A time series anomaly detection method based on multi-view wavelet decomposition and generative adversarial network
Patent Information
- Application Number
- CN202611055094.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-07-15
- Publication Date
- 2026-10-20
AI Technical Summary
然而，现有深度学习方法大多直接在原始时间序列上进行特征学习，难以充分挖掘特征信息，对于局部异常和突发异常的检测能力有限；同时，多变量时间序列中不同变量之间存在复杂的相关关系，单一特征表示难以有效描述时间序列的特征；此外，现有异常评分方法大多采用平均误差或最大误差作为异常判定依据，对局部异常信息利用不足，导致异常检测结果容易受到噪声影响，从而降低检测精度和鲁棒性
[0050]本发明通过多层离散小波分解构建多视图特征表示，并结合多编码器和注意力机制实现特征融合，能够充分挖掘多变量时间序列的多尺度特征信息；通过生成对抗网络学习正常时间序列模式，并利用融合平均误差、最大误差、通道误差和时间误差的综合异常评分机制，提高对局部异常和突发异常的检测能力；同时，采用基于95分位数的自适应阈值确定方法，提高了异常检测方法的鲁棒性和适应性。
Smart Images
Figure QLYQS_3 
Figure BSA0000307653200000071 
Figure BSA0000307653200000091
Abstract
Description
Technical Field
[0001] This invention relates to the field of time series anomaly detection technology, specifically to a time series anomaly detection method based on multi-view wavelet decomposition and generative adversarial networks. Background Technology
[0002] With the rapid development of the Industrial Internet, intelligent manufacturing, smart energy, and industrial control systems, a large number of sensors, monitoring devices, and control units continuously generate high-dimensional, multivariate time series data. Multivariate time series data can reflect the operating status of a system at different time scales, and its anomaly detection technology has significant application value in fields such as industrial equipment condition monitoring, cybersecurity, fault diagnosis, and intelligent operation and maintenance. Therefore, how to efficiently and accurately detect anomalies in multivariate time series data has become an important research direction in the field of time series analysis.
[0003] Generally, when time series data deviates from its normal operating pattern, it is considered an anomaly. Based on the duration and manifestation of the anomaly, time series anomalies are typically categorized into point anomalies, context anomalies, and sequence anomalies. Point anomalies manifest as data deviating from the normal range at a local point in time; context anomalies manifest as data inconsistent with the normal pattern under a specific environment; and sequence anomalies manifest as an overall pattern deviating from the normal state over a continuous period. Because anomalies in industrial control systems and equipment monitoring systems are often sudden and localized, accurate detection of local anomalies in multivariate time series is of great significance.
[0004] Currently, researchers in this field mainly conduct research on multivariate time series anomaly detection using statistical methods, distance methods, clustering methods, traditional machine learning methods, and deep learning methods. Statistical methods identify anomalies by establishing data distribution models and utilizing statistical features; these methods are simple in structure but have limited ability to model complex nonlinear data. Distance-based methods identify anomalies by calculating the distance relationships between samples, but their computational complexity is high in high-dimensional data scenarios. Clustering-based methods utilize the similarity between samples for anomaly detection, and their detection performance largely depends on the clustering results. Traditional machine learning methods achieve anomaly detection through classification or prediction models, but require complex feature engineering and have limited generalization ability.
[0005] Furthermore, with the development of deep learning technology, an increasing number of studies are employing models such as autoencoders, recurrent neural networks, Transformers, and generative adversarial networks (GANs) to achieve anomaly detection in multivariate time series. Reconstruction-based methods learn the feature distribution of normal samples and utilize reconstruction errors to achieve anomaly detection; prediction-based methods predict future data and utilize prediction errors for anomaly identification; and GAN-based methods utilize adversarial training between the generator and discriminator to improve the representation ability of normal patterns, exhibiting good detection performance in complex scenarios. However, most existing deep learning methods directly learn features from the original time series, making it difficult to fully mine feature information and limiting their ability to detect local and sudden anomalies. Simultaneously, complex correlations exist between different variables in multivariate time series, making it difficult for a single feature representation to effectively describe the characteristics of the time series. In addition, most existing anomaly scoring methods use average error or maximum error as the basis for anomaly judgment, insufficiently utilizing local anomaly information, making the anomaly detection results susceptible to noise, thereby reducing detection accuracy and robustness.
[0006] It is evident that existing multivariate time series anomaly detection methods struggle to fully utilize time series information, exhibiting insufficient ability to detect local and sudden anomalies. Furthermore, anomaly scoring mechanisms do not adequately leverage locally significant anomaly features, impacting the accuracy and stability of anomaly detection results. Therefore, it is necessary to propose a multivariate time series anomaly detection method that can effectively mine multi-scale feature information, enhance local anomaly detection capabilities, and improve anomaly detection robustness. Summary of the Invention
[0007] To address the aforementioned problems in existing technologies, this invention provides a time series anomaly detection method based on multi-view wavelet decomposition and generative adversarial networks. The technical problem to be solved by this invention is achieved through the following technical solution:
[0008] Obtain the original multivariate time series data, and divide the original multivariate time series into sliding window segments to obtain time series window samples;
[0009] Discrete wavelet decomposition is performed on the time series window samples to obtain low-frequency approximate components and detail components at different scales, and three-view data is constructed.
[0010] Each view data is input into the corresponding feature encoder for feature extraction, and the features of different views are weighted and fused using an attention mechanism to obtain a fused feature representation;
[0011] The fused feature representation is input into the generative adversarial network, the input sequence is reconstructed by the generator, and the generator is optimized adversarially by the discriminator in order to learn normal time series patterns.
[0012] An error matrix is constructed based on the error between the original sequence and the reconstructed sequence, and the average error, maximum error, channel error and time error are calculated respectively. A comprehensive anomaly score is obtained by weighted fusion.
[0013] The anomaly detection threshold is determined based on the 95th percentile of the comprehensive anomaly score of the training samples, and the comprehensive anomaly score of the sample to be detected is compared with the anomaly detection threshold to determine whether the sample to be detected is abnormal.
[0014] In some embodiments, the preprocessing of the original multivariate time series data to obtain a time series window sample specifically includes:
[0015] Standardize the original multivariate time series data to eliminate the differences in the units of measurement between different variables and improve the stability of model training;
[0016] The standardized time series is segmented using a sliding window to obtain time series window samples of fixed length. The length of the sliding window is set according to the dynamic characteristics of the time series and is used to capture the temporal dependencies and local change features between variables.
[0017] In some embodiments, performing discrete wavelet decomposition on time series window samples to construct multi-view data specifically includes:
[0018] Discrete wavelet transform is used to perform two-level decomposition on the time series window samples to obtain detail components at different scales;
[0019] Low-frequency, mid-frequency, and high-frequency views are constructed using detail components at different scales to characterize the variation features of time series at different frequency scales.
[0020] In some embodiments, the step of extracting features from each view data using three encoders and then weighting and fusing the features from different views using an attention mechanism specifically includes:
[0021] Three independent encoders are used to extract feature representations corresponding to the low-frequency view, mid-frequency view, and high-frequency view, respectively.
[0022] The features of each view are aggregated by an adaptive average pooling layer to obtain the global feature vector corresponding to each view;
[0023] Calculate the weight coefficients corresponding to the features of each view using an attention mechanism;
[0024] The features of each view are weighted and fused according to the weight coefficients to obtain a fused feature representation.
[0025] In some embodiments, the reconstructing training of the fused feature representation using a generative adversarial network specifically includes:
[0026] The fused feature representation is input into the generator to obtain the reconstructed sequence. The original sequence and the reconstructed sequence are then input into the discriminator to distinguish between real samples and generated samples. An adversarial training approach is used to alternately optimize the generator and discriminator to learn the feature distribution of a normal time series.
[0027] The generator loss function includes adversarial loss, reconstruction loss, and feature matching loss.
[0028] In some embodiments, the reconstruction loss is calculated using the mean absolute error to measure the difference between the original sequence and the reconstructed sequence;
[0029] The feature matching loss is calculated by comparing the differences between features in the intermediate layer of the discriminator to improve the generator's ability to learn normal patterns.
[0030] In some embodiments, constructing a comprehensive anomaly score based on the error between the original sequence and the reconstructed sequence specifically includes:
[0031] Calculate the error matrix between the original sequence and the reconstructed sequence;
[0032] The average error is calculated based on the error matrix to characterize the overall reconstruction error level;
[0033] The maximum error is calculated based on the error matrix to enhance the ability to perceive significant anomalous features;
[0034] By calculating channel error, the ability to detect anomalies in key variables is enhanced; by calculating time error, the ability to detect sudden local anomalies is enhanced.
[0035] The average error, maximum error, channel error, and time error are weighted and fused to obtain a comprehensive anomaly score.
[0036] The comprehensive anomaly score is obtained by weighted summation of average error, maximum error, channel error, and time error, with the sum of each weight coefficient being 1.
[0037] In some embodiments, determining the anomaly detection result based on the comprehensive anomaly score specifically includes:
[0038] Obtain the comprehensive anomaly score set corresponding to the training sample, calculate the 95th percentile based on the comprehensive anomaly score set, use it as the anomaly judgment threshold, and determine whether the comprehensive anomaly score of the sample to be detected is greater than the anomaly judgment threshold.
[0039] If the overall anomaly score of the sample to be tested is greater than the anomaly determination threshold, the sample is determined to be an abnormal sample; otherwise, the sample is determined to be a normal sample.
[0040] In some embodiments, the method further includes a model training phase prior to performing anomaly detection:
[0041] We acquire training data containing only normal samples, perform sliding window partitioning and view construction on the training data, and conduct end-to-end training using multiple encoders, attention fusion modules, and generative adversarial networks. We use a weighted combination of adversarial loss, reconstruction loss, and feature matching loss as a joint optimization objective to iteratively optimize the generator and discriminator to obtain model parameters for anomaly detection.
[0042] Another aspect of this invention proposes a time series anomaly detection device based on multi-view wavelet decomposition and generative adversarial networks, the device comprising:
[0043] The data acquisition module is used to acquire multivariate time series data;
[0044] The preprocessing module is used to normalize and slice the multivariate time series data using a sliding window to obtain time series samples.
[0045] The multi-view construction module is used to perform wavelet decomposition on the time series samples to construct a low-frequency view and multiple high-frequency views, so as to obtain time series feature representations under different frequency bands.
[0046] The feature extraction and fusion module includes multiple encoders and attention fusion units, which are used to extract deep features of each view respectively, and perform weighted fusion of the features of each view to obtain a multi-view fused feature representation;
[0047] The adversarial learning module, including a generator and a discriminator, is used to learn the data distribution of normal samples through adversarial training, thereby improving the model's ability to model and reconstruct complex temporal patterns.
[0048] The anomaly scoring module is used to calculate the reconstruction error based on the difference between the reconstruction result and the original sample, and to construct a comprehensive anomaly score by combining the channel dimension error, time dimension error, average error and maximum error.
[0049] The anomaly detection module is used to compare the comprehensive anomaly score with a preset threshold and output the anomaly detection results of the multivariate time series.
[0050] This invention constructs multi-view feature representations through multi-layer discrete wavelet decomposition and achieves feature fusion by combining multiple encoders and attention mechanisms, which can fully explore the multi-scale feature information of multivariate time series. By learning normal time series patterns through generative adversarial networks, and utilizing a comprehensive anomaly scoring mechanism that integrates average error, maximum error, channel error, and time error, the detection capability of local and sudden anomalies is improved. At the same time, an adaptive threshold determination method based on the 95th quantile is adopted to improve the robustness and adaptability of the anomaly detection method.
[0051] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description
[0052] Figure 1 A flowchart illustrating the steps of a multivariable time series anomaly detection method based on multi-view wavelet decomposition and generative adversarial networks provided in an embodiment of the present invention.
[0053] Figure 2 A diagram illustrating the generative adversarial network framework provided in this embodiment of the invention;
[0054] Figure 3a This is a performance comparison chart of the present invention method and existing methods on the PSM dataset, provided in an embodiment of the invention.
[0055] Figure 3b This is a performance comparison chart of the present invention method and existing methods on the SGaT dataset provided in this embodiment of the invention;
[0056] Figure 4a The graph showing the impact of timing window length on detection performance is provided in the embodiments of the present invention.
[0057] Figure 4b This is a graph showing the impact of potential spatial dimensions on detection performance, provided in an embodiment of the present invention.
[0058] Figure 4c This is a graph showing the influence of different wavelet bases on detection performance, provided in an embodiment of the present invention.
[0059] Figure 5a This is an anomaly score distribution diagram of the PSM test set provided in an embodiment of the present invention;
[0060] Figure 5b Anomaly score distribution diagram of the SWaT test set provided in an embodiment of the present invention. Detailed Implementation
[0061] The present invention will be further described in detail below with reference to specific embodiments, but the implementation of the present invention is not limited thereto.
[0062] Please see Figure 1 , Figure 1This is a flowchart of the steps of the multivariate time series anomaly detection method based on wavelet multiview and generative adversarial network provided in the embodiments of the present invention. Figure 1 The methods include, but are not limited to, steps S1 to S6.
[0063] Step S1: Obtain the raw multivariate time series data.
[0064] The original multivariate time series data originates from industrial process monitoring systems, sensor networks, or equipment logs, containing continuous values collected by multiple sensor channels on the same time axis. Each timestamp corresponds to a multidimensional vector, where each dimension represents a physical quantity or state variable, such as temperature, pressure, vibration amplitude, or current intensity. In this embodiment, the data is stored in CSV file format, with the last column as the label and the remaining columns as feature variables. To eliminate the influence of dimensions, each feature dimension is first independently min-max normalized, mapping the values to the [0, 1] interval. The normalization formula is:
[0065]
[0066] Where, x i Let x be the total number of time series values for the i-th feature. i ' represents the normalized value. The normalization coefficients need to be persistently saved so that the same transformation can be performed on new data during deployment.
[0067] Step S2: Divide the normalized multivariate time series into sliding window segments to generate window samples.
[0068] Using a sliding window approach to segment the time series, let the window length be L and the sliding step size be S. Then, the sample of the i-th window is represented as:
[0069] W i ={x i x i+1 , ..., x i+L-1}
[0070] Where, x i Let represent the multivariate observation at time i. By using a sliding window, the original time series is transformed into fixed-length window samples to preserve the local temporal dependencies of the data. The sliding window not only increases the number of training samples but also provides a fixed-length input for subsequent multi-scale time-frequency analysis.
[0071] Step S3: Perform wavelet decomposition on each window sample to obtain low-frequency approximate components and high-frequency detail components at different scales, and construct multi-view data.
[0072] Wavelet transform can simultaneously extract both time and frequency domain information of a signal. This step uses discrete wavelet transform to decompose each window sample into multiple scale components. Specifically, L-level wavelet decomposition is performed on each feature channel of the window sample. The wavelet basis function chosen is the symmetric 4 wavelet, which has symmetry and approximately linear phase characteristics. Symmetric extension is used for boundary processing to avoid boundary effects. When the number of decomposition levels L = 2, each feature channel generates one low-frequency approximation coefficient A2 and two high-frequency detail coefficients D2 and D1. Subsequently, inverse wavelet transform is used to reconstruct each set of coefficients back to the original length W, resulting in three reconstructed components of the same length as the original window:
[0073] (1) Low-frequency approximation view: reconstructed separately by A2 coefficients, reflecting the overall trend and low-frequency components of the signal;
[0074] (2) Mid-frequency detail view: Reconstructed separately from D2 coefficients to capture mid-frequency fluctuations;
[0075] (3) High-frequency detail view: Reconstructed separately from D1 coefficients to extract high-frequency noise or peak details.
[0076] Each original window sample is expanded into three view samples, representing signal representations from different frequency domain perspectives, providing diverse inputs for subsequent multi-view feature learning.
[0077] Step S4: Extract deep features from each view using multiple encoders, and fuse features using an attention mechanism to obtain a fused feature representation.
[0078] This step constructs a generator network, whose core consists of three independent but structurally identical encoders, which respectively process the low-frequency approximation view, the mid-frequency detail view, and the high-frequency detail view. Each encoder consists of multiple one-dimensional convolutional layers, batch normalization layers, and LeakyReLU activation functions. Finally, the temporal dimension is compressed to 1 through adaptive average pooling, and then mapped to a fixed-dimensional latent vector through a 1×1 convolution.
[0079] An attention mechanism is used to adaptively fuse the latent encodings from three views. First, each latent vector is mapped to a scalar score through a linear layer:
[0080] s v =Linear(z) v v∈{A,D2,D1}
[0081] Concatenate the three fractions to form S = [s A s D2 s D1 The normalized weights are obtained by applying the softmax function.
[0082]
[0083] The final fused feature z is a weighted sum of the latent vectors of each view:
[0084] z = α A z A +α D2 z D2 +α D1 z D1
[0085] This fusion feature retains the discriminative information of each view and dynamically emphasizes the frequency components that are more important to the current sample through attention weights, making the representation more robust.
[0086] Step S5: Reconstruct the fused features using a generative adversarial network, and calculate the comprehensive anomaly score by combining the average error, maximum error, channel error, and time error.
[0087] Please see Figure 2 , Figure 2 This is a diagram of the generative adversarial network framework provided in an embodiment of the present invention. The generative adversarial network consists of two parts: a generator and a discriminator. The generator and discriminator train by playing against each other, and fit the real data distribution through adversarial learning.
[0088] The decoder in the generator is responsible for restoring the fused features to a reconstructed window of the same size as the original window. The decoder consists of multiple convolutional layers. First, the dimensions are expanded, and then the features are passed through convolutional layers sequentially. Each convolution is followed by batch normalization and ReLU activation (the last layer uses Sigmoid activation). Finally, the temporal length is restored to the original window size through linear interpolation to obtain the reconstructed window.
[0089] To improve reconstruction quality and adversarial training stability, this embodiment introduces a discriminator network to engage in an adversarial game with the generator. The discriminator employs a convolutional structure similar to the encoder, but its final output is the probability of a sample being real (a scalar between 0 and 1). During training, the generator attempts to produce reconstruction results that are as close as possible to the real window to deceive the discriminator, while the discriminator strives to distinguish between the real window and the reconstructed window. The generator's loss function consists of three parts:
[0090] (1) Adversarial loss: Make the discrimination score of the reconstructed window tend to the true label by using binary cross-entropy loss.
[0091] (2) Reconstruction loss: measures the difference between the reconstructed window and the original window.
[0092] (3) Feature matching loss: Calculate the L1 distance between the output features of the discriminator intermediate layer on the real window and the reconstructed window, so as to enable the generator to learn a more realistic feature distribution.
[0093] The total generator loss is obtained by weighted summation of the above three losses.
[0094] After training, for any test window sample, it is input into the generator to obtain a reconstructed window, and a comprehensive anomaly score is calculated. The comprehensive score integrates four error metrics to comprehensively capture different types of anomaly patterns:
[0095] (1) Average error: reflects the overall reconstruction deviation.
[0096] (2) Maximum point error: highlighting instantaneous spike anomalies.
[0097] (3) Channel error: First, the average value of each channel in the time dimension is calculated, and then the average value of the top 20% of channels with the largest error is selected to detect the continuous abnormality of local channels.
[0098] (4) Time error: First, calculate the average value of each time point in the channel dimension, and then select the average value of the first 20% of time points with the largest error to highlight short-term sudden anomalies.
[0099] The final comprehensive anomaly score is the weighted sum of the above four items. The higher the score, the greater the likelihood that the sample in that window is anomaly.
[0100] Step S6: Determine the judgment threshold based on the 95th percentile of the anomaly scores in the training set, and output the anomaly detection result based on the comparison between the anomaly scores and the judgment threshold.
[0101] To ensure the detection threshold is statistically significant, this step uses all normal samples in the training set to calculate the anomaly score Ω = {Score1, Score2, ..., Score...} n The 95th percentile of these ratings is taken as the judgment threshold, i.e., T = Q. 0.95 (Ω).
[0102] In the actual detection phase, for the window sample to be tested, its comprehensive score is also calculated and compared with the threshold. If the score is greater than T, the sample is determined to be an abnormal sample; otherwise, it is determined to be a normal sample.
[0103] The following simulation experiments further illustrate the proposed multivariate time series anomaly detection method based on multi-view wavelet decomposition and generative adversarial networks.
[0104] This embodiment uses the SWaT and PSM datasets for experiments. The SWaT dataset is a publicly available dataset from a real water treatment plant's industrial control system, recording time-series data of sensors, valves, and pumps under normal system operation and various network attacks. It is the most commonly used standard test dataset in the fields of industrial control security and time-series anomaly detection. The PSM dataset is a publicly available multi-dimensional, multi-variable time-series benchmark dataset for servers from eBay, containing 26-dimensional server performance monitoring time-series data and labeled anomalies. It is a general test dataset for validating time-series anomaly detection algorithms in internet operation and maintenance scenarios. The experimental environment is based on the PyTorch deep learning framework.
[0105] To accurately evaluate the detection performance of this method, precision, recall, and F1 score are introduced as the main evaluation metrics. The effectiveness of the proposed method is verified from three aspects: overall performance comparison, sensitivity of key hyperparameters, and anomaly score distribution.
[0106] Figure 3a and Figure 3b This is a performance comparison chart of the method provided in this embodiment of the invention. The method is compared with 10 baseline methods on the same dataset. These baseline methods cover statistical and linear dimensionality reduction methods, reconstruction-based deep learning methods, temporal modeling and generative models, and cutting-edge interdisciplinary methods. Figure 3a As shown, on the PSM dataset, the F1 score reaches 0.9527, achieving the best result. Figure 3b As shown, on the SWaT dataset, our method achieves the best results in precision, recall, and F1 score, with an F1 score of 0.9804, representing improvements of 12.9 and 12.5 percentage points respectively compared to the current best-performing baseline models THOC (F1 = 0.8513) and TimesNet (F1 = 0.8550). This demonstrates that our invention effectively utilizes wavelet multi-view decomposition to extract frequency features of signals and combines this with generative adversarial networks to achieve high-precision multivariate time series anomaly detection, making it suitable for applications such as industrial control and equipment monitoring.
[0107] Figure 4a This is a graph illustrating the impact of the timing window length on detection performance, provided in an embodiment of the present invention. Figure 4a It can be seen that a medium window length (L=30) achieves the best balance between precision and recall; a window that is too short will cause the model to lack sufficient contextual information, while a window that is too long will over-smooth dynamic features. Figure 4b The graph showing the impact of latent dimensional variables on detection performance, as provided in this embodiment of the invention. Figure 4bIt can be seen that when the latent dimension is equal to 32, the optimal balance between precision and recall is achieved. If the dimension is too small, key covariance and high-frequency details in normal patterns will be lost, resulting in a larger reconstruction error for normal samples, thus drowning out anomalous signals. If the dimension is too high, the encoder will over-memorize noise and even anomalous patterns in the training samples, causing the decoder to accurately reconstruct anomalous windows as well, resulting in overlapping reconstruction errors between normal and anomalous samples. Figure 4c It can be seen that the sym4 wavelet basis has the best anomaly detection performance. This wavelet basis achieves a good balance between smoothness and computational efficiency, and can stably compress multivariate signals under normal conditions into a 32-dimensional potential space. At the same time, it makes the anomalous peaks produce a more significant energy response in the D1 high-frequency component, and ultimately makes the comprehensive anomaly score more sensitive to real anomalies, thus obtaining the best detection performance.
[0108] Figure 5a and Figure 5b This is a distribution chart of anomaly scores at certain time points in the test set provided in this embodiment of the invention. From the distribution pattern, the anomaly scores of PSM samples are mainly concentrated in the low-value region below 0.2, while the anomaly probabilities of anomaly samples are widely distributed in the high-value region between 0.2 and 1.0. The distributions of the two types of samples show a clear separation interval but still have a small overlap. The threshold of 0.245 is precisely located in the overlapping transition zone between the two distributions, which can both classify the vast majority of normal samples as normal and capture most of the anomaly samples, achieving effective differentiation between normal and anomaly. Similarly, the anomaly probabilities of normal samples in SWaT are mostly concentrated in the low-probability range below 0.2, with a high kurtosis, indicating that the model's reconstruction error for normal samples is small and stable; the anomaly probabilities of anomaly samples show a wider distribution pattern, mainly concentrated between 0.2 and 0.8, with some extreme anomalies even approaching 1.0, indicating that the model's reconstruction error for anomaly samples is significantly increased. This demonstrates that the anomaly detection method based on wavelet multi-view and generative adversarial networks proposed in this invention has good discriminative ability and generalization performance.
[0109] As can be seen from the above embodiments, the beneficial effects of the present invention are as follows: The present invention constructs low-frequency and high-frequency multi-view data through multi-layer discrete wavelet decomposition, and uses multiple encoders and attention mechanisms to achieve adaptive fusion of features of different frequencies. By learning the feature distribution of normal time series through generative adversarial networks, and combining average error, maximum error, channel error and time error to construct a comprehensive anomaly scoring mechanism, it can effectively improve the perception ability of local anomalies and sudden anomalies. At the same time, the adaptive threshold determination method based on the 95th quantile is adopted to improve the accuracy, robustness and adaptability of anomaly detection.
[0110] In the description of this invention, the terms "first" and "second" are used only to distinguish different objects and are not intended to indicate or imply any order, quantity, or importance. The term "a plurality of" refers to two or more. The term "comprising" and any variations thereof are intended to cover non-exclusive inclusion.
[0111] The terms "one embodiment," "some embodiments," "example," or "specific example" used in this specification are intended to indicate that the relevant technical solution is included in at least one embodiment of the present invention. The appearance of these terms in different positions in the specification does not necessarily refer to the same embodiment. For those skilled in the art, in the absence of contradictions, the technical features described in different embodiments or examples can be combined or substituted with each other to form other embodiments.
[0112] The present invention has been described in detail above with reference to preferred embodiments, but the scope of protection of the present invention is not limited to the above embodiments. Various equivalent substitutions, modifications, improvements, or variations made by those skilled in the art based on the disclosure of the present invention without departing from the spirit and substance of the invention should fall within the scope of protection of the present invention. The scope of protection of the present invention is determined by the appended claims and their equivalents.
Claims
1. A time series anomaly detection method based on multi-view wavelet decomposition and generative adversarial networks, characterized in that, The time series anomaly detection method, applied to a multivariate time series anomaly detection system, includes: Obtain the original multivariate time series data, and divide the original multivariate time series using a sliding window to obtain time series window samples; Wavelet decomposition is performed on the time series window samples to obtain low-frequency, mid-frequency, and high-frequency detail components to construct multi-view data; The multi-view data is processed by multiple encoders to extract features, and the features of each view are weighted and fused using an attention mechanism to obtain a fused feature representation. The fused feature representation is input into the generative adversarial network for training. The reconstructed sequence is obtained through the generator, and the discriminator is used to perform adversarial optimization on the generator. An anomaly score is calculated based on the error between the original sequence and the reconstructed sequence. The anomaly score includes the average error, the maximum error, the channel error, and the time error. The anomaly detection threshold is determined based on the 95th percentile of the anomaly scores in the training samples, and the anomaly detection result is determined based on the comparison between the anomaly scores and the anomaly detection threshold.
2. The multivariate time series anomaly detection method based on multi-view wavelet decomposition and generative adversarial networks according to claim 1, characterized in that, A sliding window of length L is used to divide the original multivariate time series. The sliding window moves step by step according to a preset step size to generate multiple time series window samples: W i =[x i ,x i+1 ,…,x i+L-1 ]。 3. The multivariate time series anomaly detection method based on multi-view wavelet decomposition and generative adversarial networks according to claim 2, characterized in that, The steps for performing discrete wavelet decomposition on the time series window samples include: Wavelet transform is used to perform a two-level decomposition on the time series window samples to obtain the low-frequency approximation component A2, the second-level high-frequency detail component D2, and the first-level high-frequency detail component D1, and then a three-view data is constructed: V = {A, D2, D1} Among them, the low-frequency approximation component is used to characterize the overall trend of the time series, while the mid-frequency and high-frequency detail components are used to characterize the local change information of the time series.
4. The multivariate time series anomaly detection method based on multi-view wavelet decomposition and generative adversarial networks according to claim 3, characterized in that, The steps of extracting features from each view using multiple encoders and fusing features through an attention mechanism include: The first encoder, second encoder, and third encoder are used to extract the feature representations corresponding to the low-frequency approximation component, high-frequency detail component, and mid-frequency approximation component, respectively, to obtain Z. A , and The attention mechanism is used to calculate the weight coefficients corresponding to the features of each view, and the fused feature representation is obtained: z=α A With A +α D2 With D2 +α D1 With D1 Where, α A +α D2 +α D1 =1, and each weight coefficient is calculated by the Softmax function.
5. The multivariate time series anomaly detection method based on multi-view wavelet decomposition and generative adversarial networks according to claim 4, characterized in that, The steps for reconstructing using a generative adversarial network include: inputting the fused features into the generator to obtain the reconstructed sequence. A discriminator is used to differentiate between the original and reconstructed sequences, and normal pattern learning is achieved by alternately optimizing the generator and discriminator. The generator loss function includes adversarial loss, reconstruction loss, and feature matching loss. L G =L adv +λ1L rec +λ2L fm Among them, L adv Indicating resistance to loss, L rec L represents the reconstruction loss. fm λ1 and λ2 represent the feature matching loss and the corresponding weight coefficients, respectively.
6. The multivariate time series anomaly detection method based on multi-view wavelet decomposition and generative adversarial networks according to claim 5, characterized in that, A comprehensive anomaly score is constructed based on the error between the original sequence and the reconstructed sequence. Calculate the error matrix, average error, maximum error, channel error, and time error, and then calculate the comprehensive anomaly score according to the following formula: S score =0.2S mean +0.3S channel +0.3S time +0.2S max 。 7. The time series anomaly detection method based on multi-view wavelet decomposition and generative adversarial networks according to claim 1, characterized in that, The 95th percentile is calculated using the comprehensive anomaly score set of the training samples to determine whether the comprehensive anomaly score of the sample to be detected is greater than the 95th percentile threshold. If the overall anomaly score is greater than the 95th percentile threshold, the sample to be tested is determined to be an abnormal sample; otherwise, the sample to be tested is determined to be a normal sample.