Multivariable time series anomaly detection method and system based on hierarchical comparative adversarial learning

Abstract

The invention discloses a multivariable time series anomaly detection method and system based on hierarchical comparative adversarial learning, and belongs to the technical field of time series anomaly detection. According to the invention, anomaly detection is realized through a hierarchical comparative adversarial learning mechanism. The method comprises the following steps: firstly, extracting local features by using a multi-head self-attention layer of relative position coding, and extracting global features by combining a multi-head self-attention layer of absolute position coding; secondly, two-way comparative learning is carried out on the head level and the time point level, and a full-sample similarity matrix is constructed through frozen gradients to solve the dislocation problem; further introducing confrontation loss, forcing the global features to approach local feature distribution, enabling the local features to be far away from the global feature distribution, and expanding the characterization difference of normal and abnormal data; and finally, a composite anomaly scoring mechanism is constructed based on the KL divergence and the JS divergence and is used for judging abnormal points. Different data sets show that the method significantly improves the anomaly detection robustness and generalization of the complex high-dimensional time series.

Description

Technical Field

[0001] This invention belongs to the field of time series anomaly detection technology, specifically relating to a multivariate time series anomaly detection method and system based on hierarchical contrastive adversarial learning. Background Technology

[0002] With the rapid development of information technology, multivariate time series (MTS) data is widely used in numerous fields, including industrial manufacturing, financial transactions, healthcare, cybersecurity monitoring, intelligent operation and maintenance, and earth science exploration. These sequence data are typically collected periodically over time by multiple sensors deployed in the target system, accurately reflecting the dynamic operating status and inherent behavioral patterns of the monitored object. Therefore, anomaly detection in MTS—that is, accurately and promptly identifying outliers or anomalous data points or subsequences that significantly deviate from the overall normal data pattern—is crucial for ensuring stable system operation, preventing catastrophic failures, detecting fraudulent transactions, managing risks, and extracting valuable business insights from massive amounts of data.

[0003] However, as time series data becomes more complex and diverse, accurately identifying anomalies remains a challenging task. To address this challenge, both academia and industry have proposed numerous methods for detecting anomalies in time series data. Traditional statistical methods such as Autoregressive Integrated Moving Average (ARIMA), Principal Component Analysis (PCA), and Spectral Residual (SR) are widely used. However, these methods often fall short when dealing with complex, high-dimensional, nonlinear time series and capturing dynamic interactions between variables. While classic machine learning algorithms based on clustering, density estimation, and uniclass classification improve the ability to handle complex data to some extent by learning the intrinsic structure or boundaries of the data to distinguish between normal and abnormal data, the "curse of dimensionality" in high-dimensional spaces can cause distance or density measures to fail. Furthermore, they may be limited by the effectiveness of manual feature engineering. In recent years, deep learning models based on data reconstruction have made significant progress in the field of multivariate time series anomaly detection. These models reconstruct the input multidimensional time series using deep learning models, and the reconstruction error is used as an indicator of anomaly detection; data points with large reconstruction errors are considered outliers. However, these models often need to be trained on normal data to learn representations of normal patterns. When the training data is contaminated with anomalies, the model may overfit to the anomalies in the training set, thus reducing model performance.

[0004] Recently, contrastive learning, which learns effective representations by bringing similar samples closer together (positive sample pairs) and pushing dissimilar samples further apart (negative sample pairs), has been applied to time series anomaly detection. However, contrastive learning relies on the proper construction of positive and negative sample pairs. Time series data is typically processed using the sliding window method, where data within each window is considered a sample. The goal of time series anomaly detection is usually to determine whether each time point is abnormal, requiring the construction of positive and negative sample pairs to be at the time point level, rather than at the level of complete window samples. This misalignment between the sample construction unit and the detection target unit poses a challenge to effectively constructing positive and negative sample pairs that meet the requirements of contrastive learning and are suitable for point-level anomaly detection. Furthermore, existing methods use multi-head self-attention for feature extraction from different perspectives, but fail to fully utilize the diversity of features and their distribution information over time. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention provides a multivariate time series anomaly detection method based on hierarchical contrastive adversarial learning, which solves the problems mentioned in the background. By performing hierarchical contrastive learning on features extracted by multi-head self-attention and further introducing an adversarial mechanism, the detection capability for various types of anomaly data is improved, thereby adapting to more complex and diverse anomaly detection tasks.

[0006] A multivariate time series anomaly detection method based on hierarchical contrastive adversarial learning includes the following steps:

[0007] Step 1: Collect the dataset and preprocess the data to obtain the training dataset, validation dataset, and test dataset;

[0008] Step 2: Randomly select training data from the training set obtained in Step 1 and input them into an N-layer multi-head self-attention layer with relative position encoding to extract attention scores as local features of the training data; Randomly select training data from the training set obtained in Step 1, after absolute position encoding, input them into an N-layer multi-head self-attention layer to extract attention scores as global features of the training data.

[0009] Step 3: Perform hierarchical comparative learning between local and global features, that is: freeze the gradient of one feature so that it does not participate in backpropagation, and then perform comparative learning with another feature at the head level and time point level respectively.

[0010] Step 4: After the contrastive learning in step 3, an adversarial loss with constraints is introduced to further amplify the representational differences between normal and abnormal data while ensuring that the introduced adversarial mechanism can make meaningful feature distinctions.

[0011] Step 5: Repeat steps 2 to 4 until the model is fully trained;

[0012] Step 6: The trained model is scored on the validation set and test set obtained in step 1 using a composite anomaly scoring mechanism. Then, a threshold is selected on the anomaly score of the validation set for anomaly detection on the test set.

[0013] Preferably, in step 1, after collecting training, validation, and test datasets from various fields, robust statistical standardization is applied to the three datasets respectively. The interquartile range (IQR) and median absolute deviation (MAD), two statistics that characterize data distribution, are combined to reconstruct a standardized scale that reflects both the breadth and density of the data. This scale effectively eliminates interference from differences in data units on the detection results and further addresses the problem of outliers easily distorting the standardized scale in traditional methods. The robust statistical standardization is specifically implemented using the following formula:

[0014]

[0015] In the formula, X norm For standardized preprocessed multivariate time series data; X is multivariate time series data; m = median(X) is the median of X; MAD = median(|Xm|) is the median absolute deviation of X; IQR is the interquartile range of X; δ is a minimum value to avoid the case where the denominator is 0;

[0016] Then, the standardized multivariate time series data is segmented using a sliding window to obtain a series of subsequences with a fixed length of T.

[0017] Preferably, in step 2, the specific steps for obtaining the local features of the training data are as follows:

[0018] First, a fixed-length subsequence of batch size B is randomly selected from the training set and passed through an embedding layer to obtain... As the input to the self-attention of the first layer, the query matrix Q of any nth layer (n≥1) is obtained by linear projection through the learnable weights. n Key matrix K n Value matrix V n Based on the query matrix position vector Bond matrix position vector Constructing the relative position matrix Its element R ij =P Q [i]-P K[j] represents the positional difference between the i-th query element and the j-th key element.

[0019] Then, a dynamic bias matrix Bias is introduced based on the relative position matrix R to achieve an adaptive correlation between position difference and attention sensitivity:

[0020] Bias h =α h log(1+γ|R|)·exp(-β h |R|)·sign(R)

[0021] In the formula, α h β is a learnable scaling factor used to control the bias strength. h γ is a learnable decay factor used to control the decay rate; γ is a relative position adjustment hyperparameter; sign(R) is the direction sign, which is used to retain the basic direction information of the relative position by taking the positive or negative sign of each element of R; the bias matrix, through the combined effect of the logarithmic nonlinear growth term used to distinguish different position differences and the exponential decay term used to weaken the interference of distant data, makes the model more sensitive to surrounding data with small position differences and less sensitive to irrelevant data with large position differences.

[0022] Finally, the attenuation bias matrix Bias h Adding the scaled dot product to the nth layer attention at the hth head yields local features of the data. The self-attention mechanisms of each layer are shown below:

[0023]

[0024] In the formula, These are the query matrix, key matrix, and value matrix of the h-th head in the n-th attention layer, respectively. d is the projection matrix of the h-th head in the n-th attention layer; k =d model / H is the dimension of each head; d model It represents the data dimension after the embedding layer; H is the number of heads of self-attention in each layer; A projection matrix composed of multiple heads; This indicates that the self-attention output of the multi-head splicing, after passing through the feedforward layer and the stacking and normalization components, serves as the input to the next layer of self-attention.

[0025] The specific steps to obtain the global features of the training data are as follows:

[0026] First, a fixed-length subsequence of batch size B is randomly selected from the training set and passed through the embedding layer. The following absolute position encoding is used to generate a unique time point vector, which provides a positional reference for global feature extraction.

[0027]

[0028] In the formula, pos is the position index; i is the dimension index;

[0029] Then, the encoded embedded data is input into the multi-head self-attention layer, which outputs global features that reflect the global correlation of the data.

[0030]

[0031] Preferably, in step 3, the global features are... and local features Weight normalization is performed at both the head level and the time-point level to obtain the normalized features:

[0032]

[0033] In the formula, This indicates that the L2 norm is calculated in the last dimension.

[0034] Then, the gradients of the global features are frozen, and similarity matrices are constructed with the local features at the head level and time point level, respectively:

[0035]

[0036] In the formula, Detach(·) represents freezing the gradient, blocking the backpropagation of the gradient; S ·,n P is the full sample similarity matrix of the nth layer; ·,n For S ·,n The diagonal elements are used as the similarity of positive sample pairs, while S ·,n The off-diagonal elements are used as the similarity of negative sample pairs.

[0037] The standard InfoNCE is used as the head-level contrastive loss for global feature freezing, as shown below:

[0038]

[0039] Cross-sample augmented InfoNCE is used as the time-point-level contrastive loss for global feature freezing, as detailed below:

[0040]

[0041] After excluding positive sample pairs, the model is forced to focus on differences across samples rather than similarities within a single sample.

[0042] After applying gradient freezing to the local features, a similarity matrix is ​​constructed as shown below:

[0043]

[0044] Finally, the contrastive loss for local feature freezing is obtained based on the construction logic of the global feature freezing contrastive loss function. and Preferably, in step 4, the introduced adversarial mechanism with constraints causes the global features to mimic the local feature distribution, while the local features maintain a difference from the global feature distribution; the adversarial mechanism is shown in the following equation:

[0045]

[0046] In the formula, N is the number of layers in the multi-head self-attention system; The model minimizes To make the global features approximate the local features of gradient freezing; The model maximizes This allows local features to move away from the gradient-frozen global features. The global and local features interact with each other by approaching and moving away, thus enhancing the robustness of the model. As a constraint term, the semantic consistency of global and local features is constrained by the L2 norm, ensuring that the introduced adversarial learning is a meaningful feature distinction rather than a meaningless random deviation.

[0047] Preferably, in step 6, the data in the validation dataset and the test dataset are used to score anomalies using a trained model and a hierarchical composite anomaly scoring mechanism that combines KL divergence and JS divergence as shown in the following formula:

[0048]

[0049] AnomalyScore = Score h +Score t

[0050] In the formula, Score h Indicates anomaly score at the head level; Score t This indicates anomaly scores at a specific point in time. express and The average distribution.

[0051] For anomaly scoring on the validation dataset, a threshold (Threshold) is set based on the k-σ criterion:

[0052] Threshold=μ+kσ

[0053] In the formula, μ and σ represent the mean and standard deviation of the abnormal scores, respectively; anomaly detection is performed on the abnormal scores of the test dataset based on this threshold, where 1 represents an abnormal data point and 0 represents a normal data point.

[0054]

[0055] This invention proposes a new method for detecting anomalies in multivariate time series. Compared with the prior art, this invention has the following advantages: (1) This invention proposes a robust data standardization method, which uses two robust statistics, interquartile range and median absolute deviation, to reconstruct the standardization scale, thus avoiding the problem of outliers distorting the standardization scale in traditional standardization methods.

[0056] (2) This invention trains the model through contrastive adversarial learning, directly amplifies the difference in feature representation between normal and abnormal points from different perspectives, and designs a composite anomaly scoring mechanism to represent this difference. Then, anomaly detection is performed based on the anomaly score, instead of using the difference between the reconstructed value and the original data value for detection. This solves the problem to some extent that the reconstructed model needs clean data for training.

[0057] (3) This invention fully utilizes the head diversity of multi-head self-attention and the distribution information of features in the time dimension by performing hierarchical learning on the features extracted by self-attention; and can solve the misalignment problem that occurs when constructing positive and negative sample pairs when using contrastive learning in the time series domain. Attached Figure Description

[0058] Figure 1 This is a flowchart of the method of the present invention;

[0059] Figure 2 This is a diagram of the relative position encoding self-attention structure of the present invention;

[0060] Figure 3 This is a comparison chart of the detection results of the embodiments of the present invention with those of existing methods on a public dataset;

[0061] Figure 4 This is a schematic diagram of the system structure of the present invention;

[0062] Figure 5 This is a schematic diagram of the hierarchical contrastive adversarial learning model in the system of this invention. Detailed Implementation

[0063] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below in conjunction with the embodiments of this invention. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0064] The specific embodiments of the present invention will be further described below with reference to the accompanying drawings.

[0065] like Figure 1 As shown, the multivariate time series anomaly detection method based on hierarchical contrastive adversarial learning described in this invention includes the following steps:

[0066] Step 1: After collecting training, validation and test sets from various fields, considering the possible differences in the scale of data from different fields and the scale interference of potential outliers in the data during data standardization, a standardization process based on robust statistics is implemented on these three types of datasets respectively. Then, the standardized multivariate time series data is segmented by a sliding window to obtain a series of subsequences with a fixed length of T.

[0067] The robust statistics-based standardization method differs from traditional standardization methods, which rely on a single statistic to define the scale and are susceptible to outliers. It combines two statistics—interquartile range and median absolute deviation—that characterize data distribution, reconstructing a standardized scale that effectively reflects both the breadth and density of the data. This scale not only effectively eliminates interference from differences in data units but also addresses the weakness of traditional methods where outliers distort the standardized scale. The robust statistics-based standardization is implemented using the following formula:

[0068]

[0069] In the formula, X norm For standardized preprocessed multivariate time series data; X is multivariate time series data; m = median(X) is the median of X; MAD = median(|Xm|) is the median absolute deviation of X; IQR is the interquartile range of X; δ is a minimum value to avoid the case where the denominator is 0.

[0070] Step 2 involves randomly selecting training data from the training set obtained in Step 1 and inputting them into an N-layer multi-head self-attention layer with relative position encoding to extract attention scores as local features of the training data. The specific steps include:

[0071] First, a fixed-length subsequence of batch size B is randomly selected from the training set and passed through an embedding layer to obtain... As the input to the self-attention of the first layer, the query matrix Q of any nth layer (n≥1) is obtained by linear projection through the learnable weights. n Key matrix K n Value matrix V n Based on the query matrix position vector Bond matrix position vector Constructing the relative position matrix Its element R ij =P Q [i]-P K [j] represents the positional difference between the i-th query element and the j-th key element.

[0072] Then, a dynamic bias matrix Bias is introduced based on the relative position matrix R to achieve an adaptive correlation between position difference and attention sensitivity:

[0073] Bias h =α h log(1+γ|R|)·exp(-β h |R|)·sign(R)

[0074] In the formula, α h β is a learnable scaling factor used to control the bias strength. h γ is a learnable decay factor used to control the decay rate; γ is a relative position adjustment hyperparameter; sign(R) is the direction sign, which is used to take the positive or negative sign of each element of R to preserve the basic direction information of the relative position.

[0075] Finally, the attenuation bias matrix Bias h Adding the scaled dot product to the nth layer attention at the hth head yields local features of the data. The self-attention mechanisms of each layer are shown below:

[0076]

[0077] In the formula, These are the query matrix, key matrix, and value matrix of the h-th head in the n-th attention layer, respectively. d is the projection matrix of the h-th head in the n-th attention layer; k =d model / H is the dimension of each head; d model It represents the data dimension after the embedding layer; H is the number of heads of self-attention in each layer; A projection matrix composed of multiple heads; This indicates that the self-attention output of the multi-head splicing, after passing through the feedforward layer and the stacking and normalization components, serves as the input to the next layer of self-attention. Relative position encoding self-attention structure diagram as follows Figure 2 As shown.

[0078] Training data is randomly selected from the training set obtained in step 1, encoded using absolute position, and then input into an N-layer multi-head self-attention layer to extract attention scores as global features of the training data; the specific steps include:

[0079] First, a fixed-length subsequence of batch size B is randomly selected from the training set and passed through the embedding layer. The following absolute position encoding is used to generate a unique time point vector, which provides a positional reference for global feature extraction.

[0080]

[0081] In the formula, pos is the position index; i is the dimension index;

[0082] Then, the encoded embedded data is input into the multi-head self-attention layer, which outputs global features that reflect the global correlation of the data.

[0083]

[0084] Step 3: Gradient freezing is applied to the global features obtained in Step 2 to prevent them from participating in backpropagation. Then, the global features are compared and learned at both the head level and time-point levels with the local features obtained simultaneously in Step 2. The specific steps are as follows:

[0085] First, global features and local features Weight normalization is performed at both the head level and the time-point level to obtain the normalized features:

[0086]

[0087] In the formula, This indicates that the L2 norm is calculated in the last dimension.

[0088] Then, the gradients of the global features are frozen, and similarity matrices are constructed with the local features at the head level and time point level, respectively:

[0089]

[0090] In the formula, Detach(·) represents freezing the gradient, blocking the backpropagation of the gradient; S ·,n P is the full sample similarity matrix of the nth layer; ·,n For S ·,n The diagonal elements are used as the similarity of positive sample pairs, while S ·,n The off-diagonal elements are used as the similarity of negative sample pairs.

[0091] The standard InfoNCE is used as the head-level contrastive loss for global feature freezing, as shown below:

[0092]

[0093] Since temporal-level contrastive learning is cross-sample, meaning that the temporal representation of each sample needs to be distinguishable from the same temporal representation of other samples, a cross-sample enhanced InfoNCE is used as the temporal-level contrastive loss for global feature freezing, as shown below:

[0094]

[0095] After excluding positive sample pairs, the model is forced to focus on differences across samples rather than similarities within a single sample.

[0096] Next, after gradient freezing of the local features, a similarity matrix is ​​constructed as shown below:

[0097]

[0098] Finally, the contrast loss of local feature freezing is obtained based on the construction logic of the global feature freezing contrast loss function.

[0099] Finally, based on the construction logic of the global feature freezing contrastive loss function, the head-level contrastive loss for local feature freezing is obtained. Loss compared with the time-point hierarchy of local feature freezing

[0100] Step 4: After completing the contrastive learning in step 3, an adversarial mechanism with constraints is introduced. This further expands the representational differences between normal and abnormal data while ensuring that the introduced adversarial mechanism can make meaningful feature distinctions.

[0101] An adversarial mechanism is introduced as shown below, which makes the global features mimic the distribution of local features, while the local features maintain a difference from the global feature distribution.

[0102]

[0103] In the formula, N is the number of layers in the multi-head self-attention system; The model minimizes To make the global features approximate the local features of gradient freezing; The model maximizes This allows local features to move away from the gradient-frozen global features. The global and local features interact with each other by approaching and moving away, thus enhancing the robustness of the model. As a constraint term, the semantic consistency of global and local features is constrained by the L2 norm, ensuring that the introduced adversarial learning is a meaningful feature distinction rather than a meaningless random deviation.

[0104] Step 5: Repeat steps 2 through 4 until model training is complete;

[0105] Step 6: Anomaly scoring is performed on the validation set and the test set using the trained model and a hierarchical composite anomaly scoring mechanism that combines KL divergence and JS divergence as shown below.

[0106]

[0107] AnomalyScore = Score h +Score t

[0108] In the formula, Score h Indicates anomaly score at the head level; Score t This indicates anomaly scores at a specific point in time. express and The average distribution.

[0109] For anomaly scoring on the validation set, a threshold is set based on the k-σ criterion:

[0110] Threshold=μ+kσ

[0111] In the formula, μ and σ represent the mean and standard deviation of the anomaly scores, respectively. Anomaly detection is performed on the anomaly scores in the test set based on this threshold, and the anomaly result y is... t As shown in the formula below, 1 represents an abnormal data point and 0 represents a normal data point;

[0112]

[0113] Example

[0114] Anomaly detection experiments were conducted on five public datasets—MSL, SMAP, PSM, SWAT, and SMD—using this invention along with the OmniAnomaly algorithm, LSTM-VAE algorithm, USAD algorithm, TranAD algorithm, AnomalyTransformer algorithm, and DCdetector algorithm.

[0115] Specifically, in this embodiment of the invention, the minimum value δ = 10 -6 Subsequence length T = 100; batch size B = 64; relative position adjustment hyperparameter γ = 10; embedding layer dimension d model =128, number of heads of multi-head self-attention H=8; number of layers of multi-head self-attention N=3; k∈[1.5,2.5].

[0116] Precision (P), recall (R), and F1 score (F1) were used as evaluation metrics for anomaly detection. The evaluation results of the anomaly detection experiment are as follows: Figure 3As shown in the figure, the bold data represents the first-ranked value, and the underlined data represents the second-ranked value. The data in the figure demonstrates that this invention significantly outperforms other algorithms in terms of precision (P), recall (R), and F1 score (F1).

[0117] In addition, such as Figure 4 As shown, the present invention provides a multivariate time series anomaly detection system based on hierarchical contrastive adversarial learning, including a data preprocessing module, a model building module, a model training module, and a model testing module.

[0118] 1) Data preprocessing module: used to robustly standardize the original multivariate time series and output standardized time series data; at the same time, a sliding window is used to dynamically segment the standardized time series data;

[0119] 2) Model building module: This module is used to build an anomaly detection model using a deep learning framework. The anomaly detection model mainly includes relative position encoding self-attention and absolute position encoding self-attention, which are used to extract local and global features of time series data, respectively. The module also sets the hyperparameters required by the model and completes the model initialization.

[0120] 3) Model training module: This module is used to extract features from the preprocessed training set through an attention mechanism; it designs contrastive learning loss functions based on different levels of InfoNCE, introduces an adversarial mechanism with constraint terms to obtain the total loss function, completes the iterative training of the anomaly detection model, and finally obtains the trained anomaly detection model.

[0121] 4) Model Testing Module: This module is used to design anomaly detection strategies. Based on the trained anomaly detection model, it designs a novel composite anomaly scoring mechanism. It scores anomalies at each time point on both the validation and test sets. Based on the anomaly scores on the validation set, it selects a threshold to apply to the test set to complete anomaly detection.

[0122] The system of this invention involves the structure of a hierarchical contrastive adversarial learning model, such as... Figure 5 As shown, the system mainly includes a self-attention module with absolute position encoding, a self-attention module with relative position encoding, and a contrastive adversarial learning module. The self-attention module with absolute position encoding mainly utilizes the periodicity and different frequency characteristics of sine and cosine functions to generate a unique encoding vector for each time point in the sequence. The self-attention module with relative position encoding mainly calculates the distance between each time point and other time points as the relative position, and adjusts the sensitivity of the attention weight to the relative position according to the combined effect of nonlinear growth and exponential decay, making the module pay more attention to the features of the data around a certain time point. The contrastive adversarial learning module amplifies the differences between the features of the two perspectives, making it easier to distinguish between outliers and normal points.

[0123] Contents not described in detail in this specification are prior art known to those skilled in the art. Although illustrative specific embodiments of the invention have been described above to facilitate understanding by those skilled in the art, it should be understood that the invention is not limited to the scope of the specific embodiments. Various modifications are readily apparent to those skilled in the art as long as they fall within the spirit and scope of the invention as defined and determined by the appended claims, and all inventions utilizing the concept of this invention are protected.

Claims

1. A multivariate time series anomaly detection method based on hierarchical contrastive adversarial learning, characterized in that, Includes the following steps: Step 1: Collect the dataset and preprocess the data to obtain the training dataset, validation dataset, and test dataset; Step 2: Randomly select training data from the training dataset and input it into an N-layer multi-head self-attention layer with relative position encoding to extract attention scores as local features of the training data; Training data is randomly selected from the training dataset, encoded with absolute position, and then input into an N-layer multi-head self-attention layer to extract attention scores as global features of the training data; and the features are divided into head layer and time point layer according to their shape. Step 3: Perform hierarchical comparative learning between local and global features, that is: freeze the gradient of one feature so that it does not participate in backpropagation, and then perform comparative learning with another feature at the head level and time point level respectively. Step 4: After contrastive learning, an adversarial mechanism with constraints is introduced to further expand the representational differences between normal and abnormal data while ensuring that the introduced adversarial mechanism can make meaningful feature distinctions. Step 5: Repeat steps 2 to 4 until the model is fully trained; Step 6: The trained model is scored for anomalies on the validation dataset and the test dataset using a composite anomaly scoring mechanism. Then, a threshold is selected based on the anomaly score on the validation dataset for anomaly detection on the test dataset.

2. The multivariate time series anomaly detection method based on hierarchical contrastive adversarial learning according to claim 1, characterized in that, The data preprocessing method in step 1 is a standardization method based on robust statistics, specifically implemented through the following formula: In the formula, X norm For standardized preprocessed multivariate time series data; X is multivariate time series data; m = median(X) is the median of X; MAD = median(|Xm|) is the median absolute deviation of X; IQR is the interquartile range of X; δ is a minimum value to avoid the case where the denominator is 0; Then, the standardized multivariate time series data is segmented using a sliding window to obtain a series of subsequences with a fixed length of T.

3. The multivariate time series anomaly detection method based on hierarchical contrastive adversarial learning according to claim 1, characterized in that, In step 2, the specific steps for obtaining the local and global features of the training data are as follows: First, a fixed-length subsequence of batch size B is randomly selected from the training set and passed through an embedding layer to obtain... As the input to the self-attention of the first layer, the query matrix Q of any nth layer (n≥1) is obtained by linear projection through the learnable weights. n Key matrix K n Value matrix V n Based on the query matrix position vector Bond matrix position vector Constructing the relative position matrix Its element R ij =P Q [i]-P K [j] represents the positional difference between the i-th query element and the j-th key element. Then, a dynamic bias matrix Bias is introduced based on the relative position matrix R to achieve an adaptive correlation between position difference and attention sensitivity: Bias h =a h log(1+γ|R|)·exp(-β h |R|)·sign(R) In the formula, α h β is a learnable scaling factor used to control the bias strength. h γ is a learnable decay factor used to control the decay rate; γ is a relative position adjustment hyperparameter; sign(R) is the direction sign, which is used to take the positive or negative sign of each element of R to preserve the basic direction information of the relative position. Finally, the attenuation bias matrix Bias h Adding the scaled dot product to the nth layer attention on the hth head yields local features of the data. The self-attention mechanisms of each layer are shown below: In the formula, These are the query matrix, key matrix, and value matrix of the h-th head in the n-th attention layer, respectively. d is the projection matrix of the h-th head in the n-th attention layer; k =d model / H is the dimension of each head; d model It represents the data dimension after the embedding layer; H is the number of heads of self-attention in each layer; A projection matrix composed of multiple heads; This indicates that the self-attention output of the multi-head splicing, after passing through the feedforward layer and the stacking and normalization components, serves as the input to the next layer of self-attention. Unique time vectors are generated for different locations using sine and cosine functions to provide a locational reference for the embedded data. Global features of the data are then extracted through a multi-head self-attention layer.

4. The multivariate time series anomaly detection method based on hierarchical contrastive adversarial learning according to claim 1, characterized in that, In step 3, local features and global features Weight normalization is performed at both the head level and the time-point level to obtain the normalized features: In the formula, This indicates that the L2 norm is calculated in the last dimension. Then, the gradients of the global features are frozen, and similarity matrices are constructed with the local features at the head level and time point level, as shown below: In the formula, Detach(·) represents freezing the gradient, blocking the backpropagation of the gradient; S ·,n P is the full sample similarity matrix of the nth layer; ·,n For S ·,n The diagonal elements are used as the similarity of positive sample pairs, while S ·,n The off-diagonal elements are used as the similarity of negative sample pairs; The standard InfoNCE is used as the head-level contrastive loss for global feature freezing, as shown below: Cross-sample augmented InfoNCE is used as the time-point-level contrastive loss for global feature freezing, as detailed below: After excluding positive sample pairs, the model is forced to focus on differences across samples rather than similarities within a single sample; After freezing the gradients of local features, the following similarity matrix is ​​constructed: Finally, the contrastive loss for local feature freezing is obtained based on the construction logic of the global feature freezing contrastive loss function. and 5. The multivariate time series anomaly detection method based on hierarchical contrastive adversarial learning according to claim 1, characterized in that, In step 4, a constrained adversarial mechanism is introduced as shown below, which makes the global features mimic the local feature distribution, while the local features maintain a difference from the global feature distribution. In the formula, N is the number of layers in the multi-head self-attention system; The model minimizes To make the global features approximate the local features of gradient freezing; The model maximizes This allows local features to move away from the gradient-frozen global features. The global and local features interact with each other by approaching and moving away, thus enhancing the robustness of the model. As a constraint term, the semantic consistency of global and local features is constrained by the L2 norm, ensuring that the introduced adversarial learning is a meaningful feature distinction rather than a meaningless random deviation.

6. The multivariate time series anomaly detection method based on hierarchical contrastive adversarial learning according to claim 1, characterized in that, In step 6, the data in the verification dataset and the test dataset are scored for anomalies using a trained model and a hierarchical composite anomaly scoring mechanism that combines KL divergence and JS divergence as shown in the following formula. AnomalyScore=Score h +Score t In the formula, Score h Indicates anomaly score at the head level; Score t This indicates anomaly scores at a specific point in time. express and The average distribution. For anomaly scoring in the validation dataset, a threshold is set based on the k-σ criterion: Threshold=μ+kσ In the formula, μ and σ represent the mean and standard deviation of the abnormal scores, respectively; Anomaly detection is performed on the abnormal scores of the test dataset based on this threshold, where 1 represents an abnormal data point and 0 represents a normal data point.

7. A multivariate time series anomaly detection system based on hierarchical contrastive adversarial learning, characterized in that, include: 1) Data preprocessing module: used to robustly standardize the original multivariate time series and output standardized time series data; at the same time, a sliding window is used to dynamically segment the standardized time series data; 2) Model building module: This module is used to build an anomaly detection model using a deep learning framework. The anomaly detection model mainly includes relative position encoding self-attention and absolute position encoding self-attention, which are used to extract local and global features of time series data, respectively. The module also sets the hyperparameters required by the model and completes the model initialization. 3) Model training module: This module is used to extract features from the preprocessed training set through an attention mechanism; it designs contrastive learning loss functions based on different levels of InfoNCE, introduces an adversarial mechanism with constraint terms to obtain the total loss, completes the iterative training of the anomaly detection model, and finally obtains the trained anomaly detection model. 4) Model Testing Module: This module is used to design anomaly detection strategies. Based on the trained anomaly detection model, a novel composite anomaly scoring mechanism is designed. Anomalies are scored at each time point on both the validation and test sets. A threshold is selected based on the anomaly score on the validation set and applied to the test set to complete anomaly detection.

Images