Multivariable time sequence abnormal data detection method based on two-stage reconstruction mechanism

Abstract

The invention provides a multivariable time series abnormal data detection method based on a two-stage reconstruction mechanism, which comprises the following steps: in a first stage, acquiring original multivariable time series data, and initializing error information; encoding the original multivariable time sequence data and the initialization error information by adopting an encoder to obtain first-stage encoding representation; inputting the first-stage coding representation into a reconstruction network to obtain a first-stage reconstruction result; in the second stage, error information of the reconstruction result of the first stage and the original multivariable time sequence data is calculated; encoding the error information and the original multivariable time sequence data to obtain second-stage encoding representation; inputting the second-stage coding representation into an error-driven reconstruction network to obtain a second-stage reconstruction result; obtaining a multivariable time sequence abnormal data detection result based on the second-stage reconstruction result; according to the method and the device, a more efficient detection effect can be realized on abnormal data detection with relatively low model complexity and a simple model architecture.

Description

Technical Field

[0001] This invention belongs to the field of artificial intelligence, specifically relating to a method for detecting anomalies in multivariate time series data based on a two-stage reconstruction mechanism. Background Technology

[0002] In recent years, the use of carefully designed deep learning architectures to achieve high-precision multivariate time series detection has attracted considerable attention from researchers. Ren et al. proposed a method combining spectral residuals and convolutional neural networks (CNNs) to detect timing anomalies in service systems. In the real world, multivariate time series data rarely possesses all label information; therefore, unsupervised anomaly diagnosis methods proposed by Li et al. have been widely studied, where the frequency consistency of multivariate spectral signals is used for unsupervised anomaly detection. For time series anomaly detection, an unsupervised method utilizing LSTM networks has been proposed, where anomaly identification is achieved through structural optimization of the LSTM model combined with support vector machine algorithms. USAD employs an autoencoder based on adversarial training to ensure effective model training. Among unsupervised learning methods, reconstruction-based anomaly detection techniques have been extensively studied due to their effectiveness in solving high-dimensional and nonlinear data problems. However, they often overfit to anomalous patterns, which may lead to inaccurate anomaly diagnosis. While reconstruction-based anomaly detection methods can effectively identify pattern anomalies, they may overfit to anomalous data, reconstructing identical anomalous data, making amplitude anomaly detection difficult. To address these issues, some studies have attempted to amplify the differences between anomalous data and reconstructed data to enable the model to better diagnose amplitude anomalies. To further address the overfitting problem to outlier data, many studies aim to prevent incorrect reconstructed fits by enabling models to learn the underlying trends of the original data. Revin recovers the statistical information of time series data through reversible instance normalization. The DC detector uses a single-scale structure to extract local features and global correlations to effectively capture the temporal information of long-term series. D3R supplements the global information of the data through decomposition and reconstruction. While these methods alleviate the overfitting problem to some extent by capturing global trend information, most models themselves do not learn the reconstruction trend of the data. Instead, they rely on preprocessing data outside the model, resulting in insufficient ability to capture reconstruction trends. Therefore, the performance of anomaly detection remains unsatisfactory. In addition, methods based on autoencoders and their variants identify outlier data through reconstruction errors. Related studies include FCVAE and other literature, which utilizes variational autoencoders to model temporal distribution features and has achieved certain results in unsupervised scenarios. Furthermore, TranAD et al. introduced the Transformer structure to enhance the modeling ability for long-term dependencies through a sequence-to-sequence reconstruction mechanism. Studies such as UNITS and RTDetector attempt to combine local temporal patterns with global statistical information to improve the ability to characterize complex multivariate relationships. In addition, works such as TimesNet and KAN-AD improve the model's ability to express periodic and nonlinear features from the perspective of frequency domain modeling or structured function modeling.

[0003] The aforementioned technologies form the closest prior art foundation for this invention, and related content can be found in publicly published academic papers such as TranAD, UNITS, and TimesNet. However, existing technologies still have the following shortcomings: First, most methods focus on time series modeling from a single perspective, making it difficult to simultaneously consider individual-level local features and group-level global correlation information; second, under unlabeled or weakly labeled conditions, the anomaly detection threshold depends on empirical settings, limiting generalization ability; third, some Transformer-based methods have high computational complexity, making them difficult to adapt to application scenarios such as medical fields that have high requirements for real-time performance and stability; fourth, existing methods mostly target industrial or system data, and do not adequately consider the heterogeneity, missing data, and risk evolution characteristics present in multivariate time series data in medical fields.

[0004] Therefore, there is an urgent need for an anomaly detection and risk prediction technology that can effectively integrate local and global information under unsupervised or weakly supervised conditions and is applicable to complex medical time-series data, in order to overcome the above-mentioned shortcomings of existing technologies. Summary of the Invention

[0005] To address the problems existing in the prior art, this invention proposes a method for detecting outlier data in multivariate time series based on a two-stage reconstruction mechanism. This method includes: constructing an outlier data detection model based on a two-stage reconstruction mechanism, which consists of a reconstruction network and an error-driven reconstruction network; and processing the input data using the two-stage reconstruction mechanism-based outlier data detection model, including:

[0006] In the first stage, the original multivariate time series data is acquired and the error information is initialized; the original multivariate time series data and the initialized error information are encoded using an encoder to obtain the first-stage encoded representation; the first-stage encoded representation is input into the reconstruction network to obtain the first-stage reconstruction result.

[0007] In the second stage, the error information between the reconstruction result of the first stage and the original multivariate time series data is calculated; the error information and the original multivariate time series data are encoded to obtain the second-stage encoded representation; the second-stage encoded representation is input into the error-driven reconstruction network to obtain the second-stage reconstruction result; and the multivariate time series abnormal data detection result is obtained based on the second-stage reconstruction result.

[0008] To achieve the above objectives, the present invention also provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements any of the above-described methods for detecting multivariate time series anomalies based on a two-stage reconstruction mechanism.

[0009] To achieve the above objectives, the present invention also provides a multivariate time series anomaly data detection device based on a two-stage reconstruction mechanism, comprising a processor and a memory; the memory is used to store a computer program; the processor is connected to the memory and is used to execute the computer program stored in the memory, so that the multivariate time series anomaly data detection device based on a two-stage reconstruction mechanism performs any of the above-mentioned multivariate time series anomaly data detection methods based on a two-stage reconstruction mechanism.

[0010] The beneficial effects of this invention are:

[0011] This invention achieves more efficient anomaly detection with lower model complexity and a simpler model architecture. Furthermore, by using a multi-scale temporal information modeling module to model and fuse dynamic features at different time scales in parallel, it can simultaneously capture both short-term abrupt changes and long-term slow evolution anomalies, improving the model's adaptability to complex anomaly patterns. Attached Figure Description

[0012] Figure 1 This is a diagram of the overall network structure of the present invention;

[0013] Figure 2 This is a structural diagram of the temporal information aggregation attention module of the present invention;

[0014] Figure 3 This is a structural diagram of the multi-scale temporal information modeling module of the present invention. Detailed Implementation

[0015] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0016] A method for detecting outlier data in multivariate time series data based on a two-stage reconstruction mechanism is disclosed. The method includes: constructing an outlier data detection model based on the two-stage reconstruction mechanism, which consists of a reconstruction network and an error-driven reconstruction network; and processing the input data using the two-stage reconstruction mechanism-based outlier data detection model, including:

[0017] In the first stage, the original multivariate time series data is acquired and the error information is initialized; the original multivariate time series data and the initialized error information are encoded using an encoder to obtain the first-stage encoded representation; the first-stage encoded representation is input into the reconstruction network to obtain the first-stage reconstruction result.

[0018] In the second stage, the error information between the reconstruction result of the first stage and the original multivariate time series data is calculated; the error information and the original multivariate time series data are encoded to obtain the second-stage encoded representation; the second-stage encoded representation is input into the error-driven reconstruction network to obtain the second-stage reconstruction result; and the multivariate time series abnormal data detection result is obtained based on the second-stage reconstruction result.

[0019] like Figure 1 As shown, this invention proposes a multivariate time series anomaly detection method based on a two-stage reconstruction mechanism. The overall network structure consists of a first-stage reconstruction network and a second-stage error-driven reconstruction network. The two-stage structure progressively enhances the modeling ability of anomaly features. The overall network structure includes an encoder module, a reconstruction network module, and an error feedback mechanism. The reconstruction network module is composed of a layer normalization module, a temporal information aggregation attention module, and a multi-scale temporal information modeling module, which are sequentially combined to achieve feature fusion through residual connections.

[0020] In this embodiment, in the first stage, the original multivariate time series data is input. Where B represents the batch size, T represents the time duration, and D represents the feature dimension. Initialization error information is also incorporated. ,in This is an all-zero matrix used to represent the absence of prior anomalous information. The encoder module will combine src with... By concatenating along the feature dimension, a sequence is formed. The feature dimension is compressed back to D through a linear mapping to obtain the first-stage encoding representation. Subsequently, The features are input into the reconstruction network. The reconstruction network first stabilizes the feature distribution through a layer normalization module, then sequentially passes through a temporal information aggregation attention module and a multi-scale temporal information modeling module, and finally enhances the feature representation capability through residual connections, outputting the first-stage reconstruction result. The role of the first stage is to learn the normal evolution pattern of the time series, providing a foundation for subsequent anomalous amplification.

[0021] The reconstructed network consists of a layer normalization module, a temporal information aggregation attention module, and a multi-scale temporal information modeling module, which are connected sequentially to achieve feature fusion. The layer normalization module performs layer normalization on the first-stage encoding representation; the temporal information aggregation attention module aggregates temporal information from the normalized first-stage encoding representation, using pooling operations to aggregate temporal information and combining an attention mechanism to calculate the correlation between different time steps in the input sequence, obtaining key historical information for anomaly detection at the current moment; this key historical information is input into the multi-scale temporal information modeling module to obtain multi-scale features; the key historical information and multi-scale features are fused through residual connections to obtain fused features; and the first-stage reconstruction result is obtained based on these fused features.

[0022] Layer normalization processing: After receiving the first stage encoded representation, layer normalization is first performed on it. That is, through the standardization operation, it is ensured that the feature values ​​of each layer have the same distribution range, thereby stabilizing the training process of the model, reducing the problem of gradient vanishing or exploding, and accelerating the convergence speed.

[0023] The temporal information aggregation attention module aggregates temporal information from the first-stage encoded representation. It uses pooling operations to aggregate temporal information and combines this with an attention mechanism to calculate the correlation between different time steps in the input sequence. This allows the model to adaptively capture the most important historical information for anomaly detection at the current moment. Then, Mamba is used to mine the temporal information. This step enhances the model's ability to pay attention to contextual information when processing long-term temporal data, especially in complex interactions with multidimensional data, improving its sensitivity to anomaly patterns.

[0024] Multi-scale temporal information modeling module: By inputting the first-stage encoded representation into the multi-scale temporal information modeling module, this module can model the dynamic changes of time series data in parallel across multiple time scales. By modeling patterns at different time scales, it can simultaneously capture both short-term and long-term temporal changes, enhancing the model's ability to identify complex, long-term dependent anomalies.

[0025] Residual connections and feature fusion: After processing by the above modules, the reconstruction network fuses the processed features with the original features through residual connections to form the final reconstructed representation. Residual connections effectively preserve the temporal pattern information in the original input, preventing the loss of temporal features due to normalization or other operations. This ensures that the model retains the effective information of the original temporal data while also learning subtle features from outliers.

[0026] Since the training data comes from unlabeled datasets (such as the SMD dataset) and is mainly composed of normal samples, the first-stage network can fully learn the statistical laws of normal time series in terms of time dependence, cross-sample similarity and multi-scale dynamic changes while minimizing reconstruction error.

[0027] For normal data, the reconstruction error is relatively small; however, due to deviations from the normal pattern, abnormal data already exhibits relatively large reconstruction residuals in the first stage. The core function of the first stage is to establish the basic time-series representation capability of normal data and to initially expose the structural biases of abnormal samples.

[0028] In this embodiment, in the second stage, based on the reconstruction results of the first stage... The error information is calculated based on the difference between the input src and the original input src.

[0029]

[0030] in, , used to characterize potential anomalous regions.

[0031] Then, the src and error information are... The components are concatenated again along the feature dimension, and the second-stage reconstruction result is obtained by using an encoder and reconstruction network with the same structure as the first stage. By introducing error-driven features, the second-stage network can pay more attention to the time points and variable dimensions that are difficult to reconstruct accurately in the first stage, thereby further amplifying the abnormal features.

[0032] The second stage uses the same network structure as the first stage. However, since the input explicitly includes error information, the model focuses on the time location and feature dimension that are difficult to model accurately in the first stage during the reconstruction process. This enables targeted modeling of abnormal regions. For normal data, which has already been well reconstructed in the first stage with relatively small error information, the second stage only performs fine-tuning. For abnormal data, the error information is explicitly introduced and propagated in the second stage, causing the abnormal location to maintain a large degree of deviation in the reconstruction result, thus forming obvious abnormal signals.

[0033] In this embodiment, the core modules of the error-driven reconstruction network include a temporal information aggregation attention module and a multi-scale temporal information modeling module. The temporal information aggregation attention module models short-term temporal dynamics based on a state-space model, efficiently capturing local abrupt anomalies with low computational complexity, making it suitable for high-dimensional time-series data. The multi-scale temporal information modeling module models temporal features across different time spans in parallel using a multi-scale structure, simultaneously identifying both short-term and long-term trend anomalies, thus improving the model's adaptability to complex anomaly patterns. The network as a whole adopts an end-to-end approach to model multivariate time-series data, making it suitable for anomaly detection scenarios with unlabeled or weakly labeled data.

[0034] In this embodiment, the time-series information aggregation attention module is as follows: Figure 2 As shown, for input features First, pooling is performed along the time dimension to aggregate the time windows of each sample into a single global representation:

[0035]

[0036] This aggregation representation is used to describe the overall temporal characteristics of each sample within the current window. Then, based on the aggregation representation P, queries, keys, and values ​​are constructed:

[0037]

[0038] in, This is a learnable projection matrix. The module then calculates the similarity weights of the aggregated time-series information across different batches.

[0039]

[0040] And obtain aggregated information across batches. This process enables each batch of data to adaptively incorporate temporal information from other similar batches, thereby enhancing the consistency modeling capability within a single batch.

[0041] The cross-sample aggregation results are broadcast back to the time dimension and fused with the original features before being input into the Mamba state-space model.

[0042]

[0043] The Mamba module is used for efficient modeling of long-range temporal dependencies. It is a class of efficient sequence modeling architectures based on selective state-space models. Through linear recursion and input selection mechanisms, it captures long-range dependencies while maintaining near-linear time and memory complexity, combining Transformer-level expressiveness with superior scalability for long sequences. Compared to pure attention mechanisms, Mamba, with its selective input and linear recursive structure, exhibits better computational efficiency and numerical stability for short to medium-length sequences, effectively capturing key temporal patterns such as trend changes, delay effects, and step dependencies. Specifically, for each batch, the input is first mapped and then decomposed using gating: Discretized parameterization of state updates (ZOH discretization), with selective input and recursive state evolution:

[0044]

[0045]

[0046]

[0047]

[0048]

[0049] in, Positive step size (by get: ), It is a diagonal continuous-time state matrix. As the input mapping matrix, Represents the ReLU activation function. This represents element-wise multiplication. , respectively for the first Discretization parameters for each time step. Final Mamba block readout and corresponding residual normalization:

[0050]

[0051]

[0052] The above calculations are performed in parallel for each batch, and the final output is obtained. Enhance the ability to express the evolution of sequence states.

[0053] In this embodiment, to fully characterize the temporal features at different time scales, the present invention also designs a multi-scale temporal information modeling structure, the calculation process of which is as follows: Figure 3As shown, this module contains a low-resolution Mamba path and a high-resolution linear feature path. The two paths are strictly aligned in the time dimension and then concatenated in the feature dimension. Cross-scale fusion and redundancy suppression are achieved through a position-wise feedforward network (FFN). In other words, it uses the entire queue-level time series as the modeling object, treating records from all batches as a continuous long sequence. It captures shared process patterns and transition structures across batches in a unified coordinate system and achieves a collaborative characterization of global trends and local details through multi-resolution paths.

[0054] First, a linear projection is performed on the feature dimension, and then an element-wise nonlinearity is applied to obtain... Subsequently, Feeding a low-resolution Mamba path to extract long-range dependencies and overall trends: While keeping the T-step time length constant, selective state-space modeling is used to perform sequential recursion and selective input on relatively "smooth" feature channels, thereby obtaining... The high-resolution path in parallel with it... For the input through another linear mapping This branch does not impose additional temporal downsampling or smoothing constraints, emphasizing sensitivity to short-range details, boundary transitions (especially at patient splicing points), and high-frequency perturbations, thus preserving finer-grained discriminative cues at the feature level. This results in... .

[0055] The outputs of the two paths are strictly aligned in the time dimension and then concatenated in the feature dimension to form... Then, cross-scale information fusion and redundancy suppression are achieved through a position-by-position feedforward network:

[0056]

[0057] in The product is an element-wise non-linear product, which is then transformed back to the original feature dimension through a linear layer to obtain... .

[0058] In this embodiment, to verify the effectiveness and universality of the proposed anomaly detection method, the publicly available multivariate time series anomaly detection datasets SMD (Server Machine Dataset) and SMAP (Soil Moisture Active Passive) are selected as experimental data sources. The SMD dataset originates from a real server operating environment and contains time series data of multivariate monitoring indicators collected from multiple servers under different operating conditions. The data covers multiple dimensions such as CPU utilization, memory usage, disk I / O, and network status, and is characterized by high dimensionality, long time span, and complex anomaly types. Anomalies in this dataset are typically caused by system failures, resource contention, or abnormal loads, demonstrating a clear engineering application background. In the experiment, this invention uses only unlabeled data from its training set for model training, which aligns with the application scenario of unsupervised anomaly detection. The SMAP dataset originates from a satellite telemetry system in the US aerospace field and records time series data from multiple sensors during satellite operation. This dataset features stable sampling periods, strong correlations between variables, and significant differences in anomaly durations, and is often used to verify the generalization ability of anomaly detection methods in complex physical systems. This invention also uses unlabeled training data from the SMAP dataset for model learning, and evaluates performance based on anomaly annotations during the testing phase.

[0059] To evaluate the performance of the anomaly detection method proposed in this invention, Precision, Recall, and F1-score are used as evaluation metrics to comprehensively assess the model's anomaly identification ability. Precision measures the proportion of data that the model classifies as anomalous, but which are actually anomalous; its calculation formula is as follows:

[0060]

[0061] Where TP represents the number of samples correctly detected as anomalous, and FP represents the number of normal samples misclassified as anomalous. Recall measures the proportion of real-world anomalous data that the model successfully detects; its formula is:

[0062]

[0063] Where FN represents the number of undetected anomaly samples. The F1 score is the harmonic mean of precision and recall, used to comprehensively reflect the overall performance of the model in the anomaly detection task, and its calculation formula is:

[0064]

[0065] The above evaluation indicators can comprehensively reflect the accuracy, coverage, and overall performance of the method of the present invention in identifying abnormal samples during the anomaly detection process.

[0066] In this embodiment, the input time series data After undergoing the first and second stages of reconstruction, the corresponding final reconstruction result is obtained. An anomaly score is calculated based on the difference between the input data and the final reconstruction result, specifically:

[0067]

[0068] When the anomaly score S exceeds a preset threshold, it is determined that there is an anomaly in the corresponding time series or time window; when the anomaly score is lower than the threshold, it is determined that the corresponding time series is normal data.

[0069] In this embodiment, the sliding window size is fixed at 10 for all datasets. If the outlier score at a given time point exceeds a certain threshold, the entire window is considered an outlier. Our model uses the Adam optimization algorithm with an initial learning rate of 1×10⁻⁵. The batch size is set to 128, and the model is trained for a total of 50 iterations. The hidden layer dimension of Mamba is set to 32. The model was trained and tested on an NVIDIA RTX 4080 SUPER GPU and a PyTorch platform.

[0070] To verify the effectiveness and advancement of the proposed anomaly detection method in multivariate time series scenarios, several representative existing anomaly detection models were selected as comparative methods for experimental verification. These comparative methods cover different technical approaches, including reconstruction, time series modeling, and multi-scale feature learning, and can comprehensively reflect the current level of technology. Specifically, the selected comparative models include RTdetector, TimesNet, FITS, DRSMT, THEMIS, DADA, and UNITS. These methods are all publicly available time series anomaly detection models in recent years and are highly representative in scenarios such as server monitoring, industrial systems, and telemetry data.

[0071] Meanwhile, all comparative models were tested under the same dataset conditions, using the SMD and SMAP datasets for validation and the same parameter configurations; consistency was maintained in data preprocessing methods, time window partitioning strategies, and training and test set partitioning methods. For performance evaluation, Precision, Recall, and F1-score were used as unified evaluation metrics to quantitatively compare the anomaly detection performance of each model. Precision measures the accuracy of anomaly detection, Recall measures the coverage of anomaly detection, and the F1 score comprehensively reflects the model's performance in balancing accuracy and recall. By comparing the method of this invention with the aforementioned existing technology models under the same experimental settings and evaluation metrics, the performance of this invention in anomaly detection tasks can be objectively evaluated, thereby verifying the effectiveness and practical value of this invention in complex multivariate time series anomaly detection scenarios. Table 1 shows the corresponding comparative performance.

[0072] Table 1

[0073]

[0074] Table 1 shows the performance comparison results of the method of the present invention with several existing anomaly detection models on the SMAP and SMD datasets. The evaluation metrics include Precision, Recall, and F1 score. The comparative analysis shows that the method of the present invention exhibits relatively stable and competitive anomaly detection performance on both datasets.

[0075] On the SMAP dataset, the method of this invention achieves superior results in terms of Precision, Recall, and F1 score. Specifically, Precision reaches 0.8228, Recall reaches 1.0000, and F1 score reaches 0.9028. Compared to existing methods, this invention achieves complete coverage of anomalous samples while maintaining high detection accuracy. Compared to the RTdetector method, this invention also achieves a Recall score of 1.0000, but exhibits a more balanced performance in Precision and F1 scores, indicating that it effectively reduces false alarms while ensuring no anomalies are missed. Compared to methods such as TimesNet and FITS, this invention shows significant advantages in Recall and F1 scores, demonstrating a stronger ability to identify anomalous patterns in complex telemetry time series. In addition, some methods have low precision or recall on the SMAP dataset, reflecting their insufficient robustness in scenarios where abnormal samples are sparse or the duration of abnormalities is long. However, this invention effectively alleviates the above problems through a two-stage reconstruction mechanism, enabling the model to stably capture abnormal features.

[0076] On the SMD dataset, the advantages of the proposed method are even more pronounced. Experimental results show that the proposed method achieves precision, recall, and F1 scores of 0.9955, 1.0000, and 0.9977, respectively, leading all compared methods. Compared to methods such as RTdetector and TimesNet, the proposed method achieves complete detection of anomalous samples in terms of recall while maintaining a very high precision, indicating that it can effectively distinguish between normal fluctuations and anomalous behavior in server-side data. Compared to the FITS method, although both perform well in precision and recall, the proposed method still has a certain advantage in overall performance (F1 score), indicating that it performs better in terms of anomaly detection stability.

[0077] Methods such as DRSMT, DADA, and UNITS exhibit a decline in Recall or F1 scores on the SMD dataset, reflecting insufficient detection or numerous false positives in scenarios with complex anomaly patterns and high variable dimensionality. This invention improves anomaly detection performance by introducing a temporal information aggregation attention mechanism and a multi-scale temporal modeling structure, enabling more comprehensive modeling of normal behavior patterns in such complex scenarios.

[0078] Experimental results on both the SMAP and SMD datasets demonstrate that the proposed method exhibits good generalization ability and stability across datasets of varying sources and characteristics. Particularly noteworthy is the Recall metric, which reaches 1.0000 on both datasets, indicating that the method effectively avoids missing outliers under unsupervised training conditions. Furthermore, its high Precision and F1 scores suggest that the method improves anomaly detection coverage without significantly increasing the false positive rate. These experimental results fully validate the effectiveness and practical value of the proposed two-stage reconstruction anomaly detection method in multivariate time series anomaly detection tasks.

[0079] In one embodiment of the present invention, the present invention further includes a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements any of the above-described methods for detecting multivariate time series anomalies based on a two-stage reconstruction mechanism.

[0080] Those skilled in the art will understand that all or part of the steps of the above-described method embodiments can be implemented using computer program-related hardware. The aforementioned computer program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments; and the aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.

[0081] A multivariate time series anomaly detection device based on a two-stage reconstruction mechanism includes a processor and a memory; the memory is used to store a computer program; the processor is connected to the memory and is used to execute the computer program stored in the memory, so that the multivariate time series anomaly detection device based on a two-stage reconstruction mechanism can perform any of the above-mentioned multivariate time series anomaly detection methods based on a two-stage reconstruction mechanism.

[0082] Specifically, the memory includes various media capable of storing program code, such as ROM, RAM, magnetic disk, USB flash drive, memory card, or optical disk.

[0083] Preferably, the processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0084] The above-described embodiments further illustrate the purpose, technical solution, and advantages of the present invention. It should be understood that the above-described embodiments are merely preferred embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made to the present invention within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for detecting outlier data in multivariate time series based on a two-stage reconstruction mechanism, characterized in that, include: An anomaly detection model based on a two-stage reconstruction mechanism is constructed, which consists of a reconstruction network and an error-driven reconstruction network. The anomaly detection model based on a two-stage reconstruction mechanism processes the input data as follows: In the first stage, the original multivariate time series data is acquired and the error information is initialized; the original multivariate time series data and the initialized error information are encoded using an encoder to obtain the first-stage encoded representation; the first-stage encoded representation is input into the reconstruction network to obtain the first-stage reconstruction result. In the second stage, the error information between the reconstruction result of the first stage and the original multivariate time series data is calculated; the error information and the original multivariate time series data are encoded to obtain the second-stage encoded representation; the second-stage encoded representation is input into the error-driven reconstruction network to obtain the second-stage reconstruction result; and the multivariate time series abnormal data detection result is obtained based on the second-stage reconstruction result.

2. The method for detecting outlier data in multivariate time series based on a two-stage reconstruction mechanism according to claim 1, characterized in that, The encoding of the original multivariate time series data and initialization error information by an encoder includes: concatenating the original multivariate time series data and initialization error information along the feature dimension, and compressing the concatenated data along the feature dimension through linear mapping to obtain the first-stage encoded representation.

3. The method for detecting outlier data in multivariate time series based on a two-stage reconstruction mechanism according to claim 1, characterized in that, The reconstructed network consists of a layer normalization module, a temporal information aggregation attention module, and a multi-scale temporal information modeling module, and achieves feature fusion through residual connections.

4. The method for detecting outlier data in multivariate time series based on a two-stage reconstruction mechanism according to claim 3, characterized in that, The reconstruction network processes the first-stage encoding representation in the following ways: First, it performs layer normalization on the first-stage encoding representation using a layer normalization module; second, it aggregates temporal information in the normalized first-stage encoding representation using a temporal information aggregation attention module, aggregating temporal information through pooling operations and combining this with an attention mechanism to calculate the correlation between each time step in the input sequence, obtaining key historical information for anomaly detection at the current moment; third, it inputs this key historical information into a multi-scale temporal information modeling module to obtain multi-scale features; fourth, it fuses the key historical information with the multi-scale features through residual connections to obtain fused features; and finally, it obtains the first-stage reconstruction result based on the fused features.

5. The method for detecting outlier data in multivariate time series based on a two-stage reconstruction mechanism according to claim 1, characterized in that, The error information for calculating the first-stage reconstruction results and the original multivariate time series data includes: ； Where c1 represents the potential abnormal region, X1 represents the first-stage reconstruction result, and src represents the original multivariate time series data.

6. The method for detecting outlier data in multivariate time series based on a two-stage reconstruction mechanism according to claim 1, characterized in that, The error-driven reconstruction network includes a temporal information aggregation attention module and a multi-scale temporal information modeling module; the temporal information aggregation attention module is used to capture local abrupt anomalies in the data, and the multi-scale temporal information modeling module is used to extract temporal features under different time spans.

7. The method for detecting multivariate time series anomalies based on a two-stage reconstruction mechanism according to claim 6, characterized in that, The temporal information aggregation attention module processes the second-stage encoding representation by: performing pooling operations on the second-stage encoding representation in the time dimension, i.e., clustering the time windows of each sample to obtain a global representation; constructing query vectors, key vectors, and value vectors based on the global representation; calculating similarity weights for aggregated temporal information between different batches based on the query vectors, key vectors, and value vectors; aggregating information across batches based on the similarity weights; broadcasting the cross-sample aggregation results back to the time dimension, fusing them with the original features, and inputting them into the Mamba state space model. Through linear recursion and input selection mechanisms, long-range dependencies are captured while maintaining approximately linear time and memory complexity, and the aggregated feature map is output.

8. The method for detecting outlier data in multivariate time series based on a two-stage reconstruction mechanism according to claim 6, characterized in that, The multi-scale temporal information modeling module processes the input features including: linearly projecting the feature dimension and applying element-wise nonlinearity to obtain feature Z1; inputting Z1 into a low-resolution Mamba path to extract long-range dependencies and overall trends; and performing sequence recursion and selective input on smooth feature channels through selective state-space modeling to obtain... ;Will and high-resolution path The input is subjected to another linear mapping to obtain feature Z2; feature Z2 retains more fine-grained discriminative clues at the feature level to obtain feature... ;Will and After strict alignment in the time dimension, the features are concatenated to form the concatenated features F. Cross-scale information fusion and redundancy suppression are achieved through a position-by-position feedforward network to obtain the second-stage reconstruction result.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, The computer program is executed by a processor to implement any one of the multivariate time series anomaly data detection methods based on a two-stage reconstruction mechanism as claimed in claims 1 to 8.

10. A device for detecting outlier data in multivariate time series based on a two-stage reconstruction mechanism, characterized in that, It includes a processor and a memory; the memory is used to store a computer program; the processor is connected to the memory and is used to execute the computer program stored in the memory, so that the multivariate time series anomaly data detection device based on a two-stage reconstruction mechanism performs any one of the multivariate time series anomaly data detection methods based on a two-stage reconstruction mechanism according to claims 1 to 8.

Images