CN110071913B - Unsupervised learning-based time series anomaly detection method - Google Patents

Unsupervised learning-based time series anomaly detection method Download PDF

Info

Publication number
CN110071913B
CN110071913B CN201910234623.8A CN201910234623A CN110071913B CN 110071913 B CN110071913 B CN 110071913B CN 201910234623 A CN201910234623 A CN 201910234623A CN 110071913 B CN110071913 B CN 110071913B
Authority
CN
China
Prior art keywords
data
time series
time sequence
abnormality
unsupervised learning
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CN201910234623.8A
Other languages
Chinese (zh)
Other versions
CN110071913A (en
Inventor
杨恺
刘音希
窦绍瑜
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Tongji University
Original Assignee
Tongji University
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Tongji University filed Critical Tongji University
Priority to CN201910234623.8A priority Critical patent/CN110071913B/en
Publication of CN110071913A publication Critical patent/CN110071913A/en
Application granted granted Critical
Publication of CN110071913B publication Critical patent/CN110071913B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F18/00—Pattern recognition
    • G06F18/20—Analysing
    • G06F18/21—Design or setup of recognition systems or techniques; Extraction of features in feature space; Blind source separation
    • G06F18/214—Generating training patterns; Bootstrap methods, e.g. bagging or boosting
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/552—Detecting local intrusion or implementing counter-measures involving long-term monitoring or reporting
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/04—Architecture, e.g. interconnection topology
    • G06N3/044—Recurrent networks, e.g. Hopfield networks
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/04—Architecture, e.g. interconnection topology
    • G06N3/045—Combinations of networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1425—Traffic logging, e.g. anomaly detection

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • Data Mining & Analysis (AREA)
  • General Physics & Mathematics (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Computing Systems (AREA)
  • Evolutionary Computation (AREA)
  • Artificial Intelligence (AREA)
  • Computer Hardware Design (AREA)
  • General Health & Medical Sciences (AREA)
  • Biomedical Technology (AREA)
  • Biophysics (AREA)
  • Computational Linguistics (AREA)
  • Mathematical Physics (AREA)
  • Molecular Biology (AREA)
  • Health & Medical Sciences (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Bioinformatics & Cheminformatics (AREA)
  • Bioinformatics & Computational Biology (AREA)
  • Computer Vision & Pattern Recognition (AREA)
  • Evolutionary Biology (AREA)
  • Testing And Monitoring For Control Systems (AREA)

Abstract

The invention relates to a time series abnormity detection method based on unsupervised learning, which comprises the following steps: segmenting the time sequence data at the position where the time sequence data are obviously changed, and filling each segmented data segment to a set length; training a neural network for anomaly detection by using a plurality of data segments which are segmented and filled by using the time sequence in the normal state; taking a plurality of data segments segmented and filled by the time sequence to be detected as the input of an anomaly detection model for detection, and outputting an anomaly score; and judging whether the abnormal score exceeds a threshold value, if so, judging that the abnormality occurs, otherwise, judging that the abnormality does not occur. Compared with the prior art, the method has the advantages of independence on marked abnormal data, no loss of data information, high performance and the like.

Description

Unsupervised learning-based time series anomaly detection method
Technical Field
The invention relates to an anomaly detection method, in particular to a time series anomaly detection method based on unsupervised learning.
Background
Anomaly Detection (Anomaly Detection) is a means of detecting anomalies in data, where "anomalies" refer to patterns that do not conform to normal behavior, such as in the field of network traffic analysis, normal patterns refer to normal network access behavior, and Anomaly patterns refer to behavior of network intruders. Abnormality detection is applied to many fields such as the medical health field, the network security field, the financial security field, the system maintenance field, and the like.
Time Series (Time Series) refers to a Series of data in the form of Time stamp and data, and the Time Series is often used for recording data such as system operation state and human health data in real Time, and by analyzing the Time Series data, the state of the system can be judged, system behaviors can be analyzed, and human decision making can be assisted. In real life, many systems record system operation states, such as website system access amount and server CPU operation state, by using time series data. In the medical and health fields, electrocardiogram data, disease progression data, and the like are also expressed in time series.
The abnormality in the time series may often reflect the abnormality of the system, for example, in the website system, the database blockage or deadlock is reflected on the monitoring data of the database, and in the electrocardiogram data, the abnormality caused by the heart disease is also reflected on the electrocardiogram data. Therefore, abnormality detection for time-series data helps people to find an abnormality as early as possible and take appropriate measures to avoid the abnormality.
At present, anomaly detection is mainly divided into a supervised method and an unsupervised method, wherein the supervised method needs a large amount of data with anomaly markers for model training, but anomalies are frequently sporadic, so that a large amount of anomaly data is difficult to obtain in real life. Therefore, we consider using an unsupervised approach to achieve anomaly detection.
Disclosure of Invention
The invention aims to overcome the defects of the prior art and provide a time series abnormity detection method based on unsupervised learning.
The purpose of the invention can be realized by the following technical scheme:
a time series abnormity detection method based on unsupervised learning comprises the following steps:
segmenting the time sequence data at the position where the time sequence data are obviously changed, and filling each segmented data segment to a set length;
using a plurality of data segments which are segmented and filled by the time sequence under the normal state as an input training abnormity detection model;
taking a plurality of data segments segmented and filled by the time sequence to be detected as the input of an anomaly detection model for detection, and outputting an anomaly score;
and judging whether the abnormal score exceeds a threshold value, if so, judging that the abnormality occurs, otherwise, judging that the abnormality does not occur.
The segmenting of the time-series data at the position where the time-series data are significantly changed specifically comprises:
solving all extreme points of the time sequence data;
and then, taking the position of the extreme value point with a larger absolute value as a segmentation point, and segmenting the time sequence into a plurality of data segments, wherein the segmentation point is determined by an artificially set absolute value threshold of the data extreme value point.
The anomaly detection model comprises a data compressor and a Gaussian mixture model estimator, wherein the data compressor adopts a many-to-many LSTM network structure, and the Gaussian mixture model estimator adopts a multi-layer perceptron structure.
The compression process of the data compressor comprises the following steps:
compressing and reconstructing the data segment;
calculating the relative distance and cosine distance before and after compression;
and synthesizing the relative distance, the cosine distance and the output of the LSTM network hidden layer unit into the input quantity of the Gaussian mixture model estimator.
The mathematical expression of the relative distance is:
Figure BDA0002007775850000021
wherein: r is the relative distance, L is the length of the time series contained in the data segment, xiIs an element in the time series contained in the data segment, and x' is an element in the time series obtained after the recombination.
The mathematical expression of the cosine distance is:
Figure BDA0002007775850000022
wherein: c is the cosine distance, | | | | | is the norm, xiIs an element in the time series contained in the data segment, and x' is an element in the time series obtained after the recombination.
The training process of the Gaussian mixture model estimator comprises the following steps:
receiving the output of the data compressor and mapping to a K-dimensional vector, where K is the number of Gaussian distributions in the model,
obtaining the mixing probability, the mean value and the covariance of each Gaussian distribution based on each element of the K-dimensional vector;
the detection process of the Gaussian mixture model comprises the following steps:
the output of the data compressor is received and an anomaly score is calculated.
The mathematical expression of the anomaly score is:
Figure BDA0002007775850000031
wherein: score (z) is the score for the abnormality,
Figure BDA0002007775850000032
is the mixing probability of the kth gaussian distribution,
Figure BDA0002007775850000033
is the covariance of the kth gaussian distribution, z is the output of the data compressor,
Figure BDA0002007775850000034
is the mean of the k-th gaussian distribution,
Figure BDA0002007775850000035
is composed of
Figure BDA0002007775850000036
The inverse matrix of (c).
The mixing probability of the kth Gaussian distribution is as follows:
Figure BDA0002007775850000037
the mean of the kth gaussian distribution is:
Figure BDA0002007775850000038
the covariance of the kth gaussian distribution is:
Figure BDA0002007775850000039
wherein: n is the total number of training samples,
Figure BDA00020077758500000310
for the kth dimension data of the ith training sample, ziIs the ith training sample.
The data compressor and the Gaussian mixture model estimator are trained in an end-to-end mode, and the trained objective function is as follows:
Figure BDA00020077758500000311
wherein: j is the objective function, λ1、λ2For manually set parameters, xiIs the time sequence contained in the ith data segment, x' is the time sequence sufficiently contained in the ith data segment,
Figure BDA00020077758500000312
is a penalty term.
Compared with the prior art, the invention has the following beneficial effects:
1) before model training and anomaly detection, the time sequence data is segmented at the position where the time sequence data is significantly changed, and the segmented sequence data is used for model training. The conventional anomaly detection method uses a time window with a fixed length to slide and select a time slice, so that a large amount of redundant information is generated in segmented sequence data, which is not beneficial to the characteristic learning of a neural network, and on the other hand, the use of the time sequence with the fixed length cannot be beneficial to representing that data in the time window has a fixed meaning, and the comparison of the time sequences with similar physical meanings cannot be realized.
2) The method based on density estimation is adopted, a segmented training sample is regarded as a sample sampled from unknown Gaussian mixture distribution, a Gaussian mixture model of the unknown distribution is estimated by utilizing a neural network, and only probability distribution of the whole data is considered in the conventional method, but different characteristic distribution of each section of the data is not considered.
3) In the training stage, segmented data is sent into a many-to-many cyclic neural network for reconstructing a training sample, the output of the last step length of a hidden layer of the neural network, the relative distance between a reconstructed sequence and an original sequence and the cosine distance are simultaneously sent into the neural network for estimating parameters of a Gaussian mixture model, and the conventional method only uses a reconstruction error as an estimation basis of the Gaussian mixture model.
Drawings
FIG. 1 is a schematic flow chart of the main steps of the present invention;
FIG. 2 is a model training flow diagram;
FIG. 3 is a schematic diagram of a neural network model used in the present invention;
FIG. 4 is a flow chart of anomaly prediction;
FIG. 5 is a graph showing the performance of the process of the present invention compared to the performance of a prior art process.
Detailed Description
The invention is described in detail below with reference to the figures and specific embodiments. The present embodiment is implemented on the premise of the technical solution of the present invention, and a detailed implementation manner and a specific operation process are given, but the scope of the present invention is not limited to the following embodiments.
A time series anomaly detection method based on unsupervised learning mainly comprises two steps: model training and anomaly detection, as shown in fig. 1, includes:
segmenting the time sequence data at the position where the time sequence data are obviously changed, and filling each segmented data segment to a set length; to achieve the above requirements, the flow chart of the model training step of the present invention is shown in FIG. 2. The data preprocessing comprises two steps:
data segmentation: firstly, all extreme points of the sequence are solved, then the position of the extreme point with a larger absolute value is used as a segmentation point, the segmentation time sequence is divided into a plurality of data segments, and the segmentation point is determined by an artificially set absolute value threshold of the data extreme point.
And (3) data padding: and filling the plurality of segmented sequences into the input length of the anomaly detection model by using 0.
And the segmented and filled data segments are respectively used as independent samples for training subsequent models.
Training a neural network for anomaly detection by using a plurality of data segments which are segmented and filled by using the time sequence in the normal state;
taking a plurality of data segments segmented and filled by the time sequence to be detected as the input of an anomaly detection model for detection, and outputting an anomaly score;
and judging whether the abnormal score exceeds a threshold value, if so, judging that the abnormality occurs, otherwise, judging that the abnormality does not occur.
As shown in fig. 3, the anomaly detection model includes a data compressor that employs a many-to-many LSTM network architecture and a gaussian mixture model estimator.
The time step used in the model structure in the data compressor is larger than all possible incoming sample lengths. The time series samples input into the LSTM model are denoted as x ═ x1,x2,…,xL]And the time sequence after the reconstruction of the LSTM network is recorded as x '═ x'1,x′2,…,x′L]Where L is the length of the time series, the loss function of the training of the LSTM network is as follows:
Figure BDA0002007775850000051
wherein xiIs the ith element, x 'in one time series sample'iTo reconstruct the ith element in a time series of samples, L is the length of the time series.
The compression process comprises the following steps:
compressing and reconstructing the data segment;
calculating the relative distance and cosine distance before and after compression;
and synthesizing the relative distance, the cosine distance and the output of the LSTM network hidden layer unit into the input quantity of the Gaussian mixture model estimator.
The mathematical expression for the relative distance is:
Figure BDA0002007775850000052
wherein: r isRelative distance, L is the length of the time series contained in the data segment, xiIs an element in the time series contained in the data segment, and x' is an element in the time series obtained after the recombination.
The mathematical expression for the cosine distance is:
Figure BDA0002007775850000061
wherein: c is the cosine distance, | | | | | is the norm, xiIs an element in the time series contained in the data segment, and x' is an element in the time series obtained after the recombination.
The gaussian mixture model estimator employs a multi-layer perceptron structure (MLP). Given the number K of gaussian distributions used by the gaussian mixture model, the gaussian mixture model estimator is configured to estimate three parameters of the K gaussian distributions, which are a mixture probability Φ, a mean μ, and a covariance Σ, respectively.
The parameter estimation process is as follows:
(1) the input samples are first mapped into K-dimensional vectors using a multi-layer neural network to determine the data used to estimate each gaussian distribution. The mapping process is as follows:
p＝MLN(z；θ)
Figure BDA0002007775850000062
where z is the data input to the Gaussian mixture model estimator, MLN (-) is a multi-layer neural network with parameters θ, softmax (-) is a softmax function,
Figure BDA0002007775850000063
are samples used to estimate the parameters of the gaussian mixture model.
(2) Parameters of the gaussian mixture model: the mixed probability phi, the mean value mu and the covariance Σ have the following estimation formula:
Figure BDA0002007775850000064
wherein
Figure BDA0002007775850000065
And
Figure BDA0002007775850000066
respectively the mixing probability, mean and covariance of the kth Gaussian distribution,
Figure BDA0002007775850000067
for the kth dimension data of the ith training sample, ziIs the ith training sample, and N is the total number of training samples.
The formula of the anomaly score output by the gaussian mixture model estimator is as follows:
Figure BDA0002007775850000068
where z is the data input to the estimated gaussian mixture model estimator, K is the given number of gaussian distributions,
Figure BDA0002007775850000069
and
Figure BDA00020077758500000610
respectively, the mixing probability, mean, covariance of the kth gaussian distribution.
The data compressor and the Gaussian mixture model estimator are trained in an end-to-end mode, and the trained objective function is as follows:
Figure BDA00020077758500000611
wherein: j is the objective function, λ1、λ2For manually set parameters, xiIs the time sequence contained in the ith data segment, x' is the time sequence sufficiently contained in the ith data segment,
Figure BDA00020077758500000612
for the penalty term, the formula is as follows:
Figure BDA0002007775850000071
wherein: d is the dimension of the sample z input into the gaussian mixture model estimator, K is the given number of gaussian distributions.
The method for determining the data segment for anomaly detection comprises the following steps of calculating the variance of Gaussian distribution generated by training each segmented data segment, and selecting the data segment which can generate the minimum variance as data which is sent to an anomaly detection model in an anomaly detection stage.
The flow chart of the anomaly detection step is shown in FIG. 4, where the data pre-processing includes two steps:
(1) data segmentation: all extreme points of the sequence are first found, and then the position of the extreme point with the largest absolute value is taken as a dividing point.
(2) And (3) data padding: and filling the plurality of segmented sequences into the input length of the anomaly detection model by using 0.
(3) And selecting the data segment for anomaly detection determined in the model training stage.
The neural network model is an anomaly detection model trained in the model training step, and tau is an artificially given anomaly score classification threshold.
The performance of the method is evaluated on a Two-lead ECG data set, AUC and ROC are used as indexes for measuring the performance, the AUC of the method is 0.8396573, and figure 5 lists comparative data of the performance of the method and the performance of other methods on the same data set, wherein Seq2Cluster is the method. Therefore, the method provided by the invention is superior to all the existing similar unsupervised anomaly detection methods, and can show that the anomaly detection method disclosed by the patent has advancement.

Claims (6)

1. A time series abnormity detection method based on unsupervised learning is characterized by being used for database fault diagnosis of a website system, and the method comprises the following steps:
segmenting the time sequence data at the position where the time sequence data are obviously changed, filling each segmented data segment to a set length,
using a plurality of data segments which are segmented and filled by the time sequence under the normal state as input to train an abnormal detection model,
a plurality of data segments segmented and filled by the time sequence to be detected are used as the input of an anomaly detection model for detection, and an anomaly score is output,
judging whether the abnormal score exceeds a threshold value, if so, judging that the abnormality occurs, otherwise, judging that the abnormality does not occur;
the anomaly detection model comprises a data compressor and a Gaussian mixture model estimator, wherein the data compressor adopts a many-to-many LSTM network structure, and the Gaussian mixture model estimator adopts a multi-layer perceptron structure;
the compression process of the data compressor comprises the following steps:
the data segment is compressed and reconstructed, and then,
the relative distance and cosine distance before and after compression are calculated,
synthesizing the relative distance, the cosine distance and the output of the LSTM network hidden layer unit into the input quantity of a Gaussian mixture model estimator;
the training process of the Gaussian mixture model estimator comprises the following steps:
receiving the output of the data compressor and mapping to a K-dimensional vector using a multi-layer neural network, where K is the number of gaussian distributions in the model,
based on each element of the K-dimensional vector and using a multilayer perceptron model, the mixed probability, the mean value and the covariance of each Gaussian distribution are obtained,
the detection process of the Gaussian mixture model comprises the following steps:
receiving the output of the data compressor and calculating to obtain an abnormal score;
the data compressor and the Gaussian mixture model estimator are trained in an end-to-end mode, and the trained objective function is as follows:
Figure FDA0002631868540000011
wherein: j is the objective function, λ1、λ2For manually set parameters, xiIs the time sequence contained in the ith data segment, x' is the time sequence sufficiently contained in the ith data segment,
Figure FDA0002631868540000021
is a penalty term.
2. The unsupervised learning-based time series abnormality detection method according to claim 1, wherein the segmenting of the time series data at the position where the time series data significantly changes specifically comprises:
solving all extreme points of the time sequence data;
and then, dividing the position of the extreme point of which the absolute value exceeds the set threshold value into a plurality of data segments as a dividing point.
3. The unsupervised learning-based time series anomaly detection method according to claim 1, wherein the mathematical expression of the relative distance is as follows:
Figure FDA0002631868540000022
wherein: r is the relative distance, L is the length of the time series contained in the data segment, xiIs an element in the time series contained in the data segment, and x' is an element in the time series obtained after the recombination.
4. The unsupervised learning-based time series anomaly detection method according to claim 1, wherein the mathematical expression of the cosine distance is as follows:
Figure FDA0002631868540000023
wherein: c is the cosine distance, | | | | | is the norm, xiIs an element in the time series contained in the data segment, and x' is an element in the time series obtained after the recombination.
5. The unsupervised learning-based time series abnormality detection method according to claim 1, wherein the mathematical expression of the abnormality score is as follows:
Figure FDA0002631868540000024
wherein: score (z) is the score for the abnormality,
Figure FDA0002631868540000025
is the mixing probability of the kth gaussian distribution,
Figure FDA0002631868540000026
is the covariance of the kth gaussian distribution, z is the output of the data compressor,
Figure FDA0002631868540000027
is the mean of the k-th gaussian distribution,
Figure FDA0002631868540000028
is composed of
Figure FDA0002631868540000029
The inverse matrix of (c).
6. The unsupervised learning-based time series abnormality detection method according to claim 5,
the mixing probability of the kth Gaussian distribution is as follows:
Figure FDA00026318685400000210
the mean of the kth gaussian distribution is:
Figure FDA0002631868540000031
the covariance of the kth gaussian distribution is:
Figure FDA0002631868540000032
wherein: n is the total number of training samples,
Figure FDA0002631868540000033
for the kth dimension data of the ith training sample, ziIs the ith training sample.
CN201910234623.8A 2019-03-26 2019-03-26 Unsupervised learning-based time series anomaly detection method Active CN110071913B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201910234623.8A CN110071913B (en) 2019-03-26 2019-03-26 Unsupervised learning-based time series anomaly detection method

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201910234623.8A CN110071913B (en) 2019-03-26 2019-03-26 Unsupervised learning-based time series anomaly detection method

Publications (2)

Publication Number Publication Date
CN110071913A CN110071913A (en) 2019-07-30
CN110071913B true CN110071913B (en) 2020-10-02

Family

ID=67366741

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201910234623.8A Active CN110071913B (en) 2019-03-26 2019-03-26 Unsupervised learning-based time series anomaly detection method

Country Status (1)

Country Link
CN (1) CN110071913B (en)

Families Citing this family (19)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110430183A (en) * 2019-07-31 2019-11-08 福建师范大学 The MH-LSTM method for detecting abnormality of dialogue-based characteristic similarity
CN110460598B (en) * 2019-08-12 2021-08-17 西北工业大学深圳研究院 Network flow space-time migration abnormity detection method
CN110717601B (en) * 2019-10-15 2022-05-03 厦门铅笔头信息科技有限公司 Anti-fraud method based on supervised learning and unsupervised learning
CN110895598B (en) * 2019-10-23 2021-09-14 山东九州信泰信息科技股份有限公司 Real-time anomaly detection parallelization method based on multi-source prediction
CN112751813A (en) * 2019-10-31 2021-05-04 国网浙江省电力有限公司 Network intrusion detection method and device
CN111177224B (en) * 2019-12-30 2022-04-05 浙江大学 Time sequence unsupervised anomaly detection method based on conditional regularized flow model
CN111562996B (en) * 2020-04-11 2021-11-23 北京交通大学 Method and system for detecting time sequence abnormality of key performance index data
CN111884874B (en) * 2020-07-15 2022-02-01 中国舰船研究设计中心 Programmable data plane-based ship network real-time anomaly detection method
CN112040338B (en) * 2020-07-31 2022-08-09 中国建设银行股份有限公司 Video playing cheating detection method and device and electronic equipment
CN112131272B (en) * 2020-09-22 2023-11-10 平安科技（深圳）有限公司 Method, device, equipment and storage medium for detecting multi-element KPI time sequence
CN112257917B (en) * 2020-10-19 2023-05-12 北京工商大学 Time sequence abnormal mode detection method based on entropy characteristics and neural network
CN112445842B (en) * 2020-11-20 2024-09-06 北京思特奇信息技术股份有限公司 Outlier detection method and system based on time sequence data
CN112416643A (en) * 2020-11-26 2021-02-26 清华大学 Unsupervised anomaly detection method and unsupervised anomaly detection device
CN112511538B (en) * 2020-11-30 2022-10-18 杭州安恒信息技术股份有限公司 Network security detection method based on time sequence and related components
CN113098640B (en) * 2021-03-26 2022-03-08 电子科技大学 Frequency spectrum anomaly detection method based on channel occupancy prediction
CN113076215B (en) * 2021-04-08 2023-06-20 华南理工大学 Unsupervised anomaly detection method independent of data types
CN113469247B (en) * 2021-06-30 2022-04-01 广州天懋信息系统股份有限公司 Network asset abnormity detection method
CN113553232B (en) * 2021-07-12 2023-12-05 厦门大学 Technology for carrying out unsupervised anomaly detection on operation and maintenance data through online matrix image
CN117539739A (en) * 2023-12-11 2024-02-09 国网河南省电力公司经济技术研究院 User continuous behavior anomaly monitoring method based on double features

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101826070A (en) * 2010-04-27 2010-09-08 上海第二工业大学 Key point-based data sequence linear fitting method
CN103150364A (en) * 2013-03-04 2013-06-12 福建师范大学 Time series feature extraction method

Family Cites Families (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20060047807A1 (en) * 2004-08-25 2006-03-02 Fujitsu Limited Method and system for detecting a network anomaly in a network
CN103561418A (en) * 2013-11-07 2014-02-05 东南大学 Anomaly detection method based on time series
CN104156473B (en) * 2014-08-25 2017-05-03 哈尔滨工业大学 LS-SVM-based method for detecting anomaly slot of sensor detection data
US10911318B2 (en) * 2015-03-24 2021-02-02 Futurewei Technologies, Inc. Future network condition predictor for network time series data utilizing a hidden Markov model for non-anomalous data and a gaussian mixture model for anomalous data
CN104915846A (en) * 2015-06-18 2015-09-16 北京京东尚科信息技术有限公司 Electronic commerce time sequence data anomaly detection method and system
CN106368816B (en) * 2016-10-27 2018-09-25 中国船舶工业系统工程研究院 A kind of online method for detecting abnormality of marine low speed diesel engine based on baseline offset
CN108647737A (en) * 2018-05-17 2018-10-12 哈尔滨工业大学 A kind of auto-adaptive time sequence variation detection method and device based on cluster

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101826070A (en) * 2010-04-27 2010-09-08 上海第二工业大学 Key point-based data sequence linear fitting method
CN103150364A (en) * 2013-03-04 2013-06-12 福建师范大学 Time series feature extraction method

Also Published As

Publication number Publication date
CN110071913A (en) 2019-07-30

Similar Documents

Publication Publication Date Title
CN110071913B (en) Unsupervised learning-based time series anomaly detection method
CN110020623B (en) Human body activity recognition system and method based on conditional variation self-encoder
CN111914873A (en) Two-stage cloud server unsupervised anomaly prediction method
CN109460574A (en) A kind of prediction technique of aero-engine remaining life
CN109117774B (en) Multi-view video anomaly detection method based on sparse coding
CN110609524A (en) Industrial equipment residual life prediction model and construction method and application thereof
CN113673346A (en) Motor vibration data processing and state recognition method based on multi-scale SE-Resnet
CN113392931A (en) Hyperspectral open set classification method based on self-supervision learning and multitask learning
CN114297918A (en) Aero-engine residual life prediction method based on full-attention depth network and dynamic ensemble learning
CN114170184A (en) Product image anomaly detection method and device based on embedded feature vector
Xu et al. Global attention mechanism based deep learning for remaining useful life prediction of aero-engine
CN113177587A (en) Generalized zero sample target classification method based on active learning and variational self-encoder
CN117034003A (en) Full life cycle self-adaptive fault diagnosis method, system, equipment and medium for aerospace major product manufacturing equipment
CN115859777A (en) Method for predicting service life of product system in multiple fault modes
Chou et al. SHM data anomaly classification using machine learning strategies: A comparative study
CN115081331A (en) Wind turbine generator running state abnormity detection method based on state parameter reconstruction error
CN114707577A (en) Anomaly detection method and system based on self-confrontation variational self-encoder
CN112861443B (en) Advanced learning fault diagnosis method integrated with priori knowledge
CN112560674B (en) Method and system for detecting sound signal quality
CN115831352B (en) Detection method based on dynamic texture features and time slicing weight network
CN105654128B (en) Fan blade image failure recognition methods based on nuclear norm canonical low-rank coding
CN114004144A (en) Method for predicting remaining service life of aircraft engine
CN113051809A (en) Virtual health factor construction method based on improved restricted Boltzmann machine
CN117909854B (en) Zero sample composite fault diagnosis method based on multi-mode contrast embedding
CN118332291B (en) Multi-sensor data fault prediction method for aircraft

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant