Anomaly detection method and apparatus for non-stationary time series and based on fusion of temporal, frequency and spatial features, and computer-readable storage medium and electronic device

Abstract

The present application relates to an anomaly detection method for a non-stationary time series and based on the fusion of temporal, frequency and spatial features. The method comprises: performing data preprocessing on time series samples in a training set; extracting a time-domain feature, a frequency-domain feature and a spatial-domain feature; by means of transformation, converting the temporal, frequency and spatial features to the same dimension, and performing a concatenation operation to obtain a fused feature; calculating an anomaly score by means of reconstruction and prediction; on the basis of the anomaly score, constructing an error series, performing smoothing processing on the error series, and using a mean value and a standard deviation to calculate a dynamic threshold; and during anomaly detection, first performing window division on test data, then inputting same into a trained model, calculating an anomaly score, and on the basis of the dynamic threshold, determining whether there is an anomaly in the test data. The method can more comprehensively capture and understand complex patterns and dynamic changes in data, so as to effectively detect an anomaly, thereby improving the accuracy and reliability of anomaly detection, and providing strong support for ensuring the safe operation of civil aviation systems.

Description

A method, apparatus, computer-readable storage medium, and electronic device for detecting unstable time series anomalies by integrating time-frequency-spatial features. Technical Field

[0001] This application belongs to the field of multivariate time series anomaly detection technology, and specifically relates to a method, apparatus, computer-readable storage medium, and electronic device for detecting unstable time series anomalies by integrating time-frequency-space features. Background Technology

[0002] Real-time monitoring of the operational status of civil aviation systems is a crucial aspect of maintaining aviation safety. During daily operations, various core application systems generate a large amount of critical time-series performance data, such as CPU utilization and memory usage. Traditional anomaly detection methods primarily rely on manual monitoring of the changing trends of single indicators, but this approach often fails to adequately account for the complex interactions between multiple indicators. With the expansion of system scale and the surge in monitoring data, traditional methods face challenges in both efficiency and effectiveness.

[0003] Currently, anomaly detection methods are mainly divided into two categories: machine learning and deep learning. Traditional machine learning methods typically rely heavily on feature engineering, involving statistical methods (such as principal component analysis) to extract features. These methods often depend on domain-specific knowledge and human experience, making it difficult to find appropriate feature representations when faced with complex anomaly patterns. Furthermore, for anomaly detection tasks involving time-series data, traditional machine learning methods struggle to fully mine and utilize temporal information and capture time dependencies, which limits their application in the field of time-series anomaly detection.

[0004] In deep learning methods, anomaly detection in multivariate time series analysis typically only considers temporal information, neglecting the complex relationships that may exist between multiple variables, such as spatial correlations (e.g., sensor placement) or other types of dependencies. In some cases, anomalies exhibit specific patterns in space, and considering only temporal information can easily lead to anomaly detection algorithms failing to accurately capture these patterns.

[0005] Furthermore, the data acquisition process often faces the problem of time drift, which causes data distribution to change over time, creating a complex challenge. Current methods may struggle to accurately identify anomalies in such situations, increasing the risk of misjudgment. This time drift phenomenon requires anomaly detection methods to adapt not only to the immediate state of the data but also to its dynamic changes, ensuring long-term accuracy and reliability. Summary of the Invention

[0006] After identifying the aforementioned problems, the applicant conducted in-depth research on existing time series anomaly detection methods. The research revealed that existing methods typically focus only on time-domain information when handling time series anomaly detection, neglecting the complex interrelationships that may exist among multiple variables. This approach leads to insufficient feature extraction because it fails to fully utilize the interdependencies and interactions between variables, thus affecting the accuracy and efficiency of anomaly detection. In practical applications, especially in complex environments like civil aviation systems, the interrelationships between various indicators and variables often play a crucial role. Ignoring these relationships may result in the omission of important anomaly patterns, thereby reducing the overall effectiveness of anomaly detection. Therefore, to improve the accuracy and efficiency of anomaly detection, it is necessary to develop a new time series anomaly detection method that can comprehensively consider time-domain information and the complex interactions between multiple variables.

[0007] Furthermore, considering the high requirements for safety and detection accuracy in the civil aviation system, as well as the complexity of anomalies, this applicant has conducted an in-depth analysis of the characteristics of time-series data in the civil aviation system to enhance its detection capabilities, efficiency, and accuracy. Time-series data in the civil aviation system not only contains rich time-domain features but also possesses significant frequency-domain and spatial characteristics. The time domain reflects the data's changing patterns over time, the frequency domain reveals the data's periodicity and oscillation patterns, while the spatial domain involves the interrelationships and distribution characteristics among multiple variables. Based on this concept, this application comprehensively considers and integrates information from different domains (time-domain trends, seasonality, and statistical characteristics; frequency components and oscillation patterns in the frequency domain; and characteristic combinations and interactions among variables in the spatial domain) to deeply model the time series data of the civil aviation system, allowing for joint analysis and judgment of multiple key performance indicator sequences. Through this design, the method of this application can more comprehensively capture and understand the complex patterns and dynamic changes in the data, thereby effectively detecting anomalies and providing more comprehensive detection results. By using this method that integrates multi-dimensional features, we can improve the accuracy and reliability of anomaly detection, thus providing stronger support for ensuring the safe operation of the civil aviation system.

[0008] In summary, this application enhances information extraction capabilities and improves the reliability of system detection by utilizing time-frequency-spatial information from multivariate time-series data. The method described in this application can quickly locate the key subsystem where the problem lies based on the calculation results, and allow for timely intervention. In the future, this method can also be integrated into big data analytics platforms and combined with other monitoring indicators to construct a more comprehensive and intelligent operational status management system, significantly improving the stability and security of civil aviation systems.

[0009] To achieve the above objectives, this application provides the following technical solution:

[0010] The first aspect of this application provides a method for detecting unstable time series anomalies by fusing time-frequency-spatial features, comprising:

[0011] Data preprocessing is performed on the time series samples in the training set;

[0012] Time-domain, frequency-domain, and spatial-domain features are extracted from the preprocessed training sample data, and time-frequency-spatial feature modeling is performed based on the extracted features.

[0013] The time-domain features, frequency-domain features, and spatial-domain features extracted in the previous step are transformed to the same dimension, and then spliced ​​together to obtain fused features.

[0014] Based on the reconstruction plus prediction approach, anomaly scores are calculated by comparing the differences between the reconstructed data and the predicted data with the preprocessed training sample data.

[0015] An error sequence is constructed based on outlier scores, and the error sequence is smoothed using an exponentially weighted moving average. Then, a dynamic threshold is calculated using the mean and standard deviation.

[0016] When performing anomaly detection, the test data is first divided into windows, then input into the trained model, anomaly score is calculated, and the presence of anomalies in the test data is determined based on the dynamic threshold determined in the previous step.

[0017] Optionally, in the method of this application, the data preprocessing includes:

[0018] Step 11: Fill in missing data values: Fill in missing data values ​​for the time series samples in the training set using linear interpolation.

[0019] Step 12: Remove outliers: Use the SR algorithm to transform the time series samples to obtain a saliency map. Detect outliers in the samples using the saliency map and replace them with normal values.

[0020] Step 13, Drift Adaptive Window Processing: Divide the time series samples into local windows with a step size equal to the window length. Perform Min-Max normalization within each window to obtain the normalized window.

[0021] Optionally, in the method of this application, the extraction of time-domain features, frequency-domain features, and spatial-domain features from the preprocessed training sample data includes:

[0022] Step 21, Temporal Feature Extraction: Use the Long Short-Term Memory (LSTM) network model to extract temporal features from the preprocessed training sample data;

[0023] Step 22, Frequency Domain Feature Extraction: Use discrete wavelet transform to extract frequency domain features from the preprocessed training sample data;

[0024] Step 23, Spatial feature extraction: Use the GATv2 model to extract spatial features from the preprocessed training sample data.

[0025] Optionally, in the method of this application, step 21 further includes: re-dividing the partitioned window obtained in step 13 with a step size of 1, while keeping the window length unchanged, and using it as the input of the LSTM model;

[0026] By utilizing the memory units and gating mechanisms within the LSTM model, temporal information can be selectively retained to obtain temporal features.

[0027] Optionally, in the method of this application, step 22 further includes: using discrete wavelet transform to extract frequency domain features from the preprocessed training sample data, and mapping the frequency components to specific time positions according to the characteristics of discrete wavelet transform, wherein the low-frequency part contains the basic features of the sample, and the high-frequency part contains the details of the sample.

[0028] Optionally, in the method of this application, step 23 further includes: using the GATv2 model, treating each variable in the training samples as a node, and the relationship between each variable as an edge, to establish a graph structure; at the same time, considering the possible changing relationships between each node, GATv2 calculates the attention score of each node through dynamic attention, first connecting adjacent query nodes, and then using linear transformation to calculate the relationship between nodes, to ensure a better fit to the training samples.

[0029] Optionally, in the method of this application, the method based on reconstruction plus prediction, which calculates anomaly scores by comparing the differences between the reconstructed data and the predicted data and the preprocessed training sample data, includes:

[0030] The fusion features are used to reconstruct reconstructed data with spatiotemporal information. The reconstructed data is then compared with the preprocessed training sample data to obtain a reconstruction anomaly score.

[0031] The fusion features are used to make predictions at a specific time step. The predicted data is then compared with the preprocessed training sample data to obtain the predicted anomaly score.

[0032] The reconstructed outlier score and the predicted outlier score are added together in a specific ratio to obtain the outlier score of the overall data.

[0033] A second aspect of this application provides an unstable time series anomaly detection device that integrates time-frequency-space features, comprising:

[0034] Data preprocessing module: used to preprocess time series samples in the training set;

[0035] Feature extraction module: used to extract time-domain features, frequency-domain features and spatial features from preprocessed training sample data, and to perform time-frequency-spatial feature modeling based on the extracted features;

[0036] Feature fusion module: This module transforms time-domain features, frequency-domain features, and spatial-domain features to the same dimension, performs a splicing operation, and obtains fused features.

[0037] Anomaly score calculation module: This module calculates anomaly scores by comparing the reconstructed and predicted data with the preprocessed training sample data, based on a reconstruction plus prediction approach.

[0038] Dynamic threshold calculation module: used to construct an error sequence based on outlier scores, smooth the error sequence using an exponentially weighted moving average, and then calculate the dynamic threshold using the mean and standard deviation;

[0039] Anomaly detection module: Used to perform anomaly detection. First, the test data is divided into windows, then input into the trained model, calculate the anomaly score, and determine whether the test data is abnormal based on the dynamic threshold.

[0040] The device implements the steps of the aforementioned method for detecting unstable time series anomalies by fusing time-frequency-space features during operation.

[0041] A third aspect of this application provides an electronic device, including: a memory and a processor;

[0042] Memory: Used to store computer programs;

[0043] Processor: Used to execute the computer program to implement the steps of the aforementioned method for detecting unstable time series anomalies by fusing time-frequency-space features.

[0044] A fourth aspect of this application provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, it implements the steps of the aforementioned method for detecting unstable time series anomalies by fusing time-frequency-space features.

[0045] In summary, this application proposes a novel anomaly detection method for unstable time series data that integrates time, frequency, and spatial features. Unlike traditional single-dimensional analysis methods, this method belongs to the multivariate time series anomaly detection approach. It employs a unique multi-dimensional data fusion strategy that combines time, frequency, and spatial features, enabling the system to more comprehensively capture and understand complex data patterns. Furthermore, the anomaly score construction in this method combines data reconstruction and prediction. The anomaly score is calculated based on the accuracy of reconstruction and prediction: if a data point deviates significantly from the actual value during reconstruction or prediction, then that data point is considered to have a high anomaly score. This method provides a new perspective for anomaly detection in time series data, and is particularly suitable for civil aviation systems with complex and dynamically changing data, providing strong technical support for improving system safety and operational efficiency.

[0046] Other features and advantages of this application will be set forth in the following description and will be apparent in part from the description or may be learned by practicing the application. The objectives and other advantages of this application may be realized and obtained by means of the techniques pointed out in the description, claims and drawings. Attached Figure Description

[0047] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0048] Figure 1 is a design architecture diagram of an unstable time series anomaly detection method that integrates time-frequency-space features according to an embodiment of this application.

[0049] Figure 2 is an overall implementation flowchart of an unstable time series anomaly detection method that integrates time-frequency-space features according to an embodiment of this application.

[0050] Figure 3 is a structural diagram of an unstable time series anomaly detection device that integrates time-frequency-space features according to an embodiment of this application.

[0051] Figure 4 is a schematic diagram of the structure of an electronic device provided in one embodiment of this application. Detailed Implementation

[0052] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0053] The term “comprising” and its variations as used herein are open-ended inclusions, meaning “including but not limited to”; the term “based on” means “at least partially based on”; and the term “one embodiment” means “at least one embodiment”.

[0054] It should be noted that the terms "a" and "a plurality of" used in this application are illustrative rather than restrictive, and those skilled in the art should understand that, unless otherwise expressly indicated in the context, they should be understood as "one or more".

[0055] It should be noted that the defects existing in the prior art are all the result of the applicant's practice and careful research. Therefore, the discovery process of the above problems and the solutions proposed by the embodiments of this application in the following text should be the original contributions made by the applicant.

[0056] Figure 1 shows the design architecture of an unstable time series anomaly detection method that integrates time-frequency-space features proposed in this application; Figure 2 shows the overall implementation process of the anomaly detection method.

[0057] Referring to Figures 1 and 2, the method of this embodiment includes the following steps:

[0058] Step S1, data preprocessing.

[0059] In this step, data preprocessing is performed on time series samples in the training set with discrete time length of N and variable dimension of D. The preprocessing steps include:

[0060] Step S11, data missing value imputation. Missing values ​​are imputed in the collected multivariate time series samples using linear interpolation. Assume the s-th variable is at time point t. Given a missing value, find two adjacent time points a and b with known values ​​for this variable. and Then solve using formula (1).

[0061] Step S12, outlier removal. Due to measurement errors, equipment malfunctions, and other anomalies, values ​​that deviate significantly from other observations may occur. This application uses the SR algorithm to transform each variable in the time series data to obtain a significance map, in order to detect significantly deviating values ​​in the sample. The specific formula of the algorithm is as follows: L(f)=log(A(f)) (4) AL(f)=h q (f)·L(f) (5) R(f)=L(f)-AL(f) (6)

[0062] Where f represents the frequency information after the Fourier transform. This represents the Fourier transform operation; Amplitude(.) extracts the amplitude spectrum from the frequency domain signal; Phrase(.) extracts the phase spectrum from the frequency domain signal; log(.) performs the logarithmic operation; h q (.) represents the filter function. The expression represents the inverse Fourier transform, exp(.) represents the exponential function, i represents the imaginary unit, ||.|| represents the L2 norm, and A(f), P(f), L(f), AL(f), R(f), S(x), etc., all represent the results of related operations. Specifically, the input X is univariate time-series data, which is first subjected to a Fourier transform. Next, the amplitude spectrum A(f) and phase spectrum P(f) are calculated separately. Then, the logarithm of the amplitude spectrum A(f) is taken to obtain L(f), and then L(f) is subjected to mean filtering h. q (f) then yields the result AL(f). R(f) is the residual spectrum, which is then subjected to an inverse Fourier transform. This allows us to obtain the significant region S(X). The above operations can effectively detect anomalies in the training set, and replace outliers with normal values ​​to eliminate or reduce them. This can reduce the negative impact on data analysis and modeling, thereby improving the accuracy and reliability of data analysis.

[0063] Step S13, Drift Adaptive Window. During the time series sample acquisition process, as the acquisition time progresses, the data distribution may change due to external factors, i.e., time drift problem. To address this, this application performs local windowing on the time series samples during the preprocessing stage. The partitioning step size is the window length, and if the window length is set to t, then a total of N / t windows are divided, where the data in a single window... Where s represents the s-th variable, and t0 represents the current time window starting from t0. This represents the t time points within the window. Then, Min-Max normalization is performed within each of the defined windows, using the following formula:

[0064] Where, x max and x min Let W represent the maximum and minimum values ​​of the window, and let W represent all the data within the current window. This gives us the normalized window. The above operations eliminated the effects of time drift while also preserving sample information.

[0065] Step S2, time-frequency spatial feature modeling.

[0066] In this step, feature extraction is performed on the preprocessed data. The feature extraction includes:

[0067] Step S21, Temporal Feature Extraction. To extract temporal features from the training samples, this application uses a Long Short-Term Memory (LSTM) network to fully utilize the temporal information contained in the training samples. Specifically, the partitioned window data obtained in step S13 is re-partitioned with a stride of 1, resulting in a total of N-t+1 windows of length t, which are then used as input to the LSTM model. The specific formula is as follows: i t =σ(W I ·[h t-1 ,x t ]+b I (9) f t =σ(W f ·[h t-1 ,x t ]+b f (10) o t =σ(W o ·[h t-1 ,x t ]+b o (12) h t =o t *tanh(C t (14)

[0068] Where ˙ denotes the dot product, [] denotes the concatenation of two vectors, and h t-1 x is the hidden state of the previous time step. t This represents the input at the current time step, σ represents the sigmoid activation function, tanh represents the hyperbolic tangent activation function, and W... I W f W C W o These are the weight matrices for the input gate, forget gate, candidate states, and output gate, respectively. I b fb C b o These are the bias vectors for the input gate, forget gate, candidate state, and output gate, respectively. t For the input gate, f t For the Gate of Oblivion To remember and update candidate values, o t As an output gate, it yields a long memory C. t Short memory h t This yields the feature output. Through the memory units and gating mechanism within the LSTM, temporal information is selectively retained to obtain temporal features.

[0069] Step S22, Frequency Domain Feature Extraction. This application uses discrete wavelet transform to extract the frequency domain information contained in the training samples. Furthermore, based on its transform characteristics, it can map frequency components to specific time locations. The low-frequency component contains the basic features of the samples, while the high-frequency component contains the details. Here, the Haar wavelet basis is used, and the specific formula is as follows: a j [n]=∑ k h[k]·x win [(2n-k) mod t] (15) d j [n]=∑ k g[k]·x win [(2n-k) mod t] (16)

[0070] Where j represents the wavelet transform level, n represents the discrete time point on the time axis, h[k] and g[k] are the corresponding low-pass and high-pass filter coefficients in the Haar wavelet basis, and mod represents the modulo operation, used to calculate the low-frequency coefficient a. j and high frequency coefficient d j x win This is the window data obtained from S13, where t is the window length, and (2n-k) mod t is used to handle boundary effects and ensure the periodicity of the signal. In the wavelet decomposition of each layer, the low-frequency coefficients a j Representing the approximate part of the signal, the high-frequency coefficient d j This represents the detailed parts of the signal. By repeatedly applying the above formula, multi-level wavelet decomposition can be performed to obtain frequency components at different scales.

[0071] Step S23: Spatial Feature Extraction. This application uses the GATv2 model to establish a graph structure, treating each variable in the training samples as a node, and the node is represented as... d represents the feature dimension, D represents the number of variables, and the relationship between the variables (h) m ,h jLet ) be considered as edge e, resulting in the graph representation G = {χ, E}. Considering the potential changing relationships between nodes, GATv2 uses dynamic attention to calculate the attention score of each node. Compared to the original GAT model, it first connects adjacent query nodes and then uses a linear transformation to calculate the relationships between nodes, ensuring a better fit to the training samples. The specific formula is as follows: e(h) m ,h j ) = a T LeakyReLU(W·[h m ||h j (17)

[0072] in, and These are the model parameters that the model can adaptively learn during gradient backpropagation. d′ represents the hidden layer dimension, d represents the feature dimension, LeakyReLU is the activation function, and || represents the concat operation that represents the two nodes as h. m ,h j They are directly concatenated together. After calculating the score e for node m and all its neighboring nodes, a normalization operation is performed using softmax.

[0073] Where exp represents the exponential function, χ m For all neighboring nodes of node m, GATv2 then uses the normalized attention coefficient a. mj Calculate the weighted average of the transformed features of neighboring nodes, and use a nonlinear σ operation to obtain a new representation of node m:

[0074] in, These are learnable parameters, and σ is the sigmoid activation function.

[0075] Step S3, feature fusion.

[0076] In this step, the time-frequency-space features extracted in step S2 are transformed to the same dimension and then spliced ​​together.

[0077] Step S4: Calculate the abnormal score.

[0078] The anomaly score is calculated using a reconstruction-prediction approach. The reconstruction part utilizes the fusion features from step S3 to reconstruct data with spatiotemporal information, and compares this reconstructed data with the preprocessed training samples to obtain the anomaly score. Similarly, the prediction part uses the fusion features from step S3 to predict data for t time steps, and compares this prediction with the training samples to obtain the anomaly score. These anomaly scores are then summed proportionally to θ to obtain the overall anomaly score for the data.

[0079] Where t0 represents the starting point of the window, and t represents the length of the time window. and This represents the actual value of that point. and This represents the corresponding reconstruction and prediction results. The first part is the outlier score obtained based on the reconstruction, and the second part is the outlier score obtained based on the prediction. This yields N / t error sequences, i.e., α = {α1, α2, ..., α...}. N / t}

[0080] Step S5, Dynamic threshold selection.

[0081] Dynamic threshold selection is suitable for data streams from multiple measurement points with different attributes and ranges. It addresses diversity, non-stationarity, and noise issues through an automatic thresholding method. Specifically, it measures the outlier score at each time step, obtaining an error sequence. Then, it uses an exponentially weighted moving average (EWMA) to smooth the error sequence, suppressing potential error peaks, resulting in a smoothed error sequence α* = {α*1, α*2, ..., α*...}. N / t The threshold is then determined by dynamically calculating the threshold using the mean and standard deviation: ε=μ(α*)+zσ(α*) (21)

[0082] Here, z is a coefficient representing the degree to which the standard deviation σ(α) deviates from the mean μ(α), and the ε threshold is determined by both. The function also considers larger α values ​​in the outlier scores. a Values ​​and sequences α seq Punishment will be imposed: Δμ(α*)=μ(α*)-μ({α∈α*|α<ε}) (23) Δσ(α*)=σ(α*)-μ({α∈α*|α<ε}) (24) α a ={α*∈α*|α*>ε} (25) α seq =continous sequences of α*∈α a (26)

[0083] Where μ(.) represents the mean, σ(.) represents the standard deviation, Δμ(α*) represents the mean of α* minus the mean of the error sequence of all points judged as normal, and Δσ(α*) represents the standard deviation of α* minus the standard deviation of the error sequence of all points judged as normal. a α represents the number of outliers in the sequence. seq This represents the number of consecutive outlier sequences. This allows us to maximize the mean and standard deviation of the removed sequence compared to the original sequence using the fewest outlier sequences and the fewest outliers.

[0084] Step S6, anomaly detection.

[0085] When performing anomaly detection on the test data, the test data is first divided into windows, then input into the trained model, the anomaly score α is calculated, and then the presence of anomalies in the sequence is determined according to the threshold ε determined in step S5.

[0086] Figure 3 shows an unstable time series anomaly detection device that integrates time-frequency-space features proposed in this application, comprising:

[0087] Data preprocessing module: used to preprocess time series samples in the training set;

[0088] Feature extraction module: used to extract time-domain features, frequency-domain features and spatial features from preprocessed training sample data, and to perform time-frequency-spatial feature modeling based on the extracted features;

[0089] Feature fusion module: This module transforms time-domain features, frequency-domain features, and spatial-domain features to the same dimension, performs a splicing operation, and obtains fused features.

[0090] Anomaly score calculation module: This module calculates anomaly scores by comparing the reconstructed and predicted data with the preprocessed training sample data, based on a reconstruction plus prediction approach.

[0091] Dynamic threshold calculation module: used to construct an error sequence based on outlier scores, smooth the error sequence using an exponentially weighted moving average, and then calculate the dynamic threshold using the mean and standard deviation;

[0092] Anomaly detection module: Used to perform anomaly detection. First, the test data is divided into windows, then input into the trained model, calculate the anomaly score, and determine whether the test data is abnormal based on the dynamic threshold.

[0093] The above-mentioned device implements the steps of the unstable time series anomaly detection method that integrates time-frequency-space features disclosed in this application when it is in operation.

[0094] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0095] As shown in Figure 4, an embodiment of this application also discloses an electronic device, including: a processor 310, a communication interface 320, a memory 330 for storing a processor-executable computer program, and a communication bus 340. The processor 310, communication interface 320, and memory 330 communicate with each other via the communication bus 340. The processor 310 executes the executable computer program to implement the steps of the aforementioned method for detecting unstable time series anomalies by fusing time-frequency-space features.

[0096] It is understandable that, in addition to memory and a processor, this electronic device may also include input devices such as a keyboard, output devices such as a display, and other communication modules. The input devices, output devices, and other communication modules communicate with the processor through I / O interfaces (i.e., input / output interfaces).

[0097] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof. These programming languages ​​include, but are not limited to, object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0098] Furthermore, this application also discloses a computer-readable storage medium, wherein when the instructions in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device is able to perform the various steps of the unstable time series anomaly detection method fused with time-frequency-space features disclosed in this application.

[0099] In the context of this application, a computer-readable storage medium can be a tangible medium, and more specific examples include portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0100] Specifically, according to embodiments of this application, the processes described in the flowcharts can be implemented as computer software programs. For example, embodiments of this application include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the unstable time series anomaly detection method disclosing this application that fuses time-frequency-spatial features. When the computer program is executed by a processing device, it performs the functions defined in the methods of the embodiments of this application.

[0101] While the foregoing discussion includes several specific implementation details, these should not be construed as limiting the scope of this application. The above description is merely a preferred embodiment of this application and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of disclosure in this application is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-described concept.

[0102] Those skilled in the art should also understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A method for detecting anomalies in unstable time series by fusing time-frequency-space features, characterized in that, The method includes: Data preprocessing is performed on the time series samples in the training set; Time-domain, frequency-domain, and spatial-domain features are extracted from the preprocessed training sample data, and time-frequency-spatial feature modeling is performed based on the extracted features. The time-domain features, frequency-domain features, and spatial-domain features extracted in the previous step are transformed to the same dimension, and then spliced ​​together to obtain fused features. Based on the reconstruction plus prediction approach, anomaly scores are calculated by comparing the differences between the reconstructed data and the predicted data with the preprocessed training sample data. An error sequence is constructed based on outlier scores, and the error sequence is smoothed using an exponentially weighted moving average. Then, a dynamic threshold is calculated using the mean and standard deviation. When performing anomaly detection, the test data is first divided into windows, then input into the trained model, anomaly score is calculated, and the presence of anomalies in the test data is determined based on the dynamic threshold determined in the previous step.

2. The method of claim 1, wherein, The data preprocessing includes: Step 11: Fill in missing data values: Fill in missing data values ​​for the time series samples in the training set using linear interpolation. Step 12: Remove outliers: Use the SR algorithm to transform the time series samples to obtain a saliency map. Detect outliers in the samples using the saliency map and replace them with normal values. Step 13, Drift Adaptive Window Processing: Divide the time series samples into local windows with a step size equal to the window length. Perform Min-Max normalization within each window to obtain the normalized window.

3. The method of claim 2, wherein, The extraction of time-domain, frequency-domain, and spatial-domain features from the preprocessed training sample data includes: Step 21, Temporal Feature Extraction: Use the Long Short-Term Memory (LSTM) network model to extract temporal features from the preprocessed training sample data; Step 22, Frequency Domain Feature Extraction: Use discrete wavelet transform to extract frequency domain features from the preprocessed training sample data; Step 23, Spatial feature extraction: Use the GATv2 model to extract spatial features from the preprocessed training sample data.

4. The method of claim 3, wherein, Step 21 also includes: re-dividing the partitioned window obtained in step 13 with a step size of 1, while keeping the window length unchanged, and using it as the input to the LSTM model; By utilizing the memory units and gating mechanisms within the LSTM model, temporal information can be selectively retained to obtain temporal features.

5. The method of claim 3, wherein, Step 22 also includes: using discrete wavelet transform to extract frequency domain features from the preprocessed training sample data, and mapping the frequency components to specific time positions according to the characteristics of discrete wavelet transform, wherein the low-frequency part contains the basic features of the sample, and the high-frequency part contains the details of the sample.

6. The method of claim 3, wherein, Step 23 also includes: using the GATv2 model, treating each variable in the training samples as a node and the relationship between the variables as an edge to establish a graph structure; at the same time, considering the possible changing relationships between the nodes, GATv2 calculates the attention score of each node through dynamic attention, first connecting adjacent query nodes, and then using linear transformation to calculate the relationship between the nodes to ensure a better fit to the training samples.

7. The method of claim 1, wherein, The reconstruction-plus-prediction approach calculates anomaly scores by comparing the differences between the reconstructed and predicted data and the preprocessed training sample data, including: The fusion features are used to reconstruct reconstructed data with spatiotemporal information. The reconstructed data is then compared with the preprocessed training sample data to obtain a reconstruction anomaly score. The fusion features are used to make predictions at a specific time step. The predicted data is then compared with the preprocessed training sample data to obtain the predicted anomaly score. The reconstructed outlier score and the predicted outlier score are added together in a specific ratio to obtain the outlier score of the overall data.

8. A device for detecting anomalies in unstable time series by fusing time-frequency-space features, characterized by, The device includes: Data preprocessing module: used to preprocess time series samples in the training set; Feature extraction module: used to extract time-domain features, frequency-domain features and spatial features from preprocessed training sample data, and to perform time-frequency-spatial feature modeling based on the extracted features; Feature fusion module: This module transforms time-domain features, frequency-domain features, and spatial-domain features to the same dimension, performs a splicing operation, and obtains fused features. Anomaly score calculation module: This module calculates anomaly scores by comparing the reconstructed and predicted data with the preprocessed training sample data, based on a reconstruction plus prediction approach. Dynamic threshold calculation module: used to construct an error sequence based on outlier scores, smooth the error sequence using an exponentially weighted moving average, and then calculate the dynamic threshold using the mean and standard deviation; Anomaly detection module: Used to perform anomaly detection. First, the test data is divided into windows, then input into the trained model, calculate the anomaly score, and determine whether the test data is abnormal based on the dynamic threshold.

9. A computer-readable storage medium having stored thereon a computer program, characterized in that, When the computer program is executed by the processor, it implements the steps of the unstable time series anomaly detection method that integrates time-frequency-space features as described in any one of claims 1-7.

10. An electronic device, comprising: include: Memory and processor; Memory: Used to store computer programs; Processor: for executing the computer program to implement the steps of the unstable time series anomaly detection method that integrates time-frequency-space features as described in any one of claims 1-7.

Images