CN115409066A - Time series data anomaly detection method, device and computer storage medium - Google Patents

Abstract

The method, the device and the computer storage medium decompose time sequence monitoring data, extract high-frequency components and low-frequency components in the time sequence monitoring data, analyze and predict the high-frequency components and the low-frequency components by adopting corresponding models according to the characteristics of the high-frequency components and the low-frequency components respectively, superpose prediction results corresponding to the high-frequency components and the low-frequency components to obtain a prediction value of the data under a future time sequence, and further identify abnormal point data in real data under the future time sequence by taking the prediction value as a basis, so that the real-time detection of the time sequence data can be realized, the abnormal point data in the time sequence data can be found in time, maintenance personnel can be reminded to take corresponding measures as early as possible, and the loss which cannot be compensated is avoided.

Description

Time series data anomaly detection method, device and computer storage medium

technical field

The present application belongs to the technical field of big data processing, and in particular relates to an anomaly detection method, device and computer storage medium for time series data.

Background technique

With the continuous development of the Internet and artificial intelligence, the world is in an era of information explosion, and people pay more and more attention to big data. In the process of information development, data mining and analysis will help people understand The value and laws behind the data. Therefore, information technologies such as big data and data mining are being developed in many fields to promote the development of related fields by discovering the important information hidden behind the data.

Time series data is one of all kinds of big data. Time series is widely used in various fields, such as medical, financial, industrial and other fields. How to discover valuable and regular information from it has become a current research hotspot. The anomaly detection of time series data is included in the field of time series data mining. Its function is to identify abnormal data in time series data, and through the discovery of abnormal data, timely solve equipment failures, medical conditions, and illegal intrusions of network security. As the business system grows larger, the business portfolio becomes more complex, the scale of time series data becomes larger and larger, and the data volume and data dimensions of the data become larger and larger, relying solely on human detection It has been unable to meet the growing monitoring needs.

Contents of the invention

In view of this, the present application provides a time-series data anomaly detection method, device, and computer storage medium to efficiently and accurately realize the anomaly detection of time-series data, and solve the time-consuming, labor-intensive, and error-prone problems of manual detection methods. question.

The specific plan is as follows:

An anomaly detection method for time series data, comprising:

Obtain time series monitoring data;

extracting high frequency components and low frequency components of the time series monitoring data;

Using the first prediction model to perform prediction processing based on the high-frequency component to obtain a first prediction result of data in future time series;

Using a second prediction model to perform prediction processing based on the low-frequency component to obtain a second prediction result of the data in the future time series;

superimposing the first prediction result and the second prediction result to obtain the target prediction result of the data in the future time series;

Identify outlier data in the real data in the future time series according to the target prediction result.

Optionally, the extracting the high-frequency components and low-frequency components of the time series monitoring data includes:

performing multi-scale decomposition and reconstruction on the time series monitoring data by using wavelet analysis theory, extracting high frequency periodic components, high frequency random components and low frequency trend components of the time series monitoring data;

Wherein, the high-frequency component includes the high-frequency periodic component and the high-frequency random component, and the low-frequency component includes the low-frequency trend component.

Optionally, the multi-scale decomposition and reconstruction of the time series monitoring data is carried out by using wavelet analysis theory, and the high frequency periodic component, high frequency random component and low frequency trend component of the time series monitoring data are extracted, include:

Acquiring measured deformation data of the time-series monitoring data, where the measured deformation data is data obtained after cleaning abnormal values of the time-series monitoring data;

Taking the measured deformation data as the current data to be decomposed;

Based on wavelet decomposition, decompose the current data to be decomposed into low-frequency parts and high-frequency parts, and obtain the low-frequency components and high-frequency components corresponding to the current data to be decomposed;

Determine whether the low-frequency subsequence contained in the low-frequency component corresponding to the current data to be decomposed has a preset change trend feature;

If so, end the decomposition processing of the data;

If not, update the data to be decomposed to the low-frequency component corresponding to the current data to be decomposed, and loop to the step of decomposing the current data to be decomposed into a low-frequency part and a high-frequency part, until the low-frequency component corresponding to the current data to be decomposed contains When the low-frequency subsequence has the characteristics of the change trend, the decomposition processing of the data is ended; during the decomposition process, each layer only decomposes the low-frequency components, and the high-frequency components are not processed;

The low-frequency component of the last layer in the decomposition result is extracted as the low-frequency trend component, and the high-frequency periodic component and high-frequency random component are extracted from the high-frequency components of each layer.

Optionally, using the first prediction model to perform prediction processing based on the high-frequency component to obtain a first prediction result of data in future time series includes:

performing denoising processing on the high-frequency random component;

Inputting the high-frequency periodic component and the high-frequency random component after denoising processing into the long-short-term memory network model, and the long-short-term memory network model based on the high-frequency periodic component and the high-frequency denoising processing The randomness component performs prediction processing to obtain the first prediction result of the data in the future time series.

Optionally, the performing denoising processing on the high-frequency random component includes:

performing denoising processing on the high-frequency random component based on a preset threshold;

σ₁＝MAD/0.6745，MAD表示首层小波分解系数绝对值的中间值，0.6745为高斯噪声标准方差的调整系数，N1表示高频随机性分量信号的尺寸或者长度。Among them, the threshold is

σ ₁ ＝MAD/0.6745, MAD represents the intermediate value of the absolute value of the wavelet decomposition coefficient of the first layer, 0.6745 is the adjustment coefficient of the standard deviation of Gaussian noise, and N1 represents the size or length of the high-frequency random component signal.

Optionally, the long-short-term memory network model includes a plurality of sequentially connected memory units, and the memory units include forget gates, input gates and output gates;

Among them, the current memory unit obtains the output information of the current memory unit by fusing the characteristic information transmitted by the previous memory unit and the high-frequency component input data of the current memory unit. The high-frequency component performs selective memory and forgetting to process the characteristic information passed down from the previous memory unit;

Through multiple memory units connected in sequence, respectively process the high-frequency components input by each and the characteristic information transmitted by the previous memory unit, so as to realize the prediction processing based on the high-frequency components in the model;

The characteristic information transmitted by the previous memory unit includes the state value and output value of the previous memory unit.

Optionally, using the second prediction model to perform prediction processing based on the low-frequency component to obtain a second prediction result of the data in the future time series includes:

The low-frequency trend component is input into a differential integrated moving average autoregressive model, and the differential integrated moving average autoregressive model is used to perform prediction processing based on the low-frequency trend component to obtain a second forecast result of the data in the future time series.

Optionally, the identifying outlier data in the real data in the future time series according to the target prediction result includes:

determining deviation information between the real data in the future time series and the target prediction result of the data in the future time series;

Identify outlier data in the real data in the future time series according to the deviation information.

An anomaly detection device for time series data, comprising:

The acquisition module is used to acquire time series monitoring data;

An extraction module, configured to extract high-frequency components and low-frequency components of the time series monitoring data;

The first prediction processing module is used to use the first prediction model to perform prediction processing based on the high-frequency component, and obtain the first prediction result of the data in the future time series;

A second prediction processing module, configured to use a second prediction model to perform prediction processing based on the low-frequency component, to obtain a second prediction result of the data in the future time series;

A superposition module, configured to superimpose the first prediction result and the second prediction result to obtain the target prediction result of the data in the future time series;

An outlier identification module, configured to identify outlier data in the real data in the future time series according to the target prediction result.

A computer-readable medium on which is stored a computer program, the computer program including program codes for executing the method for detecting anomalies in time-series data as described in any one of the above.

A computer program product, which includes a computer program carried on a non-transitory computer readable medium, the computer program including program codes for executing the method for detecting anomalies in time series data as described in any one of the above.

To sum up, the anomaly detection method, device and computer storage medium for time series data provided by this application, by decomposing time series monitoring data and extracting high frequency components and low frequency components, according to the characteristics of high/low frequency components, Use the corresponding model to analyze and predict the high/low frequency components, and superimpose the prediction results corresponding to the high/low frequency components to obtain the predicted value of the data in the future time series, and then use the predicted value to identify the real data in the future time series. Abnormal point data can realize real-time detection of time series data, find abnormal point data in time, and remind maintenance personnel to take countermeasures as soon as possible to avoid irreparable losses.

Description of drawings

The above and other features, advantages and aspects of the various embodiments of the present application will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the drawings, the same or similar reference numerals denote the same or similar elements. It should be understood that the drawings are schematic and that elements and elements are not necessarily drawn to scale.

Fig. 1 is the flow chart of the anomaly detection method of the time series data provided by the present application;

Fig. 2 is the wavelet decomposition structure diagram that the application provides;

Figure 3 is a cell structure diagram of the LSTM model provided by the present application;

Fig. 4 is the flow chart of time series data anomaly detection based on WA-LSTM-ARIMA model provided by this application;

Fig. 5 is a schematic diagram of the original data set and its data distribution based on the model training provided by the present application;

Fig. 6 is an exemplary residual diagram corresponding to the actual value and the predicted value provided by the present application;

FIG. 7 is a structural diagram of an anomaly detection device for time series data provided by the present application.

Detailed ways

Embodiments of the present application will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present application are shown in the drawings, it should be understood that the application may be embodied in various forms and should not be construed as limited to the embodiments set forth herein; A more thorough and complete understanding of the application. It should be understood that the drawings and embodiments of the present application are for exemplary purposes only, and are not intended to limit the protection scope of the present application.

As used herein, the term "comprise" and its variations are open-ended, ie "including but not limited to". The term "based on" is "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one further embodiment"; the term "some embodiments" means "at least some embodiments." Relevant definitions of other terms will be given in the description below.

It should be noted that concepts such as "first" and "second" mentioned in this application are only used to distinguish different devices, modules or units, and are not used to limit the sequence of functions performed by these devices, modules or units or interdependence.

It should be noted that the modifications of "one" and "multiple" mentioned in this application are illustrative and not restrictive. Those skilled in the art should understand that unless the context clearly indicates otherwise, it should be understood as "one or more" multiple".

Time series data is one of various types of big data, which is defined as a series of statistics or observations based on time. Time series are widely used in various fields, such as medical care, finance, industry and other fields. At present, the data volume and data dimension of time series data are increasing. How to discover valuable and regular information has become a current research hotspot. Time series anomaly detection is included in the field of time series data mining, which is defined as the process of identifying abnormal events or behaviors from normal time series, and its role is to identify abnormal data in time series. Sometimes the abnormal data itself has more important value and can provide a lot of useful information. Effective anomaly detection is widely used in many fields in the real world, such as quantitative transactions, network security detection, self-driving cars and daily maintenance of large industrial equipment etc. In particular, because time series data has the characteristics of low visualization cost, clear meaning, and obvious rules, it is often applied in the field of operation and maintenance, and time series data can be used to monitor the operating status of a certain system.

In order to solve the time-consuming, labor-intensive, and error-prone problems existing in the existing manual detection methods, this application provides an anomaly detection method, device, computer storage medium, and computer program product for time-series data to efficiently and accurately analyze and discover time-series data. The data that does not conform to the normal development law in the sequence data, through the discovery of abnormal data, can detect equipment failures in time, effectively avoid major disasters, ensure the safety of daily production and life, and reduce unnecessary human and financial losses.

Referring to the flow chart of the abnormal detection method for time series data shown in Figure 1, the abnormal detection method for time series data provided by this application includes the following processing flow:

Step 101, acquiring time series monitoring data.

The method of the present application can be applied to many fields, such as illegal intrusion detection of network security, financial fraud detection in financial transactions, detection of equipment failures in industrial production, detection of medical conditions, and the like. Taking the industrial field as an example, through the recording and analysis of equipment action data, when the data is abnormal at a certain moment, it will prompt that the equipment may be damaged due to long-term continuous work or wear and tear, and it needs to be repaired in time to avoid failure to find problems in time. And causing more serious losses, these abnormal data contain more valuable information than normal data, and it is very important for many fields to find these abnormal data in a timely and effective manner.

The time-series monitoring data obtained in this step may be, but not limited to, time-series data of network security monitoring, financial transactions, equipment status monitoring, medical condition monitoring, etc., depending on actual needs.

Step 102, extracting high-frequency components and low-frequency components of the time-series monitoring data.

This application extracts high-frequency components and low-frequency components through multi-scale decomposition and reconstruction of time-series monitoring data (referred to as "time-series data"), where high-frequency components include high-frequency periodic components and high-frequency randomness Components, low frequency components include low frequency trend components.

Further, optionally, use WA technology to decompose time series monitoring data. WA refers to wavelet transform, which inherits and develops the idea of short-time Fourier transform localization, and at the same time overcomes the shortcomings of window size not changing with frequency. .

Correspondingly, this application uses wavelet analysis theory for multi-scale decomposition and reconstruction of time series monitoring data, and extracts high-frequency periodic components, high-frequency random Sexual component and low-frequency trending component, this process can be specifically realized as:

11) Acquiring measured deformation data of the time series monitoring data, where the measured deformation data is data obtained after cleaning abnormal values of the time series monitoring data;

12) Using the measured deformation data as the current data to be decomposed;

13) Based on wavelet decomposition, the current data to be decomposed is decomposed into a low-frequency part and a high-frequency part, and a low-frequency component and a high-frequency component corresponding to the current data to be decomposed are obtained;

14) Determine whether the low-frequency subsequence contained in the low-frequency component corresponding to the current data to be decomposed has a preset change trend feature;

Optionally, the preset change trend feature may be set as: the waveform of the low-frequency time-series data corresponding to the current decomposition layer has obvious fluctuations and no periodic changes. Wherein, the obvious fluctuation and change can be measured based on a set waveform change threshold, and when the fluctuation of the low-frequency time series data waveform reaches the threshold, it can be regarded as having obvious fluctuation and change.

15) If so, end the decomposition processing of the data;

16) If not, update the data to be decomposed to the low-frequency component corresponding to the current data to be decomposed, and loop to the step 13) of decomposing the current data to be decomposed into low-frequency parts and high-frequency parts, until the current data to be decomposed When the low-frequency subsequence contained in the corresponding low-frequency component has the characteristic of the change trend, the decomposition processing of the data is ended;

Among them, in the decomposition process, each layer only decomposes low-frequency components, and high-frequency components are not processed.

17) Extract the low-frequency component of the last layer in the decomposition result as the low-frequency trend component, and extract the high-frequency periodic component and high-frequency random component from the high-frequency components of each layer.

For ease of understanding, further details are given below.

The applicant's research found that the data sequence of time series data contains information on the impact of the environment and the collection process on time series data, among which high frequency data mainly reflect the characteristics of high frequency and periodicity, and may be accompanied by some noise, while low frequency The data shows obvious low-frequency and trend characteristics. Therefore, based on WA technology, the sequence is decomposed on multiple scales to extract high-frequency periodic components, low-frequency trend components and high-frequency random components.

Considering the discreteness of the collected data, the discrete wavelet transform _Wf is preferably used for data analysis:

表示小波基函数的复共辄，f(t)表示变形时间序列，t为时间。In this formula, a ₀ and b ₀ are real constants, j and k are integers,

Represents the complex conjugate of the wavelet basis function, f(t) represents the deformed time series, and t is time.

The wavelet decomposition structure diagram is shown in Fig. 2. In Fig. 2, f ₀ represents the measured deformation data of the time series monitoring data. The measured deformation data refers to the data required for detection selected/extracted from the source data, that is, the time series monitoring data according to actual needs. Specifically, it can be the data obtained after cleaning the outliers of the time series monitoring data, so that in the training stage or the prediction stage, the data after cleaning the outliers is selected for training or prediction; f ₁ , f ₂ ,...,f _N1 are low-frequency parts , d ₁ , d ₂ ,..., d _N1 are high-frequency parts.

Among them, only the low-frequency components are decomposed in each layer, and the high-frequency components are not processed, and the change trend of the low-frequency subsequence after each decomposition is judged to identify whether it meets the preset change trend characteristics. If there is an obvious change trend , that is, the low-frequency time-series data waveform of the current decomposition layer has obvious fluctuations and no periodic changes, then it is determined that the preset trend characteristics are met, and the decomposition is stopped. Otherwise, if the trend is not obvious, continue to decompose until it shows an obvious trend . Assuming that the number of decomposition layers is N1 at this time, N1 high-frequency components and 1 low-frequency component are obtained. After superposition, we can get:

f ₀ =d ₁ +d ₂ +...+d _N1 +f _N1

That is to say, the low-frequency component (f _N1 ) of the last layer in the decomposition result is extracted as the low-frequency trend component of the time series monitoring data, and the high-frequency component (d ₁ ,d ₂ ,…,d _N1 ) of each layer is extracted , extracted as the high frequency component of the time series monitoring data. The applicant found that high-frequency data mainly reflect the characteristics of high frequency and periodicity, and are interfered by factors such as working conditions and instrument errors, and the data sequence often contains noise. Correspondingly, the high-frequency period can be further extracted from the high-frequency component sex component and high-frequency randomness component.

Among them, the high-frequency periodic component mainly reflects the high-frequency data part information of the time series monitoring data, the low-frequency trend component mainly reflects the low-frequency data part information of the time series monitoring data, and the high-frequency random component mainly reflects the influence of noise.

Step 103 , using the first prediction model to perform prediction processing based on the high-frequency component, to obtain a first prediction result of the data in the future time series.

Preferably, in view of the characteristics of high-frequency components, the embodiment of the present application adopts LSTM (Long Short-Term Memory, long-term short-term memory network) as the analysis and prediction processing model of high-frequency components, that is, the first prediction model is the LSTM model. LSTM is a time cyclic neural network, which is specially designed to solve the long-term dependence problem of general cyclic neural network.

Affected by factors such as working conditions and instrument errors, the data sequence of the time series monitoring data often contains noise, which interferes with the accuracy of the forecast. Therefore, it is necessary to denoise the monitoring data sequence. In the embodiment of the present application, since the influence of noise is mainly reflected through the high-frequency random component, the extracted high-frequency random component can be denoised correspondingly. The key to denoising is to determine the threshold λ, and the threshold is selected too large or too Small will affect the denoising effect, the present embodiment preferably adopts the following calculation formula to determine the value of the threshold λ:

σ ₁ =MAD/0.6745

Among them, MAD represents the intermediate value of the absolute value of the wavelet decomposition coefficient of the first layer, 0.6745 is the adjustment coefficient of the standard deviation of Gaussian noise, and N1 represents the size or length of the high-frequency random component signal (that is, the number of decomposition layers).

It has been verified that denoising based on the threshold determined by the above calculation formula can achieve a better denoising effect on high-frequency random components.

After denoising the high-frequency random component, it is merged into the high-frequency sequence for unified processing. That is, the high-frequency random components and high-frequency periodic components after denoising processing are input into the LSTM model together, and the LSTM model performs prediction processing based on the high-frequency random components and high-frequency periodic components after denoising processing, to obtain The first prediction result of the data in the future time series.

The long-short-term memory network model includes a plurality of sequentially connected memory units, and the memory units include forget gates, input gates and output gates.

Among them, the current memory unit obtains the output information of the current memory unit by fusing the characteristic information transmitted by the previous memory unit and the high-frequency component input data of the current memory unit. The high-frequency component performs selective memory and forgetting to process the characteristic information passed down from the previous memory unit;

Through multiple memory units connected in sequence, respectively process the high-frequency components input by each and the characteristic information transmitted by the previous memory unit, so as to realize the prediction processing based on the high-frequency components in the model;

The characteristic information transmitted by the previous memory unit includes the state value and output value of the previous memory unit in further detail below.

The LSTM model is a special form of RNN (Recurrent Neural Network, cyclic neural network). The traditional RNN model will forget the information that is far away, and it is difficult to store the information of a long time series in the past. Only a few steps of information nearby Make future predictions that are difficult to recover from if they go wrong. The LSTM model controls the retention, discarding and updating of information through the input gate, forgetting gate and output gate, which effectively overcomes the shortcomings of the former and greatly improves the prediction accuracy.

The LSTM model consists of several memory units, which are called cells in this embodiment. The cell s of the model participates in the prediction process based on the input data. The cell structure of the model can be seen in Figure 3, where f, i, o respectively represent the forget gate, input gate and output gate, x _t and h _t represent the input and output respectively, σ represents the sigmoid function, C _t represents the state value at time t, that is, the cell unit before this time conducts the input high-frequency component Selective memory and forgetting are used to process the transmitted feature information, and C _t is specifically obtained by fusion processing the state value and output value of the previous cell and the input data of the current cell.

Referring to Figure 3, the process of predicting high-frequency components (high-frequency periodic components and high-frequency random components after denoising) through the LSTM model is as follows:

21) Use the forgetting gate to control the choice of high-frequency component information obtained from wavelet decomposition data, and determine how much old information of cells in the previous state is retained:

f _t ＝σ(W _hf h _t-1 +W _xf x _t +b _f )

In the formula, f _t is the output value of the forget gate, that is, a certain value from 0 to 1; h _t-1 , W _hf are the output and weight of the previous moment respectively; x _t , W _xf are the input and weight of the current moment respectively ; b _f is a bias item.

和更新信息的输出值i_t，确定细胞需要更新的信息，即对前一细胞输出值和当前细胞输入值通过输入门运算进行选择记忆的数据信息：22) Solve the candidate value of update information

and the output value it of the updated _information to determine the information that the cell needs to update, that is, the data information that is selected and memorized through the input gate operation for the previous cell output value and the current cell input value:

i _t = σ(W _hi h _t-1 +W _xi x _i +b _i )

时h_t-1和x_t对应的更新信息权重；W_hi,W_xi分别为求解i_t时h_t-1和x_i对应的输入门权重；b_c,b_i为偏置项。In the formula, W _hc , W _xc are the solution

When h _t-1 and x _t correspond to update information weights; W _hi , W _xi are the input gate weights corresponding to h _{t -1} and x _i when solving it respectively; b _c , _bi are bias items.

和输出值i_t相乘，并将两个乘积叠加，从而达到遗忘部分旧信息和记住部分新信息的目的，得到细胞新状态C_t：23) Multiply the output value f _t with the previous state C _t-1 of the cell, and the candidate value

Multiply with the output value it, and superimpose the two products, so as to achieve the purpose of forgetting some old information and remembering some new information, and obtain the new state C _t of the cell _:

24) Use the output gate to determine the information o _t that the new cell needs to output, and multiply it with the result of the new cell C _t processed by the tanh layer to obtain the final output result h _t :

o _t ＝σ(W _ho h _t-1 +W _xo x _i +b _o )

h _t ＝o _t tanh(C _t )

In the formula, _{Who ho} , W _xo are the output gate weights corresponding to h _t-1 and x _i when solving o _t ; b _o is the bias item.

Step 104 , using a second prediction model to perform prediction processing based on the low-frequency component, to obtain a second prediction result of the data in the future time series.

Preferably, in view of the characteristics of low-frequency components, the embodiment of the present application adopts ARIMA (Autoregressive Integrated Moving Average Model) as the analysis and prediction processing model of low-frequency components, that is, the second prediction model is an ARIMA model. ARIMA is the differential integrated moving average autoregressive model, also known as the integrated moving average autoregressive model (moving can also be called sliding), which is one of the time series forecasting analysis methods.

Among them, the ARIMA model combines the difference operation with the autoregressive moving average model (ARMA), and through the difference processing of the non-stationary sequence, it tends to be stable, and then the ARMA model forecasts the sequence. The advantage of ARIMA is that it uses a mathematical model to describe the time series, and predicts the future trend through the past and present values of the series.

The ARIMA model is represented as follows:

为自回归系数；L为滞后算子；d为差分阶数；Y_t为输入的时间序列；q为移动平均阶数；θ_i为移动平均系数；ε_t为残差序列。In the formula, p is the autoregressive order;

L is the lag operator; d is the difference order; Y _t is the input time series; q is the moving average order; θ _i is the moving average coefficient; ε _t is the residual sequence.

In the embodiment of this application, the construction process of the ARIMA model includes:

31) Perform difference processing on the time series data, stop the difference when the processed sequence becomes a stationary sequence, and determine the difference order d at this time as the difference order of the model;

32) On the basis of difference processing, determine p and q values by SBC criterion.

The SBC criterion is a consistent estimate of the true order of the optimal model. Its expression is as follows:

SBC＝-2lnM _l +lnN·N

In the formula, M _l L is the maximum likelihood function value of the model.

This criterion aims to convert the penalty weight of the number of unknown parameters that need to be fitted in the model from a fixed value to a dynamic value related to the sample size, so that it can adapt to changes in the length of the time series and the judgment results are more reliable. When this criterion is actually applied, this embodiment compares the SBC indexes with p and q values within a certain range, and selects the p and q values corresponding to the minimum values of the SBC indexes as optimal parameters.

Step 105. Perform superposition processing on the first prediction result and the second prediction result to obtain the target prediction result of the data in the future time series.

Afterwards, the prediction results of the first prediction model and the second prediction model are superimposed to obtain the final prediction result of the data in the future time series, that is, the target prediction result.

Step 106, according to the target prediction result, identify outlier data in the real data in the future time series.

After the final prediction result of the data in the future time series, that is, the target prediction result is obtained according to the superposition processing of the prediction results of different models, the deviation information between the real data in the future time series and the target prediction result of the data in the future time series can be specifically determined , and according to the deviation information, identify the outlier data in the real data in the future time series.

Furthermore, in practical applications, after superimposing the prediction results of the two models to obtain the final target prediction result, the residual map corresponding to the residual error between the real value and the predicted value can be further analyzed and drawn, and based on the residual map to identify Abnormal points are based on the identification of abnormal points to determine whether the application/system is faulty/abnormal, such as judging whether there is illegal network intrusion, financial fraud, equipment failure or medical accidents, etc.

To sum up, the anomaly detection method, device and computer storage medium for time series data provided by this application, by decomposing time series monitoring data and extracting high frequency components and low frequency components, according to the characteristics of high/low frequency components, Use the corresponding model to analyze and predict the high/low frequency components, and superimpose the prediction results corresponding to the high/low frequency components to obtain the predicted value of the data in the future time series, and then use the predicted value to identify the real data in the future time series. Abnormal point data can realize real-time detection of time series data, find abnormal point data in time, and remind maintenance personnel to take countermeasures as soon as possible to avoid irreparable losses.

Next, continue to provide an application example of the method of the present application.

This example pre-establishes a time series anomaly detection model based on WA-LSTM-ARIMA, and uses this model to perform multi-scale decomposition and reconstruction of time series data using wavelet analysis theory. For the high-frequency components and low-frequency components extracted after decomposition, respectively The LSTM model and ARIMA model are used for analysis, and then the prediction results of the two models are superimposed to obtain the final prediction result, and finally the outliers are identified based on the superposition value of the prediction results of the two models.

The time series anomaly detection model based on WA-LSTM-ARIMA, the detailed anomaly detection process of time series data is shown in Figure 4, including: using wavelet analysis theory to perform multi-scale decomposition and reconstruction on time series data, extracting Periodic components, low-frequency trend components and high-frequency random components; high-frequency periodic components mainly reflect part of the high-frequency data information, which is analyzed and predicted using the LSTM model; low-frequency trend components reflect part of the low-frequency data information, using The ARIMA model is used for analysis and prediction processing; the high-frequency random component mainly reflects the influence of noise, which is merged into the high-frequency sequence for unified processing after denoising. The prediction results of each model are superimposed to obtain the final prediction result of the data in the future time series, and based on the prediction value combined with the real value (observation value) of the data in the future time series, the residual graph is drawn to identify abnormal points.

This example pre-selects a dataset to train, test, and evaluate the model.

In view of the fact that the transaction price and transaction volume of stocks in the stock market will form a continuous time series, which contains useful information related to time, this example uses relevant data on stock transactions as the experimental data set, and the data set includes date , opening price and other information, the original data set and its data distribution are shown in Figure 5. Since what is to be observed is the trend of the predicted value in the time dimension, the data and volume (referring to the trading volume in the stock market) in the data set are taken. Column information, where the first 60% of the data in the data set is used as the learning data of the model, the last 40% of the data is used for prediction, and the first 4% of the maximum deviation between the real value and the predicted value is used as an outlier based on the residual map , and the residual plot is shown in Figure 6.

When evaluating the performance of the time series anomaly detection model, this example uses indicators such as precision rate (P), recall rate (R) and F1 value to measure. Among them, the accuracy rate indicates that the number of samples that are predicted and actually are abnormal accounts for the prediction. The proportion of the total number of abnormalities, the larger the value, the better the performance; the recall rate indicates the proportion of the predicted and actual abnormal samples to the actual total number of abnormalities, the larger the value, the better the performance; the F1 value indicates the accuracy rate and the weighted harmonic mean of the recall rate, the larger the value, the better the performance. The calculation formulas of precision rate, recall rate and F1 value are as follows:

Among them, TP indicates the number of samples predicted to be abnormal and actually abnormal, FP indicates the number of samples predicted to be abnormal but actually normal, and FN indicates the number of samples predicted to be normal but actually abnormal. Therefore, TP+FP represents the total number of samples predicted to be abnormal, and TP+FN represents the total number of samples that are actually abnormal.

Since the model in this example is an anomaly detection model, the positive examples here refer to abnormal samples. The total number of samples used in the experiment of this example is 730, and the distribution of the number of positive and negative samples is shown in Table 1.

Table 1 Distribution of positive and negative samples

actual positive example Actual negative example Predict positive examples 25 4 Predict negative examples 3 698

According to Table 1, the accuracy rate, recall rate and F1 value of the model can be calculated, as shown in Table 2:

Table 2 The accuracy rate, recall rate and F1 value of the model

Accuracy (P) 0.862 Recall (R) 0.892 F1 0.877

The model in this example predicts the follow-up data based on learning the historical data of a certain system, and judges whether the system is abnormal by comparing the deviation between the real value and the predicted value. Abnormal point data, and remind maintenance personnel to take countermeasures as soon as possible to avoid irreparable losses, which can completely solve the time-consuming, laborious, and error-prone problems of the previous manual detection methods.

Corresponding to the above-mentioned anomaly detection method for time-series data, the present application also provides an anomaly detection device for time-series data, the composition and structure of which is shown in Figure 7, including:

Obtaining module 10, for obtaining time series monitoring data;

An extraction module 20, configured to extract high frequency components and low frequency components of the time series monitoring data;

The first prediction processing module 30 is configured to use the first prediction model to perform prediction processing based on the high-frequency component to obtain a first prediction result of data in future time series;

The second prediction processing module 40 is configured to use a second prediction model to perform prediction processing based on the low-frequency component to obtain a second prediction result of the data in the future time series;

A superposition module 50, configured to superimpose the first prediction result and the second prediction result to obtain the target prediction result of the data in the future time series;

The outlier identification module 60 is configured to identify outlier data in the real data in the future time series according to the target prediction result.

In one embodiment, the extraction module 20 is specifically used for:

performing multi-scale decomposition and reconstruction on the time series monitoring data by using wavelet analysis theory, extracting high frequency periodic components, high frequency random components and low frequency trend components of the time series monitoring data;

Wherein, the high-frequency component includes the high-frequency periodic component and the high-frequency random component, and the low-frequency component includes the low-frequency trend component.

In one embodiment, the extraction module 20 extracts the high-frequency periodic components, high-frequency random components and For low-frequency trend components, it is specifically used for:

Acquiring measured deformation data of the time-series monitoring data, where the measured deformation data is data obtained after cleaning abnormal values of the time-series monitoring data;

Taking the measured deformation data as the current data to be decomposed;

Based on wavelet decomposition, decompose the current data to be decomposed into low-frequency parts and high-frequency parts, and obtain the low-frequency components and high-frequency components corresponding to the current data to be decomposed;

Determine whether the low-frequency subsequence contained in the low-frequency component corresponding to the current data to be decomposed has a preset change trend feature;

If so, end the decomposition processing of the data;

If not, update the data to be decomposed to the low-frequency component corresponding to the current data to be decomposed, and loop to the step of decomposing the current data to be decomposed into a low-frequency part and a high-frequency part, until the low-frequency component corresponding to the current data to be decomposed contains When the low-frequency subsequence has the characteristics of the change trend, the decomposition processing of the data is ended; during the decomposition process, each layer only decomposes the low-frequency components, and the high-frequency components are not processed;

The low-frequency component of the last layer in the decomposition result is extracted as the low-frequency trend component, and the high-frequency periodic component and high-frequency random component are extracted from the high-frequency components of each layer.

In one embodiment, the first prediction processing module 30 is specifically used for:

performing denoising processing on the high-frequency random component;

Inputting the high-frequency periodic component and the high-frequency random component after denoising processing into the long-short-term memory network model, and the long-short-term memory network model based on the high-frequency periodic component and the high-frequency denoising processing The randomness component performs prediction processing to obtain the first prediction result of the data in the future time series.

In one embodiment, the first prediction processing module 30, when performing denoising processing on the high-frequency random components, is specifically used to:

performing denoising processing on the high-frequency random component based on a preset threshold;

σ₁＝MAD/0.6745，MAD表示首层小波分解系数绝对值的中间值，0.6745为高斯噪声标准方差的调整系数，N1表示高频随机性分量信号的尺寸或者长度。Among them, the threshold is

σ ₁ ＝MAD/0.6745, MAD represents the intermediate value of the absolute value of the wavelet decomposition coefficient of the first layer, 0.6745 is the adjustment coefficient of the standard deviation of Gaussian noise, and N1 represents the size or length of the high-frequency random component signal.

In one embodiment, the long-short-term memory network model includes a plurality of sequentially connected memory units, and the memory units include a forgetting gate, an input gate and an output gate;

Among them, the current memory unit obtains the output information of the current memory unit by fusing the characteristic information transmitted by the previous memory unit and the high-frequency component input data of the current memory unit. The high-frequency component performs selective memory and forgetting to process the characteristic information passed down from the previous memory unit;

Through multiple memory units connected in sequence, respectively process the high-frequency components input by each and the characteristic information transmitted by the previous memory unit, so as to realize the prediction processing based on the high-frequency components in the model;

The characteristic information transmitted by the previous memory unit includes the state value and output value of the previous memory unit.

In one embodiment, the second prediction processing module 40 is specifically used for:

The low-frequency trend component is input into a differential integrated moving average autoregressive model, and the differential integrated moving average autoregressive model is used to perform prediction processing based on the low-frequency trend component to obtain a second forecast result of the data in the future time series.

In one embodiment, the abnormal point identification module 60 is specifically used for:

determining deviation information between the real data in the future time series and the target prediction result of the data in the future time series;

Identify outlier data in the real data in the future time series according to the deviation information.

For the anomaly detection device for time-series data applied in the embodiment of the present application, since it corresponds to the anomaly detection method for time-series data applied in the method embodiment above, the description is relatively simple. For related similarities, please refer to the above The description of the embodiment of the text method is sufficient, and will not be described in detail here.

The present application also provides a computer-readable medium on which a computer program is stored, and the computer program includes program codes for executing the anomaly detection method for time-series data as applied in the above method embodiments.

In the context of this application, a computer-readable medium (machine-readable medium) may be a tangible medium that may contain or be stored for use by or in conjunction with an instruction execution system, apparatus, or device program of. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media would include one or more wire-based electrical connections, portable computer discs, hard drives, random access memory (RAM), read only memory (ROM), erasable programmable read only memory (EPROM or flash memory), optical fiber, compact disk read only memory (CD-ROM), optical storage, magnetic storage, or any suitable combination of the foregoing.

It should be noted that the computer-readable medium mentioned above in this application may be a computer-readable signal medium or a computer-readable storage medium, or any combination of the above two. A computer readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to, electrical connections with one or more wires, portable computer diskettes, hard disks, random access memory (RAM), read-only memory (ROM), erasable Programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this application, however, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code therein. Such propagated data signals may take many forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the foregoing. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium, which can transmit, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device . Program code embodied on a computer readable medium may be transmitted by any appropriate medium, including but not limited to wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

The above-mentioned computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

The present application also provides a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program includes a program for executing the anomaly detection method for time series data as applied for in the method embodiment above code.

In particular, according to the embodiments of the present application, the processes described above with reference to the flowcharts can be implemented as computer software programs. In such an embodiment, the computer program may be downloaded and installed from a network via communication means, or installed from a storage means, or installed from a ROM. When the computer program is executed by the processing device, the above-mentioned functions defined in the methods of the embodiments of the present application are executed.

To sum up, the anomaly detection method, device, computer storage medium and computer program product provided by this application have at least the following technical advantages:

a) Decomposing time series data based on WA technology can decompose time series data into low-frequency and high-frequency components, which helps to remove noise in high-frequency components and improve the prediction accuracy of the model;

b) ARIMA model is used to analyze the characteristics of low-frequency components such as low frequency and trend, so that the time-sensitive sequence can be described with a mathematical model based on ARIMA, and the future trend can be predicted through the past value and present value of the sequence;

c) For high-frequency periodic components, using the LSTM model with long-term memory function to analyze it can predict the results more accurately, and LSTM can perform better in longer sequences.

It should be noted that, although the subject matter has been described in language specific to structural features and/or methodological acts, it is to be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or acts described above. Rather, the specific features and acts described above are merely example forms of implementing the claims.

While several specific implementation details are contained in the above discussion, these should not be construed as limitations on the scope of the application. Certain features that are described in the context of separate embodiments can also be implemented in combination in a single embodiment. Conversely, various features that are described in the context of a single embodiment can also be implemented in multiple embodiments separately or in any suitable subcombination.

The above description is only a preferred embodiment of the present application and an illustration of the applied technical principles. Those skilled in the art should understand that the scope of application involved in this application is not limited to the technical solutions formed by the specific combination of the above technical features, but also covers the technical solutions made by the above technical features or Other technical solutions formed by any combination of equivalent features. For example, a technical solution formed by replacing the above-mentioned features with (but not limited to) technical features with similar functions in this application.

Claims (11)

1. A method for detecting an abnormality in time-series data, comprising:

acquiring time series monitoring data;

extracting high-frequency components and low-frequency components of the time series monitoring data;

performing prediction processing on the basis of the high-frequency component by using a first prediction model to obtain a first prediction result of data in a future time sequence;

performing prediction processing based on the low-frequency component by using a second prediction model to obtain a second prediction result of the data in the future time sequence;

superposing the first prediction result and the second prediction result to obtain a target prediction result of the data in the future time sequence;

and identifying abnormal point data in the real data under the future time sequence according to the target prediction result.

2. The method of claim 1, wherein extracting the high frequency component and the low frequency component of the time series monitoring data comprises:

performing multi-scale decomposition reconstruction on the time series monitoring data by using a wavelet analysis theory, and extracting a high-frequency periodic component, a high-frequency random component and a low-frequency trend component of the time series monitoring data;

wherein the high frequency component includes the high frequency periodic component and the high frequency stochastic component, and the low frequency component includes the low frequency trending component.

3. The method according to claim 2, wherein the extracting the high-frequency periodic component, the high-frequency stochastic component and the low-frequency tendency component of the time-series monitoring data by performing multi-scale decomposition reconstruction on the time-series monitoring data by using wavelet analysis theory comprises:

acquiring deformation actual measurement data of the time series monitoring data, wherein the deformation actual measurement data is obtained by cleaning abnormal values of the time series monitoring data;

taking the deformation actual measurement data as current data to be decomposed;

decomposing the current data to be decomposed into a low-frequency part and a high-frequency part based on wavelet decomposition to obtain a low-frequency component and a high-frequency component corresponding to the current data to be decomposed;

determining whether a low-frequency subsequence contained in a low-frequency component corresponding to current data to be decomposed has a preset variation trend characteristic or not;

if so, ending the decomposition processing of the data;

if not, updating the data to be decomposed into a low-frequency component corresponding to the current data to be decomposed, and circulating to the step of decomposing the current data to be decomposed into a low-frequency part and a high-frequency part until a low-frequency subsequence contained in the low-frequency component corresponding to the current data to be decomposed has the change trend characteristic, and ending the decomposition processing of the data; in the decomposition process, each layer only decomposes low-frequency components, and high-frequency components are not processed;

and extracting the low-frequency component of the last layer in the decomposition result as the low-frequency tendency component, and extracting a high-frequency periodic component and a high-frequency random component from the high-frequency components of the layers.

4. The method according to claim 2, wherein the performing a prediction process based on the high frequency component by using a first prediction model to obtain a first prediction result of data at a future time sequence comprises:

denoising the high-frequency stochastic component;

and inputting the high-frequency periodic component and the denoised high-frequency stochastic component into a long-short term memory network model, and performing prediction processing on the long-short term memory network model based on the high-frequency periodic component and the denoised high-frequency stochastic component to obtain a first prediction result of the data in the future time sequence.

5. The method of claim 4, wherein the denoising the high-frequency stochastic component comprises:

denoising the high-frequency stochastic component based on a preset threshold;

wherein the threshold is

σ ₁ = MAD/0.6745, MAD represents the middle value of the absolute value of the wavelet decomposition coefficient of the first layer,0.6745 is the adjustment coefficient of the standard deviation of gaussian noise, and N1 represents the size or length of the high frequency stochastic component signal.

6. The method according to claim 4, wherein the long-short term memory network model comprises a plurality of memory units which are connected in sequence, wherein the memory units comprise a forgetting gate, an input gate and an output gate;

the current memory unit obtains the output information of the current memory unit by carrying out fusion processing on the feature information transmitted by the previous memory unit and the high-frequency component input data of the current memory unit, and processes the feature information transmitted by the previous memory unit by selectively memorizing and forgetting the input high-frequency component when carrying out fusion processing;

respectively processing the high-frequency components input by the memory units and the characteristic information transmitted by the previous memory unit through the memory units connected in sequence to realize the prediction processing of the model based on the high-frequency components;

the characteristic information transmitted by the previous memory unit comprises a state value and an output value of the previous memory unit.

7. The method of claim 2, wherein the performing a prediction process based on the low frequency component using a second prediction model to obtain a second prediction result of the data at the future time sequence comprises:

and inputting the low-frequency tendency component into a differential integration moving average autoregressive model, and performing prediction processing on the low-frequency tendency component by the differential integration moving average autoregressive model to obtain a second prediction result of the data in the future time sequence.

8. The method of claim 1, wherein identifying outlier data in real data at the future time sequence based on the target prediction result comprises:

determining deviation information between real data at the future time sequence and a target prediction result of the data at the future time sequence;

and identifying abnormal point data in the real data under the future time sequence according to the deviation information.

9. An abnormality detection device for time-series data, comprising:

the acquisition module is used for acquiring time series monitoring data;

the extraction module is used for extracting a high-frequency component and a low-frequency component of the time series monitoring data;

the first prediction processing module is used for performing prediction processing on the basis of the high-frequency component by using a first prediction model to obtain a first prediction result of data in a future time sequence;

the second prediction processing module is used for performing prediction processing on the basis of the low-frequency component by using a second prediction model to obtain a second prediction result of the data in the future time sequence;

the superposition module is used for carrying out superposition processing on the first prediction result and the second prediction result to obtain a target prediction result of the data under the future time sequence;

and the abnormal point identification module is used for identifying abnormal point data in the real data under the future time sequence according to the target prediction result.

10. A computer-readable medium, characterized in that a computer program is stored thereon, the computer program comprising program code for executing the abnormality detection method for time-series data according to any one of claims 1 to 8.

11. A computer program product, characterized in that it comprises a computer program carried on a non-transitory computer-readable medium, the computer program comprising program code for executing the method of anomaly detection of time-series data according to any of claims 1-8.

Images