CN113792749A - Time series data abnormity detection method, device, equipment and storage medium - Google Patents

Abstract

The present disclosure provides a method, device, device and storage medium for abnormal detection of time series data, and relates to the technical field of data processing. The method includes: acquiring time series data, where the time series data is a sequence of index data corresponding to each time point in a continuous time point; obtaining a neighborhood correlation feature according to the index data corresponding to each time point, and the neighborhood correlation feature is used to represent each time point The correlation between the index data corresponding to each neighboring time point and the index data corresponding to each time point among the multiple neighboring time points of the point; based on the neighboring correlation characteristics, the multiple index data corresponding to the multiple neighboring time points are dimensionally reduced processing to obtain the associated neighbor data corresponding to each time point; and dividing a plurality of associated neighbor data corresponding to consecutive time points to determine the abnormal time point of the index data from the consecutive time points. This method improves the accuracy of anomaly detection for multiple index data with different neighbor correlations.

Description

Time series data anomaly detection method, device, equipment and storage medium

technical field

The present disclosure relates to the technical field of data processing, and in particular, to a method, apparatus, device, and readable storage medium for abnormal detection of time series data.

Background technique

In real life, some time series indicators with complex correlations can be obtained through statistics. Each time point corresponds to an indicator or a group of indicator data, and there is no necessary connection between the sample data at each time point. For example, economic indicators such as the Gross Domestic Product (GDP) of a certain region are affected by many factors, and the index value of the historical year has a certain influence on the index of the current year. When making some decisions on regional development, it will analyze the relevant indicators of the development of the region in historical years, such as GDP, population, employment, etc., to detect abnormality in the indicator data, detect abnormal historical time points, and Analyze exception causes to provide accurate decision support.

Usually there are many categories of indicators for anomaly detection, and the situation of each indicator is quite different. For example, economic indicators include the total amount of social consumer goods, various parts of the household consumption structure, investment in fixed assets in various industries, and the export value of various commodities. In related technologies, a unified model algorithm is usually used to detect anomalies of different time series indicators, and the accuracy of anomaly detection for multiple categories of indicators using a unified model is low.

As mentioned above, how to provide the accuracy of anomaly detection for multiple categories of time series indicators has become an urgent problem to be solved.

The above information disclosed in this Background section is only for enhancement of understanding of the background of the disclosure and therefore it may contain information that does not form the prior art that is already known to a person of ordinary skill in the art.

SUMMARY OF THE INVENTION

The purpose of the present disclosure is to provide a time series data anomaly detection method, device, device and readable storage medium, which at least to a certain extent improve the accuracy of anomaly detection for various types of time series indicators.

Other features and advantages of the present disclosure will become apparent from the following detailed description, or be learned in part by practice of the present disclosure.

According to an aspect of the present disclosure, a method for detecting anomalies in time series data is provided, including: acquiring time series data, where the time series data is a sequence of index data corresponding to each time point in consecutive time points; Corresponding indicator data obtains a neighbor correlation feature, and the neighbor correlation feature is used to represent the difference between the indicator data corresponding to each neighbor time point and the indicator data corresponding to each time point among the multiple neighbor time points of each time point. dimensionality reduction processing is performed on the multiple index data corresponding to the multiple neighboring time points based on the neighbor correlation feature, and the associated neighboring data corresponding to each time point is obtained; A plurality of the associated neighbor data are divided to determine the time point at which the index data is abnormal from the consecutive time points.

According to an embodiment of the present disclosure, the time series data includes index data of a plurality of similar areas corresponding to the respective time points; the acquiring the time series data includes: acquiring the first predetermined area corresponding to the respective time points index data; obtain the index data of the second predetermined area corresponding to each time point; when the similarity between the index data of the first predetermined area and the index data of the second predetermined area is greater than a preset threshold, obtain the index data of the second predetermined area. The plurality of similar areas includes the first predetermined area and the second predetermined area.

According to an embodiment of the present disclosure, the neighborhood correlation feature includes a first dimension and a second dimension, the first dimension is a sequence of neighboring time points, and the second dimension is information corresponding to the sequence of neighboring time points Gain sequence; the obtaining the neighbor correlation feature according to the index data corresponding to each time point includes: acquiring the index data corresponding to each neighbor time point of the each time point; based on the index data corresponding to each time point and all The information gain sequence corresponding to the sequence of adjacent time points is calculated according to the index data corresponding to each adjacent time point of each time point.

According to an embodiment of the present disclosure, the performing dimensionality reduction processing on multiple index data corresponding to the multiple neighboring time points based on the neighboring correlation feature includes: based on the neighboring related feature Determine the associated neighboring time points of each time point in the time point; determine the dimension of the indicator data after dimension reduction according to the associated neighboring time points of each time point; The indicator data is reduced to the dimension of the indicator data after the dimension reduction.

According to an embodiment of the present disclosure, the determining the dimension of the dimension-reduced indicator data according to the associated neighboring time points of the respective time points includes: determining according to the associated neighboring time points of the respective time points based on the neighbor correlation feature. The dimension of the indicator data after dimension reduction.

According to an embodiment of the present disclosure, the performing dimensionality reduction processing on multiple index data corresponding to the multiple neighboring time points based on the neighboring correlation feature includes: based on the neighboring related feature Determining the associated neighbor time points of the respective time points in the time points; the obtaining the associated neighbor data corresponding to the respective time points includes: obtaining the index data corresponding to the associated neighbor time points of the respective time points after dimensionality reduction the associated neighbor data.

According to an embodiment of the present disclosure, the dividing a plurality of the associated neighbor data corresponding to the continuous time points to determine the abnormal time points of the index data from the continuous time points includes: according to the continuous time points Obtaining an isolation tree corresponding to a plurality of the associated neighbor data; respectively obtaining outliers of each of the associated neighbor data corresponding to the continuous time points based on the isolation tree; obtaining the time corresponding to the associated neighbor data when the abnormal value is greater than a preset threshold The point is the time point when the indicator data is abnormal.

According to still another aspect of the present disclosure, there is provided a time series data anomaly detection device, comprising: a data acquisition module for acquiring time series data, where the time series data is a sequence of index data corresponding to each time point in consecutive time points ; Relevance feature extraction module, used to obtain the neighbor relevance feature according to the index data corresponding to each time point, and the neighbor relevance feature is used to represent each neighbor time point in the multiple neighbor time points of each time point. Correlation between the corresponding index data and the index data corresponding to the respective time points; the index dimension reduction module is used to reduce the multiple index data corresponding to the multiple neighboring time points based on the neighbor correlation feature dimensional processing, to obtain the associated neighbor data corresponding to each time point; an anomaly detection module, configured to divide a plurality of the associated neighbor data corresponding to the continuous time points to determine the abnormality of the index data from the continuous time points time point.

According to an embodiment of the present disclosure, the time series data includes index data of a plurality of similar regions corresponding to each time point; the data acquisition module is further configured to acquire a first predetermined region corresponding to each time point The indicator data of the first predetermined area is obtained; the indicator data of the second predetermined area corresponding to each time point is obtained; the data acquisition module further includes a similar area aggregation module, which is used for the indicator data in the first predetermined area and the second predetermined area. When the similarity of the index data of the predetermined area is greater than a preset threshold, the plurality of similar areas are obtained, and the plurality of similar areas include the first predetermined area and the second predetermined area.

According to an embodiment of the present disclosure, the neighborhood correlation feature includes a first dimension and a second dimension, the first dimension is a sequence of neighboring time points, and the second dimension is information corresponding to the sequence of neighboring time points Gain sequence; the correlation feature extraction module is further configured to: obtain the index data corresponding to each neighbor time point of each time point; based on the index data corresponding to each time point and each neighbor time of each time point The information gain sequence corresponding to the adjacent time point sequence is calculated from the index data corresponding to the point.

According to an embodiment of the present disclosure, the indicator dimensionality reduction module is further configured to: determine an associated neighbor time point of each time point from the plurality of neighbor time points based on the neighbor correlation feature; The associated neighboring time points of the time points determine the dimension of the index data after the dimension reduction; the multiple index data corresponding to the multiple neighboring time points are dimension-reduced to the dimension of the index data after the dimension reduction through the principal component analysis method.

According to an embodiment of the present disclosure, the indicator dimension reduction module is further configured to determine the dimension of the indicator data after dimension reduction according to the associated neighbor time points of the respective time points based on the neighbor correlation feature.

According to an embodiment of the present disclosure, the indicator dimensionality reduction module is further configured to determine, from the plurality of neighbor time points, the associated neighbor time points of the respective time points based on the neighbor correlation feature; obtain the respective time points The index data corresponding to the associated neighbor time point of the point is the associated neighbor data after dimension reduction.

According to an embodiment of the present disclosure, the anomaly detection module is further configured to: obtain an isolation tree according to a plurality of the associated neighbor data corresponding to the continuous time points; respectively obtain the corresponding data of the continuous time points based on the isolation tree The abnormal value of each of the associated neighbor data is obtained; the time point corresponding to the associated neighbor data obtained when the abnormal value is greater than the preset threshold value is the time point when the indicator data is abnormal.

According to yet another aspect of the present disclosure, there is provided an apparatus comprising: a memory, a processor, and executable instructions stored in the memory and executable in the processor, the processor executing the executable instructions When implementing any of the above methods.

According to yet another aspect of the present disclosure, there is provided a computer-readable storage medium on which computer-executable instructions are stored, and when the executable instructions are executed by a processor, implement any of the above methods.

In the method for detecting anomalies in time series data provided by the embodiments of the present disclosure, a neighborhood correlation feature is obtained according to the index data corresponding to each time point, and a dimensionality reduction process is performed on a plurality of index data corresponding to a plurality of neighboring time points based on the neighborhood correlation feature. , obtain the associated neighbor data corresponding to each time point, and divide multiple associated neighbor data corresponding to consecutive time points to determine the abnormal time points of the indicator data from the consecutive time points, so that the indicators associated with each time point can be filtered. In order to improve the accuracy of anomaly detection for various index data with different neighbor correlations, the index data of the nearest neighbor time point with strong correlation is used as the object of anomaly detection.

It is to be understood that the foregoing general description and the following detailed description are exemplary only and do not limit the present disclosure.

Description of drawings

The above and other objects, features and advantages of the present disclosure will become more apparent from the detailed description of example embodiments thereof with reference to the accompanying drawings.

FIG. 1 shows a schematic diagram of a system structure in an embodiment of the present disclosure.

FIG. 2 shows a flowchart of a method for detecting anomalies in time series data in an embodiment of the present disclosure.

Fig. 3A is a flow chart showing a method for region aggregation for obtaining anomaly detection data according to an exemplary embodiment.

FIG. 3B shows a heat map of the similarity of financial sector gross regional product, according to an exemplary embodiment.

Figure 3C shows the corporate income tax revenue index curve of Meishan City from 2000 to 2018.

Figure 3D shows the Dazhou corporate income tax revenue index curve from 2000 to 2018.

Figure 3E shows the index curve of corporate income tax revenue in Suining from 2000 to 2018.

Figure 3F shows the Mianyang corporate income tax revenue index curve from 2000 to 2018.

Figure 3G shows a clustering diagram of the similarity of the four cities' corporate income tax revenue indicators.

Fig. 4A is a flowchart showing a feature dimension reduction method for anomaly detection according to an exemplary embodiment.

FIG. 4B shows a schematic diagram of a left and right subtree division according to an embodiment.

FIG. 4C shows a histogram of the importance of the real estate industry over the past 5 years, according to an embodiment.

FIG. 4D shows a histogram of the importance of the construction industry over the past 5 years, according to an embodiment.

FIG. 4E shows a dimensionality-reduced scatter plot of real estate total value neighbor time point data according to FIG. 4C .

Fig. 5 is a flowchart showing another feature dimension reduction method according to an exemplary embodiment.

Fig. 6A is a flowchart of a method for determining an abnormal point according to an exemplary embodiment.

FIG. 6B shows a schematic diagram of a sample cutting process according to an embodiment.

FIG. 6C shows another schematic diagram of a sample cutting process according to an embodiment.

FIG. 6D shows a schematic diagram of an isolation tree according to an embodiment.

FIG. 6E shows a graph of changes over time in the number of full-time teachers in ordinary institutions of higher learning in Sichuan Province and a graph of corresponding abnormal scores, according to an embodiment.

Fig. 7 is a block diagram of a device for detecting abnormality in time series data according to an exemplary embodiment.

Fig. 8 is a block diagram of another apparatus for detecting abnormality in time series data according to an exemplary embodiment.

FIG. 9 shows a schematic structural diagram of an electronic device in an embodiment of the present disclosure.

Detailed ways

Example embodiments will now be described more fully with reference to the accompanying drawings. Example embodiments, however, can be embodied in various forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the concept of example embodiments to those skilled in the art. The drawings are merely schematic illustrations of the present disclosure and are not necessarily drawn to scale. The same reference numerals in the drawings denote the same or similar parts, and thus their repeated descriptions will be omitted.

Furthermore, the described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments. In the following description, numerous specific details are provided in order to give a thorough understanding of the embodiments of the present disclosure. However, those skilled in the art will appreciate that the technical solutions of the present disclosure may be practiced without one or more of the specific details, or other methods, devices, steps, etc. may be employed. In other instances, well-known structures, methods, devices, implementations, or operations have not been shown or described in detail to avoid obscuring aspects of the present disclosure.

In addition, the terms "first", "second", etc. are used for descriptive purposes only, and should not be construed as indicating or implying relative importance or implying the number of indicated technical features. Thus, a feature defined as "first" or "second" may expressly or implicitly include one or more of that feature. In the description of the present disclosure, "plurality" means at least two, such as two, three, etc., unless expressly and specifically defined otherwise. The symbol "/" generally indicates that the related objects are an "or" relationship.

In the present disclosure, unless otherwise expressly specified and limited, terms such as "connection" should be interpreted in a broad sense, for example, it may be an electrical connection or may communicate with each other; it may be directly connected or indirectly connected through an intermediate medium. For those of ordinary skill in the art, the specific meanings of the above terms in the present disclosure can be understood according to specific situations.

As mentioned above, there is no necessary connection between the sample data of various time points of a certain type of indicator, and the indicator value of the historical year has a certain influence on the indicator of the current year. When analyzing the indicators of the historical year for abnormal detection, it is necessary to consider the overall situation. development trend. However, the impact of different categories of indicators may be different in the historical years of the current year indicator, so the accuracy of anomaly detection using a unified model is low. Therefore, the present disclosure provides a method for detecting anomalies in time series data, by obtaining neighbor correlation features according to index data corresponding to each time point, and performing dimension reduction on multiple index data corresponding to multiple neighboring time points based on the neighbor correlation features Process, obtain the associated neighbor data corresponding to each time point, and divide a plurality of associated neighbor data corresponding to consecutive time points to determine the abnormal time point of the indicator data from the consecutive time points, so that the indicators related to each time point can be filtered. The adjacent time point index data with strong correlation is used as the object of anomaly detection to improve the accuracy of anomaly detection for various index data with different adjacent correlations.

FIG. 1 shows an exemplary system architecture 10 to which the time series data anomaly detection method or the time series data anomaly detection apparatus of the present disclosure may be applied.

As shown in FIG. 1 , the system architecture 10 may include terminal devices 102 , a network 104 , a server 106 and a database 108 . The terminal device 102 can be various electronic devices with a display screen and supporting input and output, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, wearable devices, virtual reality devices, smart homes, etc. . The network 104 is the medium used to provide the communication link between the terminal device 102 and the server 106 . The network 104 may include various connection types, such as wired, wireless communication links, or fiber optic cables, among others. The server 106 may be a server or server cluster or the like that provides various services. The database 108 can be a large database software placed on a server, or a small database software installed on a computer for storing and managing data.

The user can use the terminal device 102 to interact with the server 106 and the database 108 through the network 104 to receive or send data and the like. For example, the user imports the index data list on the terminal device 102 , uploads the index data to the server 106 through the network 104 for abnormal analysis, or uploads the index data to the database 108 through the network 104 for storage. For another example, the user obtains similar index data of multiple regions from the database 108 through the network 104, and performs processing on the terminal device 102 to obtain similar regions.

The server 106 may also receive data from the database 108 or send data to the database 108 through the network 104, or the like. For example, the server 106 may be a background processing server, configured to obtain the index data to be subjected to anomaly detection from the database 108 through the network 104 . For another example, the server 106 may be configured to obtain similar index data in multiple regions from the database 108 through the network 104 and perform regional aggregation, and transmit the aggregated index data to the database 108 through the network 104 for storage.

It should be understood that the numbers of terminal devices, networks, servers and databases in FIG. 1 are merely illustrative. There can be any number of terminal devices, networks, servers and databases according to implementation needs.

Fig. 2 is a flow chart of a method for detecting anomalies in time series data according to an exemplary embodiment. The method shown in FIG. 2 can be applied to, for example, the server side of the above-mentioned system, and can also be applied to the terminal device of the above-mentioned system.

Referring to FIG. 2 , the method 20 provided by the embodiment of the present disclosure may include the following steps.

In step S202, time-series data is acquired, where the time-series data is a sequence of index data corresponding to each time point in consecutive time points. Consecutive time points can be consecutive years, and the sequence of indicator data can be indicator data corresponding to each year in consecutive years. number of people. The consecutive time points may also be consecutive months, quarters, half-years, etc., for example, a sequence of indicator data of real estate fixed asset investment in consecutive quarters from 2000 to 2019.

In some embodiments, for example, when performing statistics on the index data with the year as the time point, if there are only some index data in recent years, the amount of time series data in an area to be anomaly detected is relatively small, such as the regional economic Relevant indicators: GDP, number of graduates, etc. Some indicators may start to be counted after 2000, so the historical value of a single indicator is very small, and there are only 20 historical reference values for a region, and there are data related to the year of the year. It may be the data of the past three years, so the sample size obtained for subsequent time series feature modeling and anomaly point division is small, resulting in a decrease in the accuracy of anomaly detection. When acquiring time-series data, data in regions with similar index data may be aggregated. For specific implementations, reference may be made to FIG. 3A to FIG. 3G , which will not be described in detail here.

In step S204, the neighbor correlation feature is obtained according to the index data corresponding to each time point, and the neighbor correlation feature is used to represent the index data corresponding to each neighbor time point among the multiple neighbor time points at each time point and the corresponding value of each time point. Correlations between indicator data. Indicator time series anomalies are usually defined as points with a large gap with the recent indicator values that may be abnormal. Therefore, the indicator data of the adjacent time points of the indicator data at each time point can be obtained first to extract the adjacent correlation characteristics. 1-5 years of data, used to extract the nearest neighbor association features.

In some embodiments, for example, the Gini coefficient can be used to calculate the correlation (importance) between the indicators of the neighboring time point and the indicators of the current time point, and then obtain the neighboring correlation feature according to the neighboring correlation.

In some embodiments, for example, the correlation (importance) between the indicators of the nearest neighbor time point and the indicators of the current time point can be measured by information gain, and then the feature of the nearest neighbor correlation can be obtained according to the nearest neighbor correlation. For the specific implementation, please refer to Figures 4A to 4D will not be described in detail here.

In step S206, dimensionality reduction processing is performed on a plurality of index data corresponding to a plurality of adjacent time points based on the adjacent correlation feature, and the associated adjacent data corresponding to each time point is obtained. After the correlation feature extraction, the neighboring time points that have a greater impact on the indicators of each time point can be obtained, that is, the neighboring time points with strong correlation (or more important), and the index data of these neighboring time points can be reduced. Dimensional processing can reduce the N-dimensional index data of N (N is a positive integer greater than 2) neighboring time points corresponding to each time point to 2 dimensions, and obtain 2-dimensional associated neighbor data corresponding to each time point.

In step S208, a plurality of associated neighbor data corresponding to consecutive time points are divided to determine the abnormal time point of the index data from the consecutive time points. After obtaining the associated neighboring data points corresponding to each time point, these data points can be divided for anomaly detection.

In some embodiments, for example, an isolation forest can be used as an anomaly detection model to divide the associated neighboring data points. The specific implementation can be referred to FIG. 6A to FIG. 6D , which will not be described in detail here.

In other embodiments, for example, a probability distribution model can be constructed based on statistical methods, and the probability that the 2-dimensional features of each data point conform to the model can be calculated, and objects with low probability can be regarded as abnormal points, such as in feature engineering. The RobustScaler method and more. For another example, outlier detection can be done based on the clustering method. If it is found after clustering that the data sample size of some clusters is much smaller than that of other clusters, and the value of the characteristic mean distribution of the data in this cluster is different from that of other clusters. It is also very different. The sample points in these clusters can be considered as abnormal points, such as BIRCH clustering algorithm, DBSCAN density clustering algorithm and so on.

According to the method for detecting anomaly in time series data provided by the embodiment of the present disclosure, the neighborhood correlation feature is obtained according to the index data corresponding to each time point, and the dimension reduction processing is performed on the multiple index data corresponding to the multiple neighboring time points based on the neighboring correlation feature. , obtain the associated neighbor data corresponding to each time point, and divide multiple associated neighbor data corresponding to consecutive time points to determine the abnormal time points of the indicator data from the consecutive time points, so that the indicators associated with each time point can be filtered. In order to improve the accuracy of anomaly detection for various index data with different neighbor correlations, the index data of the nearest neighbor time point with strong correlation is used as the object of anomaly detection.

Fig. 3A is a flow chart showing a method for region aggregation for obtaining anomaly detection data according to an exemplary embodiment. FIG. 3A can be used as the processing procedure of step S202 shown in FIG. 2 in one embodiment. When performing statistics on the index data with the year as the time point, there may be less historical data of the index in an area to be abnormally detected, and the data of similar areas can be aggregated through the implementation of FIG. 3A to FIG. 3G to expand the sample size. . For example, the method shown in FIG. 3A can be applied to the server side of the above-mentioned system, and can also be applied to the terminal device of the above-mentioned system.

Referring to FIG. 3A , the method 30 provided by the embodiment of the present disclosure may include the following steps.

In step S302, the index data of the first predetermined area corresponding to each time point is acquired.

In step S304, the index data of the second predetermined area corresponding to each time point is acquired. The purpose of region aggregation is to assist target regions to perform anomaly detection based on a small amount of data and with the help of the historical conditions of similar regions. The first predetermined area and the second predetermined area can be two provinces, cities, counties, etc. with similar situations. Including the data of each year in the past 20 years, the same index data of Chengdu, the capital of Sichuan Province, or the same index data of Chongqing, which has similar economic conditions, can be used to assist decision-making.

In step S306, when the similarity between the index data of the first predetermined area and the index data of the second predetermined area is greater than a preset threshold, obtain multiple similar areas, and the multiple similar areas include the first predetermined area and the second predetermined area .

In some embodiments, for example, cosine similarity may be used to measure the similarity of historical indicators of different regions. For example, the first predetermined area is represented as i, the index sequence of the first predetermined area is represented as a vector x _i , the second predetermined area is represented as j, the index sequence of the second predetermined area is represented as a vector x _j , wherein the first predetermined area is represented as a vector x j . The time points corresponding to the index of the area and the index of the second predetermined area are the same, that is, the vector length of the index sequence of the first predetermined area and the index sequence of the second predetermined area are the same, then the similarity between the first predetermined area and the second predetermined area is S _i,j can be calculated by the following formula:

表示区域i和区域j的内积，||x_i||表示区域i的指标向量x_i的二范式，||x_j||表示区域j的指标向量x_j的二范式，以区域i的二范式为例，计算公式为：in,

represents the inner product of region i and region j, ||x _i || represents the second normal form of the indicator vector x _i of region i, ||x _j || represents the second normal form of the indicator vector x _j of region j, and the Take the second normal form as an example, the calculation formula is:

In the formula, k represents the length of the vector x _i , and k is a positive integer.

After calculating the cosine similarity between the indicators of each region, a heat map of the regional similarity can be obtained to visually display the similarity of the indicators between the regions. For example, Figure 3B shows a heatmap of the similarity of GDP in the financial sector. As shown in Figure 3B, the regional production of the financial industry between each of Leshan City, Neijiang City, Nanchong City, Sichuan Province, Yibin City, Deyang City, Chengdu City, Luzhou City, Mianyang City, and Zigong City was calculated respectively. The cosine similarity score of the gross value index is displayed in the form of a heat map. It can be seen that Chengdu and Deyang are the most similar to Sichuan Province in terms of the gross domestic product of the financial industry. Chengdu is the capital of Sichuan Province, and the financial production indicators of Chengdu directly affect the indicators of Sichuan Province.

In other embodiments, for example, a similarity matrix of regional indicators may also be used to perform clustering, and a similar area of a predetermined area may be obtained through a clustering effect. As shown in Figure 3C-Figure 3G, Figure 3C shows the corporate income tax revenue index curve of Meishan City from 2000 to 2018, Figure 3D shows the corporate income tax revenue index curve of Dazhou City from 2000 to 2018, Figure 3E shows From 2000 to 2018, the corporate income tax revenue index curve of Suining City is shown. Figure 3F shows the corporate income tax revenue index curve of Mianyang City from 2000 to 2018. From the figure, we can see that the fluctuation laws of Mianyang and Suining are similar. , the fluctuation laws of Meishan and Dazhou are similar; Figure 3G shows the similarity cluster diagram of the corporate income tax revenue index of the four cities. From the clustering effect, it can be seen that Meishan and Dazhou are the closest, and Mianyang and Suining are the closest.

In step S308, index data of multiple similar regions corresponding to each time point is acquired. The purpose of region aggregation is to assist target regions to perform anomaly detection based on a small amount of data and with the help of the historical conditions of similar regions. For example, for the small amount of data in Sichuan Province, we can use Chengdu, the capital of Sichuan Province, and Chongqing, which has similar economic conditions, to assist in decision-making.

According to the area aggregation method provided by the embodiment of the present disclosure, when the historical data of each area is small, the aggregation of similarity areas is performed according to the curve of the historical index, and the auxiliary modeling of similar areas is used to effectively solve the problem of the small amount of data in the target area. This improves the accuracy of subsequent anomaly detection.

Fig. 4A is a flowchart showing a feature dimension reduction method for anomaly detection according to an exemplary embodiment. FIG. 4A can be used as the processing procedure of step S206 shown in FIG. 2 in one embodiment. The method shown in FIG. 4A can be applied to, for example, the server side of the above-mentioned system, and can also be applied to the terminal device of the above-mentioned system.

Referring to FIG. 4A , the method 40 provided by the embodiment of the present disclosure may include the following steps.

In step S402, index data corresponding to each neighboring time point of each time point is acquired. Indicator time series anomalies are usually defined as points with a large gap with recent indicator values that may be anomalies. For example, take the nearest 1-5 years of each year as the nearest neighbor time point, and determine the difference between the data of each time point in the past five years and the time point. Whether the correlation has changed abnormally.

In step S404, an information gain sequence corresponding to the sequence of neighboring time points is calculated based on the index data corresponding to each time point and the index data corresponding to each neighboring time point of each time point. The correlation between neighboring time points and corresponding time points can be measured by information gain.

In some embodiments, for example, the nearest neighbor time points such as each year are represented as cp ∈ {c ₀ , c ₁ , c ₂ , c ₃ , c ₄ }, _p ∈ {0, 1 , 2, 3, 4}, then the information gain I _p corresponding to each c _p can be calculated by the following formula:

表示各个时间段的近邻时间点c_p的指标值的均值，

中

和

分别表示指标序列数据按照

划分的左子树数据集和右子树数据集，y_k′为左子树数据集或右子树数据集中的数据，

为左子树数据集或右子树数据集中的数据的均值。图4B中根据一实施例示出了一种左右子树划分的示意图。如图4B所示，在

时，

中的数据y₁至y₆都比

小，

中的数据y₁至y₆都比

大。根据式(3)信息增益的计算方式，可得出每个近邻时间点与对应时间点的关联性，即每个近邻时间点的重要性。图4C中根据一实施例示出了房地产业近5年的重要性直方图。图4D中根据一实施例示出了建筑业近5年的重要性直方图。如图4C所示，对于房地产生产总值的指标，近三年的值对当前值贡献最大，时间相隔越久，特征重要性下降越快。不同经济指标重要的特征不同，如图4D所示，对于建筑业来说，近1年和之前第5年影响最大，说明建筑行业具有周期性，周期性特征影响比较大。也可根据图3A的方法进行区域聚合获得聚合数据，则对应式(3)中的指标总数量k应为一个区域的指标数乘以聚合区域数。where y _k represents the k-th indicator value in the indicator sequence, Q represents the indicator sequence data set,

represents the mean value of the index values of the neighboring time points _cp in each time period,

middle

and

Respectively represent the index series data according to

The divided left subtree data set and right subtree data set, y _k′ is the data in the left subtree data set or the right subtree data set,

is the mean of the data in the left subtree dataset or the right subtree dataset. FIG. 4B shows a schematic diagram of a left and right subtree division according to an embodiment. As shown in Figure 4B, in

hour,

The data in y ₁ to y ₆ are more than

Small,

The data in y ₁ to y ₆ are more than

big. According to the calculation method of the information gain of the formula (3), the correlation between each neighboring time point and the corresponding time point can be obtained, that is, the importance of each neighboring time point. FIG. 4C shows the importance histogram of the real estate industry in the past five years according to an embodiment. FIG. 4D shows a histogram of the importance of the construction industry over the past 5 years, according to an embodiment. As shown in Figure 4C, for the indicator of gross real estate production, the values in the past three years contribute the most to the current value, and the longer the time interval, the faster the feature importance declines. The important characteristics of different economic indicators are different. As shown in Figure 4D, for the construction industry, the recent 1 year and the previous 5 years have the greatest impact, indicating that the construction industry is cyclical, and the cyclical characteristics have a greater impact. The aggregated data can also be obtained by performing regional aggregation according to the method shown in FIG. 3A , then the total number of indicators k in the corresponding formula (3) should be the number of indicators in a region multiplied by the number of aggregated regions.

In step S406, the associated neighbor time point of each time point is determined from the plurality of neighbor time points based on the neighbor correlation feature. The neighbor correlation feature includes a first dimension and a second dimension, the first dimension is a sequence of neighbor time points, and the second dimension is an information gain sequence corresponding to the sequence of neighbor time points. Taking Fig. 4C as an example, c ₀ , c ₁ , and c ₂ in the past three years are selected as the time points of the associated neighbors, and the corresponding information gain sequence {I ₀ , I ₁ , I ₂ } is {0.7×10 ⁶ , 1.18×10 ⁶ , 1.35×10 ⁶ }.

In step S408, the dimension of the index data after dimension reduction is determined according to the associated adjacent time points of each time point. The dimension of the indicator data after dimensionality reduction is determined according to the associated neighboring time points of each time point based on the neighbor correlation feature.

In some embodiments, for example, if the sequence length of the neighbor correlation feature is 3, that is, the number of time points associated with the neighbors is 3, it can be determined that the dimension-reduced index data is 3-dimensional. Not detailed.

In some embodiments, for example, if the principal component analysis method is used for dimensionality reduction, the dimensionality reduction index data may be first determined to be 2-dimensional, and then the dimensionality reduction is performed on the index data (eg, 3-dimensional index data) associated with neighboring time points. operate.

In step S410, a principal component analysis method is used to reduce the dimension of the multiple index data corresponding to the multiple neighboring time points to the dimension of the index data after the dimension reduction. For example, the indicator data associated with neighboring time points can be transformed into 2-dimensional data through linear transformation. The meaning of the transformed two dimensions has nothing to do with the meaning of the indicator itself, and is used to indicate the relationship between the associated neighboring time points and the indicator data at the corresponding time point. .

In some embodiments, for example, the dimensionality-reduced data can be visualized in a two-dimensional coordinate system to obtain a two-dimensional data scatter plot. FIG. 4E shows a dimensionality-reduced scatter plot of real estate total value neighbor time point data according to FIG. 4C . As shown in Figure 4E, the total value of real estate in the region, except for some anomalies at some time points in a few regions, generally presents a clustered structure, indicating that the real estate laws are similar in most regions for most of the time. Points that are far away from most of the data points can be obtained from the scatter plot as outliers.

According to the data dimensionality reduction method for neighboring time points provided by the embodiment of the present disclosure, the correlation features are measured through information gain, and more important neighboring time points are screened out, and the correlation between features is comprehensively considered, and related features are integrated to eliminate noise features. Key features are preserved, improving the accuracy of anomaly detection.

Fig. 5 is a flowchart showing another feature dimension reduction method according to an exemplary embodiment. FIG. 5 can be used as the processing procedure of step S206 shown in FIG. 2 in another embodiment. The method shown in FIG. 5 can be applied to, for example, the server side of the above-mentioned system, and can also be applied to the terminal device of the above-mentioned system.

Step S502: Determine the associated neighbor time point of each time point from the multiple neighbor time points based on the neighbor correlation feature. Taking Fig. 4D as an example, select the last year c ₀ and the previous fifth year c ₄ as the associated neighbor time points, the corresponding information gain sequence {I ₀ , I ₄ } is {5.8×10 ⁶ , 1.5×10 ⁶ , 1.35 ×10 ⁶ }.

In step S504, the index data corresponding to the associated neighbor time points of each time point is obtained as the dimension-reduced associated neighbor data. Taking Figure 4D as an example, you can directly select the construction industry GDP indicator data of the last year c ₀ and the previous fifth year c ₄ as the dimensionality reduction (time, index) 2-dimensional data, or you can use the data in the second Visual display in a 2D coordinate system to obtain a 2D scatter plot of data in order to find outlier data points.

Fig. 6A is a flowchart of a method for determining an abnormal point according to an exemplary embodiment. FIG. 6A can be used as the processing procedure of step S308 shown in FIG. 3 in one embodiment. The method shown in FIG. 6A can be applied to, for example, the server side of the above-mentioned system, and can also be applied to the terminal device of the above-mentioned system.

Referring to FIG. 6A , the method 60 provided by the embodiment of the present disclosure may include the following steps.

Step S602, obtaining an isolation tree according to a plurality of associated neighbor data corresponding to consecutive time points. The associated neighbor data after dimensionality reduction can be described by an isolation forest. First, randomly select n sample points from the associated neighbor data as the root node of the isolated tree, randomly specify a dimension (from two dimensions), and randomly generate a cutting point within the data range of the current root node, which is generated at the current Between the maximum and minimum values of the specified dimension in the node data; the selection of this cutting point generates a hyperplane, which divides the current root node data space into 2 subspaces, and places the points smaller than the cutting point in the specified dimension on the current On the left branch of the root node, put the point greater than the cutting point on the right branch of the current root node; recursively first two steps in the left branch node and right branch node of the current root node, and continuously construct new leaf nodes until there are only A stat (no further cuts can be made) or the tree has grown to the set height.

In some embodiments, for example, FIG. 6B shows a schematic diagram of a sample cutting process according to an embodiment, and FIG. 6C shows a schematic diagram of another sample cutting process according to an embodiment. As shown in FIG. 6B and FIG. 6C , compared with At the _zi point, the z ₀ point can be divided in fewer steps. FIG. 6D shows a schematic diagram of an isolated tree according to an embodiment. As shown in FIG. 6D , x and y respectively represent the values of two dimensions, and the (8.7, 9.2) node in the tree may correspond to the z ₀ point.

Step S604, based on the isolation tree, obtain outliers of each associated neighbor data corresponding to consecutive time points, respectively. After the isolation tree is constructed, only predictions can be made for each associated neighbor data, that is, to see which leaf node the data falls on. The average path length can be used to measure the abnormality of each sample point, and the path length is the number of edges passed from the root node to the leaf node of the isolated tree. The abnormal score u(x, n) of the sample point (x, y) among the n sample points can be calculated by the following formula:

In the formula, h(x) is the path length, which represents the total path length required to traverse from the root node of the isolated tree to the leaf node x, and E(h(x)) represents the multiple sampling of the associated neighbor data to obtain more The average path length of the leaf node x corresponding to an isolation tree. q(n) represents the mean value of the path length when the number of sampling samples is n, and is used to normalize the path length h(x) of the root node sample x. H(n-1) is a harmonic number, which is a fixed value when n is determined.

Step S606, obtaining the time point corresponding to the associated neighbor data when the abnormal value is greater than the preset threshold value is the time point when the index data is abnormal.

In some embodiments, for example, FIG. 6E shows a graph of changes over time in the number of full-time teachers in ordinary colleges and universities in Sichuan Province and a corresponding abnormal score graph according to an embodiment. As shown in FIG. 6E , the horizontal axis represents the year, and the vertical axis of the above figure represents the year. The number of teachers, the vertical axis of the figure below represents the abnormal score, and it can be seen that the time points when the number of teachers plummets and rises are possible anomalies. The dotted line parallel to the horizontal axis represents the preset threshold, which can be calculated based on the percentage of abnormal scores. For example, the threshold set in FIG. 6E is 3%, that is, the nodes with the top 3% abnormal score can be judged as abnormal. Points A and B belong to a sudden drop, and point C belongs to a sudden rise. In the early stage, the fluctuations rose or fell, and the number of teachers suddenly dropped or rose sharply. Such situations can be considered as abnormal points identified.

According to the anomaly detection method provided by the embodiment of the present disclosure, an anomaly score is calculated based on an isolated tree for associated neighboring data points, and a possible abnormal time point is screened out according to the anomaly score, which is more efficient than the method of directly setting a threshold in the indicator dimension to determine anomaly. precise.

Fig. 7 is a block diagram of a device for detecting abnormality in time series data according to an exemplary embodiment. The apparatus shown in FIG. 7 can be applied to, for example, the server side of the above-mentioned system, and can also be applied to the terminal device of the above-mentioned system.

Referring to FIG. 7 , the apparatus 70 provided by the embodiment of the present disclosure may include a data acquisition module 702 , a correlation feature extraction module 704 , an index dimension reduction module 706 , and an abnormality detection module 708 .

The data acquisition module 702 may be configured to acquire time series data, where the time series data is a sequence of index data corresponding to each time point in consecutive time points.

The relevance feature extraction module 704 can be used to obtain the neighbor relevance feature according to the index data corresponding to each time point, and the neighbor relevance feature is used to represent the index data corresponding to each neighbor time point among the multiple neighbor time points at each time point and each time point. The correlation between the indicator data corresponding to the point.

The index dimension reduction module 706 may be configured to perform dimension reduction processing on multiple index data corresponding to multiple neighboring time points based on the neighbor correlation feature, and obtain associated neighboring data corresponding to each time point.

The abnormality detection module 708 may be configured to divide a plurality of correlated neighbor data corresponding to consecutive time points to determine the abnormal time points of the indicator data from the consecutive time points.

Fig. 8 is a block diagram of another apparatus for detecting abnormality in time series data according to an exemplary embodiment. The apparatus shown in FIG. 8 can be applied to, for example, the server side of the above-mentioned system, and can also be applied to the terminal device of the above-mentioned system.

8 , the apparatus 80 provided by the embodiment of the present disclosure may include a data acquisition module 802 , a correlation feature extraction module 804 , an index dimension reduction module 806 and an anomaly detection module 808 , where the data acquisition module 802 includes a similar region aggregation module 8022 .

The data acquisition module 802 may be configured to acquire time series data, where the time series data is a sequence of index data corresponding to each time point in consecutive time points. The time series data includes indicator data of multiple similar regions corresponding to each time point.

The data acquisition module 802 may also be configured to acquire the index data of the first predetermined area corresponding to each time point; and acquire the index data of the second predetermined area corresponding to each time point.

The similar area aggregation module 8022 can also be used to obtain multiple similar areas when the similarity between the index data of the first predetermined area and the index data of the second predetermined area is greater than a preset threshold, and the multiple similar areas include the first predetermined area and the second predetermined area. 2. Predetermined area.

The relevance feature extraction module 804 can be used to obtain the neighbor relevance feature according to the index data corresponding to each time point, and the neighbor relevance feature is used to represent the index data corresponding to each neighbor time point among the multiple neighbor time points of each time point and each time point. The correlation between the indicator data corresponding to the point. The neighbor correlation feature includes a first dimension and a second dimension, the first dimension is a sequence of neighbor time points, and the second dimension is an information gain sequence corresponding to the sequence of neighbor time points.

The correlation feature extraction module 804 can also be used to obtain the index data corresponding to each neighboring time point at each time point; based on the index data corresponding to each time point and the index data corresponding to each neighboring time point at each time point, calculate the corresponding sequence of neighboring time points. information gain sequence.

The indicator dimensionality reduction module 806 may be configured to perform dimensionality reduction processing on a plurality of indicator data corresponding to a plurality of neighboring time points based on the neighbor correlation feature, and obtain associated neighbor data corresponding to each time point.

The indicator dimensionality reduction module 806 can also be used to determine the associated neighbor time points of each time point from a plurality of neighbor time points based on the neighbor correlation feature; determine the dimension of the indicator data after dimensionality reduction according to the associated neighbor time points of each time point; The component analysis method reduces the dimension of multiple index data corresponding to multiple neighboring time points to the dimension of the index data after dimension reduction.

The index dimension reduction module 806 may also be configured to determine the dimension of the index data after dimension reduction according to the associated neighboring time points of each time point based on the neighbor correlation feature.

The indicator dimensionality reduction module 806 can also be used to determine the associated neighbor time point of each time point from a plurality of neighbor time points based on the neighbor correlation feature; the index data corresponding to the associated neighbor time point of each time point is obtained as the associated neighbor after dimensionality reduction. data.

The abnormality detection module 808 may be configured to divide a plurality of correlated neighbor data corresponding to consecutive time points to determine the abnormal time points of the indicator data from the consecutive time points.

The anomaly detection module 808 can also be used to: obtain an isolation tree according to a plurality of associated neighbor data corresponding to consecutive time points; obtain outlier values of each associated neighbor data corresponding to consecutive time points based on the isolation tree; obtain an associated neighbor whose abnormal value is greater than a preset threshold The time point corresponding to the data is the time point when the indicator data is abnormal.

For the specific implementation of each module in the apparatus provided by the embodiment of the present disclosure, reference may be made to the content in the foregoing method, which will not be repeated here.

FIG. 9 shows a schematic structural diagram of an electronic device in an embodiment of the present disclosure. It should be noted that the device shown in FIG. 9 is only an example of a computer system, and should not impose any limitations on the functions and scope of use of the embodiments of the present disclosure.

As shown in FIG. 9, the apparatus 900 includes a central processing unit (CPU) 901, which can be processed according to a program stored in a read only memory (ROM) 902 or a program loaded from a storage section 908 into a random access memory (RAM) 903 Various appropriate actions and processes are performed. In the RAM 903, various programs and data necessary for the operation of the device 900 are also stored. The CPU 901 , the ROM 902 , and the RAM 903 are connected to each other through a bus 904 . An input/output (I/O) interface 905 is also connected to bus 904 .

The following components are connected to the I/O interface 905: an input section 906 including a keyboard, a mouse, etc.; an output section 907 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 908 including a hard disk, etc. ; and a communication section 909 including a network interface card such as a LAN card, a modem, and the like. The communication section 909 performs communication processing via a network such as the Internet. A drive 910 is also connected to the I/O interface 905 as needed. A removable medium 911, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is mounted on the drive 910 as needed so that a computer program read therefrom is installed into the storage section 908 as needed.

In particular, according to embodiments of the present disclosure, the processes described above with reference to the flowcharts may be implemented as computer software programs. For example, embodiments of the present disclosure include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the method illustrated in the flowchart. In such an embodiment, the computer program may be downloaded and installed from the network via the communication portion 909, and/or installed from the removable medium 911. When the computer program is executed by the central processing unit (CPU) 901, the above-described functions defined in the system of the present disclosure are executed.

It should be noted that the computer-readable medium shown in the present disclosure may be a computer-readable signal medium or a computer-readable storage medium, or any combination of the above two. The computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus or device, or a combination of any of the above. More specific examples of computer readable storage media may include, but are not limited to, electrical connections with one or more wires, portable computer disks, hard disks, random access memory (RAM), read only memory (ROM), erasable Programmable read only memory (EPROM or flash memory), fiber optics, portable compact disk read only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing. In this disclosure, a computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In the present disclosure, however, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code therein. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the foregoing. A computer-readable signal medium can also be any computer-readable medium other than a computer-readable storage medium that can transmit, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device . Program code embodied on a computer readable medium may be transmitted using any suitable medium including, but not limited to, wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

The flowchart and block diagrams in the Figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code that contains one or more logical functions for implementing the specified functions executable instructions. It should also be noted that, in some alternative implementations, the functions noted in the blocks may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It is also noted that each block of the block diagrams or flowchart illustrations, and combinations of blocks in the block diagrams or flowchart illustrations, can be implemented in special purpose hardware-based systems that perform the specified functions or operations, or can be implemented using A combination of dedicated hardware and computer instructions is implemented.

The modules involved in the embodiments of the present disclosure may be implemented in software or hardware. The described modules can also be set in the processor, for example, it can be described as: a processor includes a data acquisition module, a correlation feature extraction module, an index dimension reduction module and an anomaly detection module. Among them, the names of these modules do not constitute a limitation of the module itself in some cases, for example, the data acquisition module can also be described as "a module that acquires time series data from a connected database server".

As another aspect, the present disclosure also provides a computer-readable medium. The computer-readable medium may be included in the device described in the above-mentioned embodiments, or it may exist alone without being assembled into the device. The above-mentioned computer-readable medium carries one or more programs, and when the above-mentioned one or more programs are executed by a device, the device includes: acquiring time-series data, the time-series data corresponding to each time point in consecutive time points; The sequence of indicator data; the neighbor correlation feature is obtained according to the indicator data corresponding to each time point, and the neighbor correlation feature is used to indicate that the indicator data corresponding to each neighbor time point among the multiple neighbor time points at each time point corresponds to each time point. The correlation between the indicator data; based on the neighbor correlation feature, the dimensionality reduction processing is performed on multiple indicator data corresponding to multiple neighboring time points, and the associated neighbor data corresponding to each time point is obtained; the multiple associated neighbors corresponding to consecutive time points are The data is divided to identify the time points at which the metric data is anomalous from consecutive time points.

Exemplary embodiments of the present disclosure have been specifically shown and described above. It should be understood that this disclosure is not limited to the details of construction, arrangements, or implementations described herein; on the contrary, this disclosure is intended to cover various modifications and equivalent arrangements included within the spirit and scope of the appended claims.

Claims (10)

1. a time series data anomaly detection method, is characterized in that, comprises: obtaining time series data, where the time series data is a sequence of index data corresponding to each time point in the consecutive time points; The neighbor correlation feature is obtained according to the index data corresponding to each time point, and the neighbor correlation feature is used to indicate that the index data corresponding to each neighbor time point among the multiple neighbor time points of each time point is related to the respective time points. The correlation between the indicator data corresponding to the point; Perform dimensionality reduction processing on multiple index data corresponding to the multiple neighboring time points based on the neighbor correlation feature, and obtain the associated neighbor data corresponding to each time point; A plurality of the associated neighbor data corresponding to the continuous time points are divided to determine the abnormal time points of the index data from the continuous time points. 2. The method according to claim 1, wherein the time series data comprises index data of a plurality of similar regions corresponding to the respective time points; The acquiring time series data includes: obtaining the index data of the first predetermined area corresponding to each time point; acquiring the indicator data of the second predetermined area corresponding to each time point; When the similarity between the index data of the first predetermined area and the index data of the second predetermined area is greater than a preset threshold, obtain the plurality of similar areas, the plurality of similar areas including the first predetermined area and the second predetermined area. 3 . The method according to claim 1 , wherein the neighbor correlation feature includes a first dimension and a second dimension, the first dimension is a sequence of neighboring time points, and the second dimension is a relationship with the The information gain sequence corresponding to the sequence of neighboring time points; The obtaining of the neighbor correlation feature according to the index data corresponding to each time point includes: Obtain the indicator data corresponding to each neighboring time point of the each time point; The information gain sequence corresponding to the sequence of neighboring time points is calculated based on the index data corresponding to each time point and the index data corresponding to each neighboring time point of each time point. 4 . The method according to claim 1 , wherein the performing dimensionality reduction processing on the multiple index data corresponding to the multiple neighboring time points based on the neighboring correlation feature comprises: 4 . Determine the associated neighbor time point of each time point from the plurality of neighbor time points based on the neighbor correlation feature; Determine the dimension of the indicator data after dimension reduction according to the associated adjacent time points of each time point; The multiple index data corresponding to multiple neighboring time points are reduced to the dimension of the index data after the dimension reduction by the principal component analysis method. 5. The method according to claim 4, wherein the determining the dimension of the dimension-reduced index data according to the associated neighboring time points of the respective time points comprises: The dimension of the index data after dimension reduction is determined according to the associated neighbor time points of the respective time points based on the neighbor correlation feature. 6 . The method according to claim 1 , wherein the performing dimensionality reduction processing on the multiple index data corresponding to the multiple neighboring time points based on the neighboring correlation feature comprises: 6 . Determine the associated neighbor time point of each time point from the plurality of neighbor time points based on the neighbor correlation feature; The obtaining the associated neighbor data corresponding to each time point includes: Obtaining the index data corresponding to the associated neighbor time points of the respective time points is the associated neighbor data after dimension reduction. 7. The method according to any one of claims 1 to 6, characterized in that, dividing a plurality of the associated neighbor data corresponding to the continuous time points to determine an indicator from the continuous time points The time points of abnormal data include: Obtain an isolation tree according to a plurality of the associated neighbor data corresponding to the continuous time points; Obtain outliers of each of the associated neighbor data corresponding to the consecutive time points based on the isolation tree; The time point corresponding to the obtained abnormal value greater than the preset threshold value and the associated neighbor data is the time point when the index data is abnormal. 8. A device for detecting anomalies in time series data, comprising: a data acquisition module, configured to acquire time series data, where the time series data is a sequence of index data corresponding to each time point in consecutive time points; The correlation feature extraction module is used to obtain the neighbor correlation feature according to the index data corresponding to each time point, and the neighbor correlation feature is used to represent the corresponding time point of each nearest neighbor time point among the multiple nearest neighbor time points of each time point. The correlation between the indicator data and the indicator data corresponding to each time point; An index dimension reduction module, configured to perform dimension reduction processing on multiple index data corresponding to the multiple neighboring time points based on the neighbor correlation feature, and obtain the associated neighboring data corresponding to each time point; An abnormality detection module, configured to divide a plurality of the associated neighbor data corresponding to the continuous time points to determine the abnormal time points of the index data from the continuous time points. 9. A device, comprising: a memory, a processor, and executable instructions stored in the memory and executable in the processor, wherein the processor implements the following when executing the executable instructions. The method of any one of claims 1-7. 10. A computer-readable storage medium having computer-executable instructions stored thereon, characterized in that, when the executable instructions are executed by a processor, the method according to any one of claims 1-7 is implemented.

Images