CN116185694A - Multi-element time sequence abnormality detection and diagnosis method based on similarity - Google Patents
Multi-element time sequence abnormality detection and diagnosis method based on similarity Download PDFInfo
- Publication number
- CN116185694A CN116185694A CN202310208218.5A CN202310208218A CN116185694A CN 116185694 A CN116185694 A CN 116185694A CN 202310208218 A CN202310208218 A CN 202310208218A CN 116185694 A CN116185694 A CN 116185694A
- Authority
- CN
- China
- Prior art keywords
- matrix
- similarity
- time
- moment
- abnormal
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000000034 method Methods 0.000 title claims abstract description 53
- 238000001514 detection method Methods 0.000 title claims abstract description 28
- 230000005856 abnormality Effects 0.000 title claims abstract description 18
- 238000003745 diagnosis Methods 0.000 title claims abstract description 16
- 239000011159 matrix material Substances 0.000 claims abstract description 164
- 230000002159 abnormal effect Effects 0.000 claims abstract description 51
- 238000004364 calculation method Methods 0.000 claims abstract description 22
- 230000007246 mechanism Effects 0.000 claims abstract description 8
- 239000013598 vector Substances 0.000 claims description 52
- 238000012549 training Methods 0.000 claims description 27
- 230000006870 function Effects 0.000 claims description 12
- 230000008569 process Effects 0.000 claims description 11
- 238000000691 measurement method Methods 0.000 claims description 3
- 238000006243 chemical reaction Methods 0.000 claims description 2
- 239000000470 constituent Substances 0.000 claims description 2
- 238000012545 processing Methods 0.000 abstract description 3
- 230000007774 longterm Effects 0.000 abstract description 2
- 238000005259 measurement Methods 0.000 abstract 1
- 238000013459 approach Methods 0.000 description 2
- 239000000463 material Substances 0.000 description 2
- 206010000117 Abnormal behaviour Diseases 0.000 description 1
- 241001522296 Erithacus rubecula Species 0.000 description 1
- 230000002547 anomalous effect Effects 0.000 description 1
- 230000005540 biological transmission Effects 0.000 description 1
- 238000004891 communication Methods 0.000 description 1
- 238000007418 data mining Methods 0.000 description 1
- 238000013461 design Methods 0.000 description 1
- 238000010586 diagram Methods 0.000 description 1
- 239000000284 extract Substances 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 230000004044 response Effects 0.000 description 1
- 238000006467 substitution reaction Methods 0.000 description 1
- 238000012360 testing method Methods 0.000 description 1
- 230000036962 time dependent Effects 0.000 description 1
- 230000009466 transformation Effects 0.000 description 1
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
- G06F11/0703—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation
- G06F11/0706—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation the processing taking place on a specific hardware platform or in a specific software environment
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
- G06F11/0703—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation
- G06F11/0751—Error or fault detection not based on redundancy
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
- G06F11/0703—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation
- G06F11/079—Root cause analysis, i.e. error or fault diagnosis
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Quality & Reliability (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Health & Medical Sciences (AREA)
- Biomedical Technology (AREA)
- Debugging And Monitoring (AREA)
- Testing And Monitoring For Control Systems (AREA)
- Test And Diagnosis Of Digital Computers (AREA)
Abstract
The invention provides a multi-element time sequence abnormality detection and diagnosis method based on similarity, which comprises the following steps: s1, acquiring a multi-element time sequence to be tested; s2, combining a basic probability distribution method and valley measurement to obtain a similarity matrix; s3, reconstructing a similarity matrix by using a reconstruction model based on an attention mechanism; s4, comparing the similarity matrix with the reconstruction matrix to obtain a similarity error matrix, wherein the number of abnormal elements in the similarity error matrix is used as the abnormal score of the corresponding moment; s5, if the anomaly score reaches a first threshold value, the moment is abnormal, and the anomaly attribute is determined according to the anomaly element distribution. The similarity matrix calculation method based on the basic probability distribution and the valley coefficient realizes the interpretable relation among the multi-element time series attributes, and the reconstruction model of the attention mechanism strengthens the capability of processing long-time and high-dimensional data so as to better describe the long-term time dependency relation, improve the capability of abnormality diagnosis and detect abnormal time and abnormal attributes.
Description
Technical Field
The invention relates to the technical field of data processing, in particular to a multi-element time sequence abnormality detection and diagnosis method based on similarity.
Background
With the popularization of the internet of things, ubiquitous connections generate a large amount of high-dimensional data, namely a multivariate time series. Data mining professionals need to study patterns or instances within the monitored system that are inconsistent with expected trends in the multivariate time series, known as anomaly detection and diagnosis. Since these unusual patterns or instances may reveal signals of functional anomalies or potential failures, how to effectively detect and diagnose anomalies is critical to quality of service management such as fault tolerant response and database design.
The current common method for detecting and diagnosing the abnormality of the multi-element time sequence data comprises the following steps: one is a distance-based method that uses a specific distance metric to compare the interrelationship between points or subsequences in a time sequence; the distribution-based method estimates the distribution of the data or fits a distribution model to the data. However, conventional distance or distribution-based methods tend to be difficult to learn more deeply and have poor generalization ability. Yet another is to use a continuous learning model based on a predictive approach to predict the state of the invisible timestamp from the prediction error through the current context window, but predictive approaches suffer from the limitations of a large number of model parameters and difficulty in capturing short term fluctuations; yet another is a reconstruction-based method that extracts the general pattern in the normal time sequence in the low-dimensional space by encoding its sub-sequence, but in a reconstruction-based method some round robin mechanism can be used for time-dependent modeling, but the computation of the later time step has to wait for the completion of the previous sequence, which requires a high time complexity; yet another is to encode the subsequences of the time series into a low-dimensional potential space based on an encoding method, but encoder-based methods encourage compact potential features to capture the most typical patterns in the input time series and ignore non-representative patterns, such as outliers, which are, however, sensitive to outliers and subject to over-fitting. Furthermore, abnormality diagnosis requires not only the discovery of abnormalities but also the discovery of specific data sources that cause abnormal behavior, i.e., the detection of abnormalities requires interpretability. This further complicates the problem and few methods exist to solve the above difficulties simultaneously.
Disclosure of Invention
The invention aims at least solving the technical problems existing in the prior art and provides a multi-element time sequence abnormality detection and diagnosis method based on similarity.
In order to achieve the above object of the present invention, the present invention provides a multi-element time series abnormality detection and diagnosis method based on similarity, comprising: step S1, a multi-element time sequence X= { X to be tested is obtained 1 ，…，X t ，…，X T }，X t Representing an N-dimensional attribute vector matrix at the moment T, wherein T represents the length of a time stamp, and T is more than or equal to 1 and less than or equal to T; step S2, a basic probability distribution method and a valley measurement method are combined to obtain a similarity matrix of an N-dimensional attribute vector matrix at each moment; s3, reconstructing a similarity matrix at each moment by using a reconstruction model based on an attention mechanism to obtain a reconstruction matrix at each moment; s4, comparing the similarity matrix and the reconstruction matrix at each moment to obtain a similarity error matrix at the moment, sequentially judging whether each element in the similarity error matrix is abnormal or not, counting the number of abnormal elements in the similarity error matrix, and taking the number of the abnormal elements as an abnormal score at the corresponding moment; and S5, judging whether the anomaly score of each moment reaches a first threshold value, if so, considering that the N-dimensional attribute vector matrix of the moment is abnormal, and further determining the anomaly attribute according to the anomaly element distribution in the similarity error matrix of the moment.
The invention solves the problem of anomaly detection and diagnosis in multi-element time sequence data, and in order to obtain the interpretable relation between multi-element time sequence attributes, the invention provides a novel similarity matrix calculation method based on basic probability distribution and valley coefficients.
Drawings
FIG. 1 is a flow chart of a method for detecting and diagnosing multiple time series anomalies based on similarity.
Detailed Description
Embodiments of the present invention are described in detail below, examples of which are illustrated in the accompanying drawings, wherein like or similar reference numerals refer to like or similar elements or elements having like or similar functions throughout. The embodiments described below by referring to the drawings are illustrative only and are not to be construed as limiting the invention.
In the description of the present invention, it should be understood that the terms "longitudinal," "transverse," "upper," "lower," "front," "rear," "left," "right," "vertical," "horizontal," "top," "bottom," "inner," "outer," and the like indicate orientations or positional relationships based on the orientation or positional relationships shown in the drawings, merely to facilitate describing the present invention and simplify the description, and do not indicate or imply that the devices or elements referred to must have a specific orientation, be configured and operated in a specific orientation, and therefore should not be construed as limiting the present invention.
In the description of the present invention, unless otherwise specified and defined, it should be noted that the terms "mounted," "connected," and "coupled" are to be construed broadly, and may be, for example, mechanical or electrical, or may be in communication with each other between two elements, directly or indirectly through intermediaries, as would be understood by those skilled in the art, in view of the specific meaning of the terms described above.
The invention discloses a multi-element time sequence abnormality detection and diagnosis method based on similarity, in a preferred embodiment, a flow diagram is shown in fig. 1, and the method comprises the following steps:
step S1, a multi-element time sequence X= { X to be tested is obtained 1 ，...，X t ，...，X T }，X t And representing an N-dimensional attribute vector matrix at the time T, wherein T represents the length of the time stamp, and T is more than or equal to 1 and less than or equal to T. The multi-element time sequence to be tested is preferably but not limited to N paths of sensor signal sets acquired at a plurality of time points in the Internet of things system, wherein each sensor signal is used as attribute data; or testing HiStandard for big data issued by Intel, wherein the HiStandard comprises 26 indexes such as network transmission rate, network TCP waiting time, CPU I/O waiting time per second and the like, and each index is used as attribute data; or a server machine dataset from a large internet company, the cluster system dataset being generated by detecting a number of machines having the same state, one machine as an attribute. Specifically, a data acquisition device may be provided, where the data acquisition device is configured to acquire and store multiple time series data from an internet sensor or a server cluster of an Intel website or an internet company, and the method is performed by reading the multiple time series data from the data acquisition device.
Step S2, the similarity matrix of the N-dimensional attribute vector matrix at each moment is obtained by combining a basic probability distribution method and a valley measurement method, the obtained similarity matrix has good symmetry, more information in the original data can be obtained by the method, and the interpretable relation among the multi-element time sequence attributes can be obtained.
Preferably, in step S2, the process of obtaining the similarity matrix of the N-dimensional attribute vector matrix at the time t includes:
step S21, obtaining a pre-training sample set Z= { Z 1 ，...，z m ，...，z M }，z m Representing an M-th N-dimensional attribute vector matrix for training, wherein M is more than or equal to 1 and less than or equal to M; and constructing Gaussian membership functions of each dimension attribute in the N-dimensional vector matrix relative to each detection category based on the pre-training sample set, wherein the detection categories comprise normal and abnormal. Further preferably, the n-th attribute is related to the Gaussian membership function of the detection class c
The method comprises the following steps:
wherein x represents the nth attribute value of the sample to be tested;
representing the average value of the nth attribute value belonging to the detection category c' in all samples in the pre-training sample set; />
Standard deviation, < > -representing the nth attribute value belonging to the detection class c' in all samples of the pre-training sample set>
In step S21, the gaussian membership function of the nth attribute with respect to each detection class, that is, the gaussian membership function of the normal class and the gaussian membership function of the abnormal class, is solved.
Step S22, matching N-dimensional vector matrix X at t moment t And Gaussian membership function, and fusing the matching result to obtain N-dimensional vector matrix X at t moment t The basic probability distribution of each dimension attribute of the computer class c is relatively calculated, and the calculated class c comprises three types of normal, abnormal and normal or abnormal. Basic probability distribution (Basic Probability Assignment, BPA for short). According to the N-dimensional vector matrix X at the time t t The basic probability distribution generation method of the intersection point with the corresponding Gaussian blur number is as follows: (1) When the sample is intersected with the single-set Gaussian fuzzy number model, the ordinate of the intersection point is the sample support of the single set. (2) When a sample intersects a multi-set gaussian blur model, it must intersect a single-set gaussian blur model. The high point of the intersection is the basic probability distribution support of a single sample set, and the low point of the intersection is the basic probability distribution support of multiple groups of sample sets. (3) If the generated basicNormalizing if the sum of probability distribution confidence levels is greater than 1; if the calculated class is smaller than 1, the excess confidence is distributed to the unknown set, the calculation class of the unknown set is normal or abnormal, and the absolute value of the calculated class is equal to or smaller than the absolute value of the calculated class, and the absolute value of the calculated class is equal to or smaller than the absolute value of the calculated class; when the class is a normal or abnormal sample, |c|=1 is calculated. The basic probability distribution in step S22 may also refer to the existing BPA generation method based on gaussian distribution, and will not be described herein.
Step S23, according to the N-dimensional vector matrix X at the time t t Basic probability distribution iteration of each dimension attribute to obtain X t Uncertainty of the dimension attribute with respect to each calculation class.
Further preferably, in step S23, an N-dimensional vector matrix X at time t is obtained t The process of the uncertainty of the nth dimension attribute relative to the calculation category comprises the following steps:
step S321, initializing parameters:
setting variables
N-dimensional vector matrix X representing time t t Uncertainty of n-th dimension attribute of (a) relative to calculation category c, let +.>
Is>
Is X t Basic probability distribution of n-th dimension attribute relative to calculated class c
Setting p as iteration times and the initial value as 1;
calculating intermediate variables
Wherein when the calculation class c is normal or abnormal, |c|=1, and when the calculation class c is normal or abnormal, |c|=2; θ represents a value set of the calculation class c, θ= { normal, abnormal, normal or abnormal };
step S322, calculating according to the following formula
P iteration values of (a): />
Step S323, calculating an iteration increment
If delta < epsilon is satisfied, the iteration is stopped and
as->
If Δ < ε is not satisfied, p=p+1 and the process returns to step S322. Epsilon represents an iteration threshold and the value can be preset.
Step S24, calculating N-dimensional vector matrix X at t moment t The similarity of any two attributes in the model (C) is obtained, and a similarity matrix of an N-dimensional attribute vector matrix at the moment of t is obtained.
Further preferably, step S24 includes:
step S241, the N-dimensional vector matrix X at the time t is obtained according to the following formula t Similarity Sim between n-th and n' -th dimension properties t (n，n′)：
Wherein n' ∈ [1, N ]]，
N-dimensional vector matrix X representing time t t The uncertainty of the n' th dimension attribute of the medium relative to the calculation category c;
step S242, utilizing the N dimension direction at the time tQuantity matrix X t The similarity among all arbitrary attributes in the system constructs a t-moment similarity matrix S t ，S t Is of size N x N. t moment similarity matrix S t Has good symmetry.
And S3, reconstructing a similarity matrix at each moment by using a reconstruction model based on an attention mechanism, and obtaining a reconstruction matrix at each moment.
Preferably, in step S3, reconstructing the model includes:
tensor acquisition module: dividing similarity matrixes at t time and before t time by adopting sliding windows with different lengths to obtain window matrixes with different sizes, and combining all window matrixes to obtain t time tensor χ t . The U sliding windows are provided with the U sliding windows, and the sizes of the U sliding windows are different. Let the time length of the u-th sliding window be omega u ，u∈[1，U]Then the u-th window matrix W t u The method comprises the following steps:
tensor χ at time t t The method comprises the following steps: x-shaped articles t ＝{W t 1 ，...，W t U }。
And the multi-layer convolution module is used for downsampling the tensor at the moment t. Preferably, a full convolutional encoder with L (l=4) layers is used to extract the deeper representation of the time series data. With χ t As an input to the first layer, the first layer is denoted as:
wherein ,σ、W(l) 、b (l) The first network parameter, the second network parameter and the third network parameter of the first layer full convolution encoder are respectively represented.
And the attention-based network module splits the similarity matrix after downsampling into row vectors according to rows, inputs all the row vectors into a multi-head attention network, and the multi-head attention network outputs a reconstruction tensor at the moment t. Further preferably, the attention-based network module performs:
step A, splitting the similarity matrix after downsampling into row vectors o according to rows t ；
Step B, row vector o t Conversion into three matrices, the query matrix q t Key matrix k t Sum matrix V t Query matrix q t The weight is
Key matrix k t The weight is +.>
Value matrix V t The weight is +.>
Step C, calculating a query matrix q t And all time key matrix k t Sparsity measure between the constituent matrices K:
step D, consisting of a sparsity measure M (q t The top-level queries of K) form a sparse matrix Q, and the definition of the attention of the obtained proportional dot product is as follows:
and E, obtaining multi-head proportional dot product attention by adopting a multi-head attention network consisting of a plurality of attention layers running in parallel:
MultiHeadAtt(Q，K，V)＝Concat(A 1 ，...，A h ，...，A H )；
wherein ,
h represents the number of attention layers; h is E [1, H]；Q h A sparse matrix representing an h-th attention layer input; k (K) h All time key matrix k representing the input of the h attention layer t A matrix of components; v (V) h All time value matrix v representing the input of the h attention layer t A matrix of components;
step F, setting the global attention unit as an all 0 matrix with the same shape as the input window when the row vector at the first moment is input, and connecting the all 0 matrix with the input window;
and G, performing position coding on the dot product attention of the multi-head proportion, and decoding the position at the t moment to obtain a reconstruction tensor at the t moment. As input embedded E, input coding structure:
E 1 ＝LayeraNorm(E+MultiHeadAtt(E，E，E))
E 2 ＝LayeraNorm(E 1 +FeedForward(E 1 ))。
in the decoding stage, position coding is applied to the target timestamp to obtain D, and the architecture of the decoder is as follows:
D 1 ＝Mask(MultiHeadAtt(D，D，D))
D 2 ＝LayerNorm(D+D 1 )
D 3 ＝LayerNorm(D 2 +MultiHeadAtt(E 2 ，E 2 ，D 2 ))
O 1 ＝Sigmoid(FeedForward(D 3 ))。
obtaining the output O of the first stage 1 Thereafter, the output is updated by:
O i ＝Decoder(Encoder(Target，||O i-1 -Target|| 2 ))。
stitching the reconstructed vectors in each of the obtained levels into a matrix
The shape and input +.>
The same applies.
And the deconvolution layer deconvolves the reconstruction tensor at the time t to obtain a reconstruction matrix at the time t. For a pair of
Performing deconvolution operation:
the model learning is facilitated to capture modes with different scales through convolution and deconvolution operations in the reconstructed model, and outliers or outliers are separated from normal modes, so that the anomaly detection accuracy is improved. In the improved attention-based mechanism, a similar matrix is divided into similar row vectors according to rows, a sparse mechanism is introduced into a query/key transformation scale dot product attention matrix, and in addition, a new global attention input unit is connected, so that the capability of a model for processing long-time and high-dimensional data is enhanced, the long-term time dependency relationship is better described, and the abnormality detection accuracy is improved.
And S4, comparing the similarity matrix and the reconstruction matrix at each moment to obtain a similarity error matrix at the moment, sequentially judging whether each element in the similarity error matrix is abnormal or not, counting the number of abnormal elements in the similarity error matrix, and taking the number of the abnormal elements as the abnormal score at the corresponding moment.
Preferably, step S4 includes:
step S41, calculating a t-moment similarity error matrix DeltaS t ＝S t -S t′, wherein ,St N-dimensional vector matrix X representing time t t Similarity matrix of S t ' N dimension direction of t momentQuantity matrix X t Is used for reconstructing the matrix;
step S42, sequentially judging the similarity error matrix DeltaS t If each element is larger than the second threshold, the element is considered to be abnormal; the second threshold th is:
th=γ·max (Δs|train), γ represents the second super parameter, γ e (0, 1), and max (as|train) represents the maximum element value of the similarity error matrix obtained during training;
and S43, counting the number of abnormal elements in the similarity error matrix at the time t and taking the number of the abnormal elements as an abnormal score at the time t.
And S5, judging whether the anomaly score of each moment reaches a first threshold value, if so, considering that the N-dimensional attribute vector matrix of the moment is abnormal, and further determining the anomaly attribute according to the anomaly element distribution in the similarity error matrix of the moment. Preferably, the first threshold is:
τ＝β·max(S m |train)；
wherein, beta represents a third super parameter, beta E (0, 1)]，max(S m Train) represents the maximum anomaly score of the similarity matrix obtained during training.
In step S5, an anomaly attribute is determined according to the anomaly element distribution in the similarity error matrix at the time, specifically, if the element at the position (n, n') in the similarity error matrix at the time t is anomalous. If the elements of the nth row and the nth column in the t-moment similarity error matrix are abnormal, a t-moment matrix x t If the n-th dimension attribute is abnormal, otherwise, the n-th dimension attribute is normal; if the elements of the nth row and the nth column in the t-moment similarity error matrix are abnormal, a t-moment matrix x t The n 'th dimension attribute of (a) is abnormal, otherwise, the n' th dimension attribute is normal. Preferably, the abnormal time and the abnormal attribute are output to a display for display or stored in a storage unit.
In a preferred embodiment, the training is performed on the reconstruction model by using a pre-training sample set Z based on a contrast learning method, and the reconstruction matrix S at m time is obtained during the training m The' post-loss function calculation process includes:
calculating the time contrast loss of the attribute pair (n, n') at the m time instant:
wherein B represents a training batch size;
represents the m-time reconstruction matrix S m Element value of position (n, n ') in' x->
Represents the m-time reconstruction matrix S m Element value of position (n ', n) in' x->
Represents the m' moment reconstruction matrix S m Element value of position (n, n ') in's;
calculating an instance contrast loss of the attribute pair (n, n') at m time instant:
wherein Ω represents an N-dimensional vector matrix z at m-time m In the set of dimension attributes other than the nth dimension attribute and the nth' dimension attribute;
calculate the total loss of attribute pairs (n, n'):
wherein α represents a first hyper-parameter, α∈ (0, 1);
calculating a m-moment reconstruction matrix S m The total loss of' is:
in the iterative training process, each time the iterative training is completed, the reconstructed matrix S is judged m If' the total loss increment is smaller than the increment loss threshold, if so, the training is ended, otherwise, the training is continued.
In the training process of the reconstruction model, the comparison learning task is designed from two aspects of the time dimension and the instance dimension by utilizing the good symmetry of the similarity matrix, so that the capability of constructing robust representation is enhanced.
In the description of the present specification, a description referring to terms "one embodiment," "some embodiments," "examples," "specific examples," or "some examples," etc., means that a particular feature, structure, material, or characteristic described in connection with the embodiment or example is included in at least one embodiment or example of the present invention. In this specification, schematic representations of the above terms do not necessarily refer to the same embodiments or examples. Furthermore, the particular features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples.
While embodiments of the present invention have been shown and described, it will be understood by those of ordinary skill in the art that: many changes, modifications, substitutions and variations may be made to the embodiments without departing from the spirit and principles of the invention, the scope of which is defined by the claims and their equivalents.
Claims (10)
1. A multi-element time sequence abnormality detection and diagnosis method based on similarity is characterized by comprising the following steps:
step S1, a multi-element time sequence X= { X to be tested is obtained 1 ，...，X t ，...，X T }，X t Representing an N-dimensional attribute vector matrix at the moment T, wherein T represents the length of a time stamp, and T is more than or equal to 1 and less than or equal to T;
step S2, a basic probability distribution method and a valley measurement method are combined to obtain a similarity matrix of an N-dimensional attribute vector matrix at each moment;
s3, reconstructing a similarity matrix at each moment by using a reconstruction model based on an attention mechanism to obtain a reconstruction matrix at each moment;
s4, comparing the similarity matrix and the reconstruction matrix at each moment to obtain a similarity error matrix at the moment, sequentially judging whether each element in the similarity error matrix is abnormal or not, counting the number of abnormal elements in the similarity error matrix, and taking the number of the abnormal elements as an abnormal score at the corresponding moment;
and S5, judging whether the anomaly score of each moment reaches a first threshold value, if so, considering that the N-dimensional attribute vector matrix of the moment is abnormal, and further determining the anomaly attribute according to the anomaly element distribution in the similarity error matrix of the moment.
2. The multi-element time series anomaly detection and diagnosis method based on the similarity according to claim 1, wherein in step S2, the process of obtaining the similarity matrix of the N-dimensional attribute vector matrix at time t includes:
step S21, obtaining a pre-training sample set Z= { Z 1 ，...，z m ，...，z M }，z m Representing an M-th N-dimensional attribute vector matrix for training, wherein M is more than or equal to 1 and less than or equal to M; constructing Gaussian membership functions of each dimension attribute in the N-dimensional vector matrix relative to each detection category based on the pre-training sample set, wherein the detection categories comprise normal and abnormal;
step S22, matching N-dimensional vector matrix X at t moment t And Gaussian membership function, and fusing the matching result to obtain N-dimensional vector matrix X at t moment t Basic probability distribution of each dimension attribute relative to a calculation category c, wherein the calculation category c comprises three types of normal, abnormal and normal or abnormal;
step S23, according to the N-dimensional vector matrix X at the time t t Basic probability distribution iteration of each dimension attribute to obtain X t Uncertainty of the dimension attribute with respect to each calculation class;
step S24, calculating N-dimensional vector matrix X at t moment t The similarity of any two attributes in the model (C) is obtained, and a similarity matrix of an N-dimensional attribute vector matrix at the moment of t is obtained.
3. The method for detecting and diagnosing a multi-component time-series abnormality based on similarity as recited in claim 2, wherein in step S21, the n-th attribute is related to a gaussian membership function of the detection class c
The method comprises the following steps:
4. The method for detecting and diagnosing a multi-element time-series abnormality based on similarity as recited in claim 3, wherein in step S23, an N-dimensional vector matrix X at time t is obtained t The process of the uncertainty of the nth dimension attribute relative to the calculation category comprises the following steps:
step S321, initializing parameters:
setting variables
N-dimensional vector matrix X representing time t t Uncertainty of n-th dimension attribute of (a) relative to calculation category c, let +.>
Is>
Is X t Basic probability assignment of n-th dimension attribute to calculation class c>
/>
Setting p as iteration times and the initial value as 1;
calculating intermediate variables
Wherein when the calculation class c is normal or abnormal, |c|=1, and when the calculation class c is normal or abnormal, |c|=2; θ represents a value set of the calculation class c, θ= { normal, abnormal, normal or abnormal };
step S322, calculating according to the following formula
P iteration values of (a):
step S323, calculating an iteration increment
If delta < epsilon is satisfied, the iteration is stopped and
as->
If Δ < ε is not satisfied, p=p+1 and the process returns to step S322.
5. The method for detecting and diagnosing a multi-component time-series abnormality based on similarity as recited in claim 4, wherein said step S24 includes:
step S241, the N-dimensional vector matrix X at the time t is obtained according to the following formula t Similarity Sim between n-th and n' -th dimension properties t (n，n′)：
Wherein n' ∈ [1, N ]]，
N-dimensional vector matrix X representing time t t The uncertainty of the n' th dimension attribute of the medium relative to the calculation category c;
step S242, utilizing the N-dimensional vector matrix X at the time t t The similarity among all arbitrary attributes in the system constructs a t-moment similarity matrix S t ，S t Is of size N x N.
6. The method for similarity-based multivariate time series anomaly detection and diagnosis of claim 3, 4 or 5, wherein in step S3, the reconstruction model comprises:
tensor acquisition module: dividing similarity matrixes at t time and before t time by adopting sliding windows with different lengths to obtain window matrixes with different sizes, and combining all window matrixes to obtain t time tensor χ t ；
The multi-layer convolution module is used for downsampling the tensor at the moment t;
the attention-based network module splits the similarity matrix after downsampling into row vectors according to rows, inputs all the row vectors into a multi-head attention network, and the multi-head attention network outputs a reconstruction tensor at the moment t;
and the deconvolution layer deconvolves the reconstruction tensor at the time t to obtain a reconstruction matrix at the time t.
7. The similarity-based multivariate time series anomaly detection and diagnosis method of claim 6, wherein the attention-based network module performs:
step A, splitting the similarity matrix after downsampling into row vectors o according to rows t ；
Step B, row vector o t Conversion into three matrices, the query matrix q t Key matrix k t Sum matrix v t Query matrix q t The weight is
Key matrix k t The weight is +.>
Value matrix v t The weight is +.>
Step C, calculating a query matrix q t And all time key matrix k t Sparsity measure between the constituent matrices K:
where mode represents the modality;
step D, consisting of a sparsity measure M (q t The top-level queries of K) form a sparse matrix Q, and the definition of the attention of the obtained proportional dot product is as follows:
wherein V represents a matrix V of all time values t A matrix of components;
and E, obtaining multi-head proportional dot product attention by adopting a multi-head attention network consisting of a plurality of attention layers running in parallel:
MultiHeadAtt(Q，K，V)＝Concat(A 1 ，...，A h ，...，A H )；
wherein ,
h represents the number of attention layers; h is E [1, H]；Q h A sparse matrix representing an h-th attention layer input; k (K) h All time key matrix k representing the input of the h attention layer t A matrix of components; v (V) h All time value matrix v representing the input of the h attention layer t A matrix of components;
step F, setting the global attention unit as an all 0 matrix with the same shape as the input window when the row vector at the first moment is input, and connecting the all 0 matrix with the input window;
and G, performing position coding on the dot product attention of the multi-head proportion, and decoding the position at the t moment to obtain a reconstruction tensor at the t moment.
8. The method for detecting and diagnosing a multivariate time series anomaly based on similarity as recited in claim 7, wherein the training of the reconstruction model is performed by using a pre-training sample set Z based on a contrast learning method, and the reconstruction matrix S is obtained at the time of m in the training process m The' post-loss function calculation process includes:
calculating the time contrast loss of the attribute pair (n, n') at the m time instant:
wherein B represents a training batch size;
represents the m-time reconstruction matrix S m The element value of the position (n, n ') in's,
when m is representedReconstruction matrix S m Element value of position (n ', n) in' x->
Represents the m' moment reconstruction matrix S m Element value of position (n, n ') in's;
calculating an instance contrast loss of the attribute pair (n, n') at m time instant:
wherein Ω represents an N-dimensional vector matrix z at m-time m In the set of dimension attributes other than the nth dimension attribute and the nth' dimension attribute;
calculate the total loss of attribute pairs (n, n'):
wherein α represents a first hyper-parameter, α∈ (0, 1);
calculating a m-moment reconstruction matrix S m The total loss of' is:
9. the method for similarity-based multivariate time series anomaly detection and diagnosis according to claim 1 or 2 or 3 or 4 or 5 or 7 or 8, wherein step S4 comprises:
step S41, calculating a t-moment similarity error matrix DeltaS t ＝S t -S t′, wherein ,St N-dimensional vector matrix X representing time t t Similarity matrix of S t ' N-dimensional vector matrix X representing time t t Is used for reconstructing the matrix;
step S42, sequentially judging the similarity error matrix DeltaS t Each element of (3)Whether the element is larger than a second threshold value, and if so, considering that the element is abnormal; the second threshold th=γ·max (Δs|train), γ represents the second super-parameter, γ∈ (0, 1)]Max (Δs|train) represents the maximum element value of the similarity error matrix obtained during training;
and S43, counting the number of abnormal elements in the similarity error matrix at the time t and taking the number of the abnormal elements as an abnormal score at the time t.
10. The method for detecting and diagnosing a multi-component time-series abnormality based on similarity as recited in claim 9, wherein in step S5, the first threshold is:
τ＝β·max(S m |train)；
wherein, beta represents a third super parameter, beta E (0, 1)]，max(S m Train) represents the maximum anomaly score of the similarity matrix obtained during training.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202310208218.5A CN116185694A (en) | 2023-03-06 | 2023-03-06 | Multi-element time sequence abnormality detection and diagnosis method based on similarity |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202310208218.5A CN116185694A (en) | 2023-03-06 | 2023-03-06 | Multi-element time sequence abnormality detection and diagnosis method based on similarity |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN116185694A true CN116185694A (en) | 2023-05-30 |
Family
ID=86434415
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202310208218.5A Pending CN116185694A (en) | 2023-03-06 | 2023-03-06 | Multi-element time sequence abnormality detection and diagnosis method based on similarity |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN116185694A (en) |
Cited By (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN116577671A (en) * | 2023-07-12 | 2023-08-11 | 中国华能集团清洁能源技术研究院有限公司 | Battery system abnormality detection method and device |
| CN116738170A (en) * | 2023-06-13 | 2023-09-12 | 无锡物联网创新中心有限公司 | Abnormality analysis method and related device for industrial equipment |
| CN117421199A (en) * | 2023-12-19 | 2024-01-19 | 湖南三湘银行股份有限公司 | Behavior determination method and system |
| CN117473337A (en) * | 2023-12-25 | 2024-01-30 | 中国科学院自动化研究所 | Track association method, track association device, track association equipment and storage medium |
-
2023
- 2023-03-06 CN CN202310208218.5A patent/CN116185694A/en active Pending
Cited By (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN116738170A (en) * | 2023-06-13 | 2023-09-12 | 无锡物联网创新中心有限公司 | Abnormality analysis method and related device for industrial equipment |
| CN116577671A (en) * | 2023-07-12 | 2023-08-11 | 中国华能集团清洁能源技术研究院有限公司 | Battery system abnormality detection method and device |
| CN116577671B (en) * | 2023-07-12 | 2023-09-29 | 中国华能集团清洁能源技术研究院有限公司 | Battery system abnormality detection method and device |
| CN117421199A (en) * | 2023-12-19 | 2024-01-19 | 湖南三湘银行股份有限公司 | Behavior determination method and system |
| CN117421199B (en) * | 2023-12-19 | 2024-04-02 | 湖南三湘银行股份有限公司 | Behavior determination method and system |
| CN117473337A (en) * | 2023-12-25 | 2024-01-30 | 中国科学院自动化研究所 | Track association method, track association device, track association equipment and storage medium |
| CN117473337B (en) * | 2023-12-25 | 2024-03-22 | 中国科学院自动化研究所 | Track association method, track association device, track association equipment and storage medium |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US12001949B2 (en) | Computer-implemented method, computer program product and system for data analysis | |
| EP3620983B1 (en) | Computer-implemented method, computer program product and system for data analysis | |
| CN116185694A (en) | Multi-element time sequence abnormality detection and diagnosis method based on similarity | |
| CN106778014B (en) | Disease risk prediction modeling method based on recurrent neural network | |
| JP6793774B2 (en) | Systems and methods for classifying multidimensional time series of parameters | |
| Jin et al. | Position encoding based convolutional neural networks for machine remaining useful life prediction | |
| CN112098600A (en) | Fault detection and diagnosis method for chemical sensor array | |
| Zhu et al. | A coupled model for dam foundation seepage behavior monitoring and forecasting based on variational mode decomposition and improved temporal convolutional network | |
| CN115510975A (en) | Multivariable time sequence abnormality detection method and system based on parallel Transomer-GRU | |
| CN116340796A (en) | Time sequence data analysis method, device, equipment and storage medium | |
| Fang et al. | Multi-sensor prognostics modeling for applications with highly incomplete signals | |
| Fu et al. | MCA-DTCN: A novel dual-task temporal convolutional network with multi-channel attention for first prediction time detection and remaining useful life prediction | |
| Zhao et al. | Exploiting multiple question factors for knowledge tracing | |
| Williams et al. | Sensing with shallow recurrent decoder networks | |
| Liu et al. | A novel integration framework for degradation-state prediction via transformer model with autonomous optimizing mechanism | |
| Lee et al. | Robust tensor-on-tensor regression for multidimensional data modeling | |
| Zhan et al. | Neural networks for geospatial data | |
| CN111027681B (en) | Time sequence data processing model training method, data processing method, device and storage medium | |
| CN117041972A (en) | Channel-space-time attention self-coding based anomaly detection method for vehicle networking sensor | |
| Zhang et al. | Image Reconstruction for High‐Performance Electrical Capacitance Tomography System Using Deep Learning | |
| CN115034307A (en) | Vibration data self-confirmation method, system and terminal for multi-parameter self-adaptive fusion | |
| Rambhatla et al. | I-SEA: Importance Sampling and Expected Alignment-Based Deep Distance Metric Learning for Time Series Analysis and Embedding | |
| Chehal et al. | Comparative Study of Missing Value Imputation Techniques on E-Commerce Product Ratings | |
| Jing et al. | Study on temperature sensor data anomaly diagnosis method based on deep neural network | |
| He et al. | An Improved Industrial Process Soft Sensor Method Based on LSTM |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |