Multivariate time series anomaly detection
By employing linear regression and model decomposition techniques, the accuracy and efficiency issues of anomaly detection in multivariate time series data were addressed, enabling efficient identification and large-scale online analysis of real anomalies.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-08
- Publication Date
- 2026-06-26
AI Technical Summary
Existing technologies struggle to effectively detect anomalies in multivariate time series data, particularly in distinguishing between genuine anomalies and noise, and are inefficient in large-scale data analysis.
Linear regression analysis was used to determine the impact of exogenous variables on endogenous variables. The time series data was decomposed into multiple components by training a model, and anomaly detection was performed using structured query language. Hyperparameter tuning and component analysis were combined to improve the accuracy and efficiency of detection.
It achieves efficient and accurate anomaly detection for multivariate time series data, can identify anomalies in historical and future data, is suitable for large-scale online analysis, and improves the reliability and accuracy of detection.
Smart Images
Figure CN122295663A_ABST
Abstract
Description
Technical Field
[0001] This disclosure relates to anomaly detection in multivariate time series. Background Technology
[0002] Anomaly detection in time series data has wide applications, such as credit card fraud detection, cybersecurity intrusion detection, and industrial fault diagnosis. There are two main types of anomalies in time series data. The first type relates to noise, errors, or unwanted data, which data analysts are generally not interested in. These types of anomalies should usually be removed or corrected to improve data quality and generate cleaner datasets that can be used by other data mining algorithms. For example, eliminating sensor transmission errors to obtain more accurate predictions. The second type of anomalies relates to events of interest. In recent years, and especially in the field of time series data, many researchers have focused on detecting and analyzing unusual but interesting phenomena. Fraud detection is a common example of anomaly detection and analysis being a primary goal. Summary of the Invention
[0003] One aspect of this disclosure provides a method for detecting anomalies in multivariate time series. The computer-implemented method, when executed by data processing hardware, causes the data processing hardware to perform operations. The operations include receiving a time series anomaly detection query from a user, the query requesting the data processing hardware to identify one or more anomalies in a set of multivariate time series data values. The set of multivariate time series data values includes endogenous variables and at least one exogenous variable. The operations also include determining the effect of at least one exogenous variable on the endogenous variables and using the effect of at least one exogenous variable on the endogenous variables to determine a set of univariate time series data values. The operations include training one or more models using each time series data value in the set of univariate time series data values. For each corresponding time series data value in the set of univariate time series data values, the operations include: using the trained one or more models and the effect of at least one exogenous variable on the endogenous variables to determine an expected data value for the corresponding time series data value; and determining the difference between the expected data value and the corresponding time series data value. For a specific time series data value within a set of univariate time series data values, the operation includes determining that the difference between the expected data value and the specific time series data value satisfies a threshold. In response to determining that the difference between the expected data value and the specific time series data value satisfies the threshold, the operation includes determining that the specific time series data value is anomalous. The operation also includes reporting the anomalous specific time series data value to the user.
[0004] Implementations of this disclosure may include one or more of the following optional features. In some implementations, determining the effect of at least one exogenous variable on an endogenous variable includes using linear regression. Optionally, determining the set of univariate time series data values includes using the effect of at least one exogenous variable on an endogenous variable to determine residuals based on the difference between the set of multivariate time series data values and the effect of at least one exogenous variable on the endogenous variable.
[0005] In some examples, determining the expected data value for a given time series data value includes determining the univariate expected data value for that time series data value and adding that univariate expected data value to the effect of at least one exogenous variable on an endogenous variable. Time series anomaly detection queries can include a single Structured Query Language (SQL) query.
[0006] In some implementations, determining whether the difference between the expected value and the specific time-series data value satisfies a threshold includes determining an upper threshold based on the sum of the expected value and the interval size, and a lower threshold based on the difference between the expected value and the interval size. In some implementations, the interval size is based on an anomaly probability threshold. Time-series anomaly detection queries may include this anomaly probability threshold.
[0007] In some examples, using one or more trained models to determine the expected data value of a given time series data value involves using one or more trained models to decompose each time series data value in the set of time series data values into multiple components. In some examples, these multiple components include one or more of a trend component, a holiday effect component, a seasonal component, and a step change component.
[0008] Another aspect of this disclosure provides a system for detecting anomalies in multivariate time series. The system includes data processing hardware and memory hardware communicating with the data processing hardware. The memory hardware stores instructions that, when executed on the data processing hardware, cause the data processing hardware to perform operations. The operations include receiving a time series anomaly detection query from a user, the query requesting the data processing hardware to identify one or more anomalies in a set of multivariate time series data values. The set of multivariate time series data values includes endogenous variables and at least one exogenous variable. The operations also include determining the effect of at least one exogenous variable on the endogenous variables and using the effect of at least one exogenous variable on the endogenous variables to determine a set of univariate time series data values. The operations include training one or more models using each time series data value in the set of univariate time series data values. For each corresponding time series data value in the set of univariate time series data values, the operations include: using the trained one or more models and the effect of at least one exogenous variable on the endogenous variables to determine an expected data value for the corresponding time series data value; and determining the difference between the expected data value and the corresponding time series data value. For a specific time series data value within a set of univariate time series data values, the operation includes determining that the difference between the expected data value and the specific time series data value satisfies a threshold. In response to determining that the difference between the expected data value and the specific time series data value satisfies the threshold, the operation includes determining that the specific time series data value is anomalous. The operation also includes reporting the anomalous specific time series data value to the user.
[0009] This aspect may include one or more optional features from the following options. In some implementations, determining the effect of at least one exogenous variable on an endogenous variable includes using linear regression. Optionally, determining the set of univariate time series data values includes using the effect of at least one exogenous variable on an endogenous variable to determine residuals based on the difference between the set of multivariate time series data values and the effect of at least one exogenous variable on an endogenous variable.
[0010] In some examples, determining the expected data value for a given time series data value includes determining the univariate expected data value for that time series data value and adding that univariate expected data value to the effect of at least one exogenous variable on an endogenous variable. Time series anomaly detection queries can include a single Structured Query Language (SQL) query.
[0011] In some implementations, determining whether the difference between the expected value and the specific time-series data value satisfies a threshold includes determining an upper threshold based on the sum of the expected value and the interval size, and a lower threshold based on the difference between the expected value and the interval size. In some implementations, the interval size is based on an anomaly probability threshold. Time-series anomaly detection queries may include this anomaly probability threshold.
[0012] In some examples, using one or more trained models to determine the expected data value of a given time series data value involves using one or more trained models to decompose each time series data value in the set of time series data values into multiple components. In some examples, these multiple components include one or more of a trend component, a holiday effect component, a seasonal component, and a step change component.
[0013] Details of one or more implementations of this disclosure are set forth in the accompanying drawings and the following description. Other aspects, features, and advantages will become apparent from the specification, drawings, and claims. Attached Figure Description
[0014] Figure 1 This is a schematic diagram of an example system for detecting anomalies in time series data.
[0015] Figure 2 yes Figure 1 A schematic diagram of an exemplary detector for the system.
[0016] Figure 3A and Figure 3B It is used for Figure 1 A schematic diagram of the two-step process of the system.
[0017] Figure 4A and Figure 4B This is a schematic diagram of an exemplary algebrizer tree.
[0018] Figure 5 This is a flowchart illustrating an example of the operational setup for a method used to detect anomalies in time series data.
[0019] Figure 6 This is a schematic diagram of an example computing device that can be used to implement the systems and methods described herein.
[0020] In the various figures, the same reference numerals indicate the same elements. Detailed Implementation
[0021] A time series is a sequence of data points arranged in chronological order (typically at regular intervals). The analysis of time series can be applied to any variable that changes over time (e.g., industrial processes or business metrics). Time series forecasting is the practice of estimating (i.e., extrapolating) future data values based on past data values. Because so many forecasting problems involve a time component, time series forecasting is an active area of interest. Specifically, time series forecasting has become an important field of machine learning. However, due to its inherent non-stationarity and uncertainty, time series forecasting remains a challenging problem.
[0022] Univariate time series models use a single historical time series to predict future values. In contrast, multivariate time series models use historical time series plus additional factors to predict future values. For example, when predicting future temperatures, a univariate model might only consider the historical temperature series to predict the next value. A multivariate model can alternatively consider the influence of other factors such as weather and seasons. In this example, historical temperatures could be referred to as endogenous variables, while additional factors such as weather and seasons could be referred to as exogenous variables.
[0023] Anomaly detection in time series data has wide applications, such as credit card fraud detection, cybersecurity intrusion detection, and industrial fault diagnosis. There are two main types of anomalies in time series data. For the first type, anomaly detection allows users to discard data points caused by noise, errors, or other unwanted data to improve the quality of the remaining data. For the second type, anomaly detection is important because the anomaly itself is an event of interest.
[0024] This paper describes an implementation of a multivariate time series anomaly detection system capable of large-scale automated anomaly detection. The system can use one or more trained models, employing a single endogenous variable and one or more exogenous variables, to detect anomalies in historical data or in future data. The system allows users to immediately recognize unusual data using comprehensive and convenient anomaly analysis. It helps users detect anomalies in historical data by not only processing time series for further analysis but also identifying specific events that occurred in the past. The system also uses trained models to help users detect anomalies in future data, reducing the time to problem discovery. For example, a sudden and unexpected increase in traffic to a specific product page might be due to an error in the pricing process leading to incorrectly low prices. The system is also highly scalable, allowing users to detect anomalies in hundreds of thousands or more time series using online queries (e.g., Structured Query Language (SQL) queries).
[0025] These implementations offer several technical solutions to overcome common challenges in anomaly detection. One such solution is to use linear regression to determine the impact of exogenous variables on endogenous variables, which helps isolate true anomalies from noise. For example, some implementations filter out anomalies caused by sensor transmission errors, thereby improving the accuracy of the anomaly detection process. Another advantage is the ability to perform hyperparameter tuning, which optimizes the parameters of predictive models to improve their predictive accuracy. This is particularly useful when time series data exhibit seasonal effects, holiday effects, or other complex patterns. For example, these implementations adjust for seasonal variations in sales data, ensuring that only true anomalies are flagged.
[0026] Implementation methods can also include features for decomposing time-series data into multiple components such as trends, seasonality, and holiday effects. This decomposition allows for more granular analysis of the data, making it easier to identify the root causes of anomalies. For example, a sudden surge in sales might be attributed to the holiday effect rather than errors in the data. Furthermore, scalability is enhanced by the ability to efficiently handle online queries. Users can submit a single Structured Query Language (SQL) query to analyze large amounts of time-series data, making the system suitable for large-scale applications such as monitoring web traffic or industrial processes. Overall, these technical solutions and advantages make these implementation methods robust tools for anomaly detection in multivariate time-series data, providing users with accurate, timely, and actionable insights.
[0027] Now for reference Figure 1 In some implementations, the example multivariate time series anomaly detection system 100 includes a remote system 140 communicating with one or more user devices 10 via a network 112. The remote system 140 may be a single computer, multiple computers, or a distributed system (e.g., a cloud environment) with scalable / elastic resources 142, including computing resources 144 (e.g., data processing hardware) and / or storage resources 146 (e.g., memory hardware). A data repository 150 (i.e., a remote storage device) may be placed on the storage resource 146 to allow clients (e.g., user devices 10) or one or more clients or computing resources within the computing resource 144 to scalably utilize the storage resource 146. The data repository 150 is configured to store multiple multivariate time series data values 152, 152a to 152n within one or more tables 158 (i.e., a cloud database). Each time series data value 152 can be an endogenous variable 152, 152D (i.e., a time series data value that is changed or determined by other variables) or an exogenous variable 152, 152X (i.e., an independent variable).
[0028] Remote system 140 is configured to receive time-series anomaly detection queries 20 from user device 10 associated with a corresponding user 12 via, for example, network 112. User device 10 may correspond to any computing device such as a desktop workstation, laptop workstation, or mobile device (i.e., smartphone). User device 10 includes computing resources 18 (e.g., data processing hardware) and / or storage resources 16 (e.g., memory hardware). User 12 may construct queries 20 using a Structured Query Language (SQL) interface 14. Each time-series anomaly detection query 20 requests remote system 140 to determine the presence of one or more anomalies in one or more detection requests 22, 22a to 22n.
[0029] Remote system 140 executes time series anomaly detector 160 to detect anomalous data values 152, 152A in historical data values 152, 152H (e.g., multivariate time series data values 152 stored at data repository 150) and future time series data values 152, 152F. Time series anomaly detector 160 is configured to receive queries 20 from user 12 via user device 10. Each query 20 may include multiple detection requests 22, 22a to 22n. Each detection request 22 requests time series anomaly detector 160 to detect one or more anomalous data values 152A in different sets of multivariate time series data values 152. That is, query 20 may include a request for time series anomaly detector 160 to simultaneously identify one or more anomalous data values 152A in multiple different sets of multivariate time series data values 152.
[0030] Query 20 may include multiple detection requests 22, each requesting remote system 140 to detect anomalous data values 152A in historical data values 152H located in one or more tables 158 stored on data repository 150. Alternatively, query 20 may include historical data values 152H. In this case, when historical data values 152H cannot be obtained otherwise via data storage 150, user 12 (via user device 10) may provide historical data values 152H. In some examples, historical data values 152H are stored in a database with multiple columns and multiple rows. For example, one column may include time-series data, while another column may include timestamp data that correlates a specific point in time with the time-series data.
[0031] The multivariate time series anomaly detector 160 includes an influence analyzer 162. The influence analyzer 162 receives historical data 152H retrieved from a data repository 150 and / or provided by user 12. The influence analyzer 162 determines the influence 164 of at least one exogenous variable 152X on an endogenous variable 152D in response to one or more detection requests in detection request 22. For example, detection request 22 indicates a specific endogenous variable 152D used for multivariate time series forecasting and one or more exogenous variables 152X that influence that endogenous variable 152D. Influence 164 represents the degree of influence of each exogenous variable 152X on the endogenous variable 152D.
[0032] In some implementations, the influence analyzer 162 uses linear regression to determine the influence 164. For example, linear regression uses the following equation:
[0033] In equation (1), Represents the original time series data. Indicates time t First n The values of the linear regression variables, Indicates the first n The coefficients of the linear regression variables, c This represents the linear regression constant term, and Indicates time t The error term at that point. Additionally... It comes from time t The linear components of a linear regression without an error term are used, based on the original historical data. It is the residual between the original time series data and the data fitted by linear regression.
[0034] The influence analyzer 162 uses the influence 164 of at least one exogenous variable 152X on the endogenous variable 152D to determine the set of univariate time series data values 152, 152U. The set of univariate time series data values 152U represents the multivariate time series data values 152 of the endogenous variable 152D when the influence 164 of the exogenous variable 152X is removed. The univariate time series data values 152U can be based on the residuals from equation (1). In other words, in some examples, the univariate time series data value 152U is the difference between the set of multivariate time series values 152 and the effect 164 of at least one exogenous variable 152X on the endogenous variable 152D.
[0035] The multivariate time series anomaly detector 160 includes a model trainer 170. The model trainer 170 continuously or simultaneously generates and / or trains one or more predictive models 172 for each detection request 22. Training the model involves feeding it historical data so that the model can learn patterns and relationships within the data. This process may include selecting an appropriate algorithm, tuning hyperparameters, and validating the model's performance. The model trainer 170 can train the predictive model 172 on univariate time series data values 152U determined by the influence analyzer 162.
[0036] Model trainer 170 can generate and / or train multiple prediction models 172 with different parameters. For example, model trainer 170 generates and trains multiple autoregressive integral moving average (ARIMA) models with different autoregressive model orders (i.e., time lags, and are typically represented by parameters). p Different degrees of differencing (i.e., the number of times past values are subtracted from the data, and are usually expressed as parameters). d ) and the order of the moving average model (i.e., the size of the moving average window, and is usually expressed as a parameter) q Using different parameters (e.g., parameter) p , d and q The model trainer 170 generates a corresponding prediction model 172 for each combination of data points 152H. Each model 172 is trained using the same historical data values 152H. One or more parameters can be configured or partially configured by the user 12.
[0037] Model trainer 170 can perform hyperparameter tuning (also known as hyperparameter optimization) while generating and training predictive model 172. Hyperparameters are parameters that control or adjust the actual learning process as other parameters (such as node weights) are learned. For example, model trainer 170 performs hyperparameter tuning for data frequency and non-seasonal order parameters. Model trainer 170 can generate and train predictive model 172 capable of modeling many different aspects of time series. For example, predictive model 172 considers seasonal effects, holiday effects, modeling drift, and anomalies.
[0038] The time series anomaly detector 160 includes a predictor 180. The predictor 180 uses one or more trained models 172 and influences 164 to predict or determine expected data values 152, 152E. The predictor 180 can predict the expected data value 152E for each historical data value in the historical data value 152H. That is, after training (i.e., using historical data value 152H) the model 172, the multivariate time series anomaly detector 160 can provide the trained model 172 with each univariate data value 152U derived from each historical data value 152H (i.e., by the influence analyzer 162), and based on the model's prediction and the influences 164 associated with the historical data value 152H, the predictor 180 determines the expected data value 152E for the corresponding historical data value 152H. In some implementations, predictor 180 (i.e., using the estimate from model 172) determines the univariate expected data value 152E, and then adds the univariate expected data value 152E to the effect 164 to determine the final expected data value 152E.
[0039] Predictor 180 can also predict the expected data value 152E for future data value 152F. Historical data value 152H represents time series data value 152 on which model 172 was trained, while future data value 152F represents time series data value 152 on which model 172 was not trained. For example, time series anomaly detector 160 receives future data value 152F after training of model 172 is complete. Influence analyzer 162 can determine the influence 164 of exogenous variable 152X on future data value 152F in the same manner as described above regarding historical data value 152H.
[0040] The time series anomaly detector 160 includes a detector 210. Detector 210 receives an expected data value 152E output from predictor 180 and a corresponding historical data value 152H or future data value 152F as input to influence analyzer 162. Detector 210 can determine the difference between the expected data value 152E and the corresponding historical data value 152H or future data value 152F. A difference is determined when the difference between the expected data value 152E and the corresponding historical data value 152H (i.e., the time series data value 152 received by the multivariate time series anomaly detector 160 before or during training model 172) or the future data value 152F (i.e., the time series data value 152 received by the time series anomaly detector 160 after training the model and predicting the expected data value 152E) satisfies (e.g., based on an anomaly probability threshold 214 received from user 12). Figure 2When the threshold is reached, detector 210 can determine that the corresponding historical data value 152H or future data value 152F is abnormal. In this case, detector 210 can report the abnormal corresponding time series data value 152A to user 12.
[0041] Now for reference Figure 2 In some examples, detector 210 determines the difference between each expected data value 152E and the true data value 152G used to predict or estimate the expected data value 152E (e.g., a historical data value 152H that has been verified by measurement). Based on this difference, detector 210 determines whether the true data value 152G is anomaly. In some implementations, detector 210 determines an interval size 220, which defines an upper limit 222 (or upper threshold) and a lower limit 224 (or lower threshold). Based on the upper limit 222 and the lower limit 224, detector 210 determines whether the true data value 152G meets the thresholds and whether it is anomaly. In some examples, the upper limit 222 is equal to the expected data value 152E (i.e., the univariate expected data value estimated by model 172 and influence 164) plus the interval size 220, and the lower limit 224 is equal to the expected data value 152E minus the interval size 220. For example, when the actual data value 152G exceeds the expected data value 152E by a value greater than the upper limit 222 or less than the value established by the lower limit 224, the detector 210 determines that the actual data value 152G is abnormal. Conversely, when the actual data value 152G is less than the upper limit 222 and greater than the lower limit 224 (i.e., sufficiently close to the expected data value 152E), the detector 210 determines that the actual data value 152G is not abnormal.
[0042] In some implementations, detector 210 determines at least partially the interval size 220, upper limit 222, and lower limit 224 based on the standard error 212 and / or anomaly probability threshold 214 from the trained model. The standard error 212 represents the amount of error measured during training of model 172. For example, a model 172 with a large error (i.e., the predicted data value 152E has a significant error during training) is less credible and thus results in a larger interval size 220. On the other hand, a highly accurate model 172 (i.e., with a low standard error 212) may result in a relatively smaller interval size 220. The anomaly probability threshold 214 can be (e.g., received via query 20) a user-configurable value that affects the interval size 220. The anomaly probability threshold 214 provides user 12 with the ability to customize or configure the interval size 220 and thus customize or configure the probability that the true value data value 152G is anomaly. That is, the anomaly probability threshold 214 allows user 12 to configure the false positive rate. When user 12 is sensitive to false positives, user 12 can choose a small anomaly probability threshold 214. Conversely, if detection is more important than false positives, user 12 can choose a larger anomaly probability threshold 214. In some examples, the anomaly probability threshold 214 establishes the confidence threshold that detector 210 must reach before reporting time series data value 152 as an anomaly. For example, user 12 provides a 95% anomaly probability threshold 214, which causes detector 210 to only report time series data value 152, which detector 210 determines to be 95% or more likely to be anomaly, as an anomaly. In these implementations, detector 210 decreases the interval size 220 as the anomaly probability threshold 214 increases.
[0043] In the example shown, Figure 230 includes first expected data values 152E, 152Ea and first true data values 152G, 152Ga. In this example, first upper limits 222, 222a span the y-axis of Figure 230 from the first expected data value 152Ea plus a value of interval size 220. Similarly, first lower limits 224, 224a span the y-axis of Figure 230 from the first expected data value 152Ea minus a value of interval size 220. Here, the first true data value 152Ga is greater than the first lower limit 224a and less than the second upper limit 222a, and therefore detector 210 determines that the first true data value 152Ga is not anomalous. The second expected data values 152E, 152Eb of Figure 230 establish the second upper limits 222, 222b and the second lower limits 224, 224b. At this point, the second true value data value 152G, 152Gb is greater than the second upper limit 222b, and therefore detector 210 determines that the second true value data value 152G is anomalous. Although not shown in the figure, detector 210 can determine the upper limit 222 and lower limit 224 of each expected data value 152E predicted by model 172 (based on interval size 220). Using the upper limit 222 and lower limit 224 of each expected data value 152E, detector 210 determines whether the corresponding true value data value 152G (i.e., the actual time series data value 152 compared with the expected data value 152E) is anomalous. Detector 210 can report only the anomalous data value 152A to user 12. Alternatively, detector 210 reports data about the comparison for each time series data value 152 (e.g., the relative difference between the expected data value 152E and the true value data value 152G).
[0044] In some implementations, the multivariate time series anomaly detector 160 includes multiple models 172. In these implementations, the model trainer 170 trains each of the multiple models 172 using historical data values 152H. In some examples, one or more trained models among the trained models 172 decompose the input time series data value 152 (i.e., historical data value 152H and / or future data value 152F) into multiple components. The predictor 180 can receive these multiple components and aggregate two or more of the components to predict the expected data value 152E.
[0045] In some examples, each of the multiple models 172 decomposes different components from the input time-series data value 152. For example, one model 172 is trained to perform holiday adjustment and generate or predict the holiday component of the time-series data value 152. As another example, different models 172 are trained (e.g., using local regression) to perform seasonal and trend decomposition and generate or predict the seasonal component of the time-series data value 152. The seasonal component can explain the recurring variations in the time-series data value 152 over specific periods (e.g., days, weeks, months, etc.). For example, an increase in December sales represents the seasonal effect of the seasonal component. The time-series anomaly detector 160 can (e.g., via one or more models 172) decompose the univariate time-series data value 152 (determined by the influence analyzer 162) into several other components, such as trend components, outlier components, peak and trough components, and step change components. The trend component can represent a trend in the data that moves upward or downward in a reasonably predictable pattern.
[0046] In some examples, one or more models 172 are used to train other models 172 of the time series anomaly detector 160. For example, model trainer 170 uses historical data values 152H to first train the holiday adjustment model 172. After the holiday adjustment model 172 is trained, model trainer 170 can use the time series data values 152 to train the outlier model 172, where the holiday component is removed by the holiday adjustment model 172. Similarly, model trainer 170 can use the time series data values 152 to train the seasonality and trend decomposition model 172, where the holiday component is removed by the holiday adjustment model 172, and outliers are removed by the outlier model 172. In this way, model trainer 170 can train a “chain” of models 172, each model responsible for generating one of the decomposition components of the time series data values 152.
[0047] In some implementations, predictor 180 predicts the expected data value 152E based on the sum of multiple components estimated or determined by model 172. For example, predictor 180 predicts the expected data value 152E based on the sum of a trend component, a holiday effect component, a seasonal period component, and a step change component. In cases where the step change component cannot be predicted (e.g., for future data value 152F), predictor 180 may predict the expected data value 152E based on the sum of the trend component, the holiday effect component, and the seasonal period component, as well as influence 164. Predictor 180 provides the expected data value 152E to detector 210.
[0048] Figure 3AA schematic diagram 300A illustrates an exemplary two-step process for predicting multivariate time series data using historical data (i.e., using data on which model 172 is trained). In a first step 310A, model 172 is created by training model 172 using univariate time series data derived from the multivariate time series data. This univariate time series data can be derived using linear regression. After training one or more models 172, a second step 320A includes using the trained model 172 to predict expected data values 152E. This may include using the trained model 172 to predict univariate expected data values 152 and then aggregating or adding influence 164 to the univariate expected data values 152. Using the expected data values 152E, the system can determine whether any data value 152 is outlier. Since the system has been previously trained on the data, it can retrieve influence 164 and univariate time series values 152U (e.g., from data repository 150) without recreating them. Figure 3B This includes a schematic diagram 300B illustrating another exemplary two-step process for predicting multivariate time series using new data (i.e., additional data after model 172 has been previously trained on different data). Here, at step 310B, a similar approach is used. Figure 3A The model 172 is trained in the manner described in step 310A. However, at step 320B, the system must determine the effects 164 on the multivariate time series value 152 and the univariate time series value 152U (i.e., because the data is new).
[0049] Figure 4A and Figure 4B This includes exemplary algebrizer trees 400A and 400B. Algebrizer trees 400A and 400B can be responsible for receiving and processing anomaly detection queries 20 from user 12. An algebrizer tree is a data structure used in query processing to decompose and organize the components of a query into a hierarchical format. This hierarchical structure allows for efficient parsing and execution of queries by systematically evaluating each component. For example, exemplary algebrizer tree 400A is at least partially responsible for retrieving historical data 152H, determining the impact 164 on historical data 152H, and determining the interval size 220, upper limit 222, and lower limit 224. Algebrizer tree 400A can also determine whether any historical data value in historical data value 152H is anomaly based on limits 222 and 224. The exemplary algebrizer tree 400B functions similarly to the algebrizer tree 400A, except that the tree 400B is responsible for new data (i.e., additional data after the model 172 has been previously trained on different data), which requires the determination of linear components (i.e., without error terms) from the linear regression.
[0050] Figure 5 This is a flowchart illustrating an exemplary arrangement of the operation of a method 500 for multivariate time series anomaly detection. The computer-implemented method 500, executed by data processing hardware 144, causes the data processing hardware 144 to perform operations. At operation 502, method 500 includes receiving a time series anomaly detection query 20 from a user 12. The time series anomaly detection query 20 requests the data processing hardware 144 to identify one or more anomalies 152A in a set of multivariate time series data values 152. The set of multivariate time series data values 152 includes an endogenous variable 152D and at least one exogenous variable 152X. At operation 504, method 500 includes determining the effect 164 of at least one exogenous variable 152X on the endogenous variable 152D. This leverages the technical advantage of using linear regression to isolate true anomalies from noise—crucial for accurate anomaly detection. By determining the effect of the exogenous variable, the method can filter out anomalies caused by sensor transmission errors, thereby improving the accuracy of the anomaly detection process. The method ensures that only true anomalies are flagged, thus enhancing the reliability of the method.
[0051] At operation 506, method 500 includes determining a set of univariate time series data values 152U using the effect 164 of at least one exogenous variable 152X on the endogenous variable 152D. This provides the benefit of simplifying multivariate time series data into univariate data that is easier to analyze and model. Univariate time series data values represent the multivariate time series data values of the endogenous variable when the effect of the exogenous variable is removed. This simplification allows for more accurate model training because it reduces the complexity of the data being analyzed. At operation 508, method 500 includes training one or more models 172 using each time series data value 152 in the set of univariate time series data values 152U. Training the model on univariate data values derived from multivariate data ensures that the model can accurately learn patterns and relationships within the data. This step may include hyperparameter tuning to optimize the parameters of the predictive models to enhance their predictive accuracy. This is particularly useful where the time series data exhibits seasonal effects, holiday effects, or other complex patterns. The trained model can then be used to predict expected data values with high accuracy.
[0052] For each corresponding time series data value 152 in the set of univariate time series data values 152U, method 500 includes, at operation 510, using one or more trained models 172 and the effect 164 of at least one exogenous variable 152X on the endogenous variable 152D to determine the expected data value 152E for that corresponding time series data value 152. This step may include decomposing the time series data into multiple components such as trend, seasonality, and holiday effects. This decomposition allows for finer-grained analysis of the data, making it easier to identify the root cause of anomalies. For example, a sudden surge in sales may be attributed to the holiday effect rather than errors in the data. At operation 512, method 500 includes determining the difference between the expected data value 152E for the corresponding time series data value 152 and the corresponding time series data value 152. This difference can be used to identify anomalies, ensuring that only significant deviations from the expected value are flagged.
[0053] For a specific time series data value 152 in the set of univariate time series data values 152U, method 500 includes, at operation 514, determining that the difference between the expected data value 152E and the specific time series data value 152 satisfies a threshold. Method 500 includes, at operation 516, determining that the specific time series data value 152A is anomalous in response to determining that the difference between the expected data value 152E and the specific time series data value 152 satisfies the threshold. Method 500 includes, at operation 518, reporting the anomalous specific time series data value 152A to user 12.
[0054] Figure 6 This is a schematic diagram of an example computing device 600 that can be used to implement the systems and methods described in this document. The computing device 600 is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframes, and other suitable computers. The components shown herein, their connections and relationships, and their functions are intended to be exemplary only and are not intended to limit the implementations of the invention described and / or claimed in this document.
[0055] Computing device 600 includes a processor 610, a memory 620, a storage device 630, a high-speed interface / controller 640 connected to the memory 620 and a high-speed expansion port 650, and a low-speed interface / controller 660 connected to a low-speed bus 670 and the storage device 630. Each of the components 610, 620, 630, 640, 650, and 660 is interconnected using various buses and may be mounted on a common motherboard or otherwise. The processor 610 can process instructions for execution within the computing device 600, including instructions stored in the memory 620 or the storage device 630, to display graphical information of a graphical user interface (GUI) on an external input / output device such as a display 680 coupled to the high-speed interface 640. In other implementations, multiple processors and / or multiple buses, as well as multiple memories and various types of memory, may be used as appropriate. Furthermore, multiple computing devices 600 may be connected, with each device providing a portion of the necessary operation (e.g., as a server library, blade server group, or multiprocessor system).
[0056] Memory 620 stores information non-temporarily within computing device 600. Memory 620 may be a computer-readable medium, a volatile memory cell, or a non-volatile memory cell. Non-temporary memory 620 may be a physical means for temporarily or permanently storing programs (e.g., instruction sequences) or data (e.g., program state information) for use by computing device 600. Examples of non-volatile memory include, but are not limited to, flash memory and read-only memory (ROM) / programmable read-only memory (PROM) / erasable programmable read-only memory (EPROM) / electronically erasable programmable read-only memory (EEPROM) (e.g., commonly used in firmware, such as boot programs). Examples of volatile memory include, but are not limited to, random access memory (RAM), dynamic random access memory (DRAM), static random access memory (SRAM), phase-change memory (PCM), and magnetic disks or magnetic tapes.
[0057] Storage device 630 provides mass storage for computing device 600. In some implementations, storage device 630 is a computer-readable medium. In various implementations, storage device 630 may be a floppy disk device, hard disk device, optical disk device, magnetic tape device, flash memory, or other similar solid-state storage device or array of devices, including devices arranged in a storage area network or other configuration. In additional implementations, a computer program product is tangibly embodied in an information carrier. The computer program product contains instructions that, when executed, perform one or more methods, such as those described above. The information carrier is a computer or machine-readable medium, such as memory 620, storage device 630, or memory on processor 610.
[0058] High-speed controller 640 manages bandwidth-intensive operations of computing device 600, while low-speed controller 660 manages lower bandwidth-intensive operations. This allocation of responsibilities is merely exemplary. In some implementations, high-speed controller 640 (e.g., via a graphics processor or accelerator) is coupled to memory 620, display 680, and high-speed expansion port 650, which can accept various expansion cards (not shown). In some implementations, low-speed controller 660 is coupled to storage device 630 and low-speed expansion port 690. Low-speed expansion port 690, which may include various communication ports (e.g., USB, Bluetooth, Ethernet, Wireless Ethernet), may be coupled to one or more input / output devices, such as keyboards, pointing devices, scanners, or networking devices, such as switches or routers, for example, via a network adapter.
[0059] The computing device 600 can be implemented in a variety of different forms, as shown in the figure. For example, it can be implemented as a standard server 600a or multiple times in a group of such servers 600a, as a laptop computer 600b, or as part of a rack server system 600c.
[0060] Various implementations of the systems and techniques described herein can be implemented in digital electronic and / or optical circuit systems, integrated circuit systems, specially designed ASICs (Application-Specific Integrated Circuits), computer hardware, firmware, software, and / or combinations thereof. These various implementations may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system, which includes at least one programmable processor, which may be dedicated or general-purpose, and is coupled to receive data and instructions from a storage system, at least one input device, and at least one output device, and to transfer data and instructions to the storage system, at least one input device, and at least one output device.
[0061] A software application (i.e., a software resource) can refer to computer software that instructs a computing device to perform a task. In some examples, a software application may be referred to as an "application," "app," or "program." Example applications include, but are not limited to, system diagnostic applications, system management applications, system maintenance applications, word processing applications, spreadsheet applications, messaging applications, media streaming applications, social networking applications, and game applications.
[0062] These computer programs (also referred to as programs, software, software applications, or code) include machine instructions for a programmable processor and can be implemented using high-level procedural and / or object-oriented programming languages and / or assembly / machine languages. As used herein, the terms “machine-readable medium” and “computer-readable medium” refer to any computer program product, non-transitory computer-readable medium, device, and / or apparatus (e.g., disk, optical disk, memory, programmable logic device (PLD)) used to provide machine instructions and / or data to a programmable processor, including machine-readable media that receive machine instructions as machine-readable signals. The term “machine-readable signal” refers to any signal used to provide machine instructions and / or data to a programmable processor.
[0063] The processes and logic flows described in this specification can be executed by one or more programmable processors, also known as data processing hardware, which execute one or more computer programs to perform functions by manipulating input data and generating output. The processes and logic flows can also be executed by special-purpose logic circuit systems, such as FPGAs (Field-Programmable Gate Arrays) or ASICs (Application-Specific Integrated Circuits). For example, processors suitable for executing computer programs include both general-purpose microprocessors and special-purpose microprocessors, as well as any one or more processors of any type of digital computer. Typically, the processor receives instructions and data from read-only memory or random access memory, or both. The basic elements of a computer are a processor for executing instructions and one or more memory devices for storing instructions and data. Typically, a computer will also include one or more mass storage devices for storing data, such as magnetic disks, magneto-optical disks, or optical disks, or operatively coupled to receive data from or transfer data to said mass storage device, or both. However, a computer need not have such devices. Computer-readable media suitable for storing computer program instructions and data include all forms of non-volatile memory, media, and memory devices, including, for example, semiconductor memory devices (e.g., EPROM, EEPROM, and flash memory devices), magnetic disks (e.g., internal hard disks or removable disks), magneto-optical disks, and CD-ROM and DVD-ROM disks. Processors and memory may be supplemented by or incorporated into dedicated logic circuitry systems.
[0064] To provide interaction with the user, one or more aspects of this disclosure can be implemented on a computer having a display device for displaying information to the user (e.g., a CRT (cathode ray tube), LCD (liquid crystal display) monitor, or touchscreen) and possibly a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback, such as visual feedback, auditory feedback, or tactile feedback; and input from the user can be received in any form, including sound, speech, or tactile input. Additionally, the computer can interact with the user by sending documents to and receiving documents from a device used by the user; for example, by sending a webpage to a web browser on the user's client device in response to a request received from a web browser.
[0065] Various implementations have been described. However, it should be understood that various modifications can be made without departing from the spirit and scope of this disclosure. Therefore, other implementations are within the scope of the appended claims.
Claims
1. A computer-implemented method (500) executed by data processing hardware (144), the computer-implemented method causing the data processing hardware (144) to perform operations, the operations including: Receive a time series anomaly detection query (20) from user (12), the time series anomaly detection query (20) requesting the data processing hardware to identify one or more anomalies in a set of multivariate time series data values (152), the set of multivariate time series data values (152) including endogenous variables (152D) and at least one exogenous variable (152X); Determine the effect of the at least one exogenous variable (152X) on the endogenous variable (152D) (164); The effect (164) of the at least one exogenous variable (152X) on the endogenous variable (152D) is used to determine the set of univariate time series data values (152U); One or more models (172) are trained using each time series data value (152) in the set of univariate time series data values (152U); For each corresponding time series data value (152) in the set of univariate time series data values (152U): The expected data value (152E) of the corresponding time series data value (152) is determined using one or more trained models (172) and the effect (164) of the at least one exogenous variable (152X) on the endogenous variable (152D); and Determine the difference between the expected data value (152E) of the corresponding time series data value (152) and the corresponding time series data value (152); as well as For a specific time series data value (152) in the set of univariate time series data values (152U): The difference between the expected data value (152E) of the specific time series data value (152) and the specific time series data value (152) satisfies a threshold. In response to the difference between the expected data value (152E) of the determined specific time series data value (152) and the specific time series data value (152) satisfying the threshold, it is determined that the specific time series data value (152) is abnormal; and Report the specific time-series data value (152A) of the anomaly to the user (12).
2. The method (500) of claim 1, wherein determining the effect (164) of the at least one exogenous variable (152X) on the endogenous variable (152D) includes using linear regression.
3. The method (500) of claim 1 or claim 2, wherein determining the set of univariate time series data values (152U) comprises determining residuals based on the difference between the set of multivariate time series data values (152) and the effect (164) of the at least one exogenous variable (152X) on the endogenous variable (152D).
4. The method (500) of any one of claims 1 to 3, wherein determining the expected data value (152E) of the corresponding time series data value (152) comprises: Determine the univariate expected data value (152E) of the corresponding time series data value (152); as well as The expected data value of the univariate (152E) is added to the effect (164) of the at least one exogenous variable (152X) on the endogenous variable (152D).
5. The method (500) of any one of claims 1 to 4, wherein the time series anomaly detection query (20) comprises a single Structured Query Language (SQL) query.
6. The method (500) of any one of claims 1 to 5, wherein determining that the difference between the expected data value (152E) of the specific time series data value (152) and the specific time series data value (152) satisfies the threshold comprises: The upper limit threshold is determined based on the sum of the expected data value (152E) of the corresponding time series data value (152) and the interval size (220); and The lower limit threshold is determined based on the difference between the expected data value (152E) of the corresponding time series data value (152) and the interval size (220).
7. The method (500) of claim 6, wherein the interval size (220) is based on an anomaly probability threshold (214).
8. The method (500) of claim 7, wherein the time series anomaly detection query (20) includes the anomaly probability threshold (214).
9. The method (500) of any one of claims 1 to 8, wherein using one or more trained models (172) to determine the expected data value (152E) of the corresponding time series data value (152) comprises using one or more trained models (172) to decompose each time series data value (152) in the set of time series data values (152) into a plurality of components.
10. The method (500) of claim 9, wherein the plurality of components includes one or more of a trend component, a holiday effect component, a seasonal component, and a step change component.
11. A system (100) comprising: Data processing hardware (144); as well as A memory hardware (146) communicating with the data processing hardware (144), the memory hardware (146) storing instructions that, when executed on the data processing hardware (144), cause the data processing hardware (144) to perform operations, the operations including: Receive a time series anomaly detection query (20) from user (12), the time series anomaly detection query (20) requesting the data processing hardware to identify one or more anomalies in a set of multivariate time series data values (152), the set of multivariate time series data values (152) including endogenous variables (152D) and at least one exogenous variable (152X); Determine the effect of the at least one exogenous variable (152X) on the endogenous variable (152D) (164); The effect (164) of the at least one exogenous variable (152X) on the endogenous variable (152D) is used to determine the set of univariate time series data values (152U); One or more models (172) are trained using each time series data value (152) in the set of univariate time series data values (152U); For each corresponding time series data value (152) in the set of univariate time series data values (152U): The expected data value (152E) of the corresponding time series data value (152) is determined using one or more trained models (172) and the effect (164) of the at least one exogenous variable (152X) on the endogenous variable (152D); and Determine the difference between the expected data value (152E) of the corresponding time series data value (152) and the corresponding time series data value (152); as well as For a specific time series data value (152) in the set of univariate time series data values (152U): The difference between the expected data value (152E) of the specific time series data value (152) and the specific time series data value (152) satisfies a threshold. In response to the difference between the expected data value (152E) of the determined specific time series data value (152) and the specific time series data value (152) satisfying the threshold, it is determined that the specific time series data value (152) is abnormal; and Report the specific time-series data value (152A) of the anomaly to the user (12).
12. The system (100) of claim 11, wherein determining the effect (164) of the at least one exogenous variable (152X) on the endogenous variable (152D) includes using linear regression.
13. The system (100) of claim 11 or claim 12, wherein determining the set of univariate time series data values (152U) comprises determining residuals based on the difference between the set of multivariate time series data values (152) and the effect (164) of the at least one exogenous variable (152X) on the endogenous variable (152D).
14. The system (100) of any one of claims 11 to 13, wherein determining the expected data value (152E) of the corresponding time series data value (152) comprises: Determine the univariate expected data value (152E) of the corresponding time series data value (152); as well as The expected data value of the univariate (152E) is added to the effect (164) of the at least one exogenous variable (152X) on the endogenous variable (152D).
15. The system (100) of any one of claims 11 to 14, wherein the time series anomaly detection query (20) comprises a single Structured Query Language (SQL) query.
16. The system (100) of any one of claims 11 to 15, wherein determining that the difference between the expected data value (152E) of the specific time series data value (152) and the specific time series data value (152) satisfies the threshold comprises: The upper limit threshold is determined based on the sum of the expected data value (152E) of the corresponding time series data value (152) and the interval size (220); and The lower limit threshold is determined based on the difference between the expected data value (152E) of the corresponding time series data value (152) and the interval size (220).
17. The system (100) of claim 16, wherein the interval size (220) is based on an anomaly probability threshold (214).
18. The system (100) of claim 17, wherein the time series anomaly detection query (20) includes the anomaly probability threshold (214).
19. The system (100) of any one of claims 11 to 18, wherein using one or more trained models (172) to determine the expected data value (152E) of the corresponding time series data value (152) comprises using one or more trained models (172) to decompose each time series data value (152) in the set of time series data values (152) into a plurality of components.
20. The system (100) of claim 19, wherein the plurality of components includes one or more of a trend component, a holiday effect component, a seasonal component, and a step change component.