CN102945320A - Time series data abnormity detection method and device - Google Patents

Abstract

The invention discloses a time series data abnormity detection method which comprises the following steps: defining neighbor nodes of a data point di in a time series, calculating the mean value of the neighbor nodes of the data point di, calculating an absolute error value ei<k> and an accumulation variable quantity ACi, setting a threshold tau, respectively comparing the absolute error value ei<k>, the accumulation variable quantity ACi and the threshold tau, marking an abnormity point if ei<k> is greater than tau or ACi is greater than tau, and otherwise, keeping the data point di. The invention further discloses a time series data abnormity detection device. The judgment of the abnormality of the data point is related to the neighbor nodes of the data point, thereby reflecting the local concept. The width of the neighbor node can be dynamically regulated according to specific requirements in different time intervals, the parameter local optimum is guaranteed under the conditions of different time intervals, the abnormal data in the time series can be effectively detected, and the method and the device have an extensive application prospect.

Description

A kind of time series data method for detecting abnormality and device

Technical field

The invention belongs to data management and business support field, relate to the data quality control in information acquisition and the information process, be specifically related to a kind of detection method and device of real-time time sequence variation data.

Background technology

Be the high speed development of computer information technology of representative and the widespread use of sensor technology along with the internet, people produce and life in accumulated the data of magnanimity.These data that just presenting explosive growth are processed oneself through having exceeded people's limit of power.Data mining is as an emerging technology that has merged the subject such as statistical method, database technology, artificial intelligence network, method for visualizing, high-performance calculation and field, can help people in time to excavate out Useful Information and abundant knowledge, forecast analysis ability and the decision supporting capability of raising system, thereby be widely used and promote.

Abnormality detection is one of four class Knowledge Discovery tasks in the data mining, and its purpose is to find small probability event or the pattern of data centralization, namely with other data behavior or the obvious inconsistent data object of model (abnormity point).

So-called unusual (or claim isolated point, abnormity point, lower with) refer to database (collection) to such an extent as in inconsistent from other Data Representations or depart from widely other data points and suspect that it is fraction object by different mechanism generations.When the data that gather when infosystem were used for modeling, the abnormity point that exists in the system is effectively modeling and descriptive system not only, and can reduce the quality of data, and data analysis, management and decision level are produced harmful effect.Accuracy and the reliability expressed in order to improve infosystem, the result of use of assurance system model must be identified and be processed accordingly abnormal data before system modelling.

At present, method for detecting abnormality is based upon on the statistical basis mostly, mainly comprise based on the method that departs from, based on the method for the method that distributes, distance-based and density-based method etc., but the method for the type need to be known the distribution of data in advance, in addition, Outlier Detection Algorithm based on statistics is only suitable for mostly in excavating univariate numeric type data, to higher-dimension, time series data and inapplicable.And the method for biological method, machine learning and be applied to the seasonal effect in time series method for detecting abnormality based on the method for feature space etc. and still be in the exploratory stage also has a lot of jejune places, and a lot of method applicabilities are not strong, and the obvious defective of ubiquity.

Therefore, need a kind of new time series data method for detecting abnormality to address the above problem.

Summary of the invention

Goal of the invention: the present invention is directed to the analysis precision that the abnormal data that exists in the infosystem of prior art can reduce system model, the defective of the essence of reflection system that can not objective provides a kind of time series data method for detecting abnormality that improves abnormality detection efficient in the available data analytic process.

Technical scheme: for solving the problems of the technologies described above, time series data method for detecting abnormality of the present invention adopts following technical scheme:

A kind of time series data method for detecting abnormality, setting-up time sequence D={ d ₁=(v ₁, t ₁), d ₂=(v ₂, t ₂) ... d _n=(v _n, t _n), time series data d _i=(v _i, t _i) expression t _iObserved reading v constantly _i, its feature may further comprise the steps:

(1), data point d in the definition time sequence _iNeighbor node Wherein, k is data point d _iThe neighbor node window width;

(2), the neighbor node of computational data point di

Average

(3), difference computational data point d _iWith the abutment points average

Between absolute error value

Data point d _iBe adjacent a little

Between accumulated change amount AC _i

(4), setting-up time sequence data abnormality detection threshold tau, the respectively more above-mentioned absolute error value that calculates Accumulated change amount AC _iAnd the magnitude relationship between the threshold tau: if

Or AC _iτ, then mark d _iBe abnormity point, otherwise, d kept _i

Beneficial effect: in the time series method for detecting abnormality that proposes among the present invention, the judgement that data point is unusual is relevant with the neighbor node of this data point, and this has embodied the concept of " part ", and this is it and abnormality detection difference in the past, also is the advantage place.Simultaneously, the neighbor node window width can dynamically be adjusted according to the real needs of different periods, has guaranteed the parameter local optimum in the different period situations.The time series Outlier Detection Algorithm that the present invention proposes can effectively detect the abnormal data in the time series, is with a wide range of applications.

Further, described k value represents the neighbor node window width, and it has determined the neighbor node number that participation computation of mean values (or accumulated change) relates to.The k value is larger, and the neighbor node that participates in calculating is more.For obtaining the best value of variable k, make that k value scope is 3-31, increment is 2, i.e. k={3,5 ..., 31}.

Further, the value of described threshold tau is comprised of two parts: the mean change amount on the period sequence and neighbor node variance.The former illustrated on the whole should period time series variation amount average level; The latter has illustrated the fluctuation situation of present node di ambient data from the part.Therefore, the size of threshold tau is that dynamic change calculates, and in the larger situation of observed reading fluctuation, threshold tau is also higher; In the less situation of observed reading fluctuation, threshold tau is lower.Seasonal effect in time series overall condition and local feature have been considered in the setting of threshold value, can dynamically update according to the fluctuation situation of neighbor node, have eliminated the harmful effect that predetermined threshold value is brought detection efficiency, thereby have improved the abnormality detection efficient of algorithm.

Further, described neighbor node

Can be defined as bilateral neighbor node,

Wherein 2k is data d _iThe neighbor node window width (from i-k to i+k, do not contain d _iItself).

Further, when described neighbor node

During for bilateral neighbor node, its average Absolute error value

And accumulated change amount AC _iCan calculate respectively by following formula:

$m_i^{\left(k\right)}=(\underset{j=1}{\overset{2k}{\mathrm{\&Sigma;}}}{v}_i-j)/\left(2k\right)$

${e_i}^{\left(k\right)}=|m_i^{\left(k\right)}-v_i|$

$A{C}_i=\left(\underset{j=1}{\overset{2k}{\mathrm{\&Sigma;}}}{w_j}^{*}\right|v_i-v_i-j\left|\right)/\left(\underset{j=1}{\overset{2k}{\mathrm{\&Sigma;}}}{w}_j\right),$ W in the formula _k, w _K-1... w ₁, w ' ₁, w ' ₂... w ' _kThe weight vectors of expression neighbor node.

In the bilateral neighbor node method for detecting abnormality of abnormal data, because right abutment points is the data that not yet detect, wherein may contain abnormity point; And only select left neighbor node can eliminate detected abnormity point, the testing result that will make abnormity point more accurately, more meaningful.Therefore, can use monolateral neighbor node method for detecting abnormality to improve bilateral neighbor node method for detecting abnormality.Monolateral neighbor node Outlier Detection Algorithm step is identical with bilateral neighbor node Outlier Detection Algorithm with judgment basis, but only defines data point d in the monolateral Outlier Detection Algorithm _iLeft neighbor node.

Further, described neighbor node

Can be defined as monolateral neighbor node,

Wherein, 2k is data d _iNeighbor node window width (from i-2k to i-1).

Further, when described neighbor node

During for monolateral neighbor node, its average

Absolute error value

And accumulated change amount AC _iCan calculate respectively by following formula:

$m_i^{\left(k\right)}=(\underset{s=1}{\overset{k}{\mathrm{\&Sigma;}}}{v}_i-s+\underset{t=1}{\overset{k}{\mathrm{\&Sigma;}}}{v}_i+t)/\left(2k\right);$

$e_i^{\left(k\right)}=|m_i^{\left(k\right)}-v_i|$

$A{C}_i=(\underset{s=1}{\overset{k}{\mathrm{\&Sigma;}}}{w}_s*|v_i-v_i-s|+\underset{t=1}{\overset{k}{\mathrm{\&Sigma;}}}{w_t}^{\&prime;*}|v_i-v_i+t\left|\right)/(\underset{s=1}{\overset{k}{\mathrm{\&Sigma;}}}{w}_s+\underset{t=1}{\overset{k}{\mathrm{\&Sigma;}}}{w_t}^{\&prime;}),$ W in the formula _k, w _K-1... w ₁, w ' ₁, w ' ₂... w ' _kThe weight vectors of expression neighbor node.

The invention also discloses a kind of time series data abnormal detector.

Time series data abnormal detector of the present invention adopts following technical scheme:

A kind of time series data abnormal detector, comprise load module, abnormality detection module, output module, described load module is used for providing abnormality detection required time series data collection, described abnormality detection module adopts aforesaid time series data method for detecting abnormality to carry out abnormality detection, and described output module is according to the testing result output abnormality data set of described abnormality detection module.

Further, described abnormality detection module comprises data pre-processing assembly, computation module and analytic unit, described data pre-processing assembly reception is carried out pre-service from data and process that the time series data load module collects, and described pre-service is to select data point to be assessed and define its neighbor node collection

Described computation module is used for calculating through pretreated data

And AC _i, described analytic unit is to result of calculation

AC _iCompare with given threshold tau, and whether belong to definite unusual according to comparative result discriminatory analysis data to be tested.

Time series data abnormal detector of the present invention is simple in structure, and the judgement that data point is unusual is relevant with the neighbor node of this data point, and this has embodied the concept of " part ", and this is it and abnormality detection difference in the past, also is the advantage place.Simultaneously, the neighbor node window width can dynamically be adjusted according to the real needs of different periods, has guaranteed the parameter local optimum in the different period situations.Time series abnormal detector of the present invention can effectively detect the abnormal data in the time series, is with a wide range of applications.

Description of drawings

Fig. 1 is the process flow diagram according to the specific embodiment of bilateral time series data method for detecting abnormality among the present invention;

Fig. 2 is the process flow diagram according to the specific embodiment of monolateral time series data method for detecting abnormality among the present invention;

Fig. 3 is the structural representation of time series data abnormal detector;

Fig. 4 comprises unusual data distribution situation synoptic diagram in the time series data.

Embodiment

Below in conjunction with the drawings and specific embodiments, further illustrate the present invention, should understand these embodiment only is used for explanation the present invention and is not used in and limits the scope of the invention, after having read the present invention, those skilled in the art all fall within the application's claims limited range to the modification of the various equivalent form of values of the present invention.

A kind of time series data method for detecting abnormality of the present invention, setting-up time sequence D={ d ₁=(v ₁, t ₁), d ₂=(v ₂, t ₂) ... d _n=(v _n, t _n), time series data d _i=(v _i, t _i) expression t _iObserved reading v constantly _i, may further comprise the steps:

(1), data point d in the definition time sequence _iNeighbor node

Wherein, k is data point d _iThe neighbor node window width; It has determined the neighbor node number that participation computation of mean values (or accumulated change) relates to.The k value is larger, and the neighbor node that participates in calculating is more.For obtaining the best value of variable k, make that k value scope is 3-31, increment is 2, i.e. k={3,5 ..., 31}.

(2), the neighbor node of computational data point di Average

(3), difference computational data point d _iWith the abutment points average

Between absolute error value

Data point d _iBe adjacent a little

Between accumulated change amount AC _i

(4), setting-up time sequence data abnormality detection threshold tau, the respectively more above-mentioned absolute error value that calculates

Accumulated change amount AC _iAnd the magnitude relationship between the threshold tau: if e _i ^(k)τ or AC _iτ, then mark d _iBe abnormity point, otherwise, d kept _iWherein, the value of threshold tau is comprised of two parts: the mean change amount on the period sequence and neighbor node variance.The former illustrated on the whole should period time series variation amount average level; The latter has illustrated present node d from the part _iThe fluctuation situation of ambient data.Therefore, the size of threshold tau is that dynamic change calculates, and in the larger situation of observed reading fluctuation, threshold tau is also higher; In the less situation of observed reading fluctuation, threshold tau is lower.Seasonal effect in time series overall condition and local feature have been considered in the setting of threshold value, can dynamically update according to the fluctuation situation of neighbor node, have eliminated the harmful effect that predetermined threshold value is brought detection efficiency, thereby have improved the abnormality detection efficient of algorithm.

Described neighbor node

Can be defined as monolateral neighbor node,

Wherein 2k is data d _iNeighbor node window width (from i-2k to i-1).When

During for monolateral neighbor node, average

Absolute error value

And accumulated change amount AC _iCan calculate respectively by following formula:

$m_i^{\left(k\right)}=(\underset{s=1}{\overset{k}{\mathrm{\&Sigma;}}}{v}_i-s+\underset{t=1}{\overset{k}{\mathrm{\&Sigma;}}}{v}_i+t)/\left(2k\right);$

$e_i^{\left(k\right)}=|m_i^{\left(k\right)}-v_i|$

$A{C}_i=\left(\underset{s=1}{\overset{k}{\mathrm{\&Sigma;}}}{w_s}^{*}\right|v_i-v_i-s|+\underset{t=1}{\overset{k}{\mathrm{\&Sigma;}}}{w_t}^{\&prime;*}|v_i-v_i+t\left|\right)/(\underset{s=1}{\overset{k}{\mathrm{\&Sigma;}}}{w}_s+\underset{t=1}{\overset{k}{\mathrm{\&Sigma;}}}{w_t}^{\&prime;}),$ W in the formula _k, w _K-1... w ₁, w ' ₁, w ' ₂... w ' _kThe weight vectors of expression neighbor node.

Neighbor node

Also can be defined as bilateral neighbor node,

Wherein 2k is data d _iThe neighbor node window width (from i-k to i+k, do not contain d _iItself).Wherein, when

During for bilateral neighbor node, average

Absolute error value

And accumulated change amount AC _iCan calculate respectively by following formula:

$m_i^{\left(k\right)}=(\underset{j=1}{\overset{2k}{\mathrm{\&Sigma;}}}{v}_i-j)/\left(2k\right)$

e _i ^(k)=|m _i ^(k)-v _i|

W in the formula _k, w _K-1... w ₁, w ' ₁, w ' ₂... w ' _kThe weight vectors of expression neighbor node.

The invention also discloses a kind of time series data abnormal detector, comprise load module, abnormality detection module, output module, load module is used for providing abnormality detection required time series data collection, the abnormality detection module adopts aforesaid time series data method for detecting abnormality to carry out abnormality detection, and output module is according to the testing result output abnormality data set of abnormality detection module.Wherein, the abnormality detection module comprises data pre-processing assembly, computation module and analytic unit, the reception of data pre-processing assembly is carried out pre-service from data and process that the time series data load module collects, and pre-service is to select data point to be assessed and define its neighbor node collection

Computation module is used for calculating through pretreated data

And AC _i, analytic unit is to result of calculation

AC _iCompare with given threshold tau, and whether belong to definite unusual according to comparative result discriminatory analysis data to be tested.

Embodiment 1

Seeing also shown in Figure 1ly, is a preferred embodiment of bilateral neighbor node time series data method for detecting abnormality.Its step is as follows:

Step S101: receive the time series data that gathers from data input module, such as average daily water level, the every daily fluctuation of stock price, resident's daily power consumption etc.If the data set that gathers is D=＜d ₁=(v ₁, t ₁), d ₂=(v ₂, t ₂) ... d _n=(v _n, t _n), d wherein _i=(v _i, t _i) expression t _iObserved reading v constantly _i

Step S102: select data point d to be detected _iAnd define its neighbor node η _i ^(k), wherein, neighbor node η _i ^(k)Be bilateral neighbor node.

${\mathrm{\&eta;}}_i^{\left(k\right)}=\{d_{i-k},...d_{i-1},d_{i+1},...d_{i+k}\}---\left(1\right)$

Wherein 2k is data d _iThe neighbor node window width (from i-k to i+k, do not contain d _iItself).

Step S103: calculate data to be tested point d _iNeighbor node bilateral with it

Average

Between absolute error value

d _iWith abutment points

Accumulated change amount AC _i, wherein And AC _iCan pass through following formula (2), (3),

(4) calculate respectively.

$m_i^{\left(k\right)}=(\underset{s=1}{\overset{k}{\mathrm{\&Sigma;}}}{v}_i-s+\underset{t=1}{\overset{k}{\mathrm{\&Sigma;}}}{v}_i+t)/\left(2k\right);---\left(2\right)$

$e_i^{\left(k\right)}=|m_i^{\left(k\right)}-v_i|---\left(3\right)$

$A{C}_i=(\underset{s=1}{\overset{k}{\mathrm{\&Sigma;}}}{w}_s*|v_i-v_i-s|+\underset{t=1}{\overset{k}{\mathrm{\&Sigma;}}}{w_t}^{\&prime;*}|v_i-v_i+t\left|\right)/(\underset{s=1}{\overset{k}{\mathrm{\&Sigma;}}}{w}_s+\underset{t=1}{\overset{k}{\mathrm{\&Sigma;}}}{w_t}^{\&prime;})---\left(4\right)$

(4) w in the formula _k, w _K-1... w ₁, w ' ₁, w ' ₂... w ' _kThe weight vectors of expression abutment points, euclidean distance between node pair is nearer, and weight is larger.Because data point d in the bilateral equal value detection method _iHave symmetry in abutting connection with window, be easy calculating, generally with weight vectors＜w _k, w _K-1... w ₁, w ' ₁... w ' _kAssignment is＜1,2 ... k, k ... 2,1 〉.

Step S104: calculate according to step S103

And AC _i, and given threshold tau compares, and according to comparative result data point to be detected is carried out anomalous discrimination.If

Or AC _iτ, then carry out step S105, with data point d _iBe labeled as abnormity point, and adopt suitable method that this abnormity point is processed; Otherwise, carry out step S106, with encumbrance strong point d _iParticipating in subsequent analysis for normal data processes.

Step S107: whether abnormality detection is complete to judge all data on the data-oriented collection, if abnormality detection is not finished, step S109 will produce next data point d _I+1And adopt method described in this implementation step to d _I+1Carry out abnormality detection; Otherwise step S108 generates abnormal data set O and " totally " the data set D ' after abnormality detection is processed according to abnormality detection result.

In the bilateral equal value detection method of abnormal data, because right abutment points is the data that not yet detect, wherein may contain abnormity point; And only select left neighbours point can eliminate detected abnormity point, the testing result that will make abnormity point more accurately, more meaningful.Therefore, can use monolateral method for detecting abnormality to improve bilateral method for detecting abnormality.

Embodiment 2

Seeing also shown in Figure 2ly, is a preferred embodiment of monolateral neighbor node time series data method for detecting abnormality.Its step is as follows:

Step S201: receive the time series data that gathers from data input module, such as average daily water level, the every daily fluctuation of stock price, resident's daily power consumption etc.If institute's image data integrates as D=＜d ₁=(v ₁, t ₁), d ₂=(v ₂, t ₂) ... d _n=(v _n, t _n), d wherein _i=(v _i, t _i) expression t _iObserved reading v constantly _i

Step S202: select data point d to be detected _iAnd define its neighbor node

Wherein, neighbor node

Be monolateral neighbor node.

${\mathrm{\&eta;}}_i^{\left(k\right)}=\{d_{i-2k},d_{i-2k+1},...d_{i-1}\}---\left(5\right)$

Wherein 2k is data d _iNeighbor node window width (from i-2k to i-1).

Step S203: calculate data to be tested point d _iNeighbor node monolateral with it

Average

Between absolute error value

d _iWith abutment points

Accumulated change amount AC _i, wherein

And AC _iCan calculate respectively by following formula (6), (7), (8).

$m_i^{\left(k\right)}=(\underset{j=1}{\overset{2k}{\mathrm{\&Sigma;}}}{v}_i-j)/\left(2k\right)---\left(6\right)$

$e_i^{\left(k\right)}=|m_i^{\left(k\right)}-v_i|---\left(7\right)$

$A{C}_i=\left(\underset{j=1}{\overset{2k}{\mathrm{\&Sigma;}}}{w_j}^{*}\right|v_i-v_i-j\left|\right)/\left(\underset{j=1}{\overset{2k}{\mathrm{\&Sigma;}}}{w}_j\right)---\left(8\right)$

Abutment points is without symmetry, generally with weight vectors＜w in the described monolateral detection algorithm ₁, w ₂... w _2kAssignment is＜2k, and 2k-1 ... 1 〉.

Step S204: calculate according to step S203

And AC _i, and given threshold tau compares, and according to comparative result data point to be detected is carried out anomalous discrimination.If

Or AC _iτ, then carry out step S205, with data point d _iBe labeled as abnormity point, and adopt suitable method that this abnormity point is processed; Otherwise, carry out step S206, with encumbrance strong point d _iParticipating in subsequent analysis for normal data processes.

Step S207: whether abnormality detection is complete to judge all data on the data-oriented collection, if abnormality detection is not finished, carries out step S209, will produce next data point d _I+1And adopt method described in this implementation step to d _I+1Carry out abnormality detection; Otherwise, carry out step S208, generate abnormal data set O and " totally " the data set D ' after abnormality detection is processed according to abnormality detection result.

See also shown in Figure 3ly, corresponding to above-mentioned Outlier Detection Algorithm, Fig. 3 provides a kind of time series abnormal detector 300 that designs among the present invention, and this device comprises load module 301, abnormality detection module 302 and the unusual output module 303 of time series data.Load module 301 is time series data collection of a typical pending abnormality detection, such as every daily fluctuation of stock market, power consumption situation, hydrometric station water level etc. day by day in the unit interval.Load module 301 is prepared the time series data collection of pending abnormality detection and is passed to abnormality detection module 302.The core of abnormal detector embodiment is abnormality detection module 302, abnormality detection module 302 is utilized the time series data that collects from load module 301, adopt the time series data method for detecting abnormality among the present invention to carry out abnormality detection, and testing result is exported displaying by output module 506.The data set that this module time of reception sequence data load module 301 gathers also carries out pre-service, calculating and discriminatory analysis, to determine whether data to be tested belong to unusual.The unusual output module 303 of time series is used for the abnormal data that output abnormality detection module 302 detects.Abnormality detection module 302 comprises data pre-processing assembly 304, computation module 305 and analytic unit 306.304 receptions of data pre-processing assembly are carried out pre-service from data and process that load module 301 collects, and pre-service mainly is to select data point to be assessed and define its neighbours' contact Ji Linjujiedianji

Bilateral Outlier Detection Algorithm and monolateral Outlier Detection Algorithm

Can obtain according to formula (1), (5) respectively.The 305 pairs of pretreated the data of process algorithms of the present invention of computation module calculate

And AC _i, computing method are referring to formula (2)-(4), (6)-(8).306 pairs of result of calculations of analytic unit

AC _iCompare with given threshold tau, and whether belong to definite unusual according to comparative result discriminatory analysis data to be tested.

Result verification

Realization resembled when hydrology phenomenon was, this change procedure is called hydrologic process.Hydrographic data is the discrete record to hydrologic process, hydrographic data is divided into various types of Hydrological Time Series by the physical quantity of its description, wherein comparatively common physical quantity has: flow, water level, rainfall amount, the validity of time series outlier detection method among the average daily ordinary water level data test the present invention in 1993 of Taihu Lake discharge site is selected in this test such as evaporation capacity.Algorithm makes k since 3 for initial value, take 2 for step-length begins to increase, and calculating have a few and its neighbor node

Average

Between absolute error value

d _iWith abutment points

Accumulated change amount AC _iFig. 4 is the data distribution situation synoptic diagram of abnormality detection in the time series data.Wherein circle mark is abnormal data.Can clearly be seen that, utilize time series data method for detecting abnormality of the present invention can effectively detect unusual data point.

Claims (9)

1. time series data method for detecting abnormality, setting-up time sequence D={ d ₁=(v ₁, t ₁), d ₂=(v ₂, t ₂) ... d _n=(v _n, t _n), time series data d _i=(v _i, t _i) expression t _iObserved reading v constantly _i, it is characterized in that, may further comprise the steps:

(1), data point d in the definition time sequence _iNeighbor node Wherein, k is data point d _iThe neighbor node window width;

(2), computational data point d _iNeighbor node Average

(3), difference computational data point d _iWith the abutment points average

Between absolute error value

Data point d _iBe adjacent a little

Between accumulated change amount AC _i

(4), setting-up time sequence data abnormality detection threshold tau, the respectively more above-mentioned absolute error value that calculates

Accumulated change amount AC _iAnd the magnitude relationship between the threshold tau: if e _i ^(k)τ or AC _iτ, then mark d _iBe abnormity point, otherwise, d kept _i

2. time series data method for detecting abnormality as claimed in claim 1 is characterized in that, described k value is k={3,5 ..., 31}.

3. time series data method for detecting abnormality as claimed in claim 1 is characterized in that, the value of described threshold tau is comprised of two parts: the mean change amount on the period sequence and neighbor node variance.

4. time series data method for detecting abnormality as claimed in claim 1 is characterized in that, described neighbor node Be monolateral neighbor node,

Wherein, 2k is data d _iNeighbor node window width (from i-2k to i-1).

5. time series data method for detecting abnormality as claimed in claim 4 is characterized in that, described average Absolute error value And accumulated change amount AC _iCan calculate respectively by following formula:

$m_i^{\left(k\right)}=(\underset{s=1}{\overset{k}{\mathrm{\&Sigma;}}}{v}_i-s+\underset{t=1}{\overset{k}{\mathrm{\&Sigma;}}}{v}_i+t)/\left(2k\right);$

${e_i}^{\left(k\right)}=|m_i^{\left(k\right)}-v_i|$

$A{C}_i=\left(\underset{s=1}{\overset{k}{\mathrm{\&Sigma;}}}{w_s}^{*}\right|v_i-v_i-s|+\underset{t=1}{\overset{k}{\mathrm{\&Sigma;}}}{w_t}^{\&prime;*}|v_i-v_i+t\left|\right)/(\underset{s=1}{\overset{k}{\mathrm{\&Sigma;}}}{w}_s+\underset{t=1}{\overset{k}{\mathrm{\&Sigma;}}}{w_t}^{\&prime;}),$ W in the formula _k, w _K-1... w ₁, w ' ₁, w ' ₂... w ' _kThe weight vectors of expression neighbor node.

6. time series data method for detecting abnormality as claimed in claim 1 is characterized in that, described neighbor node

Be bilateral neighbor node,

Wherein 2k is data d _iThe neighbor node window width (from i-k to i+k, do not contain d _iItself).

7. time series data method for detecting abnormality as claimed in claim 6 is characterized in that data point d _iBilateral neighbor node

Average

Absolute error value

And accumulated change amount AC _iCan calculate respectively by following formula:

$m_i^{\left(k\right)}=(\underset{j=1}{\overset{2k}{\mathrm{\&Sigma;}}}{v}_i-j)/\left(2k\right)$

${e_i}^{\left(k\right)}=|m_i^{\left(k\right)}-v_i|$

$A{C}_i=\left(\underset{j=1}{\overset{2k}{\mathrm{\&Sigma;}}}{w_j}^{*}\right|v_i-v_i-j\left|\right)/\left(\underset{j=1}{\overset{2k}{\mathrm{\&Sigma;}}}{w}_j\right),$ W in the formula _k, w _K-1... w ₁, w ' ₁, w ' ₂... w ' _kThe weight vectors of expression neighbor node.

8. time series data abnormal detector, it is characterized in that, comprise load module, abnormality detection module, output module, described load module is used for providing abnormality detection required time series data collection, described abnormality detection module adopts carries out abnormality detection such as each described time series data method for detecting abnormality of claim 1-7, and described output module is according to the testing result output abnormality data set of described abnormality detection module.

9. time series data abnormal detector as claimed in claim 8, it is characterized in that, described abnormality detection module comprises data pre-processing assembly, computation module and analytic unit, described data pre-processing assembly reception is carried out pre-service from data and process that the time series data load module collects, and described pre-service is to select data point to be assessed and define its neighbor node collection

Described computation module is used for calculating through pretreated data

And AC _i, described analytic unit is to result of calculation

AC _iCompare with given threshold tau, and whether belong to definite unusual according to comparative result discriminatory analysis data to be tested.

Images