Training management method, device and equipment for long-tail time sequence anomaly detection model

Abstract

This application provides a training governance method, apparatus, and device for long-tail temporal anomaly detection models. The method constructs a candidate synthetic anomaly fragment set based on real long-tail anomaly fragments, historically falsely detected or falsely detected difficult fragments, and preset temporal perturbation generation rules. For each candidate synthetic anomaly fragment, a coverage gain score, boundary confusion score, and distribution deviation constraint index are calculated, and the candidate synthetic anomaly fragments are assigned to the training layer, challenge layer, or rejection layer. Conditional admission decision variables are constructed, and training layer samples are imported into the training process in batches when the decision variables meet the admission conditions. The updated candidate models are jointly evaluated, and a stable model snapshot is updated when the evaluation results meet stability conditions. The admission priority, admission weight, or hierarchical destination of the next round of candidate synthetic anomaly fragments is adjusted based on the failure type statistics in the challenge set. This method improves the long-tail anomaly detection capability while controlling the risk of introducing synthetic anomaly samples.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence model training and governance technology, and in particular to a training and governance method, apparatus and device for long-tailed temporal anomaly detection models. Background Technology

[0002] Long-tail time-series anomaly detection is widely used in scenarios such as industrial equipment health monitoring, cloud service operation and maintenance alarms, energy system fault diagnosis, network security monitoring, and financial transaction risk control. In these scenarios, real-world anomaly samples typically exhibit a clear long-tail distribution, meaning that a small number of common anomalies have a large number of samples, while key but rare anomaly categories have very few samples. This causes existing time-series anomaly detection models to easily miss long-tail anomaly types and to be unstable in their performance on confusing anomaly segments near the decision boundary.

[0003] To alleviate the problem of insufficient long-tailed outlier samples, existing technologies typically employ data augmentation, rule perturbation, or generative models to construct synthetic outlier samples, which are then incorporated into the training set. However, existing solutions often treat synthetic outlier samples as equivalent training resources to real samples, lacking detailed assessments of their coverage value, boundary value, and distribution deviation risk. This can easily lead to the introduction of samples that deviate significantly from the real outlier distribution, resulting in a decline in model performance on real validation data.

[0004] Furthermore, existing solutions generally lack phased admission, challenge set retention, and batch rollback mechanisms for synthetic anomalous samples. On the one hand, introducing highly challenging synthetic anomalous samples too early, before the model has stably learned the basic anomalous patterns, can easily disrupt the training convergence process. On the other hand, directly discarding high-value candidate samples that are not yet suitable for admission training will result in the loss of challenging samples that are valuable for evaluating the robustness of the model.

[0005] Therefore, there is an urgent need for a training governance scheme for long-tail time-series anomaly detection models, which can improve the detection capability of long-tail anomalies while controlling the risk of introducing synthetic anomaly samples, and support closed-loop maintenance around sample admission, challenge assessment and batch rollback. Summary of the Invention

[0006] This application provides a training governance method, apparatus, and device for long-tailed temporal anomaly detection models, which addresses the problems of existing schemes lacking coverage value assessment, boundary difficulty sample identification, risk constraints, phased admission, and closed-loop backoff during the process of synthetic anomaly sample expansion.

[0007] Firstly, this application provides a training governance method for long-tailed temporal anomaly detection models, the method comprising:

[0008] A candidate set of synthetic anomalies is constructed based on real long-tailed anomaly fragments, difficult fragments that were misdetected or missed in the model's history, and preset temporal perturbation generation rules.

[0009] For each candidate synthetic anomalous fragment, calculate the coverage gain score, boundary confusion score, and distribution deviation constraint index, and assign the candidate synthetic anomalous fragment to the training layer, challenge layer, or rejection layer based on the coverage gain score, boundary confusion score, and distribution deviation constraint index;

[0010] Based on the phased performance indicators on the real validation set, construct conditional admission decision variables, and import candidate synthetic anomalous fragments from the training layer into the training process in batches when the conditional admission decision variables meet the admission conditions.

[0011] The updated candidate model is jointly evaluated using the real validation set and challenge set. When the joint evaluation metric meets the stability condition, the stable model snapshot is updated. When the joint evaluation metric does not meet the stability condition, the parameters of the most recent admission batch are rolled back.

[0012] Adjust the admission priority, admission weight, or hierarchical destination of the next round of candidate synthetic anomalous fragments based on the statistical results of failure types in the challenge set.

[0013] Optionally, the coverage gain score satisfies the following formula:

[0014]

[0015] in, Indicates candidate synthetic anomalous fragments Coverage gain score; Indicates candidate synthetic anomalous fragments The embedding vector; Indicates the anomaly category to which the candidate synthetic anomalous fragment belongs. The prototype center; Indicates the exception category The actual number of samples; g( ) indicates the target time window The corresponding coverage gap function value; , and These are positive weighting coefficients.

[0016] Optionally, the boundary confusion score satisfies the following formula:

[0017]

[0018] in, Indicates candidate synthetic anomalous fragments Boundary confusion score; Indicates candidate synthetic anomalous fragments Anomaly score margin in the current anomaly detection model; Indicates candidate synthetic anomalous fragments The absolute value of the embedding distance difference with adjacent normal and abnormal segments; It is the smoothing coefficient, and >0; This represents the normalized result of the historical false detection frequency in the failed bucket to which the candidate synthesized anomalous fragment belongs; , and These are positive weighting coefficients.

[0019] Optionally, the distribution deviation constraint index satisfies the following formula:

[0020]

[0021] in, Indicates candidate synthetic anomalous fragments The distribution deviation constraint index; Represents the embedding distribution of the candidate synthetic anomalous fragment set; Represents the embedding distribution of a set of real abnormal fragments; Indicates candidate synthetic anomalous fragments Local statistical distribution; Indicates the true anomaly category to which the candidate synthetic anomaly fragment belongs. Local statistical distribution; and These are positive weighting coefficients; Indicates the maximum mean difference; This represents the KL divergence.

[0022] Optionally, candidate synthetic anomalous fragments are assigned to training layers, challenge layers, or rejection layers based on the coverage gain score, the boundary confusion score, and the distribution deviation constraint index, including:

[0023] If the coverage gain score is higher than the preset coverage gain score threshold, the boundary confusion score is higher than the preset boundary confusion score threshold, and the distribution deviation constraint index does not exceed the preset distribution deviation constraint index threshold, the candidate synthetic anomalous fragment will be written into the training layer.

[0024] If the coverage gain score is higher than the preset coverage gain score threshold, or the boundary confusion score is higher than the preset boundary confusion score threshold, or the distribution deviation constraint index exceeds the preset distribution deviation constraint index threshold, the candidate synthetic anomalous fragment will be written into the challenge layer.

[0025] If the coverage gain score is lower than the preset coverage gain score threshold and the boundary confusion score is lower than the preset boundary confusion score threshold, the candidate synthetic anomalous fragments will be written into the rejection layer.

[0026] Optionally, the admission decision variables satisfy the following formula:

[0027]

[0028] in, It is an indicator function; Represents the basic F1 score on the real validation set; This represents the recall rate of long-tail anomalies on the real validation set; Indicates the false alarm rate; This represents the performance difference between the current candidate model and the previous stable model snapshot; to This is a preset threshold.

[0029] Optionally, the joint evaluation index satisfies the following formula:

[0030]

[0031] in, Represents the F1 score of the true validation set. This represents the recall rate of long-tail anomalies on the real validation set. This indicates a challenge to recall rate. Indicates the false alarm rate of the challenge set. to These are positive weighting coefficients.

[0032] Secondly, this application provides a training and management apparatus for a long-tailed temporal anomaly detection model, comprising:

[0033] The candidate synthetic anomalous fragment construction module is used to construct a set of candidate synthetic anomalous fragments based on real long-tailed anomalous fragments, difficult fragments that were misdetected or missed in the model's history, and preset temporal perturbation generation rules.

[0034] The dual scoring and splitting module is used to calculate the coverage gain score, boundary confusion score, and distribution deviation constraint index for each candidate synthetic anomalous fragment, and to assign the candidate synthetic anomalous fragment to the training layer, challenge layer, or rejection layer based on the coverage gain score, boundary confusion score, and distribution deviation constraint index.

[0035] The conditional admission module is used to construct conditional admission decision variables based on the phased performance indicators on the real validation set. When the conditional admission decision variables meet the admission conditions, candidate synthetic anomalous fragments in the training layer are imported into the training process in batches.

[0036] The joint evaluation and batch rollback module is used to jointly evaluate the updated candidate model using the real validation set and challenge set, update the stable model snapshot when the joint evaluation index meets the stability condition, and perform parameter rollback of the most recent admission batch when the joint evaluation index does not meet the stability condition.

[0037] The closed-loop maintenance module is used to adjust the admission priority, admission weight, or hierarchical destination of the next round of candidate synthesis of abnormal fragments based on the statistical results of failure types in the challenge set.

[0038] Thirdly, this application provides a training and governance device for a long-tailed temporal anomaly detection model, comprising:

[0039] Memory;

[0040] processor;

[0041] The memory stores computer-executed instructions;

[0042] The processor executes computer execution instructions stored in the memory to implement the training governance method for long-tailed temporal anomaly detection models as described in the first aspect and various possible implementations of the first aspect above.

[0043] Fourthly, this application provides a computer storage medium storing a computer program thereon, the computer program being executed by a processor to implement the training and management method for a long-tailed time-series anomaly detection model as described in the first aspect and various possible implementations of the first aspect above.

[0044] Compared with the prior art, the present invention has at least the following beneficial effects:

[0045] 1. Instead of directly incorporating all synthetic anomalous fragments into the training set, this invention first evaluates the technical value and risk of candidate synthetic anomalous fragments by combining coverage gain score, boundary confusion score, and distribution deviation constraint index, and then decides whether to train, challenge, or reject them, thereby reducing the risk of erroneous admission.

[0046] 2. This invention controls the timing of sample import by using conditional admission decision variables, so that high-value but high-risk candidate synthetic anomalous fragments will not enter the training process prematurely before the model is stable, thereby improving training stability and reducing performance oscillations.

[0047] 3. This invention evaluates candidate models jointly using real validation sets and challenge sets, and combines this with a parameter update rollback mechanism for the most recent admission batch, so that model performance degradation caused by erroneous admission can be identified and reversed in a timely manner, thereby improving the controllability and traceability of training governance.

[0048] 4. This invention forms a continuous closed-loop optimization mechanism for long-tailed difficult samples and boundary difficult samples by statistically analyzing the failure types of the challenge set and adjusting the admission priority of the next round in reverse, which helps to improve the recall rate of long-tailed anomalies and the robustness of boundary difficult samples.

[0049] 5. Under the condition of verification on a preferred public dataset, the present invention, compared with the scheme of directly mixing candidate synthetic anomalous fragments into the training set, can maintain or improve the overall performance on the real test set while reducing the risk of false positive expansion caused by unconstrained admission, thus making it more suitable as a training governance scheme for long-tailed temporal anomaly detection models. Attached Figure Description

[0050] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0051] Figure 1 A flowchart illustrating the training and governance method for a long-tailed temporal anomaly detection model provided in this application embodiment;

[0052] Figure 2 A schematic diagram of the structure of the training and management device for a long-tailed temporal anomaly detection model provided in an embodiment of this application;

[0053] Figure 3 This is a schematic diagram of the structure of a training and management device for a long-tailed temporal anomaly detection model provided in an embodiment of this application.

[0054] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0055] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0056] The terms "first," "second," "third," "fourth," etc. (if present) in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein.

[0057] In this application, the terms "exemplary" or "for example" are used to indicate examples, illustrations, or descriptions. Any embodiment or design described as "exemplary" or "for example" in this application should not be construed as being more preferred or advantageous than other embodiments or designs. Specifically, the use of terms such as "exemplary" or "for example" is intended to present the relevant concepts in a specific manner.

[0058] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.

[0059] This application provides a training governance method for long-tail temporal anomaly detection models, deployed in a model training governance platform. This platform includes a real sample library, a candidate synthetic anomaly fragment library, a challenge set library, a stable model snapshot library, and a model training execution module. The real sample library includes at least normal fragments, labeled common anomaly fragments, and labeled long-tail anomaly fragments; the challenge set library stores candidate synthetic anomaly fragments that are not yet allowed to be included in training but have evaluation value; and the stable model snapshot library stores snapshots of stable model parameters confirmed through joint evaluation.

[0060] Figure 1 This is a flowchart illustrating the training and governance method for a long-tailed temporal anomaly detection model provided in an embodiment of this application. Figure 1 As shown in this embodiment, the training governance method for long-tailed temporal anomaly detection models includes:

[0061] S1: Construct a candidate set of synthetic anomaly segments based on real long-tailed anomaly segments, historical false positives or false negatives of the model, and preset temporal perturbation generation rules.

[0062] The preset time-series perturbation generation rules may include amplitude amplification or reduction, local trend reversal, duration stretching or compression, periodic phase shift, cross-variable coupling perturbation, context noise injection, and multi-event splicing.

[0063] When constructing the candidate synthetic anomaly fragment set, firstly, labeled anomaly fragments with a sample size below a preset long-tail threshold are extracted from the real sample library as real long-tail anomaly fragments. Then, based on the previous stable model snapshot or the historical inference records of the current candidate model, normal fragments that were misjudged as anomalies, anomaly fragments that were missed, low-confidence fragments with anomaly scores within a preset boundary range, and fragments that were manually verified as difficult samples are extracted as historical misjudged or missed difficult fragments of the model. Subsequently, time window alignment, sampling frequency alignment, variable dimension alignment, and label alignment are performed on the above fragments to obtain standardized source fragments. For each standardized source fragment, the source fragment identifier, source type, anomaly category, original time window position, and variable channel information are recorded.

[0064] For standardized source fragments, different preset temporal perturbation generation rules are invoked according to the source type: For real long-tailed anomaly fragments, amplitude scaling, duration stretching or compression, local trend shifting, periodic phase shifting, local noise injection, or multi-event splicing are prioritized to expand the coverage of the same long-tailed anomaly category in terms of amplitude, duration, trend pattern, and context position; For difficult fragments that have been falsely detected or missed by the model in the past, slight amplitude perturbation, normal context mixing, cross-variable coupling perturbation, local missing perturbation, or boundary transition segment splicing are prioritized to generate difficult candidate fragments close to the current model's discrimination boundary. Each generated candidate synthetic anomaly fragment retains the perturbation type, perturbation intensity, target anomaly category, time window position, and generation batch number; it is only written into the candidate synthetic anomaly fragment set and enters the subsequent scoring stage if it meets the preset minimum duration, signal identifiability, variable correlation preservation, and perturbation intensity boundary conditions.

[0065] In one specific embodiment, the time window length is set to 96 sampling points; the amplitude scaling factor is set between 0.7 and 1.35; the duration stretching or compression factor is set between 0.75 and 1.30; the local trend offset is set between -1.2 and 1.2; the local noise standard deviation is set to 0.18; the noise injection width is set to 1 / 10 to 1 / 4 of the time window length; and the phase shift of multi-event splicing is set to 4 to 18 sampling points. For long-tailed anomaly categories, their candidate generation factor can be set to 2 to 6 times that of common anomaly categories; for historically difficult negative samples, high-risk candidate segments can be extracted and constructed from a preset number of normal segments with the highest anomaly scores.

[0066] During the generation process, each candidate synthetic anomalous fragment retains its mapping relationship with the original real fragment, its anomalous type, perturbation type, and its position in the time window, so as to facilitate subsequent hierarchical admission, failure tracking, and challenge set maintenance.

[0067] In one optional implementation, the time window length of the candidate synthetic anomalous segment is the same as or within a preset multiple of the time window length of the real anomalous segment; only when the candidate synthetic anomalous segment simultaneously meets the preset minimum duration condition and the signal identifiability condition can it proceed to the subsequent scoring stage.

[0068] S2: For each candidate synthetic anomalous fragment, calculate the coverage gain score, boundary confusion score, and distribution deviation constraint index, and assign the candidate synthetic anomalous fragment to the training layer, challenge layer, or rejection layer based on the coverage gain score, boundary confusion score, and distribution deviation constraint index.

[0069] In this embodiment, the coverage gain score is used to characterize the ability of candidate synthesized anomalous fragments to fill in the sparse regions of real long-tailed anomalous regions. The coverage gain score satisfies the following formula:

[0070]

[0071] in, Indicates candidate synthetic anomalous fragments Coverage gain score; Indicates candidate synthetic anomalous fragments The embedding vector; Indicates the anomaly category to which the candidate synthetic anomalous fragment belongs. The prototype center; Indicates the exception category The actual number of samples; g( ) indicates the target time window The corresponding coverage gap function value; , and , where is a positive weighting coefficient. The first term in the above formula is used to characterize the similarity between the candidate synthetic anomalous fragment and the corresponding long-tailed anomalous prototype, the second term is used to increase the priority of rare categories, and the third term is used to improve the ability to fill in the coverage gap region.

[0072] Furthermore, the boundary confusion score is used to characterize the difficulty of a candidate synthetic anomalous fragment being located near the current model decision boundary, and the boundary confusion score satisfies the following formula:

[0073]

[0074] in, Indicates candidate synthetic anomalous fragments Boundary confusion score; Indicates candidate synthetic anomalous fragments Anomaly score margin in the current anomaly detection model; Indicates candidate synthetic anomalous fragments The absolute value of the embedding distance difference with adjacent normal and abnormal segments; It is the smoothing coefficient, and >0; This represents the normalized result of the historical false detection frequency in the failed bucket to which the candidate synthesized anomalous fragment belongs; , and This is a positive weighting coefficient. A higher boundary confusion score indicates that the candidate synthetic anomalous fragment is closer to the current model's discrimination boundary and is more likely to come from a historically difficult region that has frequently been misdetected.

[0075] This embodiment also calculates the distribution deviation constraint index. The deviation between candidate synthesized anomalous fragments and the true anomalous distribution can be characterized as follows:

[0076]

[0077] in, Indicates candidate synthetic anomalous fragments The distribution deviation constraint index; Represents the embedding distribution of the candidate synthetic anomalous fragment set; Represents the embedding distribution of a set of real abnormal fragments; Indicates candidate synthetic anomalous fragments Local statistical distribution; Indicates the true anomaly category to which the candidate synthesized anomaly fragment belongs. Local statistical distribution; and These are positive weighting coefficients; Indicates the maximum mean difference; This represents the KL divergence. If... Exceeding the preset threshold If the candidate synthetic anomalous fragment deviates too much from the true anomalous distribution, it poses a risk of contaminating the training process, and therefore it is prohibited from directly entering the training layer.

[0078] In this embodiment, candidate synthetic anomalous fragments are assigned to the training layer, challenge layer, or rejection layer based on coverage gain score, boundary confusion score, and distribution deviation constraint index. This includes: writing the candidate synthetic anomalous fragment to the training layer when the coverage gain score is higher than a preset coverage gain score threshold, the boundary confusion score is higher than a preset boundary confusion score threshold, and the distribution deviation constraint index does not exceed a preset distribution deviation constraint index threshold; writing the candidate synthetic anomalous fragment to the challenge layer when the coverage gain score is higher than a preset coverage gain score threshold or the boundary confusion score is higher than a preset boundary confusion score threshold, but the distribution deviation constraint index exceeds a preset distribution deviation constraint index threshold or the model does not yet meet the admission criteria at the current stage; and writing the candidate synthetic anomalous fragment to the rejection layer when the coverage gain score is lower than a preset coverage gain score threshold and the boundary confusion score is lower than a preset boundary confusion score threshold, or when multiple rounds of challenge results indicate that it has no effective value.

[0079] The training layer refers to the set of candidate segments that are allowed to enter the model training process in batches after meeting the conditional admission decision variables. These candidate segments have high coverage value, high boundary training value, and controllable risk of distribution deviation. The challenge layer refers to the set of candidate segments that do not directly participate in parameter training but are reserved for robustness evaluation and failure type statistics. These candidate segments usually have coverage value or boundary value, but the distribution deviation is high, the model is not stable at the current stage, or it may cause the risk of false positive expansion. The rejection layer refers to the set of candidate segments that do not participate in training and are not used as regular challenge samples. These candidate segments usually have low coverage value and boundary value, or deviate too much from the true abnormal distribution.

[0080] After candidate synthetic anomalous fragments are written into the challenge layer, their source fragment identifier, perturbation type, anomaly category, distribution deviation value, and most recent model prediction result are retained. After each round of model updates, the challenge layer fragments are independently evaluated using the discrimination threshold corresponding to the real validation set. The evaluation results are statistically categorized into buckets based on anomaly category, perturbation type, time window length, and boundary difficulty level. If the failure rate of a bucket containing a challenge layer fragment exceeds a preset failure rate threshold in subsequent rounds, the admission priority or boundary confusion weight of the candidate fragment corresponding to that bucket is increased. If it meets the training layer admission criteria after re-evaluation, it can be migrated from the challenge layer to the training layer candidate queue. If it causes an increase in the challenge set false positive rate or a decrease in the joint evaluation metric for multiple consecutive rounds, the admission weight is reduced or it is moved to the rejection layer.

[0081] After candidate synthetic anomalous fragments are written into the rejection layer, they are not imported into the training process, nor are they used as samples in the regular challenge set for calculating joint evaluation metrics. Only their source, perturbation rules, rejection reasons, and rejection rounds are retained for subsequent auditing and generation rule correction. When the perturbation rules, ground truth labels, or stable model snapshots are updated, the rejection layer fragments can be re-scored. If, after re-scoring, their distribution deviation constraint index drops below a preset threshold and their coverage gain score or boundary confusion score meets the admission criteria, they are allowed to re-enter the candidate synthetic anomalous fragment set; otherwise, they remain isolated or are cleaned up according to a preset retention period.

[0082] S3: Construct conditional admission decision variables based on the phased performance indicators on the real validation set, and import candidate synthetic anomalous fragments from the training layer into the training process in batches when the conditional admission decision variables meet the admission conditions.

[0083] This embodiment does not immediately introduce candidate synthetic anomalous fragments from the training layer at the beginning of training. Instead, it determines whether the conditional admission threshold is met based on the phased performance indicators on the real validation set. Admission decision variables Satisfy the following formula:

[0084]

[0085] in, It is an indicator function; Represents the basic F1 score on the real validation set; This represents the recall rate of long-tail anomalies on the real validation set; Indicates the false alarm rate; This represents the performance difference between the current candidate model and the previous stable model snapshot; to This is a preset threshold. Only when... A new batch of synthetic anomalous fragments will only be allowed entry if the number of fragments is not less than 2.

[0086] When the conditional admission threshold is met, the normalized coverage gain score, boundary confusion score, and distribution deviation constraint index are first calculated for each candidate synthetic anomalous segment in the training layer, and then the comprehensive admission score is used to determine the final score. Sort in descending order; where, Indicates coverage gain score. Indicates boundary confusion score, This represents the distribution deviation constraint index. Candidate fragments with a distribution deviation constraint index no higher than the 78th percentile of the same batch and a comprehensive admission score in the top 30% are prioritized to form the current admission batch. If the distribution deviation constraint index is higher than the 90th percentile, it is directly classified into the rejection layer. If the distribution deviation constraint index is higher than the 78th percentile but not higher than the 90th percentile, and the boundary confusion score is greater than 0.7, it is classified into the challenge layer.

[0087] In one specific embodiment, each admission batch contains 24 candidate synthetic anomalous fragments; for datasets with smaller sample sizes, each admission batch can be set to 20 candidate synthetic anomalous fragments. After each round of admission, the real validation set and challenge set metrics are recalculated, and the comprehensive admission score of the remaining candidate fragments is updated with weights based on the challenge failure binning results.

[0088] This phased conditional admission approach can prevent the model from being prematurely affected by highly complex synthetic samples before the basic abnormal patterns have been stably learned.

[0089] S4: Jointly evaluate the updated candidate model using the real validation set and challenge set. Update the stable model snapshot when the joint evaluation metric meets the stability condition, and perform parameter rollback of the most recent admission batch when the joint evaluation metric does not meet the stability condition.

[0090] After each training round, this embodiment uses a real validation set and a challenge set to jointly evaluate the updated candidate model. The real validation set is used to evaluate the model's basic performance on real data distributions, while the challenge set is used to evaluate the model's robustness on long-tailed and boundary-hard segments. The joint evaluation metrics include at least: F1 score, long-tailed anomaly recall, and false positive rate on the real validation set, and long-tailed anomaly recall, false positive rate on boundary-hard samples, and cross-perturbation type consistency metric on the challenge set.

[0091] Joint evaluation indicators Satisfy the following formula:

[0092]

[0093] in, Represents the F1 score of the true validation set. This represents the recall rate of long-tail anomalies on the real validation set. This indicates a challenge to recall rate. Indicates the false alarm rate of the challenge set. to These are positive weighting coefficients.

[0094] If the joint evaluation metric of a candidate model meets the stability threshold, it is written into the stable model snapshot library to form a new stable model snapshot. If the candidate model shows a decline in real validation set performance or challenge set robustness exceeding a preset magnitude compared to the previous stable model snapshot, the parameter update corresponding to the most recent admission batch is revoked, and the model is restored to the previous stable model snapshot, thus completing the batch rollback.

[0095] The stability threshold may include at least one of a joint evaluation metric decline threshold, a false positive rate threshold for the true validation set, and a false positive rate threshold for the challenge set. In one specific embodiment, the joint evaluation metric... according to Calculate; when If the joint evaluation metric corresponding to the previous stable model snapshot is not lower than 0.005, and the false positive rate on the true validation set is not higher than 0.32 and the false positive rate on the challenge set is not higher than 0.32, then the candidate model is determined to meet the stability threshold and the stable model snapshot is updated. If the joint evaluation index corresponding to the previous stable model snapshot is reduced by 0.005, or if either the false positive rate of the real validation set or the false positive rate of the challenge set exceeds 0.32, then the admission batch is determined to have failed the stability condition. The parameter update corresponding to the most recent admission batch is revoked, and the candidate fragments of that batch are transferred to the challenge layer or their subsequent admission weights are reduced.

[0096] S5: Adjust the admission priority, admission weight, or hierarchical destination of the next round of candidate synthetic abnormal fragments based on the statistical results of failure types in the challenge set.

[0097] Specifically, the system is divided into buckets according to anomaly category, disturbance type, time window length, and boundary difficulty level. Buckets with failure rates higher than a preset threshold will have their corresponding candidate synthetic anomaly fragments given higher priority in the next round of admission. For buckets that cause a decrease in the robustness of the challenge set in multiple consecutive rounds, the admission weight of the corresponding candidate synthetic anomaly fragments will be reduced or they will be transferred to the rejection layer.

[0098] This step adjusts the admission priority, admission weight, or hierarchical destination of candidate synthetic abnormal fragments in the next round based on the statistical results of failure types in the challenge set, so as to form a closed-loop maintenance process of scoring, diversion, admission, evaluation, rollback, and re-admission.

[0099] In a preferred validation method, publicly available time-series anomaly detection datasets such as SMD, SMAP / MSL, Yahoo, NAB, or SWAT can be used. Specifically, the data can be divided into training, validation, and test sets according to device, channel, or time period. The validation set preferably consists of real segments and does not include candidate synthetic anomaly segments, so as to evaluate whether the admission of candidate synthetic anomaly segments leads to performance degradation of the model on the real distribution. Anomaly categories with anomaly sample proportions below a preset threshold can be labeled as long-tail anomaly categories.

[0100] In one optional implementation, the temporal anomaly detection model can employ a unified temporal encoder and anomaly scoring head structure, such as using a convolutional encoder, a recurrent neural network encoder, a Transformer encoder, or a combination thereof to extract segment embeddings, and then the anomaly scoring head outputs segment-level anomaly scores; the candidate segment governance process of the present invention can be implemented as an external or internal training governance module of the anomaly detection model.

[0101] During the verification process, at least three comparison schemes can be set up as follows: Comparison group A uses only real samples for model training; comparison group B directly incorporates the generated candidate synthetic anomalous fragments into the training set without hierarchical governance; experimental group C adopts the coverage gain scoring, boundary confusion scoring, distribution deviation constraint, conditional admission, challenge set retention, and batch rollback closed-loop maintenance process of this invention. Through the above comparisons, the differences in technical effects of this invention compared to the "no synthetic fragment scheme" and the "scheme of directly introducing synthetic fragments without governance" can be more clearly distinguished.

[0102] During the candidate fragment construction phase, candidate synthetic anomaly fragments can be generated based on real long-tailed anomaly fragments and historically difficult-to-detect or false-detection fragments. The generation methods can include at least amplitude scaling, duration stretching or compression, local trend reversal, periodic phase shifting, cross-variable coupled perturbation, contextual noise injection, and multi-event splicing. Each candidate synthetic anomaly fragment preferably retains the source fragment identifier, perturbation type, target category, time window position, and batch number to support subsequent execution splitting, failure tracking, and parameter rollback.

[0103] During the training and governance phase, the following process can be executed according to rounds or preset iteration cycles: first train the base model; then calculate the coverage gain score for candidate synthetic anomalous fragments. Boundary confusion score and distribution deviation constraint index Subsequently, candidate segments are imported into the training layer, challenge layer, or rejection layer according to the admission criteria. After each round of training, a joint evaluation is performed based on the real validation set and the challenge set. If the joint evaluation result is worse than the previous stable model snapshot by more than a preset threshold, the parameter update corresponding to the most recent admission batch is revoked.

[0104] Preferably, the validation metrics include at least the F1 score, long-tail anomaly recall rate, and false positive rate on the real validation set, and the recall rate, false positive rate, success rate of identifying boundary-difficult segments, and number of backoff triggers on the challenge set. In a further embodiment, the number of incorrect admission batches, the number of consecutive backoffs, the proportion of challenge failure bins, and the final admission rate of various candidate segments can also be recorded to evaluate the technical effectiveness of the invention in terms of training stability, risk constraint capability, and closed-loop maintenance capability.

[0105] If experimental group C can improve the recall rate of long-tailed anomalies compared to control group A, and can reduce the performance degradation of the real validation set and reduce the increase in false positive rate or the number of backoffs caused by incorrect admissions compared to control group B, then it can be said that the present invention can not only improve the problem of insufficient coverage of long-tailed anomalies, but also suppress the risk of model pollution caused by the unconstrained introduction of synthetic anomaly fragments.

[0106] Table 1. Comparison of experimental results using the SKAB dataset.

[0107]

[0108] Note: "Admission / Retention / Retrogression" represent the final number of admitted candidate fragments, the number of candidate fragments retained in the challenge or rejection layer, and the number of batch rollbacks, respectively; "-" indicates that this item was not counted or is not applicable.

[0109] In a specific experiment, the SKAB industrial multivariate time-series anomaly dataset was used for validation. This dataset includes valve anomalies, other equipment anomalies, and normal operation segments. The valve2 anomaly type, with a smaller sample size, can be used as the long-tail anomaly category. In this experiment, a total of 1228 real sample windows were used during the training phase, including 505 positive samples and 723 negative samples. The real positive sample windows corresponding to the long-tail anomaly category valve2 were 45. In the candidate synthetic anomaly segment construction phase, perturbations such as amplitude scaling, time stretching, trend shifting, local noise injection, and multi-event mixing were applied to the real anomaly segments. Combined with high-risk candidate segments derived from historical difficult negative samples, a total of 1888 candidate synthetic anomaly segments were constructed. Under the same basic model structure, the control group A, control group B, and experimental group C were tested. The main results are shown in Table 1. As can be seen from Table 1, experimental group C outperformed control group A and control group B in terms of F1 score and false alarm rate on the real test set, indicating that the present invention can reduce the false alarm expansion caused by the direct admission of high-risk candidate segments while maintaining the ability to identify long-tail difficult samples.

[0110] In another public dataset validation method, a subset of real anomalies from the NAB time-series anomaly dataset can be used for supplementary validation. This supplementary validation selects three classes of real anomaly sequences: realKnownCause, realTraffic, and realAdExchange, with the relatively small sample size of the realAdExchange class considered a long-tail anomaly class. Simultaneously, normal sequences from artificialNoAnomaly are used as additional negative sample sources. In this supplementary validation, the real positive sample window during the training phase includes 10 realKnownCause classes, 8 realTraffic classes, and 6 realAdExchange classes. Furthermore, by performing transformations such as amplitude perturbation, time shifting, trend shifting, and local noise injection on the real anomaly window, and combining this with high-risk candidate segments derived from difficult negative samples, a total of 294 candidate synthetic anomaly segments are constructed.

[0111] Table 2 Supplementary Experimental Results for the NAB Dataset

[0112]

[0113] Note: "Admission / Retention / Retrogression" represent the final number of admitted candidate fragments, the number of candidate fragments retained in the challenge or rejection layer, and the number of batch rollbacks, respectively; "-" indicates that this item was not counted or is not applicable.

[0114] Under the same basic model structure, tests were conducted on control group A, control group B, and experimental group C. The main results are shown in Table 2. As can be seen from Table 2, under the supplementary validation condition of the NAB dataset, the F1 score of the experimental group C on the real test set is higher than that of control group A and control group B, and the false alarm rate is significantly lower than that of control group A. This indicates that the conditional admission and batch rollback mechanism of the present invention can still suppress detection boundary instability and maintain better overall performance in cross-dataset scenarios.

[0115] In another optional verification method, the present invention can also be deployed in real business log time series, cloud service monitoring indicator time series, or device status monitoring time series scenarios. In this scenario, historical alarm logs, fault work order backtracking segments, or false detection segments confirmed after manual review can be used as sources of difficult segments, and offline training and verification can be performed using the same candidate segment governance process as in Embodiment 3. When the business side cannot immediately provide a large-scale real long-tail anomaly sample, a candidate synthetic anomaly segment set can still be constructed using a small number of known real anomaly segments, difficult segments, and preset perturbation rules, thereby verifying the transferability of the present invention in actual engineering data scenarios.

[0116] Figure 2 This is a schematic diagram of the structure of a training and management device for a long-tailed temporal anomaly detection model provided in an embodiment of this application. Figure 2As shown, the training and management device 200 for a long-tailed temporal anomaly detection model provided in this embodiment includes:

[0117] The candidate synthetic anomalous fragment construction module 201 is used to construct a set of candidate synthetic anomalous fragments based on real long-tailed anomalous fragments, difficult fragments that were falsely detected or missed in the model's history, and preset temporal perturbation generation rules.

[0118] The dual scoring and splitting module 202 is used to calculate the coverage gain score, boundary confusion score and distribution deviation constraint index for each candidate synthetic anomalous segment, and to assign the candidate synthetic anomalous segment to the training layer, challenge layer or rejection layer according to the coverage gain score, boundary confusion score and distribution deviation constraint index.

[0119] Conditional admission module 203 is used to construct conditional admission decision variables based on the phased performance indicators on the real validation set, and to import candidate synthetic anomalous fragments from the training layer into the training process in batches when the conditional admission decision variables meet the admission conditions.

[0120] The joint evaluation and batch rollback module 204 is used to jointly evaluate the updated candidate model using the real validation set and challenge set, update the stable model snapshot when the joint evaluation index meets the stability condition, and perform parameter rollback of the most recent admission batch when the joint evaluation index does not meet the stability condition.

[0121] The closed-loop maintenance module 205 is used to adjust the admission priority, admission weight, or hierarchical destination of the next round of candidate synthesis abnormal fragments based on the statistical results of failure types in the challenge set.

[0122] The training and management device for the long-tailed temporal anomaly detection model provided in this embodiment can execute the training and management method for the long-tailed temporal anomaly detection model provided in the above method embodiment. Its implementation principle and technical effect are similar, and will not be described in detail here.

[0123] Figure 3 This is a schematic diagram of the structure of a training and management device for a long-tailed temporal anomaly detection model provided in an embodiment of this application. Figure 3 As shown in the embodiment of this application, the training and management device for a long-tailed time series anomaly detection model includes a receiver 301, a transmitter 302, a processor 303, and a memory 304.

[0124] Receiver 301 is used to receive instructions and data;

[0125] Transmitter 302 is used to send commands and data;

[0126] Memory 304 is used to store computer-executed instructions;

[0127] Processor 303 is used to execute computer execution instructions stored in memory 304 to implement the various steps of the training and management method for the long-tailed temporal anomaly detection model in the above embodiments. For details, please refer to the relevant descriptions in the foregoing embodiments of the training and management method for the long-tailed temporal anomaly detection model.

[0128] Optionally, the memory 304 can be either standalone or integrated with the processor 303.

[0129] When the memory 304 is set up independently, the electronic device also includes a bus for connecting the memory 304 and the processor 303.

[0130] This application embodiment also provides a computer storage medium storing computer execution instructions. When the processor executes the computer execution instructions, it implements the training and management method for the long-tailed temporal anomaly detection model executed by the training and management device for the long-tailed temporal anomaly detection model described above.

[0131] It will be understood by those skilled in the art that all or some of the steps, systems, or apparatuses disclosed above, and their functional modules / units, can be implemented as software, firmware, hardware, or suitable combinations thereof. In hardware implementations, the division between functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed collaboratively by several physical components. Some or all physical components may be implemented as software executed by a processor, such as a central processing unit, digital signal processor, or microprocessor, or as hardware, or as an integrated circuit, such as an application-specific integrated circuit (ASIC). Such software may be distributed on a computer-readable medium, which may include computer storage media (or non-transitory media) and communication media (or transient media). As is known to those skilled in the art, the term computer storage media includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disc (DVD) or other optical disc storage, magnetic cartridges, magnetic tape, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and can be accessed by a computer. Furthermore, it is well known to those skilled in the art that communication media typically contain computer-readable instructions, data structures, program modules, or other data in modulated data signals such as carrier waves or other transmission mechanisms, and may include any information delivery medium.

[0132] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this application are indicated by the following claims.

[0133] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is limited only by the appended claims.

Claims

1. A training management method for a long-tail timing anomaly detection model, characterized in that, The method includes: A candidate set of synthetic anomalies is constructed based on real long-tailed anomaly fragments, difficult fragments that were misdetected or missed in the model's history, and preset temporal perturbation generation rules. For each candidate synthetic anomalous fragment, calculate the coverage gain score, boundary confusion score, and distribution deviation constraint index, and assign the candidate synthetic anomalous fragment to the training layer, challenge layer, or rejection layer based on the coverage gain score, boundary confusion score, and distribution deviation constraint index; Based on the phased performance indicators on the real validation set, construct conditional admission decision variables, and import candidate synthetic anomalous fragments from the training layer into the training process in batches when the conditional admission decision variables meet the admission conditions. The updated candidate model is jointly evaluated using the real validation set and challenge set. When the joint evaluation metric meets the stability condition, the stable model snapshot is updated. When the joint evaluation metric does not meet the stability condition, the parameters of the most recent admission batch are rolled back. Adjust the admission priority, admission weight, or hierarchical destination of the next round of candidate synthetic anomalous fragments based on the statistical results of failure types in the challenge set.

2. The method of claim 1, wherein, The coverage gain score satisfies the following formula: in, Indicates candidate synthetic anomalous fragments Coverage gain score; Indicates candidate synthetic anomalous fragments The embedding vector; Indicates the anomaly category to which the candidate synthetic anomalous fragment belongs. The prototype center; Indicates the exception category The actual number of samples; g( ) indicates the target time window The corresponding coverage gap function value; , and These are positive weighting coefficients.

3. The method according to claim 1, characterized in that, The boundary confusion score satisfies the following formula: in, Indicates candidate synthetic anomalous fragments Boundary confusion score; Indicates candidate synthetic anomalous fragments Anomaly score margin in the current anomaly detection model; Indicates candidate synthetic anomalous fragments The absolute value of the embedding distance difference with adjacent normal and abnormal segments; It is the smoothing coefficient, and >0; This represents the normalized result of the historical false detection frequency in the failed bucket to which the candidate synthesized anomalous fragment belongs; , and These are positive weighting coefficients.

4. The method according to claim 1, characterized in that, The distribution deviation constraint index satisfies the following formula: in, Indicates candidate synthetic anomalous fragments The distribution deviation constraint index; Represents the embedding distribution of the candidate synthetic anomalous fragment set; Represents the embedding distribution of a set of real abnormal fragments; Indicates candidate synthetic anomalous fragments Local statistical distribution; Indicates the true anomaly category to which the candidate synthetic anomaly fragment belongs. Local statistical distribution; and These are positive weighting coefficients; Indicates the maximum mean difference; This represents the KL divergence.

5. The method according to claim 1, characterized in that, Candidate synthetic anomalous fragments are assigned to training layers, challenge layers, or rejection layers based on the coverage gain score, the boundary confusion score, and the distribution deviation constraint index, including: If the coverage gain score is higher than the preset coverage gain score threshold, the boundary confusion score is higher than the preset boundary confusion score threshold, and the distribution deviation constraint index does not exceed the preset distribution deviation constraint index threshold, the candidate synthetic anomalous fragment will be written into the training layer. If the coverage gain score is higher than the preset coverage gain score threshold, or the boundary confusion score is higher than the preset boundary confusion score threshold, or the distribution deviation constraint index exceeds the preset distribution deviation constraint index threshold, the candidate synthetic anomalous fragment will be written into the challenge layer. If the coverage gain score is lower than the preset coverage gain score threshold and the boundary confusion score is lower than the preset boundary confusion score threshold, the candidate synthetic anomalous fragment will be written into the rejection layer.

6. The method according to claim 1, characterized in that, The admission decision variables satisfy the following formula: in, It is an indicator function; Represents the basic F1 score on the real validation set; This represents the recall rate of long-tail anomalies on the real validation set; Indicates the false alarm rate; This represents the performance difference between the current candidate model and the previous stable model snapshot; to This is a preset threshold.

7. The method according to claim 1, characterized in that, The joint evaluation index satisfies the following formula: in, Represents the F1 score of the true validation set. This represents the recall rate of long-tail anomalies on the real validation set. This indicates a challenge to recall rate. Indicates the false alarm rate of the challenge set. to These are positive weighting coefficients.

8. A training and management device for a long-tailed temporal anomaly detection model, characterized in that, The device includes: The candidate synthetic anomalous fragment construction module is used to construct a set of candidate synthetic anomalous fragments based on real long-tailed anomalous fragments, difficult fragments that were misdetected or missed in the model's history, and preset temporal perturbation generation rules. The dual scoring and splitting module is used to calculate the coverage gain score, boundary confusion score, and distribution deviation constraint index for each candidate synthetic anomalous fragment, and to assign the candidate synthetic anomalous fragment to the training layer, challenge layer, or rejection layer based on the coverage gain score, boundary confusion score, and distribution deviation constraint index. The conditional admission module is used to construct conditional admission decision variables based on the phased performance indicators on the real validation set. When the conditional admission decision variables meet the admission conditions, candidate synthetic anomalous fragments in the training layer are imported into the training process in batches. The joint evaluation and batch rollback module is used to jointly evaluate the updated candidate model using the real validation set and challenge set, update the stable model snapshot when the joint evaluation index meets the stability condition, and perform parameter rollback of the most recent admission batch when the joint evaluation index does not meet the stability condition. The closed-loop maintenance module is used to adjust the admission priority, admission weight, or hierarchical destination of the next round of candidate synthesis of abnormal fragments based on the statistical results of failure types in the challenge set.

9. A training and management device for a long-tailed temporal anomaly detection model, characterized in that, The device includes: Memory; processor; The memory stores computer-executed instructions; The processor executes the computer execution instructions stored in the memory to implement the training and management method for a long-tailed temporal anomaly detection model as described in any one of claims 1-7.

10. A computer storage medium, characterized in that, The computer storage medium stores computer execution instructions, which, when executed by the processor, are used to implement the training and management method for a long-tailed time-series anomaly detection model as described in any one of claims 1-7.

Images