Multivariable time sequence anomaly detection method and system based on frequency domain decomposition
By using frequency domain decomposition and a dual-branch feature extraction network, the decoupling problem of multi-scale and multi-mode features in multivariate time series is solved, achieving accurate anomaly detection, improving detection performance and enhancing the applicability of the method.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-11-28
- Publication Date
- 2026-04-10
AI Technical Summary
Existing technologies cannot effectively decompose multi-scale and multi-modal features in multivariate time series data, resulting in poor anomaly detection performance.
A multivariate time series anomaly detection method based on frequency domain decomposition is adopted. By separating the periodic scale and trend pattern through Fourier transform and frequency band masking, and combining it with a dual-branch feature extraction network for multi-scale fusion reconstruction, the decoupling of multi-scale and multi-mode and accurate anomaly detection are achieved.
It achieves comprehensive decoupling of multi-scale and multi-modal features, improves anomaly detection performance, and has high transferability, which can significantly improve the detection performance of other methods.
Smart Images
Figure CN121834572A_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of data mining technology, specifically relating to a method and system for detecting anomalies in multivariate time series based on frequency domain decomposition. Background Technology
[0002] Multivariate time series anomaly detection is a key technology for identifying phenomena or events that significantly deviate from normal behavior, and it is particularly important in contemporary data-intensive scientific and industrial applications. Applications span multiple fields: from detecting equipment failures in industrial production lines to identifying anomalous transactions and fraudulent activities in the financial sector, and early disease diagnosis and prevention in healthcare applications. These wide-ranging applications have led to widespread attention being paid to time series anomaly detection across various fields.
[0003] Multivariate time series data exhibit different patterns (i.e., seasonality and trend) across different periodic scales, a phenomenon termed "multi-scale and multi-modal." Taking temperature changes in meteorological data as an example, due to the Earth's rotation, temperature data displays regular changes on daily and annual periodic scales, with each scale containing various data patterns. For instance, the annual temperature cycle exhibits two coexisting data patterns: a seasonal pattern following the annual cycle and a long-term upward or downward trend pattern. These multi-scale and multi-modal characteristics often make anomalies difficult to identify. In addition to their multi-scale and multi-modal characteristics, multidimensional time series data also contain various types of anomalies, such as periodic anomalies caused by frequency variations, long-term and short-term trend anomalies, and sudden point anomalies. In real-world scenarios, anomalies are often embedded in the multi-scale and multi-modal features of the data in more complex forms, making them difficult to detect directly. Effectively decoupling these multi-scale and multi-modal features from multivariate time series data has become a key challenge in the field of time series anomaly detection.
[0004] Existing research primarily focuses on effectively decomposing raw data to facilitate more accurate anomaly detection. Some methods employ simple techniques (such as moving averages and exponential smoothing) to decompose the raw data into two patterns, but this decomposition fails to capture accurate seasonal patterns and ignores the inherent multi-scale characteristics of time series data. Other studies utilize wavelet analysis or Fourier transform to decompose the raw data into a combination of multiple scales from a frequency domain perspective. However, these methods treat all variables as a whole, thus failing to capture the distinct multi-scale features of different variables. Furthermore, the multiple patterns within each scale derived from these methods remain intertwined. Additionally, some studies process the raw data through downsampling to capture multi-scale features. However, this method relies on hyperparameter settings and can only separate scales of fixed length, failing to accurately capture the inherent multi-scale characteristics of the data. Summary of the Invention
[0005] The technical problem to be solved by the present invention is to provide a multivariate time series anomaly detection method and system based on frequency domain decomposition, which addresses the above-mentioned problems of the prior art. The present invention aims to effectively decompose complex multi-scale and multi-mode time series to achieve accurate anomaly detection, thereby alleviating the problem of poor detection effect caused by the inability to effectively decompose the original sequence in the prior art.
[0006] To solve the above-mentioned technical problems, the technical solution adopted by the present invention is as follows: A multivariate time series anomaly detection method based on frequency domain decomposition includes the following steps: using a multivariate time series anomaly detection model to obtain reconstructed values for corresponding time points; calculating the error between the reconstructed values and the true values at the corresponding time points; and determining that an anomaly exists at the corresponding time point if the error is greater than a preset threshold. The multivariate time series anomaly detection model obtains the reconstructed values for the corresponding time points by including: S101, divides the multivariate time series into overlapping window series; S102, for each variable in the window sequence, convert the time domain signal into a frequency domain signal through Fourier transform, calculate the amplitude of each frequency point in the frequency domain signal and select the top K frequency points with the largest amplitude to obtain the corresponding period scale; define a continuous frequency band around the K frequency points as the key frequency band and construct the frequency band mask. S103, for each variable in the window sequence, the frequency domain signal and the frequency band mask of K frequency points are processed to filter out the signal of the key frequency band, and the signal is converted back to the time domain by inverse Fourier transform to obtain the trend pattern signal at K period scales. The trend pattern signal at K period scales is stacked to obtain the multi-scale trend feature. The trend pattern signal at K period scales is subtracted from the original time domain signal to obtain the seasonal pattern signal at K period scales. The seasonal feature at K period scales is stacked to obtain the multi-scale seasonal feature. S104 extracts global trend feature representation from multi-scale trend features and extracts global seasonal feature representation from multi-scale seasonal features; S105, the global trend feature representation and the global seasonal feature representation are fused and reconstructed at multiple scales to obtain the fused feature; S106, the fused features are decoded using a decoder to obtain the reconstructed values at the corresponding time points.
[0007] Optionally, in step S102, when defining a continuous frequency band around K frequency points and constructing a frequency band mask, the bandwidth of the continuous frequency band defined for each frequency point is determined based on a preset hyperparameter, which is determined during the training phase of the multivariate time series anomaly detection model.
[0008] Optionally, step S104, which involves extracting a global trend feature representation from the multi-scale trend features, includes: applying a 1D convolution to the multi-scale trend features to extract local temporal features, and then smoothing the local temporal features extracted by the 1D convolution using a moving average operation to serve as the trend features at each time point; calculating the difference between the trend features at adjacent time points to obtain the trend change rate; using two independent multilayer perceptrons (MLPs) as encoders to perform nonlinear feature extraction on the trend features and the trend change rate, and then fusing the two types of features extracted by the two MLPs to map them to a unified feature space to obtain a global trend feature representation.
[0009] Optionally, step S104, which extracts a global seasonal feature representation from the multi-scale seasonal features, includes: grouping the multi-scale seasonal features according to the variable dimension, with each group corresponding to the seasonal features of a variable at K periodic scales; performing a group convolution operation on each group using a dedicated convolution kernel configured for each group to extract the group seasonal features; and integrating the group seasonal features of all groups to obtain a global seasonal feature representation.
[0010] Optionally, step S105 involves multi-scale fusion reconstruction of the global trend feature representation and the global seasonal feature representation to obtain fused features, which includes: normalizing the amplitude of the first K frequency points and using them as weights under the K-period scale; weighting and summing the global trend feature representation and the global seasonal feature representation of each variable according to the weights under the K-period scale to obtain the fused seasonal feature and fused trend feature of each variable; and integrating the fused seasonal feature and fused trend feature of all variables to obtain the fused features.
[0011] Optionally, during training, the loss function used by the multivariate time series anomaly detection model is a weighted sum of three losses: seasonal pattern reconstruction loss, trend pattern reconstruction loss, and original signal reconstruction loss. The seasonal pattern reconstruction loss is the mean square error between the reconstructed value and the true value obtained by the decoder of the global seasonal feature representation; the trend pattern reconstruction loss is the mean square error between the reconstructed value and the true value obtained by the decoder of the global trend feature representation; and the original signal reconstruction loss is the mean square error between the reconstructed value and the true value obtained by the decoder of the fused features.
[0012] Optionally, after determining that there is an anomaly at the corresponding time point, the method further includes determining that there is an anomaly at a time point within a preset time window. If any time point in a series of consecutive anomaly segments within a time window is detected as an anomaly, then the entire series of consecutive anomaly segments within the time window are determined to be anomalies.
[0013] The present invention also provides a multivariate time series anomaly detection system based on frequency domain decomposition, comprising a microprocessor and a memory interconnected thereto, wherein the microprocessor is programmed or configured to execute the multivariate time series anomaly detection method based on frequency domain decomposition.
[0014] The present invention also provides a computer-readable storage medium storing a computer program or instructions that are programmed or configured to execute the frequency domain decomposition-based multivariate time series anomaly detection method by a processor.
[0015] The present invention also provides a computer program product, including a computer program or instructions, which are programmed or configured to execute the frequency domain decomposition-based multivariate time series anomaly detection method by a processor.
[0016] Compared with the prior art, the present invention can achieve the following beneficial effects: (1) The present invention can achieve comprehensive decoupling of multiple scales and multiple modes: from the frequency domain perspective, through real fast Fourier transform, key scale screening and frequency band masking, different periodic scales can be separated, and seasonal patterns and trend patterns can be distinguished at each scale, solving the problem that the prior art cannot achieve comprehensive decoupling, and providing a foundation for accurate anomaly detection; (2) The present invention can improve anomaly detection performance: the dual-branch feature extraction network can learn features for the characteristics of seasonal patterns and trend patterns respectively, and multi-scale fusion reconstruction further ensures accurate fitting of normal data, so that the model can effectively identify various types of anomalies (such as periodic anomalies, trend anomalies, point anomalies); (3) The present invention can have high transferability: after integrating the decomposition module and dual-branch feature extraction network of the present invention into other baseline methods, the detection performance of these methods can be significantly improved, indicating that it can be used as an efficient feature enhancement module and flexibly adapt to different time series anomaly detection frameworks. Attached Figure Description
[0017] Figure 1 This is a schematic diagram illustrating the basic process of obtaining reconstructed values using a multivariate time series anomaly detection model in an embodiment of the present invention.
[0018] Figure 2 This is a schematic diagram illustrating the detection principle of the multivariate time series anomaly detection model in this embodiment of the invention.
[0019] Figure 3 This is a schematic diagram of the training process of the multivariate time series anomaly detection model in an embodiment of the present invention.
[0020] Figure 4This is a schematic diagram of the synthesized multi-scale multivariate time series in an embodiment of the present invention, where (a) and (b) are two different original signals, (c), (e) and (g) are periodic signals generated at different scales of the original data (a) input, and (d), (f) and (h) are trend signals generated at different scales of the original data (b) input. Detailed Implementation
[0021] This invention aims to effectively decompose complex multi-scale, multi-mode time series to achieve accurate anomaly detection, alleviating the problem of poor detection performance in existing technologies due to the inability to effectively decompose the original sequence. To enable those skilled in the art to better understand the technical solution of this invention, the following will provide a more detailed description of the technical solution in conjunction with the accompanying drawings of the embodiments of this invention.
[0022] like Figure 1 As shown, the multivariate time series anomaly detection method based on frequency domain decomposition in this embodiment includes the following steps: using a multivariate time series anomaly detection model to obtain the reconstructed value of the corresponding time point, calculating the error between the reconstructed value and the true value of the corresponding time point (which can be a statistical value such as difference or mean square error), and determining that there is an anomaly at the corresponding time point if the error is greater than a preset threshold. The multivariate time series anomaly detection model obtains the reconstructed value of the corresponding time point by including: S101, divides the multivariate time series into overlapping window series; S102, for each variable in the window sequence, convert the time domain signal into a frequency domain signal through Fourier transform, calculate the amplitude of each frequency point in the frequency domain signal and select the top K frequency points with the largest amplitude to obtain the corresponding period scale; define a continuous frequency band around the K frequency points as the key frequency band and construct the frequency band mask. S103, for each variable in the window sequence, the frequency domain signal and the frequency band mask of K frequency points are processed to filter out the signal of the key frequency band, and the signal is converted back to the time domain by inverse Fourier transform to obtain the trend pattern signal at K period scales. The trend pattern signal at K period scales is stacked to obtain the multi-scale trend feature. The trend pattern signal at K period scales is subtracted from the original time domain signal to obtain the seasonal pattern signal at K period scales. The seasonal feature at K period scales is stacked to obtain the multi-scale seasonal feature. S104 extracts global trend feature representation from multi-scale trend features and extracts global seasonal feature representation from multi-scale seasonal features; S105, the global trend feature representation and the global seasonal feature representation are fused and reconstructed at multiple scales to obtain the fused feature; S106, the fused features are decoded using a decoder to obtain the reconstructed values at the corresponding time points.
[0023] In step S101 of this embodiment, the input multivariate time series includes various indicator data of the device, including indicator data detected by sensors, such as some or all of current, voltage, humidity, temperature, speed, rotational speed, sound and vibration. It can also further include indicator data extracted based on sensor detection data. Taking voltage as an example, it can be data extracted based on voltage, such as the phase angle, amplitude and frequency of the fundamental wave and each harmonic. Before step S101 of this embodiment, the original data of the input multivariate time series is preprocessed to convert it into an overlapping window sequence to capture local time series features and provide a basis for subsequent frequency domain analysis and feature learning. The specific operations are as follows: (1) Clarify the basic format of the original data, including the total number of time points and variable dimensions. Each time point corresponds to a set of multivariate measurement data; (2) Set the number of iteration rounds (epochs) and the batch size (batch-size). Take the minimum batch of data from the training set and standardize the minimum batch according to the dimensions to ensure consistency between different dimensions; (3) adopt the sliding window strategy to divide the original time series into multiple overlapping windows. Each window contains a fixed number of consecutive time points. The window length can be preset according to the periodic characteristics of the data (e.g., 30 time points); (4) set different window step sizes for the training stage and the inference stage: during training, set an appropriate step size between adjacent windows to balance computational overhead and feature coverage; during inference, set the step size to 1 to ensure that each time point can be detected and avoid missing anomalies. To simplify the description of the subsequent steps, a single window is used as the basic processing unit. All subsequent operations are carried out around a single window and finally the entire original time series is covered by sliding the window.
[0024] Figure 2This is a schematic diagram of the detection principle of the multivariate time series anomaly detection model in this embodiment. The multivariate time series anomaly detection model in this embodiment includes a frequency domain analysis module, a multi-scale multi-mode decomposition module, a dual-path feature extraction network module, and an anomaly detection module. The main functions of each module are described as follows: (1) The frequency domain analysis module processes each variable in the preprocessed window sequence independently, converts the time domain signal into a frequency domain signal through real fast Fourier transform, calculates the amplitude of each frequency point and selects the top K high-energy key frequencies, and then constructs a continuous frequency band mask around the key frequencies to provide basic support for subsequent mode separation at the frequency level. (2) The multi-scale multi-mode decomposition module filters the key frequency band of the frequency domain signal of each variable based on the mask of the frequency domain analysis module and inversely transforms it back to the time domain to obtain the trend mode. The seasonal mode is obtained by subtracting the trend mode from the original signal. Then, the trend and seasonal modes of each variable at K scales are stacked and integrated to realize the decoupling and standardized feature output of multi-scale multi-mode. (3) The dual-path feature extraction network module learns features separately using two branches: the seasonal branch is grouped by variables, and multi-scale seasonal features are extracted through group convolution and variable confusion is avoided; the trend branch first extracts long-term trend features and abrupt change rate, and then fuses them after being processed by the encoder to obtain trend features that can identify trends and point anomalies, ensuring that the two modes of features fit their own attributes. (4) The anomaly detection module fuses the dual-branch multi-scale features with key frequency amplitude as weight, and completes the three-layer reconstruction of seasonal, trend and original signals through the decoder; the reconstruction error is calculated to obtain the total loss and optimize the model. During testing, the reconstruction error of the original signal is used as the anomaly score. Combined with the threshold and continuous segment judgment strategy, the anomaly is accurately identified.
[0025] Step S102 in this embodiment is a frequency domain analysis step, which includes the following steps: (1) Real Fast Fourier Transform and Amplitude Calculation: Apply Real Fast Fourier Transform to the time domain signal of each variable in the window to convert it into a frequency domain signal; then calculate the amplitude of the frequency domain signal. The amplitude reflects the contribution of the corresponding frequency component to the original signal. The larger the amplitude, the higher the information weight of the frequency component; (2) Screening Top-K Key Scales: Sort the amplitude sequence of each variable and screen out the top K frequency points with the largest amplitude. Use these frequency points as the key scales of the variable (i.e., the core of the dominant data periodicity). (1) Heart frequency); K is a preset hyperparameter. Experimentally verified, usually 2 or 3 can cover the most important 2-3 periodic scales in the time series; (2) Construct a frequency band mask: Considering that the periodic patterns of actual data are distributed in continuous frequency bands (rather than a single frequency point), and the "spectral leakage" problem of energy spreading to adjacent frequency points will occur due to the limitation of the time series length, a continuous frequency band is defined around each key frequency point; the frequency band width is a preset hyperparameter to ensure complete coverage of the periodic signal; a mask is constructed based on the defined frequency band. This mask is used to filter key frequency bands (corresponding to seasonal patterns) and retain non-key frequency bands (corresponding to trend patterns).
[0026] As an optional implementation, in step S102 of this embodiment, when defining a continuous frequency band around K frequency points and constructing a frequency band mask, the bandwidth of the continuous frequency band defined for each frequency point is determined based on a preset hyperparameter, which is determined during the training phase of the multivariate time series anomaly detection model.
[0027] Step S103 in this embodiment is a multi-scale multi-mode decomposition step, which includes the following steps: (1) Trend pattern extraction: The frequency domain signal of each variable is operated with the corresponding trend pattern mask to filter out the key frequency band signal (i.e., remove the seasonal pattern related components) to obtain a frequency domain signal containing only trend pattern related information; then the inverse real fast Fourier transform is applied to the frequency domain signal to convert it back to the time domain to obtain the trend pattern of the variable at the corresponding scale. The trend pattern reflects the long-term change trend of the variable (such as the interannual rise or fall trend of temperature); (2) Seasonal pattern extraction: The extracted trend pattern is subtracted from the original time domain signal to obtain the seasonal pattern of the variable at the corresponding scale. The seasonal pattern reflects the periodic fluctuation of the variable (such as the daily or annual cycle fluctuation of temperature); (3) Multi-scale pattern stacking: For each variable, the trend pattern and seasonal pattern at K key scales are stacked to form the multi-scale trend feature and multi-scale seasonal feature of the variable; then these features of all variables are integrated to obtain the global multi-scale trend feature and multi-scale seasonal feature, which is convenient for subsequent unified processing by the network.
[0028] Step S104 in this embodiment is the dual-branch feature extraction step, which specifically includes: designing a dual-branch feature extraction network composed of a seasonal branch and a trend branch, performing feature learning on the obtained seasonal pattern and trend pattern respectively, and ensuring that the feature representations of the two patterns do not interfere with each other and fit their respective characteristics. The seasonal branch feature extraction is implemented based on grouped convolution, specifically including: (1) grouping the global multi-scale seasonal features according to the variable dimension, with each group corresponding to K scale features of a variable, ensuring that the multi-scale seasonal features of each variable can be processed independently; (2) configuring a dedicated convolution kernel for each group, and extracting the seasonal features of the group through grouped convolution operation; this structure can significantly reduce the model complexity, while avoiding the mutual confusion of frequency features of different variables; (3) integrating the seasonal features of all groups to obtain the global seasonal feature representation. The trend branch feature extraction is based on the fusion of trend and rate of change, specifically including: (1) First, apply 1D convolution to the global multi-scale trend features to extract local temporal features, and then smooth the convolutional features through the moving average operation to highlight long-term trend information. This result is used as a trend feature and can be used to identify long-term trend anomalies; (2) Calculate the difference between the trend features at adjacent time points to obtain the trend rate of change. This rate of change can effectively capture sudden changes in the signal and can be used to detect sudden point anomalies; (3) Perform nonlinear feature extraction on the trend features and the trend rate of change through two independent multilayer perceptron encoders, and then fuse the two extracted features and map them to a unified feature space to obtain a global trend feature representation.
[0029] As an optional implementation, step S104 of this embodiment, which extracts a global trend feature representation from multi-scale trend features, includes: applying 1D convolution to multi-scale trend features to extract local temporal features, and then smoothing the local temporal features extracted by 1D convolution using a moving average operation to serve as the trend features at each time point; calculating the difference between the trend features at adjacent time points to obtain the trend change rate; using two independent multilayer perceptrons (MLPs) as encoders to perform nonlinear feature extraction on the trend features and the trend change rate, and then fusing the two types of features extracted by the two MLPs to map them to a unified feature space to obtain a global trend feature representation.
[0030] As an optional implementation, step S104 of this embodiment, which extracts a global seasonal feature representation from multi-scale seasonal features, includes: grouping the multi-scale seasonal features according to the variable dimension, with each group corresponding to the seasonal features of a variable at K periodic scales; performing a group convolution operation on each group using a dedicated convolution kernel configured for each group to extract the group seasonal features; and integrating the group seasonal features of all groups to obtain a global seasonal feature representation.
[0031] Step S105 in this embodiment is a multi-scale fusion reconstruction step, which includes fusing the multi-scale features extracted by the dual branches based on the calculated frequency amplitude, and then completing the reconstruction through the decoder. The loss function is used to optimize the model to ensure that the model can accurately fit the normal data. The specific steps are as follows: (1) Based on the amplitude of the Top-K key frequency points of each variable, the weight of each scale is obtained through normalization. The larger the amplitude of the scale, the higher the corresponding weight. (2) Using these weights, the multi-scale seasonal features and multi-scale trend features of each variable are weighted and summed to obtain the fused seasonal features and fused trend features of each variable. (3) Finally, the fused features of all variables are integrated to obtain the global comprehensive feature representation. As an optional implementation, step S105 of this embodiment, which involves multi-scale fusion reconstruction of the global trend feature representation and the global seasonal feature representation to obtain fused features, includes: normalizing the amplitude of the first K frequency points and using them as weights under the K-period scale; weighting and summing the global trend feature representation and the global seasonal feature representation of each variable according to the weights under the K-period scale to obtain the fused seasonal feature and fused trend feature of each variable; and integrating the fused seasonal feature and fused trend feature of all variables to obtain the fused features.
[0032] Step S106 in this embodiment is a loss optimization step, which includes detecting the multivariate time series in the test phase after the model training is completed, and judging whether the time point is abnormal. Specifically, it is as follows: (1) The time series data in the test phase is processed by the forward propagation process mentioned above to obtain the reconstructed value of the original signal; (2) The error between the true value of the original signal and the reconstructed value is calculated, and the error is used as the abnormal score of the corresponding time point. The higher the score, the greater the degree of deviation of the time point from the normal mode, and the higher the probability of abnormality; (3) For each time point in the test phase, if its abnormal score exceeds the threshold, it is judged as abnormal; In addition, after judging that the corresponding time point is abnormal, this embodiment also includes judging the situation that the time point in the preset time window is abnormal. If any time point in a continuous abnormal segment in a time window is detected as abnormal, then the continuous abnormal segments in the entire time window are judged as abnormal, which can adapt to the characteristic that abnormalities usually occur continuously in actual scenarios. As an optional implementation, the loss function used in the training of the multivariate time series anomaly detection model in this embodiment is a weighted sum of three losses: seasonal pattern reconstruction loss, trend pattern reconstruction loss, and original signal reconstruction loss. The seasonal pattern reconstruction loss is the mean square error between the reconstructed value and the true value obtained by the decoder of the global seasonal feature representation; the trend pattern reconstruction loss is the mean square error between the reconstructed value and the true value obtained by the decoder of the global trend feature representation; and the original signal reconstruction loss is the mean square error between the reconstructed value and the true value obtained by the decoder of the fused features.
[0033] Figure 3 This is a schematic diagram of the training process of the multivariate time series anomaly detection model in this embodiment. First, the maximum number of rounds (i.e., the upper limit of the overall training rounds, controlling the training depth and avoiding overfitting or ineffective iterations) and the maximum batch size per round are clearly defined (controlling the sample batch size in a single training round, balancing computational resource consumption and training efficiency). In the iteration phase, the smallest batch of data is selected from the training dataset, and preprocessing operations such as standardization are performed to lay a solid foundation for subsequent analysis. Next, Fourier transform is used to convert the time-domain data to the frequency domain, filtering out key scales with energy at the Top-K level; these scales correspond to the core periodic components of the data. Subsequently, a frequency band mask is constructed around the selected Top-K frequencies, and filtering operations are performed on the frequency domain signal to separate multi-scale data patterns such as seasonal patterns and trend patterns. Then, a dual-path network is used to extract specific features for different patterns, preventing mutual interference between feature learning between patterns. Afterwards, weights are assigned to the features at each scale based on frequency amplitude, and after weighted fusion, the decoder performs multi-scale weighted reconstruction of the original signal, allowing the model to fit the normal data pattern as accurately as possible. Once reconstruction is complete, a multi-objective loss is calculated, consisting of "seasonal pattern reconstruction loss + trend pattern reconstruction loss + original signal reconstruction loss," to constrain the model's fitting quality from multiple dimensions. Based on the backpropagation algorithm and optimizer, the network weights are updated using the loss results, allowing the model to gradually learn the multi-scale and multi-modal characteristics of normal data. This process is repeated until the pre-set maximum number of epochs is reached, at which point the training process ends, and the final output is a detection model that can effectively identify anomalies (data performance deviating from the normal fitting pattern) in time series data.
[0034] After the model training is completed, the multivariate time series of the test phase is detected to determine whether the time point is abnormal. Specifically, as follows: (1) The time series data of the test phase is processed by the forward propagation process described above to obtain the reconstructed value of the original signal; (2) The error between the true value of the original signal and the reconstructed value is calculated, and the error is used as the abnormal score of the corresponding time point. The higher the score, the greater the degree of deviation from the normal mode at that time point and the higher the probability of abnormality; (3) For each time point in the test phase, if its abnormal score exceeds the threshold, it is determined to be abnormal; if a point in a continuous abnormal segment in a window is detected as abnormal, the entire continuous abnormal segment is determined to be abnormal, which is adapted to the characteristic of multiple continuous occurrences of abnormalities in actual scenarios. Specifically, this embodiment determines whether there is an abnormality at the corresponding time point based on the error between the reconstructed value and the true value of the corresponding time point, including: if the error between the reconstructed value and the true value of the corresponding time point exceeds the preset threshold, the corresponding time point is determined to be abnormal; if a point in a continuous abnormal segment is detected as abnormal, the entire continuous abnormal segment is determined to be abnormal.
[0035] To verify the effectiveness of the multivariate time series anomaly detection model (FreDoM) in this embodiment, six existing mainstream time series anomaly detection models (Timesnet, TranAD, AT, COUTA, Itrans, and M_TCN) were selected as baselines. The F1 score was used as the evaluation metric (the F1 score is the harmonic mean of precision and recall, which can provide a relatively balanced measure of model performance). The model was tested on the MSL, PSM, PUMP, SMAP, SMD, SWAT, ASD, and WADI datasets. The final results are shown in Figure 1.
[0036] Table 1: Comparative Experiment Results
[0037] The experimental results shown in Table 1 demonstrate that FreDoM achieves significant advantages over the baseline comparisons. Compared to the suboptimal multi-scale decomposition method, the Timesnet model, FreDoM achieves an average performance improvement of 1.925%. In the best case, the performance improvement can even reach 25.45%. These results clearly demonstrate that FreDoM achieves state-of-the-art anomaly detection performance by effectively decomposing the complex multi-scale and multi-modal characteristics of the original data. This advantage stems from its design, which adaptively decomposes multi-scale components for different variables and achieves fine-grained pattern separation. This design not only provides a feasible technical path for improving anomaly detection performance but also expands new avenues of thought for research in this field.
[0038] To verify the effectiveness of each component module of the multivariate time series anomaly detection model (FreDoM) in this embodiment, an ablation experiment was conducted by sequentially removing three loss functions (seasonal pattern reconstruction loss, trend pattern reconstruction loss, and original signal reconstruction loss), the multi-scale multi-mode decomposition module, and the adaptive fusion reconstruction module (step S105). The results are shown in Table 2.
[0039] Table 2: Ablation Experiment Results
[0040] In Table 2, "Original Data" represents the model after removing the "Original Signal Reconstruction Loss," "Trend" represents the model after removing the "Trend Pattern Reconstruction Loss," "Seasonal" represents the model after removing the "Seasonal Pattern Reconstruction Loss," "Decomposition" represents the model after removing the multi-scale multi-mode decomposition module, and "Hybrid Reconstruction" represents the model after removing the adaptive fusion reconstruction module (step S105). The experimental results shown in Table 2 indicate that removing the "Original Signal Reconstruction Loss" leads to an average performance decrease of 5.1%; removing the "Seasonal Pattern Reconstruction Loss" and "Trend Pattern Reconstruction Loss" results in performance decreases of 1.4% and 0.7%, respectively. This result demonstrates that these three losses have complementary effects when modeling different data patterns. After removing the multi-scale multi-mode decomposition module, the F1 score decreases by an average of 1.16%, with decreases of 2.33% and 1.90% on the ASD and WADI datasets, respectively. This further demonstrates the ability of the frequency domain decomposition of the multi-scale multi-mode decomposition module to decouple "multi-scale, multi-mode" data. Furthermore, removing the adaptive fusion reconstruction module (step S105) leads to a 0.88% decrease in the average F1 score, indicating that amplitude-based adaptive weighting can more accurately restore the contribution of different frequency components to the original signal. The above experimental results fully verify the effectiveness of each component module of the multivariate time series anomaly detection model in this embodiment.
[0041] To more intuitively demonstrate the ability of the multivariate time series anomaly detection model in this embodiment to decouple multi-scale and multi-mode features, a visualization experiment was designed in this embodiment. In these experiments, periodic, trend, and point anomalies were injected into the synthesized multi-scale and multi-mode data, and decomposition was performed with parameters K=3 and the width w=3 of the constructed frequency band mask when selecting the top K frequency points with the largest amplitude in step S102. Figure 4 This is a schematic diagram of the synthesized multi-scale multivariate time series in this embodiment, where (a) and (b) are two identical original signals, (c), (e), and (g) are periodic signals generated at different scales (scale 1 to scale 3) of the original data input, and (d), (f), and (h) are the corresponding trend signals generated at that scale. Figure 4 As can be seen, the frequency domain decomposition process of the multi-scale, multi-mode decomposition module of the multivariate time series anomaly detection model in this embodiment significantly enhances the visual saliency of anomaly patterns: periodic anomalies that were originally difficult to detect appear as significantly weakened amplitude intensity at scale 1, while periodic anomalies that were initially confined to the shaded area are significantly "stretched" (as shown by the arrows in the figure), thereby greatly improving their identifiability. Trend anomalies and point anomalies are also presented more clearly at scale 1, which provides strong evidence for the effectiveness of the frequency domain decomposition strategy of the multi-scale, multi-mode decomposition module of the multivariate time series anomaly detection model in this embodiment.
[0042] Furthermore, this embodiment also provides a multivariate time series anomaly detection system based on frequency domain decomposition, including a microprocessor and a memory interconnected thereon. The microprocessor is programmed or configured to execute the multivariate time series anomaly detection method based on frequency domain decomposition. This embodiment also provides a computer-readable storage medium storing a computer program or instructions programmed or configured to execute the multivariate time series anomaly detection method based on frequency domain decomposition via a processor. This embodiment also provides a computer program product including a computer program or instructions programmed or configured to execute the multivariate time series anomaly detection method based on frequency domain decomposition via a processor.
[0043] Those skilled in the art will understand that the technical solutions provided by this invention may take the form of a method, system, or computer program product. Therefore, this invention may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this invention may take the form of a computer program product embodied on one or more computer-readable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, produce an implementation of the flowchart... Figure 1 One or more processes and / or boxes Figure 1 The computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The functions specified in one or more boxes. These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable apparatus for implementing the process. Figure 1 One or more processes and / or boxes Figure 1The steps of the function specified in one or more boxes.
[0044] The above description is merely a preferred embodiment of the present invention. The scope of protection of the present invention is not limited to the above embodiments. All technical solutions falling within the scope of the present invention's concept are within the scope of protection of the present invention. It should be noted that for those skilled in the art, any improvements and modifications made without departing from the principles of the present invention should also be considered within the scope of protection of the present invention.
Claims
1. A method for detecting anomalies in multivariate time series based on frequency domain decomposition, characterized in that, The process includes the following steps: using a multivariate time series anomaly detection model to obtain reconstructed values for corresponding time points from the multivariate time series data; calculating the error between the reconstructed values and the true values at the corresponding time points; and determining that an anomaly exists at the corresponding time point if the error exceeds a preset threshold. The multivariate time series anomaly detection model obtains the reconstructed values for the corresponding time points by: S101, divides the multivariate time series into overlapping window series; S102, for each variable in the window sequence, convert the time domain signal into a frequency domain signal through Fourier transform, calculate the amplitude of each frequency point in the frequency domain signal and select the top K frequency points with the largest amplitude to obtain the corresponding period scale; define a continuous frequency band around the K frequency points as the key frequency band and construct the frequency band mask. S103, for each variable in the window sequence, the frequency domain signal and the frequency band mask of K frequency points are processed to filter out the signal of the key frequency band, and the signal is converted back to the time domain by inverse Fourier transform to obtain the trend pattern signal at K period scales. The trend pattern signal at K period scales is stacked to obtain the multi-scale trend feature. The trend pattern signal at K period scales is subtracted from the original time domain signal to obtain the seasonal pattern signal at K period scales. The seasonal feature at K period scales is stacked to obtain the multi-scale seasonal feature. S104 extracts global trend feature representation from multi-scale trend features and extracts global seasonal feature representation from multi-scale seasonal features; S105, the global trend feature representation and the global seasonal feature representation are fused and reconstructed at multiple scales to obtain the fused feature; S106, the fused features are decoded using a decoder to obtain the reconstructed values at the corresponding time points.
2. The multivariate time series anomaly detection method based on frequency domain decomposition according to claim 1, characterized in that, In step S102, when defining a continuous frequency band around K frequency points and constructing a frequency band mask, the bandwidth of the continuous frequency band defined for each frequency point is determined based on a preset hyperparameter, which is determined during the training phase of the multivariate time series anomaly detection model.
3. The multivariate time series anomaly detection method based on frequency domain decomposition according to claim 1, characterized in that, Step S104, which involves extracting a global trend feature representation from multi-scale trend features, includes: applying 1D convolution to extract local temporal features from the multi-scale trend features; smoothing the local temporal features extracted by 1D convolution using a moving average operation to serve as the trend features at each time point; calculating the difference between the trend features at adjacent time points to obtain the trend change rate; extracting nonlinear features from the trend features and trend change rate using two independent multilayer perceptrons (MLPs) as encoders; and then fusing the two types of features extracted by the two MLPs to map them to a unified feature space to obtain a global trend feature representation.
4. The multivariate time series anomaly detection method based on frequency domain decomposition according to claim 1, characterized in that, Step S104, which extracts the global seasonal feature representation from the multi-scale seasonal features, includes: grouping the multi-scale seasonal features according to the variable dimension, with each group corresponding to the seasonal features of a variable at K periodic scales; performing group convolution operations on the groups using dedicated convolution kernels configured for each group to extract the group seasonal features; and integrating the group seasonal features of all groups to obtain the global seasonal feature representation.
5. The multivariate time series anomaly detection method based on frequency domain decomposition according to claim 1, characterized in that, Step S105 involves multi-scale fusion reconstruction of the global trend feature representation and the global seasonal feature representation to obtain fused features. This includes: normalizing the amplitude of the first K frequency points and using them as weights under the K-period scale; weighting and summing the global trend feature representation and the global seasonal feature representation of each variable according to the weights under the K-period scale to obtain the fused seasonal feature and fused trend feature of each variable; and integrating the fused seasonal feature and fused trend feature of all variables to obtain the fused features.
6. The multivariate time series anomaly detection method based on frequency domain decomposition according to claim 1, characterized in that, During training, the multivariate time series anomaly detection model uses a loss function that is a weighted sum of three losses: seasonal pattern reconstruction loss, trend pattern reconstruction loss, and original signal reconstruction loss. The seasonal pattern reconstruction loss is the mean square error between the reconstructed value and the true value obtained by the decoder of the global seasonal feature representation; the trend pattern reconstruction loss is the mean square error between the reconstructed value and the true value obtained by the decoder of the global trend feature representation; and the original signal reconstruction loss is the mean square error between the reconstructed value and the true value obtained by the decoder of the fused features.
7. The multivariate time series anomaly detection method based on frequency domain decomposition according to claim 1, characterized in that, After determining that there is an anomaly at the corresponding time point, the method further includes determining that there is an anomaly at a time point within a preset time window. If any time point in a series of consecutive anomaly segments within a time window is detected as an anomaly, then the entire series of consecutive anomaly segments within the time window are determined to be anomalies.
8. A multivariate time series anomaly detection system based on frequency domain decomposition, comprising a microprocessor and a memory interconnected, characterized in that, The microprocessor is programmed or configured to execute the multivariate time series anomaly detection method based on frequency domain decomposition as described in any one of claims 1 to 7.
9. A computer-readable storage medium storing a computer program or instructions, characterized in that, The computer program or instructions are programmed or configured to execute the multivariate time series anomaly detection method based on frequency domain decomposition as described in any one of claims 1 to 7 via a processor.
10. A computer program product, comprising a computer program or instructions, characterized in that, The computer program or instructions are programmed or configured to execute the multivariate time series anomaly detection method based on frequency domain decomposition as described in any one of claims 1 to 7 via a processor.