Application of adaptive generative adversarial neural network based on LSTM-Transform mixed mode in multi-dimensional time sequence anomaly detection
By using an LSTM-Transformer hybrid encoder and an adaptive generative adversarial network, the problems of high false alarm rate and imbalance of long-short-term dependencies in anomaly detection in multidimensional time series data are solved, achieving efficient and accurate anomaly detection results.
Patent Information
- Application Number
- CN202511726758.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-11-24
- Publication Date
- 2026-03-10
AI Technical Summary
Existing technologies for anomaly detection in multidimensional time series data suffer from high false positive and false negative rates, difficulty in balancing long-term and short-term dependencies, and unstable and poorly adaptable training of generative adversarial networks.
A generative adversarial network with an LSTM-Transformer hybrid encoder structure is adopted, which combines a signal reconstruction generator and a signal filtering discriminator. Through adaptive threshold filtering and dynamic weighted loss function, the robustness and generalization ability of the model are improved.
It achieves accurate anomaly detection in multidimensional time series data, improves the detection accuracy and stability of the model in complex scenarios, and enhances the adaptive recognition capability of anomaly patterns.
Smart Images
Figure CN121637313A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to the technical field of artificial intelligence and data security, and particularly relates to an abnormality detection method based on deep learning. BACKGROUND
[0002] With the popularity of the Internet of Things and the Industrial Internet, abnormality detection of multi-dimensional time series data becomes crucial in fields such as device predictive maintenance and network security intrusion detection. Existing abnormality detection methods mainly have the following limitations:
[0003] Traditional statistical or machine learning-based methods lack the ability to capture complex, high-dimensional, and nonlinear temporal dependencies, resulting in high false positive and false negative rates in high-dimensional scenarios.
[0004] Although deep learning methods such as autoencoders or recurrent neural networks can learn more complex patterns, they often struggle to balance the learning of long-term and short-term dependencies; for example, LSTMs are good at handling short-term dependencies but may overlook global context, while Transformers are better at capturing long-term dependencies but are relatively less sensitive to local details and sequence order.
[0005] When existing generative adversarial networks are used for abnormality detection, the training process of the generator and discriminator is often unstable, and the model's adaptability to different data distributions is poor, resulting in limited generalization ability and difficulty in direct application to multi-dimensional scenarios with dynamic data feature changes.
[0006] Therefore, there is an urgent need in the art for a technical solution that can adaptively and accurately detect complex abnormal patterns in multi-dimensional time series data. SUMMARY
[0007] The present application aims to overcome the above-mentioned defects of the prior art and provide an adaptive generative adversarial network based on a hybrid LSTM-Transformer model and an abnormality detection method thereof.
[0008] Specifically, the present application aims to solve the following key problems:
[0009] To solve the problem that existing generative adversarial networks may contain abnormal points in the training data (i.e., the training set is not completely clean), which leads to inaccurate learning of normal data distribution by the generator during the training process, thereby affecting the final abnormality detection accuracy.
[0010] To address the shortcomings of traditional methods in balancing long-term and short-term dependencies in time series, a hybrid model architecture that can effectively integrate local time series features and global contextual information is provided.
[0011] It provides an adaptive dynamic mechanism that can automatically identify and mitigate the impact of potential anomalous samples during training, thereby improving the robustness and generalization ability of the model in complex real-world scenarios.
[0012] To achieve the above objectives, this invention provides a multidimensional time series anomaly detection method based on an adaptive generative adversarial network (GAN). The GAN includes a signal reconstruction generator and a signal filtering discriminator. Its core process and modules are as follows:
[0013] First, the input multidimensional time series data is standardized to eliminate the influence of different dimensions.
[0014] Subsequently, the sliding window technique was used to divide the continuous time series into multiple continuous, fixed-length subsequences, which served as the basic input units of the model.
[0015] Furthermore, a signal reconstruction generator is constructed. This generator employs an architecture combining an LSTM-Transformer hybrid encoder and decoder, aiming to learn and reconstruct normal timing patterns from the input signal. Its specific structure includes:
[0016] Encoder: Used for deep feature extraction from input time-series signals. The encoder first performs position encoding on the input sequence to inject sequential information.
[0017] Subsequently, the features pass through the following layers: LSTM layer: used to finely capture short-term local dependencies and sequence order patterns in the time series.
[0018] Transformer encoding layer: contains multi-head self-attention mechanism and feedforward neural network, used to capture long-term global dependencies between different time points in time series.
[0019] Fusion module: Fuses the output features of the LSTM layer with the output features of the Transformer coding layer to form a comprehensive feature representation that includes both short-term details and long-term context.
[0020] Decoder: Receives the fused features output by the encoder and maps them back to the original data space through a linear projection layer to generate the reconstructed time-series signal.
[0021] The goal of the generator is to make the reconstructed signal as close as possible to the original input signal.
[0022] Furthermore, a signal filtering discriminator is constructed. The core innovation of the discriminator lies in the integration of an adaptive threshold filtering module, which pre-filters the samples before the discriminator makes a true / false judgment.
[0023] The adaptive threshold filtering module functions as follows:
[0024] This module calculates the reconstruction error between the original input signal and the generator-reconstructed signal.
[0025] It dynamically calculates the mean and standard deviation of the reconstruction error of the current batch of training data and sets a dynamic threshold based on this.
[0026] Using this dynamic threshold, the module assigns a soft label and a hard label to each sample. The hard label is used to initially determine whether the sample is abnormal (binary classification), while the soft label serves as a continuous confidence weight, reflecting the probability that the sample belongs to normal data.
[0027] This mechanism can automatically filter out or weaken the influence of samples marked as high-probability anomalies before training the discriminator, thereby ensuring that the discriminator is mainly trained based on high-confidence normal samples and improving its ability to model normal data distribution.
[0028] Furthermore, an adaptive dynamic weighted loss function is designed. To further combat the contamination of training data by outliers, this invention designs an adaptive dynamic weighted loss function, primarily used for generator training.
[0029] This loss function combines historical reconstruction error and current reconstruction error to dynamically calculate a weight for each training sample.
[0030] For samples with consistently low reconstruction errors, higher weights are assigned, making the generator focus more on learning these "clean" normal patterns.
[0031] For samples where the reconstruction error suddenly increases, their weights are reduced to mitigate the negative impact of these anomalous contamination points on the generator training process.
[0032] The generator and discriminator are trained adversarially using the loss function and filtering mechanism described above, ultimately resulting in a detection system that can accurately model the normal data distribution and is highly sensitive to anomalies.
[0033] During the detection phase, anomaly detection can be achieved by calculating the reconstruction error of new samples and comparing it with a set threshold. Attached Figure Description
[0034] Figure 1 This is a block diagram of an adaptive generative adversarial neural network model structure based on the LSTM-Transformer hybrid mode provided in an embodiment of the present invention;
[0035] Figure 2 This is a flowchart of the training process of an adaptive generative adversarial neural network based on the LSTM-Transformer hybrid mode provided in an embodiment of the present invention;
[0036] Figure 3 This is a flowchart of the multi-dimensional temporal anomaly detection application provided in this embodiment of the invention;
[0037] Figures 4 to 6 This is an application effect diagram of the multi-dimensional temporal anomaly detection provided in the embodiments of the present invention; Detailed Implementation
[0038] The present invention will be further described below with reference to the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are merely illustrative of the invention and not intended to limit it. Furthermore, the described embodiments are only a part of the embodiments of the present invention, and not all of them. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without inventive effort are within the scope of protection of the present invention.
[0039] The flowchart shown in the attached diagram is for illustrative purposes only and does not necessarily include all content and operations / steps, nor does it necessarily have to be performed in the order described. For example, some operations / steps can be broken down, combined, or partially merged, so the actual execution order may change depending on the actual situation.
[0040] The technical solution of the present invention and some embodiments of the present invention will be described in detail below with specific examples. Unless otherwise specified, the following examples and features can be combined with each other.
[0041] Firstly, such as Figure 1 As shown, the present invention provides an adaptive generative adversarial neural network model based on an LSTM-Transformer hybrid mode, which includes a multi-dimensional temporal preprocessing module, a signal reconstruction generator, an encoder, a decoder, a fusion module, a signal filtering discriminator, an adaptive threshold filtering module, and a linear discriminant module.
[0042] Figure 2 This is a flowchart illustrating the training process of an adaptive generative adversarial neural network based on a hybrid LSTM-Transformer model. Figure 2 As shown, the model training includes steps S101 to S104.
[0043] S101. Data Preprocessing. Obtain raw multidimensional time series data X = [x1, x2, ..., x...] from the data source. T ]∈R T×d
[0044] Where T is the total time step and d is the number of variable dimensions. First, the data for each dimension d is standardized, for example, using the Z-score standardization method to convert it into a distribution with a mean of 0 and a standard deviation of 1:
[0045] Where, μ d and σ d Let X and y be the mean and standard deviation of the d-th dimension data on the training set, respectively. The standardized data is denoted as X∈R. T×d
[0046] Subsequently, a sliding window technique is used to segment X. The window length L and sliding step S are set to divide the sequence into N samples, each sample being a subsequence X. i ∈R L×d , where i = 1, 2, ..., N. These samples constitute the training and testing datasets for the model.
[0047] S102. Construction of the signal reconstruction generator G. The goal of generator G is to reconstruct the signal from the input window x. i Mapped to a refactoring window Its internal structure is as follows:
[0048] Input and position encoding: Input X i ∈R L×d First, the feature dimensions are adjusted through a linear projection layer, and then sine-cosine position encoding is added to inject the sequence's order information.
[0049] LSTM layer: The sequence with added location information is input into a multi-layer LSTM network. The hidden state H of the LSTM... lstm =LSTM(W) is used to capture short-term dependencies and local temporal patterns in sequences.
[0050] Transformer Encoder Layer: The same sequence is input in parallel into a standard Transformer encoder layer. This layer includes a multi-head self-attention mechanism and a feedforward neural network, along with residual connections and layer normalization. Its output H... attn =MultiHeadAttn(H lstm H lstm H lstm This is used to capture long-term global dependencies of a sequence.
[0051] Feature fusion: The output H of LSTM lstm and the output H of the Transformer encoder attn The data is then fused. A preferred fusion method involves dimensionality reduction using a linear layer after splicing the data.
[0052] G=σ(W g[H lstm H attn ])
[0053] H fused =G·H lstm +(1-G)·H attn
[0054] Among them, H fused ∈R L×d It is the feature representation after fusion.
[0055] Decoder: Fusion Feature H fused Decoding is performed using a simple linear projection layer, outputting the reconstructed sequence.
[0056] S103. Construction of the signal filtering discriminator D. The core of discriminator D is the integrated adaptive threshold filtering module, whose goal is to determine whether the input data is real, normal data or data reconstructed by the generator. Adaptive threshold filtering module:
[0057] Reconstruction error calculation: For a pair of data (x i , ), calculate its reconstruction error (e i , )
[0058] Error is calculated per point: And it can be aggregated along the feature dimension to obtain a scalar error value e. i For each sample
[0059] Dynamic threshold setting: In the current training batch B, calculate the mean μ = mean(E) and standard deviation σ = std(E) + ε of the aggregation error of all samples in the batch.
[0060] The dynamic threshold can be set to Where τ is an adjustable attenuation hyperparameter, and k is a cooperative threshold parameter.
[0061] Hard label generation: For each sample x i :
[0062] Soft tags, as a type of weight, can be defined as follows:
[0063] Sample filtering: The output of the ATF module includes a filtered or emphasized set of samples. In one implementation, only samples with y... hard The samples with a value of 0 are weighted and then fed into the subsequent part of the discriminator for training.
[0064] Discriminant Network: The data processed by the ATF module is fed into a discriminant network. This network can consist of several linear layers or one-dimensional convolutional layers, and finally outputs a scalar through a sigmoid activation function, representing the probability that the input data is real and normal data.
[0065] S104. Training Process and Loss Function. The model training follows an adversarial training paradigm, but an adaptive dynamic weighted loss is introduced.
[0066] Reconstruction loss L rec This invention designs an adaptive dynamic weighted loss.
[0067] First, calculate the basic reconstruction loss for each sample.
[0068] Then, a weight w is dynamically calculated based on the historical error and the current error. i For each sample, the generator's total loss is a combination of weighted reconstruction loss and adversarial loss:
[0069]
[0070]
[0071]
[0072]
[0073] Where α and β are the hyperparameters of the balancing terms. High weight w i This allows the generator to focus on learning from high-confidence normal samples.
[0074] The final generator loss L G For L G =L rec +λ·L adv L adv To combat losses, it is defined as
[0075]
[0076] Discriminator loss L D The discriminator's loss calculation depends on the output of the ATF module. One approach is to calculate the standard discriminant loss using soft-label-weighted samples.
[0077]
[0078] This loss function ensures that the discriminator primarily learns the distribution from normal data with high confidence.
[0079] The generator G and discriminator D are trained alternately and iteratively by minimizing their respective loss functions until the model converges.
[0080] Furthermore, once the model is trained, it can be used for anomaly detection on newly acquired multidimensional time series data. Please refer to the following procedure: Figure 3 .like Figure 3 As shown, the multidimensional time-series anomaly detection includes steps S201 to S203.
[0081] S201. New Data Preprocessing: The real-time or offline data to be detected is standardized using the same parameters as in the training phase, and sliding window segmentation is performed using the same window length W and stride L.
[0082] Obtain the sample set to be tested:
[0083] S202, Reconstruction Error Calculation: Calculate the reconstruction error for each test sample. The input is fed into the pre-trained generator G to obtain its reconstructed output. Then, the reconstruction error at each time point is calculated:
[0084]
[0085] To obtain a comprehensive anomaly score, the errors at all time points and across all dimensions within each window are aggregated, and then the error value E is calculated.
[0086] S203. Anomaly Detection: Compare the threshold T with the error E. This threshold is selected based on the validation set by optimizing metrics such as the F1 score.
[0087] If E > T, then determine the time window. An abnormal window, and vice versa.
[0088] Effect verification, this step corresponds to Figure 4 To verify the effectiveness of this invention, experiments were conducted on several publicly available multidimensional time series anomaly detection datasets.
[0089] Comparative experiments: Comparison with baseline models on public datasets such as MSL, SMAP, WADI, and SWAT.
[0090] Ablation experiments: Ablation experiments were conducted on the innovative modules on the MSL, SMAP, WADI, and SWAT public datasets.
[0091] Robustness verification: Add random noise to the MSL, SMAP, WADI and SWAT public datasets for robustness verification.
[0092] In some alternative embodiments, the functions / operations mentioned in the block diagrams may not occur in the order shown in the operation diagrams. For example, depending on the functions / operations involved, two consecutively shown blocks may actually be executed substantially simultaneously, or the blocks may sometimes be executed in reverse order. Furthermore, the embodiments presented and described in the flowcharts of this invention are provided by way of example to provide a more comprehensive understanding of the technology. The disclosed methods are not limited to the operations and logic flows presented herein. Alternative embodiments are contemplated in which the order of various operations is altered and sub-operations described as part of a larger operation are executed independently.
[0093] Furthermore, although the invention has been described in the context of functional modules, it should be understood that, unless otherwise stated, one or more of the functions and / or features may be integrated into a single physical device and / or software module, or one or more functions and / or features may be implemented in a separate physical device or software module. It is also understood that a detailed discussion of the actual implementation of each module is unnecessary for understanding the invention. Rather, given the properties, functions, and internal relationships of the various functional modules in the apparatus disclosed herein, the actual implementation of the module will be understood within the scope of conventional skill of an engineer. Therefore, those skilled in the art can implement the invention as set forth in the claims using ordinary techniques without excessive experimentation. It is also understood that the specific concepts disclosed are merely illustrative and not intended to limit the scope of the invention, which is determined by the full scope of the appended claims and their equivalents.
[0094] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus or device (such as a computer-based system, a processor-included system or other system that can fetch and execute instructions from, an instruction execution system, apparatus or device).
[0095] In the description of this specification, references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.
[0096] Although embodiments of the invention have been shown and described, those skilled in the art will understand that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the claims and their equivalents.
[0097] The above is a detailed description of the preferred embodiments of the present invention. However, the present invention is not limited to the above embodiments. Those skilled in the art can make various equivalent modifications or substitutions without departing from the spirit of the present invention. All such equivalent modifications or substitutions are included within the scope defined by the claims of this application.
Claims
1. A method for multi-dimensional time series anomaly detection based on adaptive generative adversarial network, characterized in that, The method comprises the following steps: a data preprocessing step: standardizing and segmenting the obtained multi-dimensional time series data with a sliding window to obtain a training sample set; a model construction step: constructing an adaptive generative adversarial network, which comprises a signal reconstruction generator and a signal filtering discriminator; the signal reconstruction generator adopts an LSTM-Transformer hybrid encoder structure, which is used to learn the normal mode of the input time series data and output a reconstructed sequence; the signal filtering discriminator is integrated with an adaptive threshold filtering module, which is used to filter or weight the input sample before discrimination; a model training step: training the adaptive generative adversarial network using the training sample set; wherein an adaptive dynamic weighted loss function is used to train the signal reconstruction generator, which dynamically adjusts the training weight of the sample according to the historical and current reconstruction error; the signal filtering discriminator is trained based on the soft and hard labels output by the adaptive threshold filtering module; an anomaly detection step: inputting the time series data to be detected into the trained signal reconstruction generator, calculating the reconstruction error, and identifying the anomaly according to the set judgment threshold. 2.The method of claim 1, wherein, The LSTM-Transformer hybrid encoder structure of the signal reconstruction generator specifically comprises: an input layer and a position encoding module for receiving an input sequence and injecting position information; an LSTM layer for extracting short-term local dependence features of the input sequence; a Transformer encoding layer for extracting long-term global dependence features of the input sequence; a feature fusion module for fusing the features output by the LSTM layer and the features output by the Transformer encoding layer to form a comprehensive feature representation; a decoder for mapping the comprehensive feature representation back to the original data space to generate a reconstructed sequence. 3.The method of claim 2, wherein, The feature fusion module fuses the short-term local dependence features and the long-term global dependence features by splicing or weighted addition. 4.The method of claim 1, wherein, The adaptive threshold filtering module of the signal filtering discriminator comprises the following operations: calculating the reconstruction error between the input sequence and its reconstructed sequence; dynamically calculating a filtering threshold based on the reconstruction error statistics of the current training batch; assigning a hard label and a soft label to each training sample according to the comparison result of the reconstruction error and the filtering threshold; the hard label is used to identify whether the sample is a suspected anomaly, and the soft label reflects the confidence that the sample belongs to normal data as a sample weight; filtering or weighting the input discriminator samples based on the soft and hard labels.
5. The method of claim 4, wherein the adaptive generative adversarial network-based multi-dimensional time series anomaly detection method is characterized by, The dynamic calculation of a filtering threshold is specifically: calculating the mean and standard deviation of the reconstruction error of the current batch, and setting the threshold as the mean plus k times the standard deviation, where k is a pre-set hyperparameter.
6. The method of claim 4, wherein the adaptive generative adversarial network-based multi-dimensional time series anomaly detection method is characterized by, The calculation method of the soft label is an exponential decay function based on the reconstruction error or a continuous function based on the relative distance between the reconstruction error and the threshold.
7. The method of claim 1, wherein the adaptive generative adversarial network-based multi-dimensional time series anomaly detection method is characterized by, The adaptive dynamic weighting loss function is specifically implemented as: calculating the basic reconstruction loss of each training sample; dynamically calculating a weight coefficient combining the historical reconstruction error and the current reconstruction error of the sample; The weight coefficient is multiplied with the base reconstruction loss as a weighted contribution of the sample to the generator total loss function, so that the generator training is more focused on samples with lower reconstruction error. 8.The method of claim 1, wherein, In the anomaly detection step, the determination threshold is determined according to the reconstruction error distribution on the validation set.
9. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor executes the computer program to implement the steps of the multi-dimensional time series anomaly detection method based on the adaptive generative adversarial network as claimed in any one of claims 1 to 8.
10. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the multi-dimensional time series anomaly detection method based on the adaptive generative adversarial network as claimed in any one of claims 1 to 8.