Temporal anomaly detection method and device for association difference mining, equipment, medium

Abstract

The method, device, equipment and medium for time sequence anomaly detection of correlation difference mining relate to the technical field of time sequence analysis. The method comprises the following steps: S1, obtaining an original time sequence and performing feature representation to obtain a time sequence representation; S2, performing time dimension correlation difference calculation on the time sequence representation to obtain a time correlation difference; S3, performing space dimension correlation difference calculation on the time sequence representation to obtain a feature correlation difference; S4, reconstructing the time sequence representation to obtain a reconstructed time sequence and calculating a reconstruction error; S5, combining the time correlation difference, the feature correlation difference and the reconstruction error to calculate an anomaly score of each time point; and S6, determining a time point with an anomaly score exceeding an anomaly threshold as an anomaly point. The method fuses a time dimension difference module and a space dimension difference module, and can accurately detect anomaly points in a time sequence, thereby providing help for a time sequence anomaly detection task.

Description

Technical Field

[0001] This invention relates to the field of time series analysis technology, and more specifically, to a method, apparatus, device, and medium for detecting time series anomalies by mining correlation differences. Background Technology

[0002] Time series data is a common data type in many fields. These data typically have complex time dependencies and dynamic changing characteristics, reflecting the state and behavior of a system at different points in time.

[0003] In practical applications, timely and accurate detection of anomalies in time series is crucial for preventing failures, optimizing system performance, and ensuring security. There is an urgent need for this technology in various scenarios, such as monitoring equipment operating status in industrial production, identifying fraud in the financial sector, forecasting extreme weather events, and monitoring patients' vital signs in healthcare.

[0004] Traditional anomaly detection methods mainly rely on statistical analysis and threshold setting. These methods work well when dealing with simple time series data, but they often fail to accurately capture the dynamic changes and characteristic patterns of complex multivariate time series data.

[0005] With the development of deep learning technology, anomaly detection methods based on neural networks have gradually become a research hotspot. Examples include extracting local features of time series using convolutional neural networks, or capturing long-term dependencies of time series using recurrent neural networks and long short-term memory networks. In recent years, the Transformer model, through its self-attention mechanism, has been able to simultaneously capture the temporal dependencies of time series and the relationships between features, further advancing the field.

[0006] However, existing Transformer-based methods, when processing time series data, often focus only on one aspect of the time or spatial dimension, lacking a comprehensive fusion of information from both dimensions. For example, some methods introduce temporal location information through location embedding but fail to fully utilize the correlations between features. Other methods capture relationships between features through multi-head attention mechanisms but fail to adequately consider the impact of temporal location. This limitation makes it difficult for existing methods to simultaneously and effectively capture the dynamic changes in the time dimension and the feature correlations in the spatial dimension when dealing with multivariate time series data, thus reducing the accuracy and robustness of anomaly detection and easily leading to false positives or false negatives. Summary of the Invention

[0007] This invention provides a method, apparatus, device, and medium for detecting temporal anomalies in correlation difference mining, in order to improve at least one of the above-mentioned technical problems.

[0008] In a first aspect, the present invention provides a temporal anomaly detection method for correlation difference mining, which includes steps S1 to S6.

[0009] S1. Obtain the original time series and perform feature representation to obtain the time series representation.

[0010] S2. Calculate the time-dimensional correlation difference of the time series representation to obtain the time correlation difference.

[0011] S3. Calculate the spatial dimension correlation difference of the time series representation to obtain the feature correlation difference.

[0012] S4. Reconstruct the time series representation to obtain a reconstructed time series, and calculate the reconstruction error.

[0013] S5. Calculate the anomaly score for each time point by combining the time correlation difference, the feature correlation difference, and the reconstruction error.

[0014] S6. Determine the time point when the abnormal score exceeds the abnormal threshold as an abnormal point.

[0015] Secondly, the present invention provides a temporal anomaly detection device for correlation difference mining, which includes a feature characterization module, a temporal difference module, a spatial difference module, a reconstruction error calculation module, an anomaly evaluation module, and an anomaly identification module.

[0016] The feature representation module is used to acquire the original time series and perform feature representation to obtain the time series representation.

[0017] The time-dimensional difference module is used to calculate the time-dimensional correlation difference of the time series representation and obtain the time-related difference.

[0018] The spatial dimension difference module is used to calculate the spatial dimension correlation difference of the time series representation and obtain the feature correlation difference.

[0019] The reconstruction error calculation module is used to reconstruct the time series representation to obtain a reconstructed time series and calculate the reconstruction error.

[0020] The anomaly assessment module is used to calculate the anomaly score for each time point by combining the time correlation difference, the feature correlation difference, and the reconstruction error.

[0021] An anomaly identification module is used to identify time points where the anomaly score exceeds the anomaly threshold as anomaly points.

[0022] Thirdly, the present invention provides a temporal anomaly detection device for association difference mining, comprising a processor, a memory, and a computer program stored in the memory. The computer program can be executed by the processor to implement a temporal anomaly detection method for association difference mining as described in any paragraph of the first aspect.

[0023] Fourthly, the present invention provides a computer-readable storage medium. The computer-readable storage medium includes a stored computer program, wherein, when the computer program is executed, it controls the device containing the computer-readable storage medium to perform a temporal anomaly detection method for correlation difference mining as described in any paragraph of the first aspect.

[0024] By adopting the above technical solution, the present invention can achieve the following technical effects:

[0025] This invention presents a temporal anomaly detection method based on correlation difference mining, which can accurately detect outliers in time series. This method integrates temporal and spatial difference modules, providing assistance for time series anomaly detection tasks. Furthermore, this invention designs a loss function for calculating anomaly scores. By combining reconstruction error, temporal correlation differences, and feature correlation differences, it generates anomaly scores for each time step, thereby enabling time series anomaly detection. Attached Figure Description

[0026] To more clearly illustrate the technical solution of the present invention, the accompanying drawings used in the specific embodiments of the present invention will be briefly introduced below. It should be understood that the following drawings only show some specific embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained from these drawings without creative effort.

[0027] Figure 1 This is a flowchart illustrating the temporal anomaly detection method based on correlation difference mining.

[0028] Figure 2 This is a logic diagram of a temporal anomaly detection method based on correlation difference mining. Detailed Implementation

[0029] The technical solutions of the present invention will now be clearly and completely described with reference to the accompanying drawings in the embodiments of the present invention.

[0030] Example 1, please refer to Figures 1 to 2The first embodiment of this invention provides a time-series anomaly detection method based on spatiotemporal feature correlation difference mining. By mining the correlation differences in the time and spatial dimensions, it solves the problem of inaccurate anomaly detection in traditional methods when processing complex multivariate time series data. Ultimately, it achieves high-precision anomaly detection and can be applied to time-series anomaly detection related technical fields such as finance, industrial monitoring, weather forecasting, and healthcare.

[0031] The temporal anomaly detection method for spatiotemporal feature correlation difference mining can be executed by a temporal anomaly detection device (hereinafter referred to as: detection device). Specifically, it is executed by one or more processors in the detection device to implement steps S1 to S6.

[0032] S1. Obtain the original time series and perform feature representation to obtain the time series representation.

[0033] Based on the above embodiments, in an optional embodiment of the present invention, S1 specifically involves: implementing feature representation based on Transformer, dividing the original time series into B batches, each batch being an equal-length subsequence and each subsequence containing L time points, and simultaneously capturing the feature information and location information of the original time series through the Transformer to obtain the time series representation.

[0034] .

[0035] In the formula For time series characterization, For Transformer model, This is the original time series.

[0036] This embodiment uses a feature characterization module to process the original time series. The representation is a high-dimensional feature representation that preserves the temporal dependencies and feature information of the time series. The feature representation module is implemented based on Transformer. For the original time series, it is divided into B batches, each batch being a subsequence of equal length. Each subsequence contains L time points, and the representation of one of the subsequences is as follows: , Indicates the time series at time points The observed values, Then, using a Transformer, both the feature information and location information of the original time series are captured simultaneously to obtain a time series representation. .

[0037] For time series representation This embodiment designs a spatiotemporal feature correlation difference mining module and performs time series characterization. Reconstruction error calculation is performed. The spatiotemporal feature correlation difference mining module mainly includes a temporal difference module and a spatial difference module.

[0038] S2. Calculate the time-dimensional correlation difference of the time series representation to obtain the time correlation difference.

[0039] For the calculation of time correlation differences, this embodiment designs a time dimension difference module to quantify the deviation between the expected correlation strength and the correlation strength between time points in the learned time series representation.

[0040] The temporal difference module calculates the expected correlation strength and correlation strength in time series representation by combining a linear layer, a Gaussian distribution, and an attention layer, and obtains the temporal correlation difference in time series representation by using symmetric KL divergence.

[0041] First, the expected association strength is calculated. The expected association strength is used to represent the correlation strength at a given time point in the time series representation. At that time, point in time The correlation strength between adjacent time points. Specifically, time points are calculated through linear layers. scale parameters And by combining the distance matrix with Gaussian distribution to calculate time points Expected correlation strength with adjacent time points .

[0042] .

[0043] In the formula, Rescale is the normalization operation. For indexing. Indicates the length of the time series.

[0044] Rescale is used to ensure that the sum of each row is 1, transforming the association weights of each row into a discrete distribution, making it a probability distribution.

[0045] Next, the association strength is calculated, and the time points are calculated using the learnable weight matrix. The actual correlation strength between the data and the overall time series representation :

[0046] .

[0047] In the formula This is the Softmax activation function. It is a time series representation. To query the weight matrix. This is the key weight matrix. This represents the transpose of the matrix. 512 represents the model dimension.

[0048] The Softmax activation function is used to convert the scaled similarity scores into a probability distribution such that the sum of each row is 1. (Query) Weight matrix and key The weight matrix is ​​a learnable weight matrix of the model, which is optimized during training.

[0049] Finally, the symmetric KL divergence is combined with the expected correlation strength. Strength of correlation with reality Calculation time point Time-related differences :

[0050] .

[0051] In the formula This represents the number of attention layers. This is the symbol that separates two probability distributions in the KL divergence.

[0052] By calculating the expected correlation strength at different levels and correlation strength By identifying the differences between them, the model can more comprehensively capture anomalous patterns in time series data.

[0053] Temporal correlation discrepancies quantify the deviation between the expected correlation strength and the actual correlation strength between time points in the learned feature representation. This facilitates a better distinction between normal and outlier points in a time series. This module can capture outliers in the time dimension and improve the robustness of the model. It enables accurate identification and location of anomalies in time series.

[0054] The temporal difference module can be used to obtain the correlation difference in the time dimension. In a time series, the number of outliers is usually small. The correlation between outliers and the entire time series is concentrated on the surrounding time points. Therefore, the correlation strength of outliers is close to the expected correlation strength, so the temporal correlation difference of outliers is small.

[0055] S3. Calculate the spatial dimension correlation difference of the time series representation to obtain the feature correlation difference.

[0056] For the calculation of feature association differences, this embodiment designs a spatial difference module, which aims to analyze and quantify the spatial differences in time series representations and learn the potential patterns between different features.

[0057] The spatial dissimilarity module combines linear and attention layers to analyze and quantify spatial dissimilarity in time series representations, learning latent patterns between different features to obtain feature correlation differences in time series representations. This further evaluates anomalies in time series, reducing false positives and false negatives. This module can capture outliers in the spatial dimension, improving the model's robustness and generalization ability.

[0058] First, the mean association weights between feature pairs in the training samples are calculated using a self-attention mechanism to obtain the global feature-feature attention mean matrix. This is used to quantify the fundamental relationships that exist between features.

[0059] Specifically, the average association weights between each feature pair are recorded in one dimension. Global feature - Feature attention mean matrix middle.

[0060] .

[0061] .

[0062] In the formula Indicates the first The first feature and the first The average association weights among the features. This refers to the batch size. Indicates the length of the time series. This is the index for the batch. This is the Softmax activation function. It is the first Among the batches, at the time point Time The values ​​of each feature. It is the first Among the batches, at the time point Time The values ​​of each feature. The feature dimension of the original time series.

[0063] The Softmax activation function is a widely used activation function in machine learning and deep learning. It is used to convert scaled similarity scores into a probability distribution such that the sum of each row is 1.

[0064] Next, calculate the time points. To determine the correlation strength between time features, obtain the feature-feature attention matrix. .

[0065] .

[0066] .

[0067] In the formula For time points Time The first feature and the first The association weights between features. This is the Softmax activation function. It is a point in time. Time The values ​​of each feature. It is a point in time. Time The values ​​of each feature.

[0068] Finally, calculate the global feature-feature attention mean matrix. With the current time-feature-feature attention matrix The mean of the sum of the absolute values ​​of the differences yields the feature association differences. .

[0069] .

[0070] In the formula This is the summation of the elements. This indicates taking the absolute value.

[0071] The spatial dimension difference module allows us to obtain the values ​​at each time point. The differences in feature associations are significant. For normal points, the relationships between features exhibit certain regularity and correlation. When anomalies occur, the relationships between features are disrupted, leading to greater differences in feature associations. Therefore, for anomaly points, the differences in feature associations are substantial.

[0072] S4. Reconstruct the time series representation to obtain a reconstructed time series, and calculate the reconstruction error.

[0073] For time series representation In this embodiment, a reconstruction error calculation module is included to quantify the difference between the reconstructed time series and the original time series. The reconstruction error calculation module comprises an encoder and a projection layer.

[0074] First, time series are represented using an encoder and a feedforward neural network. Processing is performed to obtain the hidden representation. .

[0075] .

[0076] In the formula, This is the ReLU activation function. This represents the actual correlation strength. It is a time series representation. The value weight matrix. For padding operations. Global features - Feature attention mean matrix . Indicates the length of the time series. and These are the first and second weights of the feedforward neural network layer. and These are the first and second biases of the feedforward neural network layer.

[0077] The ReLU activation function is used to introduce nonlinearity and enhance the expressive power of the model.

[0078] Then, the hidden representation is used in the projection layer. Mapping back to the original feature dimensions yields the reconstructed time series. .

[0079] .

[0080] In the formula It is the weight matrix of the projection layer. It is the bias term of the projection layer.

[0081] The projection layer is responsible for mapping input data from a high-dimensional space to a low-dimensional feature space. This process helps extract the main features of the input data and achieve data compression. By learning weights and bias parameters, the projection layer can capture important information from the input data while reducing the computational complexity of the model.

[0082] Finally, the reconstructed time series is calculated. Compared with the original time series Reconstruction error between .

[0083] .

[0084] In the formula, This represents the Frobenius norm. Represents the first of the original time series Observations at each time point. The model represents the first Reconstruction values ​​at each time point.

[0085] S5. Combining the temporal correlation differences, feature correlation differences, and reconstruction errors, calculate the anomaly score for each time point. Specifically, this embodiment introduces an anomaly assessment module to combine temporal correlation differences, feature correlation differences, and reconstruction errors to calculate the anomaly score for each time point. The abnormal score is used to improve the ability to detect anomalies.

[0086] The formulas for calculating the outlier scores at each time point are as follows.

[0087] .

[0088] In the formula, This is the Softmax activation function. Differences due to time correlation. This represents the reconstruction error. For feature-related differences; The dot product operator for vectors.

[0089] S6. Determine the time point when the abnormal score exceeds the abnormal threshold as an abnormal point.

[0090] Determining the anomaly threshold is a crucial step in this time-series anomaly detection method, primarily completed during the model training and validation phases. First, after model training, anomaly scores for the training samples need to be calculated. Next, a validation set is used to determine a boundary that can distinguish between normal and anomaly points. In the specific experimental design, this boundary is quantified as the 85th percentile of the anomaly scores in the normal data; that is, the value ranking at the 85th percentile among all normal sample anomaly scores is taken as the final anomaly threshold. During the testing phase, any time point where the anomaly score exceeds this threshold will be identified as an anomaly.

[0091] This embodiment utilizes the above-mentioned modules for training and testing. In the training part, the abnormal scores of the training samples are calculated, and the boundary that can distinguish between abnormal points and normal points is obtained through the validation set, thereby obtaining the threshold of abnormal points. In the testing phase, when the abnormal score exceeds the threshold, it is determined to be an abnormal point. Then, the accuracy of detection is verified through labeled test samples.

[0092] This embodiment presents a temporal anomaly detection method based on correlation difference mining, which can accurately detect outliers in time series. This method integrates temporal and spatial difference modules, providing assistance for time series anomaly detection tasks. Furthermore, this embodiment designs a loss function to calculate anomaly scores. By combining reconstruction error, temporal correlation differences, and feature correlation differences, anomaly scores are generated for each time step, thereby enabling time series anomaly detection.

[0093] The effectiveness of this embodiment can be further verified by the experimental results below.

[0094] This experiment uses the MSL dataset, which refers to the Mars Science Laboratory dataset. It contains a series of feature readings and other measurements collected by the Curiosity rover during its mission. The experiment uses the 85th percentile of the normal data as the threshold for outlier scores to distinguish between normal and outlier data. The training, validation, and test sets are divided in a 6:2:2 ratio.

[0095] In the experiment, the most advanced methods were selected for a comparative study of detection performance, specifically: time series anomaly detection based on correlation differences (Reference 1); a method using graph neural networks to learn the correlations between features and combining them with temporal correlation differences (Reference 2); and a method using a selective state-space model combined with temporal correlation differences, which can efficiently capture long-term dependencies in time series data and enhance the ability to model complex time series (Reference 3).

[0096] Document 1: Xu, J., Wu, H., Wang, J.,&Long, M. (2022) Anomaly Transformer: Time Series Anomaly Detection with Association Discrepancy. In Proceedings of the International Conference on Learning Representations (ICLR).

[0097] Document 2: Xiong, W., Wang, P., Sun, X.,&Wang, J. (2024) SiET: Spatialinformation enhanced transformer for multivariate time series anomalydetection. Knowledge-Based Systems, 296, 111928.

[0098] Document 3: Sellam AZ, Benaissa I., Taleb-Ahmed A., Patrono L., DistanteC. MAAT: Mamba Adaptive Anomaly Transformer with association discrepancy fortime series[J / OL]. arXiv preprint arXiv:2502.07858, 2025-02-19.

[0099] The evaluation criteria employed four metrics: accuracy, precision, recall, and F1 score. Accuracy is the proportion of correctly classified samples out of the total sample size, quickly providing an overall assessment of the model's classification accuracy. Precision refers to the proportion of outliers detected by the model that are actually outliers, reflecting the reliability of the detected outliers. Recall is the proportion of actual outliers that the model detected, reflecting the model's coverage of outliers—how many actual outliers were detected. The F1 score is the harmonic mean of precision and recall, comprehensively considering both metrics and balancing their inherent limitations to provide a holistic performance evaluation.

[0100] The same experiment was performed three times. The accuracy, precision, recall, and F1 score of the generated experimental test set are shown in Table 1.

[0101] Table 1: Experimental Data Table

[0102]

[0103] Experimental results show that the proposed method outperforms the methods in references 1, 2, and 3 in all metrics. Specifically, the proposed method achieves the highest accuracy, precision, recall, and F1 score, indicating that it is better suited for time series anomaly detection. This is primarily because the proposed method effectively combines temporal and spatial information to accurately capture anomalous patterns in time series data. In the temporal dimension, the model utilizes a self-attention mechanism to deeply explore the long-term and short-term dependencies between different time points in the sequence, thereby understanding and predicting dynamic changes between time points. In the spatial dimension, the model analyzes the interactions between different features through a cross-sample attention mechanism, identifying anomalous associations in the feature space. This multi-dimensional analysis significantly improves the accuracy of anomaly detection, reduces false positives and false negatives, and enhances the model's robustness. Furthermore, by combining temporal and spatial association differences with reconstruction errors through an anomaly loss function, the accuracy of anomaly detection is further improved. The experimental results demonstrate that the proposed time series anomaly detection method possesses certain theoretical and practical application value, and the experiments verify the effectiveness of the proposed method.

[0104] Secondly, this embodiment provides a temporal anomaly detection device for correlation difference mining, which includes a feature characterization module, a temporal difference module, a spatial difference module, a reconstruction error calculation module, an anomaly evaluation module, and an anomaly identification module.

[0105] The feature representation module is used to acquire the original time series and perform feature representation to obtain the time series representation.

[0106] The time-dimensional difference module is used to calculate the time-dimensional correlation difference of the time series representation and obtain the time-related difference.

[0107] The spatial dimension difference module is used to calculate the spatial dimension correlation difference of the time series representation and obtain the feature correlation difference.

[0108] The reconstruction error calculation module is used to reconstruct the time series representation to obtain a reconstructed time series and calculate the reconstruction error.

[0109] The anomaly assessment module is used to calculate the anomaly score for each time point by combining the time correlation difference, the feature correlation difference, and the reconstruction error.

[0110] An anomaly identification module is used to identify time points where the anomaly score exceeds the anomaly threshold as anomaly points.

[0111] Example 3: This example provides a temporal anomaly detection device for association difference mining, which includes a processor, a memory, and a computer program stored in the memory. The computer program can be executed by the processor to implement a temporal anomaly detection method for association difference mining as described in any paragraph of Example 1.

[0112] It is understood that the detection device can be an electronic device with computing power, such as a portable laptop computer, desktop computer, server, smartphone, or tablet computer.

[0113] Example 4: This example provides a computer-readable storage medium. The computer-readable storage medium includes a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to perform a temporal anomaly detection method for correlation difference mining as described in any paragraph of Example 1.

[0114] Obviously, the embodiments described above are only some embodiments of the present invention, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without inventive effort are within the scope of protection of the present invention.

[0115] In the several embodiments provided in this invention, it should be understood that the disclosed apparatus and methods can also be implemented in other ways. The apparatus and method embodiments described above are merely illustrative. For example, the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram and / or flowchart, and combinations of blocks in block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0116] In addition, the functional modules in the various embodiments of the present invention can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0117] If the aforementioned functions are implemented as software functional modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, electronic device, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory, random access memory, magnetic disks, or optical disks. It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0118] The terminology used in the embodiments of this invention is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. The singular forms “a,” “the,” and “the” used in the embodiments of this invention are also intended to include the plural forms unless the context clearly indicates otherwise.

[0119] It should be understood that the term "and / or" used in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. Additionally, the character " / " in this article generally indicates that the preceding and following related objects have an "or" relationship.

[0120] Depending on the context, the word "if" as used here can be interpreted as "when," "when," "in response to determination," or "in response to detection." Similarly, depending on the context, the phrase "if determination" or "if detection (of the stated condition or event)" can be interpreted as "when determination," "in response to determination," "when detection (of the stated condition or event)," or "in response to detection (of the stated condition or event)."

[0121] The terms "first" and "second" used in the embodiments are merely to distinguish similar objects and do not represent a specific ordering of objects. It is understood that "first" and "second" can be interchanged in a specific order or sequence where permitted. It should be understood that the objects distinguished by "first" and "second" can be interchanged where appropriate so that the embodiments described herein can be implemented in an order other than those illustrated or described herein.

[0122] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A time series anomaly detection method for association difference mining, characterized in that, Comprise: S1, obtain the original time sequence, and perform feature characterization to obtain time sequence characterization; S2, time dimension correlation difference calculation is carried out on the time sequence characterization, and time correlation difference is obtained; S3, spatial dimension correlation difference calculation is carried out on the time sequence characterization, and feature correlation difference is obtained; S4, the time sequence characterization is reconstructed to obtain the reconstructed time sequence, and the reconstruction error is calculated; S5, the time correlation difference, the feature correlation difference and the reconstruction error are combined to calculate the anomaly score of each time point; S6, the time point whose anomaly score exceeds the anomaly threshold is determined as an anomaly point; S2 Comprise the following steps; Computing time points by linear layer with scale parameter Computing time points with Gaussian distribution using distance matrix Expected correlation strength between adjacent time points ; ； In the formula, Rescale is a normalization operation, is an index; denotes the length of the time series; Computing time points with learnable weight matrices Actual strength of association between entire time series representation : ； wherein is a Softmax activation function; is a time series representation; is a query weight matrix; is a key weight matrix; denotes the transpose of a matrix;512is a model dimension; Utilizing symmetric kl divergence in conjunction with expected correlation strength with actual correlation strength , computing time point time correlation difference : ； wherein is the number of attention layers; is the symbol separating two probability distributions in the KL divergence; S3 comprises the following steps; computing a correlation weight mean between the features, obtaining a global feature-feature attention mean matrix ; ； ； wherein represents the average correlation weight between the th feature and the th feature; is the batch size; represents the length of the time series; is the index of the batch; is the Softmax activation function; is the value of the th feature in the th batch at time point th feature in the th batch at time point th feature in the th batch at time point is the feature dimension of the original time series; Computing time points the strength of the association between the time features, obtaining a feature-feature attention matrix ; ； ； wherein is a time point is the is the is the association weight between the is a Softmax activation function is the value of the is the is the value of the is the value of the is the is the computing a global feature-feature attention mean matrix a difference from a current time feature-feature attention matrix a mean of an absolute value sum of a difference, obtaining a feature correlation difference ; ； In the formula is the sum of the elements; denotes taking the absolute value. 2.The time series anomaly detection method of association difference mining according to claim 1, wherein, S4 specifically comprises: Processing time series representations by an encoder and a feedforward neural network to obtain a hidden representation ; ； wherein is a ReLU activation function; is an actual correlation strength; is a time series representation; is a value weight matrix; is a padding operation; global feature-feature attention mean matrix ; denotes the length of the time series; and are first and second weights of a feedforward neural network layer; and are first and second biases of a feedforward neural network layer; Utilizing a projection layer to map the hidden representation back to the original feature dimension, resulting in a reconstructed time series ; ； wherein is a weight matrix of the projection layer, is a bias term of the projection layer; time series reconstruction error between the original time series reconstruction error between the original time series ; ； wherein denotes the Frobenius norm; denotes the observation value of the original time series at the time point; denotes the reconstructed value of the model at the time point. 3.The time series anomaly detection method of correlation difference mining according to any one of claims 1 to 2, characterized in that, S1 is specifically: based on the Transformer to realize feature characterization, the original time sequence is divided into B batches, each batch is an equal-length subsequence, and each subsequence contains L time points, and the feature information and position information of the original time sequence are captured simultaneously through the Transformer to obtain the time sequence characterization; ； In the formula is a time series, is a Transformer model, is an original time series.

4. The time series anomaly detection method of correlation difference mining according to any one of claims 1 to 2, characterized in that, The calculation formula of the anomaly score of each time point is as follows: ； wherein is a Softmax activation function; is a temporal correlation difference; is a reconstruction error; is a feature correlation difference; is a dot product operator of vectors.

5. The time series anomaly detection method of correlation difference mining according to any one of claims 1 to 2, characterized in that, The anomaly threshold is completed in the training and verification stage of the model; first, the model needs to calculate the anomaly score of the training sample after the training is completed; then, a boundary that can distinguish normal points and anomaly points is determined by using the validation set, and the anomaly threshold is obtained.

6. An apparatus for temporal anomaly detection of association difference mining, characterized by, A time sequence anomaly detection method suitable for performing the correlation difference mining method according to any one of claims 1 to 5; The time sequence anomaly detection device comprises: A feature characterization module is configured to obtain an original time sequence and perform feature characterization to obtain time sequence characterization; A time dimension difference module is configured to perform time dimension correlation difference calculation on the time sequence characterization to obtain time correlation difference; A space dimension difference module is configured to perform spatial dimension correlation difference calculation on the time sequence characterization to obtain feature correlation difference; A reconstruction error calculation module is configured to reconstruct the time sequence characterization to obtain a reconstructed time sequence and calculate a reconstruction error; An anomaly evaluation module is configured to combine the time correlation difference, the feature correlation difference and the reconstruction error to calculate the anomaly score of each time point; An anomaly identification module is configured to determine the time point whose anomaly score exceeds the anomaly threshold as an anomaly point.

7. A time series anomaly detection device for association difference mining, characterized by, The computer readable storage medium comprises a stored computer program, wherein the computer readable storage medium controls the device where the computer readable storage medium is located to execute the time sequence anomaly detection method of the correlation difference mining method according to any one of claims 1 to 5 when the computer program runs.

8. A computer-readable storage medium, characterized in that, The computer readable storage medium comprises a stored computer program, wherein the computer readable storage medium controls the device where the computer readable storage medium is located to execute the time sequence anomaly detection method of the correlation difference mining method according to any one of claims 1 to 5 when the computer program runs.

Images