A time series data anomaly detection method, device, equipment, medium and product

Abstract

The present disclosure relates to an anomaly detection method and device for time series data, equipment, medium and product. The method comprises: inputting original time series data into an encoder based on a self-attention model for encoding processing to obtain a target feature matrix; the target feature matrix is used to indicate the relationship between the multi-dimensional data corresponding to each time point in the original time series data, and the characteristics of each dimensional data at each time point; inputting the target feature matrix into a memory network model to obtain a target prediction sequence; the target prediction sequence is used to indicate the predicted values of each dimensional data at historical time and future time; determining an anomaly evaluation result of the original time series data based on the target prediction sequence; the anomaly evaluation result is used to represent the anomaly degree of each dimensional data corresponding to each time point in the original time series data; and determining abnormal data in the original time series data based on the anomaly evaluation result. The present disclosure can accurately detect abnormal data in time series data, and has strong scene generalization.

Description

Technical Field

[0001] This disclosure relates to the field of artificial intelligence technology, and in particular to a method, apparatus, device, medium and product for anomaly detection of time-series data. Background Technology

[0002] Anomaly detection, also known as anomaly identification or outlier detection, is a key technology for identifying anomalous points in data that significantly deviate from the normal pattern. It has important application value in fields such as industrial production and cybersecurity. For example, in industrial scenarios, by detecting anomalies in the time-series data of equipment operation, potential faults can be discovered in advance and preventive maintenance can be carried out to avoid significant economic losses.

[0003] In related technologies, anomaly detection of time-series data is typically performed using autoencoders and predictive models. However, these methods suffer from poor accuracy and are dependent on specific datasets, making them difficult to extend to other application scenarios. Therefore, developing a high-accuracy and highly generalizable anomaly detection method for time-series data is a pressing issue. Summary of the Invention

[0004] This disclosure provides a method, apparatus, device, medium, and product for anomaly detection of time-series data.

[0005] According to a first aspect of this disclosure, an anomaly detection method for time-series data is provided, the method comprising:

[0006] The original time series data is input into an encoder based on a self-attention model for encoding processing to obtain a target feature matrix; the target feature matrix is ​​used to indicate the relationship between the multi-dimensional data corresponding to each time point in the original time series data, as well as the characteristics of each dimension of data at each time point;

[0007] The target feature matrix is ​​input into the memory network model to obtain the target prediction sequence; the target prediction sequence is used to indicate the predicted values ​​of each dimension of data at historical and future times;

[0008] The anomaly evaluation result of the original time series data is determined based on the target prediction sequence; the anomaly evaluation result is used to characterize the degree of anomaly of each dimension of data at each time point in the original time series data;

[0009] Based on the anomaly evaluation results, abnormal data are identified in the original time series data.

[0010] Further, the step of inputting the original time-series data into an encoder based on a self-attention model for encoding processing to obtain the target feature matrix includes:

[0011] The original time-series data is divided based on a preset sliding time window to obtain multiple data sequences;

[0012] The data in each data sequence is normalized to obtain a normalized data sequence, and the normalized data sequence is input into the encoder for encoding to obtain the target feature matrix.

[0013] Further, the step of inputting the normalized data sequence into the encoder for encoding processing to obtain the target feature matrix includes:

[0014] The normalized data sequence is compressed and encoded by the first self-attention module in the encoder to obtain a first feature matrix; wherein, the first feature matrix is ​​used to indicate the features of each dimension of the original time series data at each time point;

[0015] The normalized data sequence is compressed and encoded by the second self-attention module in the encoder to obtain a second feature matrix; wherein, the second feature matrix is ​​used to indicate the correlation between the multi-dimensional data corresponding to each time point in the original time series data;

[0016] The target feature matrix is ​​determined based on the first feature matrix and the second feature matrix.

[0017] Further, the step of inputting the target feature matrix into the memory network model to obtain the target prediction sequence includes:

[0018] The target feature matrix is ​​processed by the memory network model to obtain a first prediction sequence and a second prediction sequence; wherein, the first prediction sequence is used to indicate the predicted value of each dimension of data at each historical time, and the second prediction sequence is the predicted value of each dimension of data at each future time.

[0019] The target prediction sequence is determined based on the first prediction sequence and the second prediction sequence.

[0020] Further, determining the anomaly evaluation result of the original time-series data based on the target prediction sequence includes:

[0021] Based on the target prediction sequence, point-level outliers and interval-level outliers of the original time series data are determined; wherein, the point-level outliers are used to indicate the degree of deviation of each dimension of data at each time point in the original time series data, and the interval-level outliers are used to indicate the overall degree of deviation of the dimension data at each specified time interval point in the original time series data.

[0022] The anomaly evaluation result of the original time series data is determined based on the point-level outliers and the interval-level outliers of the original time series data.

[0023] Further, determining the point-level outliers of the original time-series data based on the target prediction sequence includes:

[0024] Point-level outliers in the original time-series data are determined based on a first formula; wherein, the first formula is: P is the point-level outlier, ||·|| 2 Here is the formula for calculating the square of the L2 norm of a vector, x. i,j This refers to the j-th dimension data corresponding to the i-th time point in the original time series data. For the target prediction sequence, the one with x i,j Corresponding data.

[0025] Further, determining the interval-level outliers of the original time-series data based on the target prediction sequence includes:

[0026] The interval-level outliers of the original time-series data are determined based on the second formula; wherein, the second formula is: C represents the interval-level outlier, DTW is the dynamic time warp calculation formula, l is the preset sequence length, and x... i,j-l+1 ,…,x i,j+l In the original time series data, x i,j The sequence segments formed by extending l to both sides from the center. For the target prediction sequence, the one with x i,j-l+1 ,…,x i,j+l The corresponding sequence segments.

[0027] Further, determining the anomaly evaluation result of the original time series data based on the point-level outliers and the interval-level outliers of the original time series data includes:

[0028] Calculate the product of the point-level outlier and the interval-level outlier to obtain the outlier score of each dimension of the data at each time point in the original time series data.

[0029] The anomaly evaluation result is determined based on the anomaly score.

[0030] Further, the step of determining anomalous data in the original time-series data based on the anomaly evaluation results includes:

[0031] The abnormal scores in the abnormal evaluation results are sorted in descending order to obtain the ranking results;

[0032] An elbow point is determined in the sorting result based on the rate of decrease of the anomaly score; wherein the elbow point is used to indicate the boundary between abnormal data and normal data in the original time series data;

[0033] Based on the elbow point, abnormal data in the original time series data is determined.

[0034] Furthermore, the step of determining abnormal data in the original time-series data based on the elbow point includes:

[0035] The data corresponding to the abnormal scores located before the elbow point in the sorting results are identified as abnormal data.

[0036] According to a second aspect of this disclosure, an anomaly detection device for time-series data is provided, the device comprising:

[0037] The first processing module is used to input the original time series data into an encoder based on a self-attention model for encoding processing to obtain a target feature matrix; the target feature matrix is ​​used to indicate the relationship between the multi-dimensional data corresponding to each time point in the original time series data, as well as the characteristics of each dimension of data at each time point;

[0038] The second processing module is used to input the target feature matrix into the memory network model to obtain the target prediction sequence; the target prediction sequence is used to indicate the predicted values ​​of each dimension of data at historical and future times;

[0039] The first determining module is used to determine the anomaly evaluation result of the original time series data based on the target prediction sequence; the anomaly evaluation result is used to characterize the degree of anomaly of each dimension of data at each time point in the original time series data;

[0040] The second determining module is used to determine abnormal data in the original time series data based on the abnormality evaluation results.

[0041] According to a third aspect of this disclosure, an electronic device is provided. The electronic device includes a memory and a processor, wherein the memory stores a computer program, and the processor executes the program to implement the method described above.

[0042] According to a fourth aspect of this disclosure, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the methods described above.

[0043] According to a fifth aspect of this disclosure, a computer program product is provided. The computer program product includes a computer program that, when executed by a processor, implements the methods described above in this disclosure.

[0044] This disclosure provides an anomaly detection method, apparatus, device, medium, and product for time-series data. In this embodiment, firstly, the original time-series data is input into an encoder based on a self-attention model for encoding processing to obtain a target feature matrix. The target feature matrix indicates the relationship between the multi-dimensional data corresponding to each time point in the original time-series data, as well as the characteristics of each dimension at each time point. Then, the target feature matrix is ​​input into a memory network model to obtain a target prediction sequence. The target prediction sequence indicates the predicted values ​​of each dimension at historical and future times. Next, based on the target prediction sequence, an anomaly evaluation result of the original time-series data is determined. The anomaly evaluation result characterizes the degree of anomaly of each dimension at each time point in the original time-series data. Finally, based on the anomaly evaluation result, abnormal data is identified in the original time-series data.

[0045] As described above, the technical solution of this disclosure encodes the original time-series data using a self-attention model encoder to obtain a target feature matrix. This effectively captures the complex correlations between multi-dimensional data at each time point and the characteristics of each dimension of data in the time series. It overcomes the limitations of traditional methods in modeling the inherent correlations of multivariate time-series data, significantly improving the accuracy of capturing the features of the original time-series data, thus laying the foundation for the subsequent generation of high-precision target prediction sequences. The technical solution of this disclosure inputs the target feature matrix into a memory network model to obtain a target prediction sequence. Through bidirectional prediction of historical and future moments, a high-precision target prediction sequence can be generated, achieving accurate prediction of data of each dimension at different times and improving the model's ability to reconstruct complex time-series data. Furthermore, the technical solution of this disclosure determines the anomaly evaluation results of the original time-series data based on the target prediction sequence, and then identifies anomalous data in the original time-series data based on the anomaly evaluation results. This eliminates the dependence on empirical rules and specific datasets, ensuring the accuracy of the anomaly detection method for time-series data while also improving the generalization of the anomaly detection method for time-series data. Attached Figure Description

[0046] The above and other objects, features, and advantages of this disclosure will become more apparent from the more detailed description of the embodiments thereof in conjunction with the accompanying drawings. The drawings are provided to further illustrate the embodiments of this disclosure and form part of the specification. They are used together with the embodiments of this disclosure to explain the disclosure and do not constitute a limitation thereof. In the drawings, the same reference numerals generally represent the same components or steps.

[0047] Figure 1 A flowchart of an anomaly detection method for time-series data provided as an exemplary embodiment of this disclosure;

[0048] Figure 2 A flowchart of an anomaly detection method for time-series data provided as another exemplary embodiment of this disclosure;

[0049] Figure 3 A flowchart of an anomaly detection method for time-series data provided as another exemplary embodiment of this disclosure;

[0050] Figure 4 A flowchart of an anomaly detection method for time-series data provided as another exemplary embodiment of this disclosure;

[0051] Figure 5 A schematic block diagram of the functional modules of an anomaly detection device for time-series data provided in an exemplary embodiment of this disclosure;

[0052] Figure 6 A structural block diagram of an electronic device provided as an exemplary embodiment of this disclosure;

[0053] Figure 7 A structural block diagram of a computer system provided as an exemplary embodiment of this disclosure;

[0054] Figure 8 A structural block diagram of a computer program product provided for an exemplary embodiment of this disclosure. Detailed Implementation

[0055] Embodiments of this disclosure will now be described in more detail with reference to the accompanying drawings. While some embodiments of this disclosure are shown in the drawings, it should be understood that this disclosure can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of this disclosure. It should be understood that the accompanying drawings and embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of protection of this disclosure.

[0056] It should be understood that the steps described in the method embodiments of this disclosure may be performed in different orders and / or in parallel. Furthermore, the method embodiments may include additional steps and / or omit the steps shown. The scope of this disclosure is not limited in this respect.

[0057] The term "comprising" and its variations as used herein are open-ended, meaning "including but not limited to". The term "based on" means "at least partially based on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". Definitions of other terms will be given in the description below. It should be noted that the concepts of "first", "second", etc., used in this disclosure are only used to distinguish different devices, modules, or units, and are not intended to limit the order of functions performed by these devices, modules, or units or their interdependencies.

[0058] It should be noted that the terms "a" and "a plurality of" used in this disclosure are illustrative rather than restrictive, and those skilled in the art should understand that, unless otherwise expressly indicated in the context, they should be understood as "one or more".

[0059] The names of messages or information exchanged between multiple devices in the embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of such messages or information.

[0060] It is understood that before using the technical solutions disclosed in the various embodiments of this disclosure, users should be informed of the types, scope of use, and usage scenarios of the personal information involved in this disclosure in an appropriate manner in accordance with relevant laws and regulations, and user authorization should be obtained.

[0061] For example, upon receiving a user's active request, a prompt message is sent to the user to explicitly inform them that the requested operation will require the acquisition and use of the user's personal information. This allows the user to independently choose whether to provide personal information to the software or hardware, such as the electronic device, application, server, or storage medium performing the operations of this disclosed technical solution, based on the prompt message.

[0062] As an optional but non-limiting implementation, in response to a user's active request, sending a prompt message to the user can be done via a pop-up window, where the prompt message can be presented in text format. Furthermore, the pop-up window can also include a selection control allowing the user to choose "agree" or "disagree" to provide personal information to the electronic device. It is understood that the above notification and user authorization process is merely illustrative and does not constitute a limitation on the implementation of this disclosure; other methods that comply with relevant laws and regulations may also be applied to the implementation of this disclosure.

[0063] In one embodiment, such as Figure 1 As shown, an anomaly detection method for time series data is provided, including the following steps:

[0064] Step 101: Input the original time series data into an encoder based on a self-attention model for encoding processing to obtain the target feature matrix.

[0065] Here, the executing entity can input the original time series data into an encoder based on a self-attention model for encoding processing to obtain a target feature matrix. The target feature matrix is ​​used to indicate the relationship between the multi-dimensional data corresponding to each time point in the original time series data, as well as the characteristics of each dimension of data at each time point.

[0066] In one possible embodiment, such as Figure 2As shown, the original time-series data is input into an encoder based on a self-attention model for encoding processing to obtain the target feature matrix. The process also includes the following steps:

[0067] Step 1011: Divide the original time series data based on a preset sliding time window to obtain multiple data sequences.

[0068] Here, the executing entity can divide the original time series data based on a preset sliding time window to obtain multiple data sequences. The original time series data contains data of different dimensions at each time point.

[0069] In one possible embodiment, the original time-series data is X = (x1, x2, ..., x...). N )∈R N×M Where N is the length of the original time series data and M is the number of variables in the original time series data. For example, the original time series data X collected by a communication base station device is 24-hour multivariate time series data, which includes four variables: temperature, central processing unit (CPU) utilization, memory usage, and network traffic, i.e., M=4. The sampling interval is 5 minutes, and a total of 288 samples are taken in 24 hours. The total length of the original time series data X is N=288. It should be noted that the original time series data can also contain variables with more dimensions, which is not limited here.

[0070] In one possible embodiment, the executing entity divides the original time-series data X based on a preset sliding time window. Continuing the previous example, the executing entity sets the window size of the sliding time window to K=12 and the step size to 1, which can obtain multiple data sequences H. t =(x t-K+1 ,…,x t-1 ,x t )∈R K×M For example, the first data sequence is (x1, x2, ..., x...). 12 The second data sequence is (x2, x3, ..., x). 13 A total of 277 data sequences were generated.

[0071] Step 1012: Normalize the data in each data sequence to obtain a normalized data sequence, and input the normalized data sequence into the encoder for encoding to obtain the target feature matrix.

[0072] Here, the execution entity divides the original time series data based on a preset sliding time window. After obtaining multiple data sequences, the data in each data sequence can be normalized to obtain a normalized data sequence. The normalized data sequence is then input into the encoder for encoding to obtain the target feature matrix. The target feature matrix is ​​used to indicate the relationship between the multi-dimensional data corresponding to each time point in the original time series data, as well as the characteristics of each dimension of data at each time point.

[0073] In one possible embodiment, following the previous example, the executing entity divides the original time-series data based on a preset sliding time window to obtain multiple data sequences H. t =(x t-K+1 ,…,x t-1 ,x t )∈R K×M Subsequently, considering the differentiated temporal characteristics of multiple data sequences, in order to ensure that the features of all dimensions are within the same dimensional range, the executing entity needs to standardize the data in each data sequence. That is, the executing entity normalizes the data in each data sequence to obtain a normalized data sequence. For example, the executing entity uses the Min-Max normalization algorithm to normalize the data in each data sequence. The calculation formula for the Min-Max normalization algorithm is:

[0074]

[0075] Where, x norm The data is normalized, and x represents data in the data sequence. max Let x be the largest data element in the data sequence. min To obtain x, the execution entity normalizes the data in each data sequence to find the smallest value in the data sequence. norm x norm The range is limited to (0, 1), and all x values ​​after normalization are obtained. norm Afterwards, the executing entity will x norm This forms a normalized data sequence. It should be noted that, besides the Min-Max normalization algorithm, other normalization algorithms can also be used; no restrictions are placed here, as long as they can normalize the data in each data sequence.

[0076] In one possible embodiment, the executing entity normalizes the data in each data sequence to obtain a normalized data sequence, which can then be input into the encoder, i.e., the Transformer model, for encoding processing to obtain the target feature matrix.

[0077] In one possible embodiment, the normalized data sequence is input into an encoder for encoding processing to obtain the target feature matrix, including the following steps:

[0078] The normalized data sequence is compressed and encoded by the first self-attention module in the encoder to obtain the first feature matrix;

[0079] The normalized data sequence is compressed and encoded by the second self-attention module in the encoder to obtain the second feature matrix.

[0080] The target feature matrix is ​​determined based on the first feature matrix and the second feature matrix.

[0081] Specifically, the executing entity normalizes the data in each data sequence to obtain a normalized data sequence. First, the executing entity compresses and encodes the normalized data sequence using the first self-attention module in the encoder to obtain a first feature matrix. Then, it compresses and encodes the normalized data sequence using the second self-attention module in the encoder to obtain a second feature matrix. The first self-attention module is a time-series self-attention mechanism module, and the second self-attention module is a variable-series self-attention mechanism module. The first feature matrix indicates the features of each dimension of data in the original time-series data at each time point, and the second feature matrix indicates the correlation between the corresponding multi-dimensional data at each time point in the original time-series data. Then, the executing entity determines the target feature matrix based on the first and second feature matrices.

[0082] In one possible embodiment, the computation process of a standard Transformer block for the encoder Transformer is as follows:

[0083] z′ l =z l-1 +SA(LN(z l-1 ))+VA(LN(z l-1 ));

[0084] z l =z′ l +MLP(LN(z′ l )).

[0085] Among them, z l-1 and z l These are the inputs and outputs of the l-th layer Transformer block, i.e., z l-1 Let z be the normalized data sequence of the input to the l-th layer in the encoder Transformer. lLet LN be the target feature matrix output by the l-th layer in the Transformer encoder, where LN represents Layer Normalization, SA represents the self-attention mechanism in the temporal dimension, and VA represents the self-attention mechanism in the variable dimension. SA(LN(z) l-1 )) is the first feature matrix obtained after the temporal self-attention mechanism, VA(LN(z) l-1 )) is the second feature matrix obtained after the self-attention mechanism of the variable dimension, z′ l The feature matrix is ​​the result of fusing self-attention mechanisms in the temporal dimension and the variable dimension. MLP is a feedforward neural network. MLP(LN(z) l ′)) represents the feature matrix after processing by the feedforward neural network. It should be noted that, in order to capture the complex dependencies between the time and variable dimensions of the original time-series data, this embodiment uses both time-series and variable-dimensional self-attention mechanisms. These two attention mechanisms enrich the information the encoder focuses on, enhance its representational capabilities, and ultimately generate a target feature matrix that indicates the relationships between the corresponding multi-dimensional data at each time point in the original time-series data, as well as the characteristics of each dimension of data at each time point.

[0086] In one possible embodiment, the time-series self-attention mechanism module and the variable-series self-attention mechanism module take the normalized data sequence as the input sequence W. t The result is mapped to the Query, Key, and Value matrices via a linear transformation, calculated as follows:

[0087] Q t =(H t ) T W Q ;

[0088] K t =(H t ) T W k ;

[0089] V t =(H t ) T W V .

[0090] Among them, W Q W k and W V ∈R D×D These are all learnable parameters. After a linear transformation, the attention output matrix can be obtained through a scaled dot product attention operation. The calculation formula is as follows:

[0091]

[0092] Among them, Attention(Q t ,K t V t ) represents the attention output matrix, Q t The query vector is used to find relevant information in the input sequence, originating from the current position where attention is to be calculated, K. t The key vector stores feature information at each position in the input sequence, helping to determine the degree of matching with the query vector. t The value vector stores the actual feature values ​​to be extracted from each position in the input sequence. The output is obtained by weighted summation based on the matching results between the query vector and the key vector. k Let d be the dimension of the key vector. k In order to Q t With K t The transposed dot product result is scaled to prevent the dot product from being too large, causing the Softmax function to enter regions of minimum gradients and leading to training difficulties. The Softmax function is used to convert the input values ​​into a probability distribution, ensuring that the sum of the attention weights at each position is 1. The time-series self-attention mechanism module and the variable-series self-attention mechanism module generate the corresponding Q-factors, respectively. t K t and V t This study focuses on the characteristics of data in the time series dimension and the variable dimension, and after normalization and a feedforward neural network layer, the data can be fused to generate a target feature matrix. This target feature matrix indicates the relationship between the multi-dimensional data at each time point in the original time series data, as well as the characteristics of each dimension of data at each time point.

[0093] Step 102: Input the target feature matrix into the memory network model to obtain the target prediction sequence.

[0094] Here, the execution entity inputs the original time series data into an encoder based on a self-attention model for encoding processing. After obtaining the target feature matrix, the target feature matrix can be input into a memory network model to obtain the target prediction sequence. The target prediction sequence is used to indicate the predicted values ​​of each dimension of data at historical and future times.

[0095] In one possible embodiment, the target feature matrix is ​​input into a memory network model to obtain a target prediction sequence, including the following steps:

[0096] The target feature matrix is ​​processed by a memory network model to obtain the first prediction sequence and the second prediction sequence.

[0097] The target prediction sequence is determined based on the first prediction sequence and the second prediction sequence.

[0098] Specifically, the executing entity inputs the original time-series data into an encoder based on a self-attention model for encoding processing. After obtaining the target feature matrix, the executing entity first processes the target feature matrix through a memory network model to obtain a first prediction sequence and a second prediction sequence. The first prediction sequence indicates the predicted values ​​of each dimension of data at each historical time, and the second prediction sequence indicates the predicted values ​​of each dimension of data at each future time. Then, the executing entity determines the target prediction sequence based on the first and second prediction sequences. This target prediction sequence contains the predicted values ​​of each dimension of data at each historical time and the future time.

[0099] In one possible embodiment, the LSTM memory network model is a recurrent structure composed of multiple long short-term memory network units. A basic LSTM network unit includes an input gate, a forget gate, a unit state, and an output gate. The hidden layers store the hidden information of the preceding units and are updated at each time step, thereby achieving the function of remembering previously input information. The parameter update process is as follows:

[0100] f t =σ(W f [h t-1 ,x t ]+b f );

[0101] Among them, f t It is the output of the forget gate at time step t, σ is the sigmoid activation function, and W f It is the weight matrix of the forget gate, h t-1 It is the hidden state of the previous time step, x t It is the input for the current time step, b f It is the bias term of the forget gate.

[0102] i t =σ(W i [h t-1 ,x t ]+b i );

[0103]

[0104] Among them, i t It is the input gate output of time step t. It is the candidate cell state, W i and W C These are the weight matrices for the input gate and the candidate cell states, respectively. i and b C These are the bias terms for the input gate and candidate cell states, respectively.

[0105]

[0106] Among them, C t It is the cell state at time step t, C t-1 It is the cell state of the previous time step.

[0107] o t =σ(W o [h t-1 ,x t ]+b o );

[0108] h t =o t *tanh(C t ).

[0109] Among them, o t It is the output gate output of time step t, h t It is the hidden state of time step t, W o It is the weight matrix of the output gate, b o It is the bias term of the output gate.

[0110] In one possible embodiment, the LSTM memory network model obtains the target feature matrix through encoding by the Transformer encoder. This matrix is ​​then used to perform forward and backward predictions on the original time-series data, with a prediction step size of s. This yields a first prediction sequence and a second prediction sequence of length s. The forward prediction produces the first prediction sequence, which indicates the predicted values ​​of each dimension of the data at each historical time. The backward prediction produces the second prediction sequence, which contains the predicted values ​​of each dimension of the data at each future time. After obtaining the first and second prediction sequences, the execution entity combines them to form the target prediction sequence. Where N is the length of the target prediction sequence, which corresponds to the length of the original time series data, and M is the number of variables in the target prediction sequence, which corresponds to the number of variables in the original time series data.

[0111] In one possible embodiment, following the previous example, since a single data point in the original time series data will be predicted repeatedly s times, the median of the multiple prediction results is taken as the final predicted value of that data point, and this final predicted value is used as the target prediction sequence. In addition to the predicted data in the target prediction sequence, this embodiment uses the mean squared error (MSE) between the predicted values ​​in the target prediction sequence and the true values ​​in the original time series data as the loss function, and minimizes it through backpropagation. The calculation formula is as follows:

[0112]

[0113] Where K represents the total number of time steps in the input window, and s represents the step size of the forward and backward predictions required by the model within each window. Let X be the predicted value in the target prediction sequence, and let X be the actual value corresponding to the predicted value. Forward prediction error, This is the backward prediction error. This represents the total error.

[0114] Step 103: Determine the anomaly evaluation results of the original time series data based on the target prediction sequence.

[0115] Here, the executing entity inputs the target feature matrix into the memory network model to obtain the target prediction sequence. Based on the target prediction sequence, it can determine the anomaly evaluation result of the original time series data. The anomaly evaluation result is used to characterize the degree of anomaly of each dimension of data at each time point in the original time series data.

[0116] In one possible embodiment, such as Figure 3 As shown, determining the anomaly evaluation results of the original time series data based on the target prediction sequence includes the following steps:

[0117] Step 1031: Based on the target prediction sequence, determine the point-level outliers and interval-level outliers in the original time series data.

[0118] Here, the executing entity inputs the target feature matrix into the memory network model to obtain the target prediction sequence. Based on the target prediction sequence, it can determine the point-level outliers and interval-level outliers of the original time series data. Point-level outliers are used to indicate the degree of deviation of each dimension of data at each time point in the original time series data, while interval-level outliers are used to indicate the overall degree of deviation of the dimension data at each specified time interval in the original time series data.

[0119] In one possible embodiment, determining point-level outliers in the original time-series data based on the target prediction sequence includes the following steps:

[0120] Point-level outliers in the original time series data are determined based on the first formula.

[0121] Specifically, the executing entity can determine point-level outliers in the original time-series data based on the first formula, wherein the first formula is: P represents point-level outliers, ||·|| 2 Here is the formula for calculating the square of the L2 norm of a vector, x. i,j This refers to the j-th dimension data corresponding to the i-th time point in the original time series data. For the target prediction sequence, the sequence with x i,j The corresponding data, the point-level outliers determined by the executing entity based on the first formula, are used to indicate the degree of deviation of each dimension of the data at each time point in the original time series data. For example, if the point-level outlier P is larger, it means that the degree of deviation of each dimension of the data at that time point in the original time series data is greater, that is, the data at that time point does not conform to the normal state and is more likely to be abnormal data.

[0122] In one possible embodiment, determining point-level outliers in the original time-series data based on the target prediction sequence further includes the following steps:

[0123] The interval-level outliers of the original time series data are determined based on the second formula.

[0124] Specifically, the executing entity can determine the interval-level outliers of the original time-series data based on the second formula, wherein the second formula is: C represents the interval-level outlier, DTW is the dynamic time warp calculation formula, l is the preset sequence length, and x... i,j-l+1 ,…,x i,j+l To use x in the original time series data i,j The sequence segments formed by extending l to both sides from the center. For the target prediction sequence, the sequence with x i,j-l+1 ,…,x i,j+l For the corresponding sequence segments, the interval-level outlier determined by the executing entity based on the second formula is used to indicate the overall deviation of the dimensional data at each specified time interval in the original time series data. For example, if the interval-level outlier C is larger, it means that the overall deviation of the dimensional data at the specified time interval in the original time series data is greater, that is, the overall dimensional data at the specified time interval does not conform to the normal state and is more likely to be abnormal data.

[0125] Step 1032: Determine the anomaly evaluation results of the original time series data based on the point-level and interval-level outliers of the original time series data.

[0126] Here, after the executing entity determines the point-level and interval-level outliers of the original time series data based on the target prediction sequence, it can determine the anomaly evaluation result of the original time series data based on the point-level and interval-level outliers of the original time series data.

[0127] In one possible embodiment, determining the anomaly evaluation result of the original time series data based on point-level and interval-level outliers includes the following steps:

[0128] Calculate the product of point-level outliers and interval-level outliers to obtain the outlier scores for each dimension of the original time series data at each time point.

[0129] Anomaly evaluation results are determined based on anomaly scores.

[0130] Specifically, after determining the point-level and interval-level outliers in the original time series data based on the target prediction sequence, the executing entity first calculates the product of the point-level and interval-level outliers to obtain the outlier scores for each dimension of the original time series data at each time point. Then, the executing entity determines the outlier evaluation results for the original time series data based on the outlier scores.

[0131] In one possible embodiment, the original value x in the original time-series data i,j The quantization error is determined by both point-level and interval-level outliers. The executing entity calculates the product of the point-level and interval-level outliers to obtain the anomaly score A for each dimension of the original time series data at each time point. The calculation formula is A = P ⊙ C. The executing entity determines the anomaly evaluation result of the original time series data based on the anomaly score A. For a data point x in the original time series data... t The anomaly score is defined as the sum of the anomaly scores for each dimension, and its calculation process is as follows:

[0132]

[0133] Among them, A t Let be the anomaly score at time point t in the original time series data, and j represent variables of different dimensions. The executing entity calculates the anomaly score at each time point in the original time series data to obtain the anomaly evaluation result. This anomaly evaluation result includes the anomaly score of the data at each time point in the original time series data. For example, the original time series data contains six multidimensional variables x1, x2, ..., x6 at six time points, and each multidimensional variable x1, x2, ..., x6 also contains data in four dimensions. The executing entity calculates the anomaly scores of the multidimensional variables x1, x2, ..., x6 at the six time points using a formula, obtaining the anomaly scores A1, A2, ..., A6 at the six time points respectively. N And the outlier scores A1, A2, ..., A at the 6 time points are... N The anomaly evaluation result A = (A1, A2, ..., A N )∈R 1×N In other words, each multidimensional variable at each point in time in the original time series data corresponds to an anomaly score.

[0134] Step 104: Identify anomalous data in the original time series data based on the anomaly evaluation results.

[0135] Here, after determining the anomaly evaluation results of the original time series data based on the target prediction sequence, the executing entity can identify anomalous data in the original time series data based on the anomaly evaluation results.

[0136] In one possible embodiment, such as Figure 4 As shown, identifying outlier data in the original time series data based on the anomaly evaluation results includes the following steps:

[0137] Step 1041: Sort the abnormal scores in the abnormal evaluation results in descending order to obtain the sorting results.

[0138] Here, after determining the anomaly evaluation results of the original time series data based on the target prediction sequence, the executing entity can sort the anomaly scores in the anomaly evaluation results in descending order to obtain the sorting results.

[0139] In one possible implementation, continuing from the previous example, the executing entity will evaluate the abnormal result A = (A1, A2, ..., A...). N )∈R 1×N Abnormal scores A1, A2, ..., A N Sort the data in descending order to obtain the sorted results. For example, the executing entity sorts A1, A2, ..., A... N Sort in descending order to get the sorted result B = (B1, B2, ..., B...). N )∈R 1×N .

[0140] Step 1042: Determine the elbow point in the sorting results based on the rate of decrease of the outlier score.

[0141] Here, after the executing entity sorts the abnormal scores in the abnormal evaluation results in descending order and obtains the sorting results, it can determine the elbow point in the sorting results based on the rate of decrease of the abnormal scores. The abnormal scores of the abnormal data should be much greater than those of the normal data. Therefore, there must be an elbow point in the sorting results that turns from abnormal to normal. This elbow point is used to indicate the boundary point between abnormal data and normal data in the original time series data.

[0142] In one possible implementation, continuing from the previous example, the executing entity will use the abnormal evaluation result A = (A1, A2, ..., A...) N )∈R 1×N The abnormal scores are sorted in descending order to obtain the sorting result B = (B1, B2, ..., B...). N )∈R 1×N The executing entity determines the elbow points in the sorting results based on the rate of decrease of the abnormal scores, for example, B1, B2, ..., B NThe decrease rates are 2%, 63%, ..., 16%, respectively. Obviously, the decrease rate corresponding to B2 is much greater than the decrease rate of other abnormal scores. Therefore, the executing entity determines B2 as the elbow point in the sorting result. This elbow point indicates the dividing point between abnormal data and normal data in the original time series data.

[0143] Step 1043: Identify anomalous data in the original time series data based on elbow points.

[0144] Here, after the executing entity determines the elbow point in the sorting results based on the rate of decrease of the abnormal score, it can determine the abnormal data in the original time series data based on the elbow point.

[0145] In one possible embodiment, identifying anomalous data in the original time-series data based on elbow points includes the following steps:

[0146] The data corresponding to the abnormal scores located before the elbow point in the sorting results are identified as abnormal data.

[0147] Specifically, continuing from the previous example, the executing entity determines B2 as the elbow point in the sorting result, and the executing entity determines the data corresponding to the abnormal scores before the elbow point in the sorting result as abnormal data. For example, the data corresponding to the abnormal scores before the elbow point B2 in the sorting result are x1 and x2, then the executing entity determines x1 and x2 as abnormal data in the original time series data.

[0148] This disclosure provides an anomaly detection method, apparatus, device, medium, and product for time-series data. In this embodiment, firstly, the original time-series data is input into an encoder based on a self-attention model for encoding processing to obtain a target feature matrix. The target feature matrix indicates the relationship between the multi-dimensional data corresponding to each time point in the original time-series data, as well as the characteristics of each dimension at each time point. Then, the target feature matrix is ​​input into a memory network model to obtain a target prediction sequence. The target prediction sequence indicates the predicted values ​​of each dimension at historical and future times. Next, based on the target prediction sequence, an anomaly evaluation result of the original time-series data is determined. The anomaly evaluation result characterizes the degree of anomaly of each dimension at each time point in the original time-series data. Finally, based on the anomaly evaluation result, abnormal data is identified in the original time-series data.

[0149] As described above, the technical solution of this disclosure encodes the original time-series data using a self-attention model encoder to obtain a target feature matrix. This effectively captures the complex correlations between multi-dimensional data at each time point and the characteristics of each dimension of data in the time series. It overcomes the limitations of traditional methods in modeling the inherent correlations of multivariate time-series data, significantly improving the accuracy of capturing the features of the original time-series data, thus laying the foundation for the subsequent generation of high-precision target prediction sequences. The technical solution of this disclosure inputs the target feature matrix into a memory network model to obtain a target prediction sequence. Through bidirectional prediction of historical and future moments, a high-precision target prediction sequence can be generated, achieving accurate prediction of data of each dimension at different times and improving the model's ability to reconstruct complex time-series data. Furthermore, the technical solution of this disclosure determines the anomaly evaluation results of the original time-series data based on the target prediction sequence, and then identifies anomalous data in the original time-series data based on the anomaly evaluation results. This eliminates the dependence on empirical rules and specific datasets, ensuring the accuracy of the anomaly detection method for time-series data while also improving the generalization of the anomaly detection method for time-series data.

[0150] In one possible embodiment, after identifying anomalous data in the original time-series data based on elbow points, the following steps are further included:

[0151] Determine the anomaly labels of the original time series data based on the anomaly data.

[0152] Specifically, after identifying anomalous data in the original time series data based on elbow points, the executing entity can output the anomalous label y of the original time series data at each time step. t ∈[0,1], where the anomaly label y t Indicates whether the original time series data at time point t is abnormal, y t =1 indicates an anomaly, y t =0 indicates normal. For example, if x1 and x2 are abnormal data in the original time series data, then the values ​​of the abnormal labels y1 and y2 corresponding to x1 and x2 are 1. If x3 is normal data in the original time series data, then the value of the abnormal label y3 corresponding to x3 is 0.

[0153] As described above, the execution entity generates anomaly labels after identifying abnormal data based on elbow points. This transforms complex time-series data into intuitive binary classification labels, directly marking the abnormal state at each time point. This significantly improves the operability and interpretability of the detection results. Furthermore, this process reduces manual labeling costs by automatically generating standardized labels. In addition, the clear definition of anomaly labels facilitates the quantitative evaluation of model performance, helps to continuously optimize the detection algorithm, and enhances compatibility with existing monitoring systems. Ultimately, this enables efficient and low-cost closed-loop management of anomaly response in multiple scenarios, further improving the reliability of anomaly detection methods for time-series data.

[0154] As described above, the technical solution disclosed herein utilizes a bidirectional prediction architecture combining a Transformer encoder and an LSTM model, deeply integrating self-attention mechanisms across time and variable dimensions. This fully leverages the temporal dependencies and cross-variable correlations of multivariate time-series data, significantly enhancing the model's ability to represent complex normal patterns. Furthermore, this technical solution combines a dual quantization strategy of point-level and interval-level anomalies, achieving high sensitivity to diverse anomaly patterns and laying the foundation for improved accuracy in anomaly detection methods for time-series data. Additionally, this technical solution uses a threshold-free adaptive elbow rule to determine anomalies, effectively avoiding static... The strong dependence of the state threshold on the scene enhances the robustness and generalization of the model in dynamic and high-noise environments. Furthermore, the technical solution disclosed in this disclosure reduces the cost of manual annotation by automatically generating binary anomaly labels, providing structured input for equipment early warning and fault diagnosis, and supporting real-time response and accurate decision-making. In fields such as communication networks and industrial production, the technical solution disclosed in this disclosure can identify risks such as network congestion and equipment anomalies in advance, realize proactive operation and maintenance management, reduce unplanned downtime losses, optimize resource scheduling efficiency, and seamlessly integrate with existing monitoring systems, thereby improving the intelligent level of end-to-end operation and maintenance. It has high accuracy, strong adaptability, and broad economic value.

[0155] By dividing each functional module according to its corresponding function, this disclosure provides an anomaly detection device for time-series data. This anomaly detection device for time-series data can be a server or a chip applied to a server. Figure 5 A schematic block diagram of the functional modules of an anomaly detection device for time-series data provided as an exemplary embodiment of this disclosure. Figure 5 As shown, the anomaly detection device for this time series data includes:

[0156] The first processing module 501 is used to input the original time series data into an encoder based on a self-attention model for encoding processing to obtain a target feature matrix; the target feature matrix is ​​used to indicate the relationship between the multi-dimensional data corresponding to each time point in the original time series data, as well as the characteristics of each dimension of data at each time point.

[0157] The second processing module 502 is used to input the target feature matrix into the memory network model to obtain the target prediction sequence; the target prediction sequence is used to indicate the predicted values ​​of each dimension of data at historical and future times;

[0158] The first determining module 503 is used to determine the anomaly evaluation result of the original time series data based on the target prediction sequence; the anomaly evaluation result is used to characterize the degree of anomaly of each dimension of data at each time point in the original time series data;

[0159] The second determining module 504 is used to determine abnormal data in the original time series data based on the abnormal evaluation results.

[0160] In one embodiment, the first processing module 501 includes:

[0161] The first processing unit is used to divide the original time-series data based on a preset sliding time window to obtain multiple data sequences;

[0162] The second processing unit is used to normalize the data in each data sequence to obtain a normalized data sequence, and input the normalized data sequence into the encoder for encoding processing to obtain the target feature matrix.

[0163] In one embodiment, the first processing module 501 includes:

[0164] The third processing unit is used to compress and encode the normalized data sequence through the first self-attention module in the encoder to obtain a first feature matrix; wherein, the first feature matrix is ​​used to indicate the features of each dimension of the original time series data at each time point;

[0165] The fourth processing unit is used to compress and encode the normalized data sequence through the second self-attention module in the encoder to obtain a second feature matrix; wherein the second feature matrix is ​​used to indicate the correlation between the multi-dimensional data corresponding to each time point in the original time series data;

[0166] The fifth processing unit is used to determine the target feature matrix based on the first feature matrix and the second feature matrix.

[0167] In one embodiment, the second processing module 502 includes:

[0168] The sixth processing unit is used to process the target feature matrix through the memory network model to obtain a first prediction sequence and a second prediction sequence; wherein, the first prediction sequence is used to indicate the predicted values ​​of each dimension of data at each historical time, and the second prediction sequence is the predicted values ​​of each dimension of data at each future time.

[0169] The first determining unit is configured to determine the target prediction sequence based on the first prediction sequence and the second prediction sequence.

[0170] In one embodiment, the first determining module 503 includes:

[0171] The second determining unit is used to determine point-level outliers and interval-level outliers of the original time series data based on the target prediction sequence; wherein, the point-level outliers are used to indicate the degree of deviation of each dimension of data at each time point in the original time series data, and the interval-level outliers are used to indicate the degree of deviation of the overall dimension data at each specified time interval point in the original time series data.

[0172] The third determining unit is used to determine the anomaly evaluation result of the original time series data based on the point-level anomalies and the interval-level anomalies of the original time series data.

[0173] In one embodiment, the first determining module 503 includes:

[0174] A first calculation unit is used to determine point-level outliers in the original time-series data based on a first formula; wherein, the first formula is: P is the point-level outlier, ||·|| 2 Here is the formula for calculating the square of the L2 norm of a vector, x. i,j This refers to the j-th dimension data corresponding to the i-th time point in the original time series data. For the target prediction sequence, the one with x i,j Corresponding data.

[0175] In one embodiment, the first determining module 503 includes:

[0176] The second calculation unit is used to determine interval-level outliers in the original time-series data based on a second formula; the second formula is: C represents the interval-level outlier, DTW is the dynamic time warp calculation formula, l is the preset sequence length, and x... i,j-l+1 ,…,x i,j+l In the original time series data, x i,j The sequence segments formed by extending l to both sides from the center. For the target prediction sequence, the one with x i,j-l+1 ,…,x i,j+l The corresponding sequence segments.

[0177] In one embodiment, the first determining module 503 includes:

[0178] The third calculation unit is used to calculate the product of the point-level outlier and the interval-level outlier to obtain the outlier score of each dimension of the data at each time point in the original time series data.

[0179] The fourth determining unit is used to determine the anomaly evaluation result based on the anomaly score.

[0180] In one embodiment, the second determining module 504 includes:

[0181] The sorting unit is used to sort the abnormal scores in the abnormality evaluation results in descending order to obtain the sorting result;

[0182] The fifth determining unit is used to determine an elbow point in the sorting result based on the rate of decrease of the abnormal score; wherein the elbow point is used to indicate the boundary point between abnormal data and normal data in the original time series data;

[0183] The sixth determining unit is used to determine abnormal data in the original time series data based on the elbow point.

[0184] In one embodiment, the second determining module 504 includes:

[0185] The seventh determining unit is used to determine the data corresponding to the abnormal scores located before the elbow point in the sorting result as abnormal data.

[0186] This disclosure also provides an electronic device, including: at least one processor; a memory for storing processor-executable instructions; wherein the at least one processor is configured to execute the instructions to implement the methods disclosed in this disclosure.

[0187] Figure 6 This is a schematic diagram of the structure of an electronic device provided as an exemplary embodiment of this disclosure. For example... Figure 6 As shown, the electronic device 600 includes at least one processor 601 and a memory 602 coupled to the processor 601. The processor 601 can perform the corresponding steps in the methods disclosed in the embodiments of this disclosure.

[0188] The processor 601 described above can also be called a central processing unit (CPU), which can be an integrated circuit chip with signal processing capabilities. Each step in the method disclosed in this embodiment can be implemented by the integrated logic circuitry in the processor 601 or by software instructions. The processor 601 can be a general-purpose processor, a digital signal processor (DSP), an ASIC, a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this embodiment can be directly implemented by a hardware decoding processor, or implemented by a combination of hardware and software modules in the decoding processor. The software modules can be located in the memory 602, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. The processor 601 reads information from the memory 602 and, in conjunction with its hardware, completes the steps of the method described above.

[0189] Furthermore, various operations / processes according to this disclosure, implemented via software and / or firmware, can be transmitted from a storage medium or network to a computer system with a dedicated hardware architecture, such as... Figure 7 The computer system 700 shown is equipped with the programs that constitute the software. When various programs are installed, the computer system is able to perform various functions, including functions such as those described above. Figure 7 A block diagram of a computer system provided for an exemplary embodiment of this disclosure.

[0190] Computer system 700 is intended to represent various forms of digital electronic computer devices, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. Electronic devices may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0191] like Figure 7As shown, the computer system 700 includes a computing unit 701, which can perform various appropriate actions and processes based on a computer program stored in a read-only memory (ROM) 702 or a computer program loaded from a storage unit 708 into a random access memory (RAM) 703. The RAM 703 may also store various programs and data required for the operation of the computer system 700. The computing unit 701, ROM 702, and RAM 703 are interconnected via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0192] Multiple components in the computer system 700 are connected to the I / O interface 705, including: an input unit 706, an output unit 707, a storage unit 708, and a communication unit 709. The input unit 706 can be any type of device capable of inputting information into the computer system 700. The input unit 706 can receive input numerical or character information and generate key signal inputs related to user settings and / or function control of the electronic device. The output unit 707 can be any type of device capable of presenting information and may include, but is not limited to, a monitor, speaker, video / audio output terminal, vibrator, and / or printer. The storage unit 708 may include, but is not limited to, a hard disk and an optical disk. The communication unit 709 allows the computer system 700 to exchange information / data with other devices via a network such as the Internet, and may include, but is not limited to, a modem, network card, infrared communication device, wireless communication transceiver, and / or chipset, such as Bluetooth™ device, WiFi device, WiMax device, cellular communication device, and / or the like.

[0193] The computing unit 701 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 701 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 701 performs the various methods and processes described above. For example, in some embodiments, the methods disclosed in this disclosure can be implemented as a computer software program tangibly contained in a machine-readable medium, such as storage unit 708. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 600 via ROM 702 and / or communication unit 709. In some embodiments, the computing unit 701 can be configured to perform the methods disclosed in this disclosure by any other suitable means (e.g., by means of firmware).

[0194] This disclosure also provides a computer-readable storage medium, wherein when the instructions in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device is able to perform the methods disclosed in this disclosure.

[0195] The computer-readable storage medium in this disclosure can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. The aforementioned computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specifically, the aforementioned computer-readable storage medium may include electrical connections based on one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0196] The aforementioned computer-readable medium may be included in the aforementioned electronic device; or it may exist independently and not assembled into the electronic device.

[0197] Figure 8 A computer program product 800 is provided as an exemplary embodiment of the present disclosure. The computer program product 800 includes a computer program 801, wherein the computer program 801, when executed by a processor, implements the methods disclosed in the embodiments of the present disclosure.

[0198] In embodiments of this disclosure, computer program code for performing the operations of this disclosure can be written in one or more programming languages ​​or a combination thereof. These programming languages ​​include, but are not limited to, object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network (including a local area network (LAN) or a wide area network (WAN)), or it can be connected to an external computer.

[0199] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0200] The modules, components, or units described in the embodiments of this disclosure can be implemented in software or hardware. The names of the modules, components, or units do not necessarily constitute a limitation on the module, component, or unit itself.

[0201] The functions described above in this document can be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary hardware logic components that can be used include: field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), system-on-a-chip (SoCs), complex programmable logic devices (CPLDs), and so on.

[0202] The above description is merely an embodiment of this disclosure and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of this disclosure is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-described concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features disclosed in this disclosure that have similar functions.

[0203] While specific embodiments of this disclosure have been described in detail by way of example, those skilled in the art should understand that the examples are for illustrative purposes only and not intended to limit the scope of this disclosure. Those skilled in the art should understand that modifications can be made to the above embodiments without departing from the scope and spirit of this disclosure. The scope of this disclosure is defined by the appended claims.

Claims

1. A method for anomaly detection in time-series data, characterized in that, include: The original time-series data is input into an encoder based on a self-attention model for encoding processing to obtain the target feature matrix; The target feature matrix is ​​used to indicate the relationship between the multi-dimensional data corresponding to each time point in the original time series data, as well as the characteristics of each dimension of data at each time point. The target feature matrix is ​​input into the memory network model to obtain the target prediction sequence; the target prediction sequence is used to indicate the predicted values ​​of each dimension of data at historical and future times; Based on the target prediction sequence, determine the anomaly evaluation result of the original time series data; The anomaly evaluation results are used to characterize the degree of anomaly in each dimension of the original time series data at each time point. Based on the anomaly evaluation results, abnormal data are identified in the original time series data.

2. The method according to claim 1, characterized in that, The process of inputting the original time-series data into an encoder based on a self-attention model for encoding processing to obtain the target feature matrix includes: The original time-series data is divided based on a preset sliding time window to obtain multiple data sequences; The data in each data sequence is normalized to obtain a normalized data sequence, and the normalized data sequence is input into the encoder for encoding to obtain the target feature matrix.

3. The method according to claim 2, characterized in that, The step of inputting the normalized data sequence into the encoder for encoding processing to obtain the target feature matrix includes: The normalized data sequence is compressed and encoded by the first self-attention module in the encoder to obtain a first feature matrix; wherein, the first feature matrix is ​​used to indicate the features of each dimension of the original time series data at each time point; The normalized data sequence is compressed and encoded by the second self-attention module in the encoder to obtain a second feature matrix; wherein, the second feature matrix is ​​used to indicate the correlation between the multi-dimensional data corresponding to each time point in the original time series data; The target feature matrix is ​​determined based on the first feature matrix and the second feature matrix.

4. The method according to claim 1, characterized in that, The step of inputting the target feature matrix into a memory network model to obtain the target prediction sequence includes: The target feature matrix is ​​processed by the memory network model to obtain a first prediction sequence and a second prediction sequence; wherein, the first prediction sequence is used to indicate the predicted value of each dimension of data at each historical time, and the second prediction sequence is the predicted value of each dimension of data at each future time. The target prediction sequence is determined based on the first prediction sequence and the second prediction sequence.

5. The method according to claim 1, characterized in that, The determination of anomaly evaluation results for the original time-series data based on the target prediction sequence includes: Based on the target prediction sequence, point-level outliers and interval-level outliers of the original time series data are determined; wherein, the point-level outliers are used to indicate the degree of deviation of each dimension of data at each time point in the original time series data, and the interval-level outliers are used to indicate the overall degree of deviation of the dimension data at each specified time interval point in the original time series data. The anomaly evaluation result of the original time series data is determined based on the point-level outliers and the interval-level outliers of the original time series data.

6. The method according to claim 5, characterized in that, The step of determining point-level outliers in the original time-series data based on the target prediction sequence includes: Point-level outliers in the original time-series data are determined based on a first formula; wherein, the first formula is: P is the point-level outlier, ||·|| 2 Here is the formula for calculating the square of the L2 norm of a vector, x. i,j This refers to the j-th dimension data corresponding to the i-th time point in the original time series data. For the target prediction sequence, the one with x i,j Corresponding data.

7. The method according to claim 5, characterized in that, The step of determining interval-level outliers in the original time series data based on the target prediction sequence includes: The interval-level outliers of the original time-series data are determined based on the second formula; wherein, the second formula is: C represents the interval-level outlier, DTW is the dynamic time warp calculation formula, l is the preset sequence length, and x... i,j-l+1 ,…,x i,j+l In the original time series data, x i,j The sequence segments formed by extending l to both sides from the center. For the target prediction sequence, the one with x i,j-l+1 ,…,x i,j+l The corresponding sequence segments.

8. The method according to claim 5, characterized in that, The process of determining the anomaly evaluation result of the original time series data based on the point-level outliers and the interval-level outliers includes: Calculate the product of the point-level outlier and the interval-level outlier to obtain the outlier score of each dimension of the data at each time point in the original time series data. The anomaly evaluation result is determined based on the anomaly score.

9. The method according to claim 1, characterized in that, The process of identifying anomalous data in the original time-series data based on the anomaly evaluation results includes: The abnormal scores in the abnormal evaluation results are sorted in descending order to obtain the ranking results; An elbow point is determined in the sorting result based on the rate of decrease of the anomaly score; wherein the elbow point is used to indicate the boundary between abnormal data and normal data in the original time series data; Based on the elbow point, abnormal data in the original time series data is determined.

10. The method according to claim 9, characterized in that, The step of determining abnormal data in the original time series data based on the elbow point includes: The data corresponding to the abnormal scores located before the elbow point in the sorting results are identified as abnormal data.

11. An anomaly detection device for time-series data, characterized in that, include: The first processing module is used to input the raw time series data into an encoder based on a self-attention model for encoding processing to obtain the target feature matrix; The target feature matrix is ​​used to indicate the relationship between the multi-dimensional data corresponding to each time point in the original time series data, as well as the characteristics of each dimension of data at each time point. The second processing module is used to input the target feature matrix into the memory network model to obtain the target prediction sequence; the target prediction sequence is used to indicate the predicted values ​​of each dimension of data at historical and future times; The first determining module is used to determine the anomaly evaluation result of the original time series data based on the target prediction sequence; The anomaly evaluation results are used to characterize the degree of anomaly in each dimension of the original time series data at each time point. The second determining module is used to determine abnormal data in the original time series data based on the abnormality evaluation results.

12. An electronic device, characterized in that, include: At least one processor; Memory for storing the at least one processor-executable instruction; The at least one processor is configured to execute the instructions to implement the method as described in any one of claims 1-10.

13. A computer-readable storage medium, characterized in that, When the instructions in the computer-readable storage medium are executed by the processor of the electronic device, the electronic device is enabled to perform the method as described in any one of claims 1-10.

14. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the method as described in any one of claims 1-10.

Images