An unsupervised time series anomaly detection method
By constructing an unsupervised time series anomaly detection method, and utilizing rolling statistical features and autoencoders combined with decision tree models, the problems of low data utilization efficiency and anomaly detection delay in existing technologies are solved, and efficient anomaly identification is achieved.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- BEIJING WISEDA TECH CO LTD
- Filing Date
- 2024-11-29
- Publication Date
- 2026-06-05
AI Technical Summary
Existing time series anomaly detection methods suffer from low data utilization efficiency, delayed error detection, and insufficient response to abnormal states. They are particularly difficult to achieve ideal prediction results in industrial production, especially unsupervised learning methods which are limited in the context of high data labeling costs.
By acquiring historical time-series data, filtering feature variables, constructing an instance anomaly detection task model, reconstructing data using a rolling statistical feature strategy and an autoencoder framework, and combining an anomaly scoring with a decision tree model, unsupervised anomaly detection is achieved.
It improves the ability and efficiency of anomaly identification in time series data, and can accurately identify anomalies under unsupervised conditions. It is applicable to fields such as intelligent manufacturing, energy management and cloud computing systems.
Smart Images
Figure CN122153698A_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of time series analysis technology, specifically relating to an unsupervised time series anomaly detection method. Background Technology
[0002] In recent years, time series analysis methods have been widely applied and deeply studied across various disciplines, covering key analytical tasks such as anomaly detection and trend prediction. Anomaly detection plays a crucial role in time series data analysis, with its main research objective being to identify data points in continuous data streams that deviate from expected ranges or normal distributions. This method is widely used in fields such as intelligent manufacturing, energy management, cloud computing systems, and structural health monitoring. In the field of intelligent manufacturing, anomaly detection methods can optimize production processes, improve production efficiency and product quality by monitoring production time-series data in real time, which is of great significance for the technological upgrading and quality control of the entire production chain.
[0003] Currently, time series anomaly detection methods can be mainly divided into three categories: supervised learning-based anomaly detection, semi-supervised learning-based anomaly detection, and unsupervised learning-based anomaly detection. Each type of anomaly detection method has its unique application scenarios and advantages. Although data acquisition technology has become widespread, low data utilization efficiency, delays in error detection, and insufficient response to anomalous states remain common problems. Furthermore, considering the high cost of labeling industrial production data, supervised and semi-supervised learning methods struggle to achieve ideal predictive results in practical applications. Unsupervised learning-based time series anomaly detection technology does not require labeling of training data, a characteristic particularly important in environments with limited data labeling. Therefore, it is necessary to propose an unsupervised time series anomaly detection method to address the aforementioned issues. Summary of the Invention
[0004] The present invention aims to solve the technical problems existing in the current time series anomaly detection and to provide an unsupervised time series anomaly detection method.
[0005] This invention provides an unsupervised time series anomaly detection method, comprising:
[0006] Step 1: Obtain historical time-series data, filter feature variables based on the correlation between historical time-series data and the target, and construct historical time-series data for the instance anomaly detection task based on the feature variables;
[0007] Step 2: Apply a rolling statistical feature strategy to the relevant fields of the historical time-series data of the instance anomaly detection task to construct a historical time-series data model for the instance anomaly detection task;
[0008] Step 3: After batch processing, the historical time-series data model of the instance anomaly detection task is input into the autoencoder framework. After three encodings and three decodings, the reconstructed historical time-series data model of the instance anomaly detection task is obtained.
[0009] Step 4: Compare and analyze the historical time-series data model of the instance anomaly detection task with the reconstructed historical time-series data model of the instance anomaly detection task to obtain the loss time-series dataset.
[0010] Step 5: Construct a decision tree model to score each sample in the loss time series dataset for anomalies, and obtain the final anomaly detection result based on the score.
[0011] Furthermore, in step one, correlation analysis is first used to preliminarily screen feature factors, and then the gradient boosting tree algorithm is used to select feature variables. Based on the feature variables, including the target variable, historical time-series data for the instance anomaly detection task is constructed.
[0012] Further, in step two, the rolling statistical feature strategy includes selecting W data points forward and reconstructing the historical time-series data of the instance anomaly detection task using rolling average, rolling maximum, rolling minimum, rolling standard deviation, rolling skewness, and rolling kurtosis to obtain a historical time-series data model for the instance anomaly detection task; and reconstructing a historical time-series data model x for the instance anomaly detection task with a time dimension of T and an indicator dimension of M based on each rolling statistical variable and the variables related to the instance anomaly detection task. c x c =R L×M T represents the length of the original time series, L represents the reconstructed time series, M represents the number of features, and R represents that all elements are real numbers.
[0013] Further, in step three, the batch processing includes normalizing the time series of the historical time-series data model of the instance anomaly detection task along the feature dimension, dividing the normalized dataset into batches of fixed sample length and number, and training each batch of samples iteratively. The batch size is B, and the number of batches is [missing information].
[0014] Furthermore, in step three, the autoencoder framework employs an autoencoder neural network to process the input sample set. Compression and reconstruction are performed, where i represents the i-th variable among the M feature variables, and x b The input sample set is represented by b, where b is the batch dimension. The autoencoder architecture uses a six-layer fully connected layer, consisting of three encoder layers and three decoder layers. The encoder layer is responsible for processing the input sample set. The data is compressed and encoded, while the decoder is responsible for reconstructing the data to the original dimension M to minimize information loss; the autoencoder uses different activation functions to achieve non-linear transformation of the data.
[0015] The first layer encoder receives an input sample set with dimension M. Applying the hyperbolic tangent activation function tanh compresses each value between -1 and 1, and after a non-linear transformation, the output dataset has a dimension of M1.
[0016]
[0017] In the above formula, d1 is the result of the first linear transformation; W1 is the first weight matrix; and b1 is the first bias vector.
[0018] The second encoder layer receives a dataset of dimension M1. The dimensionality is further reduced to M2 using the linear rectified function ReLU, resulting in the dataset.
[0019]
[0020] In the above formula, d2 is the result of the second linear transformation, W2 is the second weight matrix, and b2 is the second bias vector.
[0021] The third encoder layer receives a dataset with dimension M2. The dataset output using the sigmoid activation function is between 0 and 1. The dimension is reduced to M3;
[0022]
[0023] In the above formula, d3 is the result of the third linear transformation, W3 is the third weight matrix, and b3 is the third bias vector.
[0024] Third-layer decoder: Receives compressed dataset The first step of decoding is performed using the sigmoid activation function, restoring the output dimension to M2, thus obtaining the reconstructed dataset.
[0025]
[0026] In the above formula, d4 is the result of the fourth linear transformation, W4 is the fourth weight matrix, and b4 is the fourth bias vector.
[0027] Second-layer decoder: Receives the dataset Applying the ReLU activation function again restores the dimension to M1, resulting in the reconstructed dataset.
[0028]
[0029] In the above formula, d5 is the result of the fifth linear transformation, W5 is the fifth weight matrix, and b5 is the fifth bias vector.
[0030] First-layer decoder: Receives the dataset Finally, the hyperbolic tangent activation function tanh is used to restore the original dimension M, resulting in the final reconstructed dataset.
[0031]
[0032]
[0033] In the above formula, d6 is the result of the sixth linear transformation, W6 is the sixth weight matrix, and b6 is the sixth bias vector.
[0034] Furthermore, in step four, the mean squared error is used as the loss function to compare and analyze the historical time-series data model of the instance anomaly detection task with the reconstructed historical time-series data model of the instance anomaly detection task, thereby obtaining the loss time-series dataset. and
[0035] Furthermore, in step five, the loss function value is... As the input dataset, Nt decision trees are randomly constructed, each with Ns samples, satisfying 1 ≤ Ns ≤ Bs, where Bs is the sample length of each batch. Without replacement, Ns samples are randomly selected. For each node, a feature m is randomly selected, satisfying 1 ≤ m ≤ M. From this feature, a split value s between the maximum and minimum values is randomly selected. This process is repeated recursively until the number of samples is less than or equal to 1 or the maximum tree height is reached.
[0036] For each tree Nt, the path length from the root node to the leaf node containing sample x is h(x,Nt). Adjusting the average path length yields...
[0037]
[0038] H(i)=ln(i)+γ
[0039] Where n is the number of samples per tree, c(n) is the normalization factor per tree, H(i) represents the logarithmic approximation of the harmonic number when the number of samples is i, and γ is the Euler constant.
[0040] The number of edges from the root node to the leaf node x, if isolated in very few splits, indicates a different distribution structure and may thus be an outlier.
[0041]
[0042] In the above formula, E(h(x) (i) S represents the average path length. (i) For abnormal scores, S (i) ∈R B×1 If the result is closer to 1, it indicates that the sample point may be an outlier.
[0043] This invention offers the following advantages: An unsupervised time-series anomaly detection method acquires historical time-series data, filters feature variables based on the correlation between the historical time-series data and the target, and constructs historical time-series data for an instance anomaly detection task based on these feature variables. A rolling statistical feature strategy is applied to relevant fields of the historical time-series data to construct a historical time-series data model for the instance anomaly detection task. This model is then batch-processed and input into an autoencoder framework, undergoing three encoding and three decoding steps to obtain a reconstructed historical time-series data model for the instance anomaly detection task. The historical time-series data model for the instance anomaly detection task is compared and analyzed with the reconstructed model to obtain a loss time-series dataset. A decision tree model is constructed to score each sample in the loss time-series dataset for anomalies, and the final anomaly detection result is obtained based on the scores. This method improves the ability and efficiency of anomaly identification in time-series data. Attached Figure Description
[0044] To more clearly illustrate the technical solution of the present invention, the drawings used in the embodiments will be briefly introduced below. Obviously, those skilled in the art can obtain other drawings based on these drawings without creative effort.
[0045] Figure 1 A flowchart of an unsupervised time series anomaly detection method provided by the present invention;
[0046] Figure 2 This is a schematic diagram of the abnormal detection results of the front-end short squeeze rate in Example 2;
[0047] Figure 3 This is a schematic diagram of the abnormal detection results of the back-end short-covering rejection rate in Example 2. Detailed Implementation
[0048] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this invention, and not all of them. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention. The technical solutions provided by various embodiments of this invention will be described in detail below with reference to the accompanying drawings.
[0049] Please see Figure 1 The present invention provides an unsupervised time series anomaly detection method, comprising:
[0050] Step 1: Obtain historical time-series data, filter feature variables based on the correlation between historical time-series data and the target, and construct historical time-series data for the instance anomaly detection task based on the feature variables.
[0051] Specifically, correlation analysis is first used to preliminarily screen feature factors, then gradient boosting tree algorithm is used to select feature variables, and historical time series data of instance anomaly detection task is constructed based on feature variables including target variable.
[0052] Step 2: Apply a rolling statistical feature strategy to the relevant fields of the historical time-series data of the instance anomaly detection task to construct a historical time-series data model for the instance anomaly detection task.
[0053] Specifically, the rolling statistical feature strategy includes selecting W data points forward and reconstructing the historical time-series data of the instance anomaly detection task using the rolling average, rolling maximum, rolling minimum, rolling standard deviation, rolling skewness, and rolling kurtosis to obtain the historical time-series data model of the instance anomaly detection task; and reconstructing the historical time-series data model x of the instance anomaly detection task with a time dimension of T and an indicator dimension of M based on each rolling statistical variable and the variables related to the instance anomaly detection task. c x c =R L×M T represents the length of the original time series, L represents the reconstructed time series, M represents the number of features, and R represents that all elements are real numbers.
[0054] Step 3: After batch processing, the historical time-series data model of the instance anomaly detection task is input into the autoencoder framework. After three encodings and three decodings, the reconstructed historical time-series data model of the instance anomaly detection task is obtained.
[0055] Specifically, batch processing includes normalizing the time series data of the historical time series model for the instance anomaly detection task along the feature dimension, dividing the normalized dataset into batches of fixed sample length and number, and training each batch of samples iteratively. The batch size is B, and the number of batches is [missing information].
[0056] The autoencoder framework uses an autoencoder neural network to process the input sample set. Compression and reconstruction are performed, where i represents the i-th variable among the M feature variables, and x b The input sample set is represented by b, where b is the batch dimension. The autoencoder architecture uses a six-layer fully connected layer, consisting of three encoder layers and three decoder layers. The encoder layer is responsible for processing the input sample set. The data is compressed and encoded, while the decoder is responsible for reconstructing the data to the original dimension M to minimize information loss; the autoencoder uses different activation functions to achieve non-linear transformation of the data.
[0057] The first layer encoder receives an input sample set with dimension M. Applying the hyperbolic tangent activation function tanh compresses each value between -1 and 1, and after a non-linear transformation, the output dataset has a dimension of M1.
[0058]
[0059] In the above formula, d1 is the result of the first linear transformation, W1 is the first weight matrix, and b1 is the first bias vector.
[0060] The second encoder layer receives a dataset of dimension M1. The dimensionality is further reduced to M2 using the linear rectified function ReLU, resulting in the dataset.
[0061]
[0062] In the above formula, d2 is the result of the second linear transformation, W2 is the second weight matrix, and b2 is the second bias vector.
[0063] The third encoder layer receives a dataset with dimension M2. The dataset output using the sigmoid activation function is between 0 and 1. The dimension is reduced to M3;
[0064]
[0065] In the above formula, d3 is the result of the third linear transformation, W3 is the third weight matrix, and b3 is the third bias vector.
[0066] Third-layer decoder: Receives compressed dataset The first step of decoding is performed using the sigmoid activation function, restoring the output dimension to M2, thus obtaining the reconstructed dataset.
[0067]
[0068] In the above formula, d4 is the result of the fourth linear transformation, W4 is the fourth weight matrix, and b4 is the fourth bias vector.
[0069] Second-layer decoder: Receives the dataset Applying the ReLU activation function again restores the dimension to M1, resulting in the reconstructed dataset.
[0070]
[0071] In the above formula, d5 is the result of the fifth linear transformation, W5 is the fifth weight matrix, and b5 is the fifth bias vector.
[0072] First-layer decoder: Receives the dataset Finally, the hyperbolic tangent activation function tanh is used to restore the original dimension M, resulting in the final reconstructed dataset.
[0073]
[0074] In the above formula, d6 is the result of the sixth linear transformation, W6 is the sixth weight matrix, and b6 is the sixth bias vector.
[0075] Step 4: Compare and analyze the historical time-series data model of the instance anomaly detection task with the reconstructed historical time-series data model of the instance anomaly detection task to obtain the loss time-series dataset.
[0076] Specifically, using mean squared error as the loss function, the historical time-series data model of the instance anomaly detection task is compared and analyzed with the reconstructed historical time-series data model of the instance anomaly detection task to obtain the loss time-series dataset. and
[0077] Step 5: Construct a decision tree model to score each sample in the loss time series dataset for anomalies, and obtain the final anomaly detection result based on the score.
[0078] Specifically, the loss function value As the input dataset, Nt decision trees are randomly constructed, each with Ns samples, satisfying 1 ≤ Ns ≤ Bs, where Bs is the sample length of each batch. Without replacement, Ns samples are randomly selected. For each node, a feature m is randomly selected, satisfying 1 ≤ m ≤ M. From this feature, a split value s between the maximum and minimum values is randomly selected. This process is repeated recursively until the number of samples is less than or equal to 1 or the maximum tree height is reached.
[0079] For each tree Nt, the path length from the root node to the leaf node containing sample x is h(x,Nt). Adjusting the average path length yields...
[0080]
[0081] H(i)=ln(i)+γ
[0082] Where n is the number of samples per tree, c(n) is the normalization factor per tree, H(i) represents the logarithmic approximation of the harmonic number when the number of samples is i, and γ is the Euler constant.
[0083] The number of edges from the root node to the leaf node x, if isolated in very few splits, indicates a different distribution structure and may thus be an outlier.
[0084]
[0085] In the above formula, E(h(x) (i) S represents the average path length. (i) For abnormal scores, S (i) ∈R B×1 If the result is closer to 1, it indicates that the sample point may be an outlier.
[0086] The unsupervised time series anomaly detection method of the present invention will be described in detail below with reference to two specific application scenarios.
[0087] Example 1
[0088] To obtain the historical time series data of the process production in Example 1, considering that unsupervised time series anomaly detection methods are not only affected by previous data but also depend on other feature constraints, all variables, including the target variable, will be comprehensively considered for anomaly detection of the target variable to ensure the accuracy of model prediction. Correlation analysis is used to initially screen feature factors with strong correlations, and then the gradient boosting tree algorithm is used to select feature variables with higher importance. Based on the feature variables, including the target variable, the historical time series data for the instance anomaly detection task is constructed.
[0089] To ensure the accuracy of the model's anomaly detection of the target variable x, this embodiment will comprehensively adopt a rolling statistical feature strategy. Specifically, it will select W data points forward and apply the rolling average, rolling maximum, rolling minimum, rolling standard deviation, rolling skewness, and rolling kurtosis to reconstruct the historical time-series data of the instance anomaly detection task, thus obtaining the historical time-series data model for the instance anomaly detection task. The specific calculations are as follows:
[0090]
[0091] x t =R T×m Where, x t This is the original time series dataset, a time series dataset of length T;
[0092] In the above formula, x t Max t Min t S t Skew t Kurt t These represent the rolling average, rolling maximum, rolling minimum, rolling standard deviation, rolling skewness, and rolling kurtosis values obtained at time t, respectively. Based on these rolling statistical variables and variables related to the instance anomaly detection task, a historical time-series data model x for the instance anomaly detection task is reconstructed with a time dimension of T and an indicator dimension of M. c x c =R L×M .
[0093] For time-series datasets used in anomaly detection tasks, the time series data is normalized along the feature dimension. A batch processing strategy is introduced, dividing the normalized dataset into batches of fixed sample lengths and numbers. Each batch is trained iteratively. Given a batch size of B and a batch size of [missing information], [missing information].
[0094] After batch processing, a time series input sample set can be constructed for a time series dataset x. in, R B×M And i∈(l,……,N)B ).
[0095] Using an autoencoder neural network on the input sample set Compression and reconstruction processing are performed; the autoencoder architecture adopts a six-layer fully connected layer, consisting of three encoder layers and three decoder layers; the encoder layer is responsible for processing the input sample set. The data is compressed and encoded, while the decoder is responsible for reconstructing the data to the original dimension M to minimize information loss. The autoencoder uses different activation functions to achieve non-linear transformation of the data, effectively capturing the complexity and internal structure of the data.
[0096] The first layer encoder receives an input sample set with dimension M. Applying the hyperbolic tangent activation function tanh compresses each value between -1 and 1, and after a non-linear transformation, the output dataset has a dimension of M1.
[0097]
[0098] In the above formula, W1 is the first weight matrix, and b1 is the first bias vector, where
[0099] The second encoder layer receives a dataset of dimension M1. The dimensionality is further reduced to M2 using the linear rectified function ReLU, resulting in the dataset.
[0100]
[0101] In the above formula, W2 is the second weight matrix and b2 is the second bias vector, where
[0102] The third encoder layer receives a dataset with dimension M2. The dataset output using the sigmoid activation function is between 0 and 1. The dimension is reduced to M3;
[0103]
[0104] In the above formula, W3 is the third weight matrix and b3 is the third bias vector, where
[0105] Third-layer decoder: Receives compressed dataset The first step of decoding is performed using the sigmoid activation function, restoring the output dimension to M2, thus obtaining the reconstructed dataset.
[0106]
[0107] In the above formula, W4 is the fourth weight matrix and b4 is the fourth bias vector, where
[0108] Second-layer decoder: Receives the dataset Applying the ReLU activation function again restores the dimension to M1, resulting in the reconstructed dataset.
[0109]
[0110] In the above formula, W5 is the fifth weight matrix and b5 is the fifth bias vector, where
[0111] First-layer decoder: Receives the dataset Finally, the hyperbolic tangent activation function tanh is used to restore the original dimension M, resulting in the final reconstructed dataset.
[0112]
[0113] In the above formula, W6 is the sixth weight matrix and b6 is the sixth bias vector, where b6∈R B×M .
[0114] Using mean squared error as the loss function, the historical time-series data models of the instance anomaly detection task are compared and analyzed with the reconstructed historical time-series data models of the instance anomaly detection task to obtain the loss time-series dataset. and
[0115] The loss function value As the input dataset, Nt decision trees are randomly constructed, each with Ns samples, satisfying 1 ≤ Ns ≤ Bs, where Bs is the sample length of each batch. Without replacement, Ns samples are randomly selected. For each node, a feature m is randomly selected, satisfying 1 ≤ m ≤ M. From this feature, a split value s between the maximum and minimum values is randomly selected. This process is repeated recursively until the number of samples is less than or equal to 1 or the maximum tree height is reached.
[0116] For each tree Nt, the path length from the root node to the leaf node containing sample x is h(x,Nt). Adjusting the average path length yields...
[0117]
[0118] H(i)=ln(i)+γ
[0119] Where n is the number of samples per tree, c(n) is the normalization factor per tree, H(i) represents the logarithmic approximation of the harmonic number when the number of samples is i, and γ is the Euler constant.
[0120] The number of edges from the root node to the leaf node x, if isolated in very few splits, indicates a different distribution structure and may thus be an outlier.
[0121]
[0122] In the above formula, E(h(x) (i) S represents the average path length. (i) For abnormal scores, S (i) ∈R B×1 If the result is closer to 1, it indicates that the sample point may be an outlier.
[0123] Example 2
[0124] Please see Figure 2 and Figure 3 The number of rejected blanks is considered a key indicator for assessing production stability. Under normal circumstances, the number of blank rejections should remain at a relatively stable level. An increase in the number of blank rejections usually indicates a problem in the production process. By performing anomaly detection on historical production data, unnecessary material waste and production costs can be effectively reduced. The data in this embodiment comes from the historical production data of a coiling machine in a factory, and aims to use this invention to perform anomaly detection and analysis on the number of blank rejections in the coiling machine.
[0125] To comprehensively consider that the number of short sell orders is influenced not only by previous data but also by other feature constraints, and to ensure the accuracy of model predictions, all variables, including the number of short sell orders, will be comprehensively considered to achieve anomaly detection in the number of short sell orders. Correlation analysis is used to initially screen feature factors with strong correlations, and then a gradient boosting tree algorithm is used to select feature variables with higher importance. Based on these feature variables, including the number of short sell orders, historical time-series data for the instance anomaly detection task is constructed.
[0126] Considering the abnormal situation of short selling rejection quantity, in order to ensure the accuracy of the model in detecting abnormal short selling rejection quantity, the data is stored in minutes. This embodiment will comprehensively adopt the rolling statistical feature strategy, and select the rolling average, rolling maximum, rolling minimum, rolling standard deviation, rolling skewness value and rolling kurtosis value 5 minutes ahead to reconstruct the data model of the time series of the anomaly detection task.
[0127] Given the large sample size of the data model, a batch processing approach is adopted to process the data in batches, with a batch size of 64, that is, each batch size is 64, to obtain a batched dataset, thereby reducing the training pressure on the model when processing large amounts of data.
[0128] The processed data is mapped to the encoding module, and the data is compressed and restored. The sizes of the three encoder layers are set to 32, 16, and 8, respectively, and the sizes of the three decoder layers are 16, 32, and the original size, respectively, to finally obtain the reconstructed data model.
[0129] Using mean squared error as the loss function, the data model and the reconstructed data model are compared and analyzed to obtain the time series dataset of short selling quantity loss.
[0130] A decision tree model is constructed, and the empty-head removal dataset is input into the model for anomaly scoring and diagnosis. Anomaly status is determined by the anomaly diagnosis score; if the score is close to 1, it is considered an outlier. This is applied to actual cigarette machine production, where empty-head removal mainly occurs in the upstream and downstream processes. Some of the judgment results from this implementation example are attached. Figure 2 As shown.
[0131] In summary, the unsupervised time series anomaly detection method provided by this invention improves the ability and efficiency of anomaly identification in time series data by constructing a decision tree and integrating an autoencoder into the tree structure.
[0132] The above embodiments of the present invention do not constitute a limitation on the scope of protection of the present invention.
Claims
1. An unsupervised time series anomaly detection method, characterized in that, include: Step 1: Obtain historical time-series data, and filter feature variables based on the correlation between the historical time-series data and the target. Construct historical time-series data for instance anomaly detection tasks based on feature variables; Step 2: Apply a rolling statistical feature strategy to the relevant fields of the historical time-series data of the instance anomaly detection task to construct a historical time-series data model for the instance anomaly detection task; Step 3: After batch processing, the historical time-series data model of the instance anomaly detection task is input into the autoencoder framework. After three encodings and three decodings, the reconstructed historical time-series data model of the instance anomaly detection task is obtained. Step 4: Compare and analyze the historical time-series data model of the instance anomaly detection task with the reconstructed historical time-series data model of the instance anomaly detection task to obtain the loss time-series dataset. Step 5: Construct a decision tree model to score each sample in the loss time series dataset for anomalies, and obtain the final anomaly detection result based on the score.
2. The unsupervised time series anomaly detection method according to claim 1, characterized in that, In step one, correlation analysis is first used to preliminarily screen feature factors, and then the gradient boosting tree algorithm is used to select feature variables. Based on the feature variables, including the target variable, historical time-series data for the instance anomaly detection task is constructed.
3. The unsupervised time series anomaly detection method according to claim 2, characterized in that, In step two, the rolling statistical feature strategy includes selecting W data points forward and reconstructing the historical time-series data of the instance anomaly detection task using rolling average, rolling maximum, rolling minimum, rolling standard deviation, rolling skewness, and rolling kurtosis to obtain a historical time-series data model for the instance anomaly detection task; and reconstructing a historical time-series data model x for the instance anomaly detection task with a time dimension of T and an indicator dimension of M based on each rolling statistical variable and the variables related to the instance anomaly detection task. c x c =R L×M T represents the length of the original time series, L represents the reconstructed time series, M represents the number of features, and R represents that all elements are real numbers.
4. The unsupervised time series anomaly detection method according to claim 3, characterized in that, In step three, the batch processing includes normalizing the time series data of the historical time series data model of the instance anomaly detection task along the feature dimension, dividing the normalized dataset into batches of fixed sample length and number, and training each batch of samples iteratively. The batch size is B, and the number of batches is [missing information].
5. The unsupervised time series anomaly detection method according to claim 4, characterized in that, In step three, the autoencoder framework uses an autoencoder neural network to process the input sample set. Compression and reconstruction are performed, where i represents the i-th variable among the M feature variables, and x b The input sample set is represented by b, where b is the batch dimension. The autoencoder architecture uses a six-layer fully connected layer, consisting of three encoder layers and three decoder layers. The encoder layer is responsible for processing the input sample set. The data is compressed and encoded, while the decoder is responsible for reconstructing the data to the original dimension M to minimize information loss; the autoencoder uses different activation functions to achieve non-linear transformation of the data. The first layer encoder receives an input sample set with dimension M. Applying the hyperbolic tangent activation function tanh compresses each value between -1 and 1, and after a non-linear transformation, the output dataset has a dimension of M1. In the above formula, d1 is the result of the first linear transformation; W1 is the first weight matrix; and b1 is the first bias vector. Second-layer encoder: Receives a dataset with dimension M1. The dimensionality is further reduced to M2 using the linear rectified function ReLU, resulting in the dataset. In the above formula, d2 is the result of the second linear transformation, W2 is the second weight matrix, and b2 is the second bias vector. The third encoder layer receives a dataset with dimension M2. The dataset output using the sigmoid activation function is between 0 and 1. The dimension is reduced to M3; In the above formula, d3 is the result of the third linear transformation, W3 is the third weight matrix, and b3 is the third bias vector. Third-layer decoder: Receives compressed dataset The first step of decoding is performed using the sigmoid activation function, restoring the output dimension to M2, thus obtaining the reconstructed dataset. In the above formula, d4 is the result of the fourth linear transformation, W4 is the fourth weight matrix, and b4 is the fourth bias vector. Second-layer decoder: Receives the dataset Applying the ReLU activation function again restores the dimension to M1, resulting in the reconstructed dataset. In the above formula, d5 is the result of the fifth linear transformation, W5 is the fifth weight matrix, and b5 is the fifth bias vector. First-layer decoder: Receives the dataset Finally, the hyperbolic tangent activation function tanh is used to restore the original dimension M, resulting in the final reconstructed dataset. In the above formula, d6 is the result of the sixth linear transformation, W6 is the sixth weight matrix, and b6 is the sixth bias vector. b6∈R B×M .
6. The unsupervised time series anomaly detection method according to claim 5, characterized in that, In step four, mean squared error is used as the loss function. The historical time-series data model of the instance anomaly detection task is compared and analyzed with the reconstructed historical time-series data model of the instance anomaly detection task to obtain the loss time-series dataset. and 7. The unsupervised time series anomaly detection method according to claim 6, characterized in that, In step five, the loss function value is... As the input dataset, Nt decision trees are randomly constructed, each with Ns samples, satisfying 1 ≤ Ns ≤ Bs, where Bs is the sample length of each batch. Without replacement, Ns samples are randomly selected. For each node, a feature m is randomly selected, satisfying 1 ≤ m ≤ M. From this feature, a split value s between the maximum and minimum values is randomly selected. This process is repeated recursively until the number of samples is less than or equal to 1 or the maximum tree height is reached. For each tree Nt, the path length from the root node to the leaf node containing sample x is h(x,Nt). Adjusting the average path length yields... H(i)=ln(i)+γ Where n is the number of samples per tree, c(n) is the normalization factor per tree, H(i) represents the logarithmic approximation of the harmonic number when the number of samples is i, and γ is the Euler constant. In the above formula, E(h(x) (i) S represents the average path length. (i) For abnormal scores, S (i) ∈R B×1 .