Time series data anomaly detection method, system and device and storage medium

Abstract

The invention provides a time series data anomaly detection method, system and device and a storage medium, and belongs to the technical field of computers, and the method comprises the following steps: carrying out segmentation processing on original multivariable time series data through a sliding window, and carrying out standardized operation on each segment of data; a confrontation structure composed of a generator and a discriminator is constructed, and the generator extracts sequence features by adopting structures of an encoder and a decoder and reconstructs a sequence; the discriminator fuses a self-attention mechanism and a cross-window Transform module to extract long-term dependency features and model global context information of a time sequence, and the anomaly perception ability is enhanced. The generative adversarial network is trained by using a WGAN-GP method, and the model stability and convergence efficiency are improved. The method has the advantages of high precision, strong generalization and good interpretation, and is suitable for various scenes of intelligent monitoring time sequence data anomaly detection of microgrids and industrial control systems.

Description

Technical Field

[0001] This invention belongs to the field of computer technology, and specifically relates to a method, system, device and storage medium for detecting anomalies in time-series data. Background Technology

[0002] Multivariate time series data are widely used in typical application scenarios such as power systems, manufacturing processes, environmental monitoring, and industrial control. Their stable operation is crucial for ensuring system safety and improving operational efficiency. However, real-world operating conditions are often accompanied by sudden interference, equipment failures, signal drift, and other abnormal events. Failure to detect these events promptly and accurately can lead to cascading failures or even system paralysis. Therefore, researching a high-precision, robust time series anomaly detection method has significant engineering value and practical implications.

[0003] Existing time series anomaly detection techniques mainly fall into three categories: statistical models, machine learning, and deep learning. Statistical methods, such as ARIMA and control charts, rely on the assumption of a fixed distribution and are difficult to adapt to non-stationary data structures with multi-dimensional features. Traditional machine learning methods, such as Isolation Forest or One-Class SVM, while effective in some scenarios, still rely on feature engineering and lack the ability to model complex time series structures.

[0004] In recent years, deep learning methods have been gradually introduced into anomaly detection tasks. Structures such as autoencoders, LSTM models, and variational autoencoders (VAEs) model reconstruction errors in time series data and use them for anomaly identification. However, these methods generally suffer from the following shortcomings: First, they lack the ability to model long-term dependencies and cross-window contextual information, easily overlooking periodic structures or contextual changes; second, they have limited ability to represent anomaly patterns, making it difficult to identify trend drift, slowly changing anomalies, or multivariate interaction anomalies; and third, they still rely heavily on a small number of labeled samples, limiting their generalization ability.

[0005] Especially in industrial scenarios, outlier samples are often scarce and unevenly distributed, and the system state is complex and changeable. Existing methods are difficult to achieve effective modeling under conditions of small samples, weak supervision, or no labels. Summary of the Invention

[0006] To address the shortcomings of existing time series anomaly detection methods under the influence of abnormal sample data, this invention provides a time series data anomaly detection method, system, device, and storage medium.

[0007] In order to achieve the above object, the present invention provides the following technical solutions: A method for detecting anomalies in time-series data includes the following steps: The original multivariate time series data is processed to obtain time window sequence data; the time window sequence data is mapped to latent features, and the latent features are reverse-mapped to obtain reconstructed time series data; The reconstructed time-series data is mapped into a high-dimensional feature vector. Time window information and location information are extracted from the high-dimensional vector. Attention weighting is applied to the feature vector containing time window information and location information. The weighted feature vector is then subjected to linear transformation and activation to obtain a confidence score. Calculate the error between the reconstructed time series data and the original multivariate time series data; perform a comprehensive score based on the error and the confidence score, and compare the comprehensive score with a set threshold to obtain the time series data anomaly detection result.

[0008] Preferably, the multivariate time-series data is processed by a generative adversarial network to obtain a confidence score for the data. The generative adversarial network specifically includes a generator and a discriminator. The generator includes an encoder and a decoder. The discriminator includes a self-attention layer, a positional encoding module, and a cross-window Transformer module.

[0009] Preferably, a comprehensive score is calculated based on the reconstruction error and the confidence score, specifically using the following formula: ; in, The confidence score output by the discriminator. The reconstruction error is the output of the generator. , These are adjustable weighting coefficients.

[0010] Preferably, the method further includes using a WGAN-GP loss function with a gradient penalty term during training of the generative adversarial network to constrain the gradient norm of the discriminator; the WGAN-GP loss function is specifically: ; in, For real samples, To reconstruct the generated pseudo-samples for the generator, This represents an intermediate sample obtained by random linear interpolation between real and pseudo samples. This represents the weighting coefficient for the penalty term.

[0011] Preferably, the acquisition of the reconstructed time-series data specifically includes: The encoder in the generator maps time-window sequence data into latent features; The encoder processes the latent features through a reverse mapping structure to obtain reconstructed time-series data.

[0012] Preferably, obtaining the confidence score specifically includes: The reconstructed time-series data is mapped into a high-dimensional feature vector through the linear dimensionality-upgrading module of the discriminator; The high-dimensional feature vector is input into the attention layer to perform weighted fusion of the representations at different time steps to extract time window information; the weighted fused features are then processed by the position encoding module to extract position information. The information is aggregated through multi-head self-attention processing in the cross-window Transformer module. The feedforward network with residual structure is linearly transformed and activated, and a continuous value is output, which represents the confidence score of the data within the time window as normal data.

[0013] Preferably, the processing of the original multivariate time series data to obtain time window sequence data specifically includes: The original multivariate time series data is obtained and sliced ​​according to a fixed window length and sliding step size to obtain time window sequence samples of equal length. The sample data within each time window of the equal-length time window sequence are subjected to max-min normalization to obtain the time window sequence data.

[0014] The present invention also provides a time-series data anomaly detection system, specifically comprising: The reconstruction module is used to process the original multivariate time series data to obtain time window sequence data; map the time window sequence data to latent features, and perform reverse mapping on the latent features to obtain reconstructed time series data.

[0015] The discrimination module is used to map the reconstructed time series data into a high-dimensional feature vector, extract the time window information and location information from the high-dimensional vector, perform attention weighting on the feature vector containing the time window information and location information, and perform linear transformation and activation on the weighted feature vector to obtain a confidence score.

[0016] An anomaly detection module is used to calculate the error between the reconstructed time series data and the original multivariate time series data; to perform a comprehensive score based on the error and the confidence score; and to compare the comprehensive score with a set threshold to obtain the time series data anomaly detection result.

[0017] The present invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the steps described in the time-series data anomaly detection method.

[0018] The present invention also provides a computer-readable storage medium storing a computer program, which, when loaded by a processor, is capable of executing the steps described in the time-series data anomaly detection method.

[0019] The time-series data anomaly detection method provided by this invention has the following beneficial effects: This invention reconstructs time-series data, simulating the generation pattern of normal time series and calculating and scoring the reconstruction error. This enables the model to sensitively identify different types of anomalies (including local mutations, trend drift, and periodic disturbances). By applying attention weighting to feature vectors containing time window and location information, and then performing linear transformation and activation on the weighted feature vectors, the model's ability to express long-range dependencies, periodic structures, and multi-scale changes is significantly improved. This enables accurate detection of complex time-series anomalies under unsupervised conditions and has broad application prospects in scenarios such as industrial production monitoring, microgrid condition sensing, and predictive maintenance. Attached Figure Description

[0020] To more clearly illustrate the embodiments and design schemes of the present invention, the accompanying drawings required for this embodiment will be briefly described below. The drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 This is a flowchart of a time-series data anomaly detection method according to the present invention.

[0022] Figure 2 This is a flowchart of a time-series data anomaly detection method according to an embodiment of the present invention. Detailed Implementation

[0023] To enable those skilled in the art to better understand and implement the technical solutions of the present invention, the present invention will be described in detail below with reference to the accompanying drawings and specific embodiments. The following embodiments are only used to more clearly illustrate the technical solutions of the present invention and should not be construed as limiting the scope of protection of the present invention.

[0024] Developing a time-series anomaly detection model with cross-window modeling capabilities, collaborative optimization of discrimination and generation, and consideration of scalability and deployment efficiency is a core technological bottleneck that urgently needs to be overcome in the field of intelligent operation and maintenance and system monitoring. This invention provides a method for time-series data anomaly detection, such as... Figure 1 As shown, it specifically includes:

[0025] The original multivariate time series data is processed to obtain time window sequence data; the time window sequence data is mapped to latent features, and the latent features are reverse-mapped to obtain reconstructed time series data.

[0026] The reconstructed time-series data is mapped into high-dimensional feature vectors. Time window information and location information are extracted from the high-dimensional vectors. Attention weighting is applied to the feature vectors containing time window information and location information. The weighted feature vectors are then subjected to linear transformation and activation to obtain confidence scores.

[0027] The error between the reconstructed time series data and the original multivariate time series data is calculated; a comprehensive score is calculated based on the error and confidence score, and the comprehensive score is compared with a set threshold to obtain the time series data anomaly detection results.

[0028] Example The following specific examples further illustrate the time-series data anomaly detection method provided by this invention. The specific implementation process of this method is as follows: Figure 2 As shown, it includes the following steps: Step 1: Obtain raw multivariate time series data from public industrial and IoT datasets (including SWaT, SMD, MSL, etc.) and perform preprocessing.

[0029] S1.1: First, perform data segmentation. A sliding window mechanism is used to segment the original multivariate time series signal into segments of fixed window lengths. and step length Slice the data to create multiple consecutive time windows. Assume the original data sequence length is... , dimension The number of time window samples that can be generated satisfy:

[0030] ; Each sample for: ; in, For the original continuous time series, Indicates the first The first time step The values ​​that each variable can take. Specifically, the window length... Set to 25, sliding step size Set to 1 to ensure sufficient overlap between time windows, improving the continuity and accuracy of sequence modeling.

[0031] S1.2: Because the numerical ranges of different dimensions in the original multivariate time series differ, which may affect the model's convergence speed and training stability, a max-min normalization operation is performed on each time window sample. The specific transformation formula is as follows: ; in, Indicates the first in the sample A number, , These are the minimum and maximum values ​​of that dimension across all samples, respectively. Normalization scales all variables to... Using intervals eliminates inconsistencies in the units of measurement between variables, which helps improve the model's ability to generalize across different dimensions and enhances the anomaly detection sensitivity of the subsequent discriminator.

[0032] Step 2: Construct the Generative Adversarial Network (GAN) architecture. The GAN architecture consists of a generator and a discriminator. The generator reconstructs normal time series data, and the discriminator determines the authenticity of the input data.

[0033] S21: The generator specifically includes encoder and decoder structures, where the encoder is used to process the original time window sequence of the input. After flattening, it is mapped to a latent feature representation. The decoder will recognize latent features. The sequence is restored to its shape using a reverse mapping structure (such as a symmetric linear layer or a reconstruction network). This is to approximate the joint distribution of normal samples in terms of time and variable dimensions.

[0034] The mapping process in the encoder part can be formalized as follows: ; in, For linear layer weights, For bias terms, This represents the activation function, used to introduce nonlinear capabilities.

[0035] The decoder section adopts a structure symmetrical to the encoder, storing the latent vectors... The input is fed into a reverse mapping network, where it is upsampled layer by layer and reconstructed into tensors with the same dimensions as the original sequence. The reconstruction result is used to calculate a reconstruction error (such as mean squared error) with the input sequence to guide the training process. The reconstruction loss is defined as follows:

[0036] ; The goal of the generator is to reconstruct the distribution of normal data to the greatest extent possible, thereby providing a benchmark for the subsequent discriminator to identify abnormal samples.

[0037] S22: A multi-layer neural network is used, and a self-attention mechanism and a cross-window Transformer module are introduced to build a discriminator.

[0038] The discriminator receives the reconstructed time window sequence output by the generator. or original input sample As input.

[0039] The linear dimension upscaling module upscales the input sequence into a high-dimensional vector through a linear mapping. This unifies dimensions and provides a feature base for subsequent attention mechanisms.

[0040] Then, a self-attention layer is used to weight and fuse the representations at different time steps to learn the attention weights. The specific calculation formula is as follows: ; in, , , All are learnable parameters. Indicates time step Importance within the overall sequence.

[0041] By adding fixed or learnable position vectors to the weighted fused features through the position encoding module, a position-aware representation is formed to capture the temporal order and provide position information for cross-window Transformers.

[0042] A cross-window Transformer module is introduced after the positional encoding module, using the latent features corresponding to multiple consecutive time windows as the input "token" sequence. The latent features of multiple consecutive time windows are jointly modeled, thereby enhancing the model's ability to model the long-term dependency structure and global context of time series. Specifically, let the latent features extracted by the encoder for adjacent time windows be represented as follows:

[0043] ; in, Indicates the first The hidden representation of a time window Indicates the historical depth across windows. For feature dimensions.

[0044] The cross-window Transformer module contains multiple duplicate Transformer modules. The token sequence is input to a stacked Transformer encoder. The processing procedure of the stacked Transformer encoder is as follows:

[0045] By employing a multi-head self-attention mechanism, the dependencies between all time windows are modeled, and the attention weight matrix is ​​calculated. .

[0046] in, , For trainable weight matrix, Let be the dimension of the key vector. Then output the weighted combined features.

[0047] Each Transformer encoder layer includes a feedforward network with residual structures and layer normalization operations to ensure training stability and modeling capability. The attention-weighted sequence representation is globally pooled (e.g., weighted averaging) and then input into a two-layer feedforward neural network, outputting a continuous value. This indicates the confidence score for normal data within that time window.

[0048] Step 3: Train the generative adversarial network using the WGAN-GP method. During training, the WGAN-GP loss function is used, a gradient penalty term is introduced to constrain the gradient norm of the discriminator, and a joint anomaly scoring mechanism is constructed. The reconstruction error of the generator and the output value of the discriminator are fused to form a comprehensive score, and anomaly detection is performed based on this score and a set threshold.

[0049] During training, the model optimization objectives include two directions: the generator and the discriminator. The loss function of the discriminator is defined as the sum of the adversarial objective under the Wasserstein distance and the gradient penalty term, specifically in the form of: ; in, For real samples, To reconstruct the generated pseudo-samples for the generator, This represents an intermediate sample obtained by random linear interpolation between real and pseudo samples, used to calculate the gradient penalty term during training. The weights of the penalty term are used to control the strength of the gradient constraint. Meanwhile, the generator's loss function is defined as: .

[0050] The aim is to maximize the likelihood that spurious samples are identified as real samples by the discriminator, thereby driving the generator to learn the normal distribution structure of the time series.

[0051] By combining the outputs of the generator and discriminator, a comprehensive anomaly scoring function is constructed to improve the discriminative strength of anomaly detection. Its specific form is as follows: ;

[0052] in, The confidence score output by the discriminator. The reconstruction error (such as mean square error, MSE) output by the generator. , The adjustable weighting coefficients are designed to balance the contributions of different types of anomaly features, thereby improving the accuracy and robustness of anomaly localization.

[0053] Through this adversarial optimization strategy, the model can more effectively approximate the real data distribution during training, while maintaining the Lipschitz continuity of the discriminator, significantly improving the robustness and generalization ability of the anomaly detection model under complex working conditions.

[0054] Step 4: Evaluate the performance of the anomaly detection model using multi-dimensional quantification, including data partitioning strategies and general evaluation metrics, specifically including the following aspects: Training and testing partitioning: A stratified sampling strategy is used to partition the original time series data into training and testing sets. This ensures that the various category labels, operating conditions, or periodic structures contained in the data are evenly distributed in the two subsets, thereby improving the comprehensiveness and representativeness of the model evaluation process and avoiding overfitting or evaluation distortion caused by sample bias.

[0055] The classification metric system introduces four general classification evaluation metrics: accuracy, precision, recall, and F1 score. Accuracy measures the overall correctness of the model's predictions; precision measures the accuracy of the model when predicting "abnormal" cases; recall measures the model's coverage of truly abnormal samples; and the F1 score comprehensively evaluates the model's precision and recall capabilities in imbalanced scenarios. Its calculation formula is as follows:

[0056] Accuracy: ; In this context, TP stands for True Positives, TN stands for True Negatives, FP stands for False Positives, and FN stands for False Negatives.

[0057] Accuracy: ; Recall rate: ; F1 score: .

[0058] Step 5: Input the time-series data in the real-time monitoring scenario into the anomaly detection model to obtain the anomaly detection probability, compare it with the set probability threshold, and obtain the anomaly detection result.

[0059] The present invention also provides a time-series data anomaly detection system, specifically comprising: The reconstruction module is used to process the original multivariate time series data to obtain time window sequence data; it maps the time window sequence data to latent features, and performs reverse mapping on the latent features to obtain the reconstructed time series data.

[0060] The discrimination module is used to map the reconstructed time series data into high-dimensional feature vectors, extract time window information and location information from the high-dimensional vectors, apply attention weighting to the feature vectors containing time window information and location information, and perform linear transformation and activation on the weighted feature vectors to obtain confidence scores.

[0061] The anomaly detection module is used to calculate the error between the reconstructed time series data and the original multivariate time series data; it performs a comprehensive score based on the error and confidence score, and compares the comprehensive score with a set threshold to obtain the time series data anomaly detection result.

[0062] The modules in the aforementioned time-series data anomaly detection system can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the computer device's memory as software, so that the processor can call and execute the corresponding operations of each module.

[0063] The present invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory. The processor executes the computer program to implement the steps in an embodiment of a time-series data anomaly detection method. Specific implementation methods can be found in the method embodiments, and will not be repeated here.

[0064] Furthermore, the present invention also provides a non-transitory computer-readable storage medium containing instructions on which a computer program is stored. For example, a memory containing instructions that can be executed by a processor of a computer device to perform the above-described method. For example, the non-transitory computer-readable storage medium may be a ROM, random access memory (RAM), CD-ROM, magnetic tape, floppy disk, and optical data storage device, etc. When the computer program is executed by the processor, it can implement the steps in an embodiment of a timing data anomaly detection method. Specific implementation methods can be found in the method embodiments, which will not be repeated here.

[0065] Those skilled in the art will understand that embodiments of the present invention can provide methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0066] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, as well as combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0067] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0068] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0069] It should be noted that the specific embodiments described above enable those skilled in the art to more fully understand the present invention, but do not limit the present invention in any way. Therefore, although the present invention has been described in detail in this specification and embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the present invention; and all technical solutions and improvements that do not depart from the spirit and scope of the present invention are covered within the protection scope of the present invention patent. No reference numerals in the claims should be construed as limiting the scope of the claims. Any simple variations or equivalent substitutions of technical solutions that can be readily obtained by those skilled in the art within the scope of the technology disclosed in the present invention are within the protection scope of the present invention.

Claims

1. A method for detecting anomalies in time-series data, characterized in that, Includes the following steps: The original multivariate time series data is processed to obtain time window sequence data; the time window sequence data is mapped to latent features, and the latent features are reverse-mapped to obtain reconstructed time series data; The reconstructed time-series data is mapped into a high-dimensional feature vector. Time window information and location information are extracted from the high-dimensional vector. Attention weighting is applied to the feature vector containing time window information and location information. The weighted feature vector is then subjected to linear transformation and activation to obtain a confidence score. Calculate the error between the reconstructed time series data and the original multivariate time series data; perform a comprehensive score based on the error and the confidence score, and compare the comprehensive score with a set threshold to obtain the time series data anomaly detection result.

2. The time-series data anomaly detection method according to claim 1, characterized in that, The multivariate time-series data is processed by a generative adversarial network to obtain the confidence score of the data. The generative adversarial network specifically includes a generator and a discriminator. The generator includes an encoder and a decoder. The discriminator includes a self-attention layer, a position encoding module, and a cross-window Transformer module.

3. The time-series data anomaly detection method according to claim 1, characterized in that, A comprehensive score is calculated based on the reconstruction error and the confidence score, specifically using the following formula: ； in, The confidence score output by the discriminator. The reconstruction error is the output of the generator. , These are adjustable weighting coefficients.

4. The time-series data anomaly detection method according to claim 2, characterized in that, It also includes using the WGAN-GP loss function, which incorporates a gradient penalty term, to constrain the gradient norm of the discriminator during training of the generative adversarial network; the WGAN-GP loss function is specifically as follows: ； in, For real samples, To reconstruct the generated pseudo-samples for the generator, This represents an intermediate sample obtained by random linear interpolation between real and pseudo samples. This represents the weighting coefficient for the penalty term.

5. The time-series data anomaly detection method according to claim 2, characterized in that, The acquisition of the reconstructed time-series data specifically includes: The encoder in the generator maps time-window sequence data into latent features; The encoder processes the latent features through a reverse mapping structure to obtain reconstructed time-series data.

6. The time-series data anomaly detection method according to claim 2, characterized in that, The acquisition of the confidence score specifically includes: The reconstructed time-series data is mapped into a high-dimensional feature vector through the linear dimensionality-upgrading module of the discriminator; The high-dimensional feature vector is input into the attention layer to perform weighted fusion of the representations at different time steps to extract time window information; the weighted fused features are then processed by the position encoding module to extract position information. The information is aggregated through multi-head self-attention processing in the cross-window Transformer module. The feedforward network with residual structure is linearly transformed and activated, and a continuous value is output, which represents the confidence score of the data within the time window as normal data.

7. The time-series data anomaly detection method according to claim 1, characterized in that, The process of processing the original multivariate time series data to obtain time window sequence data specifically includes: The original multivariate time series data is obtained and sliced ​​according to a fixed window length and sliding step size to obtain time window sequence samples of equal length. The sample data within each time window of the equal-length time window sequence are subjected to max-min normalization to obtain the time window sequence data.

8. A time-series data anomaly detection system, characterized in that, include: The reconstruction module is used to process raw multivariate time series data to obtain time window sequence data. The time window sequence data is mapped to latent features, and the latent features are reverse-mapped to obtain the reconstructed time series data. The discrimination module is used to map the reconstructed time series data into a high-dimensional feature vector, extract the time window information and position information in the high-dimensional vector, perform attention weighting on the feature vector containing the time window information and position information, and perform linear transformation and activation on the weighted feature vector to obtain a confidence score. An anomaly detection module is used to calculate the error between the reconstructed time series data and the original multivariate time series data; to perform a comprehensive score based on the error and the confidence score; and to compare the comprehensive score with a set threshold to obtain the time series data anomaly detection result.

9. A computer device, comprising a memory, a processor, and a computer program stored in the memory, characterized in that, The processor executes the computer program to implement the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is loaded by the processor, it is able to perform the steps of the method according to any one of claims 1 to 7.

Images