A Transformer-based Time-Series Signal Anomaly Detection System

Abstract

This invention discloses a Transformer-based time-series signal anomaly detection system, comprising: an observation and preprocessing module for generating observation sequences, time indices, and sliding window parameters; an encoder module for outputting embedding sequences and establishing embedding distance metrics and key-value caches; a time-map construction module for generating sequential neighborhoods, edge weights, and neighborhood measures and writing them to the time-map cache; a monotonic matching curvature module for calculating Ollivier–Ricci curvature sequences; a robust curvature module for generating robust curvature sequences using α-truncation, biased quality transmission, and Huber distance; a baseline and residual module for generating baseline curvature according to discrete Ricci flow and calculating curvature residuals; an anomaly scoring and judgment module for fusing curvature to generate window anomaly scores and outputting point-level and window-level labels; and an event generation and playback module for generating anomaly intervals, start and end times, and channel locations and writing them to event logs and a replayable archive. This invention uses curvature metrics to connect detection and localization, and is robust, comparable, and capable of online operation.

Description

Technical Field

[0001] This invention relates to the field of time-series signal processing technology, and in particular to a time-series signal anomaly detection system based on Transformer. Background Technology

[0002] Existing time series anomaly detection methods mostly employ statistical modeling and prediction bias discrimination. Common methods include ARIMA, Kalman filtering, control charts, and isolated forests. There are also threshold judgments based on autoencoder reconstruction error, first-order difference, and frequency domain energy ratio. These methods rely on stationarity and parameter priors, making it difficult to cover scenarios with multiple channels, non-stationarity, and abrupt changes. They are insufficient in characterizing time series correlations within the window and cross-channel coupling. Thresholds are often set empirically, and their performance is unstable when migrating across devices and operating conditions. Event interval and channel localization often require additional rule splicing.

[0003] Deep learning methods introduce end-to-end modeling. Convolutional and recurrent networks can extract local or short-term dependencies. In recent years, Transformer has been used for long dependency modeling and multi-head attention aggregation. Reconstruction and prediction paradigms have achieved good results. However, attention scores lack a metric structure, making it difficult to directly measure geometric contraction and expansion. Embedding spaces usually only measure proximity using Euclidean distance or cosine similarity, lacking a quality transfer mechanism that preserves order on the time axis. Neighborhood comparisons remain at point-to-point similarity rather than distribution-to-distribution alignment. Noise impulses, missing packets, and drift can amplify reconstruction residuals and induce false alarms. The thresholds and scores of the model are not comparable under different operating conditions. Event-level results and channel-level localization lack a unified generation link.

[0004] Graph and geometric methods attempt to measure anomalies from a topological or curvature perspective, but most remain at the level of static graphs or local clustering metrics. There is little temporal graph modeling and cache maintenance oriented towards time sliding windows. Existing works rarely construct sequential neighborhoods, edge weights, and neighborhood measures on Transformer embeddings, and use monotonic matching to define the Ollivier-Ricci curvature sequence between adjacent time points. Robustness processing often does not introduce an integrated goal of α-truncation, biased quality transmission, and Huber distance. Baseline curvature also lacks iterative construction of discrete Ricci streams, resulting in incomparability of curvatures at different time points, difficulty in incremental maintenance of residuals, lack of a unified threshold module for anomaly score fusion, and disconnect between event recording and replayable archiving and detection links.

[0005] Therefore, how to provide a time-series signal anomaly detection system based on Transformer is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0006] One objective of this invention is to propose a Transformer-based anomaly detection system for time-series signals. This invention utilizes embedded sequences to construct time maps and combines Ollivier-Ricci curvature with discrete Ricci flow to achieve anomaly identification and localization. This system integrates monotonic matched curvature, robust curvature, and curvature residuals to establish an end-to-end curvature measurement and anomaly scoring mechanism, possessing advantages such as strong adaptability, high robustness, and accurate localization.

[0007] According to an embodiment of the present invention, a Transformer-based time-series signal anomaly detection system includes: The observation and preprocessing module is used to acquire time-series signals and perform denoising, standardization and missing data completion, generate observation sequences and establish time indexes and sliding window parameters; The encoder module is used to perform channel embedding and temporal location encoding on the observation sequence, output the embedded sequence, establish the embedding distance metric, and generate a key-value cache; The time graph construction module is used to generate sequential neighborhoods, edge weights, and neighborhood measures within the sliding window based on the embedding sequence and embedding distance according to the time index and sliding window parameters, and write them to the time graph cache. The monotonic matching curvature module is used to perform monotonic matching in chronological order for adjacent moments in the time graph buffer and to calculate the Ollivier–Ricci curvature sequence; The robust curvature module is used to perform α-truncation and partial mass transfer on the neighborhood measure of sequential neighborhood in the time-map buffer and introduce Huber distance to generate a robust Ollivier–Ricci curvature sequence. The baseline and residual module is used to iterate the discrete Ricci flow in the normal segment to generate a baseline curvature sequence and calculate the curvature residual sequence. The anomaly scoring and determination module is used to fuse monotonic matching curvature sequences, robust curvature sequences, and curvature residual sequences to generate a window anomaly score stream and output point-level and window-level anomaly labels. The event generation and playback module is used to generate abnormal intervals, start and end times and channel positioning results based on abnormal labels and curvature sequences, and write them into the event log and replayable archive.

[0008] Optionally, modules can be integrated using the following methods: Acquire and preprocess time-series signals to generate observation sequences; Construct a Transformer encoder to perform channel embedding and temporal location encoding on the observation sequence, output the embedded sequence, establish an embedding distance metric, and cache the key-value pairs; Within a sliding window, a time graph is constructed based on the embedding sequence and embedding distance, generating sequential neighborhoods, edge weights, and neighborhood measures, which are then written to the time graph cache. In the time graph cache, monotonic matching is performed on adjacent time points in chronological order. The Ollivier–Ricci curvature sequence is calculated based on the embedding distance and edge weights and the time graph cache is updated accordingly. Within the time-map buffer, α-truncation and partial quality transfer are performed on the neighborhood measure of sequential neighborhoods, Huber distance is introduced, robust Ollivier–Ricci curvature sequences are calculated, and the time-map buffer is updated. The baseline curvature sequence is generated by iterating discrete Ricci flow on the normal time map buffer, and the curvature residual sequence is calculated and incrementally updated on the current time map buffer. The window anomaly fraction stream is generated by fusing monotonic matching curvature sequences, robust curvature sequences, and curvature residual sequences. The anomaly labels are then determined online by a threshold module and output at both the point and window levels. Anomaly intervals, start and end times, and channel location results are generated based on anomaly labels and curvature sequences, and written into event logs and replayable archives.

[0009] Optionally, the generation of the embedding sequence and the establishment of the embedding distance metric and caching of the key-value pairs specifically include: The observation sequence is organized according to the time index, and the channel vector at each time moment is mapped to a channel embedding vector of the same dimension to form a channel embedding sequence corresponding to the time index. For each time index, generate a time position encoding vector consistent with the channel embedding dimension. Add the time position encoding to the channel embedding element by element to obtain the encoded input sequence. Construct a Transformer encoder, which consists of a preset number of encoder layers connected in series. Each encoder layer contains a self-attention sub-layer, a feedforward network sub-layer, layer normalization, and residual connections. The self-attention sub-layer is composed of parallel attention sub-layers and the number is a preset positive integer. The encoded input sequence is fed into the Transformer encoder, calculated according to the hierarchical structure, and the output is the embedding sequence corresponding to the time index. The intermediate state is retained in memory for streaming inference. An embedding distance metric is established, defining the distance between embedding vectors corresponding to any two time indices as a weighted sum of the vector Euclidean distance and the time interval penalty. The time interval penalty is calculated based on the absolute value of the difference between the two time indices and the non-negative weight. A key-value cache is generated based on the embedding sequence. Each embedding vector is mapped to obtain a key vector and a value vector, which are then written into the key-value pair along with the time index and stored in the key-value cache.

[0010] Optionally, the generation of the sequential neighborhood, edge weight, and neighborhood measure specifically includes: The window position, half-width, and step size are determined based on the time index and sliding window parameters. The window interval is formed by taking half a window width time forward and half a window width time backward from the center time index. The part that exceeds the time index range is truncated at the boundary. Construct a time graph within each window, using the time index within the window interval as nodes and arranging them chronologically to generate sequential neighborhoods. Read the embedding vectors corresponding to the center time index and each time index of the sequential neighborhood from the embedding sequence, and calculate the distance value based on the embedding distance metric. Generate edge weights according to a weight function that monotonically decreases with increasing distance and is non-negative and bounded. Sum the edge weights related to the center time index to obtain a normalization factor, and use the ratio of each edge weight to the normalization factor as the neighborhood measure. Output the sequential neighborhood list, edge weight list, and neighborhood measure list. Write the sequential neighborhood, edge weights, neighborhood measures, and the set of nodes and edges within the window into the time graph cache. When advancing the center time index according to the window step size, delete the nodes and associated entries that have moved out of the window interval and insert the nodes and associated entries that have entered the window interval. Recalculate the distance values, edge weights, and neighborhood measures for the affected center time index and corresponding sequential neighborhood and update the time graph cache.

[0011] Optionally, the generation of the Ollivier–Ricci curvature sequence specifically includes: Read sequential neighborhood, edge weight, neighborhood measure, node set and edge set from the time graph cache, and form a set of adjacent time pairs according to the time index. Each pair consists of the previous time and the next time, and the next time is one time later than the previous time. For each adjacent time pair, perform monotonic matching in chronological order. The sequential neighborhoods of the previous time and the sequential neighborhoods of the next time are arranged in ascending order of time. Set two cursors to point to the starting positions of the two lists and iteratively process the current record. Determine the cost of a single transmission based on the embedding distance metric and the edge weights of both sides. Take the smaller value among the remaining neighborhood metrics on both sides as the transmission quality. The product of the transmission quality and the cost of a single transmission is accumulated as the monotonic matching cost. Move the corresponding cursor according to the source of the smaller value until the two lists are processed. To calculate the edge-level Ollivier–Ricci curvature, first calculate the center distance between adjacent time points, which is given by the embedding distance metric. Then, use the ratio of the monotonic matching cost to the center distance as the distance ratio. The edge-level curvature is defined as a minus the distance ratio. The reason for this definition is to normalize the transmission cost according to the baseline distance of the edge and map it into a dimensionless quantity so that it can be uniformly recorded and compared in the time graph. The edge-level curvature is written into the curvature sequence in time index order. Within the window, the edge-level curvature is summarized by time index to generate window-level curvature statistics. When advancing the time index according to the step size of the sliding window parameter, expired adjacent time pairs are removed and newly added adjacent time pairs are added. Monotonic matching and curvature calculation are performed only on newly added and affected adjacent time pairs. The curvature sequence and window-level curvature statistics are updated, and the cursor position and cumulative amount are recorded in the time map cache for incremental calculation.

[0012] Optionally, the calculation of the robust Ollivier–Ricci curvature sequence specifically includes: Read sequential neighborhood, neighborhood measure, edge weight, node set and edge set from the time graph cache, and set truncation ratio, quality loss ratio, quality penalty coefficient, entropy regularization coefficient, Huber threshold and time interval weight; At adjacent time points, truncation is performed. The source-side sequential neighborhood and the target-side sequential neighborhood are arranged in ascending order of embedding distance. Measure terms that have reached the truncation ratio at both ends are deleted and the middle interval is retained to obtain the truncated source-side neighborhood measure, target-side neighborhood measure and corresponding time index list. The calculation process of Huber distance is defined as follows: First, the Euclidean distance between the embedding vectors corresponding to two time indices is calculated as the residual. Then, the interval penalty based on the time index difference and the time interval weight is calculated. When the residual does not exceed the Huber threshold, a quadratic expression is used and the interval penalty is added. When the residual exceeds the Huber threshold, a single expression is used and the interval penalty is added to obtain the distance calculated in the Huber way. Using the truncated source-side neighborhood measure and target-side neighborhood measure as input, a partial mass transfer objective function is constructed and solved. The objective function is written as: ; Where i and j are the time indices of adjacent time pairs. and For sequential neighborhood, and For the truncated neighborhood measure, For the transmission quality from time index u to time index v, Distance calculated in Huber format. The entropy regularity coefficient is... The percentage of quality loss. This is the quality penalty coefficient. For non-negative operations, the objective function is based on the Kantorovich transport model and introduces entropy regularization and mass loss penalty, merging the transport term, relative entropy term and mass constraint term into a single cost expression; For each adjacent time pair, the center distance is calculated as the value of the embedding distance metric at the two time points. The ratio of the biased quality transmission cost to the center distance is taken as the distance ratio. The distance ratio is subtracted from the distance ratio to obtain the edge-level robust Ollivier-Ricci curvature and written into the robust curvature sequence and time map buffer. The reason for adopting this definition is to normalize the transmission cost by the center distance to obtain a dimensionless quantity and to be consistent with the standard form of Ollivier-Ricci in the metric space, while keeping the value unchanged when the embedding distance is scaled proportionally.

[0013] Optionally, the calculation of the curvature residual sequence specifically includes: Read the edge set, edge weight, sequential neighborhood, neighborhood measure and curvature sequence from the time graph cache, determine the time index range of the normal segment, and set the number of iterations, learning rate, lower bound of weight and upper bound of weight for the discrete Ricci flow; Within the normal segment, update the edge weight of each edge sequentially according to the number of iterations. The update steps are as follows: take the current edge weight, multiply it by one, subtract the learning rate multiplied by the Ollivier-Ricci curvature of the current edge to obtain the intermediate edge weight, restrict the intermediate edge weight between the lower bound and the upper bound of the weight, and write the restricted edge weight into the time graph cache. After completing all iterations, Ollivier–Ricci curvature is calculated within the normal segment based on the updated edge weights, sequential neighborhoods, and neighborhood measures. It is recorded as a baseline curvature sequence in time index order and written to the time graph cache. Read the current curvature sequence corresponding to the baseline curvature sequence from the current time map cache, calculate the difference one by one according to the same edge set and time index, subtract the current curvature from the baseline curvature to obtain the curvature residual sequence, write the curvature residual sequence into the time map cache and mark it for incremental update; When advancing the time index by the step size of the sliding window parameters, only edges entering or leaving the normal segment range are updated with edge weights and recalculated with baseline curvature. At the same time, the curvature residual sequence of the affected edges is updated, and the edge weights and curvature records of the previous iteration are retained in the time graph cache for incremental maintenance.

[0014] Optionally, the generation of the anomaly label specifically includes: Read the monotonic matching curvature sequence, robust curvature sequence and curvature residual sequence from the time map cache, generate window index by aligning the time index with the sliding window parameter and establish a one-to-one mapping relationship with the time index; The fusion weight vector is set to a three-dimensional non-negative vector with a component sum of one. The statistics of the three types of curvature sequences are calculated according to the window index and weighted according to the preset fusion rules. The window anomaly fraction stream is generated and written to the time map cache. A threshold module is constructed on the abnormal fractional flow of the window. The peak threshold is obtained by fitting the generalized Pareto distribution using the peak exceedance method. At the same time, the target quantile is calculated on the rolling window to obtain the quantile threshold. The larger of the two values ​​is taken as the judgment threshold and written into the threshold sequence and time map cache. Online judgment is performed based on the threshold sequence. The window anomaly score is compared with the judgment threshold by time index to output point-level anomaly labels. The proportion of point-level anomaly labels is counted according to the window index and compared with the preset proportion parameter to output window-level anomaly labels. The point-level anomaly labels, window-level anomaly labels, window anomaly score stream and threshold sequence are recorded in the event log and time map cache.

[0015] Optionally, the generation of the abnormal interval, start and end time, and channel positioning result specifically includes: Read point-level anomaly labels, window-level anomaly labels, window anomaly score streams, and threshold sequences from the time map cache, and establish a mapping from time index to start and end times; The point-level anomaly labels are aggregated into continuous segments by time index, and the minimum duration length filtering and minimum gap merging are performed. The anomaly interval and start and end time are determined by combining the window-level anomaly labels. Within each abnormal interval, the monotonic matching curvature sequence, robust curvature sequence, and curvature residual sequence are summarized to generate channel scores. The channel positioning results are output, and event records are generated and written to a replayable archive.

[0016] The beneficial effects of this invention are: This invention constructs a temporal graph within the Transformer embedding space, introduces sequential neighborhood, edge weights, and neighborhood measures, and establishes a geometric metric link from points to distribution by calculating the Ollivier-Ricci curvature sequence using monotonic matching in temporal order. This overcomes the limitations of traditional attention scoring methods, which lack metric structures and only perform point-to-point similarity calculations. Curvature is normalized by center distance, ensuring comparability across devices and operating conditions. Combined with temporal graph caching and sliding window incremental maintenance, online processing latency is low, and it can stably cover scenarios with both long dependencies and abrupt changes.

[0017] In terms of robustness, the system applies α-truncation and biased quality transmission to the neighborhood measure, and uses Huber distance to characterize the unified cost of residual and time interval penalties, suppressing the impact of impulse noise, packet loss, and drift on curvature estimation. The discrete Ricci stream iteratively constructs a baseline curvature sequence on the normal segment. The current curvature and the baseline curvature form a curvature residual sequence. Incremental updates facilitate rapid adaptation to environmental changes. The source and intensity of anomalies are consistently characterized by the fusion of monotonic matching curvature, robust curvature, and curvature residuals.

[0018] In terms of decision output, the system uses window anomaly fractional flow to access the threshold module, combines peak exceedance and quantile method to generate adaptive thresholds, uniformly outputs point-level and window-level anomaly labels, and further generates anomaly intervals, start and end times and channel positioning results. Event records and replayable archives are consistently connected to the detection link, reducing the burden of rule splicing and manual review, and improving positioning accuracy and engineering usability. Attached Figure Description

[0019] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings: Figure 1 This is a flowchart of a Transformer-based time-series signal anomaly detection system proposed in this invention; Figure 2 This is a schematic diagram of the time map construction for a Transformer-based time-series signal anomaly detection system proposed in this invention. Detailed Implementation

[0020] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0021] refer to Figure 1-2 A Transformer-based time-series signal anomaly detection system includes: The observation and preprocessing module is used to acquire time-series signals and perform denoising, standardization and missing data completion, generate observation sequences and establish time indexes and sliding window parameters; The encoder module is used to perform channel embedding and temporal location encoding on the observation sequence, output the embedded sequence, establish the embedding distance metric, and generate a key-value cache; The time graph construction module is used to generate sequential neighborhoods, edge weights, and neighborhood measures within the sliding window based on the embedding sequence and embedding distance according to the time index and sliding window parameters, and write them to the time graph cache. The monotonic matching curvature module is used to perform monotonic matching in chronological order for adjacent moments in the time graph buffer and to calculate the Ollivier–Ricci curvature sequence; The robust curvature module is used to perform α-truncation and partial mass transfer on the neighborhood measure of sequential neighborhood in the time-map buffer and introduce Huber distance to generate a robust Ollivier–Ricci curvature sequence. The baseline and residual module is used to iterate the discrete Ricci flow in the normal segment to generate a baseline curvature sequence and calculate the curvature residual sequence. The anomaly scoring and determination module is used to fuse monotonic matching curvature sequences, robust curvature sequences, and curvature residual sequences to generate a window anomaly score stream and output point-level and window-level anomaly labels. The event generation and playback module is used to generate abnormal intervals, start and end times and channel positioning results based on abnormal labels and curvature sequences, and write them into the event log and replayable archive.

[0022] This invention forms a closed-loop architecture with observation and preprocessing, encoder, time map construction, monotonic matching curvature, robust curvature, baseline and residual, anomaly scoring and judgment, and event generation and playback. Under unified time index and sliding window parameters, it integrates embedding, curvature and judgment, reduces false alarms, improves cross-device comparability, and supports traceability and verification with replayable archives.

[0023] In this embodiment, the modules are interconnected using the following method: Acquire and preprocess time-series signals to generate observation sequences; Construct a Transformer encoder to perform channel embedding and temporal location encoding on the observation sequence, output the embedded sequence, establish an embedding distance metric, and cache the key-value pairs; Within a sliding window, a time graph is constructed based on the embedding sequence and embedding distance, generating sequential neighborhoods, edge weights, and neighborhood measures, which are then written to the time graph cache. In the time graph cache, monotonic matching is performed on adjacent time points in chronological order. The Ollivier–Ricci curvature sequence is calculated based on the embedding distance and edge weights and the time graph cache is updated accordingly. Within the time-map buffer, α-truncation and partial quality transfer are performed on the neighborhood measure of sequential neighborhoods, Huber distance is introduced, robust Ollivier–Ricci curvature sequences are calculated, and the time-map buffer is updated. The baseline curvature sequence is generated by iterating discrete Ricci flow on the normal time map buffer, and the curvature residual sequence is calculated and incrementally updated on the current time map buffer. The window anomaly fraction stream is generated by fusing monotonic matching curvature sequences, robust curvature sequences, and curvature residual sequences. The anomaly labels are then determined online by a threshold module and output at both the point and window levels. Anomaly intervals, start and end times, and channel location results are generated based on anomaly labels and curvature sequences, and written into event logs and replayable archives.

[0024] This invention maps observation sequences to embedded sequences and constructs time maps within sliding windows through method-level connections between modules. Then, it drives the output of window anomaly scores and labels with curvature sequences and residual sequences. Key-value caching and time map caching work together to achieve streaming and incremental computation, significantly reducing online computation and storage overhead.

[0025] In this embodiment, the generation of the embedding sequence, the establishment of the embedding distance metric, and the caching of the key value specifically include: The observation sequence is organized according to the time index, and the channel vector at each time moment is mapped to a channel embedding vector of the same dimension to form a channel embedding sequence corresponding to the time index. For each time index, generate a time position encoding vector consistent with the channel embedding dimension. Add the time position encoding to the channel embedding element by element to obtain the encoded input sequence. Construct a Transformer encoder, which consists of a preset number of encoder layers connected in series. Each encoder layer contains a self-attention sub-layer, a feedforward network sub-layer, layer normalization, and residual connections. The self-attention sub-layer is composed of parallel attention sub-layers and the number is a preset positive integer. The encoded input sequence is fed into the Transformer encoder, calculated according to the hierarchical structure, and the output is the embedding sequence corresponding to the time index. The intermediate state is retained in memory for streaming inference. An embedding distance metric is established, defining the distance between embedding vectors corresponding to any two time indices as a weighted sum of the vector Euclidean distance and the time interval penalty. The time interval penalty is calculated based on the absolute value of the difference between the two time indices and the non-negative weight. A key-value cache is generated based on the embedding sequence. Each embedding vector is mapped to obtain a key vector and a value vector, which are then written into the key-value pair along with the time index and stored in the key-value cache.

[0026] This invention uses channel embedding and time position encoding in the encoder module to enter the Transformer encoder and establishes an embedding distance metric and key value cache, so that long dependencies and local mutations can be uniformly represented, streaming retains intermediate states to reduce latency, and injecting time penalties into the distance metric improves the stability of timing alignment determination.

[0027] In this embodiment, the generation of the sequential neighborhood, edge weight, and neighborhood measure specifically includes: The window position, half-width, and step size are determined based on the time index and sliding window parameters. The window interval is formed by taking half a window width time forward and half a window width time backward from the center time index. The part that exceeds the time index range is truncated at the boundary. Construct a time graph within each window, using the time index within the window interval as nodes and arranging them chronologically to generate sequential neighborhoods. Read the embedding vectors corresponding to the center time index and each time index of the sequential neighborhood from the embedding sequence, and calculate the distance value based on the embedding distance metric. Generate edge weights according to a weight function that monotonically decreases with increasing distance and is non-negative and bounded. Sum the edge weights related to the center time index to obtain a normalization factor, and use the ratio of each edge weight to the normalization factor as the neighborhood measure. Output the sequential neighborhood list, edge weight list, and neighborhood measure list. Write the sequential neighborhood, edge weights, neighborhood measures, and the set of nodes and edges within the window into the time graph cache. When advancing the center time index according to the window step size, delete the nodes and associated entries that have moved out of the window interval and insert the nodes and associated entries that have entered the window interval. Recalculate the distance values, edge weights, and neighborhood measures for the affected center time index and corresponding sequential neighborhood and update the time graph cache.

[0028] This invention generates sequential neighborhoods by time index within the time graph construction module and calculates edge weights and neighborhood measures based on embedding distance. The time graph cache is maintained incrementally by step size, so that the time relationship within the window is explicitly encoded. After the neighborhood probability allocation is standardized, it can be compared across windows, supporting reliable input for subsequent curvature and anomaly scoring.

[0029] In this embodiment, the generation of the Ollivier–Ricci curvature sequence specifically includes: Read sequential neighborhood, edge weight, neighborhood measure, node set and edge set from the time graph cache, and form a set of adjacent time pairs according to the time index. Each pair consists of the previous time and the next time, and the next time is one time later than the previous time. For each adjacent time pair, perform monotonic matching in chronological order. The sequential neighborhoods of the previous time and the sequential neighborhoods of the next time are arranged in ascending order of time. Set two cursors to point to the starting positions of the two lists and iteratively process the current record. Determine the cost of a single transmission based on the embedding distance metric and the edge weights of both sides. Take the smaller value among the remaining neighborhood metrics on both sides as the transmission quality. The product of the transmission quality and the cost of a single transmission is accumulated as the monotonic matching cost. Move the corresponding cursor according to the source of the smaller value until the two lists are processed. To calculate the edge-level Ollivier–Ricci curvature, first calculate the center distance between adjacent time points, which is given by the embedding distance metric. Then, use the ratio of the monotonic matching cost to the center distance as the distance ratio. The edge-level curvature is defined as a minus the distance ratio. The reason for this definition is to normalize the transmission cost according to the baseline distance of the edge and map it into a dimensionless quantity so that it can be uniformly recorded and compared in the time graph. The edge-level curvature is written into the curvature sequence in time index order. Within the window, the edge-level curvature is summarized by time index to generate window-level curvature statistics. When advancing the time index according to the step size of the sliding window parameter, expired adjacent time pairs are removed and newly added adjacent time pairs are added. Monotonic matching and curvature calculation are performed only on newly added and affected adjacent time pairs. The curvature sequence and window-level curvature statistics are updated, and the cursor position and cumulative amount are recorded in the time map cache for incremental calculation.

[0030] This invention performs temporal matching on sequential neighborhoods of adjacent time points in a monotonic matching curvature module to obtain a dimensionless Ollivier–Ricci curvature sequence by embedding distance and edge weights. The distance ratio normalization ensures scale invariance and reduces threshold drift. The curvature trajectory can directly reflect the structural changes of contraction and expansion.

[0031] In this embodiment, the calculation of the robust Ollivier–Ricci curvature sequence specifically includes: Read sequential neighborhood, neighborhood measure, edge weight, node set and edge set from the time graph cache, and set truncation ratio, quality loss ratio, quality penalty coefficient, entropy regularization coefficient, Huber threshold and time interval weight; At adjacent time points, truncation is performed. The source-side sequential neighborhood and the target-side sequential neighborhood are arranged in ascending order of embedding distance. Measure terms that have reached the truncation ratio at both ends are deleted and the middle interval is retained to obtain the truncated source-side neighborhood measure, target-side neighborhood measure and corresponding time index list. The calculation process of Huber distance is defined as follows: First, the Euclidean distance between the embedding vectors corresponding to two time indices is calculated as the residual. Then, the interval penalty based on the time index difference and the time interval weight is calculated. When the residual does not exceed the Huber threshold, a quadratic expression is used and the interval penalty is added. When the residual exceeds the Huber threshold, a single expression is used and the interval penalty is added to obtain the distance calculated in the Huber way. Using the truncated source-side neighborhood measure and target-side neighborhood measure as input, a partial mass transfer objective function is constructed and solved. The objective function is written as: ; Where i and j are the time indices of adjacent time pairs. and For sequential neighborhood, and For the truncated neighborhood measure, For the transmission quality from time index u to time index v, Distance calculated in Huber format. The entropy regularity coefficient is... The percentage of quality loss. This is the quality penalty coefficient. For non-negative operations, the objective function is based on the Kantorovich transport model and introduces entropy regularization and mass loss penalty, merging the transport term, relative entropy term and mass constraint term into a single cost expression; For each adjacent time pair, the center distance is calculated as the value of the embedding distance metric at the two time points. The ratio of the biased quality transmission cost to the center distance is taken as the distance ratio. The distance ratio is subtracted from the distance ratio to obtain the edge-level robust Ollivier-Ricci curvature and written into the robust curvature sequence and time map buffer. The reason for adopting this definition is to normalize the transmission cost by the center distance to obtain a dimensionless quantity and to be consistent with the standard form of Ollivier-Ricci in the metric space, while keeping the value unchanged when the embedding distance is scaled proportionally.

[0032] This invention implements α-truncation on neighborhood measures in the robust curvature module and adopts a unified metric for residuals and time interval penalties based on biased quality transmission and Huber distance. Even when packet loss, pulses, and slow drift coexist, it can still obtain a stable robust Ollivier–Ricci curvature sequence, providing noise-resistant and comparable geometric features for anomaly scoring.

[0033] In this embodiment, the calculation of the curvature residual sequence specifically includes: Read the edge set, edge weight, sequential neighborhood, neighborhood measure and curvature sequence from the time graph cache, determine the time index range of the normal segment, and set the number of iterations, learning rate, lower bound of weight and upper bound of weight for the discrete Ricci flow; Within the normal segment, update the edge weight of each edge sequentially according to the number of iterations. The update steps are as follows: take the current edge weight, multiply it by one, subtract the learning rate multiplied by the Ollivier-Ricci curvature of the current edge to obtain the intermediate edge weight, restrict the intermediate edge weight between the lower bound and the upper bound of the weight, and write the restricted edge weight into the time graph cache. After completing all iterations, Ollivier–Ricci curvature is calculated within the normal segment based on the updated edge weights, sequential neighborhoods, and neighborhood measures. It is recorded as a baseline curvature sequence in time index order and written to the time graph cache. Read the current curvature sequence corresponding to the baseline curvature sequence from the current time map cache, calculate the difference one by one according to the same edge set and time index, subtract the current curvature from the baseline curvature to obtain the curvature residual sequence, write the curvature residual sequence into the time map cache and mark it for incremental update; When advancing the time index by the step size of the sliding window parameters, only edges entering or leaving the normal segment range are updated with edge weights and recalculated with baseline curvature. At the same time, the curvature residual sequence of the affected edges is updated, and the edge weights and curvature records of the previous iteration are retained in the time graph cache for incremental maintenance.

[0034] This invention constructs a baseline curvature sequence by iteratively constructing the normal segment using discrete Ricci flow in the baseline and residual modules, and forms a curvature residual sequence by the difference between the current curvature and the baseline curvature. The sliding window advance only updates the affected edges incrementally, which can separate slow drift and structural changes and shorten the convergence time of the model under changing operating conditions.

[0035] In this embodiment, the generation of the anomaly tag specifically includes: Read the monotonic matching curvature sequence, robust curvature sequence and curvature residual sequence from the time map cache, generate window index by aligning the time index with the sliding window parameter and establish a one-to-one mapping relationship with the time index; The fusion weight vector is set to a three-dimensional non-negative vector with a component sum of one. The statistics of the three types of curvature sequences are calculated according to the window index and weighted according to the preset fusion rules. The window anomaly fraction stream is generated and written to the time map cache. A threshold module is constructed on the abnormal fractional flow of the window. The peak threshold is obtained by fitting the generalized Pareto distribution using the peak exceedance method. At the same time, the target quantile is calculated on the rolling window to obtain the quantile threshold. The larger of the two values ​​is taken as the judgment threshold and written into the threshold sequence and time map cache. Online judgment is performed based on the threshold sequence. The window anomaly score is compared with the judgment threshold by time index to output point-level anomaly labels. The proportion of point-level anomaly labels is counted according to the window index and compared with the preset proportion parameter to output window-level anomaly labels. The point-level anomaly labels, window-level anomaly labels, window anomaly score stream and threshold sequence are recorded in the event log and time map cache.

[0036] This invention integrates monotonic matching curvature, robust curvature, and curvature residual to generate window anomaly scores in the anomaly scoring and judgment module. It also uses peak exceedance and quantile methods to jointly set thresholds and outputs point-level and window-level labels. The scores and thresholds can be directly compared across time periods, facilitating consistent use for online alarms and batch offline audits.

[0037] In this embodiment, the generation of the abnormal interval, start and end time, and channel positioning result specifically includes: Read point-level anomaly labels, window-level anomaly labels, window anomaly score streams, and threshold sequences from the time map cache, and establish a mapping from time index to start and end times; The point-level anomaly labels are aggregated into continuous segments by time index, and the minimum duration length filtering and minimum gap merging are performed. The anomaly interval and start and end time are determined by combining the window-level anomaly labels. Within each abnormal interval, the monotonic matching curvature sequence, robust curvature sequence, and curvature residual sequence are summarized to generate channel scores. The channel positioning results are output, and event records are generated and written to a replayable archive.

[0038] This invention automatically generates abnormal intervals and start and end times based on labels and curvature sequences in the event generation and playback module, and outputs channel positioning results. At the same time, it generates event records and replayable archives containing fractional trajectories and threshold sections, standardizing the positioning and verification process and supporting subsequent model retraining and operation and maintenance closed loop.

[0039] Example 1: To verify the feasibility of this invention in practice, it was applied to a type of industrial equipment condition monitoring scenario for anomaly detection and localization of multi-channel vibration and temperature signals. The monitoring object is continuously operating mechanical equipment, each equipped with 12 accelerometers and 2 temperature sensors, with a sampling frequency of 200Hz and a monitoring period of 7 days. Traditional anomaly detection algorithms based on thresholds and statistical features suffer from detection delays, high false alarm rates, and cross-channel interference in this scenario, making it difficult to adapt to the non-stationarity and abrupt changes in multivariate time-series signals. This invention, through the Transformer coding structure and a graph geometric analysis framework based on Ollivier–Ricci curvature, characterizes structural anomalies from the temporal curvature changes in the embedded space, achieving accurate identification of anomaly points and anomaly intervals.

[0040] In actual deployment, vibration and temperature signals are first collected from the equipment control system. Noise filtering, mean normalization, and missing data completion are performed in the observation and preprocessing module to form an observation sequence with a unified time index. The observation length of each channel is 1,209,600 sampling points. After preprocessing, the sliding window size is set to 512 and the sliding step size is 64. In the encoder module, the observation sequence is input to the Transformer encoder after channel embedding and time position encoding. The encoder contains an 8-layer cascaded structure, with 4 attention sublayers and a feedforward network in each layer. The system outputs the embedding sequence in streaming inference mode and retains a key-value cache in memory to support real-time sliding window calculation. Subsequently, in the time graph construction module, with the embedding distance metric as the core, the time index within the window is organized into an ordered set of nodes. An edge weight function is established and normalized to obtain the neighborhood metric. The time graph cache is updated in real time.

[0041] In the monotonic matching curvature module, adjacent time windows are used to calculate Ollivier-Ricci curvature by matching neighborhood distribution. The system uses the ratio of edge weight to distance to define dimensionless curvature and generate curvature sequences. To enhance robustness, the robust curvature module implements α-truncation and biased mass transfer on the neighborhood measure and introduces Huber distance to smooth out anomaly spikes and drifts, forming a robust Ollivier-Ricci curvature sequence. The normal working segment generates baseline curvature through discrete Ricci flow. The curvature residual is obtained by subtracting the current window curvature from the baseline curvature. The baseline and residual modules are incrementally maintained in the time map cache. After the three types of curvature sequences are fused, a window anomaly score stream is formed. The anomaly scoring and judgment module uses peak exceedance and quantile methods to determine the threshold and generate point-level and window-level anomaly labels. Finally, the event generation and playback module outputs the anomaly interval, start and end time, and channel location results.

[0042] To verify performance, the detection results of this invention were compared with those of three typical algorithms: one is the reconstruction error method based on autoencoders, the second is the temporal prediction method based on LSTM, and the third is the Isolation Forest statistical method. Evaluation metrics included anomaly detection accuracy, false alarm rate, average detection latency, and anomaly interval localization error. The test samples included real equipment operating data and manually injected fault segments (bearing wear, loose bolts, sudden temperature rise, vibration drift), with fault durations ranging from 5 to 60 seconds. The anomaly injection ratio was 2.5% of the total sample. The comparison results are shown in Table 1. Table 1 Performance Comparison of Different Anomaly Detection Methods

[0043] Experiments show that this invention improves accuracy by an average of approximately 6% compared to traditional methods, reduces the false alarm rate by nearly 50%, shortens the average detection delay to less than 1.5 seconds, and controls the anomaly localization error to below 10%. In multi-channel signals, the system can distinguish asynchronous anomalies between channels, effectively avoiding cross-interference between vibration and temperature signals. Furthermore, the joint analysis of curvature residuals and robust curvature ensures high stability even under non-stationary conditions, and the sliding window buffer structure supports online updates and real-time judgments of over 10,000 records per second. These experiments demonstrate that this invention can achieve accurate, real-time, and interpretable anomaly detection and localization of time-series signals in complex industrial environments, verifying the feasibility and superiority of the method in engineering applications.

[0044] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A time-series signal anomaly detection system based on Transformer, characterized in that, include: The observation and preprocessing module is used to acquire time-series signals and perform denoising, standardization and missing data completion, generate observation sequences and establish time indexes and sliding window parameters; The encoder module is used to perform channel embedding and temporal location encoding on the observation sequence, output the embedded sequence, establish the embedding distance metric, and generate a key-value cache; The time graph construction module is used to generate sequential neighborhoods, edge weights, and neighborhood measures within the sliding window based on the embedding sequence and embedding distance according to the time index and sliding window parameters, and write them to the time graph cache. The monotonic matching curvature module is used to perform monotonic matching in chronological order for adjacent moments in the time graph buffer and to calculate the Ollivier–Ricci curvature sequence; The robust curvature module is used to perform α-truncation and partial mass transfer on the neighborhood measure of sequential neighborhood in the time-map buffer and introduce Huber distance to generate a robust Ollivier–Ricci curvature sequence. The baseline and residual module is used to iterate the discrete Ricci flow in the normal segment to generate a baseline curvature sequence and calculate the curvature residual sequence. The anomaly scoring and determination module is used to fuse monotonic matching curvature sequences, robust curvature sequences, and curvature residual sequences to generate a window anomaly score stream and output point-level and window-level anomaly labels. The event generation and playback module is used to generate abnormal intervals, start and end times and channel positioning results based on abnormal labels and curvature sequences, and write them into the event log and replayable archive.

2. The Transformer-based time-series signal anomaly detection system according to claim 1, characterized in that, The modules are connected in the following way: Acquire and preprocess time-series signals to generate observation sequences; Construct a Transformer encoder to perform channel embedding and temporal location encoding on the observation sequence, output the embedded sequence, establish an embedding distance metric, and cache the key-value pairs; Within a sliding window, a time graph is constructed based on the embedding sequence and embedding distance, generating sequential neighborhoods, edge weights, and neighborhood measures, which are then written to the time graph cache. In the time graph cache, monotonic matching is performed on adjacent time points in chronological order. The Ollivier–Ricci curvature sequence is calculated based on the embedding distance and edge weights and the time graph cache is updated accordingly. Within the time-map buffer, α-truncation and partial quality transfer are performed on the neighborhood measure of sequential neighborhoods, Huber distance is introduced, robust Ollivier–Ricci curvature sequences are calculated, and the time-map buffer is updated. The baseline curvature sequence is generated by iterating discrete Ricci flow on the normal time map buffer, and the curvature residual sequence is calculated and incrementally updated on the current time map buffer. The window anomaly fraction stream is generated by fusing monotonic matching curvature sequences, robust curvature sequences, and curvature residual sequences. The anomaly labels are then determined online by a threshold module and output at both the point and window levels. Anomaly intervals, start and end times, and channel location results are generated based on anomaly labels and curvature sequences, and written into event logs and replayable archives.

3. The Transformer-based time-series signal anomaly detection system according to claim 2, characterized in that, The generation of the embedding sequence and the establishment of the embedding distance metric and caching of key values ​​specifically include: The observation sequence is organized according to the time index, and the channel vector at each time moment is mapped to a channel embedding vector of the same dimension to form a channel embedding sequence corresponding to the time index. For each time index, generate a time position encoding vector consistent with the channel embedding dimension. Add the time position encoding to the channel embedding element by element to obtain the encoded input sequence. Construct a Transformer encoder, which consists of a preset number of encoder layers connected in series. Each encoder layer contains a self-attention sub-layer, a feedforward network sub-layer, layer normalization, and residual connections. The self-attention sub-layer is composed of parallel attention sub-layers and the number is a preset positive integer. The encoded input sequence is fed into the Transformer encoder, calculated according to the hierarchical structure, and the output is the embedding sequence corresponding to the time index. The intermediate state is retained in memory for streaming inference. An embedding distance metric is established, defining the distance between embedding vectors corresponding to any two time indices as a weighted sum of the vector Euclidean distance and the time interval penalty. The time interval penalty is calculated based on the absolute value of the difference between the two time indices and the non-negative weight. A key-value cache is generated based on the embedding sequence. Each embedding vector is mapped to obtain a key vector and a value vector, which are then written into the key-value pair along with the time index and stored in the key-value cache.

4. The Transformer-based time-series signal anomaly detection system according to claim 2, characterized in that, The generation of the sequential neighborhood, edge weight, and neighborhood measure specifically includes: The window position, half-width, and step size are determined based on the time index and sliding window parameters. The window interval is formed by taking half a window width time forward and half a window width time backward from the center time index. The part that exceeds the time index range is truncated at the boundary. Construct a time graph within each window, using the time index within the window interval as nodes and arranging them chronologically to generate sequential neighborhoods. Read the embedding vectors corresponding to the center time index and each time index of the sequential neighborhood from the embedding sequence, and calculate the distance value based on the embedding distance metric. Generate edge weights according to a weight function that monotonically decreases with increasing distance and is non-negative and bounded. Sum the edge weights related to the center time index to obtain a normalization factor, and use the ratio of each edge weight to the normalization factor as the neighborhood measure. Output the sequential neighborhood list, edge weight list, and neighborhood measure list. Write the sequential neighborhood, edge weights, neighborhood measures, and the set of nodes and edges within the window into the time graph cache. When advancing the center time index according to the window step size, delete the nodes and associated entries that have moved out of the window interval and insert the nodes and associated entries that have entered the window interval. Recalculate the distance values, edge weights, and neighborhood measures for the affected center time index and corresponding sequential neighborhood and update the time graph cache.

5. A time-series signal anomaly detection system based on Transformer according to claim 2, characterized in that, The generation of the Ollivier–Ricci curvature sequence specifically includes: Read sequential neighborhood, edge weight, neighborhood measure, node set and edge set from the time graph cache, and form a set of adjacent time pairs according to the time index. Each pair consists of the previous time and the next time, and the next time is one time later than the previous time. For each adjacent time pair, perform monotonic matching in chronological order. The sequential neighborhoods of the previous time and the sequential neighborhoods of the next time are arranged in ascending order of time. Set two cursors to point to the starting positions of the two lists and iteratively process the current record. Determine the cost of a single transmission based on the embedding distance metric and the edge weights of both sides. Take the smaller value among the remaining neighborhood metrics on both sides as the transmission quality. The product of the transmission quality and the cost of a single transmission is accumulated as the monotonic matching cost. Move the corresponding cursor according to the source of the smaller value until the two lists are processed. To calculate the edge-level Ollivier–Ricci curvature, first calculate the center distance between adjacent time steps, which is given by the embedding distance metric. Then, use the ratio of the monotonic matching cost to the center distance as the distance ratio. The edge-level curvature is defined as a minus the distance ratio. Write the edge-level curvature into the curvature sequence in time index order. Within the window, the edge-level curvature is summarized by time index to generate window-level curvature statistics. When advancing the time index according to the step size of the sliding window parameter, expired adjacent time pairs are removed and new adjacent time pairs are added. Monotonic matching and curvature calculation are performed only on new and affected adjacent time pairs. The curvature sequence and window-level curvature statistics are updated, and the cursor position and cumulative amount are recorded in the time map cache.

6. The Transformer-based time-series signal anomaly detection system according to claim 2, characterized in that, The calculation of the robust Ollivier–Ricci curvature sequence specifically includes: Read sequential neighborhood, neighborhood measure, edge weight, node set and edge set from the time graph cache, and set truncation ratio, quality loss ratio, quality penalty coefficient, entropy regularization coefficient, Huber threshold and time interval weight; At adjacent time points, truncation is performed. The source-side sequential neighborhood and the target-side sequential neighborhood are arranged in ascending order of embedding distance. Measure terms that have reached the truncation ratio at both ends are deleted and the middle interval is retained to obtain the truncated source-side neighborhood measure, target-side neighborhood measure and corresponding time index list. The calculation process of Huber distance is defined as follows: First, the Euclidean distance between the embedding vectors corresponding to two time indices is calculated as the residual. Then, the interval penalty based on the time index difference and the time interval weight is calculated. When the residual does not exceed the Huber threshold, a quadratic expression is used and the interval penalty is added. When the residual exceeds the Huber threshold, a single expression is used and the interval penalty is added to obtain the distance calculated in the Huber way. Using the truncated source-side neighborhood measure and target-side neighborhood measure as inputs, a partial mass transport objective function is constructed and solved. Based on the Kantorovich transport model, entropy regularization and mass loss penalty are introduced, and the transport term, relative entropy term and mass constraint term are merged into a single cost expression. For each adjacent time pair, the center distance is calculated as the value of the embedded distance metric at the two time points. The ratio of the biased quality transmission cost to the center distance is taken as the distance ratio. The distance ratio is subtracted from the distance ratio to obtain the edge-level robust Ollivier-Ricci curvature and written into the robust curvature sequence and time map cache.

7. The Transformer-based time-series signal anomaly detection system according to claim 2, characterized in that, The calculation of the curvature residual sequence specifically includes: Read the edge set, edge weight, sequential neighborhood, neighborhood measure and curvature sequence from the time graph cache, determine the time index range of the normal segment, and set the number of iterations, learning rate, lower bound of weight and upper bound of weight for the discrete Ricci flow; Within the normal segment, update the edge weight of each edge sequentially according to the number of iterations; After completing all iterations, Ollivier–Ricci curvature is calculated within the normal segment based on the updated edge weights, sequential neighborhoods, and neighborhood measures. It is recorded as a baseline curvature sequence in time index order and written to the time graph cache. Read the current curvature sequence corresponding to the baseline curvature sequence from the current time map cache, calculate the difference one by one according to the same edge set and time index, subtract the current curvature from the baseline curvature to obtain the curvature residual sequence, write the curvature residual sequence into the time map cache and mark it; When advancing the time index by the step size of the sliding window parameters, only the edges entering and leaving the normal segment range are updated with edge weights and recalculated with baseline curvature. At the same time, the curvature residual sequence of the affected edges is updated, and the edge weights and curvature records of the previous iteration are retained in the time map cache.

8. A time-series signal anomaly detection system based on Transformer according to claim 2, characterized in that, The generation of the anomaly tags specifically includes: Read the monotonic matching curvature sequence, robust curvature sequence and curvature residual sequence from the time map cache, generate window index by aligning the time index with the sliding window parameter and establish a one-to-one mapping relationship with the time index; The fusion weight vector is set to a three-dimensional non-negative vector with a component sum of one. The statistics of the three types of curvature sequences are calculated according to the window index and weighted according to the preset fusion rules. The window anomaly fraction stream is generated and written to the time map cache. A threshold module is constructed on the abnormal fractional flow of the window. The peak threshold is obtained by fitting the generalized Pareto distribution using the peak exceedance method. At the same time, the target quantile is calculated on the rolling window to obtain the quantile threshold. The larger of the two values ​​is taken as the judgment threshold and written into the threshold sequence and time map cache. Online judgment is performed based on the threshold sequence. The window anomaly score is compared with the judgment threshold by time index to output point-level anomaly labels. The proportion of point-level anomaly labels is counted according to the window index and compared with the preset proportion parameter to output window-level anomaly labels. The point-level anomaly labels, window-level anomaly labels, window anomaly score stream and threshold sequence are recorded in the event log and time map cache.

9. A time-series signal anomaly detection system based on Transformer according to claim 2, characterized in that, The generation of the abnormal interval, start and end time, and channel positioning results specifically includes: Read point-level anomaly labels, window-level anomaly labels, window anomaly score streams, and threshold sequences from the time map cache, and establish a mapping from time index to start and end times; The point-level anomaly labels are aggregated into continuous segments by time index, and the minimum duration length filtering and minimum gap merging are performed. The anomaly interval and start and end time are determined by combining the window-level anomaly labels. Within each abnormal interval, the monotonic matching curvature sequence, robust curvature sequence, and curvature residual sequence are summarized to generate channel scores. The channel positioning results are output, and event records are generated and written to a replayable archive.

Images