Time series anomaly detection method based on hybrid expert framework

Abstract

The invention provides a time series anomaly detection method based on a hybrid expert framework. According to the hybrid expert anomaly detection framework provided by the invention, the problem that a single model is difficult to adapt to a dynamic heterogeneous time sequence mode is solved through cooperation of shared experts and attention gated vertical experts; the number of activated experts is dynamically adjusted based on the resource load, and balance between the calculation efficiency and the detection precision is achieved; a two-stage transfer learning strategy (pre-training and fine tuning) can be quickly adapted only by a small amount of target scene data, and the overhead of repeated modeling for each scene is avoided; the balance loss function ensures expert utilization balance, and model degradation is prevented. Finally, cross-scene universality, real-time performance and stability are obviously superior to those of a clustering fine tuning and large model scheme.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence, and in particular to a time series anomaly detection method based on a hybrid expert framework. Background Technology

[0002] Time series analysis aims to uncover patterns in data changes over time (such as trends, periodicity, and anomalous fluctuations) for predicting, monitoring, or diagnosing system states. Its core is establishing a mathematical model of the relationship between historical data and future states. Time series anomaly detection, on the other hand, learns a function that maps an input sequence to a label sequence, thereby identifying outliers in the input sequence based on the values ​​of the label sequence in practical applications. In time series anomaly detection, real-world time series exhibit dynamic behavior and heterogeneous patterns, making it difficult for ordinary single models to adapt to multiple patterns. Furthermore, time series in different scenarios have different distributions, significantly increasing the overhead of training a separate neural network model for each scenario.

[0003] In some feasible implementations, cross-scenario transfer learning anomaly detection methods can include clustering methods or methods based on large model architectures. Clustering methods first cluster based on time series patterns and then fine-tune the model for each cluster. Large model architectures are based on the Transformer principle, utilizing the generalization ability of large models for pre-training and cross-scenario fine-tuning. While fine-tuning the model after clustering can improve adaptability, it increases computational overhead, is highly sensitive to clustering quality, and misclassified time series may lead to a decrease in detection performance. Large model architectures have high computational costs, high memory consumption, and large parameter storage, making them unsuitable for resource-constrained or real-time monitoring systems. Therefore, a time series anomaly detection method is needed that can combine the mechanism of hybrid expert models to serve as a general time series anomaly detection model framework, addressing the current problems of insufficient stability, generality, and application efficiency of existing models. Summary of the Invention

[0004] The purpose of this application is to at least address one of the aforementioned technical deficiencies, particularly the lack of stability, versatility, and application efficiency of existing time-series anomaly detection model frameworks.

[0005] In a first aspect, this application provides a time series anomaly detection method based on a hybrid expert framework, the method comprising:

[0006] Obtain the original time series and preprocess the original time series to obtain the target time series;

[0007] The target time series is input into a hybrid expert framework to determine the anomaly score corresponding to the target time series.

[0008] The hybrid expert framework includes a first branch and a second branch. The first branch determines a shared score through a shared expert module, and the second branch determines a preset number of vertical expert modules through an attention gating network, and determines a corresponding vertical score through each of the vertical expert modules.

[0009] Based on the relationship between the anomaly score and the preset anomaly threshold, the anomaly situation at the target time point in the target time series is determined.

[0010] As an optional implementation, the attention gating network is used for:

[0011] The target time series is converted into a query projection using a first matrix, and the expert key corresponding to each of the vertical expert modules is determined.

[0012] Based on the query projection, the expert key, and the time series length of the target time series, the attention score of each vertical expert module is determined;

[0013] Based on the attention score, a preset number of the vertical expert modules are selected.

[0014] As an optional implementation, determining the attention score of each vertical expert module based on the query projection, the expert key, and the time series length of the target time series includes:

[0015] The first attention factor is calculated based on the vector product of the query projection and the expert key, and the time series length of the target time series;

[0016] Based on the first attention factor and the second attention factor obtained during training corresponding to each of the vertical expert modules, the attention score of each vertical expert module is calculated.

[0017] Wherein, the second attention factor is used to indicate the degree of static preference of each of the vertical expert modules for the target time series;

[0018] Furthermore, the method further includes:

[0019] The attention scores of the selected vertical expert modules are normalized and used as the weight parameters of the selected vertical expert modules.

[0020] The weighting parameter is used to determine the vertical score of the corresponding vertical expert module.

[0021] As an optional implementation, the preset quantity is dynamically configured according to resource load conditions, specifically including:

[0022] The processor load rate and memory usage of each of the vertical expert modules are monitored in real time, and a dynamic configuration determination is performed every preset period based on the processor load rate or the memory usage rate.

[0023] When the processor load rate is higher than a first preset threshold, the preset quantity is reduced;

[0024] When the memory usage rate is lower than the second preset threshold, the preset quantity is increased.

[0025] As an optional implementation, the training process of the hybrid expert framework includes:

[0026] In the first stage, the parameters of the shared expert module, the vertical expert module, and the attention gating network are jointly updated on the source scene dataset.

[0027] In the second stage, the parameters of the shared expert module are frozen on the target scene dataset corresponding to the target time series, and the parameters of the vertical expert module and the attention gating network are updated.

[0028] As an optional implementation, the loss function of the training process includes a shared expert module loss function, a vertical expert module loss function, and a balanced loss function;

[0029] The balance loss function is used to indicate the overall importance of each vertical expert module within a preset time window. It is calculated by summing the product of the selection frequency and weight score of each vertical expert module within the preset time window and adjusting it with hyperparameter coefficients.

[0030] Secondly, this application provides a time series anomaly detection device based on a hybrid expert framework, the device comprising:

[0031] The acquisition module is used to acquire the original time series and preprocess the original time series to obtain the target time series;

[0032] The processing module is used to input the target time series into the hybrid expert framework and determine the anomaly score corresponding to the target time series;

[0033] The hybrid expert framework includes a first branch and a second branch. The first branch determines a shared score through a shared expert module, and the second branch determines a preset number of vertical expert modules through an attention gating network, and determines a corresponding vertical score through each of the vertical expert modules.

[0034] The processing module is further configured to determine the abnormal situation of the target time point in the target time series based on the relationship between the abnormal score and the preset abnormal threshold.

[0035] As an optional implementation, the attention gating network is used for:

[0036] The target time series is converted into a query projection using a first matrix, and the expert key corresponding to each of the vertical expert modules is determined.

[0037] Based on the query projection, the expert key, and the time series length of the target time series, the attention score of each vertical expert module is determined;

[0038] Based on the attention score, a preset number of the vertical expert modules are selected.

[0039] Thirdly, this application provides a computer device including one or more processors and a memory storing computer-readable instructions that, when executed by the one or more processors, perform the steps of the method described in the first aspect.

[0040] Fourthly, this application provides a storage medium storing computer-readable instructions that, when executed by one or more processors, cause the one or more processors to perform the steps of the method described in the first aspect.

[0041] As can be seen from the above technical solutions, the embodiments of this application have the following advantages:

[0042] Based on any of the above embodiments, this application employs a dual-branch hybrid expert framework. A shared expert module extracts common anomaly features from the time series, while an attention-gated network dynamically selects vertical expert modules based on sequence characteristics. This allows the model to adapt to time series with dynamic behavior and heterogeneous patterns simultaneously, overcoming the limitations of a single model. Anomaly scores are generated by fusing shared and vertical scores using normalized attention weights, improving the reliability of detection results. Furthermore, a resource monitoring mechanism dynamically adjusts the number of activated experts, reducing computational consumption under high processor load and enhancing pattern discrimination when memory is ample, ensuring the feasibility of the real-time monitoring system. The training phase employs a two-stage strategy of pre-training and fine-tuning: first, parameters are jointly optimized in the source scene to learn common patterns; then, shared experts are frozen and vertical modules are fine-tuned in the target scene, achieving cross-scene transfer with minimal overhead. A balanced loss term is introduced into the loss function to constrain the comprehensive importance of each expert within the time window, avoiding model degradation caused by routing bias. In summary, this method, through the collaborative design of conditional computation, sparse activation, and transfer learning, comprehensively optimizes cross-scene adaptability, computational efficiency, and deployment flexibility, solving the pain points of instability and large model resource consumption in clustering methods. Attached Figure Description

[0043] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0044] Figure 1 A flowchart illustrating a time series anomaly detection method based on a hybrid expert framework provided in one embodiment of this application;

[0045] Figure 2 A schematic diagram of the model architecture of a time series anomaly detection method based on a hybrid expert framework provided in one embodiment of this application;

[0046] Figure 3 This is an internal structural diagram of a computer device provided in an embodiment of this application. Detailed Implementation

[0047] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0048] The two important concepts involved in this application are as follows:

[0049] Time series anomaly detection: Let X = [ , , ..., ] is a univariate time series, where each observation is a univariate time series. ∈ R. Let Y = [ , , ..., ] represents the corresponding binary label sequence, where ∈ {0,1}. Label =0 indicates that the point This is a normal value, while = 1 indicates an outlier. Let = [ , +1, ..., Let represent the time window from index i to j. The goal of time series anomaly detection is to learn a function that maps an input sequence X to its label sequence Y. A key constraint is causality: the prediction of label yi can only use past and current observations. = [ , ..., [and does not contain any future information.]

[0050] Transfer learning: using This represents the labeled data in the source domain. This refers to data within the target domain. Generally, the data distributions of the source domain and the target domain differ. The goal of transfer learning is to learn a model that enables anomaly detection within the target domain data, using only the source domain data and a small portion of the target domain data.

[0051] Time series analysis aims to uncover patterns in data changes over time (such as trends, periodicity, and anomalous fluctuations) for predicting, monitoring, or diagnosing system states. Its core is establishing a mathematical model of the relationship between historical data and future states. Time series anomaly detection, on the other hand, learns a function that maps an input sequence to a label sequence, thereby identifying outliers in the input sequence based on the values ​​of the label sequence in practical applications. In time series anomaly detection, real-world time series exhibit dynamic behavior and heterogeneous patterns, making it difficult for ordinary single models to adapt to multiple patterns. Furthermore, time series in different scenarios have different distributions, significantly increasing the overhead of training a separate neural network model for each scenario.

[0052] In some feasible implementations, cross-scenario transfer learning anomaly detection methods can include clustering methods or methods based on large model architectures. Clustering methods first cluster based on time series patterns and then fine-tune the model for each cluster. Large model architectures are based on the Transformer principle, utilizing the generalization ability of large models for pre-training and cross-scenario fine-tuning. While fine-tuning the model after clustering can improve adaptability, it increases computational overhead, is highly sensitive to clustering quality, and misclassified time series may lead to decreased detection performance. Large model architectures have high computational costs, high memory consumption, and large parameter storage, making them unsuitable for resource-constrained or real-time monitoring systems. Therefore, a time series anomaly detection method is needed that can combine the mechanism of hybrid expert models as a general time series anomaly detection model framework to solve the problems of insufficient stability, generality, and application efficiency of current models. The purpose of this application is to propose a general time series anomaly detection model framework that not only has cross-scenario transferability but also high computational efficiency and scalability, and does not rely on unstable methods such as clustering.

[0053] In summary, the technical concept of this application lies in the fact that it employs a dual-branch hybrid expert framework. A shared expert module extracts general anomaly features from time series data, while an attention-gated network dynamically selects vertical expert modules based on sequence characteristics. This allows the model to adapt to time series with dynamic behavior and heterogeneous patterns simultaneously, overcoming the limitations of a single model. Anomaly scores are generated by fusing shared and vertical scores using normalized attention weights, improving the reliability of detection results. Furthermore, a resource monitoring mechanism dynamically adjusts the number of activated experts, reducing computational consumption under high processor load and enhancing pattern discrimination when memory is ample, ensuring the feasibility of the real-time monitoring system. The training phase employs a two-stage strategy of pre-training and fine-tuning: first, parameters are jointly optimized in the source scene to learn common patterns; then, shared experts are frozen and vertical modules are fine-tuned in the target scene, achieving cross-scene transfer with minimal overhead. A balanced loss term is introduced into the loss function to constrain the comprehensive importance of each expert within the time window, avoiding model degradation caused by routing bias. In summary, this method comprehensively optimizes cross-scenario adaptability, computational efficiency, and deployment flexibility through the collaborative design of conditional computation, sparse activation, and transfer learning, thus solving the pain points of instability and large model resource consumption in clustering methods.

[0054] The methods provided in this application will be described in detail below based on the corresponding implementation methods in some practical application scenarios.

[0055] Figure 1 This is a flowchart illustrating a time series anomaly detection method based on a hybrid expert framework provided in one embodiment of this application, as shown below. Figure 1 As shown, this application provides a time series anomaly detection method based on a hybrid expert framework, the method comprising:

[0056] S101. Obtain the original time series and preprocess the original time series to obtain the target time series;

[0057] S102. Input the target time series into a hybrid expert framework to determine the anomaly score corresponding to the target time series;

[0058] like Figure 2 As shown, Figure 2 This is a schematic diagram of the model architecture of a time series anomaly detection method based on a hybrid expert framework provided in one embodiment of this application. This application aims to route time series to different expert anomaly detection models through a gating mechanism. These expert models have learned the features of different time series patterns during training, thereby realizing the detection of time series anomalies in different time series patterns and across scenarios.

[0059] The hybrid expert framework includes a first branch and a second branch. The first branch determines a shared score through a shared expert module, and the second branch determines a preset number of vertical expert modules through an attention gating network, and determines a corresponding vertical score through each of the vertical expert modules.

[0060] In practice, the vertical expert module can pre-define a set of attention-gated network determination results based on the data characteristics of the actual application scenario, serving as a supplement or adjustment. The model format in the vertical expert module and the shared expert module is not fixed and can also be dynamically adjusted according to actual needs.

[0061] As an optional implementation, the attention gating network is used for:

[0062] The target time series is converted into a query projection using a first matrix, and the expert key corresponding to each of the vertical expert modules is determined.

[0063] Based on the query projection, the expert key, and the time series length of the target time series, the attention score of each vertical expert module is determined;

[0064] Based on the attention score, a preset number of the vertical expert modules are selected.

[0065] This implementation converts the target time series into a query projection and interacts with the expert keys of each vertical expert module. It calculates the attention score based on the sequence length to achieve expert screening based on sequence characteristics. It dynamically selects a preset number of expert modules to avoid the overhead of calculating all experts. This retains the ability to distinguish heterogeneous patterns and reduces the computational load through sparse activation, thereby maintaining real-time detection efficiency in resource-constrained scenarios.

[0066] As an optional implementation, determining the attention score of each vertical expert module based on the query projection, the expert key, and the time series length of the target time series includes:

[0067] The first attention factor is calculated based on the vector product of the query projection and the expert key, and the time series length of the target time series;

[0068] Based on the first attention factor and the second attention factor obtained during training corresponding to each of the vertical expert modules, the attention score of each vertical expert module is calculated.

[0069] Wherein, the second attention factor is used to indicate the degree of static preference of each of the vertical expert modules for the target time series;

[0070] Furthermore, the method further includes:

[0071] The attention scores of the selected vertical expert modules are normalized and used as the weight parameters of the selected vertical expert modules.

[0072] The weighting parameter is used to determine the vertical score of the corresponding vertical expert module.

[0073] This implementation calculates the first attention factor by combining the vector product and the sequence length, and then integrates the second attention factor obtained during training (indicating the static preferences of experts) to generate a comprehensive attention score. This allows expert selection to consider both dynamic sequence features and long-term preferences, improving routing accuracy. The normalized attention score is used as a weight parameter to ensure that the contribution ratio of the selected experts to the vertical score is reasonable and to optimize the reliability of abnormal scores.

[0074] Specifically, for the original time series, preprocessing operations such as missing value handling and standardization are first performed. Then, the processed time series is used as input for experts, including shared experts and routing experts. All time series are subjected to anomaly detection by the shared expert network. Furthermore, after passing through a gating network, the top-k experts are selected from K_r routing experts to perform anomaly detection on the time series. The formula for the attention gating network is shown below:

[0075] For time series (t represents time, d is the length of the time series), query projection For each routing expert Given learnable expert keys The expert's attention score for the time series was:

[0076] .

[0077] Only the k experts with the highest attention scores will be selected as routing experts, and their corresponding weights are represented as follows:

[0078] ,

[0079]

[0080] in These are learnable parameters used to capture the static preferences of expert i.

[0081] Finally, the outlier scores of each expert are weighted to obtain the final outlier score:

[0082]

[0083] in This represents the anomaly detection model for each expert. Indicates the number of shared experts. Represents the total number of experts

[0084] Anomaly scores can be used to determine abnormal situations. By setting thresholds based on anomaly scores and actual task conditions, it is possible to determine whether the current time point is abnormal by checking whether the threshold is exceeded.

[0085] As an optional implementation, the training process of the hybrid expert framework includes:

[0086] In the first stage, the parameters of the shared expert module, the vertical expert module, and the attention gating network are jointly updated on the source scene dataset.

[0087] In the second stage, the parameters of the shared expert module are frozen on the target scene dataset corresponding to the target time series, and the parameters of the vertical expert module and the attention gating network are updated.

[0088] The anomaly detection framework employs a two-stage training process: pre-training and fine-tuning. In the pre-training stage, anomaly patterns are learned from the source scene by optimizing all model parameters. In the fine-tuning stage, the shared expert remains fixed, while the gating network and routing expert are updated to adapt to the target scene.

[0089] This implementation adopts a two-stage training process: the first stage jointly optimizes all parameters in the source scene, enabling shared experts to learn common features across scenes; the second stage freezes the shared experts and only fine-tunes the vertical experts and gating network in the target scene, using a small amount of target data to quickly adapt to scene characteristics, which avoids the overhead of repeatedly training the basic model and solves the problem of transfer failure caused by distribution differences, significantly improving the cross-scene generalization efficiency of the framework.

[0090] As an optional implementation, the loss function of the training process includes a shared expert module loss function, a vertical expert module loss function, and a balanced loss function;

[0091] The balance loss function is used to indicate the overall importance of each vertical expert module within a preset time window. It is calculated by summing the product of the selection frequency and weight score of each vertical expert module within the preset time window and adjusting it with hyperparameter coefficients.

[0092] Specifically, the loss function design methods during training include:

[0093]

[0094]

[0095]

[0096]

[0097] in This represents the anomaly detection loss function for each expert, which can be customized. Represents the balancing loss term. The calculation of the balance loss term consists of two parts, where the hyperparameter coefficients are used. For each expert i, the frequency f_i of expert i being selected in the time window T and the weight score P_i in the time window T are calculated. Finally, the product of the frequency and the weight score of each expert i is summed to obtain the balance loss term.

[0098] This implementation monitors the overall importance of each vertical expert within a time window (the sum of the product of selection frequency and weight score) through a balanced loss function, and constrains the balance of expert utilization after adjusting the hyperparameter coefficients. This design prevents a few experts from being overactivated, which could lead to model degradation, and ensures that all experts continue to participate in pattern learning, thereby improving the stability and robustness of the model in long-term anomaly detection.

[0099] S103. Based on the relationship between the anomaly score and the preset anomaly threshold, determine the anomaly situation at the target time point in the target time series.

[0100] This implementation captures common anomaly patterns in time series through a shared expert module in the first branch of a hybrid expert framework, while the second branch uses an attention-gated network to dynamically activate vertical expert modules adapted to the characteristics of the current sequence. This enables the model to adapt to time series with dynamic behavior and heterogeneous patterns simultaneously, avoiding the limitation of a single model being unable to handle multi-modal data. By integrating the anomaly scores of shared scores and vertical scores, and combining them with preset thresholds, anomalies are accurately identified. This improves cross-scene adaptability while significantly reducing the resource overhead of training a separate model for each scene, thus balancing detection versatility and computational efficiency.

[0101] Therefore, in summary, compared with feasible implementation methods such as fine-tuning models after clustering and large model frameworks, this application achieves at least the following technical effects: On the one hand, based on the hybrid expert mechanism, it has the characteristics of conditional computation and sparse activation parameters, which has higher computational efficiency compared with large model frameworks with a large number of parameters; at the same time, the hybrid expert time series anomaly detection method, through the attention gating mechanism, makes full use of the matching and adaptation of each expert model to the time series, and does not rely on unstable methods of clustering.

[0102] This application also provides a time series anomaly detection device based on a hybrid expert framework, the device comprising:

[0103] The acquisition module is used to acquire the original time series and preprocess the original time series to obtain the target time series;

[0104] The processing module is used to input the target time series into the hybrid expert framework and determine the anomaly score corresponding to the target time series;

[0105] The hybrid expert framework includes a first branch and a second branch. The first branch determines a shared score through a shared expert module, and the second branch determines a preset number of vertical expert modules through an attention gating network, and determines a corresponding vertical score through each of the vertical expert modules.

[0106] The processing module is further configured to determine the abnormal situation of the target time point in the target time series based on the relationship between the abnormal score and the preset abnormal threshold.

[0107] This implementation captures common anomaly patterns in time series through a shared expert module in the first branch of a hybrid expert framework, while the second branch uses an attention-gated network to dynamically activate vertical expert modules adapted to the characteristics of the current sequence. This enables the model to adapt to time series with dynamic behavior and heterogeneous patterns simultaneously, avoiding the limitation of a single model being unable to handle multi-modal data. By integrating the anomaly scores of shared scores and vertical scores, and combining them with preset thresholds, anomalies are accurately identified. This improves cross-scene adaptability while significantly reducing the resource overhead of training a separate model for each scene, thus balancing detection versatility and computational efficiency.

[0108] As an optional implementation, the attention gating network is used for:

[0109] The target time series is converted into a query projection using a first matrix, and the expert key corresponding to each of the vertical expert modules is determined.

[0110] Based on the query projection, the expert key, and the time series length of the target time series, the attention score of each vertical expert module is determined;

[0111] Based on the attention score, a preset number of the vertical expert modules are selected.

[0112] This implementation converts the target time series into a query projection and interacts with the expert keys of each vertical expert module. It calculates the attention score based on the sequence length to achieve expert screening based on sequence characteristics. It dynamically selects a preset number of expert modules to avoid the overhead of calculating all experts. This retains the ability to distinguish heterogeneous patterns and reduces the computational load through sparse activation, thereby maintaining real-time detection efficiency in resource-constrained scenarios.

[0113] As an optional implementation, the processing module determines the attention score of each vertical expert module based on the query projection, the expert key, and the time series length of the target time series in a specific way, including:

[0114] The first attention factor is calculated based on the vector product of the query projection and the expert key, and the time series length of the target time series;

[0115] Based on the first attention factor and the second attention factor obtained during training corresponding to each of the vertical expert modules, the attention score of each vertical expert module is calculated.

[0116] Wherein, the second attention factor is used to indicate the degree of static preference of each of the vertical expert modules for the target time series;

[0117] Furthermore, the processing module is also used for:

[0118] The attention scores of the selected vertical expert modules are normalized and used as the weight parameters of the selected vertical expert modules.

[0119] The weighting parameter is used to determine the vertical score of the corresponding vertical expert module.

[0120] This implementation calculates the first attention factor by combining the vector product and the sequence length, and then integrates the second attention factor obtained during training (indicating the static preferences of experts) to generate a comprehensive attention score. This allows expert selection to consider both dynamic sequence features and long-term preferences, improving routing accuracy. The normalized attention score is used as a weight parameter to ensure that the contribution ratio of the selected experts to the vertical score is reasonable and to optimize the reliability of abnormal scores.

[0121] As an optional implementation, the processing module dynamically configures the preset quantity based on resource load conditions, specifically in the following ways:

[0122] The processor load rate and memory usage of each of the vertical expert modules are monitored in real time, and a dynamic configuration determination is performed every preset period based on the processor load rate or the memory usage rate.

[0123] When the processor load rate is higher than a first preset threshold, the preset quantity is reduced;

[0124] When the memory usage rate is lower than the second preset threshold, the preset quantity is increased.

[0125] This implementation dynamically adjusts the preset number of experts based on processor load and memory usage: reducing the number of activated experts to lower computational pressure under high load and increasing the number of experts to improve pattern coverage under low memory usage, thus achieving resource-adaptive expert scheduling; through periodic monitoring and dynamic configuration, it balances detection accuracy and system stability under resource fluctuations, meeting the deployment requirements of real-time monitoring systems.

[0126] As an optional implementation, the specific process by which the processing module trains the hybrid expert framework includes:

[0127] In the first stage, the parameters of the shared expert module, the vertical expert module, and the attention gating network are jointly updated on the source scene dataset.

[0128] In the second stage, the parameters of the shared expert module are frozen on the target scene dataset corresponding to the target time series, and the parameters of the vertical expert module and the attention gating network are updated.

[0129] This implementation adopts a two-stage training process: the first stage jointly optimizes all parameters in the source scene, enabling shared experts to learn common features across scenes; the second stage freezes the shared experts and only fine-tunes the vertical experts and gating network in the target scene, using a small amount of target data to quickly adapt to scene characteristics, which avoids the overhead of repeatedly training the basic model and solves the problem of transfer failure caused by distribution differences, significantly improving the cross-scene generalization efficiency of the framework.

[0130] As an optional implementation, the loss function of the training process includes a shared expert module loss function, a vertical expert module loss function, and a balanced loss function;

[0131] The balance loss function is used to indicate the overall importance of each vertical expert module within a preset time window. It is calculated by summing the product of the selection frequency and weight score of each vertical expert module within the preset time window and adjusting it with hyperparameter coefficients.

[0132] This implementation monitors the overall importance of each vertical expert within a time window (the sum of the product of selection frequency and weight score) through a balanced loss function, and constrains the balance of expert utilization after adjusting the hyperparameter coefficients. This design prevents a few experts from being overactivated, which could lead to model degradation, and ensures that all experts continue to participate in pattern learning, thereby improving the stability and robustness of the model in long-term anomaly detection.

[0133] It should be noted that the division of the various modules in the above device is merely a logical functional division. In actual implementation, they can be fully or partially integrated into a single physical entity, or they can be physically separated. Furthermore, these modules can be implemented entirely in software via processing element calls; they can be fully implemented in hardware; or some modules can be implemented by processing element calls to software, while others are implemented in hardware. For example, a processing module can be a separate processing element, or it can be integrated into a chip within the device. Alternatively, it can be stored as program code in the device's memory, and its functions can be called and executed by a processing element. The implementation of other modules is similar. Moreover, these modules can be fully or partially integrated together, or they can be implemented independently. The processing element here can be an integrated circuit with signal processing capabilities. During implementation, each step of the above method or each of the above modules can be completed through integrated logic circuits in the hardware of the processor element or through software instructions.

[0134] Indicatively, such as Figure 3 As shown, Figure 3 This is a schematic diagram of the internal structure of a computer device 300 provided in an embodiment of this application. The computer device 300 can be provided as a server. (Refer to...) Figure 3 The computer device 300 includes a processing component 302, which further includes one or more processors, and memory resources represented by memory 301 for storing instructions, such as application programs, that can be executed by the processing component 302. The application programs stored in memory 301 may include one or more modules, each corresponding to a set of instructions. Furthermore, the processing component 302 is configured to execute instructions to perform the methods of any of the embodiments described above.

[0135] The computer device 300 may also include a power supply component 303 configured to perform power management of the computer device 300, a wired or wireless network interface 304 configured to connect the computer device 300 to a network, and an input / output (I / O) interface 305. The computer device 300 may operate on an operating system stored in memory 301, such as Windows Server™, Mac OS X™, Unix™, Linux™, Free BSD™, or similar.

[0136] Those skilled in the art will understand that Figure 3 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0137] This application provides a storage medium storing computer-readable instructions that, when executed by one or more processors, cause the one or more processors to perform the method provided in any embodiment.

[0138] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0139] The various embodiments in this specification are described in a progressive manner. Each embodiment focuses on the differences from other embodiments. The various embodiments can be combined as needed, and the same or similar parts can be referred to each other.

[0140] The above description of the disclosed embodiments enables those skilled in the art to make or use this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A time series anomaly detection method based on a hybrid expert framework, characterized in that, The method includes: Obtain the original time series and preprocess the original time series to obtain the target time series; The target time series is input into a hybrid expert framework to determine the anomaly score corresponding to the target time series. The hybrid expert framework includes a first branch and a second branch. The first branch determines a shared score through a shared expert module, and the second branch determines a preset number of vertical expert modules through an attention gating network, and determines a corresponding vertical score through each of the vertical expert modules. Based on the relationship between the anomaly score and the preset anomaly threshold, the anomaly situation at the target time point in the target time series is determined.

2. The method according to claim 1, characterized in that, The attention gating network is used for: The target time series is converted into a query projection using a first matrix, and the expert key corresponding to each of the vertical expert modules is determined. Based on the query projection, the expert key, and the time series length of the target time series, the attention score of each vertical expert module is determined; Based on the attention score, a preset number of the vertical expert modules are selected.

3. The method according to claim 2, characterized in that, The step of determining the attention score of each vertical expert module based on the query projection, the expert key, and the time series length of the target time series includes: The first attention factor is calculated based on the vector product of the query projection and the expert key, and the time series length of the target time series; Based on the first attention factor and the second attention factor obtained during training corresponding to each of the vertical expert modules, the attention score of each vertical expert module is calculated. Wherein, the second attention factor is used to indicate the degree of static preference of each of the vertical expert modules for the target time series; Furthermore, the method further includes: The attention scores of the selected vertical expert modules are normalized and used as the weight parameters of the selected vertical expert modules. The weighting parameter is used to determine the vertical score of the corresponding vertical expert module.

4. The method according to claim 2, characterized in that, The preset quantity is dynamically configured based on resource load conditions, specifically including: The processor load rate and memory usage of each of the vertical expert modules are monitored in real time, and a dynamic configuration determination is performed every preset period based on the processor load rate or the memory usage rate. When the processor load rate is higher than a first preset threshold, the preset quantity is reduced; When the memory usage rate is lower than the second preset threshold, the preset quantity is increased.

5. The method according to any one of claims 1-4, characterized in that, The training process of the hybrid expert framework includes: In the first stage, the parameters of the shared expert module, the vertical expert module, and the attention gating network are jointly updated on the source scene dataset. In the second stage, the parameters of the shared expert module are frozen on the target scene dataset corresponding to the target time series, and the parameters of the vertical expert module and the attention gating network are updated.

6. The method according to claim 5, characterized in that, The loss functions in the training process include the shared expert module loss function, the vertical expert module loss function, and the balance loss function; The balance loss function is used to indicate the overall importance of each vertical expert module within a preset time window. It is calculated by summing the product of the selection frequency and weight score of each vertical expert module within the preset time window and adjusting it with hyperparameter coefficients.

7. A time series anomaly detection device based on a hybrid expert framework, characterized in that, The device includes: The acquisition module is used to acquire the original time series and preprocess the original time series to obtain the target time series; The processing module is used to input the target time series into the hybrid expert framework and determine the anomaly score corresponding to the target time series; The hybrid expert framework includes a first branch and a second branch. The first branch determines a shared score through a shared expert module, and the second branch determines a preset number of vertical expert modules through an attention gating network, and determines a corresponding vertical score through each of the vertical expert modules. The processing module is further configured to determine the abnormal situation of the target time point in the target time series based on the relationship between the abnormal score and the preset abnormal threshold.

8. The apparatus according to claim 7, characterized in that, The attention gating network is used for: The target time series is converted into a query projection using a first matrix, and the expert key corresponding to each of the vertical expert modules is determined. Based on the query projection, the expert key, and the time series length of the target time series, the attention score of each vertical expert module is determined; Based on the attention score, a preset number of the vertical expert modules are selected.

9. A computer device, characterized in that, The method includes one or more processors and a memory storing computer-readable instructions that, when executed by the one or more processors, perform the steps of the method as described in any one of claims 1-6.

10. A storage medium, characterized in that, The storage medium stores computer-readable instructions that, when executed by one or more processors, cause the one or more processors to perform the steps of the method as described in any one of claims 1-6.

Images