Time series anomaly detection method and system based on pattern vectorization

Abstract

The application relates to the technical field of anomaly detection, in particular to a time series anomaly detection method and system based on pattern vectorization, which comprises the following steps: obtaining preprocessed time series data, and performing non-overlapping segmentation on each time series with a sliding window with a size of m; for each point in each subsequence, calculating a first difference value between the point and a previous point, a second difference value between the point and a next point, determining a first amplitude mark and a second amplitude mark according to the first difference value and the second difference value, and splicing the trend mark, the first amplitude mark and the second amplitude mark into a point pattern symbol; sequentially splicing the point pattern symbols of the points in the subsequence to obtain a segment pattern base of the subsequence; constructing the segment pattern bases of all time series into a corpus, calculating a word frequency and an inverse document frequency, multiplying the word frequency and the inverse document frequency to obtain a TF-IDF weight, and generating a feature matrix; inputting the feature matrix into an integrated classifier, and outputting an anomaly detection result of each time series.

Description

Technical Field

[0001] This invention relates to the field of anomaly detection technology, and in particular to a time series anomaly detection method and system based on pattern vectorization. Background Technology

[0002] Time series anomaly detection has wide applications in fields such as industrial equipment health monitoring, financial risk early warning, network security intrusion detection, and medical physiological signal diagnosis. In the health monitoring scenario of lead-acid batteries in industrial uninterruptible power supply (UPS) systems, the system periodically collects time series data of the internal resistance of each battery, requiring accurate identification of early abnormal batteries from a large number of normal batteries. However, in real-world scenarios, normal batteries account for the vast majority, and the proportion of abnormal batteries is usually less than 2% (positive to negative sample ratio of approximately 1:50). Furthermore, early anomalies show minimal differences from normal batteries in global statistical indicators (mean, variance, etc.), but often exhibit identifiable differences in local morphology (minor vibration frequency changes, abrupt trend changes, amplitude jumps).

[0003] In existing anomaly detection algorithms, feature extraction is a supervised process that heavily relies on labeled samples. When there are very few anomaly samples, the bias is severe, making it unsuitable for highly imbalanced scenarios. The number of parameters is large, requiring a large number of labeled samples for training, and the generalization ability is poor in small sample and highly imbalanced scenarios.

[0004] The information disclosed in this background section is intended only to enhance the understanding of the general background of the invention and should not be construed as an admission or in any way implying that the information constitutes prior art known to those skilled in the art. Summary of the Invention

[0005] This invention provides a time series anomaly detection method and system based on pattern vectorization, thereby effectively solving the problems in the background art.

[0006] To achieve the above objectives, the technical solution adopted by this invention is: a time series anomaly detection method based on pattern vectorization, comprising the following steps:

[0007] The preprocessed time series data is obtained, and each time series is non-overlapped by a sliding window of size m to obtain several equal-length subsequences; where m is an even number.

[0008] For each point in each subsequence, calculate the first difference between the point and the previous point, and the second difference between the point and the next point. Determine a trend marker based on the sign combination of the first and second differences. Determine a first amplitude marker and a second amplitude marker based on the preset amplitude range into which the absolute values ​​of the first and second differences fall. Concatenate the trend marker, the first amplitude marker, and the second amplitude marker into a point pattern symbol. Concatenate the point pattern symbols of each point in the subsequence sequentially to obtain the fragment pattern base of the subsequence.

[0009] All time series fragment pattern bases are constructed into a corpus. The word frequency of each fragment pattern base relative to each time series and the inverse document frequency relative to the global corpus are calculated. The word frequency and the inverse document frequency are multiplied to obtain the TF-IDF weights, and a feature matrix is ​​generated. The rows of the feature matrix correspond to the time series, and the columns correspond to the symbol types of the fragment pattern bases.

[0010] The feature matrix is ​​input into the ensemble classifier, which outputs the anomaly detection results for each time series.

[0011] Furthermore, the trend marker p1 is selected from 9 types of trend markers based on the positive and negative sign combination of the first difference d1 and the second difference d2, covering all trend combinations of increase-decrease, decrease-increase, increase-constant, decrease-constant, constant-increase, constant-decrease, constant-constant, increase-increase and decrease-decrease.

[0012] Furthermore, the preset amplitude range includes 9 levels: 0, +S, +MS, +ML, +L, -S, -MS, -ML, -L;

[0013] The amplitude markings, p2 and p3, are determined based on whether |d1| and |d2| fall into the following intervals: d=0 corresponds to 0; 0<|d|≤0.25 corresponds to +S or -S; 0.25<|d|≤0.5 corresponds to +MS or -MS; 0.5<|d|≤0.75 corresponds to +ML or -ML; 0.75<|d|≤1 corresponds to +L or -L; the sign is consistent with the sign of d1 or d2 itself.

[0014] Furthermore, the point pattern symbol PP = p1⊕p2⊕p3; the fragment pattern base FPB is formed by concatenating the point pattern symbols of each odd-numbered site in the subsequence in temporal order, i.e., FPB. i =PP1⊕PP2⊕...⊕PP ⌊m / 2⌋ .

[0015] Furthermore, the term frequency TF FPB,T =N FPB,T / AN FPB,T , where N FPB,TLet AN be the number of times the fragment pattern base FPB appears in the FPB set of time series T. FPB,T The total number of FPBs for time series T; the inverse document frequency (IDF) FPB =log(N T / TSS FPB ), where N T The total number of time series, TSS FPB This represents the number of time series containing this FPB.

[0016] Furthermore, the ensemble classifier is a RUSBoost classifier; the RUSBoost classifier performs random undersampling of the majority class samples in each Boosting iteration to balance the ratio of positive and negative samples, trains the decision tree as a weak classifier, and obtains the final prediction result through multiple rounds of iterative weighted ensemble.

[0017] Furthermore, the preprocessing includes: resampling time series with different sampling frequencies and different start times to make each time series have a uniform length n, and normalizing the values ​​Min-Max to the [0,1] interval; the sliding window size m is an even number from 4 to 12.

[0018] Furthermore, the interval boundaries of the amplitude partition are dynamically determined based on the adaptive quantiles of the dataset difference distribution to adapt to time series with different dimensions and different fluctuation amplitudes.

[0019] The present invention also includes a time series anomaly detection system based on pattern vectorization, using the method described above, wherein the system comprises:

[0020] The preprocessing module is used to resample, normalize, and filter the original time series to remove noise, and output a preprocessed time series with a uniform format.

[0021] The sequence segmentation module is used to perform non-overlapping segmentation of the preprocessed time series using a sliding window of size m to obtain equal-length subsequences;

[0022] The dot symbolization module is used to calculate the difference d1 and d2 for each point in each subsequence. Based on the combination of positive and negative signs of the difference and the absolute value amplitude, the trend marker p1, the first amplitude marker p2 and the second amplitude marker p3 are determined respectively, and then concatenated into a dot pattern symbol PP.

[0023] The Fragment Pattern Base Generation Module is used to sequentially concatenate the point pattern symbols of each point in a subsequence to form the Fragment Pattern Base (FPB) of that subsequence.

[0024] The feature vectorization module is used to construct an FPB corpus for all time series, calculate the TF-IDF weights of each FPB, and generate a feature matrix M with a fixed number of columns.

[0025] The anomaly detection module is used to input the feature matrix M into the RUSBoost ensemble classifier and output the anomaly detection results for each time series.

[0026] The present invention also includes a computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements the method as described above.

[0027] The present invention also includes a storage medium having a computer program stored thereon, which, when executed by a processor, implements the method as described above.

[0028] The beneficial effects of this invention are as follows: the entire feature extraction process has only one hyperparameter (sliding window size m), which greatly reduces the cost of engineering parameter tuning and is superior to complex deep network methods. The feature extraction process does not require label information and can be directly applied to unlabeled historical time-series data, which is fundamentally different from Shapelet-based supervised methods and deep learning methods. It reduces the difficulty and cost of obtaining a large number of labeled samples in practical applications and can simultaneously capture the dual-dimensional symbolic encoding of trend direction and magnitude information. The TF-IDF mechanism automatically assigns higher weights to abnormal patterns and automatically highlights features valuable for anomaly detection, solving the feature dilution problem caused by equal weight processing; it is suitable for deployment on edge computing devices. Attached Figure Description

[0029] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0030] Figure 1 This is a flowchart of the method in Embodiment 1 of the present invention;

[0031] Figure 2 This is a schematic diagram of the system structure in Embodiment 1 of the present invention;

[0032] Figure 3 This is a flowchart of the method in Embodiment 2 of the present invention;

[0033] Figure 4 This is a flowchart of the PVT feature extraction process in Embodiment 2 of the present invention;

[0034] Figure 5 This is a schematic diagram of the structure of the computer device of the present invention. Detailed Implementation

[0035] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments.

[0036] Example 1:

[0037] like Figure 1 As shown: A time series anomaly detection method based on pattern vectorization includes the following steps:

[0038] Obtain the preprocessed time series data, and perform non-overlapping segmentation on each time series using a sliding window of size m to obtain several equal-length subsequences; m is an even number.

[0039] For each point in each subsequence, calculate the first difference between that point and the previous point, and the second difference between that point and the next point. Determine the trend marker based on the combination of the positive and negative signs of the first and second differences. Determine the first amplitude marker and the second amplitude marker based on the preset amplitude range into which the absolute values ​​of the first and second differences fall. Concatenate the trend marker, the first amplitude marker, and the second amplitude marker to form a point pattern symbol. Concatenate the point pattern symbols of each point in the subsequence sequentially to obtain the fragment pattern base of the subsequence.

[0040] All time series fragment pattern bases are used to construct a corpus. The word frequency of each fragment pattern base relative to each time series and the inverse document frequency relative to the global corpus are calculated. The word frequency and the inverse document frequency are multiplied to obtain the TF-IDF weights, and a feature matrix is ​​generated. The rows of the feature matrix correspond to the time series, and the columns correspond to the symbol types of the fragment pattern bases.

[0041] The feature matrix is ​​input into the ensemble classifier, which outputs the anomaly detection results for each time series.

[0042] Among them, the trend marker p1 is selected from 9 types of trend markers based on the positive and negative sign combination of the first difference d1 and the second difference d2, covering all trend combinations of increase-decrease, decrease-increase, increase-constant, decrease-constant, constant-increase, constant-decrease, constant-constant, increase-increase and decrease-decrease.

[0043] The preset amplitude range includes 9 levels: 0, +S, +MS, +ML, +L, -S, -MS, -ML, -L;

[0044] The amplitude markings, p2 and p3, are determined based on whether |d1| and |d2| fall into the following intervals: d=0 corresponds to 0; 0<|d|≤0.25 corresponds to +S or -S; 0.25<|d|≤0.5 corresponds to +MS or -MS; 0.5<|d|≤0.75 corresponds to +ML or -ML; 0.75<|d|≤1 corresponds to +L or -L; the sign is consistent with the sign of d1 or d2 itself.

[0045] In this embodiment, the dot pattern symbol PP = p1⊕p2⊕p3; the fragment pattern base FPB is formed by splicing the dot pattern symbols of each odd-numbered site in the subsequence in temporal order, i.e., FPB. i =PP1⊕PP2⊕...⊕PP ⌊m / 2⌋ .

[0046] Among them, word frequency TF FPB,T =N FPB,T / AN FPB,T , where N FPB,T Let AN be the number of times the fragment pattern base FPB appears in the FPB set of time series T. FPB,T The total number of FPBs in time series T; Inverse document frequency (IDF) FPB =log(N T / TSS FPB ), where N T The total number of time series, TSS FPB This represents the number of time series containing this FPB.

[0047] As a preferred embodiment of the above, the ensemble classifier is the RUSBoost classifier; the RUSBoost classifier performs random undersampling of the majority class samples in each Boosting iteration to make the ratio of positive and negative samples tend to be balanced, trains the decision tree as a weak classifier, and obtains the final prediction result through multiple rounds of iterative weighted ensemble.

[0048] Preprocessing includes: resampling time series with different sampling frequencies and different start times to make each time series have a uniform length n, and normalizing the values ​​Min-Max to the [0,1] interval; the sliding window size m is an even number from 4 to 12.

[0049] The interval boundaries of the amplitude partitions are dynamically determined based on the adaptive quantiles of the difference distribution of the dataset, in order to adapt to time series with different scales and different fluctuation amplitudes.

[0050] like Figure 2 As shown, this embodiment also includes a time series anomaly detection system based on pattern vectorization, using the method described above. The system includes:

[0051] The preprocessing module is used to resample, normalize, and filter the original time series to remove noise, and output a preprocessed time series with a uniform format.

[0052] The sequence segmentation module is used to perform non-overlapping segmentation of the preprocessed time series using a sliding window of size m to obtain equal-length subsequences;

[0053] The dot symbolization module is used to calculate the difference d1 and d2 for each point in each subsequence. Based on the combination of positive and negative signs of the difference and the absolute value amplitude, the trend marker p1, the first amplitude marker p2 and the second amplitude marker p3 are determined respectively, and then concatenated into a dot pattern symbol PP.

[0054] The Fragment Pattern Base Generation Module is used to sequentially concatenate the point pattern symbols of each point in a subsequence to form the Fragment Pattern Base (FPB) of that subsequence.

[0055] The feature vectorization module is used to construct an FPB corpus for all time series, calculate the TF-IDF weights of each FPB, and generate a feature matrix M with a fixed number of columns.

[0056] The anomaly detection module is used to input the feature matrix M into the RUSBoost ensemble classifier and output the anomaly detection results for each time series.

[0057] This embodiment has the following beneficial effects:

[0058] First, it is a completely unsupervised feature extraction method that does not rely on any labeled samples. The PVT feature extraction process does not require label information and can be directly applied to unlabeled historical time-series data, which is fundamentally different from Shapelet-based supervised methods and deep learning methods, reducing the difficulty and cost of obtaining a large number of labeled samples in practical applications.

[0059] Second, it employs a dual-dimensional symbolic encoding that simultaneously captures trend direction and amplitude information. The point pattern (PP) triplet encoding proposed in this embodiment simultaneously includes trend direction (9 types of labels) and amplitude magnitude (9 levels of labels), which has a significant advantage over traditional symbolic methods such as SAX that only bin the amplitude, in distinguishing segments with similar shapes but opposite trends.

[0060] Third, the parameters are extremely simple and the robustness is strong. The entire feature extraction process has only one hyperparameter (sliding window size m). Experiments show that m is highly stable in a wide range of 4 to 12, which greatly reduces the engineering parameter tuning cost and is superior to complex deep network methods.

[0061] Fourth, the TF-IDF mechanism automatically assigns higher weights to anomalous patterns. Common patterns (which appear in most normal time series) have low IDF values, while rare patterns that only appear in anomalous time series have high IDF values. This automatically highlights features valuable for anomaly detection and solves the feature dilution problem caused by equal weighting.

[0062] Fifth, it is naturally compatible with imbalanced learning. The PVT feature matrix can be integrated with imbalanced classifiers such as RUSBoost. Validated on real civil aviation UPS battery data (positive to negative ratio of approximately 1:52), the PVT+RUBT combination achieved G-mean=0.852 and AUC=0.915, a significant improvement compared to the original feature + RUBT (G-mean=0.603, AUC=0.658).

[0063] Sixth, it has low computational complexity. The time complexity is O(k(m+|term|)), the window size m is usually a small value (such as 6), the feature dimension is controllable, which is much lower than Shapelet exhaustive search (O(n²)) and deep network training, making it suitable for deployment on edge computing devices.

[0064] Example 2:

[0065] like Figure 3 As shown, this embodiment addresses a health monitoring scenario for lead-acid batteries in a civil aviation uninterruptible power supply (UPS) system of a large data center. The system connects to a total of 9456 lead-acid batteries. Every hour, the system automatically collects the internal resistance value of each battery, forming a one-dimensional real-value time series with timestamps on the horizontal axis and internal resistance values ​​on the vertical axis. The data includes 9276 normal batteries and 180 abnormal batteries (batteries confirmed by manual verification to have reached the end of their lifespan or are faulty), with a positive-to-negative sample ratio of 9276:180 ≈ 51.5:1, and an anomaly rate of approximately 1.9%. Internal resistance data is continuously collected for each battery at 500 time points.

[0066] Data preprocessing

[0067] The original battery internal resistance timing sequence is preprocessed as follows:

[0068] (1) Resampling: Linear interpolation is used to fill in missing time points caused by sensor failure or communication interruption, and each time series is uniformly set to 500 timestamps (n=500).

[0069] (2) Normalization: Each time series is independently normalized to the [0,1] interval using Min-Max normalization to ensure that the differences d1,d2∈[-1,1], satisfying the difference constraint of PP amplitude coding. The normalization formula is: x norm =(xx min ) / (x max -x min ).

[0070] (3) Filtering and noise reduction: A 3-point moving average filter is used to smooth the normalized time series and remove high-frequency noise from the sensor.

[0071] PVT Feature Extraction

[0072] likeFigure 4 As shown, PVT feature extraction includes the following steps:

[0073] (1) Sequence segmentation: Take the sliding window size m=6, and divide each time sequence with a length of 500 into ⌈500 / 6⌉=84 subsequences in a non-overlapping manner (the part with less than 6 points at the end is extended forward and rounded).

[0074] (2) Point pattern encoding: For the 1st, 3rd, and 5th odd-numbered points in each subsequence of length 6 (one point is taken every other point to avoid information redundancy between adjacent points), PP encoding is performed separately. Taking the middle point in a subsequence as an example, if the value of this point is 0.72, the value of the previous point is 0.42, and the value of the next point is 0.68, then d1=0.72-0.42=+0.30, d2=0.68-0.72=-0.04. According to the encoding rules: d1>0 and d2<0, the trend label p1=ID (increase-decrease); |d1|=0.30∈(0.25,0.5], d1 is positive, the amplitude label p2=+MS; |d2|=0.04∈(0,0.25], d2 is negative, the amplitude label p3=-S. The point pattern symbol PP="ID+MS-S".

[0075] (3) Fragment pattern base generation: For a subsequence of length 6, the PPs at 3 odd-numbered sites are spliced ​​together to form an FPB. For example: FPB="ID+MS-S·DI+ML+S·II+S+S" ("·" is only a schematic separator). Each sequence has 84 FPBs, and a total of approximately 794,304 FPBs are generated for all 9456 battery time series.

[0076] (4) TF-IDF Feature Vectorization: Construct a corpus of all FPBs and count the global occurrence of each FPB. For each FPB type, calculate the TF relative to each time series T. FPB,T =N FPB,T / 84; Calculate the global IDF FPB =log(9456 / TSS FPB TF-IDF = TF × IDF. The final feature matrix M is generated, with 9456 rows (number of batteries) and columns equal to the number of FPB types in the corpus. Statistically, approximately 1200 FPB types actually occur, therefore M has a dimension of 9456 × 1200.

[0077] RUSBoost Anomaly Detection

[0078] The feature matrix M is used as input, and an anomaly detection is performed using a RUSBoost classifier. RUBT parameter settings: number of iterations I=30, positive to negative sample target ratio 1:1, maximum number of splits for the weak classifier of the decision tree = 20.

[0079] The iteration process of RUSBoost is as follows:

[0080] (1) Initialize the weights of all training samples to a uniform distribution;

[0081] (2) In the j-th iteration, the majority class (normal battery) is randomly undersampled according to the current sample weight, so that the ratio of positive to negative samples in the training set of this round reaches 1:1;

[0082] (3) Train the decision tree weak classifier h on the undersampled training set. j ;

[0083] (4) Calculate h j The weighted error L over the entire training set j If L j If the value is ≥0.5, the iteration terminates; otherwise, the classifier weight β is calculated. j =L j / (1-L j );

[0084] (5) Update sample weights: Multiply the weights of misclassified samples by β j -1 (Weight increases), while the weights of correctly classified samples remain unchanged;

[0085] (6) Iterate until the preset number of iterations I is reached or terminate early.

[0086] The final output is the weighted voting result of all weak classifiers, which serves as the anomaly detection prediction label.

[0087] Comparison of experimental results and effects

[0088] Performance was evaluated using 10-fold cross-validation, employing four metrics: sensitivity, specificity, G-mean, and AUC. The experimental results are as follows:

[0089] Raw features + Decision Tree (DT) 0.175 0.994 0.417 0.600 Raw features + RUSBoost (RUBT) 0.516 0.704 0.603 0.658 PVT features + Decision Tree (DT) 0.246 0.996 0.495 0.760 PVT features + RUSBoost (Invention) 0.828 0.876 0.852 0.915

[0090] The results show that the proposed PVT+RUBT combination method significantly outperforms the comparative methods in terms of Sensitivity (0.828) and AUC (0.915). Compared with the original feature + RUBT, Sensitivity is improved by 60.5% (0.516→0.828), and AUC is improved by 39.1% (0.658→0.915). The introduction of PVT features enables the RUSBoost classifier to utilize discriminative temporal local morphological features, significantly improving the recall rate of anomalous samples while maintaining high Specificity (0.876), effectively solving the problem of missed anomaly detection in extremely imbalanced scenarios.

[0091] In practical applications, when predicting 180 abnormal batteries in the dataset, the method of this invention correctly identified 149 of them (recall rate 82.8%), while the original feature + RUBT method only correctly identified 93 (recall rate 51.6%). The method correctly identified 56 more abnormal batteries, which is equivalent to avoiding about 31% of the abnormal batteries being missed.

[0092] Parameter sensitivity analysis

[0093] To verify the impact of the sliding window size m on the method's performance, experiments were conducted at m∈{4,6,8,10,12}, and the results are as follows:

[0094] Window size m Sensitivity Specificity G-mean AUC 4 0.805 0.882 0.843 0.908 6 0.828 0.876 0.852 0.915 8 0.819 0.879 0.849 0.911 10 0.811 0.885 0.847 0.907 12 0.803 0.888 0.844 0.904

[0095] The results show that the fluctuation range of each index is less than ±3% when m is in the range of 4 to 12, and the fluctuation range of AUC is only 0.904~0.915, indicating that the method of the present invention has extremely low sensitivity to window size m and has excellent parameter robustness.

[0096] Example 3:

[0097] PVT Feature Extension Based on Adaptive Quantile Boundaries

[0098] This embodiment, based on Embodiment 2, replaces the fixed amplitude bin boundaries with adaptive quantile boundaries based on the difference distribution of the dataset. Specifically, the absolute value distribution of all differences *d* across all time series in the entire dataset is statistically analyzed, and the 20%, 40%, 60%, and 80% quantiles of |d| are used as bin boundaries, replacing the fixed boundaries {0.25, 0.5, 0.75}. In this way, the amplitude level division will adaptively adjust according to the fluctuation characteristics of the data itself, giving the encoding a stronger generalization ability for time series with different dimensions and fluctuation amplitudes.

[0099] Experimental results show that on the dataset of Example 2, the AUC obtained by the adaptive quantile boundary scheme is 0.918 (0.915 for the fixed boundary), and the performance of the two is similar. However, on another set of battery data from different device models (different dimensions, internal resistance range 0~50mΩ), the AUC of the adaptive boundary scheme is 0.894, which is significantly better than the 0.842 of the fixed boundary, demonstrating the cross-dimensional generalization advantage of the adaptive quantile boundary.

[0100] Example 4:

[0101] Extended applications of abnormal vibration signal detection in industrial equipment

[0102] This embodiment extends the method in Embodiment 2 to the scenario of abnormal vibration signal detection in industrial rotating machinery. The dataset used is the publicly available CWRU bearing dataset, selecting 1000 normal state samples and 50 rolling element fault samples (abnormality rate 4.8%), with each time series having a length of 400 sampling points.

[0103] Using the same parameter configuration as in Example 2 (m=6, n=400), PVT+RUBT achieved Sensitivity=0.860, Specificity=0.902, G-mean=0.881, and AUC=0.934 on this dataset. The comparison method (based on original FFT spectral features + RUSBoost) had an AUC of only 0.723. The experiments verified the transferability of the proposed method to time series anomaly detection in different domains.

[0104] Example 5:

[0105] Please see Figure 5 The diagram shows a structural schematic of a computer device provided in an embodiment of this application. An embodiment of this application provides a computer device 400, including a processor 410 and a memory 420. The memory 420 stores a computer program executable by the processor 410. When the computer program is executed by the processor 410, it performs the method described above.

[0106] This application embodiment also provides a storage medium 430, on which a computer program is stored, and the computer program is executed by a processor 410 to perform the above method.

[0107] The storage medium 430 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random Access Memory (SRAM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read Only Memory (EPROM), Programmable Red-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0108] In the description of this invention, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. "A plurality of" means two or more, unless otherwise explicitly specified.

[0109] In this invention, unless otherwise explicitly specified and limited, the terms "installation," "connection," "linking," and "fixing," etc., should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral part; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; they can refer to the internal communication of two components or the interaction between two components. Those skilled in the art can understand the specific meaning of the above terms in this invention according to the specific circumstances.

[0110] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Furthermore, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0111] Any process or method description in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more executable instructions for implementing a particular logical function or process, and the scope of the preferred embodiments of the invention includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved, as will be understood by those skilled in the art to which embodiments of the invention pertain.

[0112] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of computer-readable media include: an electrical connection having one or more wires (electronic device), a portable computer disk drive (magnetic device), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Alternatively, the computer-readable medium may be paper or other suitable media on which the program can be printed, since the program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in a computer memory.

[0113] It should be understood that various parts of the present invention can be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented in software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0114] Those skilled in the art will understand that all or part of the steps of the methods described in the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it includes one or a combination of the steps of the method embodiments.

[0115] The storage medium mentioned above can be a read-only memory, a disk, or an optical disk, etc. Although embodiments of the present invention have been shown and described above, it is to be understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those skilled in the art can make changes, modifications, substitutions, and variations to the above embodiments within the scope of the present invention.

Claims

1. A time series anomaly detection method based on pattern vectorization, characterized in that, Includes the following steps: The preprocessed time series data is obtained, and each time series is non-overlapped by a sliding window of size m to obtain several equal-length subsequences; where m is an even number. For each point in each subsequence, calculate the first difference between the point and the previous point, and the second difference between the point and the next point. Determine a trend marker based on the sign combination of the first and second differences. Determine a first amplitude marker and a second amplitude marker based on the preset amplitude range into which the absolute values ​​of the first and second differences fall. Concatenate the trend marker, the first amplitude marker, and the second amplitude marker into a point pattern symbol. Concatenate the point pattern symbols of each point in the subsequence sequentially to obtain the fragment pattern base of the subsequence. All time series fragment pattern bases are constructed into a corpus. The word frequency of each fragment pattern base relative to each time series and the inverse document frequency relative to the global corpus are calculated. The word frequency and the inverse document frequency are multiplied to obtain the TF-IDF weights, and a feature matrix is ​​generated. The rows of the feature matrix correspond to the time series, and the columns correspond to the base symbol types of the segment patterns; The feature matrix is ​​input into the ensemble classifier, which outputs the anomaly detection results for each time series.

2. The time series anomaly detection method based on pattern vectorization according to claim 1, characterized in that, The trend marker p1 is selected from 9 types of trend markers based on the positive and negative sign combination of the first difference d1 and the second difference d2, covering all trend combinations of increase-decrease, decrease-increase, increase-constant, decrease-constant, constant-increase, constant-decrease, constant-constant, increase-increase and decrease-decrease.

3. The time series anomaly detection method based on pattern vectorization according to claim 2, characterized in that, The preset amplitude range includes 9 levels: 0, +S, +MS, +ML, +L, -S, -MS, -ML, -L; The first amplitude marker p2 and the second amplitude marker p3 are determined based on whether |d1| and |d2| fall into the following intervals: d=0 corresponds to 0; 0<|d|≤0.25 corresponds to +S or -S; 0.25<|d|≤0.5 corresponds to +MS or -MS; 0.5<|d|≤0.75 corresponds to +ML or -ML; 0.75<|d|≤1 corresponds to +L or -L; the sign is consistent with the sign of d1 or d2 itself.

4. The time series anomaly detection method based on pattern vectorization according to claim 3, characterized in that, The point pattern symbol PP = p1⊕p2⊕p3; the fragment pattern base FPB is formed by concatenating the point pattern symbols of each odd-numbered site in the subsequence in chronological order, i.e., FPB. i =PP1⊕PP2⊕...⊕PP ⌊m / 2⌋ .

5. The time series anomaly detection method based on pattern vectorization according to claim 1, characterized in that, The word frequency TF FPB,T =N FPB,T / AN FPB,T , where N FPB,T Let AN be the number of times the fragment pattern base FPB appears in the FPB set of time series T. FPB,T The total number of FPBs for time series T; the inverse document frequency (IDF) FPB =log(N T / TSS FPB ), where N T The total number of time series, TSS FPB This represents the number of time series containing this FPB.

6. The time series anomaly detection method based on pattern vectorization according to claim 1, characterized in that, The ensemble classifier is a RUSBoost classifier; in each Boosting iteration, the RUSBoost classifier performs random undersampling of the majority class samples to balance the ratio of positive and negative samples, trains the decision tree as a weak classifier, and obtains the final prediction result through multiple rounds of iterative weighted ensemble.

7. The time series anomaly detection method based on pattern vectorization according to claim 1, characterized in that, The preprocessing includes: resampling time series with different sampling frequencies and different start times to make each time series have a uniform length n, and normalizing the values ​​Min-Max to the [0,1] interval; the sliding window size m is an even number from 4 to 12.

8. The time series anomaly detection method based on pattern vectorization according to claim 1, characterized in that, The interval boundaries of the amplitude partitions are dynamically determined based on the adaptive quantiles of the difference distribution of the dataset, in order to adapt to time series with different dimensions and different fluctuation amplitudes.

9. A time series anomaly detection system based on pattern vectorization, characterized in that, Using the method of any one of claims 1 to 8, the system comprises: The preprocessing module is used to resample, normalize, and filter the original time series to remove noise, and output a preprocessed time series with a uniform format. The sequence segmentation module is used to perform non-overlapping segmentation of the preprocessed time series using a sliding window of size m to obtain equal-length subsequences; The dot symbolization module is used to calculate the difference d1 and d2 for each point in each subsequence. Based on the combination of positive and negative signs of the difference and the absolute value amplitude, the trend marker p1, the first amplitude marker p2 and the second amplitude marker p3 are determined respectively, and then concatenated into a dot pattern symbol PP. The Fragment Pattern Base Generation Module is used to sequentially concatenate the point pattern symbols of each point in a subsequence to form the Fragment Pattern Base (FPB) of that subsequence. The feature vectorization module is used to construct an FPB corpus for all time series, calculate the TF-IDF weights of each FPB, and generate a feature matrix M with a fixed number of columns. The anomaly detection module is used to input the feature matrix M into the RUSBoost ensemble classifier and output the anomaly detection results for each time series.

10. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the method as described in any one of claims 1-8.

11. A storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method as described in any one of claims 1-8.

Images