Time series anomaly detection method based on spatiotemporal feature extraction and prior constraint adversarial reconstruction

Abstract

The application discloses a time sequence anomaly detection method based on space-time feature extraction and prior constraint counter-reconstruction, comprising the following steps: obtaining original operation data of a target device, and obtaining three-dimensional time sequence samples after preprocessing; inputting the samples into a time-feature fusion module, extracting time graph and feature graph attention output features respectively, and calculating correlation difference loss in the training process; inputting the space-time fusion features into a Transformer encoder without mask attention to obtain global context features; introducing a double decoder based on focus score for counter-reconstruction, optimizing model parameters by combining reconstruction error and correlation difference loss; based on the trained network, calculating the counter-reconstruction residual of data as an anomaly score, and combining a POT judgment threshold to complete system anomaly state judgment and dimension-level diagnosis. The application overcomes the defect that the traditional model overgeneralizes micro anomalies, resulting in missed reports, and greatly improves the sensitivity and detection accuracy of abnormal patterns.

Description

Technical Field

[0001] This invention relates to the field of industrial Internet of Things and data security monitoring technology, and in particular to a temporal anomaly detection method based on spatiotemporal feature extraction and prior constraint adversarial reconstruction. Background Technology

[0002] With the rapid development of modern industrial IoT and cyber-physical systems, massive numbers of sensor nodes are deployed in large server clusters, smart grids, and advanced manufacturing equipment. These sensors continuously generate high-dimensional, multivariate time-series data, and the normality of this data directly affects the operational status and lifecycle of the entire complex system. When the system is operating at high speed, even minor faults or abnormal fluctuations can lead to system instability or even a complete system crash. Therefore, ensuring the normal operation of complex systems and achieving high-precision time-series anomaly detection is not only a requirement for equipment reliability but also a responsibility for production safety.

[0003] The successful application of deep learning in multivariate time series anomaly detection has greatly improved the ability to automate the processing and feature mining of massive amounts of data. However, in real-world industrial applications, existing unsupervised anomaly detection methods still have insurmountable limitations: on the one hand, there are often strong physical topological correlations between multiple sensors in complex systems, and on the other hand, the readings of each sensor have a large span of physical dimensions and spatial heterogeneity. Most existing studies only extract sequence features based on the time dimension dependency, or forcibly impose uniform prior distribution constraints on spatiotemporal global features. This not only leads to the fragmentation of spatiotemporal feature extraction, but also causes serious interference from differences in feature dimensions, resulting in the over-smoothing of the feature representation of normal patterns.

[0004] On the other hand, traditional Transformer architectures generally retain causal masking attention mechanisms to strictly prevent the model from peeking at subsequent information during inference. However, in unsupervised time series reconstruction tasks, this unidirectional masking mechanism actually cuts off the model's full utilization of global bidirectional contextual information within the sliding window, resulting in incomplete feature fusion.

[0005] For such problems, time-series anomaly detection based on deep generative or reconstructive models has attracted extensive research in recent years. These methods reconstruct input sequences by learning the distribution knowledge of historical data in the normal domain and use the reconstruction error to identify anomalies, showing potential to solve complex multivariate distribution modeling problems. However, traditional reconstruction model research focuses more on fitting at the overall sequence level, neglecting the distribution generalization problem caused by model overfitting. This means that although traditional deep models have strong fitting capabilities, they can often "perfectly" reconstruct (overgeneralize) even small anomalies that deviate from the normal distribution, resulting in extremely small anomaly reconstruction residuals. This makes it difficult to effectively amplify the differences in anomaly features, leading to serious underreporting of anomalies and greatly limiting the accuracy of time-series anomaly detection and dimensional root cause diagnosis. Summary of the Invention

[0006] To address the shortcomings of existing technologies, this invention provides a temporal anomaly detection method based on spatiotemporal feature extraction and prior constraint adversarial reconstruction. It aims to solve the problems of fragmented spatiotemporal feature extraction, the tendency for deep reconstruction models to miss minor anomalies due to overgeneralization, and the low accuracy of root cause diagnosis in multivariate complex systems. The goal is to output more sensitive and accurate system-level anomaly warning results, enabling precise dimensional-level fault location of the source sensors causing system anomalies, thereby significantly improving the sensitivity of the temporal anomaly detection model to minor faults and the accuracy of root cause tracing.

[0007] To achieve the above-mentioned technical objectives, the present invention provides the following technical solution:

[0008] The temporal anomaly detection method based on spatiotemporal feature extraction and prior constraint adversarial reconstruction specifically includes the following steps:

[0009] The raw operating data of the target device is collected and divided into training set, validation set and test set; the preprocessing parameters of each feature dimension are fitted using only the statistics of the training set, and the same set of parameters is applied to the validation set and test set to obtain the three-dimensional time series sample tensor.

[0010] The three-dimensional temporal sample tensor is input into the time-feature fusion module, which calculates the time map attention output features along the time dimension and the feature map attention output features along the feature dimension.

[0011] Extract the self-attention weight matrix in the time dimension and calculate the association difference loss; use the association difference loss to constrain the time map attention output features, and obtain the spatiotemporal fusion feature matrix based on the three-dimensional temporal sample tensor, the constrained time map attention output features, and the feature map attention output features;

[0012] By removing the masking attention from the Transformer encoder, a global context model is performed on the spatiotemporal fusion feature matrix to obtain the context-encoded feature matrix;

[0013] Two decoders are used for two-stage decoding. In the first stage, the two decoders output basic reconstruction predictions based on context-encoded features. In the second stage, a focus score matrix is ​​constructed based on the basic reconstruction predictions output by the first decoder. The focus score matrix is ​​then conditionally injected into the Transformer encoder to reconstruct the context-encoded feature matrix. The reconstructed context-encoded feature matrix is ​​then output as an adversarial reconstruction prediction value by the second decoder. Based on the basic reconstruction predictions, adversarial reconstruction predictions, and correlation difference loss, an asymmetric joint optimization objective is constructed through a minimax adversarial game. The network parameters are updated on the training set through gradient accumulation and parameter grouping.

[0014] Based on the trained model, forward inference is performed on the test set. The residual between the three-dimensional temporal sample tensor and the adversarial reconstruction prediction value is calculated as the anomaly score. The POT judgment threshold is obtained based on the extreme value theory to determine the abnormal state and output the dimensional diagnostic results.

[0015] Furthermore, the raw operating data of the target device is collected and divided into a training set, a validation set, and a test set; preprocessing parameters are fitted using only the statistics of the training set, and the same set of parameters is applied to the validation set and the test set to obtain a three-dimensional time-series sample tensor, specifically including:

[0016] Raw operating data of the target device is collected through a sensor network. The raw operating data is multivariate time series data. The training set is composed of historical operating data that does not contain abnormal states, and the validation set and test set are composed of operating data that contains unknown states.

[0017] The Min-Max normalization parameters are fitted based on the minimum and maximum values ​​of the training set in each feature dimension, and the same set of parameters is used to transform the training set, validation set, and test set.

[0018] Set the size of the sliding window to... Perform normalization on the header of the original running data. The edges of the steps are copied and filled; then the data is truncated by sliding with a fixed step size to obtain the time-series window sequence; after batch processing, a three-dimensional time-series sample tensor is formed.

[0019] Furthermore, the step of inputting the three-dimensional temporal sample tensor into the time-feature fusion module, calculating the time map attention output features along the time dimension, and calculating the feature map attention output features along the feature dimension specifically includes:

[0020] The three-dimensional temporal sample tensor is input into the time-feature fusion module, which includes two parallel multi-head attention branches;

[0021] In the first multi-head attention branch, the feature dimension is fixed, and the time step is regarded as a graph node. The query matrix, key matrix, and value matrix of the time dimension are obtained through the multi-head attention mechanism, and the time graph attention output features are calculated. In the second multi-head attention branch, the time dimension is fixed, and the feature dimension is regarded as a graph node. The query matrix, key matrix, and value matrix of the feature dimension are calculated through the multi-head attention mechanism, and the feature graph attention output features are calculated.

[0022] Furthermore, the self-attention weight matrix in the time dimension is extracted and the association difference loss is calculated; the association difference loss is used to constrain the time map attention output features, and the spatiotemporal fusion feature matrix is ​​obtained based on the three-dimensional temporal sample tensor, the constrained time map attention output features, and the feature map attention output features. Specifically, it includes:

[0023] A prior association distribution following a Gaussian distribution is generated based on the relative distance between each time step within the time window.

[0024] Extract the self-attention weight matrix in the time dimension and use it as the sequence association distribution; calculate the bidirectional KL divergence between the sequence association distribution and the prior association distribution to obtain the association difference loss; use the association difference loss to apply a reverse constraint to the self-attention weight matrix in the time dimension, and update the query matrix, key matrix, and value matrix in the time dimension; obtain the constrained time graph attention output features based on the updated self-attention weight matrix in the time dimension.

[0025] The three-dimensional temporal sample tensor, the constrained temporal map attention output features, and the transposed and restored feature map attention output features are matrix-merged and concatenated along the feature dimension to obtain the concatenated features.

[0026] The spliced ​​features are input into a fusion linear layer for channel compression and feature interaction, and the output is a spatiotemporal fusion feature matrix restored to the original feature dimension.

[0027] Furthermore, the global context modeling of the spatiotemporal fusion feature matrix obtained by removing the masking attention using the Transformer encoder, specifically, is as follows:

[0028] The spatiotemporal fusion feature matrix is ​​mapped to the hidden dimension through input projection and superimposed with positional encoding to obtain the basic encoding input matrix. The basic encoding input matrix is ​​then input into the Transformer encoder that removes masking attention, allowing bidirectional interaction at any time step within the time window. While preserving local spatiotemporal correlations, global long-distance dependencies are modeled to obtain the context encoding feature matrix.

[0029] Furthermore, in the second stage, a focus score matrix is ​​constructed based on the basic reconstruction prediction value output by the first decoder. This focus score matrix is ​​then conditionally injected into the Transformer encoder to reconstruct the context coding feature matrix. The reconstructed context coding feature matrix is ​​then used by the second decoder to output adversarial reconstruction prediction values. Specifically:

[0030] The absolute error between the 3D temporal sample tensor and the basic reconstructed prediction value output by the first decoder is calculated and used as the focus score matrix. The focus score matrix is ​​subjected to stopping gradient, and after linear projection mapping, it is added element-wise to the basic coding input matrix to obtain the focus enhancement coding input matrix. The focus enhancement coding input matrix is ​​re-inputted into the Transformer encoder that removes masking attention, and global context modeling is re-performed to obtain the reconstructed context coding feature matrix. The reconstructed context coding feature matrix is ​​input into the second decoder to output the adversarial reconstruction prediction value.

[0031] Furthermore, the method of constructing an asymmetric joint optimization objective based on the basic reconstruction prediction value, the adversarial reconstruction prediction value, and the associated difference loss through a minimax adversarial game, and updating the network parameters on the training set through gradient accumulation and parameter grouping specifically includes:

[0032] Define decay weight With increasing weight Define the first optimized link loss respectively. Second optimization link loss for:

[0033] ;

[0034] ;

[0035] in, , These represent the first optimized link and the second optimized link, respectively. Indicates mean square error; For a three-dimensional time-series sample tensor, The base reconstructed prediction value output by the first decoder. The base reconstructed prediction value output by the second decoder. The adversarial reconstruction prediction value output by the second decoder; For associated difference loss; To balance the hyperparameters;

[0036] by , Backpropagation is performed as a joint optimization objective. Within the same training batch, the first optimized link loss is calculated and gradient backpropagation is performed first, then the second optimized link loss is calculated and gradient backpropagation is performed, and finally the two sets of network parameters are updated synchronously through the corresponding optimizer.

[0037] Furthermore, the step of performing forward inference on the test set based on the trained model, calculating the residual between the three-dimensional temporal sample tensor and the adversarial reconstruction prediction value as the anomaly score, and obtaining the POT (Potential Orientation Threshold) based on extreme value theory to determine the abnormal state and output the dimensionality-level diagnostic result specifically includes:

[0038] Obtain the true input value of any feature dimension of the test set at the current time step under the sliding window, and the adversarial reconstruction prediction value obtained by the second decoder; calculate the absolute residual between the two as the local anomaly score of that feature dimension at the current time step;

[0039] The local anomaly scores for all feature dimensions are sorted in descending order, and the top scores are selected. The weighted average of the scores of local anomalies is used to obtain the macro-system-level anomaly score.

[0040] Based on the extreme value theory POT, the tail distribution of the macroscopic system-level anomaly score sequence of the validation set throughout the entire time period is fitted to determine the POT judgment threshold corresponding to the target confidence level; when the macroscopic system-level anomaly score of the test set exceeds the POT judgment threshold, an anomaly alarm is triggered at the corresponding timestamp.

[0041] Furthermore, this application also discloses a temporal anomaly detection system based on spatiotemporal feature extraction and prior constraint adversarial reconstruction. This system is used to execute the method described above, and is characterized by specifically including:

[0042] The data preprocessing module is used to collect the raw operating data of the target device, divide it into training set, validation set and test set, and fit the preprocessing parameters using only the statistics of the training set. The same set of parameters is applied to each dataset to output a three-dimensional time series sample tensor.

[0043] The time-feature fusion module is used to receive the three-dimensional temporal sample tensor, calculate the time map attention output features along the time dimension, and calculate the feature map attention output features along the feature dimension.

[0044] The correlation difference constraint module is used to extract the self-attention weight matrix in the time dimension and calculate the correlation difference loss. The correlation difference loss is used to constrain the time map attention output features. Based on the three-dimensional time series sample tensor, the constrained time map attention output features and the feature map attention output features, a spatiotemporal fusion feature matrix is ​​obtained by fusing them.

[0045] The global context encoding module includes a Transformer encoder that removes masking attention, used to perform global context modeling on the spatiotemporal fusion feature matrix and output a context-encoded feature matrix.

[0046] The two-stage adversarial reconstruction module includes a first decoder and a second decoder. In the first stage, the first decoder outputs basic reconstruction prediction values ​​based on the context coding features. In the second stage, the module constructs a focus score matrix based on the basic reconstruction prediction values ​​output by the first decoder. The focus score matrix is ​​then conditionally re-injected into the Transformer encoder, and the second decoder outputs adversarial reconstruction prediction values.

[0047] The joint optimization training module is used to construct an asymmetric joint optimization objective based on the basic reconstruction prediction value, the adversarial reconstruction prediction value and the correlation difference loss through a maxima-mini adversarial game, and update the network parameters on the training set through gradient accumulation and parameter grouping.

[0048] The anomaly detection and diagnosis module is used to infer the test set based on the trained model, calculate the residual between the three-dimensional time-series sample tensor and the adversarial reconstruction prediction value as the anomaly score, obtain the POT judgment threshold based on the extreme value theory to determine the abnormal state, and output the dimension-level diagnostic results.

[0049] Based on the above technical solution, the present invention has at least the following beneficial effects:

[0050] 1. This method models the correlation between time steps and the correlation between feature dimensions through a time-feature fusion module, and applies prior constraints to the temporal attention distribution by using correlation difference loss. This is beneficial for integrating local temporal correlations and inter-variable correlations in a unified feature representation, reducing interference between multivariate features, and improving the feature representation and normal pattern modeling capabilities of complex multivariate time series data.

[0051] 2. By constructing a Transformer encoder that removes masking attention to obtain global context, the shortcomings of insufficient utilization of feature information caused by traditional unidirectional masking mechanisms are effectively overcome;

[0052] 3. This method constructs a focus score based on the basic reconstruction error of the first stage and uses it as the conditional information for the second stage encoding. This allows the second stage reconstruction to focus on the locations where the fitting deviation of the first stage is large, which helps to widen the difference in reconstruction residuals between normal patterns and potential abnormal patterns, improves the sensitivity to the detection of minor anomalies, and provides a basis for dimensional anomaly diagnosis. Attached Figure Description

[0053] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0054] Figure 1 The overall flowchart of the temporal anomaly detection method based on spatiotemporal feature extraction and prior constraint adversarial reconstruction proposed in this invention;

[0055] Figure 2 This is an overall architecture diagram of a deep neural network including a time-feature fusion module TFFM and a Transformer encoder in an embodiment of the present invention;

[0056] Figure 3 This is a schematic diagram of the focus score-driven two-stage decoder and the maxima-mini adversarial game reconstruction mechanism according to an embodiment of the present invention.

[0057] Figure 4 This is a comparison chart of the system-level anomaly detection evaluation metrics of the proposed method of the present invention and existing methods on the SMD dataset in the embodiments;

[0058] Figure 5 This is a comparison chart of the system-level anomaly detection evaluation metrics of the proposed method of the present invention and existing methods on the SMAP dataset in the embodiments.

[0059] Figure 6 This is a comparison chart of the system-level anomaly detection evaluation metrics of the proposed method of the present invention and existing methods on the MSL dataset in the embodiments;

[0060] Figure 7 It displays the real observations, adversarial reconstruction predictions, and local anomaly scores for specific sensor feature dimensions. Detailed Implementation

[0061] To make the above-mentioned objects, features, and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. This will allow for a full understanding of how the present application uses technical means to solve technical problems and achieve technical effects, and to facilitate its implementation.

[0062] Those skilled in the art will understand that all or part of the steps in the methods of the above embodiments can be implemented by a program instructing related hardware. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Moreover, this application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0063] Please refer to Figures 1-7 This illustration shows a specific implementation of this embodiment. The present invention proposes a temporal anomaly detection method based on spatiotemporal feature extraction and prior constraint adversarial reconstruction. This method designs a temporal anomaly detection network, which includes: a temporal-feature fusion module (TFFM) with prior constraints, a Transformer encoder to remove masking attention, and a two-stage decoder driven by focus score and incorporating maxima-minima adversarial game reconstruction. Through the method and network proposed in this invention, the technical challenges of traditional reconstruction methods in complex multivariable systems, such as fragmented spatiotemporal feature extraction, easy underreporting of minor anomalies due to overgeneralization, and difficulty in accurately locating root cause fault dimensions, are effectively solved. Figure 1 As shown, the method proposed in this invention specifically includes the following steps:

[0064] The temporal anomaly detection method based on spatiotemporal feature extraction and prior constraint adversarial reconstruction specifically includes the following steps:

[0065] S1. Collect the raw operating data of the target device and divide the raw operating data into training set, validation set and test set; use only the statistics of the training set to fit the preprocessing parameters of each feature dimension, and apply the same set of parameters to the validation set and test set to obtain the three-dimensional time series sample tensor;

[0066] In a preferred embodiment, step S1 specifically includes:

[0067] Raw operational data of the target device is collected through a sensor network; this raw operational data is multivariate time series data; the total time step length is assumed to be... The total number of feature dimensions is The training set is composed of historical running data that does not contain abnormal states in the original running data, and the validation set and test set are composed of running data that contains unknown states in the original running data.

[0068] The Min-Max normalization parameters are fitted based on the minimum and maximum values ​​of the training set in each feature dimension, and the same set of parameters is used to transform the training set, validation set, and test set.

[0069] Taking the training set as an example, the Min-Max normalization is performed on the original running data for any feature dimension at any time step, and the formula is expressed as:

[0070] ;

[0071] in, Indicates the first The time step, the first Normalized runtime data for each feature dimension For the first The time step, the first The original running data for each feature dimension, Indicates the first training set A column vector consisting of all time steps of data for each feature dimension; This represents a very small positive number (e.g., a value of 0) set to prevent the denominator from being zero. );

[0072] Set the size of the sliding window to... (If taken) ), and perform normalization on the header of the original runtime data. Edge copying and padding are performed at each step to maintain local continuity of the time series data at the boundary; then, data is truncated by sliding with a fixed step size (e.g., a step size of 1) to obtain a dimension of [dimensional value missing]. The time-series window sequence; after batch processing, it forms a dimension of size. 3D Temporal Sample Tensor ,in This represents the batch size.

[0073] S2. Input the three-dimensional temporal sample tensor into the time-feature fusion module, calculate the time map attention output features along the time dimension, and calculate the feature map attention output features along the feature dimension.

[0074] As a preferred embodiment, in this embodiment, such as Figure 2 As shown, step S2 specifically includes:

[0075] The three-dimensional temporal sample tensor is input into the time-feature fusion module, which includes two parallel multi-head attention branches;

[0076] In the first multi-head attention branch, the feature dimension is fixed. (Feature dimension refers to the spatial dimension composed of each sensor channel or feature variable), Each time step is treated as a graph node, and a query matrix along the time dimension is obtained through a multi-head attention mechanism. Key matrix Sum matrix Calculate the attention output features of the time-map The formula is expressed as:

[0077] ;

[0078] in, This is a scaling factor for the time dimension, used to prevent the gradient from vanishing due to excessively large dot product results. This represents the normalized exponential activation function;

[0079] In the second multi-head attention branch, the time dimension is fixed. , feature dimensions Each node is considered a graph node. After transposing the input matrix, a query matrix with feature dimensions is calculated using a multi-head attention mechanism. Key matrix Sum matrix Calculate the feature map attention output features The formula is expressed as:

[0080] ;

[0081] in, As a scaling factor for the feature dimension, it is also used to prevent the gradient from vanishing due to excessively large dot product results.

[0082] S3. Extract the self-attention weight matrix in the time dimension and calculate the association difference loss; use the association difference loss to constrain the time map attention output features, and obtain the spatiotemporal fusion feature matrix based on the three-dimensional temporal sample tensor, the constrained time map attention output features, and the feature map attention output features;

[0083] As a preferred embodiment, in this embodiment, such as Figure 2 As shown, step S3 specifically includes:

[0084] A prior correlation distribution following a Gaussian distribution is generated based on the relative distances at each time step within the time window. , It is in matrix form, where the first... The time step for the first Prior attention probability weights at each time step The formula is expressed as:

[0085] ;

[0086] in, To control the standard deviation parameter of the distribution width, Indicates the first One time step;

[0087] Extract the self-attention weight matrix along the time dimension and use it as the sequence association distribution. ; Calculate the sequence association distribution Distribution with prior association The bidirectional KL divergence between them yields the correlation difference loss. The formula is expressed as:

[0088] ;

[0089] in, Indicates related difference loss, The KL divergence represents the distance between two probability distributions and is used to measure the similarity between the distributions. Denotes the first of the prior correlation distribution matrices. row vectors The first element of the sequence correlation distribution matrix represents the... Row vectors are generated; the self-attention weight matrix in the time dimension is inversely constrained using association difference loss, and the query matrix, key matrix, and value matrix in the time dimension are updated; the constrained temporal graph attention output features are obtained based on the updated self-attention weight matrix in the time dimension. ;

[0090] Three-dimensional time series sample tensor Constrained temporal graph attention output features The transposed and restored feature map is used for attention output features. The concatenated features are obtained by merging and stitching matrices along the feature channel dimension, as expressed by the formula:

[0091] ;

[0092] in, The concatenated feature is a single-dimensional matrix, and the feature dimension after concatenation is 3M. This represents a tensor concatenation operation performed along the feature dimension;

[0093] The concatenated features are input into a fusion linear layer for channel compression and feature interaction, outputting a spatiotemporal fusion feature matrix, expressed by the formula:

[0094] ;

[0095] in, This represents the spatiotemporal fusion feature matrix output by the time-feature fusion module, whose feature channel number is equal to the original feature dimension M. and These represent the weight matrix and bias vector of the M-dimensional fusion linear layer, respectively, which map the 3M-dimensional concatenated features to the M-dimensional features.

[0096] In step S3 of this application, local temporal correlations that conform to normal temporal patterns are first strengthened using temporal correlation priors, reducing the interference of irrelevant or abnormal temporal correlations on feature representations. Then, the Transformer encoder performs bidirectional interaction throughout the entire time window to further model global long-distance dependencies, thereby achieving collaborative modeling of local temporal correlations and global contextual information. This helps alleviate feature interference and the problem of effective information overload in complex multivariate time-series data, and improves the stability of spatiotemporal fusion features and the ability to model normal patterns.

[0097] S4. Global context modeling is performed on the spatiotemporal fusion feature matrix by removing the masking attention using a Transformer encoder to obtain the context-encoded feature matrix;

[0098] As a preferred embodiment, in this embodiment, such as Figure 2 As shown, step S4 specifically involves:

[0099] The spatiotemporal fusion feature matrix is ​​projected onto the hidden dimension (the hidden feature dimension used internally by the Transformer encoder, i.e., the model representation dimension of the Transformer) and then superimposed with positional encoding to obtain the basic encoding input matrix. This basic encoding input matrix is ​​then input into the Transformer encoder after removing masking attention, allowing bidirectional interaction at any time step within the time window. This model preserves local spatiotemporal correlations while building global long-distance dependencies and avoids information loss caused by unidirectional causal masking, resulting in the context encoding feature matrix. .

[0100] S5. Two-stage decoding is performed using two decoders. In the first stage, the two decoders output basic reconstruction prediction values ​​based on the context-coded features. The basic reconstruction prediction value output by the first decoder is denoted as... The basic reconstructed prediction value output by the second decoder is denoted as ;

[0101] In the second stage, a focus score matrix is ​​constructed based on the basic reconstruction prediction value output by the first decoder. The focus score matrix is ​​then conditionally injected into the Transformer encoder to reconstruct the context coding feature matrix. The reconstructed context coding feature matrix is ​​then output as an adversarial reconstruction prediction value by the second decoder.

[0102] As a preferred embodiment, such as Figure 3 As shown, the specific process for obtaining the adversarial reconstruction prediction value is as follows:

[0103] Computing 3D Temporal Sample Tensors The basic reconstructed prediction value output by the first decoder The absolute error between them is used as the focus score matrix, i.e. This is used to quantify the poor fit of the first decoder, and its physical meaning is to guide the network to focus on potential abnormal regions.

[0104] The focus score matrix is ​​subjected to a stopping gradient, and after linear projection mapping, it is added element-wise to the basic encoded input matrix to obtain the focus enhancement encoded input matrix. The focus-enhancing encoding input matrix is ​​re-inputted into the Transformer encoder that removes masking attention, and global context modeling is performed again to obtain the reconstructed context encoding feature matrix; the reconstructed context encoding feature matrix is ​​then input into the second decoder to output the adversarial reconstruction prediction value. .

[0105] Based on the basic reconstruction prediction, adversarial reconstruction prediction, and associated difference loss, an asymmetric joint optimization objective is constructed through a maximal-mini adversarial game. The network parameters are updated on the training set through gradient accumulation and parameter grouping.

[0106] As a preferred embodiment, in this embodiment, such as Figure 3 As shown, the method of constructing an asymmetric joint optimization objective based on the basic reconstruction prediction value, the adversarial reconstruction prediction value, and the correlation difference loss through a minimax adversarial game, and updating the network parameters on the training set through gradient accumulation and parameter grouping specifically includes:

[0107] Define decay weight With increasing weight Define the first optimized link loss respectively. Second optimization link loss for:

[0108] ;

[0109] ;

[0110] in, , These represent the first optimized link and the second optimized link, respectively. Indicates mean square error; For a three-dimensional time-series sample tensor, The base reconstructed prediction value output by the first decoder. The base reconstructed prediction value output by the second decoder. The adversarial reconstruction prediction value output by the second decoder; The correlation difference loss is calculated from the temporal attention matrix in the forward propagation using the same Gaussian prior as defined in step S3, and the calculation occurs before the focus score injection. To balance the hyperparameters;

[0111] by , Backpropagation is performed as a joint optimization objective. Within the same training batch, the first optimized link loss is calculated and gradient backpropagation is performed, followed by the second optimized link loss. Finally, the two sets of network parameters are updated synchronously through the corresponding optimizers. The first parameter set... This includes parameters for the temporal-feature fusion module, input projection layer, focal projection layer, mask-removing Transformer encoder, and first decoder; and a second parameter set. This includes the parameters of the second decoder. It should be noted that the input projection layer here refers to the input projection mapping layer used in "mapping the spatiotemporal fusion feature matrix to the hidden dimension via input projection and overlaying positional encoding," and the focal projection layer here refers to the linear projection layer used in "performing stopping gradients on the focal score matrix and then linearly projecting it."

[0112] At the beginning of each training batch, the gradients of the two optimizers are cleared, and gradient backpropagation is performed on the first optimized link loss and the second optimized link loss in turn, so that the gradients reachable by the computation graph accumulate on the corresponding parameters. Then, the two optimizers update the network parameters according to the first parameter group and the second parameter group, respectively.

[0113] S6. Based on the trained model, perform forward inference on the test set, calculate the residual between the three-dimensional temporal sample tensor and the adversarial reconstruction prediction value as the anomaly score, obtain the POT judgment threshold based on the extreme value theory to determine the abnormal state and output the dimension-level diagnostic results.

[0114] In a preferred embodiment, step S6 specifically includes:

[0115] Get the test set in the sliding window. The time step, the first The true input values ​​for each feature dimension, i.e., the normalized running data. ,and Adversarial reconstruction prediction value obtained by the second decoder Calculate the absolute residual between the two, and use it as the local anomaly score for that feature dimension at the current time step. , indicating that the system in the first Time, Number The tendency for anomalies to occur in each feature dimension (i.e., sensor channel).

[0116] The local anomaly scores for all feature dimensions are sorted in descending order, and the top scores are selected. The weighted average of the scores of local anomalies is used to obtain the macro-system-level anomaly score.

[0117] Based on the extreme value theory POT, the tail distribution of the macroscopic system-level anomaly score sequence of the validation set throughout the entire time period is fitted to determine the POT judgment threshold corresponding to the target confidence level; when the macroscopic system-level anomaly score of the test set exceeds the POT judgment threshold, an anomaly alarm is triggered at the corresponding timestamp.

[0118] This concludes the description of the entire process of the method proposed in this invention. Furthermore, this application also discloses a temporal anomaly detection system based on spatiotemporal feature extraction and prior constraint adversarial reconstruction. This system is used to execute the method described above, and is characterized by specifically including:

[0119] The data preprocessing module is used to collect the raw operating data of the target device, divide it into training set, validation set and test set, and fit the preprocessing parameters using only the statistics of the training set. The same set of parameters is applied to each dataset to output a three-dimensional time series sample tensor.

[0120] The time-feature fusion module is used to receive the three-dimensional temporal sample tensor, calculate the time map attention output features along the time dimension, and calculate the feature map attention output features along the feature dimension.

[0121] The correlation difference constraint module is used to extract the self-attention weight matrix in the time dimension and calculate the correlation difference loss. The correlation difference loss is used to constrain the time map attention output features. Based on the three-dimensional time series sample tensor, the constrained time map attention output features and the feature map attention output features, a spatiotemporal fusion feature matrix is ​​obtained by fusing them.

[0122] The global context encoding module includes a Transformer encoder that removes masking attention, used to perform global context modeling on the spatiotemporal fusion feature matrix and output a context-encoded feature matrix.

[0123] The two-stage adversarial reconstruction module includes a first decoder and a second decoder. In the first stage, the first decoder outputs basic reconstruction prediction values ​​based on the context coding features. In the second stage, the module constructs a focus score matrix based on the basic reconstruction prediction values ​​output by the first decoder. The focus score matrix is ​​then conditionally re-injected into the Transformer encoder, and the second decoder outputs adversarial reconstruction prediction values.

[0124] The joint optimization training module is used to construct an asymmetric joint optimization objective based on the basic reconstruction prediction value, the adversarial reconstruction prediction value and the correlation difference loss through a maxima-mini adversarial game, and update the network parameters on the training set through gradient accumulation and parameter grouping.

[0125] The anomaly detection and diagnosis module is used to infer the test set based on the trained model, calculate the residual between the three-dimensional time-series sample tensor and the adversarial reconstruction prediction value as the anomaly score, obtain the POT judgment threshold based on the extreme value theory to determine the abnormal state, and output the dimension-level diagnostic results.

[0126] Meanwhile, to verify the detection performance of the proposed time-series anomaly detection method based on spatiotemporal feature extraction and prior constraint adversarial reconstruction, this method was validated on three publicly available authoritative multivariate time-series anomaly detection datasets (SMD dataset, SMAP dataset, and MSL dataset). The SMD (Server Machine Dataset) dataset is a server cluster status monitoring dataset provided by a large internet company, recording the operating status of multiple servers over a long period. At a specific sampling frequency, the data for each machine contains 38 feature dimensions (such as CPU utilization, memory page swapping, network packet throughput, etc.). The SMAP (Soil Moisture Active Passive) dataset is provided by NASA and records sensor telemetry data during spacecraft on-orbit exploration, containing 25 feature dimensions. The MSL (Mars Science Laboratory) dataset is also provided by NASA and records telemetry sensor readings from deep space exploration equipment such as Mars rovers, containing 55 feature dimensions. Table 1 below shows the specific data of the datasets used in the experiment:

[0127] Table 1 Datasets used in the experiment

[0128]

[0129] The data collected in all three datasets include historical operational records of devices in healthy states, as well as operational records of unknown states such as sudden system failures or network attacks. Each dataset is divided into a training set (healthy data without anomaly labels), a validation set (data with anomaly states), and a test set (the test set is equipped with system-level anomaly diagnostic labels accurate to the timestamp). Following the method described below, only the Min-Max normalization parameters fitted to the training set are used to transform the training, validation, and test sets. A fixed-size sliding window is set, and sliding sampling is performed along the time axis with a step size of 1, cutting the sampled dataset into three-dimensional time-series samples for model input.

[0130] In the experiments, this invention selected the aforementioned publicly available multivariate time series datasets such as SMD, SMAP, and MSL as unsupervised training and testing benchmarks. Each dataset was divided into training, validation, and test sets. Min-Max normalization parameters were fitted only based on the minimum and maximum values ​​of each feature dimension in the training set, and the same set of parameters was used to transform the training, validation, and test sets. Edges were copied and padded at the beginning of the normalized data, and then sliding sampling was performed along the time axis with a fixed window length and step size to construct three-dimensional time series samples for model input. Subsequently, the normalized training samples were input into the designed deep neural network, where the Time-Feature Fusion (TFFM) module was used to extract spatiotemporal two-dimensional features, and the AssDis (AssDis) loss was used to constrain the prior distribution of the time dimension, overcoming feature interference and overwhelming effects caused by the heterogeneity of the multivariate feature space; the Transformer encoder, which removes masking attention, was used to achieve full fusion of the global context. During training, the focus score guides the two-stage decoder to perform minimax-minimax adversarial reconstruction. The base reconstruction error, adversarial reconstruction error, and correlation difference loss are combined, and gradients are sequentially backpropagated and accumulated for both losses. Then, two optimizers update the network parameters according to their parameter groups, forming a joint gradient accumulation and group update mechanism. Finally, the trained model is used to perform forward inference on test samples containing unknown states. Under the condition of no abnormal labels during training, system-level anomaly warning and dimensional-level diagnosis are achieved by calculating the adversarial reconstruction residual and the POT (Potentially Occurring Tolerance) threshold, to verify the model's accuracy and generalization ability in complex industrial scenarios.

[0131] As an explanation, in the model training phase, this invention adaptively sets training hyperparameters for different dataset sizes: for the SMD dataset, the number of training epochs is set to 10, the batch size is set to 256, and the initial learning rate is set to... For the SMAP and MSL datasets, the number of training epochs was set to 15, the batch size to 64, and the initial learning rate to [value missing]. The optimizer uniformly adopts the AdamW algorithm.

[0132] Figure 4 , Figure 5 , Figure 6 The results of comparing the proposed method with existing mainstream methods on the system-level anomaly detection evaluation index (F1 score) of the SMD dataset, SMAP dataset, and MSL dataset are shown respectively. It can be seen that the proposed method achieves a higher F1 score on the listed datasets and the comparison methods, indicating that the spatiotemporal feature extraction and two-stage reconstruction mechanism can improve the system-level anomaly detection performance.

[0133] Figure 7This demonstrates the actual observed values, adversarial reconstruction predicted values, and local anomaly scores for a specific sensor feature dimension. Within the time interval corresponding to the system-level anomaly alarm, the local anomaly score for this feature dimension significantly increases, indicating that the local reconstruction residual can reflect abnormal changes in this feature dimension and provide a basis for dimension-level anomaly diagnosis. System-level anomaly alarms are still based on the macroscopic system-level anomaly score and the judgment threshold.

[0134] In summary, the method proposed in this invention effectively solves the problems of fragmented spatiotemporal feature extraction and feature overload caused by spatial heterogeneity in complex multivariate time series data. It completely overcomes the shortcomings of traditional deep reconstruction models, such as overgeneralization and high false negative rates when faced with minor anomalies. This method enables sensitive anomaly detection and accurate dimensionality-level source tracing of high-dimensional time series data under unsupervised training conditions. It significantly improves the reliability of early warning systems for complex industrial equipment operating at high speeds and is suitable for practical applications such as industrial IoT monitoring, server cluster maintenance, and aerospace vehicle health management.

[0135] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of this application. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of those different embodiments or examples.

[0136] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus or device (such as a computer-based system, a processor-included system or other system that can fetch and execute instructions from, an instruction execution system, apparatus or device).

[0137] The above embodiments provide a detailed description of the present invention. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A temporal anomaly detection method based on spatiotemporal feature extraction and prior constraint adversarial reconstruction, characterized in that, Specifically, the following steps are included: The raw operating data of the target device is collected and divided into training set, validation set and test set; the preprocessing parameters of each feature dimension are fitted using only the statistics of the training set, and the same set of parameters is applied to the validation set and test set to obtain the three-dimensional time series sample tensor. The three-dimensional temporal sample tensor is input into the time-feature fusion module, which calculates the time map attention output features along the time dimension and the feature map attention output features along the feature dimension. Extract the self-attention weight matrix in the time dimension and calculate the association difference loss; use the association difference loss to constrain the time map attention output features, and obtain the spatiotemporal fusion feature matrix based on the three-dimensional temporal sample tensor, the constrained time map attention output features, and the feature map attention output features; By removing the masking attention from the Transformer encoder, a global context model is performed on the spatiotemporal fusion feature matrix to obtain the context-encoded feature matrix; Two decoders are used for two-stage decoding; In the first stage, the two decoders output basic reconstructed predictions based on context-encoded features; In the second stage, a focus score matrix is ​​constructed based on the basic reconstruction prediction value output by the first decoder. The focus score matrix is ​​then conditionally injected into the Transformer encoder to reconstruct the context encoding feature matrix. The reconstructed context encoding feature matrix is ​​then output as an adversarial reconstruction prediction value by the second decoder. Based on the basic reconstruction prediction value, the adversarial reconstruction prediction value, and the correlation difference loss, an asymmetric joint optimization objective is constructed through a minimax adversarial game. The network parameters are then updated on the training set through gradient accumulation and parameter grouping. Based on the trained model, forward inference is performed on the test set. The residual between the three-dimensional temporal sample tensor and the adversarial reconstruction prediction value is calculated as the anomaly score. The POT judgment threshold is obtained based on the extreme value theory to determine the abnormal state and output the dimensional diagnostic results.

2. The temporal anomaly detection method based on spatiotemporal feature extraction and prior constraint adversarial reconstruction according to claim 1, characterized in that, The raw operating data of the target device is collected and divided into training set, validation set and test set. Using only training set statistics to fit preprocessed parameters, and applying the same set of parameters to both the validation and test sets, a three-dimensional time-series sample tensor is obtained, specifically including: Raw operating data of the target device is collected through a sensor network. The raw operating data is multivariate time series data. The training set is composed of historical operating data that does not contain abnormal states, and the validation set and test set are composed of operating data that contains unknown states. The Min-Max normalization parameters are fitted based on the minimum and maximum values ​​of the training set in each feature dimension, and the same set of parameters is used to transform the training set, validation set, and test set. Set the size of the sliding window to... Perform normalization on the header of the original running data. The edges of the steps are copied and filled; then the data is truncated by sliding with a fixed step size to obtain the time-series window sequence; after batch processing, a three-dimensional time-series sample tensor is formed.

3. The temporal anomaly detection method based on spatiotemporal feature extraction and prior constraint adversarial reconstruction according to claim 1, characterized in that, The step of inputting the three-dimensional temporal sample tensor into the time-feature fusion module, calculating the time map attention output features along the time dimension, and calculating the feature map attention output features along the feature dimension specifically includes: The three-dimensional temporal sample tensor is input into the time-feature fusion module, which includes two parallel multi-head attention branches; In the first multi-head attention branch, the feature dimension is fixed, and the time step is regarded as a graph node. The query matrix, key matrix, and value matrix of the time dimension are obtained through the multi-head attention mechanism, and the time graph attention output features are calculated. In the second multi-head attention branch, the time dimension is fixed, and the feature dimension is regarded as a graph node. The query matrix, key matrix, and value matrix of the feature dimension are calculated through the multi-head attention mechanism, and the feature graph attention output features are calculated.

4. The temporal anomaly detection method based on spatiotemporal feature extraction and prior constraint adversarial reconstruction according to claim 1, characterized in that, The process of extracting the self-attention weight matrix in the time dimension and calculating the association difference loss, and using the association difference loss to constrain the time map attention output features, and obtaining the spatiotemporal fusion feature matrix based on the three-dimensional temporal sample tensor, the constrained time map attention output features, and the feature map attention output features specifically includes: A prior association distribution following a Gaussian distribution is generated based on the relative distance between each time step within the time window. Extract the self-attention weight matrix in the time dimension and use it as the sequence association distribution; calculate the bidirectional KL divergence between the sequence association distribution and the prior association distribution to obtain the association difference loss; use the association difference loss to apply a reverse constraint to the self-attention weight matrix in the time dimension, and update the query matrix, key matrix, and value matrix in the time dimension; obtain the constrained time graph attention output features based on the updated self-attention weight matrix in the time dimension. The three-dimensional temporal sample tensor, the constrained temporal map attention output features, and the transposed and restored feature map attention output features are matrix-merged and concatenated along the feature dimension to obtain the concatenated features. The spliced ​​features are input into a fusion linear layer for channel compression and feature interaction, and the output is a spatiotemporal fusion feature matrix restored to the original feature dimension.

5. The temporal anomaly detection method based on spatiotemporal feature extraction and prior constraint adversarial reconstruction according to claim 1, characterized in that, The process of performing global context modeling on the spatiotemporal fusion feature matrix by removing masking attention using a Transformer encoder to obtain the context-encoded feature matrix is ​​as follows: The spatiotemporal fusion feature matrix is ​​mapped to the hidden dimension through input projection and superimposed with positional encoding to obtain the basic encoding input matrix. The basic encoding input matrix is ​​then input into the Transformer encoder that removes masking attention, allowing bidirectional interaction at any time step within the time window. While preserving local spatiotemporal correlations, global long-distance dependencies are modeled to obtain the context encoding feature matrix.

6. The temporal anomaly detection method based on spatiotemporal feature extraction and prior constraint adversarial reconstruction according to claim 5, characterized in that, In the second stage, a focus score matrix is ​​constructed based on the basic reconstruction prediction value output by the first decoder. This focus score matrix is ​​then conditionally injected into the Transformer encoder to reconstruct the context coding feature matrix. The reconstructed context coding feature matrix is ​​then used by the second decoder to output adversarial reconstruction prediction values. Specifically: The absolute error between the three-dimensional temporal sample tensor and the basic reconstructed prediction value output by the first decoder is calculated and used as the focus score matrix. The stopping gradient is applied to the focus score matrix, and after linear projection mapping, it is added element by element to the basic coded input matrix to obtain the focus enhancement coded input matrix. The focus-enhancing encoding input matrix is ​​re-inputted into the Transformer encoder that removes masking attention, and global context modeling is performed again to obtain the reconstructed context encoding feature matrix; the reconstructed context encoding feature matrix is ​​input into the second decoder to output the adversarial reconstruction prediction value.

7. The temporal anomaly detection method based on spatiotemporal feature extraction and prior constraint adversarial reconstruction according to claim 1, characterized in that, The method of constructing an asymmetric joint optimization objective based on the basic reconstruction prediction value, the adversarial reconstruction prediction value, and the associated difference loss through a minimax adversarial game, and updating the network parameters on the training set through gradient accumulation and parameter grouping specifically includes: Define decay weight With increasing weight Define the first optimized link loss respectively. Second optimization link loss for: ； ； in, , These represent the first optimized link and the second optimized link, respectively. Indicates mean square error; For a three-dimensional time-series sample tensor, The base reconstructed prediction value output by the first decoder. The base reconstructed prediction value output by the second decoder. The adversarial reconstruction prediction value output by the second decoder; For associated difference loss; To balance the hyperparameters; by , Backpropagation is performed as a joint optimization objective. Within the same training batch, the first optimized link loss is calculated and gradient backpropagation is performed first, then the second optimized link loss is calculated and gradient backpropagation is performed, and finally the two sets of network parameters are updated synchronously through the corresponding optimizer.

8. The temporal anomaly detection method based on spatiotemporal feature extraction and prior constraint adversarial reconstruction according to claim 1, characterized in that, The process of performing forward inference on the test set based on the trained model, calculating the residual between the three-dimensional temporal sample tensor and the adversarial reconstruction prediction value as the anomaly score, and obtaining the POT (Potential Orientation Threshold) based on extreme value theory to determine the abnormal state and output dimensional diagnostic results specifically includes: Obtain the true input value of any feature dimension of the test set at the current time step under the sliding window, and the adversarial reconstruction prediction value obtained by the second decoder; calculate the absolute residual between the two as the local anomaly score of that feature dimension at the current time step; The local anomaly scores for all feature dimensions are sorted in descending order, and the top scores are selected. The weighted average of the scores of local anomalies is used to obtain the macro-system-level anomaly score. Based on the extreme value theory POT, the tail distribution of the macroscopic system-level anomaly score sequence of the validation set throughout the entire time period is fitted to determine the POT judgment threshold corresponding to the target confidence level; when the macroscopic system-level anomaly score of the test set exceeds the POT judgment threshold, an anomaly alarm is triggered at the corresponding timestamp.

9. A temporal anomaly detection system based on spatiotemporal feature extraction and prior constraint adversarial reconstruction, the system being used to execute the method as described in any one of claims 1-8, characterized in that, Specifically, it includes: The data preprocessing module is used to collect the raw operating data of the target device, divide it into training set, validation set and test set, and fit the preprocessing parameters using only the statistics of the training set. The same set of parameters is applied to each dataset to output a three-dimensional time series sample tensor. The time-feature fusion module is used to receive the three-dimensional temporal sample tensor, calculate the time map attention output features along the time dimension, and calculate the feature map attention output features along the feature dimension. The correlation difference constraint module is used to extract the self-attention weight matrix in the time dimension and calculate the correlation difference loss. The correlation difference loss is used to constrain the time map attention output features. Based on the three-dimensional time series sample tensor, the constrained time map attention output features and the feature map attention output features, a spatiotemporal fusion feature matrix is ​​obtained by fusing them. The global context encoding module includes a Transformer encoder that removes masking attention, used to perform global context modeling on the spatiotemporal fusion feature matrix and output a context-encoded feature matrix. The two-stage adversarial reconstruction module includes a first decoder and a second decoder. In the first stage, the first decoder outputs basic reconstruction prediction values ​​based on the context coding features. In the second stage, the module constructs a focus score matrix based on the basic reconstruction prediction values ​​output by the first decoder. The focus score matrix is ​​then conditionally re-injected into the Transformer encoder, and the second decoder outputs adversarial reconstruction prediction values. The joint optimization training module is used to construct an asymmetric joint optimization objective based on the basic reconstruction prediction value, the adversarial reconstruction prediction value and the correlation difference loss through a maxima-mini adversarial game, and update the network parameters on the training set through gradient accumulation and parameter grouping. The anomaly detection and diagnosis module is used to infer the test set based on the trained model, calculate the residual between the three-dimensional time-series sample tensor and the adversarial reconstruction prediction value as the anomaly score, obtain the POT judgment threshold based on the extreme value theory to determine the abnormal state, and output the dimension-level diagnostic results.

Images