Time series data anomaly detection method, device, equipment, medium and product

Abstract

This application provides a method, apparatus, device, medium, and product for anomaly detection in time-series data. The method normalizes an initial time-series dataset, maps it to different pixel intensity values, and generates an initial data representation image in the form of a heatmap. This transforms the time-series characteristics and numerical variation patterns of the time-series data into visualized spatial visual features. It fully utilizes a converged visual model to extract feature information from the data, then reconstructs the features using a reconstruction model to obtain target reconstructed features. Based on these reconstructed features, anomaly detection scores are calculated for each data point, and anomalous data is determined through threshold comparison. Therefore, this method can comprehensively and accurately capture the complex and varied inherent patterns and laws within time-series data, solving the problem of related technologies' difficulty in accurately distinguishing between normal and anomalous data, and reducing the false detection and false negative rates of anomaly detection in time-series data.

Description

Technical Field

[0001] This application relates to the field of data processing technology, and in particular to methods, apparatus, equipment, media and products for detecting anomalies in time-series data. Background Technology

[0002] Time-series data refers to data generated by using sensors to record the changes in parameters such as temperature, vibration, and voltage during the operation of industrial equipment over time. When performing anomaly detection on time-series data, related technologies struggle to accurately capture the complex and ever-changing inherent patterns and regularities within the data. This makes it difficult to accurately distinguish between normal and abnormal data during the detection process, thus reducing the accuracy of anomaly detection. Summary of the Invention

[0003] The time-series data anomaly detection method, apparatus, equipment, medium, and product provided in this application's embodiments aim to solve the problem of low accuracy in related technologies for time-series data anomaly detection methods.

[0004] In a first aspect, the time-series data anomaly detection method provided in the embodiments of this application includes:

[0005] Obtain an initial time series dataset, and normalize the data in the initial time series dataset to obtain intermediate time series data;

[0006] The intermediate time-series data is mapped to different pixel intensity values ​​to generate a heatmap image; the heatmap image serves as the initial data representation image.

[0007] The initial data representation image is used to extract features using a visual model that has been trained to convergence, in order to obtain initial features;

[0008] The initial features are input into the reconstructed model trained to convergence for feature reconstruction to obtain the target reconstructed features;

[0009] Based on the target reconstruction features, the anomaly detection score corresponding to each data point in the initial time series dataset is determined;

[0010] If the anomaly detection score is greater than a preset score threshold, the data corresponding to the anomaly detection score is determined to be abnormal data.

[0011] In one possible design, the reconstructed model trained to convergence includes a learnable reference module and a cross-attention module;

[0012] The step of inputting the initial features into a converged reconstruction model for feature reconstruction to obtain the target reconstructed features includes:

[0013] Learnable reference features are generated based on the learnable reference module;

[0014] The cross-attention module is used to perform attention calculation on the initial features and the learnable reference features to obtain the target reconstruction features; wherein, the initial features serve as the query of the cross-attention module, and the learnable reference features serve as the key and value of the cross-attention module.

[0015] One possible design also includes:

[0016] The initial reconstruction model is trained using an intra-class perceptual loss function to obtain the reconstructed model that has been trained to convergence.

[0017] The step of obtaining the intra-class perceptual loss function includes:

[0018] Clustering algorithms are used to divide the training sample data into multiple clusters;

[0019] The intra-class perception loss function is determined based on the basic reconstruction loss, risk minimization loss, and variance penalty term for each cluster.

[0020] In one possible design, the basic reconstruction loss includes mean squared error loss and cosine similarity loss;

[0021] The intra-class perception loss function is determined based on the basic reconstruction loss, risk minimization loss, and variance penalty term for each cluster, including:

[0022] The mean squared error loss, cosine similarity loss, weighted risk minimization loss, and weighted variance penalty term of each cluster are summed to obtain the intra-class perception loss function; wherein, the weighted risk minimization loss is obtained by multiplying the risk minimization loss by the first adjustment coefficient; and the weighted variance penalty term is obtained by multiplying the variance penalty term by the second adjustment coefficient.

[0023] In one possible design, determining the anomaly detection score corresponding to each data point in the initial time-series dataset based on the target reconstruction features includes:

[0024] Based on the target reconstructed features and the initial features, the cosine similarity complement is determined; and the Euclidean norm difference between the target reconstructed features and the initial features is determined;

[0025] Based on the cosine similarity complement and the Euclidean norm difference, the preliminary fusion score corresponding to each data point in the initial time series dataset is determined;

[0026] An upsampling operation is performed on the preliminary fusion score to determine the anomaly detection score corresponding to each data point in the initial time-series dataset.

[0027] In one possible design, after determining that the data corresponding to the anomaly detection score is anomalous data, the following steps are also included:

[0028] The pixel regions corresponding to abnormal data in the initial data representation image are set to the first color, and the pixel regions corresponding to normal data are set to the second color, so as to distinguish and display abnormal data from normal data.

[0029] Secondly, the time-series data anomaly detection device provided in the embodiments of this application includes:

[0030] The preprocessing module is used to acquire an initial time series dataset and normalize the data in the initial time series dataset to obtain intermediate time series data.

[0031] The preprocessing module is further configured to map the intermediate time-series data into different pixel intensity values ​​to generate a heatmap image; the heatmap image serves as the initial data representation image.

[0032] The reconstruction module is used to extract features from the initial data representation image using a visual model trained to convergence, so as to obtain initial features;

[0033] The reconstruction module is also used to input the initial features into the reconstruction model trained to convergence for feature reconstruction in order to obtain the target reconstruction features;

[0034] The detection module is used to determine the anomaly detection score corresponding to each data point in the initial time series dataset based on the target reconstruction features;

[0035] The determination module is used to determine that the data corresponding to the anomaly detection score is abnormal data when the anomaly detection score is greater than a preset score threshold.

[0036] Thirdly, the electronic device provided in the embodiments of this application includes: a processor, and a memory communicatively connected to the processor;

[0037] The memory stores computer-executed instructions;

[0038] The processor executes computer execution instructions stored in the memory to implement the timing data anomaly detection method as described in any of the first aspects.

[0039] Fourthly, the computer-readable storage medium provided in the embodiments of this application stores computer-executable instructions, which, when executed by a processor, are used to implement the timing data anomaly detection method as described in any of the first aspects.

[0040] Fifthly, the computer program product provided in the embodiments of this application includes a computer program that, when executed by a processor, implements the timing data anomaly detection method described in any one of the first aspects.

[0041] The time-series data anomaly detection method, apparatus, device, medium, and product provided in this application embodiment describe a method that normalizes an initial time-series dataset, maps it to different pixel intensity values, and generates an initial data representation image in the form of a heatmap. This transforms the time-series characteristics and numerical variation patterns of the time-series data into visualized spatial visual features. The method fully utilizes a converged visual model trained to extract data feature information, then reconstructs the features using a reconstruction model to obtain target reconstructed features. Based on these reconstructed features, anomaly detection scores are calculated for each data point, and anomalous data are determined through threshold comparison. Therefore, this method can comprehensively and accurately capture the complex and varied inherent patterns and laws contained in time-series data, solving the problem that related technologies struggle to accurately distinguish between normal and anomalous data. It significantly reduces the false detection rate and false negative rate of time-series data anomaly detection, effectively improving the accuracy and stability of time-series data anomaly detection. Attached Figure Description

[0042] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0043] Figure 1 A schematic diagram of an application scenario corresponding to the time series data anomaly detection method provided in an embodiment of this application;

[0044] Figure 2 A flowchart illustrating a time-series data anomaly detection method provided in an embodiment of this application. Figure 1 ;

[0045] Figure 3 This is a schematic diagram of the structure of a learnable reference module and a cross-attention module provided in an embodiment of this application;

[0046] Figure 4 A flowchart illustrating a time-series data anomaly detection method provided in an embodiment of this application. Figure 2 ;

[0047] Figure 5 A flowchart illustrating a time-series data anomaly detection method provided in an embodiment of this application. Figure 3 ;

[0048] Figure 6 This is a schematic diagram of the structure of a timing data anomaly detection device provided in an embodiment of this application;

[0049] Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application.

[0050] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0051] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0052] Currently, time-series data is widely used in numerous fields such as industrial monitoring, financial transactions, and healthcare. For example, in industrial production, equipment sensors continuously collect time-series data such as temperature, pressure, and rotational speed that change over time; in the financial sector, data such as stock prices and trading volumes are also presented in time-series format. Accurately detecting abnormal data in time-series data is of great significance for ensuring stable system operation, preventing financial risks, and assisting in medical diagnosis.

[0053] Anomaly detection methods for time series data in related technologies mainly include statistical methods and machine learning-based methods. Statistical methods, such as the mean-standard deviation method, calculate the mean and standard deviation of the data and classify data deviating from the mean by a certain multiple of the standard deviation as anomalies. However, this method often fails to accurately capture the changing patterns of complex, non-stationary time series data, leading to high false positive and false negative rates. Machine learning-based methods, such as decision trees and support vector machines, can handle non-linear data to some extent, but require a large amount of labeled data for training and do not fully utilize the time-dependent characteristics of time series data, making it difficult to adapt to dynamic changes in the data. Therefore, anomaly detection methods for time series data in related technologies struggle to accurately capture the complex and ever-changing inherent patterns and regularities within time series data, resulting in low accuracy in anomaly detection.

[0054] Considering the rich feature information in image data and the existence of mature feature extraction and reconstruction techniques in image processing, this approach addresses the technical challenges by first converting the time-series information into image form, providing a suitable medium for subsequent feature extraction and anomaly detection. Second, a convergent target feature reconstruction model is trained to deeply mine the latent features and patterns in the images, enabling precise feature extraction and reconstruction of the converted images. Feature reconstruction allows for better capture of the complex and varied inherent patterns and regularities in time-series data, distinguishing normal and abnormal data in the feature space. Third, based on the target reconstructed features, anomaly detection scores are determined for each data point in the initial time-series dataset, reflecting the degree of deviation from normal patterns. Finally, a preset score threshold is set; data with an anomaly score exceeding this threshold is identified as abnormal. This method enables more accurate identification of abnormal data in time-series data, effectively reducing false positives and false negatives and improving the accuracy of anomaly detection in time-series data.

[0055] Figure 1 This is a schematic diagram of a scenario corresponding to the time-series data anomaly detection method provided in an embodiment of this application, such as... Figure 1 As shown in the diagram, the application scenario of the time-series data anomaly detection method provided in this embodiment includes: a device to be detected 10 and a detection device 11, wherein the device to be detected 10 and the detection device 11 are communicatively connected. Optionally, the device to be detected 10 may be a device sensor.

[0056] Specifically, when it is necessary to detect the time-series data of the device to be detected 10, the detection device 11 sends a data retrieval request to the device to be detected 10. After receiving the retrieval request, the device to be detected 10 sends the time-series data to the detection device 11. The detection device 11 acquires the time-series data and preprocesses it to obtain a data representation image. Then, it uses a target feature reconstruction model trained to convergence to reconstruct the features of the data representation image to obtain target reconstruction features. Based on the target reconstruction features, it determines the anomaly detection score corresponding to each data in the time-series data. If the anomaly detection score is greater than a preset score threshold, the data corresponding to the anomaly detection score is determined to be anomaly data.

[0057] When the detection device 11 detects abnormal data, it can display it on the display device or send it to the device under test 10.

[0058] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.

[0059] Figure 2 Flowchart of a time-series data anomaly detection method provided in an embodiment of this application Figure 1 ,like Figure 2 As shown, the execution entity in this embodiment is a timing data anomaly detection device. This device can be implemented through a computer program, or through a medium storing the relevant computer program, such as a USB flash drive and / or optical disc, or it can be integrated into an electronic device. The timing data anomaly detection method provided in this embodiment includes the following steps:

[0060] S201. Obtain the initial time series dataset and normalize the data in the initial time series dataset to obtain intermediate time series data.

[0061] Optionally, an initial time-series dataset containing a series of data points arranged in chronological order can be obtained through a data acquisition device or data interface.

[0062] It should be noted that in practical applications, raw time-series data may contain noise and missing values. Directly using raw time-series data for anomaly detection will affect the accuracy of the detection results. Therefore, optionally, after obtaining the initial time-series dataset, a cleaning operation can be performed to remove noisy data and missing values. For handling missing values, interpolation methods, such as linear interpolation and polynomial interpolation, can be used to estimate the missing values ​​based on the values ​​of adjacent data points.

[0063] Optionally, the cleaned data can be normalized to map the data to a specific interval, such as any value in the range of 0 to 1, in order to eliminate the influence of data units and improve the training efficiency and accuracy of the model.

[0064] Optionally, an image generation algorithm can be used to convert the processed initial time-series data into an initial data representation image. For example, the time-series data can be arranged into a matrix in chronological order, and different grayscale or color values ​​can be assigned according to the data values, thereby converting the time-series data into an initial data representation image.

[0065] It should be noted that because images have a rich ability to represent visual information and can better capture the characteristics and patterns of data in a spatial dimension, converting time-series data into image form can provide a more intuitive and effective data format for subsequent feature extraction and analysis.

[0066] It should be noted that normalization can eliminate the influence of data units, bringing data of different magnitudes to the same scale, which facilitates subsequent processing. Specifically, the min-max normalization method can be used, with the following formula:

[0067] (Formula 1)

[0068] in, This is the initial time series data. The minimum value in the original data. The maximum value in the original data. This is intermediate time series data.

[0069] Specifically, after normalization, the initial time series data will be mapped to the [0,1] interval.

[0070] S202. Map the intermediate time series data to different pixel intensity values ​​to generate a heat map image; the heat map image is a representation image of the initial data.

[0071] Specifically, corresponding colors or grayscale levels can be assigned based on the magnitude of the normalized intermediate time-series data. For example, data values ​​close to 0 can be assigned cool colors, such as blue, while data values ​​close to 1 can be assigned warm colors, such as red, and intermediate values ​​can be assigned transitional colors. Optionally, pixels can be arranged in a two-dimensional matrix, with the horizontal axis representing the time series and the vertical axis divided according to data characteristics, such as different data categories or feature dimensions, thereby intuitively displaying the distribution and changes of data over time and other dimensions.

[0072] It should be noted that by generating heatmaps from time-series data as the initial data representation image, data features can be presented in an intuitive and visual form. Compared with other images, heatmaps can clearly show the distribution differences of data in the time dimension, highlight the trend of data change and abnormal areas, and enable subsequent target feature reconstruction models to extract data features more accurately, thereby improving the accuracy and efficiency of time-series data anomaly detection.

[0073] S203. Use a visual model trained to convergence to extract features from the initial data representation image to obtain initial features.

[0074] Optionally, the visual model can employ convolutional neural networks, such as ResNet and VGG. When training the visual model, a large amount of initial data, transformed from normal temporal data, can be used as training samples. With image classification or feature extraction as the objective, the visual model parameters are continuously adjusted using a backpropagation algorithm. For example, the cross-entropy loss function can be used as the optimization objective to minimize the difference between the model's predictions and the true labels. When the visual model's feature extraction performance on both the training and validation sets stabilizes and no longer shows significant improvement, the visual model is considered to have converged.

[0075] Specifically, the initial data representing the image is input into a visual model that has been trained to convergence. After multiple convolutions, pooling, and other operations, initial features containing the spatial structure and semantic information of the image are extracted.

[0076] S204. Input the initial features into the reconstructed model that has been trained to convergence to reconstruct the features and obtain the target reconstructed features.

[0077] Optionally, the reconstruction model can adopt an autoencoder structure, consisting of an encoder and a decoder. When training the reconstruction model, the initial features are used as input, the encoder compresses the initial features into a low-dimensional latent feature representation, and then the decoder reconstructs the data features based on the latent feature representation.

[0078] Optionally, during training, a loss function such as mean squared error is used to measure the difference between the reconstructed features and the original data features. The parameters of the reconstruction model are optimized through the backpropagation algorithm to minimize the reconstruction error. When the reconstruction error stabilizes on the training and validation sets and no longer decreases significantly, the reconstruction model is considered to be trained successfully, or when the model has been trained for a preset number of iterations.

[0079] The initial features extracted by the visual model that has been trained to convergence are input into the reconstruction model that has been trained to convergence. After encoding and decoding operations, the target reconstruction features are finally obtained.

[0080] Specifically, the target feature reconstruction model is set up to consist of a visual model trained to convergence and a reconstruction model trained to convergence. The visual model trained to convergence has a strong image feature extraction capability and can extract rich and effective local and global features from the initial data representation image. The reconstruction model trained to convergence reconstructs the data based on the extracted initial features and learns the mapping relationship of normal data feature patterns.

[0081] The target feature reconstruction model consists of a visual model trained to convergence and a reconstruction model trained to convergence. The visual model trained to convergence first extracts features from the initial data representation image to obtain initial features, and then inputs the initial features into the reconstruction model trained to convergence to obtain target reconstructed features. The phased processing approach can more effectively mine and utilize the deep feature information of the data, thereby improving the accuracy and reliability of subsequent time series data anomaly detection.

[0082] S205. Based on the target reconstruction features, determine the anomaly detection score corresponding to each data point in the initial time series dataset.

[0083] Specifically, the target reconstruction features reflect the reconstruction effect of the target feature reconstruction model trained to convergence on the initial data representation image. The larger the reconstruction error, the more the data deviates from the feature pattern of normal data, that is, the more likely it is abnormal data.

[0084] Optionally, by determining the degree of difference between the target reconstructed features and the initial data features, and quantifying it as an anomaly detection score, the degree of anomaly of each data point can be intuitively measured.

[0085] Optionally, methods such as mean squared error (MSE) and cosine similarity can be used to calculate the difference between the reconstructed features of the target data and the features of the original data. For example, using MSE, the sum of the squares of the differences between each element of the features corresponding to the reconstructed features of the target data and the features of the initial data representation image is calculated, and then the average value is taken. The result is the anomaly detection score for that data. The higher the anomaly detection score, the greater the difference between the data and normal data, and the higher the probability of an anomaly.

[0086] S206. If the anomaly detection score is greater than the preset score threshold, the data corresponding to the anomaly detection score is determined to be abnormal data.

[0087] The preset score threshold is a pre-set standard value used to determine whether data is abnormal. When the anomaly detection score of data exceeds the preset score threshold, it indicates that the difference between the characteristics of the data and those of normal data exceeds the normal range, and therefore it can be judged as abnormal data. It should be noted that the preset score threshold was obtained through a large number of experiments and analyses based on actual application scenarios and data characteristics.

[0088] Optionally, in practical applications, experiments can be conducted using a portion of time-series data with known labels. By adjusting the preset score threshold, the accuracy and recall of anomaly detection can be brought to the desired state, thereby determining a suitable preset score threshold.

[0089] Specifically, when performing anomaly detection on the initial time series dataset, the anomaly detection score of each data point is compared with a preset score threshold. If the anomaly detection score is greater than the preset score threshold, the data is marked as anomaly data; otherwise, the data is considered normal data.

[0090] The time-series data anomaly detection method provided in this application normalizes the initial time-series dataset, maps it to different pixel intensity values, and generates an initial data representation image in the form of a heatmap. This transforms the time-series characteristics and numerical variation patterns of the time-series data into visualized spatial visual features. It fully utilizes a converged visual model to extract feature information from the data, and then uses a reconstruction model to reconstruct the target reconstructed features. Based on these reconstructed features, anomaly detection scores are calculated for each data point, and anomalous data are determined through threshold comparison. Therefore, this method can comprehensively and accurately capture the complex and varied inherent patterns and laws within time-series data, solving the problem of related technologies' difficulty in accurately distinguishing between normal and anomalous data. It significantly reduces the false positive and false negative rates of time-series data anomaly detection, effectively improving the accuracy and stability of time-series data anomaly detection.

[0091] As an optional implementation, based on any of the above embodiments, the reconstructed model trained to convergence includes a learnable reference module and a cross-attention module.

[0092] Specifically, the initial features are input into the reconstructed model trained to convergence for feature reconstruction to obtain the target reconstructed features. This includes the following steps:

[0093] First, learnable reference features are generated based on the learnable reference modules.

[0094] Specifically, learnable reference modules are typically composed of multi-layered neural networks, such as fully connected neural networks. During training, the input to the learnable reference module when reconstructing the model is random data. This random data can be a tensor conforming to a certain distribution, such as a normal distribution or a uniform distribution. Through the backpropagation algorithm, with the reconstruction error as the optimization objective, the parameters of the learnable reference module are continuously adjusted so that it can learn valuable feature information from the random data and generate learnable reference features. As training progresses, the learnable reference features generated by the learnable reference module gradually adapt to the feature patterns of normal data, providing auxiliary information for subsequent feature reconstruction.

[0095] Secondly, a cross-attention module is used to perform attention calculations on the initial features and learnable reference features to obtain the target reconstructed features; wherein, the initial features serve as the query of the cross-attention module, and the learnable reference features serve as the key and value of the cross-attention module.

[0096] Specifically, the cross-attention module is based on an attention mechanism. The initial features serve as the query of the cross-attention module, while the learnable reference features serve as both the key and value of the cross-attention module.

[0097] To facilitate understanding of the scheme in this embodiment, the working principle of the reconstructed model trained to convergence is described below:

[0098] In the traditional Transformer architecture, attention residual connections allow the output to directly contain the input, which can easily lead to lazy learning. Furthermore, since skip connections are crucial for promoting the convergence of deep learning models, simple removal is impractical. Therefore, this embodiment addresses the lazy learning problem in the Transformer architecture by combining a learnable reference module and a cross-attention module.

[0099] For example, suppose the initial features extracted by the visual model after training to convergence are: Where P is the number of feature channels, Corresponding to multivariate feature dimensions, Corresponding to the time dimension, It is the set of initial features. The Transformer block is the basic building block in the Transformer architecture. It is mainly composed of multi-head attention mechanism (MHA), temporal cross attention operator (TCA), 1-D composite trend module (CTN), feedforward neural network (FFN) and layer normalization (LN). Figure 3 This is a schematic diagram of the structure of a learnable reference module and a cross-attention module provided in an embodiment of this application; specifically, the structural reference of the Transformer block in this embodiment... Figure 3 As shown in the image.

[0100] Specifically, the features of the output of the k-th Transformer block of the reconstructed model trained to convergence. , is represented as:

[0101] (Formula 2)

[0102] in, For layer normalization; It is a feedforward layer; It is an intermediate variable. Represented as:

[0103] (Formula 3)

[0104] in, It is the input of the learnable reference module of the (k-1)th layer; These are features of the output of the (k-1)th Transformer block; It is a 1-D composite trend module. For the attention of the bulls, It is a temporal cross-attention operator.

[0105] By adding the same dimension as the initial features of the input. This replaces the original skip connections that were simply added together. Furthermore, to make the model focus on temporal characteristics, Used to drive the model to consider temporal dependencies and feature correlations to capture data features.

[0106] (Formula 4)

[0107] in, and These are one-dimensional convolutions of features in the multivariate feature dimension and the time dimension, respectively. This allows the reference features to learn the inherent data patterns of normal samples and, after processing... Capture timing information,

[0108] Then Learnable reference features and Cross-attention is calculated using the initial features of each branch. Learnable reference features are used as keys and values, and the initial features are used as queries. The process is shown in the following formula:

[0109] (Formula 5)

[0110] in, This is the output of the cross-attention module at layer k-1; Softmax is a commonly used activation function used to convert the input real number vector into a probability distribution. Softmax normalizes the calculation results within the parentheses so that the sum of each element in the output is 1, thus obtaining the attention weights. It is the transformation matrix corresponding to the query. It is the transformation matrix corresponding to the key. It is the transformation matrix corresponding to the value. yes Dimensions It is a neighbor mask matrix composed of 0s and 1s, used to mask attention calculations at certain locations and alleviate local feature dependencies.

[0111] It should be noted that the Transformer architecture in this embodiment does not have skip connections and incorporates neighborhood masks. The initial features, after passing through the cross-attention module, are not directly integrated with the input. The cross-attention module dynamically selects relevant information from learnable reference features based on the characteristics of the initial features. Since the learnable reference features are learned only from normal features, anomaly markers will receive lower similarity scores during cross-attention calculation. Therefore, the Transformer output will not retain anomalous features, thus restoring them to a normal state and preventing lazy learning.

[0112] It should be noted that the convergent reconstruction model includes a learnable reference module and a cross-attention module. The learnable reference module generates learnable reference features, which introduce additional information dimensions into the reconstruction process, enriching the model's understanding of data features. The cross-attention module dynamically captures the relationships between different features by performing attention calculations on the initial features and the learnable reference features, thereby reconstructing data features more accurately. Furthermore, the convergent reconstruction model can adapt to time-series data with different distributions and characteristics. Even when faced with new or unseen time-series data, it maintains good reconstruction results and anomaly detection performance, effectively improving the model's generalization ability.

[0113] The time-series data anomaly detection method provided in this application includes a learnable reference module and a cross-attention module in the reconstructed model trained to convergence. The learnable reference module generates learnable reference features, and the cross-attention module performs attention calculation with the initial features as queries and the learnable reference features as keys and values ​​to obtain the target reconstructed features. Thus, it can capture the correlation information between data more flexibly, enhance the effect of feature reconstruction, and improve the accuracy of time-series data anomaly detection.

[0114] As an optional implementation, based on any of the above embodiments, it further includes: training the initial reconstruction model using an intra-class perceptual loss function to obtain a reconstruction model trained to convergence.

[0115] The steps for obtaining the intra-class perceptual loss function include:

[0116] First, a clustering algorithm is used to divide the training sample data into multiple clusters.

[0117] Alternatively, clustering algorithms such as K-Means and DBSCAN can be used.

[0118] For example, taking the K-Means algorithm, the number of clusters is first determined and cluster centers are randomly initialized; then the distance from each training sample data point to each cluster center is calculated, and the data point is assigned to the cluster to which the nearest cluster center belongs; then the center position of each cluster is recalculated, and the above process of assigning and calculating the center is repeated until the cluster centers no longer change significantly or the preset number of iterations is reached, thereby completing the division of the training sample data and generating multiple clusters.

[0119] Secondly, the intra-class perception loss function is determined based on the basic reconstruction loss, risk minimization loss, and variance penalty term for each cluster.

[0120] Optionally, the basic reconstruction loss can be calculated using mean squared error. For each sample in the cluster, the mean squared error between its reconstructed features and the initial features is calculated, and then the mean squared errors of all samples in the cluster are averaged to obtain the basic reconstruction loss of the cluster.

[0121] Alternatively, the risk minimization loss can be measured by calculating the uncertainty of the model's prediction results on different samples. For example, it can be done by using entropy to calculate the entropy value of the prediction results for each sample in the cluster, and then taking the average value to obtain the risk minimization loss of the cluster.

[0122] Optionally, the variance penalty term is used to limit the fluctuation of data reconstruction results within the same cluster. The variance of the sample reconstruction features within each cluster is calculated, and the average value is taken as the variance penalty term for that cluster.

[0123] It should be noted that the significant differences in the distribution of normal samples can weaken the model's generalization ability. This difference stems from the diversity among different normal samples, such as the operating modes of equipment under different conditions and environmental changes. Since the model may only be optimized under a specific distribution of the training set, its reconstruction ability may be affected when encountering new normal samples, leading to false positives or false negatives.

[0124] To address this issue, training is performed using the intra-class perceptual loss function, which alleviates the difficulty of reconstruction training caused by excessive differences in the distribution of normal samples. Specifically, the intra-class perceptual loss function divides the training sample data into multiple clusters using a clustering algorithm, ensuring that data within the same cluster exhibit similar feature patterns. Building upon this, by combining the basic reconstruction loss, the risk minimization loss, and the variance penalty term, the model is prompted to consider not only the reconstruction accuracy of individual samples but also the intra-class similarity and distribution stability of the data when reconstructing the data.

[0125] Specifically, the basic reconstruction loss ensures the model can accurately reconstruct the data; the risk minimization loss reduces the prediction risk of the model on different samples; and the variance penalty term limits the fluctuation of data reconstruction results within the same cluster, preventing the model from overfitting individual samples. In this way, the model can better learn the feature patterns of normal data and improve its sensitivity to abnormal data.

[0126] The time-series data anomaly detection method provided in this application introduces an intra-class perceptual loss function, enabling the initial reconstruction model to better learn the inherent distribution characteristics of the data. Through clustering and constraints from multiple loss terms, the initial reconstruction model has a deeper understanding of the intra-class similarity of normal data, thus enabling it to reconstruct data more accurately when faced with data of different distribution characteristics, thereby improving the accuracy and stability of time-series data anomaly detection.

[0127] As an optional implementation, based on any of the above embodiments, the basic reconstruction loss includes mean squared error loss and cosine similarity loss; the intra-class perception loss function is determined based on the basic reconstruction loss, risk minimization loss, and variance penalty term for each cluster, including:

[0128] The mean squared error loss, cosine similarity loss, weighted risk minimization loss, and weighted variance penalty term of each cluster are summed to obtain the intra-class perception loss function. The weighted risk minimization loss is obtained by multiplying the risk minimization loss by the first adjustment coefficient, and the weighted variance penalty term is obtained by multiplying the variance penalty term by the second adjustment coefficient.

[0129] Mean squared error loss is calculated using the mean squared error method. For each sample in the cluster, the mean squared error between the reconstructed features and the original features is calculated using the following formula:

[0130] (Formula 6)

[0131] in, This is the mean squared error loss; This refers to the number of samples, i.e., the number of samples in the training sample set; It is the index of the sample, used to iterate through each sample in the sample set. From 1 to , indicating that the dataset contains Each sample is calculated sequentially; Represents the first in the sample set One sample, It is the first Sample The predicted value, The representative model function takes the input samples Mapped to the predicted output.

[0132] The cosine similarity loss measures the cosine of the angle between two vectors, thus reflecting the directional similarity of the feature vectors. For each sample in the cluster, the cosine similarity between its initial feature vector and the reconstructed feature vector is calculated using the following formula:

[0133] (Formula 7)

[0134] in, This represents the cosine similarity loss.

[0135] Among them, the risk minimization loss can be measured by calculating the uncertainty of the model's prediction results on different samples, as shown in the formula:

[0136] (Formula 8)

[0137] in, To minimize losses due to risk; The number of cluster categories; It is the index of the cluster, used to traverse the individual clusters in the cluster collection; Indicates the first The set of all samples of the class; Indicates belonging to a cluster The sample set; It is a model function used to... Mapped to the output space; It is for clusters Reconstruction loss; It's about parameters. The gradient operator represents the gradient of the subsequent function. Regarding parameters Find the gradient. This enables the model to learn a representation that exhibits similar gradient behavior across all clusters, thus achieving cluster invariance.

[0138] Specifically, the weighted risk minimization loss is obtained by multiplying the risk minimization loss by the first adjustment coefficient, that is, the weighted risk minimization loss = ,in, This is the first adjustment factor. Optionally, the first adjustment factor can be any value between 0 and 1.

[0139] The variance penalty term is used to limit the fluctuation of data reconstruction results within the same cluster, ensuring balanced reconstruction performance across each cluster. It calculates the variance of the reconstructed features within each cluster and takes the average as the variance penalty term for that cluster. The formula is as follows:

[0140] (Formula 9)

[0141] in, The calculation results of the variance penalty term, It is the reconstruction loss of each cluster. It is the average loss across all clusters.

[0142] Specifically, the weighted variance penalty term is obtained by multiplying the variance penalty term by the second adjustment coefficient, that is, the weighted variance penalty term = , This is the second adjustment factor. Optionally, the second adjustment factor can be any value between 0 and 1.

[0143] Finally, the mean squared error loss, cosine similarity loss, weighted risk minimization loss, and weighted variance penalty term of each cluster are summed to obtain the intra-class perceptual loss function, as shown in the formula:

[0144] (Formula 10)

[0145] in, This is the intra-class perceptual loss function.

[0146] It should be noted that by setting the first adjustment coefficient and the second adjustment coefficient, the weights of the risk minimization loss and variance penalty term in the intra-class perceptual loss function can be flexibly adjusted according to different dataset characteristics and application scenarios, thereby optimizing the initial reconstructed model training process and enabling the initial reconstructed model to better adapt to diverse time-series data.

[0147] The time-series data anomaly detection method provided in this application integrates mean squared error loss and cosine similarity loss as basic reconstruction losses, and sums them with a weighted risk minimization loss and a variance penalty term. This achieves the fusion of multi-dimensional loss information, enabling the initial reconstruction model to balance the influence of different loss terms during training. This ensures both the accuracy of reconstruction and enhances the robustness and generalization ability of the model. Consequently, it helps to more accurately capture the inherent patterns and regularities of time-series data, thereby improving the performance of time-series data anomaly detection.

[0148] Figure 4 A flowchart illustrating a time-series data anomaly detection method provided in an embodiment of this application. Figure 2 ;like Figure 4 As shown in the figure, as an optional implementation, based on any of the above embodiments, the anomaly detection score corresponding to each data point in the initial time series dataset is determined based on the target reconstruction features, specifically including the following steps:

[0149] S2031. Determine the cosine similarity complement based on the target reconstruction features and the initial features; and determine the Euclidean norm difference between the target reconstruction features and the initial features.

[0150] For each data point, the target reconstructed feature vector and the initial feature vector are used to calculate their cosine similarity complement, as shown in the formula:

[0151] (Formula 11)

[0152] in, Cosine similarity complement Reconstruct the feature vector for the target. Initial feature vector. The Euclidean norm difference between the target reconstructed features and the initial features is expressed as: .

[0153] The Euclidean norm difference numerically reflects the distance between two features.

[0154] S2032. Based on the cosine similarity complement and the difference in Euclidean norm, determine the preliminary fusion score corresponding to each data point in the initial time series dataset.

[0155] Specifically, the preliminary fusion score can be obtained by summing the difference between the pre-similarity complement and the Euclidean norm.

[0156] S2033. Perform an upsampling operation on the preliminary fusion score to determine the anomaly detection score corresponding to each data point in the initial time series dataset.

[0157] Because the dimensionality and granularity of the data may change during feature extraction and reconstruction, the resolution of the initial fusion score may differ from that of the initial time-series data. To ensure that the anomaly detection score accurately corresponds to each initial data point, an upsampling operation is employed. For example, linear interpolation, bilinear interpolation, or other upsampling algorithms can be used to calculate the anomaly detection score that corresponds one-to-one with each original time-series data point, based on the position of the initial fusion score and the relationship between adjacent scores. Specifically, the expression for the anomaly detection score is:

[0158] (Formula 12)

[0159] Where S represents the anomaly detection score, and Upsample represents the upsampling operation, which is used to increase the resolution or sampling rate of the data. The specific implementation methods can be linear interpolation, bicubic interpolation, etc.

[0160] The time-series data anomaly detection method provided in this application determines a preliminary fusion score by combining the cosine similarity complement and the Euclidean norm difference. This allows for a comprehensive measurement of the degree of mismatch between features from two dimensions: directional and numerical differences in feature vectors. The cosine similarity complement highlights the directional differences between feature vectors, while the Euclidean norm difference numerically quantifies the distance between features. The combination of these two factors more comprehensively reflects the degree of data anomaly. By upsampling the preliminary fusion score, the score resolution can be increased to a granularity matching the original time-series data, enabling the anomaly detection score to more accurately correspond to each data point, thereby more precisely detecting anomalous data.

[0161] Figure 5 A flowchart illustrating a time-series data anomaly detection method provided in an embodiment of this application. Figure 3 The execution entity in this embodiment is a time-series data anomaly detection device, such as... Figure 5 As shown in the figure, the time-series data anomaly detection method provided in this embodiment specifically includes the following steps:

[0162] S211. Obtain the initial time series dataset.

[0163] S212. Process the data in the initial time series dataset to generate a heatmap.

[0164] S213. Input the heatmap into the visual model that has been trained to convergence for feature extraction to obtain initial features.

[0165] S214. The cross-attention module in the reconstructed model trained to convergence is used to perform attention calculation on the initial features and the learnable reference features to obtain the target reconstructed features; wherein, the learnable reference features are generated by the learnable reference module in the reconstructed model trained to convergence.

[0166] S215. Based on the target reconstruction features and initial features, determine the preliminary fusion score corresponding to each data point in the initial time series dataset.

[0167] S216. Perform an upsampling operation on the preliminary fusion score to determine the anomaly detection score corresponding to each data point in the initial time series dataset.

[0168] S217. If the anomaly detection score is greater than the preset score threshold, the data corresponding to the anomaly detection score is determined to be abnormal data.

[0169] S218. Set the color of abnormal data in the image to the first color, and set the color of normal data in the image to the second color.

[0170] Specifically, the first color and the second color are used to distinguish between abnormal data and normal data. In this embodiment, the first color is red and the second color is blue.

[0171] In this embodiment, the implementation method and technical effect of steps 211-218 are similar to those of the corresponding solutions in the above embodiments, and will not be repeated here.

[0172] Figure 6 This is a schematic diagram of the structure of a timing data anomaly detection device provided in an embodiment of this application, as shown below. Figure 6 As shown, the timing data anomaly detection device provided in this embodiment is located in an electronic device. The timing data anomaly detection device 30 provided in this embodiment includes: a preprocessing module 31, a reconstruction module 32, a detection module 33, and a determination module 34.

[0173] The preprocessing module 31 is used to acquire the initial time-series dataset and normalize the data in the initial time-series dataset to obtain intermediate time-series data. The preprocessing module 31 is also used to map the intermediate time-series data to different pixel intensity values ​​to generate a heatmap image. The heatmap image serves as the initial data representation image. The reconstruction module 32 is used to extract features from the initial data representation image using a visual model that has been trained to convergence to obtain initial features. The reconstruction module 32 is also used to input the initial features into a reconstruction model that has been trained to convergence for feature reconstruction to obtain target reconstruction features. The detection module 33 is used to determine the anomaly detection score corresponding to each data in the initial time-series dataset based on the target reconstruction features. The determination module 34 is used to determine that the data corresponding to the anomaly detection score is anomaly data if the anomaly detection score is greater than a preset score threshold.

[0174] Optionally, the reconstructed model trained to convergence includes a learnable reference module and a cross-attention module.

[0175] Optionally, when the initial features are input into the converged reconstruction model for feature reconstruction to obtain the target reconstructed features, the reconstruction module 32 is specifically used to: generate learnable reference features based on the learnable reference module; and perform attention calculation on the initial features and the learnable reference features using the cross-attention module to obtain the target reconstructed features; wherein the initial features serve as the query of the cross-attention module, and the learnable reference features serve as the key and value of the cross-attention module.

[0176] Optionally, the time-series data anomaly detection device also includes a training module.

[0177] Optionally, the training module is used to train the initial reconstruction model using an intra-class perceptual loss function to obtain a reconstructed model that has been trained to convergence; wherein, the step of obtaining the intra-class perceptual loss function includes: dividing the training sample data using a clustering algorithm to generate multiple clusters; and determining the intra-class perceptual loss function based on the basic reconstruction loss, risk minimization loss, and variance penalty term of each cluster.

[0178] Optionally, the basic reconstruction loss includes mean squared error loss and cosine similarity loss.

[0179] Optionally, when determining the intra-class perception loss function based on the basic reconstruction loss, risk minimization loss, and variance penalty term for each cluster, the training module specifically performs the following: summing the mean squared error loss, cosine similarity loss, weighted risk minimization loss, and weighted variance penalty term for each cluster to obtain the intra-class perception loss function; wherein, the weighted risk minimization loss is obtained by multiplying the risk minimization loss by the first adjustment coefficient; and the weighted variance penalty term is obtained by multiplying the variance penalty term by the second adjustment coefficient.

[0180] Optionally, the detection module 33, when determining the anomaly detection score corresponding to each data point in the initial time-series dataset based on the target reconstruction features, specifically performs the following steps: determining the cosine similarity complement based on the target reconstruction features and the initial features; determining the Euclidean norm difference between the target reconstruction features and the initial features; determining the preliminary fusion score corresponding to each data point in the initial time-series dataset based on the cosine similarity complement and the Euclidean norm difference; and performing an upsampling operation on the preliminary fusion score to determine the anomaly detection score corresponding to each data point in the initial time-series dataset.

[0181] Optionally, the time-series data anomaly detection device further includes a marking module. Optionally, after determining that the data corresponding to the anomaly detection score is anomalous data, the marking module is used to: set the pixel region corresponding to the anomalous data in the initial data representation image to a first color, and set the pixel region corresponding to the normal data to a second color, so as to distinguish and display anomalous data from normal data.

[0182] Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application, as shown below. Figure 7 As shown, the electronic device 40 provided in this embodiment includes a processor 42 and a memory 41 communicatively connected to the processor 42.

[0183] The memory 41 stores computer-executed instructions; the processor 42 executes the computer-executed instructions stored in the memory 41 to implement the timing data anomaly detection method provided in any of the above embodiments.

[0184] The program may include program code, which includes computer-executable instructions. Memory 41 may include high-speed RAM, and may also include non-volatile memory, such as at least one disk storage device.

[0185] In this embodiment, the memory 41 and the processor 42 are connected via a bus. The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 7 The bus is represented by a single straight line, but this does not mean that there is only one bus or one type of bus.

[0186] This application also provides a computer-readable storage medium, including computer-executable instructions stored in the computer-readable storage medium. When the computer-executable instructions are executed by a processor, they are used to implement the timing data anomaly detection method provided in any of the above embodiments.

[0187] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the timing data anomaly detection method provided in any of the above embodiments.

[0188] In the above embodiments, it should be understood that the processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this invention can be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules within the processor.

[0189] The aforementioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The readable storage medium can be any available medium accessible to a general-purpose or special-purpose computer.

[0190] An exemplary readable storage medium is coupled to a processor, enabling the processor to read information from and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can reside in an Application Specific Integrated Circuit (ASIC). Alternatively, the processor and the readable storage medium can exist as discrete components in the device.

[0191] The division of units is merely a logical functional division; in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be indirect coupling or communication connection through some interfaces, devices, or units, and may be electrical, mechanical, or other forms.

[0192] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0193] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0194] If a function is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0195] Those skilled in the art will understand that all or part of the steps of the above-described method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments; and the aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.

[0196] Finally, it should be noted that other embodiments of the invention will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This invention is intended to cover any variations, uses, or adaptations of the invention that follow the general principles of the invention and include common knowledge or customary techniques in the art not disclosed herein, and is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of the invention is limited only by the appended claims.

Claims

1. A method for detecting anomalies in time-series data, characterized in that, include: Obtain an initial time series dataset and normalize the data in the initial time series dataset to obtain intermediate time series data; The intermediate time-series data is mapped to different pixel intensity values ​​to generate a heatmap image; The heatmap image serves as the initial data representation image; The initial data representation image is used to extract features using a visual model trained to convergence, in order to obtain initial features; The initial features are input into the reconstructed model trained to convergence for feature reconstruction to obtain the target reconstructed features; Based on the target reconstruction features, the anomaly detection score corresponding to each data point in the initial time series dataset is determined; If the anomaly detection score is greater than a preset score threshold, the data corresponding to the anomaly detection score is determined to be abnormal data.

2. The method according to claim 1, characterized in that, The reconstructed model trained to convergence includes a learnable reference module and a cross-attention module; The step of inputting the initial features into a converged reconstruction model for feature reconstruction to obtain the target reconstructed features includes: Learnable reference features are generated based on the learnable reference module; The cross-attention module is used to perform attention calculation on the initial features and the learnable reference features to obtain the target reconstruction features; wherein, the initial features serve as the query of the cross-attention module, and the learnable reference features serve as the key and value of the cross-attention module.

3. The method according to claim 1, characterized in that, Also includes: The initial reconstruction model is trained using an intra-class perceptual loss function to obtain the reconstructed model that has been trained to convergence. The step of obtaining the intra-class perceptual loss function includes: Clustering algorithms are used to divide the training sample data into multiple clusters; The intra-class perception loss function is determined based on the basic reconstruction loss, risk minimization loss, and variance penalty term for each cluster.

4. The method according to claim 3, characterized in that, The basic reconstruction loss includes mean squared error loss and cosine similarity loss; The intra-class perception loss function is determined based on the basic reconstruction loss, risk minimization loss, and variance penalty term for each cluster, including: The mean squared error loss, cosine similarity loss, weighted risk minimization loss, and weighted variance penalty term of each cluster are summed to obtain the intra-class perception loss function; wherein, the weighted risk minimization loss is obtained by multiplying the risk minimization loss by the first adjustment coefficient; and the weighted variance penalty term is obtained by multiplying the variance penalty term by the second adjustment coefficient.

5. The method according to claim 1, characterized in that, The step of determining the anomaly detection score corresponding to each data point in the initial time-series dataset based on the target reconstruction features includes: Based on the target reconstructed features and the initial features, the cosine similarity complement is determined; and the Euclidean norm difference between the target reconstructed features and the initial features is determined; Based on the cosine similarity complement and the Euclidean norm difference, the preliminary fusion score corresponding to each data point in the initial time series dataset is determined; An upsampling operation is performed on the preliminary fusion score to determine the anomaly detection score corresponding to each data point in the initial time-series dataset.

6. The method according to any one of claims 1-5, characterized in that, After determining that the data corresponding to the anomaly detection score is anomaly data, the process also includes: The pixel regions corresponding to abnormal data in the initial data representation image are set to the first color, and the pixel regions corresponding to normal data are set to the second color, so as to distinguish and display abnormal data from normal data.

7. A time-series data anomaly detection device, characterized in that, include: The preprocessing module is used to acquire an initial time series dataset and normalize the data in the initial time series dataset to obtain intermediate time series data. The preprocessing module is also used to map the intermediate time series data into different pixel intensity values ​​to generate a heat map image; The heatmap image serves as the initial data representation image; The reconstruction module is used to extract features from the initial data representation image using a visual model trained to convergence, so as to obtain initial features; The reconstruction module is also used to input the initial features into the reconstruction model trained to convergence for feature reconstruction in order to obtain the target reconstruction features; The detection module is used to determine the anomaly detection score corresponding to each data point in the initial time series dataset based on the target reconstruction features; The determination module is used to determine that the data corresponding to the anomaly detection score is abnormal data when the anomaly detection score is greater than a preset score threshold.

8. An electronic device, characterized in that, include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the timing data anomaly detection method as described in any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the timing data anomaly detection method as described in any one of claims 1-6.

10. A computer program product, characterized in that, The method includes a computer program that, when executed by a processor, implements the timing data anomaly detection method according to any one of claims 1-6.

Images