CN112685476A - Periodic multivariate time series anomaly detection method and system - Google Patents
Periodic multivariate time series anomaly detection method and system Download PDFInfo
- Publication number
- CN112685476A CN112685476A CN202110010864.1A CN202110010864A CN112685476A CN 112685476 A CN112685476 A CN 112685476A CN 202110010864 A CN202110010864 A CN 202110010864A CN 112685476 A CN112685476 A CN 112685476A
- Authority
- CN
- China
- Prior art keywords
- time
- training data
- vector
- multivariate
- time series
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Images
Landscapes
- Debugging And Monitoring (AREA)
Abstract
The invention relates to the technical field of abnormal data detection, in particular to a periodic multivariate time series abnormality detection method and a periodic multivariate time series abnormality detection system, wherein the method comprises the following steps: constructing an encoder for resisting a generation network, and outputting an encoder implicit vector through the periodicity of the learning time of the encoder and the complex dependency relationship between the learning time and a variable; constructing a decoder of the countermeasure generation network, and generating a multivariate sequence (false data) at the current moment through the decoder; constructing a model, and identifying true and false data through an anomaly detection classifier to enhance the sensitivity of the classifier; establishing the accuracy of an optimization model of the comprehensive loss function; and predicting the data to be detected by the abnormality detection classifier. The invention has the beneficial effects that: the problem of periodical multi-element time series abnormality detection is solved, and the sensitivity of an abnormality detection model is improved.
Description
Technical Field
The invention relates to the technical field of abnormal data detection, in particular to a periodic multivariate time series abnormality detection method and system.
Background
A time series is a set of random variables ordered in time, and is typically the result of observing a potential process at a given sampling rate over equally spaced time periods, where a multivariate time series data refers to the trend of multiple sets of random variables changing constantly over time, and a multivariate time series data with periodicity refers to the trend of multiple sets of random variables changing over time with periodicity. Multivariate time series data analysis refers to the study of multivariate time series, and the change rule of many sequences can be influenced by other sequences in practice. For example, the current and voltage change with time at the same time are studied in engineering; analyzing the change relation among pressure, temperature and volume in chemical change; during weather forecast analysis, the recording data of rainfall, air temperature and air pressure of the area need to be considered at the same time. Therefore, the multivariate time series data analysis needs to consider the components as univariate processes to study, and also needs to study the relationship and change rule among the components.
Time series anomaly detection is the process of identifying abnormal events or behaviors from a normal time series. Effective anomaly detection is widely used in many fields of the real world, such as quantitative transactions, network security detection, autonomous vehicles, and routine maintenance of large industrial equipment. Taking an in-orbit spacecraft as an example, failure to detect a hazard may result in serious or even irreparable damage due to the expense and complexity of the system. Anomalies can develop into serious faults at any time, so accurate and timely anomaly detection can remind astronauts to take measures in the early days. With the development of multivariate time series data, the detection of multivariate time series abnormalities has attracted the attention of researchers. The patent application number CN202010439838.6 provides a multivariate time series abnormal mode prediction method and a data acquisition monitoring device, and the method adopts a natural neighbor principle and an MMOD algorithm to realize the online identification of the multivariate time series abnormal mode. Patent application No. CN202010752303.4 provides a service system anomaly detection method, device, computer device and storage medium, which uses an encoding and decoding method to reconstruct and compare multiple time series data, thereby improving anomaly detection accuracy.
The detection of the abnormality of the periodic time series with the multivariate time series has the following difficulties according to the characteristics of the multivariate time series data: 1. the time trend has periodicity, and the change trend in the time local period and the change trend in the time global period need to be learned; 2. the multivariate time series abnormality detection needs to consider the correlation between the whole variables, the abnormality of one variable does not represent the data abnormality at the moment, and the cooperative relationship among a plurality of groups of random variables needs to be learned under the condition of data pollution possibly; 3. the collection of abnormal multivariate time series data is difficult, and data offset exists.
Disclosure of Invention
The invention aims to overcome the defects and provide a periodic multivariate time series abnormity detection method and system, which can enhance the robustness of a model, improve the sensitivity of a detection model and solve the problem of periodic multivariate time series abnormity detection.
The invention achieves the aim through the following scheme: a periodical multivariate time series abnormality detection method comprises the following steps:
s1, collecting the multivariate time sequence and preprocessing the multivariate time sequence to obtain a multivariate time sequence example vector X formed by the training data X;
s2 construction of an encoder for countering a Generation network, outputting a multivariate time series implicit vector T'VM；
S3, constructing a decoder of the confrontation generation network, and outputting a reconstructed multivariate time sequence x _;
s4, replacing training data x by x part to form training data x ', inputting x ' into coder of countermeasure generating network, outputting x ' corresponding to reconstructed implicit vector TVM”；
S5, intercepting the multivariate time sequence of the current period to obtain real training data train _1 and abnormal training data train _0, inputting the real training data train _1 and the abnormal training data train _0 into an abnormal detection classifier, and outputting a label vector T ″', wherein the label vector T is a linear vectorclass；
S6, constructing a loss function loss as Wclass×lossclass+Wcontent×losscontent+Whidden×losshiddenWherein two classes loseclassOutputting a label vector T' for the label data of the training data and the anomaly detection classifierclassCross entropy loss value of (1), context losscontentThe Euclidean distance between the reconstructed data x _ of the training data and the training data x, with loss impliedhiddenIs a multivariate time series implicit vector T'VMAnd the reconstructed implicit vector TVM"Euclidean distance, Wclass、Wcontent、WhiddenAre respectively lossclass、lossconten、losshiddenA coefficient index of (d);
s7, iteratively updating the network parameters according to the loss value to generate an abnormal detection model M;
and S8, inputting the data to be detected into an abnormality detection classifier, and loading the prediction result of the abnormality detection model M by the abnormality detection classifier.
Preferably, the pretreatment comprises: multivariate time series data Sec RV×MPretreatment was (M +1) P, (M +2) P, …, at time M
Multiple time series instance vectors
Where M is the time step of collecting data, V is the variable number of collecting data, P is the period of the multivariate time series, and M is the constant representing the number of learning periods, then (M +1) P time and the training data before (M +1) P time
Wherein
Represents the value of the vth variable at the (m +1) th P time.
Preferably, the step S2 specifically includes the following steps:
s21: making the training data x be equal to RV×(m+1)PInputting the partial time convolution layer, extracting the training dataLocal temporal feature T of x(m+1)P；
S22: making the training data x be equal to RV×(m+1)PInputting a global time convolution layer, and extracting a global time characteristic T' of training data x;
s23: inputting the global time characteristic T 'into a variable attention layer I, and extracting a global time variable attention vector T';
s24: inputting the output global time variable attention vector T' into the bidirectional LSTM layer I, and extracting the variable global time vector TV；
S25: global time vector T of variableVInputting a weight matrix fusion layer and outputting an implicit vector T'VM。
Preferably, the step S3 specifically includes the following steps: implicit vector T'VMInputting the global time variable attention vector T' into the variable attention layer II to obtain a reconstructed multivariate time sequence x _.
Preferably, the real training data train _1 in the step S5 intercepts a multivariate time series of P time dimensions from the multivariate time series instance vector X; the abnormal training data train _0 is obtained by sequentially replacing data at corresponding positions in the real training data train _1 by the reconstructed multivariate time sequence x _ 1.
Preferably, the real training data train _1 and the abnormal training data train _0 sequentially pass through the bidirectional LSTM layer II, the full connection layer, and the softmax layer to output the tag vector T ″class。
Preferably, the anomaly detection classifier outputs a two-dimensional label vector, if the maximum value is in one dimension, the data to be detected is an anomaly time sequence, and if the maximum value is in two dimensions, the data to be detected is a normal time sequence.
A multivariate time series anomaly detection system having periodicity, comprising: the system comprises a data preprocessing module, an encoder of a countermeasure generation network, a decoder of the countermeasure generation network, an anomaly detection classifier, a loss calculation module, a model updating module and a prediction module; the encoder of the countermeasure generation network includes: a local time convolution layer, a global time convolution layer, a variable attention layer I, a bidirectional LSTM layer I and a weight matrix fusion layer; the decoder of the antagonistic generating network comprises a variable attention layer II; the anomaly detection classifier comprises a bidirectional LSTM layer II, a full connection layer and a softmax layer; the data preprocessing module outputs training data, an anomaly detection model M is generated through an encoder of an adversarial generation network, a decoder of the adversarial generation network, an anomaly detection classifier, a loss calculation module and a model updating module, data to be detected are input into the anomaly detection classifier, and the anomaly detection classifier loads a prediction result of the anomaly detection model M.
The invention has the beneficial effects that: the problem of detection of the abnormality of a periodical multivariate time series is solved: 1. the encoder designed by the invention adopts the convolutional neural network to learn local time information in a period and extract multi-period global time information; learning the cooperative relationship of the multivariate variables on local time and global time by adopting a user-defined variable attention mechanism; adopting bidirectional LSTM to supplement and learn trend information of multi-period global time; the design of the encoder can enhance the robustness of the model; 2. the invention adopts a coding and decoding countermeasure generation network, learns local and global period time variable information at a certain moment through a coder, and decodes to generate abnormal data similar to a time multivariate time sequence, thereby solving the problem of data deviation of an abnormal detection model; 3. the comprehensive loss is adopted, namely context loss generated by comparing a false multivariate time sequence generated by a countermeasure network with a true multivariate time sequence, binary loss generated by training binary classification of the false multivariate time sequence generated by the countermeasure network and the true multivariate time sequence, and implicit loss generated by comparison after the true multivariate time sequence is coded, and the comprehensive loss can improve the sensitivity of an anomaly detection model.
Drawings
FIG. 1 is a schematic flow diagram of the process of the present invention;
FIG. 2 is a schematic of a prediction flow of the present invention;
FIG. 3 is a schematic diagram of the training process of the anomaly detection model M of the present invention;
FIG. 4 is a schematic diagram of the system of the present invention;
fig. 5 is a schematic configuration diagram of an encoder of the countermeasure generation network and a decoder of the countermeasure generation network.
Detailed Description
The invention is further described below with reference to specific embodiments, but the scope of protection of the invention is not limited thereto:
example (b): as shown in fig. 4 and 5, a multivariate time series abnormality detection system having periodicity includes: the system comprises a data preprocessing module, an encoder of a countermeasure generation network, a decoder of the countermeasure generation network, an anomaly detection classifier, a loss calculation module, a model updating module and a prediction module; the encoder of the countermeasure generation network includes: a local time convolution layer, a global time convolution layer, a variable attention layer I, a bidirectional LSTM layer I and a weight matrix fusion layer; the decoder of the antagonistic generating network comprises a variable attention layer II; the anomaly detection classifier comprises a bidirectional LSTM layer II, a full connection layer and a softmax layer; the data preprocessing module outputs training data, an anomaly detection model M is generated through an encoder of an adversarial generation network, a decoder of the adversarial generation network, an anomaly detection classifier, a loss calculation module and a model updating module, data to be detected are input into the anomaly detection classifier, and the anomaly detection classifier loads a prediction result of the anomaly detection model M.
As shown in fig. 1 to 3, a periodic multivariate time series anomaly detection method based on the above system includes the following steps:
s1, collecting the multivariate time sequence and preprocessing the multivariate time sequence to obtain a multivariate time sequence example vector X formed by the training data X;
s2 construction of an encoder for countering a Generation network, outputting a multivariate time series implicit vector T'VM；
S3, constructing a decoder of the confrontation generation network, and outputting a reconstructed multivariate time sequence x _;
s4, replacing training data x by x part to form training data x ', inputting x ' into coder of countermeasure generating network, outputting x ' corresponding to reconstructed implicit vector TVM”；
S5, intercepting the multivariate time sequence of the current period to obtain the real training data train _1 and the abnormal training data train \0, inputting the real training data train _1 and the abnormal training data train _0 into an abnormal detection classifier, and outputting a label vector T ″class；
S6, constructing a loss function loss as Wclass×lossclass+Wcontent×losscontent+Whidden×losshiddenWherein two classes loseclassOutputting a label vector T' for the label data of the training data and the anomaly detection classifierclassCross entropy loss value of (1), context losscontentThe Euclidean distance between the reconstructed data x _ of the training data and the training data x, with loss impliedhiddenIs a multivariate time series implicit vector T'VMAnd the reconstructed implicit vector TVM"Euclidean distance, Wclass、Wcontent、WhiddenAre respectively lossclass、lossconten、losshiddenA coefficient index of (d);
s7, iteratively updating the network parameters according to the loss value to generate an abnormal detection model M;
and S8, inputting the data to be detected into an abnormality detection classifier, and loading the prediction result of the abnormality detection model M by the abnormality detection classifier.
The embodiment collects the historical stay record S E R of the hospital ICUV×MThe multivariate time sequence data is obtained, wherein M is 192000, V is 42, P is 48, M is 8, S is R, R is the number of learning cycles, M is the time step of collecting data, V is the number of variables of collecting data, P is the period of the multivariate time sequence, M is the constant, and S is the number of learning cycles42×192000Pretreatment was at times 432,480, …,192000
Multiple time series example vector X ∈ R3992×42×432. Then the multivariate time sequence at time 432 and before time 432 is the training data
Wherein
Indicates the 42 thThe value of the variable at time 54.
1) The encoder that constructs the challenge generation network:
(1.1) local time convolution layer: preprocessing data to obtain a multivariate time sequence example vector X, and taking the multivariate time sequence at the 432 moment and before the 432 moment as training data X belonging to R42×432For example, the information is input into a local time convolution layer, a filter is used to perform convolution calculation on training data x local time to learn trend information in a time period, the size of the filter in this embodiment is 1 × 6, where h ═ 6 is a time step in a convolution kernel window, that is, h ═ 6 adjacent time information in the learning period, and then the training data x is convolved to output a feature
Comprises the following steps:
wherein b isTe.R is a deviation term, WT∈R6×1Is the weight matrix of the convolution kernel, f is the convolution kernel function,
a two-dimensional vector from the ith dimension of the variable dimension and the jth dimension to the (j + 5) th dimension of the time dimension is the multi-element time sequence vector; the filter is applied to a multivariate time sequence x to obtain a local time characteristic T432Comprises the following steps:
(1.2) global time convolution layer: performing sliding convolution on the training data x by utilizing the convolution smooth characteristic to acquire global period time information; the output time characteristic T' is:
T'＝[T432,T384,…,T48]]∈R9×42×43 (3)
wherein T is48Local temporal features are obtained for the 48-time multivariate time series,smooth for 8 cycles.
(1.3) learning the multivariate cooperative relationship by using a custom attention mechanism:
(1.3.1) output variable attention vector: according to the time characteristic T' output in the step (1.2), aiming at the time point 432 time characteristic
And (3) solving a variable attention vector, wherein the custom attention mechanism formula is as follows:
wherein
The attention of the variable i and the variable j at the moment 432 is shown, and the attention vector of the variable at the moment 432 is output
(1.3.2) output global time variant attention vector: according to the time characteristic T 'output in the step (1.2), calculating 432,384, … and 48 time variable attention vectors in the same step (1.3.1), and outputting a global time variable attention vector T' as follows:
T”＝[a432,a384,…,a48]∈R9×42×42 (6)
(1.4) learning Global time period dependencies Using bidirectional lstm
(1.4.1) outputting a first variable global time matrix: according to the global time variable attention vector T ″ output in step (1.3.2), taking the first variable as an example, there is a first variable global time matrix v _ 1:
(1.4.2) outputting a first variable global time characteristic: globally according to the first variable output in the step (1.4.1)The time matrix v _1 learns trend information of 9 time periods by utilizing a bidirectional LSTM layer and outputs a first variable global time characteristic TV1:
TV1＝s+s'∈R1×2L (8)
si＝f'(ULSTMv_1i+WLSTMsi-1)∈R1×L (9)
s′i＝f'(ULSTMv_1i+WLSTMs′i+1)∈R1×L (10)
Wherein s represents a forward calculation output implicit vector, s 'represents a reverse calculation output implicit vector, f' is an lstm kernel function, ULSTM∈R42×64,WLSTM∈R64×64The weight matrix of the LSTM kernel, L-64 is the implicit layer vector dimension.
(1.4.3) output variable global time vector: according to the global time variable attention vector T' output in the step (1.3.2), 42 variable global time vectors are sequentially calculated in the same step (1.4.2), and the variable global time vector T is outputV:
TV＝[TV1,…,TV42]∈R42×128 (11)
(1.5) fusing time variable characteristics by using weight matrix
(1.5.1) outputting 432 time-instant multivariate time-series implicit vectors: initializing the weight matrix WVM∈R128×1The variable global time vector T output by the step (1.4.3)VMultiplying by a weight matrix to output a multivariate time sequence implicit vector T by fusing variable time period characteristicsVM∈R42×1。
(1.5.2) outputting a multivariate time series implicit vector: the multivariate time series example vector X is equal to R3992×42×432Repeating the calculation process of outputting the implicit vector by the multivariate time sequence at the time point 432 in the step (1.5.1), and outputting the implicit vector T 'of the multivariate time sequence'VM∈R3992×42×1。
2) Decoder for constructing a countermeasure generation network
(2.1) decoding with attention: multiple times of 432Inter-sequence implicit vector TVMAnd 432 moment variable attention vector a432Decoding and outputting the reconstructed time point 432 multivariate time sequence x _432, wherein the formula is as follows:
(2.2) outputting the reconstructed multivariate time series: and (3) sequentially carrying out attention decoding on the 432,480, … and 192000 multi-element time series implicit vectors output by the step (1.5.2) and the step (2.1), and outputting the reconstructed 432,480, … and 192000 multi-element time series x ═ x _432, x _480, … and x _192000]∈R3992×42×1。
3) Constructing a binary classification model for anomaly detection
(3.1) outputting real training data train _ 1: the multivariate time series example vector X epsilon R sequentially from 432,480, … and 192000 time moments3992×42×432A multivariate time sequence of a period P is intercepted and used as real training data with a label of 1 in the two-classification training data, and train _1 is output as [ X ═ X432,X480,…,X192000]∈R3992×42×48Wherein
A one-cycle multivariate time series is shown at time 432,
the total number of training data labeled 1.
(3.2) outputting abnormal training data train _ 0: according to the real training data train _1 output in the step (3.1), the multivariate time series of the times 432,480, … and 192000 are sequentially input into the step 1) and the step 2) for encoding and decoding, namely, the reconstructed multivariate time series x _ ═ of the times 432,480, … and 192000 output in the step (2.2) is [ x _432, x _480, … and x _192000 ]]The reconstructed multivariate time series is sequentially substituted for the multivariate time series at times 432,480, … and 192000 in the real training data train _1, and the abnormal training data train _0 with a label of 0 in the binary training data train _0 is output [ X ═ X432',X480',…,X192000']Wherein
A one-cycle multivariate time series is shown at time 432.
(3.3) a classifier feature extraction layer: inputting the training data output in the step (3.1) and the step (3.2) into a bidirectional LSTM layer II to learn trend information of 1 time period, and outputting a time trend characteristic Tclass∈R7984×1×64Wherein L isclassThe hidden layer vector dimension is 32.
(3.4) classifier full connection layer: the time trend characteristic T output in the step (3.3)classDimensionality reduction is carried out through all the connection layers to obtain a classification vector T'class∈R7984×1×2
(3.5) the classification vector T 'is further divided'class∈R7984×1×2Performing softmax normalization to output tag vector T ″)class∈R7984×1×2。
(4) Building custom triple loss function
(4.1) triple loss function
(4.1.1) output two classification losses: the label vector T' output in the step (3.4)class∈R7984×1×2Calculating cross entropy loss value with real label, and outputting two-class lossclass∈R7984×1The real label ═ label0, label1]The calculation formula is as follows:
wherein y isiReal label, pre, representing the ith training dataiRepresents the probability that the ith training data is predicted to be normal data, i.e., the value of the label vector in 2 dimensions.
(4.1.2) loss of output context: reconstructing the multivariate time sequence [ x _432, x _480, …, x _192000 ] of the time instants 432,480, … and 192000 output in the step (3.2)]Sequentially solving Euclidean distances from the multivariate time series of the real 432,480, … and 192000 moments and outputting contextLoss ofcontent∈R3992×1The calculation formula is as follows:
(4.1.3) output implicit loss: taking time 432 as an example, a multivariate time series example before time 432 and time 432 is
Replacing the reconstructed multivariate time sequence x _432 with the multivariate time sequence at the time point 432 and outputting the multivariate time sequence
Inputting x' into an encoder of the countermeasure generation network in the step 1), and outputting a reconstructed implicit vector T ″VM∈R42×1Calculating Euclidean distances between the implicit vector before reconstruction and the implicit vector after reconstruction; and analogically calculating the Euclidean distance of the implicit vectors before and after reconstruction at 432,480, … and 192000 moments, and outputting the losshidden∈R3992×1。
(4.2) model training: in this embodiment, the weight W is setclass＝5,Wcontent＝10,Whidden2, total loss of output Wclass×lossclass+Wcontent×losscontent+Whidden×losshiddenAnd continuously and iteratively updating the network parameters according to the loss value to generate an anomaly detection model M.
5) Model prediction: loading the parameters of the abnormal detection binary model according to the abnormal detection model M stored in the step (4.2); preprocessing a multivariate time sequence at the t' moment to be predicted into
And inputting the time sequence into an abnormality detection model M, outputting a two-dimensional label vector, and if the maximum value is in one dimension, the t 'time multivariate time sequence is an abnormal time sequence, and if the maximum value is in two dimensions, the t' time multivariate time sequence is a normal time sequence.
While the invention has been described in connection with specific embodiments thereof, it will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined by the appended claims.
Claims (8)
1. A periodical multivariate time series abnormality detection method is characterized by comprising the following steps:
s1, collecting the multivariate time sequence and preprocessing the multivariate time sequence to obtain a multivariate time sequence example vector X formed by the training data X;
s2 construction of an encoder for countering a Generation network, outputting a multivariate time series implicit vector T'VM；
S3, constructing a decoder of the confrontation generation network, and outputting a reconstructed multivariate time sequence x _;
s4, replacing training data x by x part to form training data x ', inputting x ' into coder of countermeasure generating network, outputting x ' corresponding to reconstructed implicit vector TVM”；
S5, intercepting the multivariate time sequence of the current period to obtain real training data train _1 and abnormal training data train _0, inputting the real training data train _1 and the abnormal training data train _0 into an abnormal detection classifier, and outputting a label vector T ″', wherein the label vector T is a linear vectorclass；
S6, constructing a loss function loss as Wclass×lossclass+Wcontent×losscontent+Whidden×losshiddenWherein two classes loseclassOutputting a label vector T' for the label data of the training data and the anomaly detection classifierclassCross entropy loss value of (1), context losscontentThe Euclidean distance between the reconstructed data x _ of the training data and the training data x, with loss impliedhiddenImplicit vector T for multivariate time seriesV'MAnd the reconstructed implicit vector TVM"Euclidean distance, Wclass、Wcontent、WhiddenAre respectively lossclass、lossconten、losshiddenA coefficient index of (d);
s7, iteratively updating the network parameters according to the loss value to generate an abnormal detection model M;
and S8, inputting the data to be detected into an abnormality detection classifier, and loading the prediction result of the abnormality detection model M by the abnormality detection classifier.
2. The method for detecting the abnormality of the periodic multivariate time series according to claim 1, wherein the preprocessing comprises: multivariate time series data Sec RV×MPretreatment was (M +1) P, (M +2) P, …, at time M
Multiple time series instance vectors
Where M is the time step of collecting data, V is the variable number of collecting data, P is the period of the multivariate time series, and M is the constant representing the number of learning periods, then (M +1) P time and the training data before (M +1) P time
Wherein
Represents the value of the vth variable at the (m +1) th P time.
3. The method for detecting abnormality of a periodic multivariate time series as set forth in claim 2, wherein the step S2 specifically comprises the steps of:
s21: making the training data x be equal to RV×(m+1)PInputting the partial time convolution layer, extracting the partial time characteristic T of the training data x(m+1)P；
S22: making the training data x be equal to RV×(m+1)PInputting a global time convolution layer, and extracting a global time characteristic T' of training data x;
s23: inputting the global time characteristic T 'into a variable attention layer I, and extracting a global time variable attention vector T';
s24: inputting the output global time variable attention vector T' into the bidirectional LSTM layer I, and extracting the variable global time vector TV；
S25: global time vector T of variableVInputting a weight matrix fusion layer and outputting an implicit vector T'VM。
4. The method according to claim 3, wherein the step S3 specifically comprises the following steps: implicit vector T'VMInputting the global time variable attention vector T' into the variable attention layer II to obtain a reconstructed multivariate time sequence x _.
5. The method according to claim 4, wherein the real training data train _1 in the step S5 is used to intercept the multivariate time series with P time dimensions from the multivariate time series instance vector X; the abnormal training data train _0 is obtained by sequentially replacing data at corresponding positions in the real training data train _1 by the reconstructed multivariate time sequence x _ 1.
6. The method as claimed in claim 5, wherein the real training data train _1 and the abnormal training data train _0 sequentially pass through the bi-directional LSTM layer II, the full-link layer and the softmax layer to output the tag vector T ″ "class。
7. The method according to claim 6, wherein the anomaly detection classifier outputs a two-dimensional label vector, and if the maximum value is in one dimension, the data to be detected is an anomaly time series, and if the maximum value is in two dimensions, the data to be detected is a normal time series.
8. A system for detecting anomalies in a periodic time series, comprising: the system comprises a data preprocessing module, an encoder of a countermeasure generation network, a decoder of the countermeasure generation network, an anomaly detection classifier, a loss calculation module, a model updating module and a prediction module; the encoder of the countermeasure generation network includes: a local time convolution layer, a global time convolution layer, a variable attention layer I, a bidirectional LSTM layer I and a weight matrix fusion layer; the decoder of the antagonistic generating network comprises a variable attention layer II; the anomaly detection classifier comprises a bidirectional LSTM layer II, a full connection layer and a softmax layer; the data preprocessing module outputs training data, an anomaly detection model M is generated through an encoder of an adversarial generation network, a decoder of the adversarial generation network, an anomaly detection classifier, a loss calculation module and a model updating module, data to be detected are input into the anomaly detection classifier, and the anomaly detection classifier loads a prediction result of the anomaly detection model M.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110010864.1A CN112685476A (en) | 2021-01-06 | 2021-01-06 | Periodic multivariate time series anomaly detection method and system |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110010864.1A CN112685476A (en) | 2021-01-06 | 2021-01-06 | Periodic multivariate time series anomaly detection method and system |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN112685476A true CN112685476A (en) | 2021-04-20 |
Family
ID=75455820
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202110010864.1A Pending CN112685476A (en) | 2021-01-06 | 2021-01-06 | Periodic multivariate time series anomaly detection method and system |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN112685476A (en) |
Cited By (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113282876A (en) * | 2021-07-20 | 2021-08-20 | 中国人民解放军国防科技大学 | Method, device and equipment for generating one-dimensional time sequence data in anomaly detection |
| CN113780387A (en) * | 2021-08-30 | 2021-12-10 | 桂林电子科技大学 | Time sequence anomaly detection method based on shared self-encoder |
| CN116361673A (en) * | 2023-06-01 | 2023-06-30 | 西南石油大学 | Quasi-periodic time sequence unsupervised anomaly detection method, system and terminal |
| CN116776228A (en) * | 2023-08-17 | 2023-09-19 | 合肥工业大学 | Power grid time sequence data decoupling self-supervision pre-training method and system |
-
2021
- 2021-01-06 CN CN202110010864.1A patent/CN112685476A/en active Pending
Cited By (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113282876A (en) * | 2021-07-20 | 2021-08-20 | 中国人民解放军国防科技大学 | Method, device and equipment for generating one-dimensional time sequence data in anomaly detection |
| CN113780387A (en) * | 2021-08-30 | 2021-12-10 | 桂林电子科技大学 | Time sequence anomaly detection method based on shared self-encoder |
| CN116361673A (en) * | 2023-06-01 | 2023-06-30 | 西南石油大学 | Quasi-periodic time sequence unsupervised anomaly detection method, system and terminal |
| CN116361673B (en) * | 2023-06-01 | 2023-08-11 | 西南石油大学 | Quasi-periodic time sequence unsupervised anomaly detection method, system and terminal |
| CN116776228A (en) * | 2023-08-17 | 2023-09-19 | 合肥工业大学 | Power grid time sequence data decoupling self-supervision pre-training method and system |
| CN116776228B (en) * | 2023-08-17 | 2023-10-20 | 合肥工业大学 | Power grid time sequence data decoupling self-supervision pre-training method and system |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| Choi et al. | Deep learning for anomaly detection in time-series data: Review, analysis, and guidelines | |
| CN112784965B (en) | Large-scale multi-element time series data anomaly detection method oriented to cloud environment | |
| CN112685476A (en) | Periodic multivariate time series anomaly detection method and system | |
| Costa et al. | Variational encoding approach for interpretable assessment of remaining useful life estimation | |
| CN115688035A (en) | Time sequence power data anomaly detection method based on self-supervision learning | |
| Zhao et al. | Remaining useful life prediction for multi-sensor systems using a novel end-to-end deep-learning method | |
| Yu et al. | Stacked denoising autoencoder‐based feature learning for out‐of‐control source recognition in multivariate manufacturing process | |
| Wu et al. | Layer-wise relevance propagation for interpreting LSTM-RNN decisions in predictive maintenance | |
| Dong | A tutorial on nonlinear time-series data mining in engineering asset health and reliability prediction: concepts, models, and algorithms | |
| CN111325403A (en) | Method for predicting remaining life of electromechanical equipment of highway tunnel | |
| CN116796272A (en) | Method for detecting multivariate time sequence abnormality based on transducer | |
| Lin et al. | Attention-based Gate Recurrent Unit for remaining useful life prediction in prognostics | |
| Sun et al. | Intelligent fault diagnosis scheme for rolling bearing based on domain adaptation in one dimensional feature matching | |
| Huang et al. | CausalViT: Domain generalization for chemical engineering process fault detection and diagnosis | |
| Wang et al. | DVGTformer: A dual-view graph Transformer to fuse multi-sensor signals for remaining useful life prediction | |
| Yu et al. | Dynamic convolutional gated recurrent unit attention auto-encoder for feature learning and fault detection in dynamic industrial processes | |
| Wang et al. | Attention-mechanism based DiPLS-LSTM and its application in industrial process time series big data prediction | |
| Qin et al. | Remaining useful life prediction using temporal deep degradation network for complex machinery with attention-based feature extraction | |
| US20230350402A1 (en) | Multi-task learning based rul predication method under sensor fault condition | |
| Liu et al. | A CNN-LSTM-based domain adaptation model for remaining useful life prediction | |
| Bond et al. | A hybrid learning approach to prognostics and health management applied to military ground vehicles using time-series and maintenance event data | |
| CN115982988A (en) | PCA-Transformer-based device remaining service life prediction method | |
| Xu et al. | Deep transfer learning remaining useful life prediction of different bearings | |
| Park et al. | TCAE: temporal convolutional autoencoders for time series anomaly detection | |
| Qu et al. | Remaining Useful Life Prediction of High-Speed Railroad Contact Network Based on Stacking Integrated Attention-LSTM-CNN Deep Learning |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| WD01 | Invention patent application deemed withdrawn after publication |
Application publication date: 20210420 |
|
| WD01 | Invention patent application deemed withdrawn after publication |