Time series data anomaly detection method and device, electronic equipment and storage medium

Abstract

The embodiment of the invention provides a time series data anomaly detection method and device, electronic equipment and a storage medium. The time series data anomaly detection method comprises the steps that historical time series data and an original model are acquired; performing comparative learning training on the original model based on the historical time sequence data to obtain an initial anomaly detection model; performing supervised learning training on the initial anomaly detection model based on the historical time sequence data to obtain a target anomaly detection model; and under the condition that to-be-identified time series data is received, performing anomaly detection on the to-be-identified time series data based on the target anomaly detection model, and determining anomaly information. Through the embodiment of the invention, the accuracy of anomaly detection can be improved.

Description

Technical Field

[0001] This invention relates to the field of time-series data processing technology, and in particular to a time-series data anomaly detection method, a time-series data anomaly detection device, an electronic device, and a storage medium. Background Technology

[0002] In related technologies, time series anomaly detection often suffers from a large amount of unlabeled data, while labeled anomaly samples are scarce, resulting in insufficient accuracy of deep time series anomaly detection methods when anomaly samples are scarce. Summary of the Invention

[0003] In view of the above problems, embodiments of the present invention are proposed to provide a time-series data anomaly detection method, a time-series data anomaly detection device, an electronic device, and a storage medium to overcome or at least partially solve the above problems.

[0004] To address the aforementioned problems, in a first aspect, an embodiment of the present invention discloses a method for detecting anomalies in time-series data, comprising: Acquire historical time series data and the original model; The original model is trained by comparative learning based on the historical time series data to obtain an initial anomaly detection model. The initial anomaly detection model is trained using supervised learning based on the historical time series data to obtain the target anomaly detection model. Upon receiving the time series data to be identified, anomaly detection is performed on the time series data based on the target anomaly detection model to determine the anomaly information.

[0005] Optionally, the step of performing comparative learning training on the original model based on the historical time series data to obtain an initial anomaly detection model includes: Extract several augmented sample data from the historical time series data; In the case where the enhanced sample data is the same segment being enhanced, the enhanced sample data is determined as positive sample data; In the case where the enhanced sample data is not from the same segment, the enhanced sample data is identified as negative sample data; The original model is trained by comparison using the negative sample data and the positive sample data until the preset model convergence condition is reached, thereby determining the initial anomaly detection model.

[0006] Optionally, the loss function of the initial anomaly detection model is:

[0007] in, , These are two positive samples after augmentation of the same segment; N is the number of samples in the augmented sample data. express and Cosine similarity between ; This is a preset temperature function; This represents the loss value per instance.

[0008] Optionally, the loss value of the initial anomaly detection model is the average of the single loss value over the positive sample data.

[0009] Optionally, the step of supervising the training of the initial anomaly detection model based on the historical time series data to obtain the target anomaly detection model includes: The historical time series data is labeled to identify normal and abnormal sample data. The initial anomaly detection model is trained using supervised learning based on the normal sample data and the abnormal sample data to obtain the target anomaly detection model.

[0010] Optionally, the step of supervising the training of the initial anomaly detection model based on the normal sample data and the abnormal sample data to obtain the target anomaly detection model includes: The initial anomaly detection model is trained using weakly supervised learning based on the normal sample data and the abnormal sample data to obtain the target anomaly detection model.

[0011] Optionally, the step of performing weakly supervised learning training on the initial anomaly detection model based on the normal sample data and the abnormal sample data to obtain the target anomaly detection model includes: Enhance the abnormal sample data; The initial anomaly detection model is trained using weakly supervised learning based on the normal sample data and the enhanced abnormal sample data to obtain the target anomaly detection model.

[0012] Optionally, the step of augmenting the abnormal sample data includes: Construct a variable sliding window; The abnormal sample data is enhanced based on the variable sliding window.

[0013] Optionally, the loss function of the target anomaly detection model is the cross-entropy loss function.

[0014] Optionally, the cross-entropy loss function is:

[0015] Where L is the cross-entropy and y is the sample label. This represents the probability of anomaly prediction.

[0016] Optionally, the number of normal sample data and the number of abnormal sample data are the same.

[0017] Optionally, the original model is a multi-head self-attention mechanism deep learning model.

[0018] In a second aspect, embodiments of the present invention disclose a time-series data anomaly detection device, comprising: The acquisition module is used to acquire historical time series data and the original model; The first training module is used to perform comparative learning training on the original model based on the historical time series data to obtain an initial anomaly detection model. The second training module is used to perform supervised learning training on the initial anomaly detection model based on the historical time series data to obtain the target anomaly detection model. The detection module is used to detect anomalies in the time series data to be identified based on the target anomaly detection model when the time series data to be identified is received, and to determine the anomaly information.

[0019] In a third aspect, an embodiment of the present invention discloses an electronic device, including a processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein the computer program, when executed by the processor, implements the steps of the timing data anomaly detection method as described above.

[0020] In a fourth aspect, embodiments of the present invention disclose a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the time-series data anomaly detection method as described above.

[0021] The embodiments of the present invention have the following advantages: This invention employs historical time-series data and an original model; it then trains the original model using comparative learning based on the historical time-series data to obtain an initial anomaly detection model; finally, it trains the initial anomaly detection model using supervised learning based on the historical time-series data to obtain a target anomaly detection model; upon receiving time-series data to be identified, it performs anomaly detection on the time-series data based on the target anomaly detection model to determine the anomaly information. By training the original model using comparative learning, the initial anomaly detection model can more accurately identify the time-series data to be identified, improving its feature extraction capability. Furthermore, by using supervised learning to train the initial anomaly detection model, the target anomaly detection model can achieve good anomaly detection performance even with only a small amount of anomaly data. Using the target anomaly detection model to identify the time-series data to be identified can improve the accuracy of detection. Attached Figure Description

[0022] Figure 1 This is a flowchart illustrating the steps of an embodiment of the time-series data anomaly detection method of the present invention; Figure 2 This is a flowchart illustrating the steps of another embodiment of the time-series data anomaly detection method of the present invention; Figure 3 This is a schematic diagram of an initial anomaly detection model architecture according to the present invention; Figure 4 This is a schematic diagram of a weakly supervised learning method according to the present invention; Figure 5 This is a flowchart illustrating the steps of an example of a time-series data anomaly detection method according to the present invention; Figure 6 This is a structural block diagram of an embodiment of a time-series data anomaly detection device according to the present invention; Figure 7 This is a structural block diagram of an electronic device provided in an embodiment of the present invention; Figure 8 This is a structural block diagram of a storage medium provided in an embodiment of the present invention. Detailed Implementation

[0023] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0024] Methods for time series anomaly detection can be broadly categorized into traditional statistical methods, machine learning algorithms, and deep learning algorithms. Traditional statistical methods often establish a mathematical model, identifying samples deemed low-probability as outliers, such as parameter estimation in a normal distribution model. These models offer advantages like strong interpretability and high efficiency, but struggle with complex data structures and are heavily reliant on data assumptions. Machine learning algorithms first extract features from the data and then classify the samples using classification algorithms; common machine learning algorithms include Isolation Forest and SVM (Support Vector Machine). However, machine learning algorithms offer limited nonlinear capabilities compared to deep learning algorithms and struggle to extract complex, high-dimensional features. Deep learning methods have become increasingly popular in recent years, offering powerful nonlinear capabilities, strong feature extraction capabilities, and low reliance on pre-existing assumptions. However, they often suffer from high requirements for data accuracy and volume, as well as high computational demands, leading to insufficient accuracy in deep time series anomaly detection methods due to the scarcity of outlier samples. To at least partially address these technical problems, this invention proposes embodiments.

[0025] Reference Figure 1 The diagram illustrates a flowchart of an embodiment of a time-series data anomaly detection method according to the present invention. The time-series data anomaly detection method may specifically include the following steps: Step 101: Obtain historical time series data and the original model; Historical time-series data can be obtained as training samples. Historical time-series data refers to the time series data used for training. A time series is a data sequence formed over time by continuously observing one or more attribute values. Historical time-series data can include multivariate time series. Alternatively, the model file of the original model can also be obtained.

[0026] Step 102: Based on the historical time series data, perform comparative learning training on the original model to obtain an initial anomaly detection model; Historical time series data can be used to train the original model through comparative learning. By constructing similar and dissimilar samples from the historical time series data, the learning data of the original model can be effectively represented by features. This makes similar samples close in the feature space and dissimilar samples far apart, thereby continuously identifying effective time series in the historical time series data without the need for manual labeling, thus improving the feature extraction capability.

[0027] Step 103: Based on the historical time series data, supervised learning training is performed on the initial anomaly detection model to obtain the target anomaly detection model; Historical time-series data can be reused to train the initial anomaly detection model through supervised learning, resulting in a target anomaly detection model. This target anomaly detection model can then split the time series data. The target anomaly detection model can identify and determine the probability of anomalies in the time-series data, and based on this probability, determine whether the time-series data is abnormal.

[0028] Step 104: Upon receiving the time series data to be identified, perform anomaly detection on the time series data to be identified based on the target anomaly detection model to determine the anomaly information.

[0029] Upon receiving time series data to be identified, this data can be used as input to the target anomaly detection model. The model then identifies the anomaly and determines the anomaly information. This anomaly information is used to record the time series data containing the anomaly.

[0030] This invention employs historical time-series data and an original model; it then trains the original model using comparative learning based on the historical time-series data to obtain an initial anomaly detection model; finally, it trains the initial anomaly detection model using supervised learning based on the historical time-series data to obtain a target anomaly detection model; upon receiving time-series data to be identified, it performs anomaly detection on the time-series data based on the target anomaly detection model to determine the anomaly information. By training the original model using comparative learning, the initial anomaly detection model can more accurately identify the time-series data to be identified, improving its feature extraction capability. Furthermore, by using supervised learning to train the initial anomaly detection model, the target anomaly detection model can achieve good anomaly detection performance even with only a small amount of anomaly data. Using the target anomaly detection model to identify the time-series data to be identified can improve the accuracy of detection.

[0031] Reference Figure 2 The diagram illustrates a flowchart of another embodiment of the time-series data anomaly detection method of the present invention. The time-series data anomaly detection method may specifically include the following steps: Step 201: Obtain historical time series data and the original model; Historical time series data and the corresponding model files of the original model can be obtained from the preset storage space. The historical time series data can be historical multivariate time series data.

[0032] In an optional embodiment of the present invention, the original model is a multi-head self-attention mechanism deep learning model. That is, a multi-head self-attention mechanism deep learning model can be used as the initial model for training. The multi-head self-attention mechanism deep learning model is a neural network model based on the Transformer architecture. The Transformer architecture consists of an encoder and a decoder. The encoder is responsible for understanding the input sequence and is composed of multiple identical encoder layers stacked together. Each encoder layer contains two main sub-layers: a multi-head self-attention mechanism layer and a fully connected feedforward neural network layer. Residual connections and layer normalization are used between each sub-layer. The decoder generates the target sequence based on the encoder's output and is also composed of multiple identical decoder layers stacked together. Each decoder layer contains three main sub-layers: a masked self-attention layer, an encoder-decoder attention layer, and a fully connected feedforward neural network layer. The decoder also uses a masked self-attention mechanism to ensure that each position only considers all positions preceding it, preserving autoregressive properties.

[0033] Step 202: Extract several augmented sample data from the historical time series data; Multiple augmented sample data can be extracted from historical time series data; these are called augmented sample data. Augmented sample data are sample data formed by augmenting the original sample data in historical time series data.

[0034] Step 203: If the enhanced sample data is the same segment being enhanced, then the enhanced sample data is determined as positive sample data; It is possible to determine whether the augmented sample data is based on the original sample data of the same segment. If the augmented sample data is based on the same segment, that is, the two augmented samples being compared are similar, the two augmented sample data being compared can be identified as positive sample data.

[0035] Step 204: If the enhanced sample data is not the same segment, the enhanced sample data is determined as negative sample data. Based on the same comparison method, if the enhanced sample data are not the same segment enhanced, that is, the two enhanced samples being compared are not similar, the two enhanced sample data being compared can be identified as negative sample data.

[0036] Step 205: Based on the negative sample data and the positive sample data, perform comparative learning training on the original model until the preset model convergence condition is reached, and determine the initial anomaly detection model; The original model is then trained using both negative and positive sample data for comparative learning. After each training round, it is determined whether the preset model convergence condition is met. If the model convergence condition is met, the currently trained original model is determined as the initial anomaly detection model. The preset model convergence condition can be determined according to requirements, such as reaching a certain number of training iterations, or the model's loss value being less than a specified loss value. This embodiment of the invention does not limit this.

[0037] In practical applications, the loss function of the initial anomaly detection model is:

[0038] in, , These are two positive samples after augmentation of the same segment; N is the number of samples in the augmented sample data. express and Cosine similarity between ; This is a preset temperature function; This represents the loss value per instance.

[0039] The numerical values ​​obtained from each training round can be extracted and substituted into the loss function of the initial anomaly detection model to determine the current loss value.

[0040] Furthermore, the loss value of the initial anomaly detection model is the average of the single loss value over the positive sample data.

[0041] In practical applications, the average value of the positive sample data in a single loss test can be used as the initial loss value for the anomaly detection model. For example:

[0042] in, is the initial loss value of the anomaly detection model, l is the single loss value, and N is the number of samples.

[0043] The relevant model parameters can be substituted into the model to determine the loss value of the initial anomaly detection model.

[0044] For the initial anomaly detection model architecture, i.e., reference Figure 3 The main model consists of a Transformer Encoder. There's no need to distinguish between normal and abnormal samples. Sample segments are augmented and then input into the model. Samples augmented from the same segment are considered positive samples, while samples augmented from different segments are considered negative samples. Comparative learning is then performed until the model converges.

[0045] Step 206: Label the historical time series data to identify normal and abnormal sample data; After obtaining the initial anomaly detection model, it can be fine-tuned. Data annotation can be performed on samples in historical time series data to divide the samples into normal sample data and abnormal sample data.

[0046] Furthermore, the number of normal sample data and the number of abnormal sample data are the same. That is, each batch of sample data contains the same number of normal samples and abnormal samples. Using the same amount of normal samples and abnormal samples can prevent model bias, thereby further improving the accuracy of the model.

[0047] Step 207: Based on the normal sample data and the abnormal sample data, supervised learning training is performed on the initial anomaly detection model to obtain the target anomaly detection model; The initial anomaly detection model can be trained using both normal and abnormal sample data through supervised learning. The target anomaly detection model can then be obtained through classification training using the same data. The input to the target anomaly detection model is time-series data, and the output is the time-series data containing the anomalies.

[0048] In an optional embodiment of the present invention, the step of performing supervised learning training on the initial anomaly detection model based on the normal sample data and the abnormal sample data to obtain the target anomaly detection model includes: performing weakly supervised learning training on the initial anomaly detection model based on the normal sample data and the abnormal sample data to obtain the target anomaly detection model.

[0049] Weakly supervised learning can be used to train the initial anomaly detection model using both normal and abnormal sample data, so that even when the proportion of abnormal sample data is small, the target anomaly detection model can still achieve more accurate recognition capabilities.

[0050] In an optional embodiment of the present invention, the step of performing weakly supervised learning training on the initial anomaly detection model based on the normal sample data and the abnormal sample data to obtain the target anomaly detection model includes: Sub-step S2071: Enhance the abnormal sample data; Data augmentation can be performed on anomalous sample data. Normal sample data does not require processing.

[0051] Specifically, the step of enhancing the abnormal sample data includes: constructing a variable sliding window; and enhancing the abnormal sample data based on the variable sliding window.

[0052] For anomalous sample augmentation, a variable sliding window can be constructed based on the requirements. This window is then used to truncate the anomalous sample data, dividing it into multiple segments, thereby augmenting the data. For example, for a sample of length... Abnormal samples The minimum segment length is ,and The length can be used from arrive The sliding window can capture up to [number] segments. , …., common A fragment.

[0053] Sub-step S2072: Based on the normal sample data and the enhanced abnormal sample data, perform weakly supervised learning training on the initial anomaly detection model to obtain the target anomaly detection model.

[0054] The initial anomaly detection model can be trained using both normal sample data and enhanced abnormal sample data through weakly supervised learning. Training can be completed using only a small amount of abnormal sample data to obtain the target anomaly detection model.

[0055] For example, the process of weakly supervised learning can be referenced. Figure 4 A MLP module is added after the Transformer Encoder for classification, and the model is trained using a weakly supervised training method. Normal samples are not augmented, while abnormal samples are augmented using a variable sliding window method. After training, the model can be input into the sample to be detected to obtain the detection results.

[0056] Furthermore, the loss function of the target anomaly detection model is the cross-entropy loss function. The cross-entropy loss function is used as the loss function of the target anomaly detection model to measure the difference in probability distributions.

[0057] Specifically, the cross-entropy loss function is:

[0058] Where L is the cross-entropy and y is the sample label. This represents the probability of anomaly prediction.

[0059] The cross-entropy of the target anomaly detection model can be determined by substituting the sample labels from the sample annotations and the anomaly prediction probabilities output by the target anomaly detection model after each round of training into the above formula.

[0060] Step 208: Upon receiving the time series data to be identified, perform anomaly detection on the time series data to be identified based on the target anomaly detection model to determine the anomaly information.

[0061] When identification is required, i.e. when time series data to be identified is received, a target anomaly detection model can be used to identify the time series data to be identified, determine the probability of an anomaly, and then determine the anomaly information based on the probability of an anomaly.

[0062] This invention, in its embodiments, acquires historical time-series data and an original model; extracts several augmented sample data from the historical time-series data; when the augmented sample data is from the same segment, it is identified as positive sample data; when the augmented sample data is from different segments, it is identified as negative sample data; the original model is trained through comparative learning based on the negative and positive sample data until a preset model convergence condition is reached, thus determining an initial anomaly detection model; the historical time-series data is labeled to identify normal and abnormal sample data; the initial anomaly detection model is trained through supervised learning based on the normal and abnormal sample data to obtain a target anomaly detection model; upon receiving time-series data to be identified, anomaly detection is performed on the time-series data to be identified based on the target anomaly detection model to determine anomaly information. By training the original model through comparative learning, the initial anomaly detection model can more accurately identify the time-series data to be identified, improving the feature extraction capability of the initial anomaly detection model; and by using supervised learning to train the initial anomaly detection model, even with only a small amount of anomaly data, the target anomaly detection model can achieve good anomaly detection performance. Using a target anomaly detection model to identify the time series data to be identified can improve the accuracy of detection.

[0063] To enable those skilled in the art to clearly understand the implementation process of this invention, an example is provided below: (Refer to...) Figure 5 We acquire multivariate time series data, construct a contrastive learning model, train the model to obtain an encoder, add a classification module, and perform weakly supervised training by inputting the data to be detected into the model for classification.

[0064] It should be noted that, for the sake of simplicity, the method embodiments are all described as a series of actions. However, those skilled in the art should understand that the embodiments of the present invention are not limited to the described order of actions, because according to the embodiments of the present invention, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions involved are not necessarily essential to the embodiments of the present invention.

[0065] Reference Figure 6 The diagram illustrates a structural block diagram of an embodiment of a time-series data anomaly detection device according to the present invention. The time-series data anomaly detection device may specifically include the following modules: Module 601 is used to acquire historical time series data and the original model; The first training module 602 is used to perform comparative learning training on the original model based on the historical time series data to obtain an initial anomaly detection model. The second training module 603 is used to perform supervised learning training on the initial anomaly detection model based on the historical time series data to obtain the target anomaly detection model. The detection module 604 is used to detect anomalies in the time series data to be identified based on the target anomaly detection model when the time series data to be identified is received, and to determine the anomaly information.

[0066] In an optional embodiment of the present invention, the first training module 602 includes: The extraction submodule is used to extract several augmented sample data from the historical time series data; The first enhancement submodule is used to determine the enhanced sample data as positive sample data when the enhanced sample data is the same segment enhanced; The second enhancement submodule is used to determine the enhanced sample data as negative sample data when the enhanced sample data is not the same segment enhancement; The first training submodule is used to perform comparative learning training on the original model based on the negative sample data and the positive sample data until the preset model convergence condition is reached, and to determine the initial anomaly detection model.

[0067] In an optional embodiment of the present invention, the loss function of the initial anomaly detection model is:

[0068] in, , These are two positive samples after augmentation of the same segment; N is the number of samples in the augmented sample data. express and Cosine similarity between ; This is a preset temperature function; This represents the loss value per instance.

[0069] In an optional embodiment of the present invention, the loss value of the initial anomaly detection model is the average value of the single loss value over the positive sample data.

[0070] In an optional embodiment of the present invention, the second training module 603 includes: The annotation submodule is used to annotate the historical time series data and identify normal and abnormal sample data. The second training submodule is used to perform supervised learning training on the initial anomaly detection model based on the normal sample data and the abnormal sample data to obtain the target anomaly detection model.

[0071] In an optional embodiment of the present invention, the second training submodule includes: The weakly supervised learning unit is used to perform weakly supervised learning training on the initial anomaly detection model based on the normal sample data and the abnormal sample data to obtain the target anomaly detection model.

[0072] In an optional embodiment of the present invention, the weakly supervised learning unit includes: The third enhancement subunit is used to enhance the abnormal sample data; The weakly supervised learning subunit is used to perform weakly supervised learning training on the initial anomaly detection model based on the normal sample data and the enhanced abnormal sample data to obtain the target anomaly detection model.

[0073] In an optional embodiment of the present invention, the third enhancement subunit includes: Construct sub-units to build variable sliding windows; The fourth enhancement subunit is used to enhance the abnormal sample data based on the variable sliding window.

[0074] In an optional embodiment of the present invention, the loss function of the target anomaly detection model adopts the cross-entropy loss function.

[0075] In an optional embodiment of the present invention, the cross-entropy loss function is:

[0076] Where L is the cross-entropy and y is the sample label. This represents the probability of anomaly prediction.

[0077] In an optional embodiment of the present invention, the number of normal sample data and the number of abnormal sample data are the same.

[0078] In an optional embodiment of the present invention, the original model is a multi-head self-attention mechanism deep learning model.

[0079] This invention employs historical time-series data and an original model; it then trains the original model using comparative learning based on the historical time-series data to obtain an initial anomaly detection model; finally, it trains the initial anomaly detection model using supervised learning based on the historical time-series data to obtain a target anomaly detection model; upon receiving time-series data to be identified, it performs anomaly detection on the time-series data based on the target anomaly detection model to determine the anomaly information. By training the original model using comparative learning, the initial anomaly detection model can more accurately identify the time-series data to be identified, improving its feature extraction capability. Furthermore, by using supervised learning to train the initial anomaly detection model, the target anomaly detection model can achieve good anomaly detection performance even with only a small amount of anomaly data. Using the target anomaly detection model to identify the time-series data to be identified can improve the accuracy of detection.

[0080] As the device embodiment is basically similar to the method embodiment, the description is relatively simple, and relevant parts can be found in the description of the method embodiment.

[0081] Reference Figure 7 The present invention also provides an electronic device, comprising: A processor 701 and a memory 702 are provided. The memory 702 stores a computer program executable by the processor 701. When the electronic device is controlled to run, the processor 701 executes the computer program to implement the timing data anomaly detection method as described in any embodiment of the present invention. The timing data anomaly detection method includes: Acquire historical time series data and the original model; The original model is trained by comparative learning based on the historical time series data to obtain an initial anomaly detection model. The initial anomaly detection model is trained using supervised learning based on the historical time series data to obtain the target anomaly detection model. Upon receiving the time series data to be identified, anomaly detection is performed on the time series data based on the target anomaly detection model to determine the anomaly information.

[0082] Optionally, the step of performing comparative learning training on the original model based on the historical time series data to obtain an initial anomaly detection model includes: Extract several augmented sample data from the historical time series data; In the case where the enhanced sample data is the same segment being enhanced, the enhanced sample data is determined as positive sample data; In the case where the enhanced sample data is not from the same segment, the enhanced sample data is identified as negative sample data; The original model is trained by comparison using the negative sample data and the positive sample data until the preset model convergence condition is reached, thereby determining the initial anomaly detection model.

[0083] Optionally, the loss function of the initial anomaly detection model is:

[0084] in, , These are two positive samples after augmentation of the same segment; N is the number of samples in the augmented sample data. express and Cosine similarity between ; This is a preset temperature function; This represents the loss value per instance.

[0085] Optionally, the loss value of the initial anomaly detection model is the average of the single loss value over the positive sample data.

[0086] Optionally, the step of supervising the training of the initial anomaly detection model based on the historical time series data to obtain the target anomaly detection model includes: The historical time series data is labeled to identify normal and abnormal sample data. The initial anomaly detection model is trained using supervised learning based on the normal sample data and the abnormal sample data to obtain the target anomaly detection model.

[0087] Optionally, the step of supervising the training of the initial anomaly detection model based on the normal sample data and the abnormal sample data to obtain the target anomaly detection model includes: The initial anomaly detection model is trained using weakly supervised learning based on the normal sample data and the abnormal sample data to obtain the target anomaly detection model.

[0088] Optionally, the step of performing weakly supervised learning training on the initial anomaly detection model based on the normal sample data and the abnormal sample data to obtain the target anomaly detection model includes: Enhance the abnormal sample data; The initial anomaly detection model is trained using weakly supervised learning based on the normal sample data and the enhanced abnormal sample data to obtain the target anomaly detection model.

[0089] Optionally, the step of augmenting the abnormal sample data includes: Construct a variable sliding window; The abnormal sample data is enhanced based on the variable sliding window.

[0090] Optionally, the loss function of the target anomaly detection model is the cross-entropy loss function.

[0091] Optionally, the cross-entropy loss function is:

[0092] Where L is the cross-entropy and y is the sample label. This represents the probability of anomaly prediction.

[0093] Optionally, the number of normal sample data and the number of abnormal sample data are the same.

[0094] Optionally, the original model is a multi-head self-attention mechanism deep learning model.

[0095] This invention employs historical time-series data and an original model; it then trains the original model using comparative learning based on the historical time-series data to obtain an initial anomaly detection model; finally, it trains the initial anomaly detection model using supervised learning based on the historical time-series data to obtain a target anomaly detection model; upon receiving time-series data to be identified, it performs anomaly detection on the time-series data based on the target anomaly detection model to determine the anomaly information. By training the original model using comparative learning, the initial anomaly detection model can more accurately identify the time-series data to be identified, improving its feature extraction capability. Furthermore, by using supervised learning to train the initial anomaly detection model, the target anomaly detection model can achieve good anomaly detection performance even with only a small amount of anomaly data. Using the target anomaly detection model to identify the time-series data to be identified can improve the accuracy of detection.

[0096] The memory may include random access memory (RAM) or non-volatile memory, such as at least one disk storage device. Optionally, the memory may also be at least one storage device located remotely from the aforementioned processor.

[0097] The processors mentioned above can be general-purpose processors, including central processing units (CPUs), network processors (NPs), etc.; they can also be digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0098] Reference Figure 8 This invention also provides a computer-readable storage medium 801, on which a computer program is stored. When a processor executes the computer program, it performs the timing data anomaly detection method as described in any one of the embodiments of this invention. The timing data anomaly detection method includes: Acquire historical time series data and the original model; The original model is trained by comparative learning based on the historical time series data to obtain an initial anomaly detection model. The initial anomaly detection model is trained using supervised learning based on the historical time series data to obtain the target anomaly detection model. Upon receiving the time series data to be identified, anomaly detection is performed on the time series data based on the target anomaly detection model to determine the anomaly information.

[0099] Optionally, the step of performing comparative learning training on the original model based on the historical time series data to obtain an initial anomaly detection model includes: Extract several augmented sample data from the historical time series data; In the case where the enhanced sample data is the same segment being enhanced, the enhanced sample data is determined as positive sample data; In the case where the enhanced sample data is not from the same segment, the enhanced sample data is identified as negative sample data; The original model is trained by comparison using the negative sample data and the positive sample data until the preset model convergence condition is reached, thereby determining the initial anomaly detection model.

[0100] Optionally, the loss function of the initial anomaly detection model is:

[0101] in, , These are two positive samples after augmentation of the same segment; N is the number of samples in the augmented sample data. express and Cosine similarity between ; This is a preset temperature function; This represents the loss value per instance.

[0102] Optionally, the loss value of the initial anomaly detection model is the average of the single loss value over the positive sample data.

[0103] Optionally, the step of supervising the training of the initial anomaly detection model based on the historical time series data to obtain the target anomaly detection model includes: The historical time series data is labeled to identify normal and abnormal sample data. The initial anomaly detection model is trained using supervised learning based on the normal sample data and the abnormal sample data to obtain the target anomaly detection model.

[0104] Optionally, the step of supervising the training of the initial anomaly detection model based on the normal sample data and the abnormal sample data to obtain the target anomaly detection model includes: The initial anomaly detection model is trained using weakly supervised learning based on the normal sample data and the abnormal sample data to obtain the target anomaly detection model.

[0105] Optionally, the step of performing weakly supervised learning training on the initial anomaly detection model based on the normal sample data and the abnormal sample data to obtain the target anomaly detection model includes: Enhance the abnormal sample data; The initial anomaly detection model is trained using weakly supervised learning based on the normal sample data and the enhanced abnormal sample data to obtain the target anomaly detection model.

[0106] Optionally, the step of augmenting the abnormal sample data includes: Construct a variable sliding window; The abnormal sample data is enhanced based on the variable sliding window.

[0107] Optionally, the loss function of the target anomaly detection model is the cross-entropy loss function.

[0108] Optionally, the cross-entropy loss function is:

[0109] Where L is the cross-entropy and y is the sample label. This represents the probability of anomaly prediction.

[0110] Optionally, the number of normal sample data and the number of abnormal sample data are the same.

[0111] Optionally, the original model is a multi-head self-attention mechanism deep learning model.

[0112] This invention employs historical time-series data and an original model; it then trains the original model using comparative learning based on the historical time-series data to obtain an initial anomaly detection model; finally, it trains the initial anomaly detection model using supervised learning based on the historical time-series data to obtain a target anomaly detection model; upon receiving time-series data to be identified, it performs anomaly detection on the time-series data based on the target anomaly detection model to determine the anomaly information. By training the original model using comparative learning, the initial anomaly detection model can more accurately identify the time-series data to be identified, improving its feature extraction capability. Furthermore, by using supervised learning to train the initial anomaly detection model, the target anomaly detection model can achieve good anomaly detection performance even with only a small amount of anomaly data. Using the target anomaly detection model to identify the time-series data to be identified can improve the accuracy of detection.

[0113] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.

[0114] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, apparatus, or computer program products. Therefore, embodiments of the present invention can take the form of entirely hardware embodiments, entirely software embodiments, or embodiments combining software and hardware aspects. Furthermore, embodiments of the present invention can take the form of computer program products implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0115] Embodiments of the present invention are described with reference to flowchart illustrations and / or block diagrams of methods, terminal devices (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing terminal device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing terminal device, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0116] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing terminal device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0117] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal equipment, causing a series of operational steps to be performed on the computer or other programmable terminal equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable terminal equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0118] Although preferred embodiments of the present invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the present invention.

[0119] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or terminal device. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or terminal device that includes said element.

[0120] The present invention has provided a detailed description of a time-series data anomaly detection method, a time-series data anomaly detection device, an electronic device, and a storage medium. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A method for detecting anomalies in time-series data, characterized in that, include: Acquire historical time series data and the original model; The original model is trained by comparative learning based on the historical time series data to obtain an initial anomaly detection model. The initial anomaly detection model is trained using supervised learning based on the historical time series data to obtain the target anomaly detection model. Upon receiving the time series data to be identified, anomaly detection is performed on the time series data based on the target anomaly detection model to determine the anomaly information.

2. The method according to claim 1, characterized in that, The step of performing comparative learning training on the original model based on the historical time series data to obtain the initial anomaly detection model includes: Extract several augmented sample data from the historical time series data; In the case where the enhanced sample data is the same segment being enhanced, the enhanced sample data is determined as positive sample data; In the case where the enhanced sample data is not from the same segment, the enhanced sample data is identified as negative sample data; The original model is trained by comparison using the negative sample data and the positive sample data until the preset model convergence condition is reached, thereby determining the initial anomaly detection model.

3. The method according to claim 2, characterized in that, The loss function of the initial anomaly detection model is: in, , These are two positive samples after augmentation of the same segment; N is the number of samples in the augmented sample data. express and Cosine similarity between ; This is a preset temperature function; This represents the loss value per instance.

4. The method according to claim 3, characterized in that, The loss value of the initial anomaly detection model is the average of the single loss value over the positive sample data.

5. The method according to claim 1, characterized in that, The step of supervising the training of the initial anomaly detection model based on the historical time series data to obtain the target anomaly detection model includes: The historical time series data is labeled to identify normal and abnormal sample data. The initial anomaly detection model is trained using supervised learning based on the normal sample data and the abnormal sample data to obtain the target anomaly detection model.

6. The method according to claim 5, characterized in that, The step of supervising the training of the initial anomaly detection model based on the normal sample data and the abnormal sample data to obtain the target anomaly detection model includes: The initial anomaly detection model is trained using weakly supervised learning based on the normal sample data and the abnormal sample data to obtain the target anomaly detection model.

7. The method according to claim 6, characterized in that, The step of performing weakly supervised learning training on the initial anomaly detection model based on the normal sample data and the abnormal sample data to obtain the target anomaly detection model includes: Enhance the abnormal sample data; The initial anomaly detection model is trained using weakly supervised learning based on the normal sample data and the enhanced abnormal sample data to obtain the target anomaly detection model.

8. The method according to claim 7, characterized in that, The step of enhancing the abnormal sample data includes: Construct a variable sliding window; The abnormal sample data is enhanced based on the variable sliding window.

9. The method according to claim 6, characterized in that, The loss function of the target anomaly detection model is the cross-entropy loss function.

10. The method according to claim 9, characterized in that, The cross-entropy loss function is: Where L is the cross-entropy and y is the sample label. This represents the probability of anomaly prediction.

11. The method according to claim 5, characterized in that, The number of normal sample data and the number of abnormal sample data are the same.

12. The method according to claim 1, characterized in that, The original model is a deep learning model with a multi-head self-attention mechanism.

13. A time-series data anomaly detection device, characterized in that, include: The acquisition module is used to acquire historical time series data and the original model; The first training module is used to perform comparative learning training on the original model based on the historical time series data to obtain an initial anomaly detection model. The second training module is used to perform supervised learning training on the initial anomaly detection model based on the historical time series data to obtain the target anomaly detection model. The detection module is used to detect anomalies in the time series data to be identified based on the target anomaly detection model when the time series data to be identified is received, and to determine the anomaly information.

14. An electronic device, characterized in that, The method includes a processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein the computer program, when executed by the processor, implements the steps of the time-series data anomaly detection method as described in any one of claims 1 to 12.

15. A computer-readable storage medium, characterized in that, A computer program is stored on the computer-readable storage medium, which, when executed by a processor, implements the steps of the time-series data anomaly detection method as described in any one of claims 1 to 12.

Images