Government affair system operation monitoring multi-dimensional time sequence data anomaly detection method and device

Abstract

This invention discloses a method and apparatus for anomaly detection of multi-dimensional time-series data in e-government system operation monitoring, comprising: fusing preliminary prediction results with multi-dimensional time-series data from e-government systems or e-government cloud platforms as input through a cascaded feedback module; extracting temporal features from the multi-dimensional time-series data using a reparameterized temporal convolutional network in the time branch; treating the multi-dimensional time-series data as a graph at each time step in the spatial branch, with each monitoring indicator as a node in the graph, and constructing a fully connected graph between nodes using a fully connected approach, with a graph attention network running on the fully connected graph, adaptively weighting the fully connected edges by calculating attention coefficients, and obtaining the final spliced ​​spatial features through a multi-head attention mechanism; fusing the temporal features in the time branch and the final spatial feature representation output by the spatial branch in a gated fusion module, and outputting the fused features; and generating the final prediction result through encoding and decoding using a lightweight transformer encoding / decoding module.

Description

Technical Field

[0001] This invention relates to the field of multidimensional time-series data anomaly detection, and in particular to a method and apparatus for multidimensional time-series data anomaly detection for government system operation monitoring. Background Technology

[0002] With the development of network data, which carries massive amounts of public services and critical business processes, its stable, efficient, and secure operation is the cornerstone for ensuring the performance of functions, improving the level of public services, and maintaining social stability.

[0003] To ensure system operation, the cloud center deployed a massive number of monitoring probes, forming a three-dimensional sensing network covering computing, network, storage, database, and application layers. These probes generated a wealth of multi-dimensional time-series data, such as server CPU utilization, memory usage, network throughput, database query response time, API (Application Programming Interface) call success rate, and application log error data. This data collectively depicts the real-time "vital signs" of the entire electronic system.

[0004] However, these performance metrics do not exist in isolation, but are tightly coupled through complex business logic and technical architecture. For example, a performance bottleneck in a core application on a service platform may initially manifest as only a slight increase in the number of slow queries in the relevant database, minor congestion in the middleware queue, and a coordinated increase in front-end API response time. Such system-level interconnected anomalies are difficult to detect using traditional single-point threshold alerts (e.g., CPU usage exceeding 90%). Similarly, a potential network attack or data breach may also present early signs as subtle, coordinated anomalies in multiple system metrics.

[0005] Existing monitoring methods lack the ability to model such cross-indicator and cross-system correlation anomalies, resulting in delays in the discovery of events such as performance bottlenecks in government systems, potential application failures, and data security risks, which may lead to service interruptions and data leaks.

[0006] Therefore, a new technology is needed that can intelligently analyze the complex spatiotemporal correlations among multidimensional indicators of government systems, thereby enabling accurate, early, and system-level anomaly detection of their operational status. Summary of the Invention

[0007] This invention provides a method and apparatus for detecting anomalies in multi-dimensional time-series data for monitoring the operation of government systems. Based on a two-stage spatiotemporal attention network (TSA-Net), this invention addresses the problems of insufficient modeling of cross-indicator correlations, high model deployment costs, and untimely detection of potential anomalies in existing technologies. Details are described below: A method for detecting anomalies in multi-dimensional time-series data for monitoring the operation of government systems, the method comprising: The features of gated fusion are encoded and decoded by a lightweight transducer encoding / decoding module to generate preliminary prediction results. ; and the preliminary prediction results are transmitted through a cascading feedback module. It is integrated with multi-dimensional time-series data from e-government systems or e-government cloud platforms as input; The temporal branch uses a reparameterized temporal convolutional network to extract temporal features from multidimensional temporal data; Spatial branching treats multidimensional time series data as a graph at each time step, The monitoring indicators are used as a graph. Nodes The nodes are connected to construct a fully connected graph. The graph attention network runs on the fully connected graph. The fully connected edges are adaptively weighted by calculating attention coefficients, and the final spatial features after splicing are obtained through a multi-head attention mechanism. The gated fusion module fuses the temporal features from the time branch and the final spatial feature representation from the spatial branch, outputting the fused features. The lightweight transformer encoding / decoding module then encodes and decodes these features to generate the final prediction result. .

[0008] The reparameterized temporal convolutional network includes: a first-stage local temporal convolutional network and a second-stage global temporal convolutional network; In local temporal convolutional networks, the dilation rate is fixed at 1 per layer. In global temporal convolutional networks, the dilation rate is... With network layers Exponential growth, .

[0009] The graph attention network dynamically assigns weights to each edge through a self-attention mechanism, capturing the real-time correlation between indicators.

[0010] The fusion is as follows:

[0011] in, For feature splicing dimensions, For batch size, For the number of features, For each sequence length, a fusion gate weight is dynamically generated for each time step and feature dimension using a one-dimensional convolutional network Conv1d with a kernel size of 1 and a sigmoid activation function. :

[0012] Final fusion features By analyzing time series characteristics and spatial feature representation By performing a weighted summation, a dynamic trade-off between the two types of information is achieved:

[0013] In the formula, ⊙ represents element-wise multiplication.

[0014] The method uses LeakyReLU as the activation function:

[0015] in, , and , The weights and biases of the first and second fully connected layers are respectively; an additional fully connected layer and residual connection are introduced to enhance the initial representation, resulting in the final encoded representation; a lightweight decoder consisting of a single linear layer and a sigmoid activation function is used to map the final encoded representation back to the original data space to generate the prediction result. .

[0016] The method uses the prediction results generated via a lightweight Transformer codec. As a correction signal for the original input.

[0017] The second aspect is a device for detecting anomalies in multi-dimensional time-series data for monitoring the operation of government systems. The device includes a processor and a memory, wherein the memory stores program instructions, and the processor calls the program instructions stored in the memory to cause the device to execute the method described in any one of the first aspects.

[0018] Third aspect, a computer-readable storage medium storing a computer program, the computer program including program instructions that, when executed by a processor, cause the processor to perform the method described in any one of the first aspects.

[0019] The beneficial effects of the technical solution provided by this invention are: 1. High detection accuracy and low false negative rate: Through spatiotemporal dual-branch parallel modeling and gating fusion, the complex spatiotemporal dependencies between indicators are accurately captured; the sensitivity to weak, system-level anomalies is enhanced through a two-stage cascaded feedback structure. 2. High model efficiency and low deployment cost: The RepVGG-TCN (Heavily Parameterized Temporal Convolutional Network) structure used in the time branch achieves "complexity during training and high efficiency during inference". Combined with the lightweight Transformer module, it greatly reduces the computational overhead and is easy to deploy in resource-constrained edge devices or scenarios requiring real-time response. 3. Strong generalization ability and good adaptability: The introduction of an optimization strategy based on model-independent meta-learning (MAML) enables the model to learn quickly from sparse abnormal data and adapt quickly to new monitoring scenarios or data distributions. 4. Automated threshold setting and strong robustness: The abnormal threshold is automatically determined by adopting the POT (peak value exceeding threshold) method based on extreme value theory, which avoids the subjectivity and instability of manual setting and improves the robustness of the detection device. Attached Figure Description

[0020] Figure 1 A flowchart for a method of detecting anomalies in multi-dimensional time-series data for monitoring the operation of government systems; Figure 2 A visualization of the prediction results. Detailed Implementation

[0021] To make the objectives, technical solutions, and advantages of the present invention clearer, the embodiments of the present invention will be described in further detail below.

[0022] Example 1 A method for detecting anomalies in multi-dimensional time-series data for monitoring the operation of government systems, see [link to relevant documentation]. Figure 1 The method includes: The features of gated fusion are encoded and decoded by a lightweight transducer encoding / decoding module to generate preliminary prediction results. ; and the preliminary prediction results are transmitted through a cascading feedback module. It is integrated with multi-dimensional time-series data from e-government systems or e-government cloud platforms as input; The temporal branch uses a reparameterized temporal convolutional network to extract temporal features from multidimensional temporal data; Spatial branching treats multidimensional time series data as a graph at each time step, The monitoring indicators are used as a graph. Nodes The nodes are connected to construct a fully connected graph. The graph attention network runs on the fully connected graph. The fully connected edges are adaptively weighted by calculating attention coefficients, and the final spatial features after splicing are obtained through a multi-head attention mechanism. The gated fusion module fuses the temporal features from the time branch and the final spatial feature representation from the spatial branch, outputting the fused features. The lightweight transformer encoding / decoding module then encodes and decodes these features to generate the final prediction result. .

[0023] The reparameterized temporal convolutional network consists of a first-stage local temporal convolutional network and a second-stage global temporal convolutional network. In local temporal convolutional networks, the dilation rate is fixed at 1 per layer. In global temporal convolutional networks, the dilation rate is... With network layers Exponential growth, .

[0024] Graph attention networks dynamically assign weights to each edge through a self-attention mechanism, capturing the real-time correlation between metrics.

[0025] Merge into:

[0026] in, For feature splicing dimensions, For batch size, For the number of features, For each sequence length, a fusion gate weight is dynamically generated for each time step and feature dimension using a one-dimensional convolutional network Conv1d with a kernel size of 1 and a sigmoid activation function. :

[0027] Final fusion features By analyzing time series characteristics and spatial feature representation By performing a weighted summation, a dynamic trade-off between the two types of information is achieved:

[0028] In the formula, ⊙ represents element-wise multiplication.

[0029] The method uses LeakyReLU as the activation function:

[0030] in, , and , The weights and biases of the first and second fully connected layers are respectively; an additional fully connected layer and residual connection are introduced to enhance the initial representation, resulting in the final encoded representation; a lightweight decoder consisting of a single linear layer and a sigmoid activation function is used to map the final encoded representation back to the original data space to generate the prediction result. .

[0031] The prediction results generated by the lightweight Transformer codec As a correction signal for the original input.

[0032] In summary, the embodiments of the present invention, based on a two-stage spatiotemporal attention network, solve the problems of insufficient modeling of cross-index correlation, high model deployment costs, and untimely detection of potential anomalies in the prior art.

[0033] Example 2 The feasibility of the scheme in Example 1 is verified below using specific experimental data and calculation formulas, as detailed in the following description: In this embodiment of the invention, the input data is multidimensional time-series data from an e-government system or a government cloud platform. For example: from a government service platform Each monitoring indicator in continuous Readings at each time step, these metrics can include: server CPU utilization, database response time, network traffic, etc. This data can be represented as a matrix. The objective of this invention is to learn... It can determine the normal operating mode, predict its future state, and identify abnormal events based on prediction deviations, application performance bottlenecks, potential system failures, or security risks.

[0034] First, in order to eliminate the dimensional differences between different monitoring indicators, it is necessary to process the raw data. Each column (i.e., each indicator) is subjected to Min-Max normalization, mapping the values ​​to... The interval is calculated using the following formula: (1) In the formula, It is the value of the original data. and Calculate separately The minimum and maximum values ​​within the entire feature column. It is the normalized value. The denominator is a very small positive number to prevent it from being zero. Next, a sliding window method is used to transform the processed sequence into a fixed-length window sequence, which facilitates capturing temporal dependencies. The processed samples are then fed into the temporal and spatial branches in parallel.

[0035] I. Time Branches The temporal branch employs a reparameterized temporal convolutional network (RepVGG-TCN) to extract temporal features. The RepVGG-TCN of this invention is divided into a first-stage local TCN and a second-stage global TCN. In the local TCN, the dilation rate is fixed at 1 per layer. In the global TCN, to obtain a large receptive field, the dilation rate is... With network layers Exponential growth, To ensure strict temporal causality, meaning the prediction depends only on past information, left padding is required before convolution. The padding length is... Calculated by the following formula: (2) Where k is the kernel size.

[0036] The innovation of RepVGG-TCN lies in its parallel use of three branches—3x1 convolution, 1x1 convolution, and identity mapping—during training to enhance the model's learning ability. During inference, through structural reparameterization, the parameters of these three branches are algebraically merged into a single 3x1 convolution kernel, achieving "complexity during training and efficiency during inference," which greatly improves the model's deployment efficiency.

[0037] II. Spatial Branches The spatial branch treats the input samples as a graph at each time step, where... The monitoring indicators are used as a graph. Nodes In this embodiment of the invention, a fully connected graph is constructed. The Graph Attention Network (GAT) dynamically assigns weights to each edge through a self-attention mechanism to capture the real-time correlation between metrics.

[0038] First, for the node Calculate an attention score with its neighbor node j. : (3) In the formula, It is a node The feature vector (i.e., its time series segment). It is a shared linear transformation weight matrix. It is the weight vector of a single-layer feedforward network. This represents vector concatenation, where T is the transpose operation. R is the activation function; R is the mathematical dimension; and W is the window length.

[0039] Then, the attention scores of all neighbors of a node are normalized using the softmax function to obtain the attention weights. : (4) In the formula, It is a node The set of all neighbors, It is the attention score between the node and its neighboring nodes, where k is the number of neighboring nodes.

[0040] To enhance stability, this embodiment of the invention employs a multi-head attention mechanism. The core idea is parallel execution. Each attention head performs an independent attention calculation, and then the results are integrated. In the middle, node Updated features It is obtained by weighted aggregation of neighbor features, and the calculation process is as follows: (5) Multiple results splicing: In After calculating all the individual items, they were obtained. New feature vectors arrive The features are then combined to form a richer and more powerful final feature representation. : (6) Where F is the dimension of the concatenated feature vector; This is a vector concatenation operation.

[0041] III. Gating Integration To effectively integrate the temporal features in the first time branch The final spatial feature representation of the second part output In this embodiment of the invention, a gating fusion module is designed.

[0042] First, the two are concatenated along the feature dimension: (7) in, For feature splicing dimensions, For batch size, For the number of features, The sequence length is given. Then, a fusion gate weight is dynamically generated for each time step and feature dimension using a one-dimensional convolutional network Conv1d with a kernel size of 1 and a sigmoid activation function. : (8) Final fusion features Through the and By performing a weighted summation, a dynamic trade-off between the two types of information is achieved: (9) In the formula, ⊙ represents element-wise multiplication.

[0043] IV. Lightweight Encoding and Decoding To further capture long-range temporal dependencies in fused features, this invention proposes a lightweight Transformer module, whose core components include: Adaptive multi-head self-attention: Standard Transformer uses a fixed number of heads. To improve the model's adaptability and efficiency, this embodiment of the invention proposes a dynamic head count strategy. Specifically, the head count... Instead of fixed hyperparameters, they are based on the dimensionality of the input features. Dynamic settings: Set as The largest true factor (if) If it is a prime number, then This strategy aims to automatically match computational resources to features of varying complexity, significantly reducing redundant computations while maintaining the model's expressive power. In the adaptive multi-head attention mechanism of this invention, the basic computation of each attention head follows the standard scaled dot product attention model: (10) in, , , These represent the query, key, and value matrices, respectively. for and Dimensions.

[0044] Improved Feedforward Network (Modified FFN): Output at attention sublayer The standard position-independent feedforward network (FFN) was then fine-tuned. LeakyReLU was used as the activation function to enhance the model's response to weak nonlinear anomalies commonly found in real-world scenarios, as defined below: (11) in, , and , These are the weights and biases for the first and second fully connected layers, respectively.

[0045] After obtaining the initial encoded representation, an additional fully connected (FC) layer is introduced with residual connections to enhance sensitivity to weak anomalies, thus strengthening the initial representation and yielding the final encoded representation. Finally, a lightweight decoder consisting of a single linear layer and a sigmoid activation function is used to map the final encoded representation back to the original data space, generating the prediction result. .

[0046] V. Cascade Feedback The feedback loop is the key difference between this invention's embodiments and traditional single-stage models. This invention's embodiments do not directly use the first-stage prediction results generated by the simplified lightweight Transformer codec. Instead of treating it as the final output, it is considered as a correction signal to the original input. The second-stage enhanced input is generated using the following formula. : (12) in, Dimensional permutation, used for swapping The time and feature dimensions are defined, with X as the original input. This design implicitly superimposes the prediction residual information from the first stage back into the input. This allows the second-stage network to focus on learning and correcting subtle or complex anomalous patterns that the first stage failed to capture.

[0047] Subsequently, enhanced input The data is fed into a network with the exact same structure as the first stage (containing independent dual-branch extraction, fusion, and encoding / decoding modules), which outputs the final, more accurate prediction results. .

[0048] VI. Joint Supervision and Training To achieve end-to-end optimization, a joint supervised objective function is adopted. Specifically, the preliminary prediction loss for the first stage is calculated separately. and the second-stage predicted loss after residual feedback correction These two losses, based on mean squared error (MSE), are weighted and combined to form the final optimization objective: (13) In the formula, and These are the learnable parameters of the first and second stage networks, respectively. Hyperparameters (such as) ), used to give higher priority to the first phase of refactoring tasks.

[0049] VII. Meta-learning This invention utilizes a model-independent meta-learning (MAML)-based optimization strategy to enhance the model's generalization ability in sparse data environments, enabling the model to quickly adapt to new data distributions. For each time window batch... In this embodiment of the invention, it is treated as an independent learning task. Model parameters In-task adaptation update : (14) in, The learning rate is controlled by the optimizer. For parameters Find the gradient. It is for batches Weighted reconstruction loss, Let be the prediction function. This single-step adaptation mechanism enables the model to quickly capture key information in each batch, especially when anomalous patterns are sparsely distributed. This embodiment of the invention achieves meta-level knowledge integration through a learning rate scheduler, which can be formalized as: (15) in, For the number of training rounds, It is a periodic learning rate that is dynamically adjusted as training progresses. (16) here This is the learning rate decay factor. The updated prediction function within the task. This represents the total number of training rounds.

[0050] This method updates the model immediately after each batch, enabling it to quickly acquire knowledge from the current task. This mechanism allows the model to continuously adjust its attention mechanism and feature extraction capabilities during training.

[0051] VIII. Anomaly Scoring Calculation When the model is faced with new time window data When w is the window size and m is the feature dimension, it generates a predicted representation through two-stage reconstruction: (17) in, These represent the outputs of the first and second phases of reconstruction, respectively. For parameters Neural network operations.

[0052] Subsequently, the weighted reconstruction bias was calculated as an anomaly score. : (18) in, These are reconstruction weights, used to balance the importance of the two reconstruction stages. Indicates the first The first time step (moment) The observed values ​​(or characteristic values) of each monitoring indicator are expressed as row norms, and the deviation is calculated separately for each time step. Indicates the first stage in Time of the first Reconstructed values ​​of each monitoring indicator Indicates the second stage in Time of the first Reconstructed values ​​of each monitoring indicator.

[0053] IX. Threshold Setting To avoid manually setting a fixed threshold, this invention introduces the POT (Peaks Over Threshold) method based on extreme value theory. This method assumes that the threshold is exceeded. The outlier scores follow a generalized Pareto distribution (GPD): (19) in, Indicates abnormal scores Greater than the initial threshold But less than or equal to a certain specific value The probability, and The shape and scale parameters are obtained through maximum likelihood estimation. Based on the anomaly scores calculated on the training set, the final threshold is determined using the following formula. : (20) here, It is the expected probability of an anomaly. It is the total number of samples. This refers to the number of samples exceeding the initial threshold. For multidimensional time series, this embodiment of the invention calculates the threshold for each dimension separately, and then identifies system-level anomalies: (twenty one) in, and Indicates the first The first time step Whether anomalies were detected in each dimension and their anomaly scores. Indicates the first Does a system-level anomaly occur at each time step? Indicates the first The final threshold for each feature dimension, where m represents the total number of features.

[0054] In summary, the embodiments of the present invention, by combining efficient RepVGG-TCN, accurate GAT, dynamic gating fusion, and an innovative two-stage cascading feedback mechanism, successfully solve the problem of detecting complex, system-level abnormal events in the operation monitoring of government cloud centers, and significantly improve the accuracy and sensitivity of detection while ensuring high efficiency.

[0055] Example 3 To evaluate the performance of the proposed network model, embodiments of the present invention use... , , , Training time and training efficiency are used as evaluation metrics. Measuring how many events predicted as anomalous by the model are actually anomalous reflects the model's accuracy. Measuring how many real-world anomalies are successfully detected by the model reflects the model's detection capability or sensitivity. Precision score is a metric for evaluating the performance of a binary classification model; a higher score indicates a stronger ability to distinguish between positive and negative samples. F1 score is the harmonic mean of precision and recall, representing the model's robustness. A higher F1 score indicates better robustness. Training Time records the average time (in seconds) required for the model to complete one epoch of training, used to assess the model's computational efficiency and feasibility for practical deployment. The above metrics are defined as follows: (twenty two) (twenty three) (twenty four) in, Indicates the number of samples; These are the positive samples that the model classifies as positive. This indicates that negative samples are classified as positive samples; This indicates that a positive sample is classified as a negative sample.

[0056] To demonstrate the accuracy and efficiency of the method of this invention, a comprehensive comparison of prediction results with ten other mainstream or state-of-the-art anomaly detection models was conducted on three internationally recognized multivariate time series anomaly detection benchmark datasets: SMAP (Soil Moisture Active and Passive Satellite Telemetry Data), MSL (Mars Science Laboratory Rover Telemetry Data), and SMD (Server Cluster Monitoring Data). These datasets simulate the operational states of multiple sensors / indicators in complex systems. The SMD dataset, in particular, is highly similar to and representative of the government cloud center operation monitoring scenario addressed in this invention's embodiments. SMAP and MSL, as recognized benchmarks, were used to verify the universality and robustness of the method of this invention in processing different types of complex multidimensional time series data. Tables 1, 2, and 3 show the performance of all compared models on the SMD, SMAP, and MSL datasets, respectively. The last row represents the experimental results of the model proposed in this invention's embodiments, while the others represent experimental results of some common and state-of-the-art network models.

[0057] A comprehensive analysis of the evaluation metrics in Tables 1-3 reveals that the model proposed in this invention exhibits significant advantages in overall performance. Across the three datasets, it demonstrates superior performance in Precision, Recall, AUC, and F1. This indicates that the proposed model not only accurately identifies anomalies in multivariate time-series anomaly detection tasks but also minimizes false negatives. This fully demonstrates the superior ability of the proposed two-stage spatiotemporal attention architecture in capturing anomalous patterns in complex systems.

[0058] Table 1 Table 2 Table 3 Furthermore, Table 4 shows the training efficiency of some representative models on the SMD dataset. It can be seen that the training time of this embodiment is only 13.63 seconds per epoch, far lower than other models. In particular, compared with MTAD-GAT (1312.82 seconds) and GDN (161.99 seconds), which also use spatiotemporal joint modeling, the efficiency is improved by nearly 100 times. This result strongly demonstrates that this invention, by employing heavily parameterized convolution (RepVGG-TCN) and lightweight Transformer designs, significantly reduces the computational complexity of the model while maintaining high accuracy, giving it great potential for efficient training and deployment in scenarios with extremely high real-time requirements, such as government cloud platforms and critical e-government systems.

[0059] Table 4 The figure below shows its detection results in the first three dimensions of the SMD dataset. The figure compares the model's predictions, the calculated anomaly scores, and the actual anomaly events. In the non-anomaly time period (i.e., the area covered by the shaded bars in the figure), the actual data and the predicted data highly overlap, indicating that the model has successfully learned the normal dynamic pattern and has not generated false positives; at this time, the anomaly score curve below remains at a low level close to zero.

[0060] When data enters an anomaly zone, such as the area around timestamps 17000 to 21000, the actual data fluctuates drastically and deviates significantly from the normal pattern. Despite this, the model's predicted data maintains its original stable trend, resulting in a significant residual between the predicted and actual values, causing a sharp rise in the anomaly score curve below. When the anomaly score exceeds a preset threshold, the system identifies that time period as an anomaly and marks it in the graph. As can be seen from the graph, the anomaly-marked areas in the model's output highly coincide with the periods of drastic data fluctuation, demonstrating the consistency of the model's detection.

[0061] Furthermore, the model's performance aligns with the 99.81% F1-score results in Table 1, providing strong evidence for its effectiveness. It's worth noting that in dimension 0 (after timestamp 25000), the model labeled a small predicted anomaly, but no true anomaly label was found, potentially indicating a false positive and reflecting the model's sensitivity to minor fluctuations. On the other hand, this could also suggest the existence of unlabeled minor anomalies in the data annotation. The multi-dimensional analysis demonstrates the model's robustness, showcasing its ability to capture anomalies and enhancing the reliability of the detection results. This ability to capture subtle fluctuations and co-variations is particularly crucial for identifying hidden performance bottlenecks and early failures in government systems.

[0062] Example 4 A device for detecting anomalies in multi-dimensional time-series data for monitoring the operation of government systems includes a processor and a memory. The memory stores program instructions, and the processor calls the program instructions stored in the memory to cause the device to execute the following method steps in Embodiment 1: The features of gated fusion are encoded and decoded by a lightweight transducer encoding / decoding module to generate preliminary prediction results. ; and the preliminary prediction results are transmitted through a cascading feedback module. It is integrated with multi-dimensional time-series data from e-government systems or e-government cloud platforms as input; The temporal branch uses a reparameterized temporal convolutional network to extract temporal features from multidimensional temporal data; Spatial branching treats multidimensional time series data as a graph at each time step, The monitoring indicators are used as a graph. Nodes The nodes are connected to construct a fully connected graph. The graph attention network runs on the fully connected graph. The fully connected edges are adaptively weighted by calculating attention coefficients, and the final spatial features after splicing are obtained through a multi-head attention mechanism. The gated fusion module fuses the temporal features from the time branch and the final spatial feature representation from the spatial branch, outputting the fused features. The lightweight transformer encoding / decoding module then encodes and decodes these features to generate the final prediction result. .

[0063] The reparameterized temporal convolutional network includes: a first-stage local temporal convolutional network and a second-stage global temporal convolutional network; In local temporal convolutional networks, the dilation rate is fixed at 1 per layer. In global temporal convolutional networks, the dilation rate is... With network layers Exponential growth, .

[0064] Among them, the graph attention network dynamically assigns weights to each edge through a self-attention mechanism to capture the real-time correlation between indicators.

[0065] The fusion is as follows:

[0066] in, For feature splicing dimensions, For batch size, For the number of features, For each sequence length, a fusion gate weight is dynamically generated for each time step and feature dimension using a one-dimensional convolutional network Conv1d with a kernel size of 1 and a sigmoid activation function. :

[0067] Final fusion features By analyzing time series characteristics and spatial feature representation By performing a weighted summation, a dynamic trade-off between the two types of information is achieved:

[0068] In the formula, ⊙ represents element-wise multiplication.

[0069] LeakyReLU is used as the activation function.

[0070] in, , and , The weights and biases of the first and second fully connected layers are respectively; an additional fully connected layer and residual connection are introduced to enhance the initial representation, resulting in the final encoded representation; a lightweight decoder consisting of a single linear layer and a sigmoid activation function is used to map the final encoded representation back to the original data space to generate the prediction result. .

[0071] The prediction results generated by the lightweight Transformer codec As a correction signal for the original input.

[0072] It should be noted that the device descriptions in the above embodiments correspond to the method descriptions in the embodiments, and the embodiments of the present invention will not be repeated here.

[0073] The execution entities of the aforementioned processor and memory can be devices with computing functions such as computers, microcontrollers, and single-chip microcomputers. In specific implementations, the embodiments of the present invention do not limit the execution entities and can select them according to the needs of actual applications.

[0074] Data signals are transmitted between the memory and the processor via a bus, which will not be elaborated upon in this embodiment of the invention.

[0075] Based on the same inventive concept, embodiments of the present invention also provide a computer-readable storage medium, the storage medium including a stored program, which, when the program is running, controls the device where the storage medium is located to execute the method steps in the above embodiments.

[0076] The computer-readable storage medium includes, but is not limited to, flash memory, hard disk, solid-state drive, etc.

[0077] It should be noted that the description of the readable storage medium in the above embodiments corresponds to the description of the method in the embodiments, and the embodiments of the present invention will not be repeated here.

[0078] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. A computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the flow or function according to the embodiments of the present invention is generated.

[0079] The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. Computer instructions can be stored in or transmitted through a computer-readable storage medium. The computer-readable storage medium can be any usable medium accessible to a computer or a data storage device such as a server or data center that integrates one or more usable media. The usable medium can be a magnetic medium or a semiconductor medium, etc. Unless otherwise specified, the model numbers of the devices in this embodiment of the invention are not limited; any device capable of performing the above functions is acceptable.

[0080] Those skilled in the art will understand that the accompanying drawings are merely schematic diagrams of a preferred embodiment, and the sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0081] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for detecting anomalies in multi-dimensional time-series data for monitoring the operation of government systems, characterized in that, The method includes: The features of gated fusion are encoded and decoded by a lightweight transducer encoding / decoding module to generate preliminary prediction results. ; and the preliminary prediction results are transmitted through a cascading feedback module. It is integrated with multi-dimensional time-series data from e-government systems or e-government cloud platforms as input; The temporal branch uses a reparameterized temporal convolutional network to extract temporal features from multidimensional temporal data; Spatial branching treats multidimensional time series data as a graph at each time step, The monitoring indicators are used as a graph. Nodes The nodes are connected to construct a fully connected graph. The graph attention network runs on the fully connected graph. The fully connected edges are adaptively weighted by calculating attention coefficients, and the final spatial features after splicing are obtained through a multi-head attention mechanism. The gated fusion module fuses the temporal features from the time branch and the final spatial feature representation from the spatial branch, outputting the fused features. The lightweight transformer encoding / decoding module then encodes and decodes these features to generate the final prediction result. .

2. The method for detecting anomalies in multi-dimensional time-series data for monitoring the operation of government systems according to claim 1, characterized in that, The reparameterized temporal convolutional network includes: a first-stage local temporal convolutional network and a second-stage global temporal convolutional network; In local temporal convolutional networks, the dilation rate is fixed at 1 per layer. In global temporal convolutional networks, the dilation rate is... With network layers Exponential growth, .

3. The method for detecting anomalies in multi-dimensional time-series data for monitoring the operation of government systems according to claim 1, characterized in that, The graph attention network dynamically assigns weights to each edge through a self-attention mechanism, capturing the real-time correlation between indicators.

4. The method for detecting anomalies in multi-dimensional time-series data for monitoring the operation of government systems according to claim 1, characterized in that, The fusion is as follows: ； in, For feature splicing dimensions, For batch size, For the number of features, For each sequence length, a fusion gate weight is dynamically generated for each time step and feature dimension using a one-dimensional convolutional network Conv1d with a kernel size of 1 and a sigmoid activation function. : ； The final fusion features are obtained by analyzing temporal features. and spatial feature representation By performing a weighted summation, a dynamic trade-off between the two types of information is achieved: ； In the formula, ⊙ represents element-wise multiplication.

5. The method for detecting anomalies in multi-dimensional time-series data for monitoring the operation of government systems according to claim 1, characterized in that, The method uses LeakyReLU as the activation function: ； in, , and , The weights and biases of the first and second fully connected layers are respectively; an additional fully connected layer and residual connection are introduced to enhance the initial representation, resulting in the final encoded representation; a lightweight decoder consisting of a single linear layer and a sigmoid activation function is used to map the final encoded representation back to the original data space to generate the prediction result. .

6. The method for detecting anomalies in multi-dimensional time-series data for monitoring the operation of government systems according to claim 1, characterized in that, The method uses the prediction results generated via a lightweight Transformer codec. As a correction signal for the original input.

7. A device for detecting anomalies in multi-dimensional time-series data for monitoring the operation of government systems, characterized in that, The device includes a processor and a memory, the memory storing program instructions, the processor invoking the program instructions stored in the memory to cause the device to perform the method according to any one of claims 1-6.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, the computer program including program instructions that, when executed by a processor, cause the processor to perform the method described in any one of claims 1-6.

Images