A dual-branch time series anomaly detection method and system based on noise decomposition

Abstract

The application discloses a kind of double-branch time series anomaly detection method and system based on noise decomposition, belong to data mining, abnormal detection field.Single-variable time series of cloud service monitoring is collected to build training set, and after pretreatment, noise decomposition method is used to obtain the time series after denoising;The single-variable time series after pretreatment is simultaneously input into double-branch prediction network, and the range of normal point is predicted;Double-branch prediction network is trained and the best score threshold is optimized;Collect the single-variable time series to be detected, input into the double-branch prediction network after training, calculate total abnormal score, if total abnormal score exceeds the best score threshold, then determine that there is abnormality in the input single-variable time series.The application uses double-branch network structure to measure the abnormal state of time series from the two scales of long-term periodicity and short-term context, so that the model is more sensitive to different types of anomalies, effectively improves the ability of model detection anomaly.

Description

Technical Field

[0001] This invention belongs to the field of data mining and anomaly detection, specifically relating to a method and system for anomaly detection of periodic, contextually bi-branched time series based on noise decomposition. Background Technology

[0002] With the rapid development of cloud computing and other fields, an increasing number of critical systems rely on real-time monitoring and analysis of time-series data. Time-series data typically arrives continuously in streaming form, characterized by large scale, significant noise interference, obvious seasonal / periodic variations, and complex anomaly types (such as point anomalies, trend anomalies, and periodic mutations). This type of data is widely present in cloud service monitoring scenarios, mainly manifested as server traffic and CPU utilization. Time-series data places high demands on anomaly detection technologies in terms of real-time performance, high accuracy, and strong robustness. Since labeled data is often lacking in practical applications, and the definition of anomalies is highly context-dependent, unsupervised or weakly supervised learning methods have become an important research direction in this field.

[0003] In the broad field of time series anomaly detection, existing methods can be categorized into univariate and multivariate detection based on input data type, and into traditional and deep learning methods based on modeling approach, further divided into unsupervised and supervised categories. Traditional methods, such as k-nearest neighbor and sequence alignment based on similarity, local subsequence comparison based on sliding windows, STL methods based on decomposition, bias detection based on extremum theory, and Fourier transform in frequency domain analysis, are still widely used in scenarios with clear structures or scarce annotations due to their high computational efficiency and strong interpretability. With the development of deep learning, supervised methods such as SRCNN and TFAD can build classifiers using labeled data to achieve high accuracy, but their performance is limited by the scale and quality of the labeled data. Unsupervised methods, such as DONUT, VQRAE, and FCVAE, which are reconstruction models based on variational autoencoders, and Informer and Anomaly-Transformer, which are models based on prediction or self-attention mechanisms, achieve anomaly identification by mining the inherent structure or temporal dependencies of the data, and are particularly suitable for real-world environments lacking labels.

[0004] However, existing methods still have significant limitations. Many methods rely on future information for inference, leading to detection delays and making it difficult to meet the needs of real-time applications. Reconstruction-based methods, such as VAEs, often fail to accurately reconstruct anomalous segments due to a lack of anomalous samples and frequently ignore dependencies between time windows, resulting in performance degradation. Although models such as Transformer and LSTM perform well in multivariate time series detection, univariate sequences, due to their single feature dimension and limited contextual information, make it difficult for models to effectively learn temporal patterns. Existing methods generally face three major challenges: first, they need to accurately capture local change trends rather than just focusing on absolute numerical differences; second, they need to model periodic dynamic evolution processes rather than treating them as static structures; and third, they need to effectively identify normal patterns in high-noise environments. Therefore, this invention aims to address the above problems by proposing a more efficient, accurate, and applicable solution for real-time univariate time series anomaly detection. Summary of the Invention

[0005] To address the aforementioned issues, this invention proposes a method and system for detecting anomalies in periodic, context-dependent time series based on noise decomposition.

[0006] The technical solution adopted in this invention is as follows: In a first aspect, the present invention proposes a two-branch time series anomaly detection method based on noise decomposition, comprising the following steps: (1) Collect univariate time series of cloud service monitoring to build a training set. The univariate time series represents the change of server traffic or CPU utilization over time. Mark the abnormal points in the univariate time series and generate the corresponding abnormal indication mask. (2) The univariate time series is preprocessed and the noise decomposition method based on wavelet transform and median absolute deviation (MAD) is used to obtain the denoised time series; (3) The preprocessed univariate time series is simultaneously input into the dual-branch prediction network, which includes a periodic branch S-LSTM and a context branch C-LSTM, and the range of normal points is predicted by the two branches respectively. (4) Replace the points marked as abnormal in the original univariate time series with the corresponding values ​​in the denoised time series, while keeping the values ​​of normal points unchanged, to generate a corrected time series; based on the corrected time series and the prediction results of each branch in step (3), calculate the abnormal score of the periodic branch and the abnormal score of the context branch respectively; train the dual-branch prediction network with the goal of minimizing the total abnormal score; statistically analyze the distribution of the total abnormal score of the trained dual-branch prediction network on the validation set to determine the optimal score threshold for abnormal judgment; (5) Collect the univariate time series to be detected, input it into the trained bi-branch prediction network, calculate the total anomaly score, and if the total anomaly score exceeds the optimal score threshold, it is determined that there is an anomaly in the input univariate time series.

[0007] Furthermore, in the univariate time series collected in step (1), there are significantly more normal points than abnormal points.

[0008] Furthermore, in step (1), if the collected univariate time series does not contain labels, outlier points are injected into the original univariate time series, and corresponding outlier indicator masks are generated based on the injected outlier points.

[0009] Further, step (2) includes: (2-1) Normalize the univariate time series and fill in missing values. Use the selected wavelet basis and the preset decomposition level L to perform wavelet decomposition on the preprocessed original signal to obtain a set of approximate coefficients. and multi-scale detail coefficients from layer 1 to layer L ; (2-2) Based on the detail coefficients at each scale Median absolute bias estimates noise level The calculation formula is: ; Where Φ is the cumulative distribution function of the standard normal distribution. It is the detail coefficient at the i-th scale. It is the average; (2-3) Calculate the general threshold The calculation formula is: ; Where n represents the length of the original signal; (2-4) All detail coefficients are processed using the soft thresholding method, and the calculation formula is as follows: ; (2-5) Reconstruct the denoised signal using the approximation coefficients and the processed detail coefficients via inverse wavelet transform: .

[0010] Furthermore, in the periodic branch S-LSTM, the historical time series before the current time point is divided into multiple non-overlapping windows of a first predetermined length; the sequences of each non-overlapping window are transformed to the frequency domain through Fourier transform to obtain the first frequency domain features; the time domain statistical features of each non-overlapping window are used as covariates and concatenated with the first frequency domain features, and input into the first LSTM network to learn the evolution trend of long-term periodic patterns, and output the first predicted mean μ1 and variance σ1 to characterize the range of normal points; In the context branch C-LSTM, the historical time series before the current time point is divided into multiple overlapping windows of a second predetermined length; the sequences of each overlapping window are transformed to the frequency domain through Fourier transform to obtain the second frequency domain features; the time domain statistical features of each overlapping window are used as covariates and input to the second frequency domain features along with the second frequency domain features into the second LSTM network to learn the short-term context change trend, and output the second predicted mean μ2 and variance σ2 to characterize the range of normal points.

[0011] Furthermore, the time-domain statistical features are the original sequence values ​​for the entire window.

[0012] Furthermore, during the training phase, the anomaly scoring function is as follows: ; Here, mask is the anomaly indicator mask, with a mask value of 1 representing an outlier and a mask value of 0 representing a normal point; μ and σ are the predicted mean and standard deviation, respectively. It is the inverse of the mask. This represents element-wise multiplication. It is a preprocessed univariate time series. It is the time series after denoising.

[0013] Furthermore, during the inference phase, the anomaly scoring function is as follows: ; Where μ and σ are the predicted mean and standard deviation, It is the preprocessed univariate time series to be detected.

[0014] Secondly, this invention proposes a noise decomposition-based dual-branch time series anomaly detection system to implement the aforementioned noise decomposition-based dual-branch time series anomaly detection method.

[0015] Compared with the prior art, the beneficial effects of this invention are: (1) This invention adopts a time series decomposition method that is different from previous methods, and proposes a "noise decomposition" strategy to remove the "non-stationary" part of the time series, which helps the model to learn the normal pattern better and improve the anomaly detection capability; (2) A dual-branch network structure is adopted to measure the abnormal state of the time series from two scales: long-term periodicity and short-term context. This makes the model more sensitive to different types of anomalies and effectively improves the model's capabilities.

[0016] (3) Combining time and frequency domain analysis, the accuracy of anomaly detection in the model is improved by introducing covariates into the LSTM. Attached Figure Description

[0017] Figure 1 This is a schematic diagram of the framework of the noise decomposition-based dual-branch time series anomaly detection method of the present invention. Detailed Implementation

[0018] The present invention will be further described and illustrated below with reference to specific embodiments. The embodiments described are merely examples of the content of this disclosure and do not limit the scope of the invention. The technical features of each embodiment in the present invention can be combined accordingly, provided that there is no mutual conflict.

[0019] The accompanying drawings are merely illustrative of the invention and are not necessarily drawn to scale. Some of the block diagrams shown in the drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0020] The flowchart shown in the attached diagram is merely an illustrative example and does not necessarily include all steps. For example, some steps may be broken down, while others may be combined or partially combined; therefore, the actual execution order may change depending on the specific circumstances.

[0021] like Figure 1 As shown, this invention proposes a two-branch time series anomaly detection method based on noise decomposition. For a univariate time series representing changes in server traffic or CPU utilization over time, normalization and missing value filling are performed for preprocessing, but data augmentation techniques are not used. Then, noise decomposition is used to obtain a denoised time series. Next, a two-branch prediction network is used: the S-LSTM branch is responsible for learning periodic patterns from the frequency domain of historical sequences, while the C-LSTM branch is specifically used to capture local trends and short-term changes in the data. Finally, anomaly scores are calculated.

[0022] The implementation details of each part are explained below.

[0023] S1. Collect univariate time series data from cloud service monitoring to build a training set. The univariate time series characterizes the changes in server traffic or CPU utilization over time. Mark outliers in the univariate time series and generate corresponding anomaly indicator masks.

[0024] In this step, monitoring metric data is collected from cloud service platforms (such as AWS CloudWatch, Azure Monitor, or a privately deployed Prometheus system). This data constitutes a univariate time series, the core characteristic of which is the continuous observation of a single metric changing over time. Typical examples include: Server traffic: such as requests per second, network input / output bandwidth.

[0025] CPU utilization: Represents the percentage of computing resources being used.

[0026] Outlier markers are added to the collected time series data. Specifically, each data point (corresponding to a specific timestamp) is assigned a label: 0 for normal points and 1 for outliers. Based on these labels, an anomaly indicator mask of the same length as the original time series is generated. This mask is a binary sequence where a mask value of 1 corresponds to an outlier and a mask value of 0 corresponds to a normal point.

[0027] It should be noted that the collected time-series data exhibits class imbalance, meaning that the number of normal data points significantly exceeds the number of outliers. This phenomenon aligns with the reality that cloud service systems operate stably for the vast majority of the time, and is a crucial prerequisite for building an effective anomaly detection model. For unlabeled raw data, anomaly injection techniques can be employed to artificially generate labels and masks by simulating anomaly patterns (such as sudden increases, decreases, or platform drift).

[0028] S2 preprocesses the univariate time series and uses a noise decomposition method based on wavelet transform and median absolute deviation (MAD) to obtain the denoised time series.

[0029] Time series data is a sequence of numerical points arranged in chronological order. It consists of normal points and outliers. Outliers typically refer to points that deviate from the normal trend of the sequence; they are a direct reflection of abnormal events in the real world, such as abnormal surges in traffic or abnormal changes in CPU utilization.

[0030] This step proposes a noise decomposition strategy to address two core issues: the lack of true labels for outliers and the difficulty in accurately fitting the normal patterns of time series. This invention employs a method based on Median Absolute Deviation (MAD) to effectively filter noise from time series data while preserving the easily learnable stable components. It assumes that the underlying data follows a normal distribution without outliers. .

[0031]

[0032]

[0033]

[0034]

[0035] Original signal x ∈ R n First, wavelet decomposition is performed using the selected wavelet basis ψ and the preset number of decomposition levels L. This decomposition yields a set of approximate coefficients at the coarsest level. And obtain multiple sets of detail coefficients at each layer from 1 to L. Subsequently, the noise level is estimated based on the median absolute deviation of the detail coefficients for each group. , where the coefficient This is used to ensure consistency with the standard deviation under the Gaussian white noise assumption. Next, a general threshold is calculated. The noise is then applied to all detail coefficients using a soft thresholding method. This process suppresses noise while preserving important signal components. Finally, the denoised signal is reconstructed using inverse wavelet transform. .

[0036] S3, the preprocessed univariate time series is simultaneously input into the dual-branch prediction network, which includes a periodic branch S-LSTM and a context branch C-LSTM, and the two branches are used to predict the range of normal points respectively.

[0037] In this invention, the S-LSTM branch focuses on learning periodic information and its evolutionary trends in historical data to detect segment-level anomalies. Unlike previous methods that only capture periodicity near the detection point, S-LSTM models the temporal evolution of periodic patterns across the entire historical sequence, providing a more comprehensive characterization of the underlying structure. Specifically, the historical sequence before the detection point is first divided into several equal-length, non-overlapping windows. Each window is transformed from the time domain to the frequency domain using a Fourier transform to obtain frequency components that intuitively reflect the periodicity of the data. Since the periodic characteristics of different segments differ, the relationships between these frequency domain representations are modeled to capture the evolution of periodicity over time. To this end, a single-layer LSTM is used to learn the changing trends of continuous frequency vectors and predict future periodic patterns. Furthermore, to enhance the model's characterization of temporal distribution, the original time-domain values ​​are used as covariates, concatenated with the frequency-domain features, and then input into the LSTM, enabling the model to effectively capture both distribution characteristics and periodic correlation simultaneously.

[0038] The C-LSTM branch aims to learn the trends and distributions of local changes in adjacent historical data to identify sudden, abrupt anomalies. Since the information at a single time point in a unified time series (UTS) is limited, traditional single-point-based prediction methods often perform poorly in anomaly detection tasks. Therefore, the C-LSTM branch captures richer local temporal dependencies by focusing on overlapping time segments. Specifically, it extracts shorter historical sequences preceding the detection point and divides them into several equal-length, overlapping windows. This transformation shifts the task from learning relationships between individual points to learning relationships between segments, effectively alleviating the problem of scarce single-point information. Subsequently, each overlapping window is transformed to the frequency domain using a Fourier transform to capture finer-grained details. Similarly, to enhance the model's characterization of temporal distribution, the original time-domain values ​​are used as covariates, concatenated with frequency-domain features, and then input into a single-layer LSTM to model the temporal relationships between these overlapping frequency segments, using local information to predict future values.

[0039] S4, Abnormal score calculation, training a dual-branch prediction network and determining the optimal score threshold.

[0040] During the training phase, the points marked as outliers in the original univariate time series need to be replaced with their corresponding values ​​in the denoised time series, while the values ​​of normal points remain unchanged, thus generating the corrected time series. ; Based on the corrected time series and the prediction results of each branch in the previous step, the anomaly scores for the periodic branch and the context branch are calculated respectively. In this embodiment, the negative log-likelihood (NLL) loss function for noise decomposition is used to calculate the anomaly score by the distance between normal and anomaly points. Therefore, this invention designs a loss function to calculate the anomaly score:

[0041] in, This is the denoised time series, where σ and μ are the mean and variance predicted by the branch, and mask is the anomaly mask, which is used to replace the anomalies in the original signal with the denoised time series during model training. This allows the model to better fit the normal patterns of the time series.

[0042] Substituting the first predicted mean μ1 and variance σ1 from the periodic branch S-LSTM output, and the second predicted mean μ2 and variance σ2 from the context branch C-LSTM output, into the above formula, two outlier scores are calculated respectively. By adding the outlier scores of the two branches, the final outlier score can be obtained.

[0043] The loss value of this invention is the sum of the anomaly scores of the two branches. The model predicts future data using historical data, based on the values ​​obtained in the first step. Outliers in the original sequence are replaced, and the model learns to predict normal points by minimizing the loss. Anomaly scores, calculated using the true and predicted values, are used to determine whether an anomaly has occurred. After training, the distribution of the total anomaly scores of the trained dual-branch prediction network is statistically analyzed on the validation set to determine the optimal score threshold for anomaly detection.

[0044] S5: Collect the univariate time series to be detected, input it into the trained bi-branch prediction network, calculate the total anomaly score, and if the total anomaly score exceeds the optimal score threshold, it is determined that there is an anomaly in the input univariate time series.

[0045] In this step, the univariate time series to be detected is collected and preprocessed to obtain a one-dimensional tensor. The form; The algorithm then enters the S-LSTM and C-LSTM branches, respectively using long-term periodic features and short-term contextual features to predict the normal interval for the next point. Finally, the predicted mean is calculated. and variance The loss function, which is fed into the inference stage, is used to calculate the anomaly score, and the anomaly score is used to determine whether an anomaly has occurred.

[0046] Unlike the training phase, the inference phase does not use a mask; instead, the anomaly score is calculated directly using the following formula:

[0047] Where μ and σ are the predicted mean and standard deviation, It is the preprocessed univariate time series to be detected.

[0048] To verify the effectiveness of the present invention, the results of the present invention (CS-LSTMs) and other methods were compared on four commonly used public datasets, where F1 and F1* refer to best F1 and delay F1, respectively, P is the precision value, and R is the recall value, which are industry-standard evaluation metrics.

[0049] The following list covers various time series data anomaly detection methods developed in recent years, ranging from traditional statistical methods to modern deep learning techniques. They can be broadly categorized as follows: SPOT: This is a statistical method based on extreme value theory. It identifies unusual points by modeling the distribution of extreme values ​​in a dataset.

[0050] SRCNN and TFAD: These are supervised methods. This means they require a large amount of labeled data for training. They identify anomalies by learning from examples of normal and anomalous data points.

[0051] DONUT, VQRAE, and AnoTransfer: These methods are all unsupervised, reconstruction-based. They use a type of neural network called a variational autoencoder (VAE). A VAE learns to reconstruct "normal" data. When it attempts to reconstruct an anomalous data point, the reconstruction error is high, indicating the presence of an anomaly.

[0052] Informer: This is an unsupervised, prediction-based method. It uses an attention mechanism to predict what the next normal value should be in a time series. If the actual value deviates significantly from the predicted value, it is marked as an anomaly.

[0053] Anomaly-Transformer: This is an unsupervised method that leverages the Transformer architecture, originally developed for natural language processing, to detect outliers in time series data. It identifies anomalies by analyzing relationships and patterns in the data using a self-attention mechanism.

[0054] FCVAE: This method, also based on VAE, is an unsupervised, reconstruction-based approach. It specifically learns the distribution of time series sequences based on specific frequencies. It then reconstructs entire segments of the time series as normal values ​​and marks deviations as anomalies.

[0055] Table 1: Comparison of the present invention (CS-LSTMs) with other methods on four commonly used public datasets.

[0056] The inference efficiency of this invention (CS-LSTMs) is compared with other methods under the same environment. All methods below were tested under a GPU 3090 24G environment. Memory represents the video memory usage, and Time represents the inference time of a single batch (batch_size=512).

[0057] Table 2: Comparison of inference efficiency of the present invention (CS-LSTMs) with other methods under the same conditions.

[0058] The transfer performance of the present invention (CS-LSTMs) is compared with that of other methods. Table 3 shows the results of training on the Yahoo and KPI datasets and then testing on the other three datasets.

[0059] Table 3: Comparison of transfer performance of the present invention (CS-LSTMs) with other methods

[0060] This embodiment also provides a dual-branch time series anomaly detection system based on noise decomposition, including: The training set construction module is used to collect univariate time series data from cloud service monitoring to build a training set. The univariate time series characterizes the changes in server traffic or CPU utilization over time, marks outliers in the univariate time series, and generates corresponding anomaly indication masks. The noise decomposition module is used to preprocess univariate time series and uses a noise decomposition method based on wavelet transform and median absolute deviation (MAD) to obtain the denoised time series. A dual-branch prediction network module is used to simultaneously input the preprocessed univariate time series into the dual-branch prediction network. The dual-branch prediction network includes a periodic branch S-LSTM and a context branch C-LSTM, which respectively use the two branches to predict the range of normal points. The training module replaces the points marked as anomalous in the original univariate time series with their corresponding values ​​in the denoised time series, while keeping the values ​​of normal points unchanged, generating a corrected time series. Based on the corrected time series and the prediction results of each branch, the anomalous scores of the periodic branch and the context branch are calculated respectively. The dual-branch prediction network is trained with the goal of minimizing the total anomalous score. The distribution of the total anomalous score of the trained dual-branch prediction network is statistically analyzed on the validation set to determine the optimal score threshold for anomaly detection. The anomaly detection module is used to collect the univariate time series to be detected, input it into the trained bi-branch prediction network, calculate the total anomaly score, and determine that there is an anomaly in the input univariate time series if the total anomaly score exceeds the optimal score threshold.

[0061] For the system embodiments, since they basically correspond to the method embodiments, relevant details can be found in the descriptions of the method embodiments; the implementation methods of the remaining modules will not be repeated here. The system embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of the present invention according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0062] The system embodiments of the present invention can be applied to any device with data processing capabilities, such as a computer or other similar device. The system embodiments can be implemented in software, hardware, or a combination of both. Taking software implementation as an example, as a logical device, it is formed by the processor of any data processing device loading the corresponding computer program instructions from non-volatile memory into memory for execution.

[0063] The above-described embodiments are merely illustrative of several implementations of the present invention, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of the invention. Those skilled in the art can make various modifications and improvements without departing from the concept of the present invention, and these modifications and improvements all fall within the scope of protection of the present invention.

Claims

1. A method for detecting anomalies in a two-branch time series based on noise decomposition, characterized in that, Includes the following steps: (1) Collect univariate time series of cloud service monitoring to build a training set. The univariate time series represents the change of server traffic or CPU utilization over time. Mark the abnormal points in the univariate time series and generate the corresponding abnormal indication mask. (2) The univariate time series is preprocessed and the noise decomposition method based on wavelet transform and median absolute deviation (MAD) is used to obtain the denoised time series; (3) The preprocessed univariate time series is simultaneously input into the dual-branch prediction network, which includes a periodic branch S-LSTM and a context branch C-LSTM, and the range of normal points is predicted by the two branches respectively. (4) Replace the points marked as anomalous in the original univariate time series with the corresponding values ​​in the denoised time series, while keeping the values ​​of normal points unchanged, and generate a corrected time series; based on the corrected time series and the prediction results of each branch in step (3), calculate the anomalous score of the periodic branch and the anomalous score of the context branch respectively. The dual-branch prediction network is trained with the goal of minimizing the total anomaly score. The distribution of the total anomaly score of the trained dual-branch prediction network is statistically analyzed on the validation set to determine the optimal score threshold for anomaly detection. (5) Collect the univariate time series to be detected, input it into the trained bi-branch prediction network, calculate the total anomaly score, and if the total anomaly score exceeds the optimal score threshold, it is determined that there is an anomaly in the input univariate time series.

2. The dual-branch time series anomaly detection method based on noise decomposition according to claim 1, characterized in that, In the univariate time series collected in step (1), the number of normal points is significantly greater than the number of abnormal points.

3. The dual-branch time series anomaly detection method based on noise decomposition according to claim 2, characterized in that, In step (1), if the collected univariate time series does not contain labels, outlier points are injected into the original univariate time series, and corresponding outlier indicator masks are generated based on the injected outlier points.

4. The dual-branch time series anomaly detection method based on noise decomposition according to claim 1, characterized in that, Step (2) includes: (2-1) Normalize the univariate time series and fill in missing values. Use the selected wavelet basis and the preset decomposition level L to perform wavelet decomposition on the preprocessed original signal to obtain a set of approximate coefficients. and multi-scale detail coefficients from layer 1 to layer L ; (2-2) Based on the detail coefficients at each scale Median absolute bias estimates noise level The calculation formula is: ； in, It is the cumulative distribution function of the standard normal distribution. It is the detail coefficient at the i-th scale. It is the average; (2-3) Calculate the general threshold The calculation formula is: ； Where n represents the length of the original signal; (2-4) All detail coefficients are processed using the soft thresholding method, and the calculation formula is as follows: ； (2-5) Reconstruct the denoised signal using inverse wavelet transform with approximation coefficients and processed detail coefficients. : 。 5. The dual-branch time series anomaly detection method based on noise decomposition according to claim 1, characterized in that, In the periodic branch S-LSTM, the historical time series before the current time point is divided into multiple non-overlapping windows of a first predetermined length; the sequences of each non-overlapping window are transformed to the frequency domain through Fourier transform to obtain the first frequency domain features; The temporal statistical features of each non-overlapping window are concatenated with the first frequency domain features as covariates and input into the first LSTM network to learn the evolution trend of long-term periodic patterns and output the first predicted mean. and variance Used to characterize the range of normal points; In the context branch C-LSTM, the historical time series before the current time point is divided into multiple overlapping windows of a second predetermined length; the sequences of each overlapping window are transformed to the frequency domain through Fourier transform to obtain the second frequency domain features; The temporal statistical features of each overlapping window are used as covariates and input along with the second frequency domain features into the second LSTM network to learn short-term contextual change trends and output the second predicted mean. and variance Used to characterize the range of normal points.

6. The dual-branch time series anomaly detection method based on noise decomposition according to claim 5, characterized in that, The time-domain statistical features are the original sequence values ​​for the entire window.

7. The dual-branch time series anomaly detection method based on noise decomposition according to claim 1, characterized in that, During the training phase, the anomaly scoring function is as follows: ； Here, mask is the anomaly indicator mask, with a mask value of 1 representing an outlier and a mask value of 0 representing a normal point; μ and σ are the predicted mean and standard deviation, respectively. It is the inverse of the mask. This represents element-wise multiplication, where x is a preprocessed univariate time series. It is the time series after denoising.

8. The dual-branch time series anomaly detection method based on noise decomposition according to claim 1, characterized in that, During the inference phase, the anomaly scoring function is as follows: ； Where μ and σ are the predicted mean and standard deviation, and x is the preprocessed univariate time series to be detected.

9. A noise-decomposition-based dual-branch time series anomaly detection system, used to implement the noise-decomposition-based dual-branch time series anomaly detection method of claim 1, characterized in that the system... include: The training set construction module is used to collect univariate time series data from cloud service monitoring to build a training set. The univariate time series characterizes the changes in server traffic or CPU utilization over time, marks outliers in the univariate time series, and generates corresponding anomaly indication masks. The noise decomposition module is used to preprocess univariate time series and uses a noise decomposition method based on wavelet transform and median absolute deviation (MAD) to obtain the denoised time series. A dual-branch prediction network module is used to simultaneously input the preprocessed univariate time series into the dual-branch prediction network. The dual-branch prediction network includes a periodic branch S-LSTM and a context branch C-LSTM, which respectively use the two branches to predict the range of normal points. The training module is used to replace the points marked as anomalous in the original univariate time series with the corresponding values ​​in the denoised time series, while keeping the values ​​of normal points unchanged, to generate a corrected time series; based on the corrected time series and the prediction results of each branch, the anomalous scores of the periodic branch and the context branch are calculated respectively. The dual-branch prediction network is trained with the goal of minimizing the total anomaly score. The distribution of the total anomaly score of the trained dual-branch prediction network is statistically analyzed on the validation set to determine the optimal score threshold for anomaly detection. The anomaly detection module is used to collect the univariate time series to be detected, input it into the trained bi-branch prediction network, calculate the total anomaly score, and determine that there is an anomaly in the input univariate time series if the total anomaly score exceeds the optimal score threshold.

10. The dual-branch time series anomaly detection system based on noise decomposition according to claim 9, characterized in that, In the univariate time series used to construct the training set, the number of normal points is significantly greater than the number of abnormal points.

Images