System and method for cross-system multivariate time series anomaly detection based on time-frequency multi-angle alignment

Abstract

The present disclosure relates to a cross-system multivariate time series anomaly detection system and method based on time-frequency multi-angle alignment, which comprises: a data coupling encoder processing heterogeneous time series data of source and target systems, mapping them to a unified dimension through local feature extraction and space-time attention mechanism, and outputting space-time coupling encoding; a shared time-frequency encoder extracting time and frequency domain features from the encoding and splicing them into a latent representation, calculating a distribution alignment loss, calculating a classification loss based on the source system label, and calculating a reconstruction loss of the target system through a reconstruction network; and a time-frequency enhanced normalization flow model extracting time-frequency conditions from the reconstructed data and fusing them into a conditional input, estimating the conditional probability density of the target data and calculating a flow model loss. The system trains the overall model by jointly optimizing the above losses to obtain an optimized model; the data to be tested is input into the optimized model, and the reconstruction error and negative log-likelihood value based on its output are used to determine data anomalies.

Description

Technical Field This disclosure relates to the field of multivariate time series anomaly detection and computer program technology, and to a cross-system multivariate time series anomaly detection system and method based on time-frequency multi-angle alignment. Background Technology With the rapid development of the Internet of Things (IoT) and various monitoring systems, an increasing number of sensors are being deployed to perceive the operational status and behavior of complex systems, resulting in a large amount of multivariate time series data. Effectively monitoring and detecting anomalies or outliers in multivariate time series data is crucial for fault detection and potential risk avoidance in many practical applications.

[0001] Time series anomaly detection aims to identify outliers or anomalous patterns in time series data, and it has wide applications in real-world industry and daily life. In recent years, deep learning-based methods have attracted widespread attention from researchers due to their powerful processing capabilities. With the advancement of related research, various techniques such as time series representation learning and adversarial training have been introduced into the field of time series anomaly detection, significantly improving the accuracy of anomaly detection.

[0002] However, most current time-series anomaly detection methods are based on the assumption of identical data distribution, assuming that training and testing data originate from the same system. However, in real-world industrial applications, cross-system scenarios such as multi-platform deployments, system upgrades, and business adjustments are common. As the algorithm model migrates from the original system to the new system, the data from the source and target systems are often heterogeneous due to differences in data collection methods and application scenarios. The data exhibits significant dimensional differences and distribution variations. Therefore, effectively bridging the data distribution gap between different systems, achieving efficient knowledge transfer from the source to the target system, and completing the anomaly detection task on the target system remains a challenging task.

[0003] The performance of cross-system anomaly detection is limited by the data differences between the source and target systems, making it crucial to reduce these distributional discrepancies. Domain adaptation is a technique to address this issue by transferring knowledge from a labeled source domain to an unlabeled target domain. This leverages the correlation between the two domains—labeled data from the source domain and unlabeled data from the target domain—to improve learning performance in the target domain. Current mainstream domain adaptation methods include distribution alignment methods and adversarial learning methods. The former learns domain-invariant features by minimizing the feature distribution differences between the source and target systems, using statistical metrics such as MMD to measure the distance between the feature distributions of the two domains, and incorporating a distribution alignment loss term into the model training. The latter introduces a domain discriminator, using adversarial training methods to make it difficult for the discriminator to distinguish features between the source and target systems, thus learning a domain-confused representation.

[0004] These methods have all achieved some results, but they all focus on time-domain alignment while ignoring frequency-domain information. The time domain can reveal the instantaneous changes and trends of data, while the frequency domain reflects the periodicity and frequency characteristics of the signal. In the source and target domains, time-domain and frequency-domain characteristics may have different distributions. Therefore, aligning the time or frequency domain alone cannot effectively bridge the data distribution gap, resulting in poor cross-domain migration performance. Summary of the Invention This disclosure addresses the problems in the prior art by providing a cross-system multivariate time series anomaly detection system and method based on time-frequency multi-angle alignment.

[0005] An exemplary embodiment of this disclosure discloses a cross-system multivariate time series anomaly detection system based on time-frequency multi-angle alignment, comprising: a data coupling encoder configured to preprocess and extract local features from source system data and target system data respectively to obtain source system local feature sequences and target system local feature sequences; and to unify the feature dimension of the source system local feature sequences and target system local feature sequences based on a spatiotemporal attention mechanism to obtain source system spatiotemporal coupling codes and target system spatiotemporal coupling codes, wherein the dimension of the source system data is: Data length is The dimensions of the target system data are Data length is And satisfy , The source system data contains label information, while the target system data does not. A shared time-frequency encoder is configured to extract features from the spatiotemporally coupled source system encoding and the spatiotemporally coupled target system encoding in the time and frequency domains, respectively, and then concatenate them to obtain latent representations of the source and target systems. It also calculates the distribution alignment loss, the classification loss using the label information from the source system data, and the reconstruction loss of the target system data through a reconstruction network. A time-frequency enhanced normalized flow model is configured to extract time and frequency conditions from the target system data reconstructed by the reconstruction network, and then fuse them. The system is configured to: input the conditional probability density of the target system data into the time-frequency augmented normalized flow model; and calculate the negative log-likelihood loss of the flow model. Specifically, the system is configured to: jointly optimize the parameters of the data-coupled encoder, the shared time-frequency encoder, and the time-frequency augmented normalized flow model based on the joint loss composed of distribution alignment loss, classification loss, reconstruction loss, and the negative log-likelihood loss of the flow model; and after optimization, input the data to be detected into the system. The system calculates the anomaly score and determines the anomaly of the data to be detected based on the reconstruction error output by its internal reconstruction network and the negative log-likelihood value output by the time-frequency augmented normalized flow model.

[0006] An exemplary embodiment of this disclosure provides a cross-system multivariate time series anomaly detection method based on time-frequency multi-angle alignment, comprising: preprocessing and extracting local features from source system data and target system data respectively to obtain source system local feature sequences and target system local feature sequences, wherein the dimension of the source system data is... Data length is The dimensions of the target system data are Data length is And satisfy , The source system data contains label information, while the target system data does not. Based on a spatiotemporal attention mechanism, the local feature sequences of the source and target systems are subjected to a unified feature dimension to obtain spatiotemporal coupled encodings for both systems. Features are extracted from the spatiotemporal coupled encodings of the source and target systems in the time and frequency domains, respectively, and then concatenated to obtain latent representations for the source and target systems, respectively, and the distribution alignment loss is calculated. The label information of the source system data is used to calculate the classification loss, and the reconstruction loss of the target system data is calculated through a reconstruction network. Temporal and frequency conditions are extracted from the reconstructed target system data, and these are fused and used as the conditional input to a time-frequency enhanced normalized flow model to calculate the conditional probability density of the reconstructed target system data and the negative log-likelihood loss of the flow model. The overall model is optimized based on the distribution alignment loss, classification loss, reconstruction loss, and negative log-likelihood loss of the flow model to obtain an optimized model. Finally, the data to be detected is input into the optimized model, and anomalies in the data are determined based on the reconstruction error and negative log-likelihood value of the output.

[0007] Among them, the distribution alignment loss uses Divergence minimizes the distributional differences between the source and target systems in the latent space, promoting domain alignment of data from different systems and mitigating distribution shifts caused by system differences. Classification loss calculates binary cross-entropy on the source labeled data, enabling the model to learn accumulated anomaly knowledge from the source system, effectively detecting anomalies in the source data and gaining anomaly detection capabilities. Reconstruction loss models the overall distribution on the target data, preventing aligned features from deviating from the original data. Flow model negative log-likelihood loss guides the model to learn an invertible mapping from data to prior distribution, accurately modeling the true probability distribution of the data. This results in normal samples having higher likelihood values ​​in the latent space, while anomalous samples correspond to lower likelihood values, thus enabling the model to effectively distinguish anomalies. These four types of losses work together, contributing to model optimization from different perspectives. They ensure that cross-system tasks overcome data dimensional and distributional differences, achieving efficient anomaly detection using improved flow models, overcoming difficulties in cross-system anomaly detection, and ultimately achieving effective cross-system anomaly detection.

[0008] In some exemplary embodiments, preprocessing and extracting local features from source system data and target system data to obtain source system local feature sequences and target system local feature sequences respectively includes: normalizing source system data and target system data respectively; and segmenting the normalized source system data and target system data into time series using sliding window technology, and applying a one-dimensional convolutional neural network to extract local features to obtain source system local feature sequences and target system local feature sequences.

[0009] In some exemplary embodiments, obtaining spatiotemporal coupled encoding of the source system and the target system based on a spatiotemporal attention mechanism by unifying the feature dimension includes: performing global average pooling and global max pooling on the source system and the target system local feature sequences respectively in the time dimension to obtain aggregate statistics for each feature channel; inputting the aggregate statistics into a multilayer perceptron to adaptively learn the importance weights of each feature channel, and adding the weight results based on global average pooling and global max pooling to obtain a spatial attention weight vector; and multiplying the spatial attention weight vector element-wise with the source system local feature sequences and the target system local feature sequences respectively in the channel dimension to obtain source system channel enhancement features and target system channel enhancement features. Global average pooling and global max pooling are performed on the channel dimensions of the source system channel enhancement features and the target system channel enhancement features, respectively, to obtain the aggregated statistics at each time step. The two are concatenated and processed through a one-dimensional convolutional layer to obtain the source system time attention weight vector and the target system time attention weight vector. The source system time attention weight vector and the target system time attention weight vector are then multiplied element-wise with the source system channel enhancement features and the target system channel enhancement features in the time dimension to obtain the source system spatiotemporal enhancement features and the target system spatiotemporal enhancement features. Convolution processing is performed on the source system spatiotemporal enhancement features and the target system spatiotemporal enhancement features to map them to the same preset dimension to obtain the source system spatiotemporal coupled coding and the target system spatiotemporal coupled coding.

[0010] In some exemplary embodiments, feature extraction and concatenation of the spatiotemporally coupled coding of the source system and the target system in the time and frequency domains, respectively, are performed to obtain the latent representations of the source system and the target system, respectively. The calculation of the distribution alignment loss includes: performing Fast Fourier Transform on the spatiotemporally coupled coding of the source system and the target system to transform the data from the time domain to the frequency domain; processing the frequency domain data through a complex convolutional network to extract frequency features, and extracting amplitude and phase features from the frequency features, concatenating the amplitude and phase features to obtain the frequency representation; applying a convolutional neural network and combining it with average pooling operations to the spatiotemporally coupled coding of the source system and the target system in the time domain to extract the time representation; concatenating the frequency representation with the time representation to form the latent representations of the source system and the target system; calculating the Sinkhorn divergence between the latent representations of the source system and the target system as the distribution alignment loss; and optimizing the distribution alignment loss to make the distributions of the source system data and the target system data in the latent representation space more consistent.

[0011] In some exemplary embodiments, calculating the classification loss using the label information of the source system data and calculating the reconstruction loss of the target system data through the reconstruction network includes: constructing a multilayer perceptron-based classifier, taking the latent representation of the source system as input, performing a classification task, and calculating the binary cross-entropy loss as the classification loss; and constructing a multilayer perceptron-based reconstruction network, taking the latent representation of the target system as input, reconstructing the spatiotemporal coupled code of the target system, and calculating the mean square error between the reconstructed spatiotemporal coupled code of the target system and the original spatiotemporal coupled code of the target system as the reconstruction loss.

[0012] In some exemplary embodiments, extracting temporal and frequency conditions from the reconstructed target system data using the reconstructed network, and fusing them as the conditional input to the time-frequency enhanced normalized flow model to calculate the conditional probability density of the reconstructed target system data and the negative log-likelihood loss of the flow model includes: in the time domain, the reconstructed target system is spatiotemporally coupled and encoded, the time dependencies are extracted using a recurrent neural network, and the dynamic relationships between different variables are modeled using a dynamic graph construction method, then processed by a graph convolutional network to obtain fused features as temporal conditions; in the frequency domain, the reconstructed target system is spatiotemporally coupled and encoded, a fast Fourier transform is applied to convert the data to the frequency domain, and frequency domain features are directly extracted using a complex neural network as frequency conditions; the time and frequency conditions are weighted and fused to obtain a fused conditional representation; the fused conditional representation is used as the conditional input, and the time-frequency enhanced normalized flow model is used to calculate the conditional probability density of the reconstructed target system data; based on the conditional probability density, the negative log-likelihood loss of the flow model used for model training is calculated.

[0013] In some exemplary embodiments, optimizing the overall model based on distribution alignment loss, classification loss, reconstruction loss, and negative log-likelihood loss of the flow model to obtain an optimized model includes: optimizing the overall model based on distribution alignment loss. Classification loss The joint loss is calculated using reconstruction loss and negative log-likelihood loss of the flow model; and the overall model is optimized by minimizing the joint total loss through backpropagation algorithm.

[0014] In some exemplary embodiments, inputting the data to be detected into an optimized model and determining the anomaly of the data based on its output reconstruction error and negative log-likelihood value includes: collecting data from different systems in the same scene as the data to be detected; inputting the data to be detected into the optimized model; calculating the reconstruction error of the data to be detected through the reconstruction network in the optimized model; calculating the negative log-likelihood value of the data to be detected through the time-frequency enhanced normalized flow model in the optimized model; weighting and fusing the reconstruction error and the negative log-likelihood value to obtain a comprehensive anomaly score; comparing the comprehensive anomaly score with a preset detection threshold, and if the score is higher than the threshold, determining that the data to be detected is anomaly.

[0015] The system disclosed herein includes: a data-coupled encoder that processes heterogeneous time-series data from a source system and a target system, maps them to a unified dimension through local feature extraction and a spatiotemporal attention mechanism, and outputs a spatiotemporally coupled code; a shared time-frequency encoder that extracts time-domain and frequency-domain features from the code and concatenates them into a latent representation, calculates the distribution alignment loss, calculates the classification loss based on the source system label, and calculates the reconstruction loss of the target system through a reconstruction network; and a time-frequency enhanced normalized flow model that extracts time-frequency conditions from the reconstructed data and fuses them into a conditional input, estimates the conditional probability density of the target data, and calculates the flow model loss. The system trains the overall model by jointly optimizing the above losses to obtain an optimized model; the test data is input into the optimized model, and data anomalies are determined based on the reconstruction error and negative log-likelihood value output by the model.

[0016] The system, method, or model proposed in this disclosure is the first to focus on the problem of cross-system anomaly detection, providing a novel perspective for improving anomaly detection performance. By leveraging anomaly knowledge accumulated in the source system and transferring it to a new target system, it effectively addresses the data heterogeneity problem between different systems in the same scenario. Compared to traditional methods based on the assumption of identical data distribution, this method significantly improves anomaly detection performance and generalization ability in new environments, and provides stable and reliable anomaly detection capabilities in real-world scenarios such as multi-platform deployment, system upgrades, and business adjustments.

[0017] This disclosure effectively bridges the dimensionality differences between different datasets through a data-coupled encoder. Utilizing a spatial attention mechanism, it adaptively learns the importance of each channel, uncovers correlations between different channels, enhances focus on features of important channels, captures channels more crucial for anomaly detection, and suppresses noise and redundant channels. Simultaneously, it complements temporal and spatial attention to extract key temporal features, achieving comprehensive encoding of spatiotemporal information. By unifying the dimensionality of different datasets, it bridges the dimensionality gap, thereby improving the effectiveness of cross-system feature alignment and transfer learning.

[0018] This disclosure achieves multi-angle alignment of time and frequency by using a shared time-frequency encoder, simultaneously considering both time-domain and frequency-domain features. In anomaly detection tasks, time-domain features are more sensitive to temporal dynamics and can detect abrupt anomalies. Frequency-domain features are more sensitive to periodic changes and can detect seasonal anomalies. The shared time-frequency encoder, by modeling in both the time and frequency domains, significantly reduces the distributional differences between source and target data, effectively promoting the full transfer of anomaly knowledge.

[0019] This disclosure classifies source data using a multilayer perceptron-based classifier, effectively utilizing anomaly knowledge from the source system to help both source and target data achieve a good embedding representation and anomaly detection capability. Simultaneously, a multilayer perceptron-based reconstruction network reconstructs the aligned features, preventing the alignment process from causing features to deviate excessively from the target data. This disclosure uses... Divergence-aligned data distribution Divergence focuses more on the overall geometric distribution of a distribution, rather than just point-to-point similarity. It is more robust to high-dimensional distributions and enables efficient and accurate knowledge transfer.

[0020] This disclosure employs an improved flow model for anomaly detection, significantly enhancing the detection performance of complex anomalies. The flow model is a generative model capable of directly learning the probability density function of data; for datasets with complex anomaly patterns, its powerful modeling capabilities compensate for the limitations of reconstruction methods.

[0021] This disclosure fully utilizes the aligned time-frequency features to model simultaneously in both the time and frequency dimensions. In the time dimension, the data is processed through... Temporal relationships are extracted by constructing relationships between variables using a dynamic graph, and fused features are obtained using graph convolution as temporal conditions. In the frequency dimension, a Fast Fourier Transform is used to extract and transform the data into frequency representations, and frequency features are directly extracted as frequency conditions through a complex neural network. The fusion of time-frequency conditions facilitates the mapping process of the flow model. This method achieves state-of-the-art performance on multiple cross-domain datasets.

[0022] This disclosure proposes a data coupling coding method to compensate for the dimensional differences in data from different systems. It uses a multi-angle alignment strategy to bridge the data distribution gap between different systems, achieving efficient data migration. It overcomes the shortcomings of traditional methods in dealing with data heterogeneity. It can effectively utilize the rich anomaly knowledge accumulated on labeled source systems to help improve the anomaly detection effect on unlabeled target systems. It can effectively cope with scenarios such as multi-platform deployment, system upgrades, and business adjustments in reality. Attached Figure Description To more clearly illustrate the technical solutions in the embodiments of this disclosure or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this disclosure. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0023] Figure 1 This is a schematic diagram of the structure of a cross-system multivariable timing anomaly detection system based on time-frequency multi-angle alignment according to an exemplary embodiment of the present disclosure.

[0024] Figure 2This is a flowchart of a cross-system multivariable timing anomaly detection method based on time-frequency multi-angle alignment according to an exemplary embodiment of the present disclosure.

[0025] Figure 3 The figure shows experimental results of a cross-system multivariate timing anomaly detection method based on time-frequency multi-angle alignment according to an exemplary embodiment of the present disclosure. Detailed Implementation The technical solutions of the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this disclosure, and not all embodiments. Based on the embodiments of this disclosure, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this disclosure.

[0026] Figure 1 This is a schematic diagram of the structure of a cross-system multivariable timing anomaly detection system based on time-frequency multi-angle alignment according to an exemplary embodiment of the present disclosure.

[0027] According to exemplary embodiments of this disclosure, a cross-system multivariate time series anomaly detection system based on time-frequency multi-angle alignment is provided, which aims to solve the problem that anomaly detection models are difficult to directly transfer between different monitoring systems due to differences in the number of sensors, sampling frequency, data format, etc.

[0028] like Figure 1 As shown, an exemplary embodiment of this disclosure discloses a cross-system multivariate time series anomaly detection system based on time-frequency multi-angle alignment, comprising: a data coupling encoder configured to preprocess and extract local features from source system data and target system data respectively to obtain source system local feature sequences and target system local feature sequences; and to unify the feature dimension of the source system local feature sequences and target system local feature sequences based on a spatiotemporal attention mechanism to obtain source system spatiotemporal coupling codes and target system spatiotemporal coupling codes, wherein the dimension of the source system data is... Data length is The dimensions of the target system data are Data length is And satisfy , The source system data contains label information, while the target system data does not. A shared time-frequency encoder is configured to extract features from the spatiotemporally coupled source system encoding and the spatiotemporally coupled target system encoding in the time and frequency domains, respectively, and then concatenate them to obtain latent representations of the source and target systems. It also calculates the distribution alignment loss, the classification loss using the label information from the source system data, and the reconstruction loss of the target system data through a reconstruction network. A time-frequency enhanced normalized flow model is configured to extract time and frequency conditions from the target system data reconstructed by the reconstruction network, and then fuse them. The system is configured to: input the conditional probability density of the target system data into the time-frequency augmented normalized flow model; and calculate the negative log-likelihood loss of the flow model. Specifically, the system is configured to: jointly optimize the parameters of the data-coupled encoder, the shared time-frequency encoder, and the time-frequency augmented normalized flow model based on the joint loss composed of distribution alignment loss, classification loss, reconstruction loss, and the negative log-likelihood loss of the flow model; and after optimization, input the data to be detected into the system. The system calculates the anomaly score and determines the anomaly of the data to be detected based on the reconstruction error output by its internal reconstruction network and the negative log-likelihood value output by the time-frequency augmented normalized flow model.

[0029] like Figure 1 As shown, the system mainly includes a data-coupled encoder, a shared time-frequency encoder, and a time-frequency enhanced normalized flow model. The data-coupled encoder is responsible for processing heterogeneous time-series data from different systems. Specifically, in practical application scenarios, the source system (e.g., an old factory monitoring network that has been running for many years) may contain n sensors (such as temperature, pressure, and vibration sensors), continuously collecting time-series data of length Ts and accumulating labeled information with clear annotations (normal or abnormal). The target system (e.g., a newly upgraded monitoring platform) deploys m sensors (m and n can be different, and sensor types can be added or replaced), collecting unlabeled data of length Tt.

[0030] A data-coupled encoder typically comprises parallel source-domain and target-domain data encoders. These encoders first perform preprocessing, such as normalization, on the input source and target system data to eliminate scale differences. Then, using a sliding window combined with a one-dimensional convolutional neural network, they extract local feature sequences from the original high-dimensional time-series data, reflecting local dynamic patterns in both the source and target systems. To further enhance feature representation and focus key information, the encoder introduces a spatiotemporal attention mechanism: first, spatial attention is applied in the time dimension to adaptively learn and weight the importance of different sensor channels; then, temporal attention is applied in the channel dimension to highlight key time segments. Finally, convolutional layers project the processed feature sequences of both types onto the same preset feature dimension, resulting in source-system and target-system spatiotemporally coupled codes with unified dimensionality, effectively bridging the dimensionality differences of the original data.

[0031] A shared time-frequency encoder receives the aforementioned coupled encoding, achieving distribution alignment of cross-system data. This encoder analyzes the input from both the time and frequency domains. In the frequency domain, a Fast Fourier Transform (FFT) is applied to the spatiotemporal coupled encoding to transform it to the frequency domain. Frequency domain features are extracted using a complex convolutional network, and their amplitude and phase are calculated separately. These two are then concatenated to form a frequency representation, which helps capture potential periodic or spectral anomalies in the data. In the time domain, a Convolutional Neural Network (CNN) combined with average pooling is used to extract the trend and morphological features of the data's evolution over time, serving as a time representation. Concatenating the time and frequency domain representations yields the latent representations of the source and target systems, respectively, containing multi-dimensional information. To reduce the distribution differences between the two systems in the feature space, the encoder calculates the Sinkhorn divergence between their latent representations as a distribution alignment loss. In addition, to fully utilize the supervisory information of the source system and ensure the quality of the target system features, this module also has two auxiliary tasks: a multilayer perceptron (MLP) based classifier uses the latent representation of the source system and its labels to calculate the classification loss in order to transfer anomaly discrimination knowledge; another MLP based reconstruction network attempts to recover the spatiotemporal coupling encoding from the latent representation of the target system, and uses the calculation of reconstruction loss to constrain feature learning and prevent excessive distortion in the alignment process.

[0032] The time-frequency enhanced normalized flow model is the anomaly detection module of the system. It receives reconstructed target system data generated by the reconstruction network in the shared time-frequency encoder. The model first extracts time and frequency conditions from this data: the time condition captures temporal dependencies through a recurrent neural network (RNN) and combines dynamic graph construction and graph convolution (GCN) to model the dynamic relationships between variables; the frequency condition is extracted directly through a complex neural network after the data is subjected to another FFT transformation. These two conditions are weighted and fused to form a comprehensive time-frequency condition vector. This condition vector then serves as the condition input to the normalized flow model, guiding the flow model to map the target system data to a simple base distribution (such as a standard Gaussian distribution), thereby accurately estimating the conditional probability density of the normal data of the target system, and simultaneously calculating the negative log-likelihood loss of the flow model.

[0033] The entire system employs an end-to-end training approach. The system is configured to combine the aforementioned distribution alignment loss, classification loss, reconstruction loss, and negative log-likelihood loss of the flow model into a joint loss function. Through the backpropagation algorithm, all parameters in the data-coupled encoder, shared time-frequency encoder, and time-frequency enhanced normalized flow model are simultaneously optimized, enabling the modules to work collaboratively and ultimately obtaining an anomaly detection model optimized for the target system.

[0034] After model optimization, the inference and detection phase begins. The system is configured to accept real-time data from the target system as input. The system's internal reconstruction network outputs the reconstruction error of this data, while the time-frequency enhanced normalized flow model outputs its negative log-likelihood value. The system weighted and fused these two metrics to calculate a comprehensive anomaly score. By comparing this score with a preset threshold, it can be determined whether the current data is an anomaly, thus achieving accurate and adaptive cross-system anomaly detection.

[0035] Figure 2 This is a flowchart of a cross-system multivariable timing anomaly detection method based on time-frequency multi-angle alignment according to an exemplary embodiment of the present disclosure.

[0036] like Figure 1 and Figure 2 As shown, a cross-system multivariate time series anomaly detection method based on time-frequency multi-angle alignment effectively utilizes the rich anomaly knowledge accumulated in labeled source systems to help improve anomaly detection performance in unlabeled target systems. The source system time series data dimension is set as follows: This indicates that the data comes from One sensor, data length is The target system data dimension is The data length is . and , and The differences vary across different datasets. The source system dataset contains label information, while the target system dataset does not.

[0037] like Figure 2 As shown, an exemplary embodiment of this disclosure provides a cross-system multivariate time series anomaly detection method based on time-frequency multi-angle alignment, comprising: preprocessing and extracting local features from source system data and target system data respectively to obtain source system local feature sequences and target system local feature sequences (S1); unifying the feature dimensions of the source system local feature sequences and target system local feature sequences based on a spatiotemporal attention mechanism to obtain source system spatiotemporal coupled coding and target system spatiotemporal coupled coding (S2); extracting features from the source system spatiotemporal coupled coding and target system spatiotemporal coupled coding in the time domain and frequency domain respectively, and concatenating them to obtain source system latent representation and target system latent representation, and calculating the distribution alignment loss (S2). 3) Calculate the classification loss using the label information of the source system data, and calculate the reconstruction loss of the target system data using the reconstruction network (S4); extract the time condition and frequency condition from the target system data reconstructed by the reconstruction network, and fuse them as the condition input of the time-frequency enhanced normalized flow model to calculate the conditional probability density of the reconstructed target system data, and calculate the negative log-likelihood loss of the flow model (S5); optimize the overall model based on the distribution alignment loss, classification loss, reconstruction loss and negative log-likelihood loss of the flow model to obtain the optimized model (S6); and input the data to be detected into the optimized model, and determine the anomaly of the data to be detected based on its output reconstruction error and negative log-likelihood value (S7).

[0038] Step S1, will Weiyuan system data and The data of the target system are normalized, and local features are extracted through sliding window and one-dimensional convolution.

[0039] Step S2 uses spatial and temporal attention to capture important features, further enhancing feature representation capabilities. Based on the local features obtained in Step S1, global average pooling and max pooling are first performed in the temporal dimension. A multilayer perceptron adaptively learns the importance weights for each channel, and the two are summed to obtain the spatial attention map. The attention weights are then applied element-wise to the original feature map to obtain channel-enhanced features. The same processing is performed in the channel dimension and applied to the feature map to obtain spatiotemporal enhanced features. Finally, convolutional layers map the features of the source and target systems to a unified dimension. This serves as the final spatiotemporal coupling code.

[0040] Step S3: Apply Fast Fourier Transform to the spatiotemporal coupled code obtained in Step S2 to transfer the data from the time domain to the frequency domain. Obtain frequency features through convolution, and extract their phase and amplitude, concatenating them as the frequency representation. In the time domain, a convolutional neural network combined with average pooling is used to obtain the time representation. The latent representation is obtained by concatenating it with the frequency representation. The latent representations are obtained by processing the source system data and the target data separately. and ,pass Divergence calculations reveal the latent representation differences between the source and target systems. To align the domain distribution.

[0041] Step S4: To leverage anomalous knowledge from the source system and help obtain a good embedding representation for both the source and target data, a multilayer perceptron-based classifier is used to classify the source data using the original data labels, and the classification loss is calculated using binary cross-entropy. Model optimization. To prevent the aligned features from deviating excessively from the target data, a reconstruction network based on a multilayer perceptron is used to model the target system data. The reconstructed target system data is as follows: And calculate the reconstruction loss. .

[0042] Step S5, in the time domain, through The target system data reconstructed in step S4 Extracting temporal relationships and constructing a dynamic graph. Extract the relationships between variables and use graph convolution to obtain fused features as a temporal condition. In the frequency domain, fast Fourier transform and complex neural networks are used to directly extract frequency features as frequency conditions. Weighted fusion time and frequency conditions are obtained. This facilitates the flow model mapping process, thereby enabling accurate estimation of time series density.

[0043] Step S6: Based on the above steps, construct a cross-domain multivariate temporal anomaly detection model with time-frequency multi-angle alignment, and apply the distribution alignment loss obtained in step S3. The classification loss obtained in step S4 Reconstruction loss The loss obtained by mapping the likelihood loss function of the flow model in step S5. Added together as the total loss Optimize the model.

[0044] Step S7: Collect data from different systems within the same scenario, and obtain a mature model through training and testing. Input the test data into the model, and use the reconstruction error calculated in step S4. The negative log-likelihood of the flow model from step S5 is used to calculate the anomaly score. A threshold is set; anomalies with scores higher than the threshold are considered anomalies, and the detection results are output.

[0045] In some exemplary embodiments, preprocessing and extracting local features from source system data and target system data to obtain source system local feature sequences and target system local feature sequences respectively includes: normalizing source system data and target system data respectively; and segmenting the normalized source system data and target system data into time series using sliding window technology, and applying a one-dimensional convolutional neural network to extract local features to obtain source system local feature sequences and target system local feature sequences.

[0046] Specifically, Weiyuan system data and The data of the target system are normalized, and local features are extracted through sliding window and one-dimensional convolution.

[0047] For input multivariate time series data Normalization is performed to eliminate differences in scale and statistical distribution between data from different systems, making them comparable within the same feature space. It is the length of the input data, i.e., the length of the time step. This refers to the feature dimensions of the input data. For each feature, i.e., each column of data, the following processing is performed: in, This represents the data for each feature column. Represents the characteristic mean. Represents the characteristic variance. This represents the normalized feature columns.

[0048] Local feature patterns are extracted using a sliding window and one-dimensional convolution based on the normalized data.

[0049] in, , It is the feature dimension after convolution. It is a weight matrix. It is a product operator. It is an activation function.

[0050] In some exemplary embodiments, obtaining spatiotemporal coupled encoding of the source system and the target system based on a spatiotemporal attention mechanism by unifying the feature dimension includes: performing global average pooling and global max pooling on the source system and the target system local feature sequences respectively in the time dimension to obtain aggregate statistics for each feature channel; inputting the aggregate statistics into a multilayer perceptron to adaptively learn the importance weights of each feature channel, and adding the weight results based on global average pooling and global max pooling to obtain a spatial attention weight vector; and multiplying the spatial attention weight vector element-wise with the source system local feature sequences and the target system local feature sequences respectively in the channel dimension to obtain source system channel enhancement features and target system channel enhancement features. Global average pooling and global max pooling are performed on the channel dimensions of the source system channel enhancement features and the target system channel enhancement features, respectively, to obtain the aggregated statistics at each time step. The two are concatenated and processed through a one-dimensional convolutional layer to obtain the source system time attention weight vector and the target system time attention weight vector. The source system time attention weight vector and the target system time attention weight vector are then multiplied element-wise with the source system channel enhancement features and the target system channel enhancement features in the time dimension to obtain the source system spatiotemporal enhancement features and the target system spatiotemporal enhancement features. Convolution processing is performed on the source system spatiotemporal enhancement features and the target system spatiotemporal enhancement features to map them to the same preset dimension to obtain the source system spatiotemporal coupled coding and the target system spatiotemporal coupled coding.

[0051] Specifically, based on the local features obtained in step S1, global average pooling and max pooling are first performed in the time dimension. The importance weights of each channel are adaptively learned through a multilayer perceptron, and the two are added together to obtain a spatial attention map.

[0052] The following formula is used to perform average pooling on local features: Max pooling is performed using the following formula: in, By concatenating all the channel results, we can obtain and Both are input into a shared linear layer, which adaptively learns the importance weights of each channel: in The same process is used to obtain the weight matrix. Add the two together Activation function to obtain spatial attention map .

[0053] in The attention weights are then multiplied element-wise on the original feature map to obtain channel-enhanced features: Channel enhancement features This process can enhance the focus on important channel features, capture channels that are more important to the anomaly detection task, and suppress noise and redundant channels.

[0054] Perform average pooling and max pooling along the channel dimension and then concatenate them to obtain the result. .

[0055] The following formula is used to perform average pooling on local features: Max pooling is performed using the following formula: spliced ​​together : Then, a temporal attention map is obtained through one-dimensional convolution and the Sigmoid activation function. : and with Element-wise multiplication along the channel dimension yields the spatiotemporal augmentation features. : To compensate for the resolution loss caused by global pooling and max pooling, and to perform dimensionality projection, convolution is used to re-integrate features at a fine-grained level to obtain the final spatiotemporal coupled encoding.

[0056] in , This refers to the unified dimension of the two-domain datasets. Both the source and target system data will have their respective proprietary coupling coding modules extracting domain information and unifying the dimension to obtain the final spatiotemporal coupling code. .

[0057] In some exemplary embodiments, feature extraction and concatenation of the spatiotemporally coupled coding of the source system and the target system in the time and frequency domains, respectively, are performed to obtain the latent representations of the source system and the target system, respectively. The calculation of the distribution alignment loss includes: performing Fast Fourier Transform on the spatiotemporally coupled coding of the source system and the target system to transform the data from the time domain to the frequency domain; processing the frequency domain data through a complex convolutional network to extract frequency features, and extracting amplitude and phase features from the frequency features, concatenating the amplitude and phase features to obtain the frequency representation; applying a convolutional neural network and combining it with average pooling operations to the spatiotemporally coupled coding of the source system and the target system in the time domain to extract the time representation; concatenating the frequency representation with the time representation to form the latent representations of the source system and the target system; calculating the Sinkhorn divergence between the latent representations of the source system and the target system as the distribution alignment loss; and optimizing the distribution alignment loss to make the distributions of the source system data and the target system data in the latent representation space more consistent.

[0058] Specifically, the spatiotemporal coupled code obtained in step S2 is applied to the Fast Fourier Transform (FFT) to transfer the data from the time domain to the frequency domain. The FFT uses the following formula: Obtaining frequency features through convolution: in, This represents a complex weighted matrix. Its phase and amplitude are extracted and concatenated to form the frequency representation. The phase is extracted using the following formula: in, Let these represent the real and imaginary parts, respectively. The amplitude is extracted using the following formula: Phase and amplitude are spliced ​​together as a frequency representation : In the time domain, the following formula is used to obtain the time representation through a convolutional neural network combined with average pooling. .

[0059] in, This represents a convolutional neural network. The frequency representation is concatenated with the time representation to obtain the final latent representation. .

[0060] pass Divergence is used to calculate the latent representation differences between the source and target systems to align the domain distribution: in, This represents the optimal transmission with entropy regularization. The entropy regularization coefficient controls the regularization strength. Calculated using the following formula: in, Therefore As support point distributed.

[0061] In some exemplary embodiments, calculating the classification loss using the label information of the source system data and calculating the reconstruction loss of the target system data through the reconstruction network includes: constructing a multilayer perceptron-based classifier, taking the latent representation of the source system as input, performing a classification task, and calculating the binary cross-entropy loss as the classification loss; and constructing a multilayer perceptron-based reconstruction network, taking the latent representation of the target system as input, reconstructing the spatiotemporal coupled code of the target system, and calculating the mean square error between the reconstructed spatiotemporal coupled code of the target system and the original spatiotemporal coupled code of the target system as the reconstruction loss.

[0062] Specifically, to leverage anomaly knowledge from the original system to help obtain a good embedding representation for both the original and target data, and to gain the ability to identify anomalies, a multilayer perceptron-based classifier is used. The original data is classified to utilize its labels, and a binary cross-entropy loss optimization model is computed. Its input is the latent representation of the source system data encoded by a shared time-frequency encoder. The calculation formula is as follows: To prevent the aligned features from deviating excessively from the target data, a reconstruction loss is calculated to accurately model the overall distribution of the target data. A reconstruction network based on a multilayer perceptron is used. Model the target system data.

[0063] in, This is the reconstructed target system data. The reconstruction loss is calculated using the following formula: in, This represents the mean square error.

[0064] In some exemplary embodiments, extracting temporal and frequency conditions from the reconstructed target system data using the reconstructed network, and fusing them as the conditional input to the time-frequency enhanced normalized flow model to calculate the conditional probability density of the reconstructed target system data and the negative log-likelihood loss of the flow model includes: in the time domain, the reconstructed target system is spatiotemporally coupled and encoded, the time dependencies are extracted using a recurrent neural network, and the dynamic relationships between different variables are modeled using a dynamic graph construction method, then processed by a graph convolutional network to obtain fused features as temporal conditions; in the frequency domain, the reconstructed target system is spatiotemporally coupled and encoded, a fast Fourier transform is applied to convert the data to the frequency domain, and frequency domain features are directly extracted using a complex neural network as frequency conditions; the time and frequency conditions are weighted and fused to obtain a fused conditional representation; the fused conditional representation is used as the conditional input, and the time-frequency enhanced normalized flow model is used to calculate the conditional probability density of the reconstructed target system data; based on the conditional probability density, the negative log-likelihood loss of the flow model used for model training is calculated.

[0065] Specifically, to fully utilize the aligned time-frequency features, this disclosure improves the traditional flow model by simultaneously modeling in both the time and frequency dimensions. In the time domain, a recurrent neural network is used to extract the temporal relationships from the target system data reconstructed in step S4.

[0066] in, Indicates the first One channel The hidden state.

[0067] Relationships between variables are extracted by constructing dynamic graphs, and fused features are obtained using graph convolution as a temporal condition. .

[0068] in, They are and Weight matrix, An activation function is a commonly used function for classification tasks that maps a set of real numbers to a corresponding probability distribution. These are graph convolution and historical information weights, respectively.

[0069] In the frequency domain, fast Fourier transform and complex neural networks are applied to directly extract frequency features as frequency conditions. .

[0070] in This represents learnable frequency domain filtering. This represents the complex weight matrix.

[0071] Weighted fusion time conditions and frequency conditions Used for normalized flow model mapping process.

[0072] in It is the fusion coefficient. yes No. Data from each channel, It is a Gaussian distribution. It is a normalized flow model. It is the Jacobian determinant. The likelihood loss function used in the flow model mapping process is: In some exemplary embodiments, optimizing the overall model based on distribution alignment loss, classification loss, reconstruction loss, and negative log-likelihood loss of the flow model to obtain an optimized model includes: optimizing the overall model based on distribution alignment loss. Classification loss The joint loss is calculated using reconstruction loss and negative log-likelihood loss of the flow model; and the overall model is optimized by minimizing the joint total loss through backpropagation algorithm.

[0073] Specifically, based on the above steps, a cross-domain multivariate temporal anomaly detection model with time-frequency multi-angle alignment is constructed, and the distribution alignment loss obtained in step S3 is used. The classification loss obtained in step S4 Reconstruction loss The loss obtained by mapping the likelihood loss function of the flow model in step S5. The sum is used as the total loss to optimize the model.

[0074] In some exemplary embodiments, inputting the data to be detected into an optimized model and determining the anomaly of the data based on its output reconstruction error and negative log-likelihood value includes: collecting data from different systems in the same scene as the data to be detected; inputting the data to be detected into the optimized model; calculating the reconstruction error of the data to be detected through the reconstruction network in the optimized model; calculating the negative log-likelihood value of the data to be detected through the time-frequency enhanced normalized flow model in the optimized model; weighting and fusing the reconstruction error and the negative log-likelihood value to obtain a comprehensive anomaly score; comparing the comprehensive anomaly score with a preset detection threshold, and if the score is higher than the threshold, determining that the data to be detected is anomaly.

[0075] Data from different systems within the same scenario is collected, and a mature model (i.e., an optimized model) is obtained through training and testing. The test data is then input into the model, and the reconstruction error is calculated in step S4. The negative log-likelihood of the flow model in step S5 Weighted fusion calculation as outlier score .

[0076] in These represent a data-coupled encoder and a shared time-frequency encoder, respectively. Indicates decoder, This represents the dimension after data coupling and encoding. Represents probability density, This represents the weighted fusion coefficient.

[0077] During model training, select from the training set Accuracy is selected as the model evaluation criterion when testing the model on the test set. Recall rate , The score is used as the evaluation index of the model, and the optimal threshold method is used to select the threshold. Abnormal scores above the threshold are judged as abnormal, otherwise they are normal.

[0078] In a preferred embodiment of this disclosure, step S7 involves selecting during model verification. The score is used as an evaluation metric for the model. It is a weighted average of the model's precision and recall, with a maximum value of 1 and a minimum value of 0. The calculation formula is as follows: ;in Accuracy is expressed by the following formula: , Recall rate is represented by the formula: , This indicates the number of outliers that are marked as anomalous. To determine the number of normal values ​​that are marked as abnormal, This involves marking outliers as normal; taking The model with the highest score is considered the mature model, and the maximum abnormal score on the validation set at this point is used as the threshold for the detection stage in step S7.

[0079] Figure 3 The figure shows experimental results of a cross-system multivariate timing anomaly detection method based on time-frequency multi-angle alignment according to an exemplary embodiment of the present disclosure.

[0080] To verify the effectiveness of the proposed method in cross-system anomaly detection, cross-system experiments were conducted in various common scenarios. The performance advantages of the proposed method were compared and analyzed in conjunction with current mainstream baseline models and knowledge transfer methods. Compared with the baseline model, the proposed method achieved optimal performance in all experiments. Furthermore, by utilizing prior knowledge of anomalies in the original system through knowledge transfer methods, the proposed method achieved suboptimal performance in the vast majority of the three cross-system experimental settings. This further verifies the feasibility of improving anomaly detection performance through cross-system anomaly detection tasks.

[0081] Furthermore, to verify the effectiveness of each module of the system disclosed herein, comparative experiments were conducted by removing the data coupling encoder, the shared time-frequency encoder, and the streaming model respectively. The results show that removing any key module leads to a decrease in model performance, with the removal of the shared time-frequency encoder causing the most significant performance degradation. This fully demonstrates that the cross-system knowledge transfer module of the system disclosed herein plays a crucial role in improving anomaly detection performance. In addition, the removal of the streaming model also has a significant impact on overall performance, indicating that for datasets with complex anomaly patterns, the streaming model effectively compensates for the limitations of the reconstruction method, thereby significantly improving the detection effect of complex anomalies. Experimental results are as follows: Figure 3 As shown.

[0082] The above description is merely a preferred embodiment of this disclosure and an explanation of the technical principles used, and is not intended to limit the scope of the claimed disclosure, but only to illustrate preferred embodiments of this disclosure. Those skilled in the art should understand that the scope of the invention involved in this disclosure is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalent features without departing from the inventive concept. All other embodiments obtained by those skilled in the art based on the embodiments of this disclosure without inventive effort are within the scope of protection of this disclosure.

Claims

1. A cross-system multivariate time series anomaly detection system based on time-frequency multi-angle alignment, characterized in that, include: A data coupling encoder is configured to preprocess and extract local features from source system data and target system data respectively to obtain source system local feature sequences and target system local feature sequences, and to unify the feature dimension of the source system local feature sequences and target system local feature sequences based on a spatiotemporal attention mechanism to obtain source system spatiotemporal coupling codes and target system spatiotemporal coupling codes, wherein the dimension of the source system data is... Data length is The dimension of the target system data is Data length is And satisfy , The source system data contains tag information while the target system data does not. A shared time-frequency encoder is configured to extract features from the spatiotemporally coupled source system code and the spatiotemporally coupled target system code in the time and frequency domains, respectively, and then concatenate them to obtain latent representations of the source and target systems. It also calculates distribution alignment loss, classification loss using the label information of the source system data, and reconstruction loss of the target system data through a reconstruction network. The time-frequency enhanced normalized flow model is configured to extract time and frequency conditions from the target system data reconstructed by the reconstruction network, and then fuse them as the conditional input to the time-frequency enhanced normalized flow model to calculate the conditional probability density of the target system data and the negative log-likelihood loss of the flow model. The system is configured to: jointly optimize the parameters of the data-coupled encoder, the shared time-frequency encoder, and the time-frequency enhanced normalized flow model based on the joint loss composed of the distribution alignment loss, the classification loss, the reconstruction loss, and the negative log-likelihood loss of the flow model; and After optimization, the data to be detected is input into the system. The system calculates the anomaly score and determines the anomaly of the data to be detected based on the reconstruction error output by its internal reconstruction network and the negative log-likelihood value output by the time-frequency enhanced normalized flow model.

2. A method for anomaly detection in cross-system multivariate time series based on time-frequency multi-angle alignment, characterized in that, include: Preprocessing and local feature extraction are performed on the source system data and target system data respectively to obtain the source system local feature sequence and the target system local feature sequence, wherein the dimension of the source system data is . Data length is The dimension of the target system data is Data length is And satisfy , The source system data contains tag information while the target system data does not. Based on the spatiotemporal attention mechanism, the local feature sequences of the source system and the local feature sequences of the target system are subjected to a unified feature dimension to obtain the spatiotemporal coupled coding of the source system and the spatiotemporal coupled coding of the target system. The spatiotemporal coupled coding of the source system and the spatiotemporal coupled coding of the target system are extracted in the time domain and concatenated in the frequency domain to obtain the latent representation of the source system and the latent representation of the target system, and the distribution alignment loss is calculated. The classification loss is calculated using the label information of the source system data, and the reconstruction loss of the target system data is calculated using the reconstruction network. The time and frequency conditions are extracted from the target system data after reconstruction of the network, and the two are fused together as the condition input of the time-frequency enhanced normalized flow model to calculate the conditional probability density of the reconstructed target system data and the negative log-likelihood loss of the flow model. The overall model is optimized based on the distribution alignment loss, the classification loss, the reconstruction loss, and the negative log-likelihood loss of the flow model to obtain an optimized model; and The data to be detected is input into the optimized model, and the anomalies of the data to be detected are determined based on the reconstruction error and negative log-likelihood value output by the model.

3. The cross-system multivariate time series anomaly detection method based on time-frequency multi-angle alignment according to claim 2, characterized in that, Preprocessing and local feature extraction of source system data and target system data respectively to obtain local feature sequences of the source system and the target system include: The source system data and the target system data are respectively normalized; and The normalized source system data and target system data are segmented into time series using the sliding window technique, and a one-dimensional convolutional neural network is applied to extract local features to obtain the local feature sequences of the source system and the target system.

4. The cross-system multivariate time series anomaly detection method based on time-frequency multi-angle alignment according to claim 2, characterized in that, Based on the spatiotemporal attention mechanism, a unified feature dimension is applied to the local feature sequences of the source system and the target system respectively to obtain the spatiotemporal coupled coding of the source system and the target system, including: Global average pooling and global max pooling are performed on the local feature sequences of the source system and the target system respectively in the time dimension to obtain the aggregate statistics of each feature channel; The aggregated statistics are input into a multilayer perceptron to adaptively learn the importance weights of each feature channel. The weights based on global average pooling and global max pooling are then added together to obtain the spatial attention weight vector. The spatial attention weight vector is multiplied element-wise with the source system local feature sequence and the target system local feature sequence in the channel dimension to obtain the source system channel enhancement feature and the target system channel enhancement feature; Global average pooling and global max pooling are performed on the channel dimensions of the source system channel enhancement features and the target system channel enhancement features, respectively, to obtain the aggregate statistics at each time step. The two are concatenated and processed through a one-dimensional convolutional layer to obtain the source system time attention weight vector and the target system time attention weight vector. The source system time attention weight vector and the target system time attention weight vector are multiplied element-wise with the source system channel enhancement feature and the target system channel enhancement feature in the time dimension to obtain the source system spatiotemporal enhancement feature and the target system spatiotemporal enhancement feature. Convolution processing is performed on the spatiotemporal enhancement features of the source system and the spatiotemporal enhancement features of the target system to map the spatiotemporal enhancement features of the source system and the target system to the same preset dimension, so as to obtain the spatiotemporal coupled coding of the source system and the spatiotemporal coupled coding of the target system.

5. The cross-system multivariate time series anomaly detection method based on time-frequency multi-angle alignment according to claim 4, characterized in that, The spatiotemporal coupled coding of the source system and the spatiotemporal coupled coding of the target system are feature extracted in the time domain and frequency domain respectively, and then concatenated to obtain the latent representations of the source system and the target system, and the distribution alignment loss is calculated, including: Fast Fourier transform is performed on the spatiotemporal coupling coding of the source system and the spatiotemporal coupling coding of the target system respectively to convert the data from the time domain to the frequency domain; The frequency domain data is processed by a complex convolutional network to extract frequency features. Amplitude and phase features are then extracted from the frequency features. The amplitude and phase features are concatenated to obtain the frequency representation. In the time domain, convolutional neural networks are applied to the spatiotemporal coupled coding of the source system and the spatiotemporal coupled coding of the target system, respectively, and combined with average pooling operations to extract the time representation. The frequency representation and the time representation are concatenated to form the latent representation of the source system and the latent representation of the target system; Based on the latent representations of the source system and the target system, the Sinkhorn divergence between them is calculated as the distribution alignment loss. By optimizing the distribution alignment loss, the distribution of source system data and target system data in the latent representation space tends to be consistent.

6. The cross-system multivariate time series anomaly detection method based on time-frequency multi-angle alignment according to claim 5, characterized in that, The calculation of classification loss using the label information of the source system data and the calculation of reconstruction loss of the target system data through the reconstruction network include: A multilayer perceptron-based classifier is constructed, taking the latent representation of the source system as input, to perform a classification task, and calculating the binary cross-entropy loss as the classification loss; and A reconstruction network based on a multilayer perceptron is constructed. The latent representation of the target system is used as input to reconstruct the spatiotemporal coupled coding of the target system. The mean square error between the reconstructed spatiotemporal coupled coding of the target system and the original spatiotemporal coupled coding of the target system is calculated as the reconstruction loss.

7. The cross-system multivariate time series anomaly detection method based on time-frequency multi-angle alignment according to claim 6, characterized in that, The time and frequency conditions are extracted from the reconstructed target system data, and then fused together as the conditional input to the time-frequency enhanced normalized flow model. This is used to calculate the conditional probability density of the reconstructed target system data and to calculate the negative log-likelihood loss of the flow model, including: In the time domain, the reconstructed target system is spatiotemporally coupled encoded, the time dependency is extracted by a recurrent neural network, and the dynamic relationship between different variables is modeled by a dynamic graph construction method. Then, the fused features are obtained by graph convolutional network processing, which serve as time conditions. In the frequency domain, a fast Fourier transform is applied to the spatiotemporal coupling coding of the reconstructed target system to convert the data to the frequency domain, and frequency domain features are directly extracted through a complex neural network as frequency conditions. The time condition and frequency condition are weighted and fused to obtain the fused condition representation; The fusion condition representation is used as the condition input, and the conditional probability density of the reconstructed target system data is calculated using the time-frequency enhanced normalized flow model. Based on the conditional probability density, the negative log-likelihood loss of the streaming model used for model training is calculated.

8. The cross-system multivariate time series anomaly detection method based on time-frequency multi-angle alignment according to claim 7, characterized in that, The overall model is optimized based on the distribution alignment loss, the classification loss, the reconstruction loss, and the negative log-likelihood loss of the flow model to obtain the optimized model, including: The joint loss is calculated based on the distribution alignment loss, the classification loss, the reconstruction loss, and the negative log-likelihood loss of the flow model; and The overall model is optimized by minimizing the joint total loss using the backpropagation algorithm.

9. The cross-system multivariate time series anomaly detection method based on time-frequency multi-angle alignment according to claim 2, characterized in that, The data to be detected is input into the optimized model, and anomalies in the data to be detected are determined based on the reconstruction error and negative log-likelihood value of its output, including: Data from different systems within the same scenario is collected as the data to be tested. The data to be detected is input into the optimized model; The reconstruction error of the data to be detected is calculated using the reconstruction network in the optimized model. The negative log-likelihood value of the data to be detected is calculated using the time-frequency enhanced normalized flow model in the optimized model. The reconstruction error is weighted and fused with the negative log-likelihood value to obtain a comprehensive anomaly score; The comprehensive anomaly score is compared with a preset detection threshold. If the score is higher than the threshold, the data to be detected is determined to be abnormal.

Images