Detector orchestration method, system, device and storage medium for time series anomaly detection

Abstract

The application discloses a detector arrangement method, system and device for time series anomaly detection and a storage medium. The detector arrangement method comprises the following steps: acquiring a candidate anomaly detector set and historical corpus; extracting sequence-level representations of each historical time series, constructing historical task partitions, determining effective clusters and effective cluster centers; training cluster-specific detector performance prediction models for each effective cluster; routing a target time series to a matching effective cluster, performing window-level detector performance prediction; aggregating the prediction results to obtain detector ranking and detector weights of the candidate anomaly detectors; executing the candidate anomaly detectors ranked at the top in the detector ranking, acquiring corresponding anomaly sub-sequences, performing effectiveness checking and alignment, and outputting; and recording decision trace information of the target time series to be detected. The application can obtain detection quality close to full-pool integration with significantly fewer candidate anomaly detector execution quantities and lower inference time.

Description

Technical Field

[0001] This invention relates to the fields of data management and auditable analysis technology, and in particular to a detector orchestration method, system, device and storage medium for time series anomaly detection. Background Technology

[0002] Time series anomaly detection is widely used in scenarios such as cloud service monitoring, industrial equipment monitoring, network traffic monitoring, financial risk control, medical monitoring, and equipment fault detection. Different time series tasks typically have different dynamic patterns, noise structures, anomaly types, and operating states, making it difficult for a single anomaly detector to stably adapt to all tasks.

[0003] One existing approach is to use a global detector selector, such as MetaOD based on meta-learning (Zhao Y, Rossi RA, Akoglu L. Automating Outlier Detection via Meta-Learning[J].2020. DOI:10.48550 / arXiv.2009.10606.), which trains a unified selection model for all tasks, selecting one or a set of detectors from a set of candidate detectors for the target sequence. However, when the target sequence has a distributional shift relative to historical data or comes from an unseen domain, the detector ranking given by the global selector is often unreliable, leading to a decrease in the detection quality of the selected detectors on the target sequence.

[0004] Another existing approach is to use full-pool fusion, such as fusion anomaly detection methods using rules like AVG, MAX, or AOM. This involves executing all detectors in the candidate detector set one by one and directly fusing their anomaly scores. This approach requires executing all detectors online, resulting in high execution costs. Furthermore, the anomaly scores output by different detectors often differ in scale and meaning, making direct score fusion unstable. Scores need to be calibrated, but the calibration itself is difficult to standardize among heterogeneous detectors.

[0005] Another existing approach attempts to improve upon these shortcomings through local selection or ranking aggregation. For example, LSCP (Zhao Y, Nasrullah Z, Hryniewicki MK, et al. LSCP: Locally Selective Combination in Parallel Outlier Ensembles[J]. 2019. DOI:10.1137 / 1.9781611975673.66.) defines instance-level local regions and selects the most capable detectors for combination, but its local regions are dynamically constructed based on pseudo-true value similarity, lacking a stable performance prediction mechanism for offline training. The above methods fail to establish a systematic coordination mechanism between task partitioning granularity, window-level prediction uncertainty handling, and heterogeneous detector score fusion.

[0006] Furthermore, existing automated anomaly detection methods typically only output the final selected detector or the final anomaly score, lacking process-level records of intermediate evidence for orchestration processes such as routing, sorting, execution, and fusion, making it difficult to audit and interpret the orchestration path afterward.

[0007] Therefore, there is an urgent need for a detector orchestration method that can improve the reliability of local sorting, reduce bounded execution overhead, and record the source of decision-making throughout the entire process under the condition of no target label. Summary of the Invention

[0008] This invention provides a detector orchestration method for time series anomaly detection. When the target time series has a distributional offset relative to historical corpora or comes from an unseen running scenario, it improves the reliability of anomaly detector ranking and anomaly scoring fusion, reduces the computational overhead of online execution of candidate anomaly detectors, and records auditable evidence of the routing, ranking, execution, and fusion processes.

[0009] The technical solution of the present invention is as follows: A detector orchestration method for time series anomaly detection includes the following steps: (1) Obtain a set of candidate anomaly detectors and historical data, wherein the historical data includes a historical time series used to characterize the operating state of the monitored object and the corresponding detector performance vector; (2) Extract window-level time series features from each historical time series and aggregate them to obtain a sequence-level representation. Construct historical task partitions and determine the effective clusters and effective cluster centers for deployment. (3) Train cluster-specific detector performance prediction models for each effective cluster used for deployment; (4) The target time series to be detected is routed to the matching effective cluster, and the window-level detector performance is predicted using the corresponding cluster-specific detector performance prediction model; (5) Perform cross-window aggregation on the window-level prediction results to obtain the detector ranking and detector weights of the candidate anomaly detectors; (6) Execute the candidate anomaly detectors that rank higher in the detector sorting and obtain the corresponding anomaly subsequences; (7) Perform validity checks and alignment on the acquired abnormal subsequences and output the results; (8) Record the decision tracing information of the target time series to be detected.

[0010] Time series data refers to time-series data used to characterize the operating status of the monitored object, including cloud service operation indicators, industrial equipment sensor data, network traffic data, sensor monitoring data, etc.

[0011] The candidate anomaly detector set can include detectors from different families such as statistics, distance, clustering, subsequence, reconstruction, prediction or base model, and there is no limit to the specific number and composition of them.

[0012] The detector performance vector can be calculated offline based on the labels of the historical time series.

[0013] The components of the detector performance vector are preset unified evaluation index values ​​of candidate anomaly detectors on the corresponding historical time series. The preset unified evaluation index is at least one of precision-recall surface volume (VUS-PR), precision-recall area under the curve (AUC-PR), receiver operating characteristic area under the curve (AUC-ROC), and F1 score.

[0014] Preferably, step (2) includes: (2-1) Divide the historical time series into multiple windows according to the preset window division method, and extract window-level time series features for each window; (2-2) Perform sequence-level aggregation on the window-level time series features of all windows of the historical time series to obtain the sequence-level representation of the historical time series, and then use a shared normalizer to standardize it to obtain the standardized sequence-level representation; (2-3) At each candidate partition granularity, the historical time series is clustered and partitioned based on the normalized sequence-level representation to obtain the historical task partition; the sequences in the low support clusters in the historical task partition are reassigned to the nearest support cluster center and the center is recalculated to obtain the effective clusters and their effective cluster centers at the candidate partition granularity. (2-4) For each candidate partition granularity, perform granularity scoring: in, Candidate partition granularity Granularity score; The number of historical time series; The mean squared error of leave-one-out cross-validation weighted by cluster size on the historical corpus; It is the ratio of the average center distance between the current candidate partition granularity and the nearest candidate partition granularity that precedes it in the traversal order of granularity from smallest to largest and participates in the granularity scoring. This represents the number of valid clusters after threshold filtering. The candidate partition granularity with the highest granularity score is determined as the target partition granularity, and the effective clusters and effective cluster centers under the target partition granularity are used as the effective clusters and effective cluster centers for deployment.

[0015] Preferably, in step (2-1), the preset window partitioning method is a fixed-length non-overlapping window partitioning method; the window-level time series features are catch22 standard time series features, tsfresh features, frequency domain features, domain features, or learned feature representations.

[0016] Preferably, in step (2-2), the window-level time series features are aggregated at the sequence level by averaging: in, Representing historical time series Sequence-level representation; express A collection of windows; express The number of windows; Display window Window-level time series features.

[0017] Preferably, in step (2-3), Ward agglomerative clustering, K-means clustering, Gaussian mixture clustering, K-centroid clustering, or spectral clustering are used to cluster and partition the historical time series.

[0018] Low-support clusters are historical task partitions with support levels below the support threshold, while support clusters are historical task partitions with support levels not lower than the support threshold.

[0019] For each candidate partition granularity, identify the support clusters that reach the support threshold. (a) When there is no supporting cluster, determine that the granularity of the candidate partition does not participate in the granularity scoring; (b) When a supporting cluster exists, the historical time series in the low-support cluster is reallocated to the nearest supporting cluster center and the center is recalculated to obtain the effective clusters and their effective cluster centers at the candidate partition granularity; if the nearest supporting clusters are in the same distance, they are preferentially assigned to the supporting cluster with the larger support amount; if the support amounts are still in the same distance, they are determined according to the preset and fixed cluster numbering order. (c) Candidate partitions with fewer than 2 effective clusters after reallocation are not included in the granularity scoring; If none of the candidate partition granularities meet the granularity scoring conditions (cases (a) or (c)), then all historical time series will be formed into a single effective cluster and a global detector performance prediction model will be trained.

[0020] Step (3) includes: (3-1) For each valid cluster used for deployment, construct the cluster training set: in, Indicates a valid cluster The cluster training set; Display window Window-level time series features; Representing historical time series The detector performance vector; Indicates a valid cluster ; express A collection of windows; (3-2) Use the effective cluster training set to train the cluster-specific detector performance prediction model.

[0021] The cluster-specific detector performance prediction model takes window-level time series features as input and outputs a vector composed of the prediction performance of each candidate anomaly detector in the candidate anomaly detector set. The cluster-specific detector performance prediction model can be a multi-task regression model or a ranking model.

[0022] Preferably, in step (4), the effective cluster that has the smallest distance between the normalized sequence-level representation of the target time series to be detected and the effective cluster center used for deployment is determined as the matching effective cluster; When the distance to multiple effective cluster centers is the same, the effective cluster with the larger historical support is selected first. If the historical support is still the same, the effective cluster numbers are determined according to a preset and fixed order.

[0023] Preferably, step (4) includes: (4-1) Divide the target time series to be detected into multiple windows according to the preset window division method, and extract window-level time series features for each window; (4-2) Perform sequence-level aggregation on the window-level time series features of all windows of the target time series to be detected to obtain the sequence-level representation of the target time series. Then, use a shared normalizer to standardize the target time series to obtain the standardized sequence-level representation of the target time series. (4-3) Calculate the distance between the normalized sequence-level representation of the target time series and the centers of each effective cluster, and determine the effective clusters that match the target time series from the effective clusters based on the distances: in, Represents the target time series The valid cluster to which the route is taken; Represents the target time series Standardized sequence-level representation; Indicates a valid cluster Valid cluster centers; Indicates Euclidean distance; (4-4) Use effective clusters The cluster-specific detector performance prediction model is used to predict the window-level detector performance of the target time series.

[0024] Preferably, step (5) includes: (5-1) Based on the window-level prediction performance, near-parallel detectors are adaptively retained according to the gap threshold to obtain the window-level retention set of each window; (5-2) Calculate the cumulative prediction performance score for each candidate anomaly detector. ; in, Display window For candidate anomaly detectors Window-level prediction performance; For indicator functions, when Belongs to window Window-level reserved set The value is 1 if the condition is met, otherwise it is 0. (5-3) Determine the detector ranking in descending order of cumulative prediction performance score. When the cumulative prediction performance score of the candidate anomaly detectors determined according to the detector ranking and the upper limit of the number of detectors can be effectively normalized, the corresponding cumulative prediction performance score is normalized and used as the detector weight. When the sum of the cumulative prediction performance scores of the candidate anomaly detectors determined according to the detector ranking and the upper limit of the number of detectors is 0, or when effective normalization cannot be performed, the uniform weight of the determined candidate anomaly detectors is calculated as the detector weight.

[0025] Preferably, adaptively retaining near-parallel detectors according to the gap threshold includes: always retaining the candidate anomaly detector with the highest prediction performance (i.e., the first one) in each window, and retaining the second one when the gap between the first and second place in the prediction performance in that window does not exceed the gap threshold, retaining the third one when the gap between the first and second place does not exceed the gap threshold and the gap between the second and third place does not exceed the gap threshold, and so on until the number of retained candidate anomaly detectors reaches the upper limit of the number of detectors.

[0026] When sorting by cumulative prediction performance score in descending order, if the cumulative prediction performance scores are the same, the order is determined by the average prediction performance across all windows in descending order. If the average prediction performance is still the same, the detectors are sorted by the preset detector number order.

[0027] Preferably, step (6) includes: performing pre-detector sorting... Named candidate anomaly detectors, obtain the corresponding anomaly segmentation sequences; This is the preset maximum number of detectors.

[0028] Preferably, step (7) includes: (7-1) Perform a validity check on the obtained abnormal subsequences. For candidate abnormal detectors that fail to run, have missing output, empty output, or no valid output value, mark them as invalid and remove them from the set of executed candidate abnormal detectors. (7-2) When no valid abnormal sequence exists, output an execution failure flag; When valid outlier subsequences exist, map and align them to the length of the target time series; When a valid anomaly score sequence is obtained, the valid anomaly score sequence is directly used as the anomaly score sequence of the target time series, and the time-stamped anomaly score or anomaly severity of the target time series is output. When at least two valid anomaly subsequences are obtained, the detector weights are renormalized on the set of candidate anomaly detectors corresponding to the valid anomaly subsequences to obtain the weights. And perform the weighted ordinal rank fusion step (7-3); (7-3) Rank the timestamps in descending order according to the size of the anomaly score in each candidate anomaly detector corresponding to the effective anomaly score sequence, and obtain the timestamp ordinal rank. Determine the rank fusion score of each candidate anomaly detector at each time stamp. The rank fusion scores of each candidate anomaly detector are weighted and fused to obtain the timestamp. Fusion anomaly scoring : in, It is the stability constant; The time-stamped anomaly score or anomaly severity of the target time series is output based on the fused anomaly scoring sequence.

[0029] Preferably, step (7) further includes: applying thresholding to the time-stamped anomaly score or anomaly severity of the target time series to obtain a binary anomaly or normal determination of the target time series.

[0030] When multiple timestamps from the same candidate anomaly detector have the same anomaly score, the ordinal rank of the timestamps is determined by the parallel average rank of the multiple timestamps.

[0031] The decision tracing information in step (8) includes routing tracing information, sorting tracing information, execution tracing information and fusion tracing information.

[0032] By using the above four layers of decision-making traceability information, the orchestration paths of routing, sorting, execution, and fusion can be audited afterward.

[0033] The routing origination information includes the selected effective clusters and the routing margin between the nearest and second-nearest effective cluster centers.

[0034] The ranking and source information includes the top-ranked candidate anomaly detectors, the cumulative prediction performance score, the gap between the first and second ranked prediction performance, the number of times each candidate anomaly detector is retained, and at least one of the pairwise TreeSHAP feature attribution.

[0035] The execution traceability information includes the set of candidate anomaly detectors that were executed and the upper limit on the number of detectors.

[0036] The fusion source tracing information includes detector weights and the cumulative share of each candidate anomaly detector in the fusion anomaly scoring sequence.

[0037] The present invention also provides a detector orchestration system for time series anomaly detection, for executing the detector orchestration method, comprising: The historical corpus acquisition module acquires a set of candidate anomaly detectors and historical corpus, wherein the historical corpus includes historical time series used to characterize the operating state of the monitored object and the corresponding detector performance vector; The feature and partitioning module extracts window-level time series features from each historical time series and aggregates them to obtain a sequence-level representation, constructs historical task partitions, and determines effective clusters and effective cluster centers; The prediction model training module trains cluster-specific detector performance prediction models for each effective cluster. The routing and prediction module routes the target time series to be detected to a matching effective cluster and uses the corresponding cluster-specific detector performance prediction model to predict the window-level detector performance. The prediction aggregation module performs cross-window aggregation on the window-level prediction results to obtain the detector ranking and detector weights of the candidate anomaly detectors; The bounded execution module executes the candidate anomaly detectors that rank higher in the detector sorting and obtains the corresponding anomaly score sequence. The fusion and output module performs validity checks and alignment on the acquired abnormal subsequences and then outputs them. The decision tracing and recording module records the decision tracing and recording information of the target time series to be detected.

[0038] The present invention also provides an electronic device, including a memory and a processor, wherein the memory stores a computer program or instructions, and when the computer program or instructions are executed by the processor, the steps of the above-described detector arrangement method are implemented.

[0039] The present invention also provides a computer-readable storage medium having a computer program or instructions stored thereon, wherein the computer program or instructions, when executed by a processor, implement the steps of the detector arrangement method described above.

[0040] This invention achieves near-full-pool integration detection quality with significantly fewer candidate anomaly detectors and lower inference time.

[0041] Compared with the prior art, the beneficial effects of the present invention are as follows: First, the Task-Aligned Granularity Criterion (TAGC) is used to jointly score the predictability of intra-cluster detector performance, inter-cluster separation, and effective cluster complexity. This allows for the selection of partition granularity that balances learnability, distinguishability, and deployment complexity without using target time series labels, thus mitigating the problems of implicit parameter tuning of granularity and unreliable global selector sorting under distribution offset.

[0042] Second, by training a cluster-specific detector performance prediction model for each effective cluster and routing the target sequence to the matching effective cluster based on distance, a local sorting expert is used instead of a global selector, making the detector sorting closer to the local region where the target sequence is located, thereby improving the reliability of anomaly detection in scenarios with distribution shift or no observed operation.

[0043] Third, by adaptively retaining near-parallel detectors through gap thresholds and accumulating prediction performance only on the retained windows, near-parallel candidate detectors can be retained when there is uncertainty in window-level prediction, reducing the impact of single-window prediction error on the final ranking and weights.

[0044] Fourth, by executing only the top-ranked candidate anomaly detectors within the upper limit of the number of detectors, and by employing scale-independent weighted ordinal rank fusion when there are at least two valid anomaly score sequences, the robustness to ranking errors can be improved under bounded execution costs, the number of candidate anomaly detectors executed online can be reduced, the inference computation overhead can be reduced, and cross-detector calibration of the anomaly scores output by heterogeneous candidate anomaly detectors can be avoided.

[0045] Fifth, by recording decision-making traceability information, the orchestration path can be audited afterward, which helps to locate the process basis for routing target time series to specific effective clusters, sorting and executing candidate anomaly detectors, and forming fusion anomaly scores. Attached Figure Description

[0046] Figure 1 This is a schematic diagram of the overall process of the detector orchestration method for time series anomaly detection according to the present invention; Figure 2 This is a schematic diagram of the offline stage of the detector orchestration method for time series anomaly detection of the present invention; Figure 3 This is a schematic diagram of the online stage of the detector orchestration method for time series anomaly detection of the present invention; Figure 4 This is a schematic diagram of the decision tracing record structure of the present invention. Detailed Implementation

[0047] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be noted that the embodiments described below are intended to facilitate the understanding of the present invention and do not limit it in any way.

[0048] The technical problem to be solved by this invention is: for time series data used to characterize the operating status of monitored objects, such as cloud service operation indicators, industrial equipment sensor data, network traffic data, and sensor monitoring data, how to improve the reliability of anomaly detector ranking and anomaly scoring fusion when the target time series has a distribution offset relative to historical corpus or comes from unseen operating scenarios, reduce the computational overhead of online execution of candidate anomaly detectors, and record auditable evidence of the routing, ranking, execution, and fusion processes.

[0049] To address the aforementioned technical problems, this invention provides a detector orchestration method for time series anomaly detection, comprising an offline stage and an online stage, the overall process of which is as follows: Figure 1As shown, the process includes the following steps: In the offline phase, a set of candidate anomaly detectors and historical corpus are acquired. The historical corpus includes historical time series representing the operational state of the monitored object and their corresponding detector performance vectors. Window-level time series features are extracted from the historical time series and aggregated to obtain sequence-level representations. Based on the sequence-level representations, historical task partitions are constructed, effective clusters for deployment and their effective cluster centers are determined, and cluster-specific detector performance prediction models are trained for each effective cluster. In the online phase, for the target time series to be detected, its window-level time series features and sequence-level representations are extracted. Based on the distance between the sequence-level representations and the centers of each effective cluster, the target time series is routed to a matching effective cluster, and the cluster-specific detector performance of that effective cluster is used. The prediction model predicts detector performance for each window; it aggregates the prediction results across windows to obtain the detector ranking and weights of candidate anomaly detectors; within a preset upper limit for the number of detectors, it executes candidate anomaly detectors ranked within the upper limit of the number of top detectors in the detector ranking to obtain the corresponding anomaly score sequences; when a valid anomaly score sequence is obtained, it is used as the anomaly score sequence for the target time series; when at least two valid anomaly score sequences are obtained, it performs weighted ordinal rank fusion based on the ordinal rank of the timestamp within the detectors according to the detector weights to obtain the fused anomaly score sequence for the target time series; and it outputs the anomaly score sequence or the fused anomaly score sequence.

[0050] The labels of the target time series are not involved in the determination of matching effective clusters, detector ranking, detector weights, the determination of the set of candidate anomaly detectors to be executed, or weighted ordinal rank fusion; they can only be used in offline testing or effect evaluation.

[0051] Example 1: Offline Phase This embodiment illustrates the offline stage of the detector orchestration method, including historical corpus construction, feature extraction and sequence-level representation, historical task partitioning and effective cluster construction, task alignment granularity selection, and the training process of the cluster-specific detector performance prediction model. Figure 2 As shown. The following explanation uses a univariate time series as an example, and includes the following steps: (i) In the data acquisition and historical corpus construction steps, a set of candidate anomaly detectors and historical time series are acquired; the set of candidate anomaly detectors may include detectors from different families such as statistics, distance, clustering, subsequence, reconstruction, prediction or base model, and their specific number and composition are not limited. In a preferred embodiment, the candidate anomaly detector set includes 20 candidate anomaly detectors: Sub-IForest, Local Polynomial Fitting (POLY), Matrix Profile, Normal Pattern Modeling Based on k-Shape Clustering (KShapeAD), Subsequence Anomaly Detection by Streaming Cytometry (SAND), Sub-PCA, Sub-HBOS Histogram Outlier Scoring, Sub-LOF, Spectral Residual Significance Detection (SR), Sub-KNN, Sub-OCSVM, Detection Based on Cluster Centroid Distance (KMeansAD-U), Autoencoder Reconstruction Error, Convolutional Neural Network Prediction Error (CNN), OmniAnomaly, Adversarial Training Autoencoder (USAD), Transformer-Based Detection (TranAD), Time Series Two-Dimensional Variation Modeling (TimesNet), Transformer Detection Based on Association Difference (AnomalyTransformer), and Time Series Basic Model (TimesFM). For each historical time series and its label, the detection performance of each candidate anomaly detector in the candidate anomaly detector set on that historical time series is determined offline, resulting in a detector performance vector corresponding to that historical time series. The detector performance vector can be calculated offline based on the labels of the historical time series; this offline calculation is part of offline supervision and does not involve the use of the target time series labels. The historical corpus is composed of the historical time series and their detector performance vectors.

[0052] The first of the detector performance vectors The component is the first The preset unified evaluation index value of each candidate anomaly detector on the corresponding historical time series; the preset unified evaluation index is at least one of the following, which takes values ​​in the range [0,1]: precision-recall surface volume (VUS-PR), precision-recall area under the curve (AUC-PR), receiver operating characteristic (AUC-ROC) or F1 value, preferably VUS-PR; when loss value is used to characterize detection performance, the loss value is converted into a normalized performance score, in which a larger value indicates better detection performance.

[0053] (ii) In the window partitioning and window-level time series feature extraction steps, the historical time series is divided into multiple windows according to a preset window partitioning method; the preset window partitioning method is preferably a fixed-length non-overlapping window partitioning method, and the window length is preferably 1024. For sequences shorter than the window length, they are padded with zeros at the end to form a window of a complete length. For sequences whose length is not an integer multiple of the window length, the sequence length is set to... Window length is Remainder , will be from the Data from each time point, categorized by window length Divide the sequence into several non-overlapping windows in sequence, and then... Each point in time can be used as a separate window (when...) (At that time, the window partially overlaps with the first window that follows it). Window-level time series features are extracted for each window; the window-level time series features are preferably catch22-specific time series features, that is, time series statistical features of a preset dimension (e.g., 22 dimensions) extracted for each window; in alternative implementations, the window-level time series features can also be tsfresh features, frequency domain features, neighborhood features, or learned representations, etc.

[0054] (iii) In the sequence-level representation and standardization steps, the window-level time series features of all windows in the historical time series are aggregated at the sequence level (e.g., averaged) according to formula (1) to obtain the sequence-level representation of the historical time series. The sequence-level representation is independent of the sequence length. Then, a shared normalizer (preferably a z-score normalizer) is used to standardize the sequence-level representation to obtain a standardized sequence-level representation. This standardized sequence-level representation is used for offline clustering and online routing.

[0055] (1) in, Representing historical time series Sequence-level representation; express A set of windows obtained according to a preset window division method; Display window Window-level time series features; express The formula calculates the number of windows. It averages the window-level time series features of all windows in the sequence to obtain a sequence-level representation that is independent of the sequence length.

[0056] (iv) In the historical task partitioning and effective cluster construction steps, historical time series are partitioned based on standardized sequence-level representation at multiple candidate partition granularities to obtain candidate historical task partitions. The clustering method used for partitioning is preferably Ward agglomerative clustering, which uses minimizing the intra-cluster variance increment as the link criterion, and the resulting cluster centers are in the same standardized space as the online routes. In alternative implementations, clustering can also use K-means, Gaussian mixture, K-centroid, spectral clustering, etc., but should be compatible with subsequent distance routing. Low-support clusters in the candidate historical task partitions with support below the support threshold (measured by the total number of windows of historical time series within the cluster, preferably 100) are reassigned, and the sequences in the low-support clusters are reassigned to the nearest support cluster center, and the center and effective cluster number are recalculated; thus, effective clusters and their effective cluster centers are obtained. In an optional alternative implementation, low-support clusters can also be processed by cluster merging.

[0057] During the redistribution of low-support clusters, support clusters with support levels reaching the support threshold are first identified. If no support cluster exists at a candidate partition granularity, or the number of effective clusters after redistribution is less than 2, then that candidate partition granularity will not participate in the subsequent task alignment granularity scoring. If none of the candidate partition granularities meet the above conditions, then all historical time series are treated as a single effective cluster, and a global detector performance prediction model is trained as a degradation scheme. When support clusters exist, sequences in each low-support cluster are assigned to the nearest support cluster center. If the distances are equal, priority is given to assigning to the support cluster with the larger support level; if they are still equal, the cluster numbering order is determined according to a preset and fixed sequence.

[0058] (v) In the task alignment granularity selection step, based on historical corpora, each candidate partition granularity is jointly scored based on three factors: intra-cluster detector performance predictability, inter-cluster separation, and effective cluster complexity. Specifically, it can be calculated using formula (2): (2) in, Candidate partition granularity; The number of historical time sequences or historical tasks in the historical corpus; The mean squared error of leave-one-out cross-validation is weighted by cluster size on the historical corpus (the first term reflects the predictability of detector performance within the cluster). This is the ratio of the average center distance between adjacent effective granularities (its second term reflects the inter-cluster separation); adjacent effective granularities refer to the nearest candidate partition granularity that precedes the current candidate partition granularity and has at least 2 effective clusters after low-support cluster redistribution (i.e., meets the granularity scoring conditions and participates in granularity scoring) when traversing each candidate partition granularity in ascending order of partition granularity; the average center distance is the average of the pairwise Euclidean distances between the centers of all effective clusters under this candidate partition granularity; the ratio of this ratio for the first candidate partition granularity in the effective granularity sequence is 1; if the immediately preceding candidate partition granularity does not meet the granularity scoring conditions (and is skipped), then the current candidate partition granularity is considered the first candidate partition granularity in the effective granularity sequence, and the ratio is 1. This represents the number of effective clusters after threshold filtering (its third term is the effective cluster complexity penalty). This is calculated separately for multiple candidate partitions. ,Will The largest candidate partition granularity is determined as the target partition granularity.

[0059] The predictability of in-cluster detector performance is determined by the mean squared error of leave-one-out cross-validation weighted by cluster size on the historical corpus. The performance is reflected in (intra-cluster ridge regression weighted by cluster size on the standardized sequence-level representation at the historical task / historical time series level and the corresponding detector performance vector); the inter-cluster separation is the ratio of the average center distance between adjacent effective granularities. The effective cluster complexity is reflected in the number of effective clusters after filtering by the support threshold. This is reflected in the fact that the joint score is performed without using target time series labels (where the detector performance vector is calculated offline using historical labels, which is considered offline supervision). The largest candidate partition granularity is used as the target partition granularity, and the effective clusters and their effective cluster centers under the target partition granularity are used as the effective clusters and their effective cluster centers for deployment. It should be noted that this step uses a three-item joint scoring, which can better balance learnability, distinguishability, and deployment complexity compared to using only a single criterion (such as using only predictability, or only BIC, silhouette coefficient, etc.).

[0060] (vi) In the cluster-specific detector performance prediction model training step, a cluster-specific detector performance prediction model is trained for each effective cluster used for deployment. The cluster training set for this effective cluster is constructed according to formula (3): (3) in, Indicates a valid cluster The cluster training set; Display window Window-level time series features; Representing historical time series The detector performance vector; Indicates a valid cluster ; express The set of windows. This formula will belong to the valid cluster. The detector performance vector of the historical time series is copied onto all its windows to form window-level training samples.

[0061] According to formula (4), the cluster-specific detector performance prediction model takes window-level time series features as input and the prediction performance of each candidate anomaly detector in the candidate anomaly detector set as output, that is, it maps window-level features into prediction performance vectors.

[0062] (4) in, Indicates a valid cluster Cluster-specific detector performance prediction model; The feature space representing the window-level time series features ( For the feature dimension, in the preferred embodiment (22) Represents the space in which the detector's predictive performance resides ( (Number of candidate anomaly detectors).

[0063] The preferred model is a multi-output random forest regression model, but alternative implementations may include gradient boosting trees, neural networks, multi-task regression models, or ranking models.

[0064] The deliverables of the offline phase include: shared feature processing parameters, effective clusters for deployment and their effective cluster centers, partition labels for historical time series, cluster-specific detector performance prediction models for each effective cluster, and a shared normalizer.

[0065] Example 2: Online Phase This embodiment illustrates the online phase of the detector orchestration method, including target time series feature extraction, routing, window-level prediction, gap threshold preservation, cross-window aggregation, bounded execution, anomaly output handling, weighted ordinal-rank fusion, and result output. Figure 3 As shown.

[0066] This embodiment uses a univariate time series as an example for illustration and adopts an online inference and whole-series processing approach during deployment: after the target time series arrives, it is routed, sorted, executed, and fused, specifically including the following steps: (I) In the target time series feature extraction step, for the target time series to be detected, it is divided into multiple windows according to the same preset window division method as the offline stage, the window-level time series features of the target time series are extracted, and the sequence-level representation of the target time series is obtained by aggregation according to formula (1). Then, the same shared normalizer is used for standardization to obtain the standardized sequence-level representation of the target time series.

[0067] (II) In the routing step, the distance between the normalized sequence-level representation of the target time series and the centers of each effective cluster is calculated according to formula (5), and the effective clusters that match the target time series are determined from the effective clusters based on the distance; (5) in, Represents the target time series The valid cluster to which the route is taken; Represents the target time series Standardized sequence-level representation; Indicates a valid cluster Valid cluster centers; This represents the Euclidean distance. The formula calculates the distance between the normalized sequence-level representation of the target time series and the centers of each effective cluster. Preferably, the effective cluster with the smallest distance (i.e., the closest center) is identified as the matching effective cluster, and the cluster-specific detector performance prediction model for that effective cluster is used.

[0068] (III) In the window-level prediction step, the selected cluster-specific detector performance prediction model is used to predict each window of the target time series to obtain the window-level prediction performance of each window.

[0069] When the distances from the standardized sequence-level representation of the target time series to multiple effective cluster centers are the same, the effective cluster with the larger historical support is selected first; if they are still the same, they are determined according to the preset and fixed effective cluster number order to ensure that the routing results can be reproduced.

[0070] (IV) In the gap threshold retention step, based on the window-level prediction performance, near-parallel detectors are adaptively retained according to the gap threshold to obtain a window-level retention set for each window. This window-level retention set contains at least the candidate anomaly detector with the highest prediction performance in the corresponding window. Preferably, the candidate anomaly detector with the highest prediction performance (i.e., the first one) is always retained in each window. The second one is retained when the gap between the first and second place in the prediction performance of the window does not exceed the gap threshold, and the third one is retained when the gap between the first and second place does not exceed the gap threshold and the gap between the second and third place does not exceed the gap threshold. This serves as the window-level retention set for that window. The upper limit of retention and the comparison relationship can be parameterized, but they are generated by the same gap threshold mechanism.

[0071] Set window The candidate anomaly detectors are arranged in descending order of window-level prediction performance as follows: , , The corresponding window-level prediction performance is Then the window Window-level reserved set for: in The gap threshold is preferably 0.05.

[0072] (V) In the cross-window aggregation step, according to formula (6), for each candidate anomaly detector, only when the candidate anomaly detector belongs to the window-level retention set of the corresponding window, its window-level prediction performance on that window is included in the accumulation, so as to obtain the cumulative prediction performance score of the candidate anomaly detector. (6) in, Indicates candidate anomaly detector For the target time series Cumulative prediction performance score; Display window For candidate anomaly detectors Window-level prediction performance; For indicator functions, when Belongs to window Window-level reserved set The value is 1 if the condition is met, otherwise it is 0. Display window The window-level retain set obtained by gap threshold retention. This formula is only applicable when... The prediction performance is accumulated over the reserved window.

[0073] The detector ranking (e.g., descending order of cumulative prediction performance score) and detector weights are determined based on the cumulative prediction performance scores of each candidate anomaly detector. The detector ranking is obtained by descending order of the cumulative prediction performance scores of each candidate anomaly detector. When the cumulative prediction performance scores can be effectively normalized, the corresponding cumulative prediction performance scores are normalized to obtain the detector weights.

[0074] When multiple candidate anomaly detectors have the same cumulative prediction performance score, they are first ordered by descending order of their average prediction performance across all windows. If they are still the same, they are ordered according to a preset and fixed candidate anomaly detector numbering order. When all candidate anomaly detectors have a cumulative prediction performance score of 0 or cannot be effectively normalized, candidate anomaly detectors are selected according to the above two-level stable sorting rule (i.e., when the cumulative prediction performance scores are the same, they are first ordered by descending order of their average window-level prediction performance across all windows; if they are still the same, they are ordered according to a preset and fixed candidate anomaly detector numbering order). The number of candidate anomaly detectors actually determined is not more than the upper limit of the number of detectors. Then for Each candidate anomaly detector is assigned... The uniform weighting is used as a degenerate weighting method when the detector weights cannot be normally determined by the cumulative prediction performance score.

[0075] (VI) In the bounded execution step, under the preset upper limit of the number of detectors, only candidate anomaly detectors ranked within the aforementioned upper limit of the number of detectors are executed to obtain the corresponding anomaly subsequences. The actual number of candidate anomaly detectors executed does not exceed the upper limit of the number of detectors. When the upper limit of the number of detectors is 1, one candidate anomaly detector is executed; when the upper limit of the number of detectors is greater than or equal to 2, multiple candidate anomaly detectors can be executed. The anomaly subsequences of the candidate anomaly detectors can be obtained by calling the corresponding candidate anomaly detectors in the online phase, or they can be read from the pre-generated anomaly subsequence storage that establishes an association between the target time series and the candidate anomaly detectors. When using pre-generated or cached anomaly subsequences, the read anomaly subsequence is the execution result of the corresponding candidate anomaly detector on the target time series.

[0076] (VII) In the abnormal output processing step, the validity of the acquired abnormal subsequences is checked. Candidate abnormal detectors that fail to run, have missing outputs, empty outputs, or no valid values ​​in their outputs are marked as invalid and removed from the set of executed candidate abnormal detectors. For the remaining valid abnormal subsequences, they are mapped and aligned to the length of the target time series according to a preset alignment rule; preferably, for parts with insufficient length, the last value of the abnormal subsequence is used to fill the length of the target time series, and for parts with excessive length, the length is truncated to the length of the target time series, and non-finite values ​​in the abnormal subsequence are set to 0; in other embodiments, interpolation, resampling, or preset value filling can also be used. If no valid abnormal subsequence exists, an execution failure flag is output, and a fallback detector can be called according to a preset strategy, or manual processing can be initiated.

[0077] When only one valid anomaly sequence exists after anomaly output processing, this valid anomaly sequence is directly used as the anomaly scoring sequence of the target time series, and weighted ordinal-rank fusion is not performed; when at least two valid anomaly sequences exist, the detector weights are renormalized on the candidate anomaly detector set corresponding to the valid anomaly sequence, and the following weighted ordinal-rank fusion steps are performed: When at least two valid anomaly score sequences exist, the valid anomaly score sequences are fused using a weighted ordinal rank fusion method based on detector weights to obtain a fused anomaly score sequence for the target time series, without cross-detector labeling of the anomaly scores of each candidate anomaly detector. Specifically, this includes: ranking the timestamps in descending order according to the anomaly score within each candidate anomaly detector to obtain the ordinal rank of the timestamp; determining the rank fusion score of each candidate anomaly detector at each timestamp based on the ordinal rank of the timestamp; and performing a weighted fusion of the rank fusion scores of each candidate anomaly detector using detector weights. Preferably, as shown in formula (7): (7) in, Represents timestamp The fusion anomaly score; This represents the set of candidate anomaly detectors that are retained after validity checks and participate in weighted ordinal-rank fusion; Indicates the detector weights in The weights obtained by supernormalization; Indicates candidate anomaly detector Internal timestamp Ranked in descending order of anomaly score, with the predicted most anomalous timestamp ranked as 1. It is a stability constant (preferably 60).

[0078] The formula first ranks the timestamps in descending order according to their anomaly scores within each candidate anomaly detector to obtain the timestamp ordinal rank, and then determines the rank fusion score (preferably 1 / ) based on this ordinal rank. Finally, the rank fusion scores are weighted and fused using the detector weights, without cross-detector labeling of the anomaly scores of each candidate anomaly detector.

[0079] In alternative implementations, the rank fusion score can also be in other function forms based on ordinal rank. When multiple timestamp anomaly scores output by the same candidate anomaly detector are the same, in a preferred implementation, the ordinal rank of the timestamps is determined by the parallel average rank of the multiple timestamps; in alternative implementations, the order of parallel timestamps can also be determined according to the original order of the timestamps, a preset numbering order, or other preset and fixed stable order.

[0080] In the output step, when only one valid anomaly subsequence is obtained, the time-stamped anomaly score or anomaly severity of the target time series is output based on this valid anomaly subsequence; when at least two valid anomaly subsequences are obtained, the time-stamped anomaly score or anomaly severity of the target time series is output based on the fused anomaly score sequence. In an optional thresholding implementation, thresholding processing can be applied to the time-stamped anomaly score or anomaly severity to obtain a binary anomaly or normal determination of the target time series; this binary determination is an optional post-processing and not a necessary form of the above output.

[0081] Example 3: Decision Source Tracing Record In the detector orchestration process of this invention, decision tracing information of routing decisions, detector ranking decisions, execution decisions, and fusion decisions can be recorded, such as... Figure 4 As shown.

[0082] As shown in formula (8), the target time series Decision-making traceability information It includes four parts: routing traceability information, sorting traceability information, execution traceability information, and fusion traceability information.

[0083] (8) Route source information includes the selected effective clusters and the route margin between the nearest and second nearest effective cluster centers (the route margin is the difference between the Euclidean distance from the normalized sequence-level representation of the target time series to the second nearest effective cluster center and the Euclidean distance to the nearest effective cluster center (i.e., the selected effective cluster). ,in , These are the nearest and second nearest effective cluster centers, respectively, and the contribution of the squared distance per feature (for the normalized sequence-level representation). Each feature component contributes to the squared distance. ,in For the k-th component of the normalized sequence-level representation, , These are the k-th components of the nearest and second-nearest effective cluster centers, respectively; they can be ordered by | (The top few features are selected in descending order to explain the routing decision, which explains why the target time series is routed to the effective cluster.)

[0084] The ranking and traceability information includes the top-ranked candidate anomaly detectors, cumulative prediction performance scores, the gap between the first and second ranked detectors, the number of times each candidate anomaly detector is retained, and at least one of the following: Paired TreeSHAP feature attribution (TreeSHAP is a SHAP feature attribution algorithm for tree ensemble models; Paired TreeSHAP feature attribution is: for the cluster-specific detector performance prediction model of the routed effective clusters, calculate the TreeSHAP attribution values ​​corresponding to the outputs of the first and second ranked candidate anomaly detectors respectively, and subtract each feature. Select the top few features in descending order of the absolute value of the difference to explain the source of the advantage of the first-ranked detector's cumulative prediction performance score relative to the second-ranked detector), which is used to explain the detector ranking and its feature basis.

[0085] The execution traceability information includes the set of candidate anomaly detectors that were executed and the upper limit on the number of detectors.

[0086] The fusion source tracing information includes detector weights and the cumulative share of each candidate anomaly detector in the fusion anomaly scoring sequence.

[0087] By using the above four layers of decision-making traceability information, the orchestration paths of routing, sorting, execution, and fusion can be audited afterward.

[0088] Optional implementation methods and alternative implementations Regarding the time series type, the above embodiments primarily use univariate time series as the main example. In an optional extended embodiment, the time series can be a multivariate time series. For multivariate time series, window-level time series features can be extracted for each variable, and the variable-wise features can be concatenated, pooled, or weighted and summarized. Furthermore, correlation features, frequency domain features, neighborhood features, or learned representations can be extracted to form window-level time series features for the target window. The above multivariate scenario is an optional extended embodiment, and the corresponding feature extraction method can be configured according to the specific application scenario, without affecting the technical solution of this invention, which primarily uses univariate time series as the main example.

[0089] Regarding the specific implementation of each step in the offline phase, the following preferred or alternative implementation methods can be adopted: the window-level time series features are preferably catch22 (22 canonical time series features), which can be replaced by tsfresh, frequency domain, neighborhood, or learned representations, etc.; the preset window partitioning method is preferably a fixed-length non-overlapping window, which can be replaced by other preset window partitioning methods; the clustering used for partitioning is preferably Ward agglomerative clustering, which can be replaced by other clustering methods compatible with distance routing; the cluster-specific detector performance prediction model is preferably a multi-output random forest regression model, which can be replaced by gradient boosting trees, neural networks, multi-task regression models, or ranking models; low-support clusters are preferably redistributed, and cluster merging can be used in optional alternative implementation methods.

[0090] Regarding the specific implementation of each step in the online phase, the following preferred or alternative implementation methods can be adopted: The routing method is preferably the nearest center distance route; the gap threshold retention method is preferably retained up to the third position, and its retention upper limit and comparison relationship can be parameterized; when the cumulative prediction performance score is all 0 or cannot be normalized, candidate anomaly detectors can be determined according to a preset stable sorting and uniform weights can be used; anomaly score alignment is preferably padded with the last value for insufficient length and truncated for excessive length; when only one valid anomaly score sequence exists, the valid anomaly score sequence is directly output; when at least two valid anomaly score sequences exist, weighted ordinal-rank fusion is performed; the rank fusion score of the weighted ordinal-rank fusion is preferably... , where κ is a stability constant, preferably 60; for parallel anomaly scores, the parallel average rank is preferred, but the original timestamp order, preset number order, or other preset and fixed stable order can also be used; in alternative implementations, other weighted fusion functions based on ordinal rank can also be used; the final output is a timestamp-by-time anomaly score or anomaly severity, and the binary anomaly or normal judgment is an optional thresholding implementation.

[0091] Regarding the deployment approach, this invention adopts an online phase, inference during deployment, and routing, sorting, execution, and fusion after the target time series arrives; implementation methods involving strict real-time, streaming window incremental updates, or continuous monitoring are optional extended implementation methods that can be configured according to specific deployment requirements.

[0092] Regarding the evaluation, the specific composition of the candidate anomaly detector set, evaluation criteria, evaluation indicators, and testing protocols are only used to illustrate the experimental results of this invention and do not constitute a limitation on the scope of protection of this invention. The embodiments of this invention are implemented using an experimental setup based on the TSB-AD-U benchmark and the OOD leave-one-domain-out protocol. ( The AVG.VUS-PR (AVG.VUS-PR is the average VUS-PR value over all evaluation time series; VUS-PR is the precision-recall volume under the surface) obtained by reserving an upper limit for the preset detectors is 0.623, with an average of 3.6 detectors executed and an average inference time of 71.2 seconds. The AVG.VUS-PR obtained by using OE-AVG (Outlier Ensemble-Average, where Outlier Ensemble uses the AVG (mean) fusion rule, averaging the anomaly scores of all basic anomaly detectors as the final anomaly score) as a reference for full pool integration is 0.636, with 20 detectors executed and an average inference time of 319.9 seconds. These experimental results demonstrate that the implementation of this invention can achieve near-full pool integration detection quality with significantly fewer candidate anomaly detectors executed and lower inference time. This invention also provides a detector orchestration system for time series anomaly detection, comprising: a historical corpus acquisition module for acquiring a set of candidate anomaly detectors, historical time series, and their detector performance vectors; a feature and partitioning module for extracting window-level time series features and sequence-level representations of the time series, constructing historical task partitions, and determining effective clusters for deployment and their effective cluster centers; a prediction model training module for training cluster-specific detector performance prediction models for each effective cluster; a routing and prediction module for routing the target time series to matching effective clusters and performing window-level detector performance prediction using the corresponding cluster-specific detector performance prediction model; and a prediction aggregation module for performing cross-window aggregation of the window-level prediction results. The system obtains the detector ranking and detector weights; a bounded execution module is used to execute the top-ranked candidate anomaly detectors within the upper limit of the number of detectors and obtain anomaly score sequences; a fusion and output module is used to perform validity checks and alignment on the obtained anomaly score sequences, and when a valid anomaly score sequence is obtained, output the valid anomaly score sequence as the anomaly score sequence of the target time series; when at least two valid anomaly score sequences are obtained, the valid anomaly score sequences are fused according to the detector weights based on the weighted ordinal rank of the timestamp within the detectors, and the fused anomaly score sequence is output; wherein, the routing and prediction module, the prediction aggregation module, the bounded execution module, and the fusion and output module do not use the label of the target time series during runtime.

[0093] The present invention also provides an electronic device, including a memory and a processor, wherein the memory stores a computer program or instructions, and when the computer program or instructions are executed by the processor, the steps of the above-described detector arrangement method are implemented.

[0094] The present invention also provides a computer-readable storage medium having a computer program or instructions stored thereon, wherein the computer program or instructions, when executed by a processor, implement the steps of the detector arrangement method described above.

[0095] The present invention also provides a computer program product, including a computer program or instructions, which, when executed by a processor, implement the steps of the above-described detector arrangement method.

[0096] The embodiments described above provide a detailed explanation of the technical solutions and beneficial effects of the present invention. It should be understood that the above descriptions are merely specific embodiments of the present invention and are not intended to limit the present invention. Any modifications, additions, and equivalent substitutions made within the scope of the principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A detector orchestration method for time series anomaly detection, characterized in that, Includes the following steps: (1) Obtain a set of candidate anomaly detectors and historical data, wherein the historical data includes a historical time series used to characterize the operating state of the monitored object and the corresponding detector performance vector; (2) Extract window-level time series features from each historical time series and aggregate them to obtain a sequence-level representation. Construct historical task partitions and determine the effective clusters and effective cluster centers for deployment. (3) Train cluster-specific detector performance prediction models for each effective cluster used for deployment; (4) The target time series to be detected is routed to the matching effective cluster, and the window-level detector performance is predicted using the corresponding cluster-specific detector performance prediction model; (5) Perform cross-window aggregation on the window-level prediction results to obtain the detector ranking and detector weights of the candidate anomaly detectors; (6) Execute the candidate anomaly detectors that rank higher in the detector sorting and obtain the corresponding anomaly subsequences; (7) Perform validity checks and alignment on the acquired abnormal subsequences and output the results; (8) Record the decision tracing information of the target time series to be detected.

2. The detector orchestration method for time series anomaly detection according to claim 1, characterized in that, Step (2) includes: (2-1) Divide the historical time series into multiple windows according to the preset window division method, and extract window-level time series features for each window; (2-2) Perform sequence-level aggregation on the window-level time series features of all windows of the historical time series to obtain the sequence-level representation of the historical time series, and then use a shared normalizer to standardize it to obtain the standardized sequence-level representation; (2-3) At each candidate partition granularity, the historical time series is clustered and partitioned based on the normalized sequence-level representation to obtain the historical task partition; the sequences in the low support clusters in the historical task partition are reassigned to the nearest support cluster center and the center is recalculated to obtain the effective clusters and their effective cluster centers at the candidate partition granularity. (2-4) For each candidate partition granularity, perform granularity scoring: ； in, Candidate partition granularity Granularity score; The number of historical time series; The mean squared error of leave-one-out cross-validation weighted by cluster size on the historical corpus; It is the ratio of the average center distance between adjacent effective particle sizes; The number of effective clusters; The candidate partition granularity with the highest granularity score is determined as the target partition granularity, and the effective clusters and effective cluster centers under the target partition granularity are used as the effective clusters and effective cluster centers for deployment.

3. The detector orchestration method for time series anomaly detection according to claim 1, characterized in that, Step (3) includes: (3-1) For each valid cluster used for deployment, construct the cluster training set: ； in, Indicates a valid cluster The cluster training set; Display window Window-level time series features; Representing historical time series The detector performance vector; Indicates a valid cluster ; express A collection of windows; (3-2) Use the effective cluster training set to train the cluster-specific detector performance prediction model.

4. The detector orchestration method for time series anomaly detection according to claim 1, characterized in that, In step (4), the effective cluster with the smallest distance between the normalized sequence-level representation of the target time series to be detected and the effective cluster centers used for deployment is determined as the matching effective cluster; When the distance to multiple valid cluster centers is the same, select the valid cluster with the larger historical support; if the historical support is still the same, determine the effective cluster numbering order according to the preset and fixed order.

5. The detector orchestration method for time series anomaly detection according to claim 1 or 4, characterized in that, Step (4) includes: (4-1) Divide the target time series to be detected into multiple windows according to the preset window division method, and extract window-level time series features for each window; (4-2) Perform sequence-level aggregation on the window-level time series features of all windows of the target time series to be detected to obtain the sequence-level representation of the target time series. Then, use a shared normalizer to standardize the data to obtain the standardized sequence-level representation of the target time series. (4-3) Calculate the distance between the normalized sequence-level representation of the target time series and the centers of each effective cluster, and determine the effective clusters that match the target time series from the effective clusters based on the distances: ； in, Represents the target time series The valid cluster to which the route is taken; Represents the target time series Standardized sequence-level representation; Indicates a valid cluster Valid cluster centers; Indicates Euclidean distance; (4-4) Use effective clusters The cluster-specific detector performance prediction model is used to predict the window-level detector performance of the target time series.

6. The detector orchestration method for time series anomaly detection according to claim 1, characterized in that, Step (5) includes: (5-1) Based on the window-level prediction performance, near-parallel detectors are adaptively retained according to the gap threshold to obtain the window-level retention set of each window; (5-2) Calculate the cumulative prediction performance score for each candidate anomaly detector. ; ； in, Display window For candidate anomaly detectors Window-level prediction performance; For indicator functions, when Belongs to window Window-level reserved set The value is 1 if the condition is met, otherwise it is 0. (5-3) Determine the detector ranking in descending order of cumulative prediction performance score. When the cumulative prediction performance score of the candidate anomaly detectors determined according to the detector ranking and the upper limit of the number of detectors can be effectively normalized, the corresponding cumulative prediction performance score is normalized and used as the detector weight. When the sum of the cumulative prediction performance scores of the candidate anomaly detectors determined according to the detector ranking and the upper limit of the number of detectors is 0, or when effective normalization cannot be performed, the uniform weight of the determined candidate anomaly detectors is calculated as the detector weight.

7. The detector orchestration method for time series anomaly detection according to claim 1, characterized in that, Step (7) includes: (7-1) Perform a validity check on the obtained abnormal subsequences. For candidate abnormal detectors that fail to run, have missing output, empty output, or no valid output value, mark them as invalid and remove them from the set of executed candidate abnormal detectors. (7-2) When no valid abnormal sequence exists, output an execution failure flag; When valid outlier subsequences exist, map and align them to the length of the target time series; When a valid anomaly score sequence is obtained, the valid anomaly score sequence is directly used as the anomaly score sequence of the target time series, and the time-stamped anomaly score or anomaly severity of the target time series is output. When at least two valid anomaly subsequences are obtained, the detector weights are renormalized on the set of candidate anomaly detectors corresponding to the valid anomaly subsequences to obtain the weights. And perform the weighted ordinal rank fusion step (7-3); (7-3) Rank the timestamps in descending order according to the size of the anomaly score in each candidate anomaly detector corresponding to the effective anomaly score sequence, and obtain the timestamp ordinal rank. Determine the rank fusion score of each candidate anomaly detector at each time stamp. The rank fusion scores of each candidate anomaly detector are weighted and fused to obtain the timestamp. Fusion anomaly scoring : ； in, It is the stability constant; The time-stamped anomaly score or anomaly severity of the target time series is output based on the fused anomaly scoring sequence.

8. A detector orchestration system for time series anomaly detection, characterized in that, include: The historical corpus acquisition module acquires a set of candidate anomaly detectors and historical corpus, wherein the historical corpus includes historical time series used to characterize the operating state of the monitored object and the corresponding detector performance vector; The feature and partitioning module extracts window-level time series features from each historical time series and aggregates them to obtain a sequence-level representation, constructs historical task partitions, and determines effective clusters and effective cluster centers; The prediction model training module trains cluster-specific detector performance prediction models for each effective cluster. The routing and prediction module routes the target time series to be detected to a matching effective cluster and uses the corresponding cluster-specific detector performance prediction model to predict the window-level detector performance. The prediction aggregation module performs cross-window aggregation on the window-level prediction results to obtain the detector ranking and detector weights of the candidate anomaly detectors; The bounded execution module executes the candidate anomaly detectors that rank higher in the detector sorting and obtains the corresponding anomaly score sequence. The fusion and output module performs validity checks and alignment on the acquired abnormal subsequences and then outputs them. The decision tracing and recording module records the decision tracing and recording information of the target time series to be detected.

9. An electronic device, characterized in that, It includes a memory and a processor, wherein the memory stores a computer program or instructions, which, when executed by the processor, implement the steps of the detector orchestration method according to any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, It stores computer programs or instructions, which, when executed by a processor, implement the steps of the detector arrangement method according to any one of claims 1-7.

Images