Multivariate time sequence anomaly detection method and system based on spatio-temporal knowledge

Abstract

The invention discloses a multivariate time series anomaly detection method and system based on spatio-temporal knowledge. The method comprises the steps that specified sensor data or index data form multivariate time series data; periodic time sequence decomposition and causal discovery are carried out to construct a space-time knowledge graph, nodes in the space-time knowledge graph represent the state of each variable in specific time, directed edges represent the causal relationship between the variables, and the weights of the directed edges reflect the causal influence intensity; performing data preprocessing and feature extraction on the multivariate time sequence data to obtain sequence features; extracting space-time synchronous attention features from the space-time causal knowledge graph and the sequence features by using a space-time synchronous attention network; and performing anomaly detection based on the spatio-temporal synchronization attention features to determine whether the device or the network is abnormal or not. The invention aims to simultaneously model complex short-term and long-term space-time dependencies for multivariate time series anomaly detection and fuse prior causal relationship knowledge to improve the anomaly detection accuracy and reduce false alarms.

Description

Technical Field

[0001] This invention relates to the field of multivariate time series anomaly detection technology, specifically to a multivariate time series anomaly detection method and system based on spatiotemporal knowledge, applicable to time series data analysis in fields such as network operation and maintenance, IoT monitoring, and network security. Background Technology

[0002] In modern industrial, information, and network systems, critical equipment and services often generate large amounts of multivariate time-series (MTS) data through multiple sensors. Efficient anomaly detection of this data is a core task for ensuring stable system operation and preventing failures. Existing methods mostly employ deep learning techniques, such as Long Short-Term Memory (LSTM) networks, autoencoders, and Generative Adversarial Networks (GANs), for anomaly detection. Some methods also integrate Graph Neural Networks (GNNs) to model the relationships between variables. However, existing technologies suffer from the following problems: 1) Disjointed modeling of spatial and temporal dependencies: Most methods model spatial and temporal features separately, making it difficult to capture the synchronous and overlapping spatiotemporal dependencies in the real world. 2) Difficulty in identifying spurious correlations: Traditional graph structures are mostly constructed based on the correlation between variables, lacking causal reasoning capabilities and potentially misleading anomaly detection. 3) Neglecting lag effects and cross-temporal dependencies: Spatiotemporal dependencies often have lag effects, which most existing models do not consider, reducing detection accuracy. 4) Insufficient model generalization ability: When faced with novel types of anomalies, statistical learning-based models are prone to false positives or false negatives. Therefore, there is an urgent need for a method that can simultaneously model dependencies in the spatiotemporal dimensions, integrate static causal knowledge to guide the learning process, and improve the robustness and interpretability of detecting complex anomaly patterns. Summary of the Invention

[0003] The technical problem to be solved by the present invention is to provide a multivariate time series anomaly detection method and system based on spatiotemporal knowledge, which addresses the above-mentioned problems in the prior art. The present invention aims to model complex short-term and long-term spatiotemporal dependencies and integrate prior causal knowledge for multivariate time series anomaly detection to improve the accuracy of anomaly detection and reduce false alarms.

[0004] To solve the above-mentioned technical problems, the technical solution adopted by the present invention is as follows: A multivariate time series anomaly detection method based on spatiotemporal knowledge includes the following steps: S101, acquiring multivariate time series data composed of specified sensor data or indicator data; S102, performing periodic temporal decomposition and causal discovery on the multivariate time series data to construct a spatiotemporal knowledge graph, where nodes in the spatiotemporal knowledge graph represent the state of each variable at a specific time, directed edges represent causal relationships between variables, and the weights of directed edges reflect the strength of causal influence; performing data preprocessing and feature extraction on the multivariate time series data to obtain sequence features; S103, extracting spatiotemporal synchronous attention features from the spatiotemporal causal knowledge graph and sequence features using a spatiotemporal synchronous attention network; S104, performing anomaly detection based on the spatiotemporal synchronous attention features to determine whether there are anomalies in the device or network.

[0005] Optionally, step 102, which involves periodically decomposing and causally discovering the input multivariate time series data to construct a spatiotemporal knowledge graph, includes: S201, for the input multivariate time series data , For multivariate time series data Time window size, For multivariate time series data The dominant period is identified using the Fast Fourier Transform and according to the following formula. ; , , , in, Indicates to Round down to the nearest integer. For the frequency with the largest amplitude, For any frequency, The amplitude corresponding to each frequency, For multivariate time series data The results of the fast Fourier transform, For amplitude calculation operation, For in dimension Average calculation operation on; S202, multivariate time series data Based on the dominant cycle Perform periodic time-series decomposition; S203, after time series decomposition, the multivariate time series data is expanded along the time axis, and causal discovery is performed according to the following formula to extract the preset time lag. Internal time lag Causal effects between variables weight matrix ; , in, Current timestamp variables, For time lag variables, To simulate random variables influenced or disturbed by external factors; the various time lags variables Causal effects between weight matrix any element in the i-th row and j-th column express causal relationship Indicates the first Time lag of each variable variables, Indicates the direction of causal relationship. Indicates the current timestamp The One variable, express A causal relationship exists; otherwise, it means... The causal relationship does not exist; S204, delaying time variables Causal effects between weight matrix Constructing a spatiotemporal causal knowledge matrix The constructed spatiotemporal causal knowledge matrix Variables with a time lag of 0 on the middle diagonal Causal effects between weight matrix The element in the upper right corner represents time lag. variables Causal effects between weight matrix ; S205, for matrices Different time lags The weight matrix is ​​grouped and the average value of the groups is taken to obtain the final spatiotemporal causal knowledge graph.

[0006] Optionally, step 102 involves preprocessing the input multivariate time series data and extracting features to obtain sequence features, including: S301, for the input multivariate time series data The data is standardized using the min-max normalization method, where For multivariate time series data Time window size, For multivariate time series data The dimensions; the standardized multivariate time series data A one-dimensional convolutional neural network is used for feature extraction to extract sequences of high-order features; S302, the sequence of high-order features is divided into overlapping patches, and the non-overlapping region between two patches is... Thus, the patch sequence is obtained. , For the length of the patch, For the number of patches, , As the dominant cycle, Indicates to Round down; S303, using a linear layer to sequence patches Projecting into a high-dimensional space yields sequence features ,in To hide the dimension.

[0007] Optionally, the spatiotemporal synchronous attention network includes multiple spatiotemporal synchronous attention modules. Step S103, which involves extracting spatiotemporal synchronous attention features from the spatiotemporal causal knowledge graph and sequence features using the spatiotemporal synchronous attention network, includes: S401, after sampling the sequence features through the input window, input them into each spatiotemporal synchronous attention module, and then perform spatiotemporal synchronous attention feature extraction in each spatiotemporal synchronous attention module in combination with the spatiotemporal causal knowledge graph. S402, extract the features obtained from each i-th spatiotemporal synchronization attention module. The combined feature representation is obtained after splicing. ,in The length of the patch in the sequence features. For multivariate time series data Dimensions To hide dimensions; S403, representing the integrated features Input a gated recurrent unit (GRU) to obtain spatiotemporal synchronous attention features.

[0008] Optionally, in step S401, when each spatiotemporal synchronization attention module performs spatiotemporal synchronization attention feature extraction in conjunction with the spatiotemporal causal knowledge graph, the spatiotemporal synchronization attention feature extraction for any i-th spatiotemporal synchronization attention module includes: S501, Obtain features sampled from sequence features ; S502, features sampled from sequence features Extracting attention graphs using graph attention networks ; S503, if the i-th spatiotemporal synchronized attention module is the 1st spatiotemporal synchronized attention module, then directly apply the attention graph. As an enhanced attention diagram Otherwise, pay attention to the diagram. The spatiotemporal causal attention graph output by the (i-1)th spatiotemporal synchronization attention module The enhanced attention diagram is obtained by splicing. ; S504, enhanced attention diagram The spatiotemporal causal knowledge graph is concatenated with the spatiotemporal causal knowledge graph, and then the concatenated feature map is convolved through multi-channel convolution to obtain the spatiotemporal causal fusion graph. ; S505, enhanced attention diagram Fusion diagram of spacetime causality Linear fusion yields a spatiotemporal causal attention map ; S506, Spatiotemporal Causal Attention Graph As input to the (i+1)th spatiotemporal synchronization attention module, and the spatiotemporal causal attention graph is used. and features sampled from sequence features Multiply to obtain the output features of the i-th spatiotemporal synchronization attention module. ; S507, from the output features of the i-th spatiotemporal synchronization attention module Feature cropping is performed to obtain the features extracted by the i-th spatiotemporal synchronization attention module. .

[0009] Optionally, step S104, which involves anomaly detection based on spatiotemporal synchronous attention features to determine whether an anomaly exists in the device or network, includes: S601, the spatiotemporal synchronous attention features are used to generate reconstruction probabilities for each variable through a reconstruction model and predicted values ​​for each variable through a prediction model; S602, calculate the anomaly score based on the reconstruction probability and predicted value of each variable. : , in, For multivariate time series data Dimensions For variables Predicted value Compared with the true value The squared error, To reconstruct the model for variables The probability of encountering an anomaly. For variables The score, The hyperparameters that combine the reconstruction probability and the predicted value; S603, Determine abnormal scores Does it exceed a preset threshold? If the score for a certain timestamp is abnormal? If the detection result exceeds the preset threshold, the detection result of whether there is an anomaly in the device or network at that timestamp is marked as "abnormal"; otherwise, the detection result of whether there is an anomaly in the device or network at that timestamp is marked as "normal".

[0010] Optionally, the prediction model is a three-layer fully connected network; the reconstruction model is a GRU-VAE model, which uses a gated recurrent unit (GRU) as the encoder and decoder of a variational autoencoder (VAE) to learn data in the latent representation. The marginal distribution on the graph, the prediction model and the reconstruction model update the parameters of both models simultaneously during training, and the loss function used when updating the parameters of the prediction model and the reconstruction model. The function expression is: , in, The loss function of the prediction model, The loss function for reconstructing the model; , , in, For multivariate time series data Dimensions For the first Variables The true value of a moment for The predicted value, As the expected value, Given the expected negative log-likelihood of the input, The encoder for the GRU-VAE model. For data, for The data in the potential representation, for about Conditional distribution, For encoder distribution KL divergence, for The edge density, and has , ,in, For the true posterior density, for Edge density.

[0011] Furthermore, the present invention also provides a multivariate time series anomaly detection system based on spatiotemporal knowledge, comprising a microprocessor and a memory interconnected thereto, wherein the microprocessor is programmed or configured to execute the multivariate time series anomaly detection method based on spatiotemporal knowledge.

[0012] Furthermore, the present invention also provides a computer-readable storage medium storing a computer program or instructions that are programmed or configured to execute the spatiotemporal knowledge-based multivariate time series anomaly detection method by a processor.

[0013] In addition, the present invention also provides a computer program product, including a computer program or instructions, which are programmed or configured to execute the spatiotemporal knowledge-based multivariate time series anomaly detection method by a processor.

[0014] Compared with existing technologies, this invention mainly achieves the following beneficial effects: This invention simultaneously integrates spatial dependence, temporal dependence, and causal relationships between variables, comprehensively capturing complex dependencies in multivariate time series, overcoming the problem of insufficient relationship capture caused by the traditional method's fragmented processing of spatial and temporal information. Furthermore, by introducing explicit causal knowledge, this invention can distinguish between variables with genuine causal relationships and those with accidental correlations, thereby significantly reducing the false alarm rate in anomaly detection and improving detection accuracy and stability. Simultaneously, this invention employs an advanced spatiotemporal synchronous attention mechanism, effectively enhancing the ability to focus on key variables and time periods, further improving the sensitivity and robustness of anomaly detection. Therefore, this invention is particularly suitable for handling scenarios with complex dependencies across high dimensions, multiple variables, and multiple time periods, exhibiting significant technical advantages in anomaly detection in such scenarios. Attached Figure Description

[0015] Figure 1 This is a schematic diagram of the basic process of the method in an embodiment of the present invention.

[0016] Figure 2 This is a schematic diagram illustrating the principle of the method in an embodiment of the present invention.

[0017] Figure 3 This is a schematic diagram of the spatiotemporal causal knowledge graph process constructed in an embodiment of the present invention.

[0018] Figure 4 This is a schematic diagram of the spatiotemporal causal knowledge graph constructed in an embodiment of the present invention.

[0019] Figure 5 This is a schematic diagram of the spatiotemporal synchronous attention network in an embodiment of the present invention.

[0020] Figure 6 The above are visualization analysis results comparing the method of the present invention with other existing methods in terms of the number of parameters, model size and inference latency. (a) is the visualization analysis result comparing the number of parameters, (b) is the visualization analysis result comparing the model size and (c) is the visualization analysis result comparing the inference latency. Detailed Implementation

[0021] To enable those skilled in the art to better understand the technical solutions of the present invention, the technical solutions of the present invention will be further described in detail below with reference to the accompanying drawings in the embodiments of the present invention.

[0022] like Figure 1 As shown, the multivariate time series anomaly detection method based on spatiotemporal knowledge in this embodiment includes the following steps: S101, acquiring multivariate time series data composed of specified sensor data or indicator data; S102, performing periodic temporal decomposition and causal discovery on the multivariate time series data to construct a spatiotemporal knowledge graph, where nodes in the spatiotemporal knowledge graph represent the state of each variable at a specific time, directed edges represent causal relationships between variables, and the weights of directed edges reflect the strength of causal influence; performing data preprocessing and feature extraction on the multivariate time series data to obtain sequence features; S103, extracting spatiotemporal synchronous attention features from the spatiotemporal causal knowledge graph and sequence features using a spatiotemporal synchronous attention network; S104, performing anomaly detection based on the spatiotemporal synchronous attention features to determine whether there are anomalies in the device or network. See also Figure 2In this embodiment, the input data (multivariate time series data) includes two independent processing branches: one branch performs periodic temporal decomposition and causal discovery to construct a spatiotemporal knowledge graph; the other branch performs data preprocessing and feature extraction (represented by patches and linear layers in the diagram) to obtain sequence features. Overall, it can be divided into four main steps: spatiotemporal causal knowledge graph construction, data preprocessing and feature extraction, spatiotemporal synchronous attention network construction, and anomaly detection. In this embodiment, the multivariate time series data consists of specified sensor data or indicator data, which can be specified as needed. For example, it can be voltage and current sensor data to detect anomalies in power equipment or power networks; it can be IoT sensor data to detect anomalies in IoT devices or IoT networks. The IoT sensor data includes some or all of the following: temperature, humidity, air quality, light intensity, pressure, speed, location, vibration, displacement, pH, gas composition, voltage, current, power, image, flow rate, and liquid level. It can also be network key performance indicators (KPIs) to detect anomalies in IoT devices or IoT networks. These KPIs include: network availability, mean time to recovery (MTTR), network latency, bandwidth and bandwidth utilization, packet loss rate and retransmission rate, throughput, security incident response time, and security vulnerability patching cycle. Part or all of a Cycle.

[0023] See Figure 3 In this embodiment, step 102 involves periodically decomposing and discovering causal relationships within the input multivariate time series data to construct a spatiotemporal knowledge graph, including: S201 refers to the input data, namely: multivariate time series data. , For multivariate time series data Time window size, For multivariate time series data The dominant period is identified using the Fast Fourier Transform (FFT) in the dimension of the equation. ; , , , in, Indicates to Round down to the nearest integer. For the frequency with the largest amplitude, For any frequency, The amplitude corresponding to each frequency, For multivariate time series data The results of the fast Fourier transform, For amplitude calculation operation, For in dimension Average calculation operation on; S202, multivariate time series data Based on the dominant cycle Perform periodic time-series decomposition; S203, In order to extract causal dependencies between variables spanning multiple time steps in the constructed spatiotemporal causal knowledge graph, its dimensions are expanded along the time axis. The relationships between variables from the lag timestamp to the current timestamp can be determined by causal relationships discovered through VAR-LiNGAM. Specifically, in this embodiment, the dimensions of the multivariate time series data after time series decomposition are expanded along the time axis, and causal discovery is performed according to the following formula to extract the preset time lag. Internal time lag Causal effects between variables weight matrix ; , in, Current timestamp variables, For time lag variables, To simulate random variables influenced or disturbed by external factors; the various time lags variables Causal effects between weight matrix any element in the i-th row and j-th column express causal relationship Indicates the first Time lag of each variable variables, Indicates the direction of causal relationship. Indicates the current timestamp The One variable, express A causal relationship exists; otherwise, it means... The causal relationship does not exist; S204, delaying time variables Causal effects between weight matrix Constructing a spatiotemporal causal knowledge matrix The constructed spatiotemporal causal knowledge matrix Variables with a time lag of 0 on the middle diagonal Causal effects between weight matrix The element in the upper right corner represents time lag. variables Causal effects between weight matrix ; S205, for matrices Different time lags The weight matrix is ​​grouped and the average value of the groups is taken to obtain the final spatiotemporal causal knowledge graph.

[0024] As a specific implementation method, time lag is used in this embodiment. The quantity is set to That is, calculation , and Causal relationships between variables Their corresponding causal weight matrices are respectively , , , respectively represent , as well as The spatiotemporal causal knowledge matrix obtained from the causal relationships of time-varying variables. like Figure 4 As shown, the spatiotemporal causal knowledge graph can be viewed as a combination of nine subgraphs, including: four subgraphs representing the same timestamp, one lagging timestamp, two lagging timestamps to the current time step, and a blank graph (where no inverse causal relationship exists in the time dimension). The spatiotemporal causal knowledge graphs obtained from each group are summed and averaged to obtain the final spatiotemporal causal knowledge graph. Take the average of the groups, and form a spatiotemporal causal knowledge graph. It includes the spatiotemporal causal relationships between variables and the causal effects.

[0025] In step 102 of this embodiment, the input multivariate time series data undergoes data preprocessing and feature extraction to obtain sequence features, including: S301, for the input multivariate time series data The data is standardized using the min-max normalization method, where For multivariate time series data Time window size, For multivariate time series data The dimension of is expressed as a function: , in, and The maximum and minimum values ​​in the training / test set; the standardized multivariate time series data. A one-dimensional convolutional neural network is used for feature extraction to extract sequences of high-order features; this method can enhance data consistency and extract richer high-order features. S302, In order to increase the computational efficiency of the model, this embodiment will use the sequence of higher-order features ( The area is divided into overlapping patches, and the non-overlapping area between two patches is... Thus, the patch sequence is obtained. , For the length of the patch, For the number of patches, , As the dominant cycle, Indicates to Round down; before dividing into overlapping patches, this can be achieved by repeating the last value of the sequence of higher-order features. The padding is then inserted to the end of the original sequence to ensure that the patch size is aligned; S303, using a linear layer to sequence patches Projecting into a high-dimensional space yields sequence features ,in To hide the dimension.

[0026] See Figure 5 In this embodiment, the spatiotemporal synchronous attention network includes multiple spatiotemporal synchronous attention modules. Step S103 involves using the spatiotemporal causal knowledge graph and sequence features to extract spatiotemporal synchronous attention features, including: S401, after sampling the sequence features through the input window, input them into each spatiotemporal synchronous attention module, and then perform spatiotemporal synchronous attention feature extraction in each spatiotemporal synchronous attention module in combination with the spatiotemporal causal knowledge graph. S402, extract the features obtained from each i-th spatiotemporal synchronization attention module. The combined feature representation is obtained after splicing. ,in The length of the patch in the sequence features. For multivariate time series data Dimensions To hide dimensions; S403, representing the integrated features Input a gated recurrent unit (GRU) to obtain spatiotemporal synchronous attention features.

[0027] In this embodiment, the spatiotemporal synchronization attention module is implemented based on a graph attention network (GAT) and employs a multi-head attention mechanism. Each attention head calculates the attention weights between variables to enhance the attention given to variables with significant causal relationships. The network captures local and long-term spatiotemporal dependencies through a sliding window mechanism, forming a spatiotemporal synchronization attention layer, thereby comprehensively describing the characteristics of the data sequence. In this embodiment, each variable in the graph of the spatiotemporal synchronization attention module aggregates the features of itself and other variables at the current time step, one lag time step, and two lag time steps. The variable information of the three time steps is input into the spatiotemporal synchronization attention module. Specifically, in step S401 of this embodiment, when each spatiotemporal synchronization attention module performs spatiotemporal synchronization attention feature extraction in conjunction with the spatiotemporal causal knowledge graph, the spatiotemporal synchronization attention feature extraction of any i-th spatiotemporal synchronization attention module includes: S501, Obtain features sampled from sequence features ; S502, features sampled from sequence features Extracting attention graphs using graph attention networks The input to the graph attention network is The number of nodes is The set of nodes is represented as: , Its extracted attention diagram From attention score constitute: , , in, for The first of the two nodes Dimensional attention score , , It is the vector dimension. For nodes The set of neighboring nodes. In this scenario, the node At the current time step A lag time step Or two time steps with lag Its neighbor node set contains other related variable nodes at the same or different times. The neighbor node set can be used to aggregate information of surrounding nodes to update the feature representation of the current node. For nodes The set of neighboring nodes. The nodes here... A node representing a variable of a certain dimension in a multivariate time series at a specific time step, and its neighbor node set are also used to aggregate information, and... The difference is It focuses on the neighbor information of a node representing a specific variable dimension. For node u and its neighboring nodes In the , The attention score after feature concatenation is the value without Softmax normalization. It is achieved by connecting nodes... and neighboring nodes After concatenating specific dimensional features, they are combined with learnable column vectors. The calculation is performed and processed by the LeakyReLU activation function to obtain the attention score for subsequent calculation. For nodes and In the , The attention score after feature concatenation is the value before Softmax normalization. Its calculation method is similar to... Similarly, it reflects the nodes and The degree of correlation between features in a specific dimension is used to calculate the attention score. Important intermediate values, For learnable column vectors, It is a non-linear activation function; This represents a concatenation of two nodes. For nodes In the 1D eigenvectors. Nodes The variable node corresponding to a certain moment in a multivariate time series. This represents the specific feature information of the node in dimension i, which is used to participate in the calculation of the attention score and the updating of node features. For nodes In the 3D eigenvectors. (and) similar, Representative node exist The dimensional feature information plays a role in the attention score calculation and node feature update process, reflecting the interrelationship between different dimensional features of different nodes; S503, if the i-th spatiotemporal synchronized attention module is the 1st spatiotemporal synchronized attention module, then directly apply the attention graph. As an enhanced attention diagram Otherwise, pay attention to the diagram. The spatiotemporal causal attention graph output by the (i-1)th spatiotemporal synchronization attention module The enhanced attention diagram is obtained by splicing. ; S504, enhanced attention diagram The spatiotemporal causal knowledge graph is concatenated (using channel convolution CWC), and then the concatenated feature map is convolved through multichannel convolution (using multichannel 2D convolution) to obtain the spatiotemporal causal fusion graph. It can be described as:

[0028] S505, enhanced attention diagram Fusion diagram of spacetime causality Linear fusion yields a spatiotemporal causal attention map Specifically, in this embodiment, hyperparameters are used. To balance the importance of both, it can be described as follows: , Thus through After activation, they obtained the following: The final spatiotemporal causal attention graph of the size Then the attention score corresponding to the node in the graph can be expressed as: 。; S506, Spatiotemporal Causal Attention Graph As input to the (i+1)th spatiotemporal synchronization attention module, and the spatiotemporal causal attention graph is used. and features sampled from sequence features Multiply to obtain the output features of the i-th spatiotemporal synchronization attention module. ; S507, from the output features of the i-th spatiotemporal synchronization attention module Feature cropping is performed to obtain the features extracted by the i-th spatiotemporal synchronization attention module. .

[0029] In this embodiment, the output of the spatiotemporal synchronization attention module is fed into the feature pruning layer. The pruning operation retains all features from the last time step node and deletes all features from the first two time steps. This is because the graph attention layer already contains information from the first two time steps. That is, the input is the local spatiotemporal graph signal matrix. The output of the spatiotemporal synchronization attention module can be expressed as: After feature cropping, it is compressed into .like Figure 5 As shown, to capture the long-term spatiotemporal correlation of the entire network series, a sliding window is used to cut out different periods. The input of the spatiotemporal synchronization attention layer is represented as... The spatiotemporal synchronization attention layer uses the spatiotemporal synchronization attention module as the convolution kernel of the sliding convolution along the time dimension. The calculation is performed with a window size of 3 and a step size of 1. Before this, to maintain the causality of the input and the length of the output, two zeros are padded at the beginning of the input sequence. For the input of CSTSAM, we reshape it to obtain... Then, the outputs of each calculation by the spatiotemporal synchronization attention module are concatenated into a matrix, represented as: , in, ~ This represents the output of the 1st to Lth spatiotemporal synchronization attention modules, arbitrarily... Indicates the first The output of the spatiotemporal synchronization attention module.

[0030] In this embodiment, step S104, which involves anomaly detection based on spatiotemporal synchronous attention features to determine whether a device or network exhibits anomalies, includes: S601, the spatiotemporal synchronous attention features are used to generate reconstruction probabilities for each variable through a reconstruction model and predicted values ​​for each variable through a prediction model; S602, calculate the anomaly score based on the reconstruction probability and predicted value of each variable. : , in, For multivariate time series data Dimensions For variables Predicted value Compared with the true value The squared error, To reconstruct the model for variables The probability of encountering an anomaly. For variables The score, The hyperparameters that combine the reconstruction probability and the predicted value; S603, Determine abnormal scores Does it exceed a preset threshold? If the score for a certain timestamp is abnormal? If the detection result exceeds the preset threshold, the detection result of whether there is an anomaly in the device or network at that timestamp is marked as "abnormal"; otherwise, the detection result of whether there is an anomaly in the device or network at that timestamp is marked as "normal".

[0031] In this embodiment, the prediction model is a three-layer fully connected network; the reconstruction model is a GRU-VAE model, which uses a gated recurrent unit (GRU) as the encoder and decoder of a variational autoencoder (VAE) to learn data in the latent representation. The edge distribution on the graph is used to simultaneously update the parameters of the prediction and reconstruction models during training. Features output by the spatiotemporal synchronous attention network are concatenated with features extracted by the one-dimensional convolutional network to form a comprehensive feature representation, which is then fed into a gated recurrent unit (GRU) to capture sequence patterns in the time series. The output of the GRU is input in parallel into the prediction and reconstruction models to obtain the final result.

[0032] In this embodiment, the prediction model uses a three-layer fully connected network, and the loss function is the root mean square error. , in Represents the input sequence exist Time of the first The characteristic values ​​of each variable This indicates its predicted value.

[0033] For the reconstruction model, a GRU-VAE architecture is used, that is, a GRU is used as the encoder and decoder of the VAE to learn the data in the latent representation. The marginal distribution on the given input. Assuming a conditional distribution Reconstruction in the middle, among which Let be the vector representation of the latent space. The optimization objective is to find the reconstruction that best approximates the data distribution. The optimal model parameters are: The true posterior density is: The edge density formula is: .

[0034] In this embodiment, the loss function used when updating the parameters of the prediction model and the reconstruction model is... The function expression is: , in, The loss function of the prediction model, The loss function for reconstructing the model; , , in, For multivariate time series data Dimensions For the first Variables The true value of a moment for The predicted value, As the expected value, Given the expected negative log-likelihood of the input, The encoder for the GRU-VAE model. For data, for The data in the potential representation, for about Conditional distribution, For encoder distribution KL divergence, for The edge density, and has , ,in, For the true posterior density, for Edge density. In this embodiment, a recognition model is introduced. To approximate the posterior distribution, given a GRU-based encoder and decoder Then reconstruct the model loss function As shown in the above equation, the first term is the expected negative log-likelihood of the given input, and the second term is the encoder distribution. The KL divergence.

[0035] To verify the method in this embodiment, the experimental settings are as follows: the model input window size is 100, the one-dimensional convolutional kernel size is 7, the patch length is 16, the stride is 8, the input linear layer dimension is 32, and the number of multi-head graph attention layers is 4. , , Spatiotemporal causal knowledge injection was used in all 2D convolutional models with a kernel size of 3*3. The prediction model had a hidden dimension of 150, while the reconstruction model had a hidden dimension of 100. These models were trained using the Adam optimizer with a learning rate of 1e-3 and a training epoch of 30. An early stopping strategy was applied during training, with patience set to 3, meaning that training would stop if performance dropped three times consecutively. Eight datasets were used to validate the effectiveness of our models: ASD (Application Server Dataset), PSM (Pooled Server Metrics), SMD (Server Machine Data), Exathlon, SMAP (Soil Moisture Active Passive), MSL (Mars Science Lab), SWAT (Secure Water Treatment), and WADI (Water Distribution). The baseline models used for comparison with the method in this embodiment include: PCA, LSTM-NDT, USAD, MTAD-GAT, TranAD, GANF, STGAT-MAD, AnomalyTransformer, DCdetector, DiffAD, CGAD, CST-CL, SensitiveHUE, and CutAddPaste. During testing, Precision, Recall, and F1 score were selected as evaluation metrics to compare and analyze the performance of the baseline models with that of the present invention. ‍ , as well as , in, Indicates a true positive result. This indicates a false positive. This indicates a false negative.

[0036] These metrics all need to be calculated within defined thresholds. Therefore, due to different threshold selection methods, metric values ​​vary significantly between different tasks. The threshold selection method requires combining industry-specific knowledge related to the dataset; therefore, the optimal F1 score is found and reported. The final results are shown in Tables 1-7. Furthermore... Figure 6 The invention is compared with other current multivariate time series anomaly detection methods based on graph neural networks in terms of parameter quantity, model size, and inference latency.

[0037] Table 1: Performance comparison with baseline on ASD and PSM datasets

[0038] Table 2: Performance comparison with baseline on SMD and Exathlon datasets

[0039] Table 3: Performance comparison with baseline on SMAP and MSL datasets

[0040] Table 4: Performance comparison with baseline on SGaT and WADI datasets

[0041] Table 5: Ablation experiments on ASD and PSM datasets

[0042] Table 6: Ablation experiments on the SGaT and WADI datasets

[0043] Table 7: Ablation experiments on SMAP and MSL datasets

[0044] Tables 1 through 7 and Figure 6 This demonstrates that the method in this embodiment has higher accuracy and reliability in detecting abnormal data and can more effectively identify anomalies in the data; at the same time, compared with similar methods, the method in this embodiment has lower parameter quantity, model size and inference latency.

[0045] In addition, to further verify the effectiveness of the components in the method of this embodiment, a series of ablation experiments were conducted. In this example, “w / o STCG”, “w / o STS”, “w / o STSAN&P”, “w / o FOR”, “w / o REC”, “w / FP_1”, and “w / FP_2” represent canceling the spatiotemporal causal knowledge graph, canceling spatiotemporal synchronization (i.e., time lag k=0), canceling the spatiotemporal synchronization network and patch (i.e., using a traditional graph attention network), canceling the prediction model, canceling the reconstruction model, delaying the first time step of feature pruning, and delaying the second time step of feature pruning. Table 8 shows the results of the ablation experiments.

[0046] Table 8: Ablation experiments on the SGaT and WADI datasets

[0047] As shown in Table 8, after eliminating various strategies, the model exhibits significant performance loss on all datasets, confirming the effectiveness of the various components involved in the method of this embodiment.

[0048] In summary, to improve the accuracy and robustness of anomaly detection for multi-indicator data in complex systems, this embodiment represents multivariate time series data as a spatiotemporal graph structure. Within a sliding time window, variables at different time steps are treated as nodes. A spatiotemporal synchronous attention mechanism simultaneously captures spatial and temporal dependencies between variables, and a static causal graph constructed from prior causal knowledge is integrated to enhance the effectiveness of attention weights. By jointly modeling the time series data using a training prediction model and a reconstruction model, anomaly scores are obtained for each time step, and anomalies are determined based on preset thresholds. This embodiment effectively integrates spatial, temporal, and causal relationships, significantly improving the accuracy and stability of anomaly detection, making it particularly suitable for practical applications such as server monitoring and industrial IoT device monitoring. The specific parameters and model structure of this embodiment can be flexibly adjusted according to actual needs. Compared with existing technologies, this embodiment can simultaneously model short-term and long-term dependencies of multiple variables, filtering out irrelevant associations to reduce false alarms. It achieves high-precision anomaly detection on various real-world datasets and is applicable to network operation and maintenance, IoT monitoring, and network security.

[0049] Furthermore, this embodiment also provides a multivariate time series anomaly detection system based on spatiotemporal knowledge, including a microprocessor and a memory interconnected, wherein the microprocessor is programmed or configured to execute the multivariate time series anomaly detection method based on spatiotemporal knowledge.

[0050] Furthermore, this embodiment also provides a computer-readable storage medium storing a computer program or instructions that are programmed or configured to execute the spatiotemporal knowledge-based multivariate time series anomaly detection method by a processor.

[0051] In addition, this embodiment also provides a computer program product, including a computer program or instructions, which are programmed or configured to execute the spatiotemporal knowledge-based multivariate time series anomaly detection method by a processor.

[0052] Those skilled in the art will understand that the technical solutions provided by this invention may take the form of a method, system, or computer program product. Therefore, this invention may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this invention may take the form of a computer program product embodied on one or more computer-readable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, produce an implementation of the flowchart... Figure 1 One or more processes and / or boxes Figure 1 The computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The functions specified in one or more boxes. These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable apparatus for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0053] The above description is merely a preferred embodiment of the present invention. The scope of protection of the present invention is not limited to the above embodiments. All technical solutions falling within the scope of the present invention's concept are within the scope of protection of the present invention. It should be noted that for those skilled in the art, any improvements and modifications made without departing from the principles of the present invention should also be considered within the scope of protection of the present invention.

Claims

1. A multivariate time series anomaly detection method based on spatiotemporal knowledge, characterized in that, The process includes the following steps: S101, acquiring multivariate time series data composed of specified sensor data or indicator data; S102, performing periodic temporal decomposition and causal discovery on the multivariate time series data to construct a spatiotemporal knowledge graph, where nodes represent the state of each variable at a specific time, directed edges represent causal relationships between variables, and the weights of directed edges reflect the strength of causal influence; and performing data preprocessing and feature extraction on the multivariate time series data to obtain sequence features; S1 03. Extract spatiotemporal synchronous attention features from the spatiotemporal causal knowledge graph and sequence features using a spatiotemporal synchronous attention network; S104. Perform anomaly detection based on the spatiotemporal synchronous attention features to determine whether there are anomalies in the device or network.

2. The multivariate time series anomaly detection method based on spatiotemporal knowledge according to claim 1, characterized in that, Step 102 involves periodically decomposing and causally discovering the input multivariate time series data to construct a spatiotemporal knowledge graph, including: S201, for the input multivariate time series data , For multivariate time series data Time window size, For multivariate time series data The dominant period is identified using the Fast Fourier Transform and according to the following formula. ; ， ， ， in, Indicates to Round down to the nearest integer. For the frequency with the largest amplitude, For any frequency, The amplitude corresponding to each frequency, For multivariate time series data The results of the fast Fourier transform, For amplitude calculation operation, For in dimension Average calculation operation on; S202, multivariate time series data Based on the dominant cycle Perform periodic time-series decomposition; S203, after time series decomposition, the multivariate time series data is expanded along the time axis, and causal discovery is performed according to the following formula to extract the preset time lag. Internal time lag Causal effects between variables weight matrix ; ， in, Current timestamp variables, For time lag variables, To simulate random variables influenced or disturbed by external factors; the various time lags variables Causal effects between weight matrix any element in the i-th row and j-th column express causal relationship Indicates the first Time lag of each variable variables, Indicates the direction of causal relationship. Indicates the current timestamp The One variable, express A causal relationship exists; otherwise, it indicates that... The causal relationship does not exist; S204, delaying time variables Causal effects between weight matrix Constructing a spatiotemporal causal knowledge matrix The constructed spatiotemporal causal knowledge matrix Variables with time lag of 0 on the middle diagonal Causal effects between weight matrix The element in the upper right corner represents time lag. variables Causal effects between weight matrix ; S205, for matrices Different time lags The weight matrix is ​​grouped and the average value of the groups is taken to obtain the final spatiotemporal causal knowledge graph.

3. The multivariate time series anomaly detection method based on spatiotemporal knowledge according to claim 2, characterized in that, Step 102 involves preprocessing the input multivariate time series data and extracting features to obtain sequence features, including: S301, for the input multivariate time series data The data is standardized using the min-max normalization method, where For multivariate time series data Time window size, For multivariate time series data The dimensions; the standardized multivariate time series data A one-dimensional convolutional neural network is used for feature extraction to extract sequences of high-order features; S302, the sequence of high-order features is divided into overlapping patches, and the non-overlapping region between two patches is... Thus, the patch sequence is obtained. , For the length of the patch, For the number of patches, , As the dominant cycle, Indicates to Round down; S303, using a linear layer to sequence patches Projecting into a high-dimensional space yields sequence features ,in To hide the dimension.

4. The multivariate time series anomaly detection method based on spatiotemporal knowledge according to claim 1, characterized in that, The spatiotemporal synchronous attention network includes multiple spatiotemporal synchronous attention modules. Step S103 involves extracting spatiotemporal synchronous attention features from the spatiotemporal causal knowledge graph and sequence features using the spatiotemporal synchronous attention network, including: S401, after sampling the sequence features through the input window, input them into each spatiotemporal synchronous attention module, and then perform spatiotemporal synchronous attention feature extraction in each spatiotemporal synchronous attention module in combination with the spatiotemporal causal knowledge graph. S402, extract the features obtained from each i-th spatiotemporal synchronization attention module. The combined feature representation is obtained after splicing. ,in The length of the patch in the sequence features. For multivariate time series data Dimensions To hide dimensions; S403, representing the integrated features Input a gated recurrent unit (GRU) to obtain spatiotemporal synchronous attention features.

5. The multivariate time series anomaly detection method based on spatiotemporal knowledge according to claim 4, characterized in that, In step S401, when each spatiotemporal synchronization attention module performs spatiotemporal synchronization attention feature extraction in conjunction with the spatiotemporal causal knowledge graph, the spatiotemporal synchronization attention feature extraction for any i-th spatiotemporal synchronization attention module includes: S501, Obtain features sampled from sequence features ; S502, features sampled from sequence features Extracting attention graphs using graph attention networks ; S503, if the i-th spatiotemporal synchronized attention module is the 1st spatiotemporal synchronized attention module, then directly apply the attention graph. As an enhanced attention diagram Otherwise, pay attention to the diagram. The spatiotemporal causal attention graph output by the (i-1)th spatiotemporal synchronization attention module The enhanced attention diagram is obtained by splicing. ; S504, enhanced attention diagram The spatiotemporal causal knowledge graph is concatenated with the spatiotemporal causal knowledge graph, and then the concatenated feature map is convolved through multi-channel convolution to obtain the spatiotemporal causal fusion graph. ; S505, enhanced attention diagram Fusion diagram of spacetime causality Linear fusion yields a spatiotemporal causal attention map ; S506, Spatiotemporal Causal Attention Graph As input to the (i+1)th spatiotemporal synchronization attention module, and the spatiotemporal causal attention graph is used. and features sampled from sequence features Multiply to obtain the output features of the i-th spatiotemporal synchronization attention module. ; S507, from the output features of the i-th spatiotemporal synchronization attention module Feature cropping is performed to obtain the features extracted by the i-th spatiotemporal synchronization attention module. .

6. The multivariate time series anomaly detection method based on spatiotemporal knowledge according to claim 5, characterized in that, Step S104, which involves anomaly detection based on spatiotemporal synchronization attention features to determine whether there are anomalies in the device or network, includes: S601, the spatiotemporal synchronous attention features are used to generate reconstruction probabilities for each variable through a reconstruction model and predicted values ​​for each variable through a prediction model; S602, calculate the anomaly score based on the reconstruction probability and predicted value of each variable. : ， in, For multivariate time series data Dimensions For variables Predicted value Compared with the true value The squared error, To reconstruct the model for variables The probability of encountering an anomaly. For variables The score, The hyperparameters that combine the reconstruction probability and the predicted value; S603, Determine abnormal scores Does it exceed a preset threshold? If the score for a certain timestamp is abnormal? If the detection result exceeds the preset threshold, the detection result of whether there is an anomaly in the device or network at that timestamp is marked as "abnormal"; otherwise, the detection result of whether there is an anomaly in the device or network at that timestamp is marked as "normal".

7. The multivariate time series anomaly detection method based on spatiotemporal knowledge according to claim 6, characterized in that, The prediction model is a three-layer fully connected network; the reconstruction model is a GRU-VAE model, which uses gated recurrent units (GRUs) as encoders and decoders in a variational autoencoder (VAE) to learn data in the latent representation. The marginal distribution on the graph, the prediction model and the reconstruction model update the parameters of both models simultaneously during training, and the loss function used when updating the parameters of the prediction model and the reconstruction model. The function expression is: ， in, The loss function of the prediction model, The loss function for reconstructing the model; ， ， in, For multivariate time series data Dimensions For the first Variables The true value of a moment for The predicted value of As the expected value, Given the expected negative log-likelihood of the input, The encoder for the GRU-VAE model. For data, for The data in the potential representation, for about Conditional distribution, For encoder distribution KL divergence, for The edge density, and has , ,in, For the true posterior density, for Edge density.

8. A multivariate time series anomaly detection system based on spatiotemporal knowledge, comprising a microprocessor and a memory interconnected, characterized in that, The microprocessor is programmed or configured to execute the multivariate time series anomaly detection method based on spatiotemporal knowledge as described in any one of claims 1 to 7.

9. A computer-readable storage medium storing a computer program or instructions, characterized in that, The computer program or instructions are programmed or configured to execute the multivariate time series anomaly detection method based on spatiotemporal knowledge as described in any one of claims 1 to 7 via a processor.

10. A computer program product, comprising a computer program or instructions, characterized in that, The computer program or instructions are programmed or configured to execute the multivariate time series anomaly detection method based on spatiotemporal knowledge as described in any one of claims 1 to 7 via a processor.

Images