Neural network-based anomaly detection for time-series data

Abstract

The system uses a neural network to detect anomalies in time series data. The system trains the neural network for a fixed number of iterations using data from a time window of the time series. To identify anomalies in the time series data, the system uses a loss value at the end of the fixed number of iterations. For the time window, the system initializes the neural network to a random value and trains the neural network for a fixed number of iterations using the data in the time window. After the fixed number of iterations, the system compares the loss values ​​for various data points to a threshold. Data points with loss values ​​that exceed the threshold are identified as anomalous data points.

Description

Technical Field

[0001] The present disclosure generally relates to the analysis of time - series data, and more specifically, to the use of neural networks for the identification of anomalies in time - series data.

Background Art

[0002] Time - series data is generated and processed in several contexts. Examples of time - series data include data generated by measurement software that monitors the utilization rate of resources such as sensor data, processing resources, memory resources, storage resources, network resources, application usage data, etc. Anomaly detection is usually performed to identify problems in the system that generates time - series data. For example, an anomaly in the utilization rate of computing resources may be an indicator of a server failure that is likely to occur in the near future. Similarly, an anomaly in the utilization rate of network resources may be an indicator of a network failure that is likely to occur in the near future. By accurately and timely detecting anomalies in time - series data, such failures can be predicted in advance and preventive measures can be taken.

[0003] Various techniques are used for anomaly detection, including clustering analysis, random forest techniques, machine - learning - based models, such as neural networks. Conventional neural - network - based techniques for anomaly detection require a large amount of training data and significant computing resources to train the neural network. Furthermore, when the characteristics of the time - series data to be analyzed are different from the time - series data used to train the neural network, neural - network - based techniques have low accuracy.

Brief Description of the Drawings

[0004] Embodiments of the disclosure will have other advantages and features that will become more readily apparent from the detailed description, the appended claims, and the appended drawings (or figures). A brief introduction to the figures is as follows.

[0005] [Figure 1] This is a block diagram of a system environment including a computing system for performing time series analysis, according to one embodiment.

[0006] [Figure 2] An example of time-series data and corresponding output for anomaly detection according to one embodiment is shown.

[0007] [Figure 3] An example of a system architecture for a time-series processing module according to one embodiment is provided.

[0008] [Figure 4] An example of a neural network architecture used for anomaly detection, according to one embodiment, is provided.

[0009] [Figure 5] An example of an anomaly detection process according to one embodiment is provided.

[0010] [Figure 6] A flowchart illustrating the process of anomaly detection according to one embodiment is shown.

[0011] [Figure 7] Figure 1 is a high-level block diagram illustrating an exemplary computer for implementing the client device and / or computing system.

[0012] The drawings and the following description illustrate specific embodiments for illustrative purposes only. Those skilled in the art will readily recognize from the following description that alternative embodiments of the structures and methods illustrated herein may be employed without departing from the principles described herein. Several embodiments will be referenced in detail, examples of which are illustrated in the accompanying drawings. [Modes for carrying out the invention]

[0013] The system performs anomaly detection on time series data using a machine learning-based model, such as a neural network. The system trains the neural network for a fixed number of iterations using data from a time window of the time series. To identify anomalies in the time series data, the system uses a loss value at the end of the fixed number of iterations. The loss value may represent the difference between the predicted data value and the time series data value corresponding to the time value. For example, the system compares the loss value to a predetermined threshold. The system uses the loss value to adjust the parameters of the neural network, for example, using backpropagation. The system also uses the loss value determined during the training phase to determine whether a data point in the time series represents an anomaly. If the loss value at a given point in time exceeds a threshold, the system determines that the time value corresponds to an anomaly. In one embodiment, the anomaly is a point anomaly. The system performs the above steps for a new time interval. The system reinitializes the neural network for the new time interval and repeats the above steps.

[0014] Traditionally, neural networks are trained using training datasets, and the trained neural network is used during inference to predict outcomes. In contrast, systems in various embodiments determine anomalies during the training phase rather than using a trained neural network to make predictions.

[0015] The system trains a neural network using data within a time window and detects anomalies in data points within the time window based on the loss value determined within that time window. Conventional systems train the neural network until convergence occurs, for example, until the loss value falls below a threshold. In contrast, systems in various embodiments train the neural network for a fixed number of iterations. After the fixed number of iterations, the system compares the loss values ​​of data points within the time window to a threshold. The system identifies data points with loss values ​​exceeding the threshold as anomaly data points. The system repeats this process for subsequent time intervals.

[0016] When this process is repeated for the next time window, the system discards the neural network trained with the data from the previous time window. Therefore, for each time window, the system reinitializes the neural network, for example, using random values. Thus, the system does not train the neural network for future use as a predictor during inference. The system simply runs the training process to use the loss determined during the training process for identifying point anomalies. After an anomaly is detected for a time window during the training phase of the neural network, the system discards the neural network and reinitializes it using random values ​​for the next time interval.

[0017] Furthermore, the system trains the neural network with a fixed number of iterations. Traditionally, neural network training is performed until a convergence criterion is met, for example, until the loss value falls below a threshold indicating convergence. The system does not attempt to reach convergence, but uses the training dynamics to determine anomalies. Therefore, the system does not aim to produce a fully trained neural network.

[0018] As a result, the process used to detect anomalies in time-series data is computationally efficient because it is trained in only a few iterations, rather than until the neural network converges. The accuracy of the disclosed technique is better than, or at least as good as, other techniques that fully train the neural network. Thus, the system achieves high accuracy with fewer computing resources. Therefore, the disclosed technique improves the computing efficiency of the process of detecting anomalies in time-series data and provides a technical advantage over conventional techniques.

[0019] Overall system environment Figure 1 is a block diagram of a system environment including a computing system for performing time-series analysis according to one embodiment. The system environment 100 shown in Figure 1 includes a computing system 130, a client device 110, an external system 120, and a network 150. Alternative configurations may include different and / or additional components in the system environment 100. The computing system 130 may be an online system or a system that works offline, for example by performing batch processing that performs anomaly detection.

[0020] The computing system 130 includes a time-series processing module 140, a listener module 145, and an action module 160. The listener module 145 receives time-series data 135 from one or more sources, for example, an external system 120. The time-series processing module 140 performs anomaly detection on the time-series data 135 to detect anomalies, for example, point anomalies 155. The action module 160 takes action based on the detected anomalies 155, for example, by sending a warning message to the user or by taking automated remediation actions. In some embodiments, the computing system 130 itself may be the source of the time-series data.

[0021] Figure 2 shows exemplary time - series data and corresponding outputs of anomaly detection executed by the time - series processing module 140 according to one embodiment. Chart 210 represents time - series data 135 received by the listener module 145 and provided as input to the time - series processing module 140. The time - series processing module 140 outputs a score indicating the occurrence of an anomaly within the time - series data shown in chart 210. An exemplary score determined based on the time - series data of chart 210 is shown as chart 220. As shown in Figure 2, when the score generated by the time - series processing module 140 exceeds a predetermined threshold, for example, when the score increases at point 225 based on a point anomaly detected in the time - series data at point 215, the computing system 130 determines the occurrence of anomaly 155.

[0022] Anomaly detection may be performed, for example, for system maintenance to detect system problems in advance. For example, an anomaly in the usage rate of computing resources may be an indicator of a server failure that may occur in the near future. Similarly, an anomaly in the usage rate of network resources may be an indicator of a network failure that may occur in the near future. Therefore, for the analysis of such time - series data, it is important to detect anomalies accurately and in a timely manner.

[0023] The computing system 130 receives time-series data 135 from a source, for example, an external system 120. For example, the external system 120 includes computing resources 125 that generate the time-series data. Examples of computing resources include memory resources, processing resources, storage resources, and network resources. The external system 120 may run instrumentation software that generates time-series data representing the resource usage of one or more resources. For example, the external system 120 may run instrumentation software that monitors network usage and periodically reports metrics indicating network usage. The reported data represents the time-series data 135 received by the computing system 130. The time-series processing module 140 may detect anomalies 155 that represent potential problems with computing resources, for example, potential failures that are likely to occur. The action module 160 may take appropriate action in response to the detection of anomaly 155, for example, by sending a warning to the system administrator, or by taking an automatic remediation action, for example, by allocating additional computing resources to a task or process if the system determines that anomaly 155 indicates a shortage of specific computing resources allocated to the task or process. For example, computing system 130 may determine that a detected point anomaly in a time series representing network usage indicates a lack of sufficient network resources for a communication channel, and the action module 160 may reallocate network resources to provide additional network bandwidth to the communication channel. As another example, the time series data may represent the number of pages swapped by a process, and anomaly 155 may occur due to an increase in the number of swapped pages indicating a shortage of storage resources. In response to the detection of anomaly 155, the action module 160 may allocate additional storage to the process.

[0024] The time series data 135 may be reported by sensors that monitor other sources, such as some real-world data, such as temperature, pressure, weight, light intensity, etc., and report it periodically. For example, the sensors may monitor the temperature or pressure of an industrial process that performs a chemical reaction and report it periodically as the time series data 135. The action module 160 may perform an action to control the industrial process in response to the detection of an anomaly 155, for example, by controlling the industrial process to adjust the rate of the chemical reaction.

[0025] The time series data 135 may represent a user's action, such as a user's interaction with an online system. For example, the computing system 130 may monitor user interactions with an online system to detect anomalies in the user interactions. A point anomaly may be an indicator of a change in the user's behavior or a problem with the online system that receives the user interaction. The action module 160 may take an appropriate action based on the detection of the point anomaly 155, for example, by sending a warning message to the user. The warning message may also provide suggestions for actions that the user can take to adjust the online system parameters in response to the anomaly detection. For example, if the anomaly 155 is determined as an indicator of an increase in demand for a particular product, the online system may initiate an online campaign for the product to provide additional users with information about the product.

[0026] Figure 1 shows a single instance of various components, such as external systems and client devices. However, there may be multiple instances of each of these components. For example, there may be several computing systems 130 and tens or hundreds of client devices 110 or external systems 120 communicating with each computing system 130. The figure uses similar reference numbers to identify similar elements. Letters following a reference number, such as "110a," indicate that the text specifically refers to the element with that particular reference number. Reference numbers in the text without following letters, such as "110," refer to any or all of the elements in the figure that have that reference number.

[0027] The client device 110 is a computing device such as a smartphone, tablet computer, laptop computer, desktop computer, electronic stereo in an automobile or other vehicle, or any other type of network-enabled device capable of listening to or otherwise experiencing digital content, having an operating system such as ANDROID® or APPLE® IOS®. A typical client device 110 includes the hardware and software necessary to connect to the network 150 (e.g., via Wi-Fi and / or 4G or other wireless communication standards).

[0028] Network 150 provides a communication infrastructure between client devices 110, external systems 120, and computing systems 130. Network 150 is typically the Internet, but may be any network including, but not limited to, a local area network (LAN), metropolitan area network (MAN), wide area network (WAN), mobile wired or wireless network, private network, or virtual private network. Parts of Network 150 may be provided by links using communication technologies including Wi-Fi based on the IEEE 802.11 standard, the Bluetooth® short-range standard, and the wireless USB (Universal Serial Bus) standard.

[0029] System Architecture Figure 3 illustrates the system architecture of a time-series processing module according to one embodiment. The time-series processing module 140 includes an anomaly detection module 310 and a time-series database 360. The time-series processing module 140 may perform processing of various types of time-series data, including anomaly detection. The anomaly detection unit 310 performs anomaly detection of time-series data stored in the time-series database 360. The anomaly detection module 310 includes a neural network 320, a loss determination module 340, a training module 330, and a threshold determination module 350. Conventional components such as network interfaces, security functions, load balancers, failover servers, and management network operation consoles are not shown so as not to obscure the details of the system architecture.

[0030] In one embodiment, the neural network 320 is a multilayer perceptron. Figure 4 illustrates a neural network architecture used for anomaly detection according to one embodiment. Figure 4 shows an exemplary neural network 400 including an input layer 410, one or more hidden layers 420, and an output layer 430. The input layer 410 is configured to receive a time value as input, and the output layer 430 is configured to predict a data value corresponding to the input time value.

[0031] The loss determination module 340 determines the loss value based on the predictions of the trained neural network. The loss value represents the difference between the predicted data value and the corresponding known data value in the time series corresponding to the time value. For example, if the time series data value is D1 for a time value T1, the neural network predicts the value D1' and determines the loss value based on the difference between D1' and D1. The loss value may be determined using any of the various possible metrics, such as the root mean square or the mean absolute value.

[0032] The training module 330 executes the training process of the neural network. The training module 330 initializes the neural network, for example, by setting the neural network parameters to random values. The training module 330 uses the neural network to predict values ​​of time series data and determines the loss value by calling the loss determination module 340. Based on the loss value, the training module 330 adjusts the parameters of the neural network to minimize the loss value, for example using backpropagation.

[0033] The threshold determination module 350 determines a threshold used to determine point anomalies. The anomaly detection module 310 compares the neural network's loss value with the threshold determined by the threshold determination module 350 to determine whether a point anomaly exists in the time value within the time series data. In one embodiment, the threshold determination module 350 adjusts the threshold based on a comparison of the identified anomaly with known anomalies. For example, point anomalies may be presented to the user to receive feedback explaining whether the point anomaly was accurately identified.

[0034] If the anomaly detection module 310 receives feedback indicating that one or more known point anomalies were not detected by the anomaly detection module 310, the threshold may be reduced so that point anomalies similar to the missed point anomalies can be identified later. If the anomaly detection module 310 receives feedback indicating that one or more known point anomalies were identified by the anomaly detection module 310 but were not actual point anomalies, the threshold may be increased so that point anomalies similar to the previously identified pseudo-point anomalies are filtered out and not detected subsequently. The threshold determination module 350 uses the adjusted threshold to identify anomalies for subsequent time windows.

[0035] Anomaly detection process Figure 5 illustrates an anomaly detection process according to one embodiment. As shown in Figure 5, the time series data 135 includes time 510 and data value 520. For example, the time series data 135 is represented as a sequence of tuples (Tn, Dn), where Tn represents the time value 510 and Dn represents the data value 520. The neural network 320 receives the time value 510 as input and predicts the data value 530. The loss determination module 320 receives the predicted data value 530 and the actual data value 520 of the time series as input and determines a loss value that is used as feedback to adjust the parameters of the neural network. The loss value is used by the anomaly detection module 310 to determine anomalies 540 by comparing the loss value to a threshold.

[0036] Figure 6 shows a flowchart illustrating the process of anomaly detection according to one embodiment. The steps described herein may be performed in a different order than those shown herein. Each step may be performed in a different module than those shown herein.

[0037] The time series processing module 140 receives a time series (610) containing a sequence of data values. Each data value in the time series is associated with a time value. The time series processing module 140 processes different time windows of the time series data to determine point anomalies within each time window. A time window represents a range of time values. Therefore, the time series processing module 140 trains a neural network based on the data values ​​in the time window and detects point values ​​within the time window based on the loss value determined during the training phase of the neural network based on the time series data of the time window. For each time window, the time series processing module 140 repeats the following steps.

[0038] The time series processing module 140 receives a time window representing a range of time values ​​(620). The time series processing module 140 initializes the neural network for the time window (630). The time series processing module 140 trains the neural network for a predetermined number of iterations by repeating the following steps 660, 670, and 680. For each iteration, the time series processing module 140 repeats steps 660 and 670 for the time values ​​within the time window. The time series processing module 140 runs the neural network on the time values ​​in the time window to predict the data values ​​for the time values ​​(660). The time series processing module 140 determines the loss value based on the predicted data values ​​(670). After repeating steps 660 and 670 for the set of time values ​​in the time window, the time series processing module 140 determines the aggregate loss value across the set of time values.

[0039] The time series processing module 140 adjusts the parameters of the neural network based on the total loss value (680). The steps of determining the total loss value and adjusting the parameters of the neural network are repeated for each iteration. After a predetermined number of iterations, the time series processing module 140 identifies point anomalies within the time window as follows: If the loss value corresponding to a particular time value within the time window exceeds a threshold, the time series processing module 140 identifies the corresponding data value as an anomaly. The computing system 130 may store information describing the data value identified as a point anomaly. The action module 160 can take action based on the identified point anomaly, for example, by sending a warning message describing the point anomaly to the user, sending information describing the point anomaly to be displayed via the user interface, proposing a remediation action based on the point anomaly, or executing a remediation action based on the point anomaly.

[0040] The time series processing module 140 initializes the neural network for each time window and discards the neural network at the end of processing for the time window. The neural network may be initialized by setting its parameter values ​​to random values. Thus, the time series processing module 140 performs a step to train the neural network, but does not use the trained neural network for any processing. The time series processing module 140 uses the loss value determined during the training process to detect point anomalies in the time series data for the time window and repeats the process for the next time window. Furthermore, the time series processing module 140 trains the neural network for a predetermined number of iterations, rather than training it until the total loss value falls below a threshold. The predetermined number of iterations may be configurable by the user or set to a default value. The predetermined number of iterations is set to a value less than the number of iterations required to ensure that the total loss value falls below a threshold. This ensures that the anomaly detection process is performed efficiently because the goal of the time series processing module 140 is not to generate a trained model that can be used at inference to make predictions, but merely to go through a partial training process, and as a result, point anomalies can be identified using the loss values ​​during the partial training process.

[0041] Performance improvement The experimental data demonstrate the performance improvements achieved by using the techniques disclosed herein. The table below shows the F1 scores obtained by running various models on various datasets. The F1 score is calculated as F1 = 2 * Precision * Recall / (Precision + Recall). Each column represents a specific dataset, and each row represents a specific model. The disclosed techniques were compared with other models, including WinStats, ISF, RRCF (Robust Random Cut Forest), and Prophet. The first row represents the data of the system according to one embodiment of the disclosed techniques, and the remaining rows represent other models that do not use the disclosed techniques. For example, (1) WinStats (Window statistics) is a technique that uses statistics on time-series data to determine which particular points are anomalous, (2) ISF (Isolation Forest) is a technique based on a decision tree algorithm, (3) RRCF (Robust Random Cut Forest) is similar to ISF but modified to work with streaming data, and (4) Prophet is an approach based on a regression model. [Table 1]

[0042] As shown in the table above, the F1 scores of the systems based on the disclosed technology indicated that the systems predicted anomalies without requiring any retraining, and performed better than or near the best of all the models tested. For example, the last "Average" column represents the average performance of all models across various datasets, showing that the average performance of the disclosed system is better than all the models studied. Therefore, the disclosed system is computationally efficient, requiring significantly less computational resources to train the model compared to other technologies, while at least performing at or above the level of the other technologies. The average performance of the disclosed technology across all datasets was better than all other technologies tested. Computer Architecture

[0043] Figure 7 is a high-level block diagram illustrating an exemplary computer for implementing the client device and / or computing system of Figure 1. The computer 700 includes at least one processor 702 coupled to a chipset 704. The chipset 704 includes a memory controller hub 720 and an input / output (I / O) controller hub 722. Memory 706 and a graphics adapter 712 are coupled to the memory controller hub 720, and a display 718 is coupled to the graphics adapter 712. A storage device 708, an input device 714, and a network adapter 716 are coupled to the I / O controller hub 722. Other embodiments of the computer 700 have different architectures.

[0044] The storage device 708 is a non-temporary computer-readable storage medium such as a hard drive, compact disk read-only memory (CD-ROM), DVD, or solid memory device. Memory 706 holds instructions and data used by the processor 702. The input interface 714 is a touchscreen interface, mouse, trackball, or other type of pointing device, keyboard, or any combination thereof, used to input data into the computer 700. In some embodiments, the computer 700 may be configured to receive input (e.g., commands) from the input interface 714 via gestures from the user. The graphics adapter 712 displays images and other information on the display 718. The network adapter 716 connects the computer 700 to one or more computer networks.

[0045] Computer 700 is adapted to run computer modules for providing the functions described herein. As used herein, the term “module” refers to computer program logic used to provide a particular function. Thus, modules can be implemented in hardware, firmware, and / or software. In one embodiment, a computer module is stored on a storage device 708, loaded into memory 706, and executed by a processor 702.

[0046] The type of computer 700 used by the entity in Figure 1 may vary depending on the embodiment and the processing power required by the entity. Computer 700 may lack some of the components described above, such as the graphics adapter 712 and the display 718. For example, computing system 130 may consist of multiple blade servers communicating over a network, such as within a server farm. Alternative Embodiments

[0047] The drawings and descriptions of the disclosed invention are simplified to illustrate elements relevant to a clear understanding of the invention, but it should be understood that, for clarity, many other elements found in typical distributed systems have been omitted. Those skilled in the art may recognize that other elements and / or steps are desirable and / or necessary when implementing the embodiments. However, since such elements and steps are well known in the art and would not facilitate a better understanding of the embodiments, no discussion of such elements and steps is provided herein. The disclosure herein covers all such variations and modifications to such elements and methods known to those skilled in the art.

[0048] Some parts of the above description describe embodiments in terms of algorithms and symbolic representations of operations on information. These descriptions and representations of algorithms are used by those skilled in the data processing technology to effectively communicate the substance of the work to others skilled in the art. These operations are described functionally, computationally, or logically, but are understood to be implemented by computer programs or equivalent electrical circuits, microcode, etc. Furthermore, it has proven that it is sometimes convenient to refer to the arrangement of these operations as modules without loss of generality. The described operations and their associated modules may be embodied in software, firmware, hardware, or any combination thereof.

[0049] Where used herein, any reference to “one embodiment” or “a particular embodiment” means that a specific element, feature, structure, or feature described in relation to the embodiment is included in at least one embodiment. The phrase “in one embodiment” appearing in various places in the specification does not necessarily refer to the same embodiment.

[0050] Some embodiments may be described using the terms “joined” and “connected,” along with their derivatives. These terms should be understood not as synonyms. For example, some embodiments may be described using the term “connected” to indicate that two or more elements are in direct physical or electrical contact with one another. In another example, some embodiments may be described using the term “joined” to indicate that two or more elements are in direct physical or electrical contact with one another. However, the term “joined” may also mean that two or more elements are not in direct contact with one another but are working together or interacting with one another. Embodiments are not limited to this context.

[0051] As used herein, “equipped,” “having,” “including,” “containing,” “having,” or any other derivative thereof are intended to cover non-exclusive inclusion. For example, a process, method, article, or apparatus that includes a list of elements is not necessarily limited to those elements alone and may include other elements not expressly enumerated in or inherent to such process, method, article, or apparatus. Furthermore, unless explicitly stated otherwise, “or” refers to an inclusive OR and not an exclusive OR. For example, condition A or B is satisfied by any one of the following: A is true (or exists) and B is false (or does not exist); A is false (or does not exist) and B is true (or exists); and both A and B are true (or exist).

[0052] In addition, the use of "a" or "an" is used to describe elements and components of the embodiments herein. This is done simply for convenience to give a general meaning to the invention. This description should be read as including one or at least one singular noun, and plural nouns unless it is clear that otherwise.

[0053] A person skilled in the art will, upon reading this disclosure, understand through the principles disclosed herein, that there may be additional alternative structural and functional designs for systems and processes for displaying charts using strain regions. Therefore, while specific embodiments and applications have been illustrated and described, it should be understood that the disclosed embodiments are not limited to the exact structures and components disclosed herein. Various modifications, changes, and variations may be made to the configuration, operation, and details of the methods and apparatus disclosed herein without departing from the spirit and scope defined in the appended claims, which would be apparent to a person skilled in the art.

Claims

1. A computer implementation method for identifying anomalies in time-series data, Receiving a time series containing a sequence of data values, where each data value is associated with a time value, and receiving the data value. Identifying a time window that represents a range of time values, To identify anomalies in the time series data within the aforementioned time window, Initializing a neural network configured to receive an input time value and predict the time-series data value for the input time value, Training the neural network for a predetermined number of iterations, For one or more time values ​​in the aforementioned time window, The neural network is executed to predict the data value for the time value, The loss value is determined based on the predicted data value, and the following is performed: Training, which includes adjusting the parameters of the neural network based on the loss value, After the predetermined number of iterations, the abnormality within the time window is determined, Identifying includes determining the corresponding data value as abnormal in response to a loss value corresponding to a time value exceeding a threshold, A computer implementation method comprising storing information describing one or more data values ​​identified as abnormal.

2. The computer implementation method according to claim 1, wherein the abnormality is a point abnormality.

3. The computer implementation method according to claim 1, wherein initializing the neural network includes assigning random values ​​to the parameters of the neural network.

4. The aforementioned time window is a first time window, the range of the time value is a range of the first time value, and the computer implementation method is Identifying a second time window that represents a range of second time values, Identifying anomalies within the second time window, Reinitializing the neural network for the second time window, The neural network is trained using the data values ​​of the second time window for a predetermined number of iterations. A computer implementation method according to claim 1, comprising identifying the data value of the time value as abnormal in response to the loss value of the time value in the second time window exceeding the threshold.

5. The computer implementation method according to claim 1, wherein the loss value represents the difference between the predicted data value and the time series data value corresponding to the time value.

6. Adjusting the parameters of the aforementioned neural network is The total loss value is determined based on the loss value corresponding to the time value in the aforementioned time window, The computer implementation method according to claim 1, further comprising adjusting the parameters of the neural network based on the total loss value.

7. The aforementioned time series represents the resource utilization rate of computing resources, and the computer implementation method is Identifying potential resource failures based on the identified anomalies, The computer implementation method according to claim 1, further comprising sending a message reporting the aforementioned potential resource failure.

8. The aforementioned computing resources are Processing resources Memory resources Network resources, or A computer implementation method according to claim 7, which is one of the storage resources.

9. The aforementioned time series represents the resource utilization rate of computing resources, and the computer implementation method is The computer implementation method according to claim 7, further comprising taking corrective measures to prevent the aforementioned potential resource failure.

10. The computer implementation method according to claim 1, wherein the neural network is a multilayer perceptron configured to receive a scalar input and output a scalar value.

11. Adjusting the threshold based on a comparison of one or more identified anomalies with known anomalies, The computer implementation method according to claim 1, further comprising using the adjusted threshold to identify anomalies for one or more other time windows.

12. A non-temporary computer-readable storage medium for storing instructions, wherein when an instruction is executed by one or more computer processors, the instructions are stored in the one or more computer processors. Receiving a time series containing a sequence of data values, where each data value is associated with a time value, and receiving the data value. Identifying a time window that represents a range of time values, Identifying anomalies in the time series data within the time window, wherein the identification is performed by one or more computer processors. Initializing a neural network configured to receive an input time value and predict the time-series data value for the input time value, Training the neural network for a predetermined number of iterations, wherein the training is performed by one or more computer processors, For one or more time values ​​in the aforementioned time window, The neural network is executed to predict the data value for the time value, The loss value is determined based on the predicted data value, and the following is performed: Adjusting the parameters of the neural network based on the loss value, and training the network, After the predetermined number of iterations, the abnormality within the time window is determined, and the determination of the abnormality is performed by one or more computer processors. In response to a loss value corresponding to a time value exceeding a threshold, the system determines and identifies the corresponding data value as abnormal. A non-temporary, computer-readable storage medium that stores information containing one or more data values ​​identified as abnormal.

13. The aforementioned time window is a first time window, the range of the time value is a range of the first time value, and the instruction is to one or more computer processors, Identifying a second time window that represents a range of second time values, The one or more computer processors mentioned above: Reinitializing the neural network for a second time window, The neural network is trained using the data values ​​of the second time window for a predetermined number of iterations. A non-temporary computer-readable storage medium according to claim 12, further comprising: identifying the data value of the time value as abnormal in response to the loss value of the time value in the second time window exceeding the threshold; and identifying an abnormality within the second time window.

14. Instructions for adjusting the parameters of the neural network are given to one or more computer processors. The total loss value is determined based on the loss value corresponding to the time value in the aforementioned time window, A non-temporary computer-readable storage medium according to claim 12, which allows the parameters of the neural network to be adjusted based on the total loss value.

15. A computer system, One or more computer processors, A non-temporary computer-readable storage medium for storing instructions, wherein when an instruction is executed by one or more computer processors, the one or more computer processors... Receiving a time series containing a sequence of data values, where each data value is associated with a time value, and receiving the data value. Identifying a time window that represents a range of time values, Identifying anomalies in the time series data within the time window, wherein the identification is performed by one or more computer processors. Initializing a neural network configured to receive an input time value and predict the time-series data value for the input time value, Training the neural network for a predetermined number of iterations, wherein the training is performed by one or more computer processors, For one or more time values ​​in the aforementioned time window, The neural network is executed to predict the data value for the time value, The loss value is determined based on the predicted data value, and the following is performed: Adjusting the parameters of the neural network based on the loss value, and training the network, After the predetermined number of iterations, the abnormality within the time window is determined, and the determination of the abnormality is performed by one or more computer processors. In response to a loss value corresponding to a time value exceeding a threshold, the system determines and identifies the corresponding data value as abnormal. A computer system that stores information containing one or more data values ​​identified as abnormal.

Images