhancement on the data embedding with variable labels to obtain variable transformed data; the variable Mamba group of the multivariate time series anomaly detection network encodes the variable transformed data to extract the potential state between multiple variables of the multivariate time series data, and obtains variable encoded data; and the variable decoder of the multivariate time series anomaly detection network decodes the variable encoded data to obtain a variable reconstruction sequence. The time reconstruction sequence and the variable reconstruction sequence are fused to obtain a reconstruction sequence. Based on the reconstruction sequence and the multivariate time series, a reconstruction error is obtained, and based on the reconstruction error, an anomaly detection result is obtained.

[0065] Optionally, the training set of the multivariate time series anomaly detection network is: , wherein T represents the number of timestamps in the time series, M represents the number of variables in the time series, and the training set only contains normal timestamps; The test set of the multivariate time series anomaly detection network is: , and the label is , wherein represents the timestamp t is a normal timestamp, represents the timestamp t is abnormal.

[0066] Optionally, the multivariate time series anomaly detection network is obtained by reverse propagation training using mean square error as a loss function:

[0067] , wherein, wherein represents an input sequence, R represents a reconstruction sequence.

[0068] Optionally, the detection module is configured to: Let all data of the time series be , N represents the number of time points of the data, is the index of the variable, W is the size of the adaptive standardization window, and the standardization calculation process of each point in the initial standardization window is as follows:

[0069] , wherein and is the mean and variance of the data in the initial normalization window, respectively, and the data after normalization is obtained by normalizing each point in the initial normalization window using these values ; For each point after the initial normalization window , its corresponding mean and variance are determined, and the statistics in the normalization calculation are adjusted smoothly according to the sequence state of the recent window to obtain the normalized data , so as to ensure that the normal point is as close to zero as possible when the sequence state does not change suddenly, thereby reducing the reconstruction error of the normal point; the normalization calculation process of each point outside the initial normalization window is as follows: , , .

[0070] Optionally, the time decoder and the variable decoder integrate a linear attention mechanism, use linear normalization instead of a nonlinear Softmax function, and use an additional kernel function σ in Q and K ; based on the associativity of matrix multiplication, convert to , and reduce the calculation complexity to ; Let represent a sequence of D time points with a variable dimension of N ; The linear attention calculation process of the time decoder and the variable decoder is as follows: , , , ; The time decoder and the variable decoder are added with a convolution layer for feature aggregation before modal conversion, and the decoder is also added with multiple activation functions to give the decoder nonlinear characteristics; The time decoder and the variable decoder are also added with a skip connection and a dot product operation to realize selective memory and increase the weight of important memory.

[0071] The embodiment of the dual-channel architecture multi-element time sequence anomaly detection device provided by the application can be applied to any device with data processing capability, which can be a device or apparatus such as a computer. The device embodiment can be realized by software, or realized by hardware or a combination of software and hardware. Taking software realization as an example, as a logical device, it is formed by reading the corresponding computer program instructions in the non-volatile memory into the memory and running by the processor of the device with data processing capability. From the hardware level, as shown in Figure 3 The embodiment of the dual-channel architecture multi-element time sequence anomaly detection device provided by the application can be applied to any device with data processing capability, which can be a device or apparatus such as a computer. The device embodiment can be realized by software, or realized by hardware or a combination of software and hardware. Taking software realization as an example, as a logical device, it is formed by reading the corresponding computer program instructions in the non-volatile memory into the memory and running by the processor of the device with data processing capability. From the hardware level, as shown in Figure 3 The embodiment of the dual-channel architecture multi-element time sequence anomaly detection device provided by the application can be applied to any device with data processing capability, which can be a device or apparatus such as a computer. The device embodiment can be realized by software, or realized by hardware or a combination of software and hardware. Taking software realization as an example, as a logical device, it is formed by reading the corresponding computer program instructions in the non-volatile memory into the memory and running by the processor of the device with data processing capability. From the hardware level, as shown in

[0072] Based on the same inventive concept, the application further provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the dual-channel architecture multi-element time sequence anomaly detection method according to any one of the above embodiments when executed.

[0073] Based on the same inventive concept, the application further provides a computer readable storage medium, which stores a computer program, wherein the program is executed by a processor to implement the steps of the dual-channel architecture multi-element time sequence anomaly detection method according to any one of the above embodiments.

[0074] Based on the same inventive concept, the application provides a computer program product, which includes computer programs / instructions, wherein the computer programs / instructions are executed by a processor to implement the steps of the dual-channel architecture multi-element time sequence anomaly detection method according to any one of the above embodiments.

[0075] Each embodiment in the specification is described in a progressive manner, and each embodiment focuses on the difference from other embodiments. The same and similar parts between each embodiment can be referred to each other.

[0076] Those skilled in the art should understand that the embodiments of the application can be provided as a method, device, or computer program product. Therefore, the application can be in the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the application can be in the form of a computer program product implemented on one or more computer usable storage media containing computer usable program code (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.).

[0077] The present application is described in reference to the flowchart and / or block diagrams of the method, terminal device (apparatus), and computer program product in accordance with the present application. It will be understood that each block of the flowchart and / or block diagrams, and combinations of blocks in the flowchart and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart and / or block diagram block or blocks. Figure 1 one or more flowcharts and / or blocks Figure 1 means for carrying out the function specified by the block or blocks.

[0078] These computer program instructions can also be stored in a computer- readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instructions which implement the flowchart and / or block diagram block or blocks. Figure 1 one or more flowcharts and / or blocks Figure 1 means for carrying out the function specified by the block or blocks.

[0079] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the flowchart and / or block diagram block or blocks. Figure 1 one or more flowcharts and / or blocks Figure 1 means for carrying out the function specified by the block or blocks.

[0080] While preferred embodiments of the application have been described, additional variations and modifications can be made to these embodiments by those skilled in the art once they have the benefit of the foregoing description. Therefore, the appended claims are intended to encompass within their scope all possible variations and modifications of the preferred embodiments.

[0081] Finally, it needs to be pointed out that in the present application, the relational terms such as first and second and the like are used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. Moreover, the terms "comprises", "comprising", or any other variations thereof, are intended to cover a non-exclusive inclusion such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can include other elements not expressly listed or inherent to such process, method, article, or apparatus. An element proceeded by "comprises... a" does not, without more constraints, exclude the existence of additional identical elements in the process, method, article, or apparatus that comprises the recited element.

[0082] The above describes in detail the method for detecting multi-element time sequence anomaly provided by the dual-channel architecture of the present application, and the principle and implementation manner of the present application are described by using specific examples. The above description of the examples is only used to help understand the method of the present application and its core idea. Meanwhile, for those skilled in the art, the specific implementation manner and application range will be changed according to the idea of the present application. In summary, the content of the specification should not be understood as a limitation of the present application.

Claims

1. A multivariate time series anomaly detection method with a dual-channel architecture, characterized in that: The method comprises: Obtain the multivariate time series to be detected; Inputting the multivariate time series to be detected into a pre-trained multivariate time series anomaly detection network to obtain an anomaly detection result; The multivariate time series anomaly detection network has a dual-channel architecture, with each channel integrating a Fourier operator and a Mamba group. The multivariate time series anomaly detection network uses the time series of each variable as a variable tag and multiple variable observations with the same timestamp as time tags. The dual-channel architecture is used to capture the temporal dependencies of time series data and the potential interactions between variables in parallel.

2. The multivariate time series anomaly detection method with a dual-channel architecture according to claim 1, characterized in that: Inputting the multivariate time series to be detected into a pre-trained multivariate time series anomaly detection network to obtain anomaly detection results, including: The adaptive normalization module of the multivariate time series anomaly detection network normalizes the multivariate time series to obtain data embedding; The time Fourier operator of the multivariate time series anomaly detection network performs Fourier transform and frequency domain feature enhancement on the embedded data with time tags to obtain time-transformed data. The time Mamba group of the multivariate time series anomaly detection network encodes the time-transformed data and extracts the time state of the multivariate time series data to obtain time-coded data. The time decoder of the multivariate time series anomaly detection network decodes the time-coded data to obtain a time-reconstructed sequence. The variable Fourier operator of the multivariate time series anomaly detection network performs Fourier transform and frequency domain feature enhancement on the data embedded with the variable label to obtain variable transformed data; the variable Mamba group of the multivariate time series anomaly detection network encodes the variable transformed data, extracts the potential states between multiple variables of the multivariate time series data, and obtains variable encoded data; the variable decoder of the multivariate time series anomaly detection network decodes the variable encoded data to obtain a variable reconstructed sequence; fusing the time reconstruction sequence and the variable reconstruction sequence to obtain a reconstructed sequence; A reconstruction error is obtained based on the reconstruction sequence and the multivariate time series, and an anomaly detection result is obtained based on the reconstruction error.

3. The multivariate time series anomaly detection method with a dual-channel architecture according to claim 1, characterized in that: The training set of the multivariate time series anomaly detection network is: ,in T represents the number of timestamps in the time series, M Represents the number of variables in the time series, and the training set only contains normal timestamps; The test set of the multivariate time series anomaly detection network is: , tagged ,in, Indicates timestamp t is a normal timestamp, Indicates timestamp t is abnormal.

4. The dual-channel architecture multivariate time series anomaly detection method according to claim 3, characterized in that: The multivariate time series anomaly detection network is trained by back propagation using mean square error as the loss function: Among them, represents the input sequence, R Represents the reconstruction sequence.

5. The dual-channel architecture multivariate time series anomaly detection method according to claim 2, characterized in that: The adaptive normalization module of the multivariate time series anomaly detection network normalizes the multivariate time series to obtain data embedding, including: Assume that all the time series data are , N Indicates the number of time points of the data, is the index of the variable, W To adapt the normalization window size, the normalization calculation process for each point in the initial normalization window is as follows: in, and is the mean and variance of the data in the initial standardized window. These values ​​are used to standardize each point in the initial standardized window to obtain the standardized data ; For each point after the initial normalization window , determine its corresponding mean and variance , according to the sequence state of the nearest window of each point, the statistics in the normalization calculation are smoothly adjusted to obtain the standardized data , to ensure that the normal point is always as close to zero as possible when the sequence state does not change suddenly, thereby reducing the reconstruction error of the normal point; the normalization calculation process for each point outside the initial normalization window is as follows: ， ， 。 6. The multivariate time series anomaly detection method with a dual-channel architecture according to claim 2, characterized in that: The temporal decoder and the variable decoder integrate the linear attention mechanism, use linear normalization instead of the nonlinear Softmax function, and Q and K Using additional kernel functions σ ; Based on the associative law of matrix multiplication, Convert to , reducing the computational complexity to ; set up Indicates that D Variable dimensions N A sequence of time points; the linear attention calculation process of the temporal decoder and the variable decoder is as follows: ， ， ， ； The temporal decoder and the variable decoder are added with a convolution layer for feature aggregation before modality conversion, and the decoder is also added with multiple activation functions to give the decoder nonlinear characteristics; The temporal decoder and the variable decoder also add skip connections and dot product operations to achieve selective memory and increase the weight of important memories.

7. A multivariate time series anomaly detection device with a dual-channel architecture, characterized in that: The dual-channel architecture multivariate time series anomaly detection device comprises: An acquisition module is used to obtain the multivariate time series to be detected; A detection module, configured to input the multivariate time series to be detected into a pre-trained multivariate time series anomaly detection network to obtain an anomaly detection result; The multivariate time series anomaly detection network has a dual-channel architecture, with each channel integrating a Fourier operator and a Mamba group. The multivariate time series anomaly detection network uses the time series of each variable as a variable tag and multiple variable observations with the same timestamp as time tags. The dual-channel architecture is used to capture the temporal dependencies of time series data and the potential interactions between variables in parallel.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the multivariate time series anomaly detection method with a dual-channel architecture according to any one of claims 1 to 6 is implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the multivariate time series anomaly detection method with a dual-channel architecture according to any one of claims 1 to 6 is implemented.

10. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instruction is executed by a processor, the steps of the multivariate time series anomaly detection method with a dual-channel architecture are implemented.

Images