A lightweight time series anomaly detection method and system based on relationship fingerprints

Abstract

The application relates to the technical field of time series data analysis processing, in particular to a lightweight time series anomaly detection method and system based on a relationship fingerprint, which comprises the following steps: obtaining a time sequence segment and calculating a standardized relationship fingerprint; obtaining a segment embedding and a relationship fingerprint semantic embedding to calculate a bidirectional semantic alignment loss; obtaining a normal behavior mode and a soft assignment target to calculate a mode-level soft comparison loss; constructing and combining a local time sequence comparison loss to obtain a total training loss to obtain optimized network parameters; constructing a compact normal memory bank and a compact relationship fingerprint bank; calculating the relative density anomaly score, the global rarity score and the local consistency score of a to-be-detected time sequence segment; calculating a fusion anomaly score and aggregating the score into a point-level anomaly score. The application cooperatively reduces the calculation and storage overhead by means of a low-dimensional parameter-free relationship fingerprint, lightweight convolution coding, a compressed memory bank and simplified neighbor scoring, while the robustness and interpretability of anomaly detection are maintained.

Description

Technical Field

[0001] This invention relates to the field of time series data analysis and processing technology, and in particular to a lightweight time series anomaly detection method and system based on relation fingerprinting. Background Technology

[0002] Time series anomaly detection aims to identify moments or time intervals that deviate from normal operating patterns from continuously collected observation data. It is widely used in scenarios such as industrial equipment condition monitoring, network and information system operation and maintenance, and financial risk early warning. Due to the scarcity of anomalous samples and the high cost of annotation in real-world scenarios, existing methods generally employ unsupervised or self-supervised approaches, training models using only normal data and assigning anomaly scores during the inference phase based on the degree of deviation between the learned normal patterns and the test data.

[0003] Existing time-series anomaly detection methods based on representation learning typically divide the original sequence into several time segments, map each segment to a feature space using an encoder, and measure the difference between the segment and the normal pattern using methods such as proximity, reconstruction error, or contrastive learning. However, such methods still have the following shortcomings: First, the representation learned by the encoder is entirely determined by the neural network parameters, lacking explicit coupling with the inherent statistical relationship of the data itself, resulting in a lack of targeted discrimination ability for different types of anomalies such as horizontal shifts, dispersion changes, trend abrupt changes, sharp anomalies, and autocorrelation breaks; Second, existing methods often use a single pseudo-supervisory signal to construct the training target, failing to fully utilize the potential category structure based on statistical relationships between time segments; Third, anomaly scoring in the inference stage often relies only on a single distance or density signal in the representation space, resulting in insufficient robustness; Fourth, some methods rely on complex time-series encoding or reconstruction structures and retain a large number of training samples as a normal memory bank during the inference stage, coupled with multiple or iterative nearest neighbor density calculations, which increases the computational, storage, and retrieval costs of the model with the number of training segments, making it unsuitable for deployment in resource-constrained scenarios such as edge devices and online monitoring.

[0004] Therefore, how to construct low-dimensional relational fingerprints that are directly related to the statistical characteristics of time series segments without introducing anomaly annotations and without requiring additional training, and how to integrate them into the training and inference process through lightweight encoding, compact normal pattern storage, and low-overhead anomaly scoring, while taking into account discriminative ability, robustness, and interpretability, and reducing computational, storage, and retrieval overhead, has become a key technical problem that needs to be solved for time series anomaly detection to be deployed in practice online. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention provides a lightweight time series anomaly detection method and system based on relational fingerprints, which reduces the overhead of model encoding, normal pattern storage, and nearest neighbor retrieval during the inference stage while maintaining the ability to distinguish multiple types of anomalies.

[0006] To achieve the above objectives, in a first aspect, the present invention provides a lightweight time series anomaly detection method based on relation fingerprints. The method includes the following steps: performing sliding slicing on an original multivariate time series to obtain multiple time series segments, and calculating the normalized relation fingerprints of the time series segments; obtaining segment embeddings of the time series segments using a lightweight convolutional encoder, and obtaining the relation fingerprint semantic embeddings of the normalized relation fingerprints based on a semantic projection network, to calculate a bidirectional semantic alignment loss; clustering the time series segments according to the normalized relation fingerprints to obtain multiple normal behavior patterns, obtaining soft assignment targets between the time series segments and the normal behavior patterns, to calculate a pattern-level soft contrast loss; constructing a local temporal contrast loss, and combining it with the bidirectional semantic alignment loss... The overall training loss is obtained by combining the semantic alignment loss and the pattern-level soft contrast loss to obtain optimized network parameters for the lightweight convolutional encoder and the semantic projection network. Based on the optimized network parameters, a compact normal memory and a compact relation fingerprint database are constructed based on the training time series segments. The relative density anomaly score, global sparseness score, and local consistency score of the time series segment under test are calculated based on the segment embedding, the normalized relation fingerprint, the compact normal memory, and the compact relation fingerprint database. The fusion anomaly score of the time series segment under test is calculated using the relative density anomaly score, the global sparseness score, and the local consistency score, and the fusion anomaly score is aggregated into a point-level anomaly score for the original multivariate time series. This invention uses low-dimensional training irrelevant relation fingerprints simultaneously as semantic supervision, pseudo-class clustering, and inference scoring signals, and reduces resource overhead from three aspects: encoding structure, normal pattern storage, and anomaly scoring.

[0007] Optionally, the step of performing sliding slices on the original multivariate time series to obtain multiple time series segments and calculating the standardized relational fingerprint of the time series segments includes: performing sliding cuts on the original multivariate time series with a fixed window length and sliding step size to obtain the time series segments; calculating the horizontal offset and logarithmic dispersion ratio based on the mean and variance of the time series segments and their neighboring windows as context components; calculating the least squares trend slope, excess kurtosis, and first-order autocorrelation coefficient based on the internal numerical sequence of the time series segments as structural components; combining the context components and the structural components to obtain the relational fingerprint, and standardizing the relational fingerprint to obtain the standardized relational fingerprint. This invention explicitly captures multidimensional anomaly features and constructs standardized relational fingerprints, providing reliable prior input for subsequent analysis and processing.

[0008] Optionally, the step of obtaining the segment embedding of the temporal segment using a lightweight convolutional encoder, obtaining the relation fingerprint semantic embedding of the normalized relation fingerprint based on a semantic projection network, and calculating the bidirectional semantic alignment loss includes: normalizing the temporal segment along the time dimension using reversible instance normalization, and performing feature encoding using the lightweight convolutional encoder to obtain the segment embedding; the semantic projection network includes a lightweight context semantic projection network and a lightweight structural semantic projection network; using the lightweight context semantic projection network to perform nonlinear mapping and normalization on the context components to obtain the context semantic embedding; using the lightweight structural semantic projection network... A projection network performs nonlinear mapping and normalization on the structural components to obtain structural semantic embeddings. The context semantic embeddings and structural semantic embeddings are concatenated and input into a gating network to obtain gating coefficients. The gating coefficients are used to perform a weighted summation of the context semantic embeddings and structural semantic embeddings to obtain the relational fingerprint semantic embedding. The fragment embeddings and relational fingerprint semantic embeddings of the time-series segments are normalized to calculate a scaled similarity matrix. Using the sample's own index as a label, cross-entropy loss is calculated along both the row and column directions of the scaled similarity matrix, and the average value of the cross-entropy loss is obtained as the bidirectional semantic alignment loss. This invention enhances the interpretability of fragment embeddings and relational fingerprint semantic embeddings and improves the ability to distinguish various statistical anomalies.

[0009] Optionally, the step of clustering the time-series segments based on the standardized relation fingerprint to obtain multiple normal behavior patterns, and obtaining a soft assignment target between the time-series segments and the normal behavior patterns to calculate the pattern-level soft contrast loss includes: dividing the standardized relation fingerprint into multiple clusters using a clustering algorithm, and using the cluster center of the cluster as the normal behavior pattern; for each time-series segment, calculating the Euclidean distance between the standardized relation fingerprint and the normal behavior pattern to obtain the soft assignment target; concatenating the segment embedding with the description vector of the normal behavior pattern, and using a comparison network to calculate the relevance score of the time-series segment relative to the normal behavior pattern; processing the relevance score with a normalized exponential function, and using the soft assignment target as a soft label to calculate the soft cross-entropy as the pattern-level soft contrast loss. This invention implements soft contrast constraints, enabling representation learning to conform to the inherent statistical category distribution of time-series data, thereby improving the accuracy of normal pattern recognition.

[0010] Optionally, the step of constructing a local temporal contrastive loss and combining it with the bidirectional semantic alignment loss and the pattern-level soft contrastive loss to obtain the overall training loss, thereby obtaining the optimized network parameters of the lightweight convolutional encoder and the semantic projection network, includes: constructing positive samples for the temporal segments based on temporal proximity relationships and mining difficult negative samples to calculate the local temporal contrastive loss; weighting and summing the local temporal contrastive loss, the bidirectional semantic alignment loss, and the pattern-level soft contrastive loss to obtain the overall training loss; and iteratively optimizing based on the overall training loss to obtain the optimized network parameters. This invention enhances the encoder's representation and discrimination capabilities through the complementary use of multiple losses, effectively improving anomaly differentiation performance.

[0011] Optionally, the step of constructing positive samples for the time-series segment based on temporal proximity and mining difficult negative samples to calculate the local temporal contrast loss includes: for the time-series segment, randomly selecting a neighboring segment as the positive sample from the effective neighbor indices within the radius before and after the temporal index; performing feature encoding and contrast projection on the time-series segment and the positive sample, and calculating the cosine similarity matrix between the time-series segment and the positive sample; after excluding diagonal elements in the cosine similarity matrix, determining the difficult negative sample based on the element with the highest similarity; and calculating the local temporal contrast loss based on the similarity between the time-series segment and the positive sample and the difficult negative sample. This invention reduces false detections caused by temporal noise and enhances the generalization detection capability in the temporal dimension.

[0012] Optionally, constructing a compact normal memory and a compact relation fingerprint database based on the optimized network parameters and training time-series segments includes: encoding the training time-series segments using the lightweight convolutional encoder based on the optimized network parameters, and retaining representative core samples through clustering compression to construct the compact normal memory; and performing clustering compression on the standardized relation fingerprints of the training time-series segments to construct the compact relation fingerprint database. This invention reduces the computational load of distance calculation and nearest neighbor retrieval during the inference stage, achieving lightweight storage and retrieval, and adapting to edge deployment.

[0013] Optionally, the step of calculating the relative density anomaly score, global rarity score, and local consistency score of the time series segment under test based on the fragment embedding, the normalized relation fingerprint, the compact normal memory, and the compact relation fingerprint database includes: for the time series segment under test, performing a nearest neighbor search based on the fragment embedding and the compact normal memory, and using the ratio of the local distance to the local density scale of the time series segment under test as the relative density anomaly score; for the time series segment under test, calculating the average distance between the normalized relation fingerprint and the relation fingerprint prototypes in the compact relation fingerprint database as the global rarity score; and within the temporal neighborhood, calculating the Euclidean distance between the normalized relation fingerprint of the time series segment under test and the mean of the normalized relation fingerprint of the time series segment as the local consistency score. This invention effectively covers both global anomaly and contextual anomaly scenarios through the complementarity of these three types of scores.

[0014] Optionally, the step of calculating the fusion anomaly score of the time series segment under test using the relative density anomaly score, the global sparseness score, and the local consistency score, and aggregating the fusion anomaly score into a point-level anomaly score of the original multivariate time series, includes: standardizing the relative density anomaly score, the global sparseness score, and the local consistency score, and obtaining the fusion anomaly score through hierarchical fusion; for time series segments covering the same time point, obtaining the mean of the fusion anomaly scores as the point-level anomaly score. This invention effectively suppresses score jitter caused by noise and outputs stable and reliable time-by-time anomaly detection results.

[0015] Secondly, this invention provides a lightweight time series anomaly detection system based on relation fingerprints. The system executes the lightweight time series anomaly detection method based on relation fingerprints provided by this invention. The system includes an input device, an output device, a processor, and a memory, which are interconnected. The memory stores a computer program, which includes program instructions, and the processor is configured to invoke the program instructions. This invention ensures stable execution of the method through high-performance hardware collaboration, facilitating business deployment and expansion. Attached Figure Description

[0016] Figure 1 This is a flowchart of a lightweight time series anomaly detection method based on relation fingerprinting according to an embodiment of the present invention; Figure 2 This is a framework diagram of a lightweight time series anomaly detection system based on relational fingerprinting according to an embodiment of the present invention. Detailed Implementation

[0017] Specific embodiments of the present invention will now be described in detail. It should be noted that the embodiments described herein are for illustrative purposes only and are not intended to limit the invention. In the following description, numerous specific details are set forth in order to provide a thorough understanding of the invention. However, it will be apparent to those skilled in the art that these specific details are not necessary to practice the invention. In other instances, well-known circuits, software, or methods have not been specifically described to avoid obscuring the invention.

[0018] Throughout this specification, references to "an embodiment," "an embodiment," "an example," or "an example" mean that a particular feature, structure, or characteristic described in connection with that embodiment or example is included in at least one embodiment of the invention. Therefore, the phrases "in an embodiment," "in an embodiment," "an example," or "an example" appearing in various places throughout the specification do not necessarily refer to the same embodiment or example. Furthermore, specific features, structures, or characteristics can be combined in one or more embodiments or examples in any suitable combination and / or sub-combination. Moreover, those skilled in the art will understand that the illustrations provided herein are for illustrative purposes and are not necessarily drawn to scale.

[0019] Please see Figure 1 One embodiment of the present invention provides a lightweight time series anomaly detection method based on relation fingerprints, the method comprising the following steps: S1. Perform sliding slicing on the original multivariate time series to obtain multiple time series segments, and calculate the standardized relational fingerprint of the time series segments.

[0020] In this embodiment, a fixed window length is used. and sliding step size A sliding truncation is performed on the training and test data to obtain a sequence of time segments that overlap in the time dimension. The window length is... The number of sampling points contained in a single time segment is determined based on the sampling frequency of the original time series and the typical time scale used to characterize the dynamic process; the sliding step size. The integer is positive. To obtain time-by-time anomaly detection results, this embodiment preferably sets it to... Each time series segment corresponds to an observation subsequence arranged consecutively on the original sequence, and the time series indices of adjacent time series segments increase sequentially.

[0021] Furthermore, for each time segment, its mean or extreme value in the channel dimension is taken as the representative signal, and multiple non-overlapping neighborhood windows are taken before and after it on the time axis (the offset is the length of the time segment). (integer multiples thereof), calculate the relative relationship between the time segment and its neighborhood window in terms of mean and variance, and obtain the horizontal offset and logarithmic dispersion ratio as context components. and Simultaneously, based on the numerical sequence within this time segment, its least squares trend slope, excess kurtosis, and first-order autocorrelation coefficient are calculated as structural components. , and Then, a five-dimensional relational fingerprint is obtained by splicing the fingerprints together, satisfying the following relationship:

[0022]

[0023]

[0024]

[0025]

[0026]

[0027] in, For horizontal offset, This represents the mean of the time series segments. This is an estimate of the mean of a time series segment. This is an estimate of the standard deviation of a time series segment. The logarithmic dispersion ratio, The variance of the time series segment. It is a very small positive number. The least squares trend slope. The slope is the slope obtained by fitting a straight line using the least squares method. For fixed window length, For excess kurtosis, Let be the fourth moment of the numerical sequence within the time segment. The first-order autocorrelation coefficient, For indexing time, For the first The value at each moment. For the first The value at each moment. For relational fingerprints.

[0028] In this embodiment, the mean and standard deviation of the relation fingerprints of all time-series segments of the training data are calculated as a whole, and the entire relation fingerprints are standardized accordingly to obtain standardized relation fingerprints, which are used to eliminate the differences in dimensionality between various dimensions, facilitating subsequent clustering, semantic projection and distance calculation.

[0029] It should be noted that the relation fingerprint is a fixed five-dimensional vector. Its calculation process does not depend on any learnable parameters. It is derived solely from the mean, variance, trend, fourth moment, and autocorrelation of the time segment itself and its time neighborhood. Therefore, it can be calculated offline in one go before training begins, without adding backbone network parameters or backpropagation calculations. Furthermore, subsequent clustering and inference distance calculations are all completed in a low-dimensional space, thus forming a lightweight statistical representation on the prior side. This invention refers to it as a training-independent relation fingerprint.

[0030] S2. Obtain the segment embedding of the temporal segment using a lightweight convolutional encoder, and obtain the relation fingerprint semantic embedding of the standardized relation fingerprint based on a semantic projection network, so as to calculate the bidirectional semantic alignment loss.

[0031] In this embodiment, to improve the robustness of the model to distribution shifts, before feature encoding, each time segment is reversibly instance-normalized along the time dimension, that is, the mean of the segment itself is subtracted and divided by its standard deviation. This normalization operation can be reversed and restored after the score calculation is completed in the inference stage, so as to alleviate the distribution shift between different time segments.

[0032] Furthermore, the standardized temporal segments are sequentially processed by a lightweight convolutional encoder (multi-layer one-dimensional convolutional blocks) to extract local temporal features. Each layer contains only one-dimensional convolution, batch normalization, and activation functions. Finally, average pooling is applied in the temporal dimension to obtain segment embeddings with fixed dimensions.

[0033] It should be noted that the lightweight convolutional encoder mainly uses local one-dimensional convolution and pooling, does not set up a temporal reconstruction decoder, and does not construct a self-attention matrix with pairwise interactions at global time, thereby reducing network branches and intermediate feature storage, making it suitable as the lightweight backbone encoder of this invention.

[0034] In this embodiment, semantic projection is performed on the context component and structural component of the standardized relation fingerprint, and the projection results are fused using an adaptive gating mechanism to obtain the semantic embedding of the relation fingerprint. The specific steps include the following: First, the standardized relation fingerprint is split into context components ( , ) and structural components ( ).

[0035] Secondly, a context semantic projection network (consisting of a linear layer, a ReLU activation function, and another linear layer) is used to perform nonlinear mapping on the context components, and the context semantic embedding is obtained after layer normalization. The structural components are nonlinearly mapped using a structural semantic projection network (with the same structure and context semantic projection network but independent parameters), and then normalized through layers to obtain the structural semantic embedding. They respectively satisfy the following relations:

[0036]

[0037] in, For contextual semantic embedding, For layer normalization, For context semantic projection networks, For horizontal offset, The logarithmic dispersion ratio, For structural semantic embedding, For structural semantic projection networks, The least squares trend slope. For excess kurtosis, This is the first-order autocorrelation coefficient.

[0038] Next, and The concatenation along the feature dimension is then input into a gating network (a linear layer), and the gating coefficients are obtained dimension-wise through the Sigmoid activation function. It satisfies the following relationship:

[0039] in, The gating coefficient, It is the Sigmoid activation function. These are the learnable parameters of the gated network. For contextual semantic embedding, This is a structural semantic embedding.

[0040] It should be noted that the learnable parameters of the gated network do not need to be specified manually. The parameters are initialized at the beginning of model training and are used together with the parameters of the lightweight convolutional encoder, the context semantic projection network, and the structural semantic projection network as the parameters to be optimized. The parameters are updated iteratively through backpropagation and gradient optimization based on the overall training loss.

[0041] Finally, using the gating coefficient right and Weighted fusion is performed to obtain the semantic embedding of relation fingerprints. It satisfies the following relationship:

[0042] in, For semantic embedding of relational fingerprints, The gating coefficient, For element-wise multiplication, For contextual semantic embedding, This is a structural semantic embedding.

[0043] It should be noted that since the context component and the structural component respectively characterize the relative relationship between the temporal segment and its neighborhood and the morphological features within the temporal segment, their physical meanings and numerical distributions are significantly different. Using dual-channel independent projection can avoid mutual interference, while the adaptive gating mechanism enables the model to dynamically adjust the fusion ratio of the two types of semantics for different temporal segments, thereby obtaining a more discriminative relational fingerprint semantic embedding.

[0044] In this embodiment, L2 normalization is performed on the fragment embedding and relation fingerprint semantic embedding of each time segment within a batch. The similarity matrix between the normalized fragment embedding matrix and the normalized relation fingerprint semantic embedding matrix within the batch is calculated, and divided by the semantic alignment temperature coefficient to obtain the logits matrix as the scaling similarity matrix. Using the sample's own index within the batch as the label, the cross-entropy loss is calculated along the row and column directions of the logits matrix, and the average of the two is taken as the bidirectional semantic alignment loss, satisfying the following relationship:

[0045]

[0046] in, To scale the similarity matrix, This is the fragment embedding matrix after batch normalization. This is the normalized relation fingerprint semantic embedding matrix within the batch. For transpose, For semantic alignment temperature coefficient, For bidirectional semantic alignment loss, Let cross-entropy be the loss function. This is the index for samples within the batch.

[0047] It should be noted that the bidirectional semantic alignment loss causes the segment embeddings and their relation fingerprint semantic embeddings of the same temporal segment to be close to each other in the feature space, while being far away from the relation fingerprint semantic embeddings of other temporal segments in the batch, thereby aligning the representation space with the training-independent statistical semantic space.

[0048] S3. Cluster the time series segments according to the standardized relation fingerprint to obtain multiple normal behavior patterns, obtain the soft assignment target between the time series segments and the normal behavior patterns, and calculate the pattern-level soft contrast loss.

[0049] In this embodiment, the standardized relation fingerprints of all time-series segments of the training data are divided into groups using a mini-batch K-means clustering algorithm. Each cluster is considered as a normal behavior pattern, with its cluster center as the central point of interest. A set of normal behavior patterns constitutes a normal behavior pattern set; then, the standardized relation fingerprint of each time segment is calculated. The squared Euclidean distance between each normal behavior pattern is calculated, and the negative value of the squared distance is divided by the assigned temperature coefficient and then normalized exponentially transformed to obtain the time segment relative to the normalized temperature pattern. The soft-assignment target of a normal behavioral pattern satisfies the following relationship:

[0050] in, For soft allocation targets, For the first Standardized relational fingerprints of each time sequence segment For the first Cluster centers of normal behavioral patterns To allocate temperature coefficients, It is an exponential function. The number of normal behavioral patterns, An index for normal behavioral patterns. For the first This is a normal behavioral pattern.

[0051] The above-mentioned temperature coefficients satisfy the following relationship:

[0052] in, To allocate temperature coefficients, It is the numerical stability constant. This represents median operations. For indexes of time series segments, The index for the cluster centers. The number of normal behavioral patterns, To standardize relational fingerprints, For the first Cluster centers of each cluster.

[0053] It should be noted that the numerical stability constant is used to prevent the temperature coefficient from approaching zero. The number of normal behavior patterns is a preset hyperparameter. When its value causes clustering to degenerate into a single pattern, the soft assignment objective degenerates into all time segments sharing the same soft label. At this time, the pattern-level soft contrast loss tends to be constant and does not affect the optimization of other loss terms.

[0054] In this embodiment, the segment embedding for each time segment is respectively with... The description vectors of normal behavior patterns (which can be the cluster centers of normal behavior patterns or the vectors of the cluster centers after semantic projection) are concatenated and input into a comparison network (consisting of a linear layer, a LeakyReLU activation function, and another linear layer) to obtain the relative order of the time segment. The relevance score of each normal behavior pattern is calculated; after dividing the relevance score by the comparison network temperature coefficient, a normalized exponential transformation is performed, and the soft cross-entropy is calculated using the soft assignment objective as the soft label to obtain the pattern-level soft contrastive loss, which satisfies the following relationship:

[0055] in, For pattern-level soft contrast loss, The total number of time segments. For indexes of time series segments, The number of normal behavioral patterns, An index for normal behavioral patterns. For soft allocation targets, For relevance scores, To compare the temperature coefficient of the network (fixed at 0.2).

[0056] By using the clustering structure of relation fingerprints as the source of pseudo-class labels, the original unsupervised representation learning task is transformed into a pseudo-supervised classification task with statistical semantics. Moreover, the pseudo-class information comes entirely from training-irrelevant relation fingerprints and does not rely on any manual annotation.

[0057] S4. Construct a local temporal contrast loss and combine it with the bidirectional semantic alignment loss and the pattern-level soft contrast loss to obtain the overall training loss, so as to obtain the optimized network parameters of the lightweight convolutional encoder and the semantic projection network.

[0058] In this embodiment, for each time segment (anchor sample) within a batch, a preset radius is set before and after its time index. From the valid neighbor indexes within the range (excluding itself), one is randomly selected as the positive sample of the anchor sample; if the anchor sample has no valid neighbors within the batch, it is degenerated by using itself as the positive sample. Feature encoding and contrastive projection are performed on the anchor sample and the positive sample respectively, and the projection results are normalized. The cosine similarity matrix between the anchor sample and the positive sample within the batch is calculated; for this similarity matrix, the sample corresponding to the largest element other than the diagonal element (the similarity between the anchor sample and its own positive sample) is taken as the hard negative sample of the anchor sample.

[0059] Furthermore, the local temporal contrast loss is calculated based on the distance between the anchor sample and the positive sample and the hard negative sample, satisfying the following relationship:

[0060] in, For local time-series comparison loss, The total number of time segments. For indexes of time series segments, For time sequence segments The distance between it and its positive samples For time sequence segments The distance between it and its difficult negative samples This is a preset interval constant.

[0061] It should be noted that the preset interval constant is used to specify the minimum interval that the distance between the anchor sample and the positive sample must satisfy relative to the distance between the anchor sample and the difficult negative sample, and is set to 0.1.

[0062] In this embodiment, the local temporal contrast loss, bidirectional semantic alignment loss, and pattern-level soft contrast loss are weighted and summed to obtain the overall training loss, which satisfies the following relationship:

[0063] in, For the overall training loss, For local time-series comparison loss, The preset balancing hyperparameters, For pattern-level soft contrast loss, This is the bidirectional semantic alignment loss.

[0064] It should be noted that the balancing hyperparameter is used to control the contribution ratio of the mode-level soft contrast loss and the bidirectional semantic alignment loss to the local temporal contrast loss, and the values ​​of the two can be determined by grid search.

[0065] In this embodiment, the local temporal contrast loss, bidirectional semantic alignment loss, and pattern-level soft contrast loss are jointly optimized, so that the encoder can maintain temporal local consistency while further aligning the representation space with the statistical semantics and pseudo-class structure depicted by the relation fingerprint, thereby obtaining more discriminative and interpretable fragment embeddings.

[0066] Furthermore, the AdamW optimizer is used in conjunction with a cosine annealing learning rate strategy to perform multiple rounds of iterative optimization on the overall training loss until the preset number of training iterations is reached. The model parameters at which the overall training loss reaches the minimum value during training are retained as the convolutional encoder parameters after training, so as to obtain the optimized network parameters.

[0067] S5. Based on the optimized network parameters, construct a compact normal memory bank and a compact relation fingerprint bank based on the training time sequence segments.

[0068] In this embodiment, to achieve lightweight storage and retrieval, based on optimized network parameters, a lightweight convolutional encoder is used to sequentially encode features of all temporal segments of the training data to obtain a training segment embedding set. ,in This represents the total number of training time segments. To control the storage and retrieval overhead during the inference phase and suppress the high redundancy caused by sliding slices with a stride of 1, L2 normalization is first applied to the embedding of each training segment, followed by mini-batch processing. The mean clustering algorithm divides it into Clusters, It should be approximately one-tenth of the total number of training time-series segments, and no less than a preset lower limit of 500, to ensure that the memory bank has sufficient representativeness. The values ​​of satisfy the following relationship:

[0069] in, The number of representative core samples, For the floor function, This represents the total number of training time segments.

[0070] For each cluster, to avoid using synthetic cluster centers that would lead to a disconnect from the distribution of real fragments, the real fragment within that cluster that is closest to the cluster center is taken as the core sample (approximate median sample) of that cluster. Each core sample constitutes a compact normal memory bank. , of which The core samples satisfy the following relationship:

[0071]

[0072] in, For the first One core sample, For indexes of time series segments, To belong to the A set of training fragment indices for each cluster. For the first L2-normalized segment embeddings of training time sequences For the first Cluster centers of each cluster An index for representative core samples, For the first Cluster centers of each cluster.

[0073] Within the L2 normalized space, Euclidean distance and cosine similarity monotonically correspond; therefore, directional clustering is equivalent to partitioning the representation space based on cosine similarity. This core sample compression method, while preserving the structure of the main dense regions of normal data, compresses the number of normal samples that need to be persisted and participate in nearest neighbor retrieval from all training segments to a representative core sample set, thereby directly reducing memory usage, distance calculation frequency, and nearest neighbor retrieval overhead.

[0074] In this embodiment, the standardized relational fingerprints of all time-series segments of the training data are... Small batch The mean clustering algorithm is compressed into A relational fingerprint prototype It comprises approximately one-fifth of the total number of training segments, with a maximum limit of 2000. The values ​​of satisfy the following relationship:

[0075] in, The number of relational fingerprint prototypes, For the floor function, This represents the total number of training time segments.

[0076] Furthermore, because relational fingerprints are only five-dimensional and spatially compact, a small number of prototypes can cover normal statistical patterns. A compact relation fingerprint database is constructed from relation fingerprint prototypes. .

[0077] It should be noted that, unlike the clustering used in the training phase to construct a set of normal behavior patterns, the compressed relation fingerprint database obtained here is specifically used in the inference phase to measure the deviation of the statistical features of the test segment from all normal patterns. Its low-dimensional prototype storage eliminates the need for comparison with all training segments one by one in global sparseness calculation, further reducing storage and distance calculation overhead.

[0078] S6. Calculate the relative density anomaly score, global sparseness score, and local consistency score of the time series segment under test based on the segment embedding, the standardized relation fingerprint, the compact normal memory, and the compact relation fingerprint library.

[0079] In this embodiment, to avoid the multi-level calculation of reachability distance and local reachability density in the standard local outlier factor method, the local density scale of normal core samples is pre-calculated offline and cached; for each test segment, only one nearest neighbor search is performed on the compact normal memory; and then the lightweight relative density anomaly score is obtained by the ratio of the local distance of the test segment to the mean of the local density scale of its nearest core samples, specifically calculated as follows: The first step is to calculate the local density scale of each core sample in the normal memory bank.

[0080] For each core sample in the compact normal memory bank Among the remaining core samples in this memory bank, find the one with the highest similarity to the cosine. Each core sample is used as its nearest neighbor set. Calculate the core sample and its The average distance between the nearest core samples is used as the local density scale of the core sample. It satisfies the following relationship:

[0081] in, For the local density scale of the core samples, The number of nearest neighbors is a hyperparameter. The sample index of the nearest neighbor set. core sample The nearest neighbor set, For the first One core sample, For the first Nearest neighbor samples, This is the cosine similarity between two core samples within the normalized embedding space.

[0082] It should be noted that, The first The typical spacing between normal samples around a core sample is the density of normal samples in the region where the core sample is located.

[0083] The second step is to calculate the local distance of the time segment to be tested.

[0084] Fragment embedding of the timing segment under test After L2 normalization, the cosine similarity between the sample and all core samples in the normal memory is calculated, and the sample with the highest similarity is selected. Each core sample constitutes the nearest neighbor set of the sample to be tested. Calculate the test sample and its The average distance between the nearest core samples is used as the local distance of the sample to be tested. It satisfies the following relationship:

[0085] in, For local distance, The number of nearest neighbors is a hyperparameter. The sample index of the nearest neighbor set. The timing segment to be tested The nearest neighbor set, For the embedding of the timing segment to be tested, For the first Nearest neighbor samples.

[0086] The third step is to calculate the relative density anomaly score.

[0087] With the sample to be tested The average local density scale of the nearest neighbor core samples is used as the normal density scale of the region where the sample to be tested falls. The local distance of the sample to be tested is divided by this normal density scale to obtain the relative density anomaly score of the time segment to be tested. It satisfies the following relationship:

[0088] in, The relative density anomaly score. For local distance, The number of nearest neighbors is a hyperparameter. The sample index of the nearest neighbor set. The timing segment to be tested The nearest neighbor set, For the first Local density scale of each core sample It is a very small positive number.

[0089] It should be noted that the theoretical meaning of the relative density anomaly score is that the density of normal data in the representation space is not uniform, and the distances between normal samples in different regions are inherently different. Therefore, directly comparing absolute distances cannot characterize the fact that "sparseness equals anomaly." This embodiment compares the local distance of the sample to be tested with the packing scale of the normal samples within its region: if the sample to be tested falls into a sparse region of the representation space, or is significantly isolated relative to the normal samples in that region, then... Significantly larger than the typical spacing between core samples in this region. A score significantly greater than 1 indicates an overly high score; if the test sample and surrounding normal samples have similar density, then... The value is close to 1. Compared to the standard LOF algorithm, which uses the ratio of reachable distance to local reachable density and requires iterative calculation, this embodiment adopts a lightweight relative density form of "ratio of local distance to neighboring local density scales," requiring only one iteration. Nearest neighbor retrieval can be completed, making reasoning highly efficient; middle To prevent extremely small positive numbers with a denominator of zero, and because cosine distance is used in the normalized embedding space, the fraction is not sensitive to the vector length of the embedding of the segment to be tested.

[0090] In this embodiment, the global rarity score of the relation fingerprint of the time sequence segment to be tested relative to the relation fingerprint database, and the local consistency score of the relation fingerprint of the time sequence segment to be tested relative to the relation fingerprints of its time sequence neighborhood are calculated.

[0091] First, calculate the global rarity score.

[0092] Calculate the normalized relational fingerprint of the time sequence segment under test Calculate its relationship with the compact fingerprint database. All The Euclidean distance between the prototype fingerprints is taken as the minimum distance. A set of prototypes , will this The average of the distances is used as the global rarity score of the time series segment under test. It satisfies the following relationship:

[0093] in, The global rarity score of the time series segment to be tested. The number of nearest neighbors is a hyperparameter. This is the prototype vector from the relational fingerprint database. For the segment to be tested The most recent set of prototypes, This is the standardized relational fingerprint of the time sequence segment to be tested.

[0094] Global rarity scores characterize the rarity of the statistical features of the time series segment under test within all normal statistical patterns: if the segment under test exhibits anomalies such as horizontal shift, changes in dispersion, abrupt trend changes, spikes, or autocorrelation breaks, its standardized relational fingerprint will fall outside the coverage of the normal prototype set. Significantly increased. Since the calculation of relation fingerprints does not depend on any learnable parameters, the global rarity score is a zero-sample outlier signal that can be directly applied to outlier types that have not been seen during training.

[0095] Next, calculate the local consistency score.

[0096] Calculate the normalized relational fingerprint of the time series segment under test The Euclidean distance between the normalized relational fingerprint mean of each time segment in its temporal neighborhood and the time segment under test is used as the local consistency score of the time segment under test. It satisfies the following relationship:

[0097] in, The local consistency score is the time sequence segment to be tested. For the standardized relational fingerprint of the time sequence segment to be tested, This is a set of indices of non-overlapping temporal neighbor segments on the time axis for the temporal segment under test. The number of its valid elements. For the first A standardized relational fingerprint of a temporal neighborhood segment.

[0098] Local consistency score and context component , different: , Directly characterizing the horizontal offset and dispersion of the measured segment relative to its neighborhood represents a first-order relationship; while the local consistency score measures the abrupt jumps in the overall five-dimensional relationship pattern of the measured segment relative to the mean of its local temporal context, representing a second-order relationship signal. Within the normal operating range, the relationship fingerprint of adjacent temporal segments evolves smoothly. The difference is smaller; however, at contextual anomalies or state transition boundaries, even if the relational fingerprint of the segment under test itself is not uncommon in the entire database ( Even if the distance is small, the relative neighborhood fingerprint will change abruptly. The global rarity score is significantly increased. Therefore, the local consistency score is complementary to the global rarity score: the former captures “statistically rare”, and the latter captures “locally abrupt”.

[0099] S7. Calculate the fusion anomaly score of the time series segment under test using the relative density anomaly score, the global sparseness score, and the local consistency score, and aggregate the fusion anomaly score into the point-level anomaly score of the original multivariate time series.

[0100] In this embodiment, the relative density anomaly score, global sparseness score, and local consistency score are standardized and then weighted and fused to obtain the fused anomaly score of the time series segment to be tested. The fused anomaly scores of multiple time series segments are then aggregated into the point-level anomaly score of the original time series.

[0101] First, the first level of fusion: fusion of relative density anomaly score and global rarity score.

[0102] Relative density anomaly scores of each time segment across the entire dataset under test Global rarity score Standardize them separately, and use the standardized function. Subtracting the mean from the scores of all test data and dividing by its standard deviation satisfies the following relationship:

[0103] in, For the standardized function, For the fractional variable to be standardized, Let be the mean of the corresponding score sequence over all the data to be tested. denoted as , where is the standard deviation of the corresponding score sequence over all the test data.

[0104] The standardized relative density anomaly score is multiplied by the first weighting coefficient. The standardized global rarity scores are summed to obtain the intermediate fusion score. It satisfies the following relationship:

[0105] in, For intermediate fusion scores, For standardized operators, The relative density anomaly score. As the first weighting coefficient, This represents the global rarity score.

[0106] Secondly, the second-level fusion: superimposing local consistency scores.

[0107] For intermediate fusion scores Standardize again and multiply by the second weighting coefficient. The standardized local consistency scores are summed to obtain the fusion anomaly score of the time sequence segment under test. It satisfies the following relationship:

[0108] in, The fusion anomaly score of the time sequence segment under test. For standardized operators, For intermediate fusion scores, This is the second weighting coefficient. The local consistency score is the time sequence segment to be tested.

[0109] The reason for employing a two-stage weighted fusion is that the relative density anomaly score, global rarity score, and local consistency score originate from the representation space and statistical relation space, respectively, and have different physical meanings and numerical scales. Using any one of these signals alone may fail under a specific data distribution. This embodiment standardizes the scores involved in the fusion before each stage to eliminate dimensional differences, ensuring that each signal contributes at a comparable scale. The first stage fuses the relative density anomaly score from the representation space with the global rarity score from the statistical space; both characterize the semantics of "the tested segment deviating from the normal distribution," forming a complementary relationship. The second stage then superimposes the consistency signal reflecting local temporal abrupt changes, further enhancing sensitivity to contextual anomalies and state transitions. When any one of these signals fails or weakens under a certain data distribution, the remaining signals can still maintain overall detection performance, thereby improving the robustness of the method. This fusion process only includes scalar standardization and weighted summation, without introducing additional prediction networks or iterative optimization, thus maintaining low inference overhead while enhancing detection robustness. , Preset weighting coefficients are used to control the contribution ratio of statistical relation signals to the spatial representation signals, and can be adjusted according to the performance of the validation set, for example... A value of 0.5 to 1.0 can be used. A value of 0.2 to 0.5 is acceptable.

[0110] Finally, the fragment-level fusion anomaly scores are aggregated into point-level anomaly scores.

[0111] Because the window length is used A sliding slice with a step size of 1, representing each moment of the original time series. quilt Each time-series segment is covered. The fused anomaly scores of all time-series segments covering the same time point are averaged to obtain the point-level anomaly score for that time point. It satisfies the following relationship:

[0112] in, For point-level outlier scores, The length of the sliding window. Indicates all covered times Time sequence segments, The fusion anomaly score is the time sequence segment to be tested.

[0113] Point-level anomaly scores at all times As the final anomaly detection result of the original time series, the aggregation method of averaging within the coverage window also plays a role in smoothing and denoising, avoiding the point-level score from drastic fluctuations caused by noise in a single time series segment.

[0114] This invention uses time-series data as a foundation, simultaneously applying training-independent five-dimensional statistical relation fingerprints to semantic supervision during training, pseudo-class clustering, and zero-shot scoring during inference. Lightweighting is achieved through a lightweight one-dimensional convolutional encoder, a compact normal memory and relation fingerprint database, relative density scoring for a single nearest neighbor retrieval, and low-dimensional statistical scoring. Without relying on anomaly labeling, this invention maintains the ability to discriminate multiple types of anomalies, including horizontal shifts, variations in dispersion, abrupt trend changes, sharp anomalies, and autocorrelation breaks, while reducing model computation, storage, and retrieval overhead, thus improving the robustness, interpretability, and online deployment applicability of anomaly detection.

[0115] Please see Figure 2 In an optional embodiment, the present invention provides a lightweight time series anomaly detection system based on relation fingerprints. The system includes an input device, an output device, a processor, and a memory, all interconnected. The memory stores a computer program comprising program instructions, and the processor is configured to invoke the program instructions to execute specific steps as described in the relevant embodiments of the lightweight time series anomaly detection method based on relation fingerprints provided by the present invention. The lightweight time series anomaly detection system based on relation fingerprints provided by the present invention has a complete structure, is objective and stable, and improves the overall applicability and practical application capability of the present invention.

[0116] In summary, the present invention provides a lightweight time-series anomaly detection method and system based on relation fingerprints. During the training phase, five-dimensional relation fingerprints, requiring no learning parameters, provide statistical semantic and normal behavior pattern supervision. A lightweight encoder composed of one-dimensional convolution and temporal average pooling is employed, combined with local temporal contrast, bidirectional semantic alignment, and pattern-level soft contrast for representation learning. During the inference phase, training fragment embeddings and relation fingerprints are clustered and compressed, retaining only representative core samples and low-dimensional relation fingerprint prototypes. A lightweight relative density score based on pre-cached local density scales and single-nearest-neighbor retrieval is used, which is then standardized and weighted and fused with global rarity and local consistency scores involving only five-dimensional distance calculations. Thus, the present invention forms a collaborative lightweight mechanism from five levels: low-dimensional prior, lightweight encoding, memory compression, single-retrieval, and network-free fusion. This mechanism balances the ability to discriminate multiple types of anomalies, detection robustness, and interpretability without relying on anomaly labeling, while reducing computational, storage, and retrieval overhead. It is suitable for online monitoring and deployment on resource-constrained devices. The method of this invention is easy to understand, simple to calculate, requires less work, and is convenient for engineering applications, providing a theoretical basis and technical support for the further development of the field of time series data analysis and processing technology.

[0117] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention, and they should all be covered within the scope of the claims and specification of the present invention.

Claims

1. A lightweight time series anomaly detection method based on relational fingerprints, characterized in that, Includes the following steps: The original multivariate time series is sliced ​​by sliding to obtain multiple time series segments, and the normalized relation fingerprint of the time series segments is calculated. The fragment embedding of the temporal segment is obtained using a lightweight convolutional encoder, and the relation fingerprint semantic embedding of the normalized relation fingerprint is obtained based on a semantic projection network to calculate the bidirectional semantic alignment loss. Based on the standardized relational fingerprint, the time series segments are clustered to obtain multiple normal behavior patterns. The soft assignment target between the time series segments and the normal behavior patterns is obtained to calculate the pattern-level soft contrast loss. A local temporal contrast loss is constructed, and the overall training loss is obtained by combining the bidirectional semantic alignment loss and the pattern-level soft contrast loss, so as to obtain the optimized network parameters of the lightweight convolutional encoder and the semantic projection network. Based on the optimized network parameters, a compact normal memory bank and a compact relation fingerprint bank are constructed based on training time sequence segments; The relative density anomaly score, global sparseness score, and local consistency score of the time series segment under test are calculated based on the segment embedding, the standardized relation fingerprint, the compact normal memory, and the compact relation fingerprint database. The fusion anomaly score of the time series segment under test is calculated using the relative density anomaly score, the global sparseness score, and the local consistency score, and the fusion anomaly score is aggregated into the point-level anomaly score of the original multivariate time series.

2. The lightweight time series anomaly detection method based on relational fingerprints according to claim 1, characterized in that, The process of performing sliding slicing on the original multivariate time series to obtain multiple time series segments, and calculating the normalized relational fingerprints of the time series segments, includes: The time series segment is obtained by sliding truncation on the original multivariate time series with a fixed window length and sliding step size; For the time segment and its neighborhood window, the horizontal offset and logarithmic dispersion ratio are calculated based on the mean and variance, and used as context components; The least squares trend slope, excess kurtosis and first-order autocorrelation coefficient are calculated based on the internal numerical sequence of the time segment and used as structural components. The relation fingerprint is obtained by combining the context component and the structural component, and the relation fingerprint is standardized to obtain the standardized relation fingerprint.

3. The lightweight time series anomaly detection method based on relational fingerprints according to claim 2, characterized in that, The process of obtaining the segment embedding of the temporal segment using a lightweight convolutional encoder, obtaining the relation fingerprint semantic embedding of the normalized relation fingerprint based on a semantic projection network, and calculating the bidirectional semantic alignment loss includes: The temporal segment is normalized along the time dimension using reversible instance normalization, and the segment embedding is obtained by feature encoding using the lightweight convolutional encoder. The semantic projection network includes a lightweight context semantic projection network and a lightweight structural semantic projection network; The lightweight context semantic projection network is used to perform nonlinear mapping and normalization on the context components to obtain the context semantic embedding. The structural components are nonlinearly mapped and normalized using the lightweight structural semantic projection network to obtain the structural semantic embedding. The contextual semantic embedding and the structural semantic embedding are concatenated and then input into the gating network to obtain the gating coefficients; The relation fingerprint semantic embedding is obtained by weighted summation of the context semantic embedding and the structural semantic embedding using the gating coefficients. The segment embedding and the relation fingerprint semantic embedding of the time sequence segment are normalized to calculate the scaled similarity matrix; Using the sample's own index as the label, the cross-entropy loss is calculated along the row and column directions of the scaled similarity matrix, and the average value of the cross-entropy loss is obtained as the bidirectional semantic alignment loss.

4. The lightweight time series anomaly detection method based on relational fingerprints according to claim 1, characterized in that, The step of clustering the time series segments based on the standardized relation fingerprint to obtain multiple normal behavior patterns, obtaining the soft assignment target between the time series segments and the normal behavior patterns, and calculating the pattern-level soft contrast loss includes: The standardized relation fingerprint is divided into multiple clusters using a clustering algorithm, and the cluster center of each cluster is used as the normal behavior pattern. For the time segment, calculate the Euclidean distance between the normalized relation fingerprint and the normal behavior pattern to obtain the soft assignment target; The segment is embedded and concatenated with the description vector of the normal behavior pattern, and a comparison network is used to calculate the relevance score of the time segment relative to the normal behavior pattern. The correlation score is processed by a normalized exponential function, and the soft cross-entropy is calculated as the mode-level soft contrast loss using the soft assignment target as the soft label.

5. The lightweight time series anomaly detection method based on relational fingerprints according to claim 1, characterized in that, The construction of a local temporal contrastive loss, combined with the bidirectional semantic alignment loss and the pattern-level soft contrastive loss, yields the overall training loss, thereby obtaining the optimized network parameters for the lightweight convolutional encoder and the semantic projection network. This includes: Positive samples are constructed for the time segments based on temporal proximity relationships, and difficult negative samples are mined to calculate the local temporal contrast loss; The total training loss is obtained by weighted summing of the local temporal contrast loss, the bidirectional semantic alignment loss, and the pattern-level soft contrast loss. The optimized network parameters are obtained by iterative optimization based on the overall training loss.

6. The lightweight time series anomaly detection method based on relational fingerprints according to claim 5, characterized in that, The process of constructing positive samples for the time segment based on temporal proximity and mining difficult negative samples to calculate the local temporal contrast loss includes: For the time series segment, a neighbor segment is randomly selected from the valid neighbor indices within the radius range before and after the time series index as the positive sample; Feature encoding and contrast projection are performed on the time segment and the positive sample, and the cosine similarity matrix between the time segment and the positive sample is calculated; After excluding the diagonal elements in the cosine similarity matrix, the difficult negative sample is determined based on the element with the highest similarity. The local temporal contrast loss is calculated based on the similarity between the temporal segment and the positive sample and the difficult negative sample.

7. The lightweight time series anomaly detection method based on relational fingerprints according to claim 1, characterized in that, The step of constructing a compact normal memory and a compact relation fingerprint database based on the optimized network parameters and training time-series segments includes: Based on the optimized network parameters, the lightweight convolutional encoder is used to encode the training time sequence segments, and representative core samples are retained through clustering compression to construct the compact normal memory library; The standardized relation fingerprints of the training time sequence segments are clustered and compressed to construct the compact relation fingerprint library.

8. The lightweight time series anomaly detection method based on relational fingerprints according to claim 1, characterized in that, The calculation of the relative density anomaly score, global sparseness score, and local consistency score of the time series segment under test based on the segment embedding, the normalized relation fingerprint, the compact normal memory, and the compact relation fingerprint database includes: For the time series segment to be tested, a nearest neighbor search is performed based on the segment embedding and the compact normal memory, and the ratio of the local distance to the local density scale of the time series segment to be tested is used as the relative density anomaly score. For the time series segment to be tested, the average distance between the standardized relation fingerprint and the relation fingerprint prototype in the compact relation fingerprint library is calculated as the global rarity score. Within the temporal neighborhood, the Euclidean distance between the normalized relational fingerprint of the time segment under test and the mean of the normalized relational fingerprint of the time segment is calculated as the local consistency score.

9. The lightweight time series anomaly detection method based on relational fingerprints according to claim 1, characterized in that, The process of calculating the fusion anomaly score of the time series segment under test using the relative density anomaly score, the global sparseness score, and the local consistency score, and then aggregating the fusion anomaly score into the point-level anomaly score of the original multivariate time series, includes: The relative density anomaly score, the global sparseness score, and the local consistency score are standardized, and the fusion anomaly score is obtained through hierarchical fusion. For the time series segments covering the same moment, the mean of the fusion anomaly scores is obtained as the point-level anomaly score.

10. A lightweight time series anomaly detection system based on relational fingerprints, characterized in that, The system includes an input device, an output device, a processor, and a memory, which are interconnected. The memory stores a computer program, which includes program instructions. The processor is configured to invoke the program instructions to execute the lightweight time-series anomaly detection method based on relational fingerprints as described in any one of claims 1-9.

Images