A time series anomaly detection method based on multi-scale mask reconstruction and difference representation

Abstract

The application provides a kind of time series anomaly detection method based on multi-scale mask reconstruction and difference representation, it is related to time series anomaly detection technical field.The application reconstructs input sequence using time series anomaly detection model, obtains mask reconstruction sequence;Based on mask reconstruction sequence and input sequence, calculate anomaly score, judge whether input sequence is abnormal or not.The application constructs leading period mask sequence, guides time series anomaly detection model to be more focused on the learning of periodic structure, improves reconstruction stability.Construct positive and negative samples generated based on leading period and noise disturbance, introduce difference representation mechanism through comparison learning under multi-scale view, expand the separability of normal and abnormal samples in feature space.The double-branch attention coding structure of the application models local changes within time block and global dependence between blocks respectively, constructs a more expressive abnormal representation system, realizes efficient detection of abnormal patterns in complex multivariate time series data.

Description

Technical Field

[0001] This invention belongs to the field of time anomaly detection technology, and particularly relates to a time anomaly detection method based on multi-scale mask reconstruction and difference representation. Background Technology

[0002] With the widespread deployment of sensors, information systems, and data acquisition equipment in applications such as industrial process monitoring, intelligent manufacturing, equipment operation and maintenance, cybersecurity, and financial risk control, multivariate time series data is showing a continuous growth trend. Time series anomaly detection aims to identify abnormal points, abnormal intervals, or abnormal patterns that deviate from the normal evolution pattern from continuously acquired time series data. It has significant application value in equipment fault early warning, operational status assessment, risk identification, and system health management. Because abnormal events in real-world scenarios are typically characterized by low probability of occurrence, high annotation difficulty, and high manual costs, most existing time series anomaly detection technologies adopt unsupervised or weakly supervised methods. These methods learn the inherent variation patterns of time series using normal samples and identify anomalies based on the degree of deviation between the tested sequence and the normal pattern.

[0003] Existing time series anomaly detection methods mainly fall into the following categories: One category is reconstruction-based anomaly detection methods, which typically utilize models such as autoencoders, variational autoencoders, and recurrent neural networks to extract features and reconstruct data from normal time series, determining the degree of anomaly based on the error between the input sequence and the reconstructed sequence. Another category is methods based on temporal dependency modeling, which usually employ attention mechanisms or Transformer structures to model the correlations between different time positions in the time series, thereby uncovering temporal dependency differences between anomalous and normal patterns. Additionally, there is a category of anomaly detection methods based on representation learning or contrastive learning. These methods enhance the model's ability to distinguish between normal and anomalous patterns by constructing temporal representations under different views, thereby improving anomaly detection accuracy. These methods have respectively promoted the development of time series anomaly detection technology in terms of reconstruction capability, global dependency modeling capability, and feature representation discrimination capability.

[0004] However, existing technologies still have the following shortcomings: First, reconstruction-based detection methods typically use a single reconstruction error as the criterion for anomaly discrimination. During training, the model may simultaneously possess the ability to reconstruct some anomalous patterns, resulting in insufficiently significant differences between normal and anomalous samples, thus affecting detection accuracy. Second, while existing dependency modeling methods can capture long-term temporal correlations to some extent, they often lack a unified and effective modeling mechanism for anomalous patterns at different time scales, such as short-term mutations, local perturbations, and long-term drifts, making it difficult to balance local features and global dependency information. Third, existing representation learning or contrastive learning methods are usually relatively simple in constructing anomalous representations, lacking sufficient coverage of complex, structural, and multi-scale anomalies, resulting in limited model representation capabilities for anomalous patterns. Therefore, there is an urgent need to provide a time series anomaly detection method that can model time series from multiple scales and combine reconstruction and difference representation information to enhance anomaly discrimination capabilities, thereby improving the accuracy and robustness of multivariate time series anomaly detection in complex scenarios. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention provides a temporal anomaly detection method based on multi-scale mask reconstruction and difference representation, which overcomes the deficiencies of existing temporal anomaly detection models, such as insufficient reconstruction stability, limited multi-scale feature modeling capabilities, and low anomaly representation discriminability.

[0006] This invention provides a method for detecting temporal anomalies based on multi-scale mask reconstruction and difference representation, comprising the following steps:

[0007] Obtain the input sequence;

[0008] A time-series anomaly detection model is constructed, and the input sequence is reconstructed using the time-series anomaly detection model to obtain the masked reconstructed sequence;

[0009] Anomaly scores are calculated based on the masked reconstructed sequence and the input sequence, and the anomaly score is used to determine whether the input sequence is abnormal.

[0010] The temporal anomaly detection model includes a dominant periodic mask module, a noise injection module, a multi-scale block module, a dual-branch attention encoder, and a decoding and reconstruction module.

[0011] The dominant period mask module is used to extract the dominant period of the input sequence and generate a dominant period mask sequence;

[0012] The noise injection module is used to inject Gaussian noise into the input sequence to generate a negative sample sequence;

[0013] The multi-scale segmentation module is used to segment the dominant periodic mask sequence and the negative sample sequence into blocks, resulting in dominant periodic segmented sequences and negative sample segmented sequences.

[0014] The dual-branch attention encoder is used to extract features from the dominant periodic block sequence and the negative sample block sequence, respectively, to obtain the encoded sequences of the dominant periodic block sequence and the negative sample block sequence;

[0015] The decoding and reconstruction module is used to decode and reconstruct the encoded sequence based on the dominant periodic block sequence and the negative sample block sequence to obtain the mask reconstruction sequence.

[0016] Furthermore, the input sequence is multivariate time series data obtained by periodically or continuously collecting the operating status of the target object. The target object includes industrial equipment, production systems, servers, network nodes, or other monitored objects. The multivariate time series data includes observations from multiple sensors or multiple monitoring dimensions.

[0017] Furthermore, the specific method for extracting the dominant period of the input sequence and generating the dominant period mask sequence is as follows:

[0018] Perform a Fast Fourier Transform on the input sequence and calculate the frequency-energy average spectrum of the input sequence. Select the first... The frequency with the highest energy is selected as the dominant frequency; the sampling period corresponding to each dominant frequency is calculated, and the sampling period is sampled at a random starting position to generate a mask matrix; a dominant period mask sequence is generated based on the input sequence and the mask matrix.

[0019] Furthermore, the specific method for injecting Gaussian noise into the input sequence is as follows: Gaussian noise is injected into the input sequence in a random manner.

[0020] Furthermore, the specific method for segmenting the dominant periodic mask sequence and the negative sample sequence is as follows:

[0021] The dominant periodic mask sequence and the negative sample sequence are divided into blocks using windows of different scales, resulting in multiple dominant periodic block sequences and negative sample block sequences of different scales. Each dominant periodic block sequence and negative sample block sequence of different scales includes multiple time blocks of different scales.

[0022] Furthermore, the dual-branch attention encoder includes a cross-attention branch and a multi-head self-attention branch; the cross-attention branch is used to extract local feature representations, and the multi-head self-attention branch is used to extract global feature representations.

[0023] The dominant periodic block sequence and the negative sample block sequence at each scale are input into the dual-branch attention encoder. For any block sequence, the specific method for extracting local feature representations is as follows:

[0024] The block sequence is input into the cross-attention branch, and linear embedding is performed on the block sequence including multiple time blocks to obtain the corresponding embedding vector. The key vector and value vector of the linear embedding are calculated based on the trainable linear layer, and a learnable query aggregation vector is introduced to calculate the cross-attention score of each time block. The cross-attention scores of all time blocks are concatenated to obtain the local feature representation.

[0025] The specific method for extracting global feature representations is as follows:

[0026] The block sequence is input into the multi-head self-attention branch, and the block sequence including multiple time blocks is embedded along the feature dimension. The features of each time block are flattened to obtain the inter-block attention space representation of each time block. The inter-block attention space representations of all time blocks are concatenated to obtain the inter-block attention space representation of the dominant period block sequence, which is then input into the linear layer to extract the query vector, key vector, and value vector. The global feature representation is calculated based on the dot product attention mechanism.

[0027] The local feature representation and the global feature representation are added element by element to obtain the encoded sequence of the block sequence.

[0028] Furthermore, the specific method for decoding and reconstructing the encoded sequences based on the dominant periodic block sequence and the negative sample block sequence is as follows:

[0029] The encoded sequence of time blocks in the dominant periodic block sequence is decoded, and the dimension of the decoded encoded sequence is mapped to the same data dimension as the input sequence to obtain the mask reconstruction sequence.

[0030] Furthermore, the loss function of the time-series anomaly detection model includes reconstruction loss and difference loss;

[0031] The reconstruction loss is used to calculate the reconstruction error between the masked reconstruction sequence and the input sequence;

[0032] The encoded sequence output by the dual-branch attention encoder for time blocks in the dominant periodic block sequence is used as the positive sample hidden representation, and the encoded sequence output by the dual-branch attention encoder for time blocks in the negative sample block sequence is used as the negative sample hidden representation.

[0033] The difference loss is used to calculate the difference between the normal sample hidden representation and the negative sample hidden representation.

[0034] Furthermore, anomaly scores are calculated based on the masked reconstructed sequence and the input sequence. The specific method for determining whether anomalies exist in the input sequence based on the anomaly scores is as follows:

[0035] calculate The input sequence of time steps and Anomaly scores of time-step mask reconstruction sequences are generated based on anomaly scores of multiple consecutive time steps;

[0036] Set a global threshold when When the abnormal score at a time step is higher than the global threshold, a judgment is made. If the input sequence at the time step is abnormal, the abnormal score sequence is converted into a binary judgment result based on the global threshold.

[0037] The beneficial effects of adopting the above technical solution are as follows: This invention provides a time-series anomaly detection method based on multi-scale mask reconstruction and differential representation. Addressing the problems of unstable model reconstruction, weak anomaly feature discriminativeness, and poor multi-scale anomaly adaptability in the current unsupervised time-series anomaly detection field, it proposes an end-to-end modeling scheme that integrates frequency domain awareness, multi-scale block partitioning, and a dual-branch attention mechanism. In terms of reconstruction modeling, this invention introduces a dominant periodicity mask strategy. By extracting the dominant frequency components in the time series through Fast Fourier Transform (FFT), a dominant periodicity mask sequence is constructed, guiding the time-series anomaly detection model to focus more on learning periodic structures, thereby enhancing the model's ability to fit normal patterns and improving reconstruction stability. In terms of anomaly discrimination, this invention constructs positive and negative samples based on dominant periodicity and noise perturbation. Through contrastive learning under a multi-scale view, a differential representation mechanism is introduced, effectively expanding the separability of normal and anomalous samples in the feature space and improving the model's robustness in recognizing diverse anomaly patterns (such as sudden changes and trend shifts). Furthermore, this invention designs a dual-branch attention encoding structure, which models local changes within time blocks and global dependencies between blocks respectively. By combining reconstruction error and representation difference for joint optimization, a more expressive anomaly representation system is constructed, ultimately achieving efficient detection of anomaly patterns in complex multivariate time series data. Attached Figure Description

[0038] Figure 1 A schematic diagram of the temporal anomaly detection model structure for multi-scale mask reconstruction and difference representation provided in Embodiment 1 of the present invention;

[0039] Figure 2 The flowchart of the dominant periodic mask module generating the dominant periodic mask provided in Embodiment 1 of the present invention;

[0040] Figure 3 A schematic diagram of the dual-branch attention encoder structure provided in Embodiment 1 of the present invention. Detailed Implementation

[0041] The specific implementation methods of this application will be further described in detail below with reference to the accompanying drawings and embodiments.

[0042] Example 1:

[0043] A temporal anomaly detection method based on multi-scale mask reconstruction and difference representation, such as... Figure 1 As shown, it includes the following steps:

[0044] Step 1: Obtain the input sequence;

[0045] In some implementation scenarios, the input sequence is multivariate time series data obtained by periodically or continuously collecting data on the operating status of a target object. The target object includes, but is not limited to, industrial equipment, production systems, servers, network nodes, energy equipment, manufacturing lines, or other monitored objects. The multivariate time series data may include operating status observations collected by sensors, control systems, log collection systems, or network monitoring systems.

[0046] This embodiment takes an industrial centrifugal pump unit as an example. Sensors deployed on the centrifugal pump bearings, motor, inlet and outlet pipelines, and pump body periodically collect multi-dimensional operating status parameters such as bearing temperature, motor current, motor voltage, pump body vibration acceleration, inlet pressure, outlet pressure, flow rate, speed, and lubricating oil temperature during the operation of the centrifugal pump. These parameters are then arranged in chronological order to form multivariate time series data, which serves as the input sequence for the time series anomaly detection model in this embodiment.

[0047] Step 2: Construct a temporal anomaly detection model based on multi-scale mask reconstruction and difference representation, and reconstruct the input sequence to obtain the mask reconstruction sequence;

[0048] The temporal anomaly detection model includes a dominant periodic mask module, a noise injection module, a multi-scale block segmentation module, a dual-branch attention encoder, and a decoding and reconstruction module;

[0049] Step 2.1: Construct a dominant periodic mask module to extract the dominant period of the input sequence and generate a dominant periodic mask sequence;

[0050] like Figure 2 As shown, the frequency components of the input sequence are analyzed using Fast Fourier Transform (FFT) to extract the dominant period, and samples are used for mask construction based on their energy proportions. For the input sequence... Perform a Fast Fourier Transform, as shown in the following formula:

[0051] ;

[0052] in, For Fast Fourier Transform, The amplitude of each frequency component of the input sequence;

[0053] Calculate the frequency-energy average spectrum of the input sequence:

[0054] ;

[0055] in, The dimension is the number of subsequences. For the first The amplitude of each frequency component is used to determine the importance of each frequency component based on the average spectral energy of each frequency component in historical data.

[0056] Before selection The frequency with the highest energy is taken as the dominant frequency, the... dominant frequency Corresponding sampling period for:

[0057] ;

[0058] in, The length of the input sequence;

[0059] For sampling period Perform random starting position sampling to generate a mask matrix. Generate dominant periodic mask sequences based on mask matrices As shown in the formula below:

[0060] ;

[0061] Step 2.2: Based on the noise injection module, Gaussian noise is randomly injected into the input sequence to simulate abnormal perturbations and generate a negative sample sequence. As shown in the formula below:

[0062] ;

[0063] in, It is Gaussian noise;

[0064] Step 2.3: Construct a multi-scale segmentation module, using multiple windows of different scales to segment the dominant periodic mask sequence and the negative sample sequence, resulting in multiple dominant periodic segmented sequences and negative sample segmented sequences of different scales. Each dominant periodic segmented sequence and negative sample segmented sequence of different scales includes multiple time blocks of different scales.

[0065] This embodiment is designed A window of a certain scale The dominant periodic mask sequence The time blocks are divided into multiple windows to obtain a dominant periodic block sequence that includes time blocks of multiple scales. As shown in the formula below:

[0066] ;

[0067] in, For the first One time block; For the first Windows of different sizes;

[0068] Similarly, using The negative sample sequence is divided into blocks using windows of multiple scales, resulting in a negative sample block sequence comprising time blocks of multiple scales. ;

[0069] Step 2.4: Construct a dual-branch attention encoder. Input the dominant periodic block sequence and the negative sample block sequence into the dual-branch attention encoder to obtain the dual-branch attention encoder outputs of the dominant periodic block sequence and the negative sample block sequence, respectively.

[0070] The dual-branch attention encoder in this embodiment is as follows: Figure 3 As shown, it includes a cross-attention branch and a multi-head self-attention branch; the cross-attention branch is used to perform local modeling for each time block and extract local feature representations; the multi-head self-attention branch is used to perform global modeling between multiple time blocks and extract global feature representations. The local feature representations and global feature representations are fused to obtain the output of the dual-branch attention encoder.

[0071] Divide the dominant periodic sequence Input cross-attention branch, in which, for... The dominant periodic block sequence of each time block Perform linear embedding to divide the dominant periodic block sequence Projected onto the attention space dimension; where, the first Time block The embedding vector is obtained after projection onto the attention space. ,in, Indicates cross-attention branches, The length of the time block. For time block dimension, The dimension of the time block in the attention space;

[0072] Then embedding vector The key vectors are obtained after passing through a trainable linear layer. Sum value vector This embodiment introduces a learnable query aggregation vector. It is used to aggregate contextual information within a time block and calculates the first time block using a dot product attention mechanism. Cross-attention scores for each time block As shown in the formula below:

[0073] ;

[0074] Will The cross-attention scores of each time block are concatenated to obtain the local feature representation of the dominant periodic block sequence. As shown in the formula below:

[0075] ;

[0076] The method for extracting local feature representations of negative sample block sequences by inputting them into the cross-attention branch is the same as the method for extracting local feature representations of dominant period block sequences, and will not be repeated here.

[0077] The dominant periodic block sequence is input into the multi-head self-attention branch, which is responsible for extracting the global dependencies between multiple time blocks. Embedding is performed along the feature dimension, and the features of each time block are flattened to obtain the inter-block attention space representation of each time block. ,in, This indicates a multi-head self-attention branch. .Will The inter-block attention space representations of each time block are concatenated to obtain the inter-block attention space representation of the dominant periodic block sequence. Use linear mapping to extract the inter-block attention space representation. query vector Key vector Sum value vector ;

[0078] Global feature representation is calculated based on the dot product attention mechanism. As shown in the formula below:

[0079] ;

[0080] The method for extracting the global feature representation of the negative sample block sequence by inputting it into the multi-head self-attention branch is the same as the method for extracting the global feature representation of the dominant periodic block sequence, and will not be repeated here.

[0081] The local feature representation is computed through a linear layer, expanding it back to the original time block length dimension. Then, it is added element-wise with the global feature representation to obtain the time block. The encoded sequence output by the dual-branch attention encoder As shown in the formula below:

[0082] ;

[0083] in, Linear layer;

[0084] Step 2.5: Construct a decoding and reconstruction module to decode and reconstruct the encoded sequence output by the dual-branch attention encoder, obtaining the masked reconstruction sequence. ;

[0085] Time blocks in the dominant periodic block sequence The encoded sequence output by the dual-branch attention encoder As a hidden representation of positive samples The negative sample block sequence is divided into time blocks. The encoded sequence output by the dual-branch attention encoder As a negative sample hidden representation As shown in the formula below:

[0086] ;

[0087] in, Indicates the use of extracting the first A dual-branch attention encoder for each time block;

[0088] The positive sample hidden representation is input into the decoding and reconstruction module, mapped back to the original data dimension, and the output is the mask reconstruction sequence. .

[0089] Step 2.6: Construct the loss function for the time series anomaly detection model, which is used to train the time series anomaly detection model;

[0090] The temporal anomaly detection model performs reconstruction learning at multiple scales, and defines the reconstruction loss based on the mean squared error. The average reconstruction error across all scales is given by the following formula:

[0091] ;

[0092] in, for The first time step of the input sequence A time block, for The first time step of the input sequence A sequence of mask reconstructions for each time block;

[0093] The purpose of the difference representation is to increase the representation distance between positive and negative samples while decreasing the representation distance between positive samples. In this embodiment, positive sample representations at the same time step but at different scales are considered as positive sample pairs. Negative sample pairs are of three types: first, representations at different time steps at the same scale; second, representations at different time steps in different views; and third, representations of positive samples and all negative samples. A contrastive learning objective is constructed based on dot product similarity, using the hidden representation of the positive sample at the first scale as the anchor point. The difference is compared point-by-point, and the difference loss is defined as:

[0094] ;

[0095] Based on reconstruction loss and difference loss, the loss function of the temporal anomaly detection model is established as shown in the following formula:

[0096] ;

[0097] in, and All are weighting coefficients;

[0098] During training, a loss function is jointly used to minimize the mask reconstruction error and maximize the difference between positive and negative sample representations. Positive and negative samples are constructed through a dominant periodic mask and noise perturbation mechanism. The reconstruction loss is used to model the normal data distribution, while the difference loss is used to distinguish potential anomalous data representations. This synergistic approach improves the model's sensitivity and robustness to anomalous patterns from two perspectives.

[0099] Step 3: Reconstruct the sequence based on the mask and input sequence Calculate the anomaly score, perform anomaly detection on the input sequence based on the anomaly score, and obtain the anomaly detection result of the input sequence;

[0100] Input sequence of time steps and mask reconstruction sequence of time steps The abnormal score is shown in the following formula:

[0101] ;

[0102] The anomaly score is used as the basis for judging anomalies; the higher the anomaly score, the more abnormal it is. Input sequence of time steps The more difficult it is to be reconstructed by a temporal anomaly detection model, the higher the probability of an anomaly; this can be achieved through a global threshold. This converts a continuous sequence of outlier scores into a binary judgment result, with a global threshold. It can be determined by statistically analyzing the percentage of anomalies in historical data.

[0103] To verify the performance of the temporal anomaly detection method based on multi-scale mask reconstruction and difference representation provided in this embodiment, comparative experiments were conducted on three publicly available real-world temporal anomaly detection datasets. The specific dataset information is shown in Table 1, and the experimental environment is shown in Table 2.

[0104] Table 1. Dataset Information;

[0105]

[0106] Table 2 Experimental Environment;

[0107]

[0108] The experimental results are shown in Table 3. As can be seen from Table 3, the MRDetector model proposed in this embodiment shows superior detection performance on three real-world multivariate time series datasets (MSL, SMAP, and PSM), which is significantly better than existing mainstream unsupervised anomaly detection models, including LSTM-VAE, OmniAnomaly, THOC, AnomalyTransformer, and DCdetector.

[0109] Table 3. Comparison of prediction performance;

[0110]

[0111] To measure anomaly detection performance, the experiment employed evaluation metrics that better reflect temporal characteristics, including Association Precision (Aff-P), Association Recall (Aff-R), and Association F1 Score (Aff-F1). Compared to the best baseline model, the MRDetector in this embodiment achieved significant improvements across all metrics: on the MSL dataset, Aff-P improved by 13.86%, and Aff-F1 improved by 8.48%; on the SMAP dataset, Aff-P, Aff-R, and Aff-F1 improved by 5.49%, 0.48%, and 3.7%, respectively; and on the PSM dataset, Aff-P, Aff-R, and Aff-F1 improved by 14.18%, 9.25%, and 11.1%, respectively.

[0112] This embodiment introduces a frequency domain analysis method, utilizing Fast Fourier Transform (FFT) to extract the dominant frequency components in the input sequence, determine the main periodic structure, and design a probabilistic sampling strategy based on the frequency energy distribution to construct periodic masking regions. This masking strategy not only enhances the model's ability to learn the periodic structure of normal patterns but also avoids the interference of traditional random masks on non-periodic information, significantly improving the reconstruction learning effect. To address the performance differences of anomalous patterns at different time scales, a multi-scale time window segmentation scheme is designed. This scheme captures sudden anomalies within a short window and perceives trend shifts within a long window, giving the time-series anomaly detection model stronger cross-scale perception capabilities and providing a structural foundation for subsequent local and global modeling. A dual-branch attention encoder is constructed, building attention channels within and between time blocks to capture local change patterns and global dependencies, respectively. Compared to the traditional single-channel structure, this design significantly enhances the richness and expressiveness of feature extraction, effectively improving the contextual modeling performance of anomaly detection.

[0113] Example 2:

[0114] This embodiment proposes an electronic device, including: one or more processors, and a memory, wherein the memory is used to store instructions, and when the instructions are executed by the one or more processors, the one or more processors execute the aforementioned temporal anomaly detection method based on multi-scale mask reconstruction and difference representation.

[0115] The electronic device may be a mobile phone, computer, or tablet computer, etc., and includes a memory and a processor. The memory stores a computer program, which, when executed by the processor, implements the temporal anomaly detection method based on multi-scale mask reconstruction and difference representation as described in the embodiments. It is understood that the electronic device may also include input / output (I / O) interfaces and communication components.

[0116] The processor is used to execute all or part of the steps in the temporal anomaly detection method based on multi-scale mask reconstruction and difference representation as described in the above embodiments. The memory is used to store various types of data, which may include, for example, instructions for any application or method in the electronic device, as well as application-related data.

[0117] The processor can be implemented as an Application Specific Integrated Circuit (ASIC), Digital Signal Processor (DSP), Programmable Logic Device (PLD), Field Programmable Gate Array (FPGA), controller, microcontroller, microprocessor, or other electronic components, and is used to execute the timing anomaly detection method based on multi-scale mask reconstruction and difference representation described in the above embodiments.

[0118] Example 3:

[0119] This embodiment proposes a computer-readable storage medium that stores executable instructions. When these instructions are executed, if they are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium.

[0120] The computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the temporal anomaly detection method based on multi-scale mask reconstruction and difference representation described in the various embodiments of this application.

[0121] The aforementioned storage media include: flash memory, hard disks, multimedia cards, card-type memory (e.g., SD (Secure Digital Memory Card) or DX (Memory Data Register, MDR) memory), random access memory (RAM), static random-access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic storage, disks, optical discs, servers, APP (Application) application stores, and other media capable of storing program verification codes. These media store computer programs, which, when executed by a processor, can implement the various steps of the aforementioned timing anomaly detection method based on multi-scale mask reconstruction and difference representation.

[0122] Example 4:

[0123] This embodiment proposes a computer program product, including a computer program or instructions, which, when executed by a processor, implements the aforementioned temporal anomaly detection method based on multi-scale mask reconstruction and difference representation.

[0124] Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or part of the technical solution, can be embodied in the form of a computer program product.

[0125] The various embodiments in this application are described in a progressive manner. The same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on describing the differences from other embodiments.

[0126] The scope of protection of this application is not limited to the embodiments described above. Obviously, those skilled in the art can make various modifications and variations to this disclosure without departing from the scope and spirit of this disclosure. If such modifications and variations fall within the scope of this disclosure and its equivalents, then the intent of this disclosure also includes these modifications and variations.

Claims

1. A temporal anomaly detection method based on multi-scale mask reconstruction and difference representation, characterized in that, Includes the following steps: The input sequence is obtained as multivariate time series data obtained by periodically or continuously collecting data on the operating status of a target object. The target object includes industrial equipment, production systems, servers, network nodes, or other monitored objects. The multivariate time series data includes observations from multiple sensors or multiple monitoring dimensions. A time-series anomaly detection model is constructed, and the input sequence is reconstructed using the time-series anomaly detection model to obtain the masked reconstructed sequence; Anomaly scores are calculated based on the masked reconstructed sequence and the input sequence, and the anomaly score is used to determine whether the input sequence is abnormal. The temporal anomaly detection model includes a dominant periodic mask module, a noise injection module, a multi-scale block module, a dual-branch attention encoder, and a decoding and reconstruction module. The dominant period mask module is used to extract the dominant period of the input sequence and generate a dominant period mask sequence; The noise injection module is used to inject Gaussian noise into the input sequence to generate a negative sample sequence; The multi-scale segmentation module is used to segment the dominant periodic mask sequence and the negative sample sequence into blocks, resulting in dominant periodic segmented sequences and negative sample segmented sequences. The dual-branch attention encoder is used to extract features from the dominant periodic block sequence and the negative sample block sequence, respectively, to obtain the encoded sequences of the dominant periodic block sequence and the negative sample block sequence; The decoding and reconstruction module is used to decode and reconstruct the encoded sequence based on the dominant periodic block sequence and the negative sample block sequence to obtain the mask reconstruction sequence.

2. The temporal anomaly detection method based on multi-scale mask reconstruction and difference representation according to claim 1, characterized in that, The specific method for extracting the dominant period of the input sequence and generating the dominant period mask sequence is as follows: Perform a Fast Fourier Transform on the input sequence and calculate the frequency-energy average spectrum of the input sequence. Select the first... The frequency with the highest energy is taken as the dominant frequency; Calculate the sampling period corresponding to each dominant frequency, select a random starting position to sample the sampling period, and generate a mask matrix; Generate a dominant periodic mask sequence based on the input sequence and the mask matrix.

3. The temporal anomaly detection method based on multi-scale mask reconstruction and difference representation according to claim 1, characterized in that, The specific method for injecting Gaussian noise into the input sequence is as follows: Gaussian noise is injected into the input sequence in a random manner.

4. The temporal anomaly detection method based on multi-scale mask reconstruction and difference representation according to claim 1, characterized in that, The specific method for dividing the dominant periodic mask sequence and the negative sample sequence into blocks is as follows: The dominant periodic mask sequence and the negative sample sequence are divided into blocks using windows of different scales, resulting in multiple dominant periodic block sequences and negative sample block sequences of different scales. Each dominant periodic block sequence and negative sample block sequence of different scales includes multiple time blocks of different scales.

5. The temporal anomaly detection method based on multi-scale mask reconstruction and difference representation according to claim 1, characterized in that, The dual-branch attention encoder includes a cross-attention branch and a multi-head self-attention branch; the cross-attention branch is used to extract local feature representations, and the multi-head self-attention branch is used to extract global feature representations. The dominant periodic block sequence and the negative sample block sequence at each scale are input into the dual-branch attention encoder. For any block sequence, the specific method for extracting local feature representations is as follows: The block sequence is input into the cross-attention branch, and linear embedding is performed on the block sequence including multiple time blocks to obtain the corresponding embedding vector. The key vector and value vector of the linear embedding are calculated based on the trainable linear layer, and a learnable query aggregation vector is introduced to calculate the cross-attention score of each time block. The cross-attention scores of all time blocks are concatenated to obtain the local feature representation. The specific method for extracting global feature representations is as follows: The block sequence is input into the multi-head self-attention branch, and the block sequence including multiple time blocks is embedded along the feature dimension. The features of each time block are flattened to obtain the inter-block attention space representation of each time block. The inter-block attention space representations of all time blocks are concatenated to obtain the inter-block attention space representation of the dominant period block sequence, which is then input into the linear layer to extract the query vector, key vector, and value vector. The global feature representation is calculated based on the dot product attention mechanism. The local feature representation and the global feature representation are added element by element to obtain the encoded sequence of the block sequence.

6. The temporal anomaly detection method based on multi-scale mask reconstruction and difference representation according to claim 5, characterized in that, The specific method for decoding and reconstructing the encoded sequences based on the dominant periodic block sequence and the negative sample block sequence is as follows: The encoded sequence of time blocks in the dominant periodic block sequence is decoded, and the dimension of the decoded encoded sequence is mapped to the same data dimension as the input sequence to obtain the mask reconstruction sequence.

7. The temporal anomaly detection method based on multi-scale mask reconstruction and difference representation according to claim 6, characterized in that, The loss function of the time-series anomaly detection model includes reconstruction loss and difference loss; The reconstruction loss is used to calculate the reconstruction error between the masked reconstruction sequence and the input sequence; The encoded sequence output by the dual-branch attention encoder for time blocks in the dominant periodic block sequence is used as the positive sample hidden representation, and the encoded sequence output by the dual-branch attention encoder for time blocks in the negative sample block sequence is used as the negative sample hidden representation. The difference loss is used to calculate the difference between the normal sample hidden representation and the negative sample hidden representation.

8. The temporal anomaly detection method based on multi-scale mask reconstruction and difference representation according to claim 1, characterized in that, The anomaly score is calculated based on the masked reconstructed sequence and the input sequence. The specific method for determining whether the input sequence contains anomalies based on the anomaly score is as follows: calculate The input sequence of time steps and Anomaly scores of time-step mask reconstruction sequences are generated based on anomaly scores of multiple consecutive time steps; Set a global threshold when When the abnormal score at a time step is higher than the global threshold, a judgment is made. If the input sequence at the time step is abnormal, the abnormal score sequence is converted into a binary judgment result based on the global threshold.

Images