CN117786374B - Multivariate time sequence anomaly detection method and system based on graph neural network - Google Patents

Abstract

The present invention discloses a multivariate time series anomaly detection method and system based on graph neural network. The method comprises: obtaining time series input data to be detected, inputting the time series input data into a preset time series anomaly detection model to judge the time series anomaly; the construction process of the time series anomaly detection model comprises: obtaining a sample set and then training the time series anomaly detection model with the sample set; converting the unit sample x into a fused time series that simultaneously fuses the relationship between the time domain and the spatial domain ; The fused time series Input to encoder output intermediate features ; The fused time series and intermediate features The training output sequence is input to the decoder, the training loss value is calculated based on the training output sequence, the parameters of the time series anomaly detection model are optimized, and the trained time series anomaly detection model is output; the present invention can more comprehensively analyze multivariate time series data, thereby improving the accuracy and reliability of anomaly detection.

Description

A multivariate time series anomaly detection method and system based on graph neural network

Technical Field

The present invention belongs to the field of data time series anomaly detection, and specifically relates to a multivariate time series anomaly detection method and system based on graph neural network.

Background Art

Multivariate time series anomaly detection has wide applications in many fields such as finance, industrial manufacturing, and network security. Its main goal is to identify abnormal patterns in time series data so that potential problems can be discovered early and appropriate measures can be taken. Traditional anomaly detection methods are usually based on statistics or rules, but these methods often face limitations when dealing with complex multidimensional time series data.

In recent years, deep learning-based methods have made significant progress in the field of multivariate time series anomaly detection. In particular, algorithms that combine graph neural networks and encoder-decoder structures provide more powerful spatiotemporal modeling capabilities. Graph neural networks can capture complex spatial relationships in data, while encoder-decoder structures can effectively learn spatiotemporal representations of data for reconstruction and anomaly detection.

The key idea behind this emerging technology is to view multidimensional time series data as a graph structure, where nodes represent different features or dimensions and edges represent the spatial relationships between them. Through graph neural networks, spatial relationships can be effectively learned, thereby improving the accuracy and robustness of anomaly detection. In addition, the encoder-decoder structure helps capture the intrinsic representation of the data, making it a general method suitable for a variety of application scenarios.

The multivariate time series anomaly detection algorithm based on graph neural network and encoder-decoder structure represents an advanced technological trend, but there are still two problems with the existing technology: first, it is difficult to simultaneously consider the spatial relationship and time domain relationship of the time series during the time series reconstruction process; second, it is difficult to accurately locate the abnormal points of defective data.

Summary of the invention

The present invention provides a multivariate time series anomaly detection method and system based on graph neural network, which can more comprehensively analyze multivariate time series data, thereby improving the accuracy and reliability of anomaly detection.

In order to achieve the above object, the technical solution adopted by the present invention is:

The first aspect of the present invention provides a multivariate time series anomaly detection method based on a graph neural network, comprising:

Obtain the time series input data to be detected, input the time series input data into a preset time series anomaly detection model to obtain a detection output sequence, calculate the time series anomaly score based on the detection output sequence and the time series input data, and output the judgment result by comparing the time series anomaly score with a preset time series anomaly judgment threshold;

The construction process of the time series anomaly detection model includes:

After obtaining the sample set, the time series anomaly detection model is trained using the sample set, wherein the time series anomaly detection model includes a time series reconstruction module, an encoder, and a decoder;

Construct a graph structure G(V,E) based on the unit samples in the sample set; input the unit samples into the time domain dilation convolution to obtain the time series ; The time series And the graph structure G(V,E) are simultaneously input into the graph attention influence network to obtain the fused time series ;

Fusion of time series Input to encoder output intermediate features ; The fused time series and intermediate features Input into the decoder to obtain the training output sequence, calculate the training loss value based on the training output sequence, and optimize the parameters of the timing anomaly detection model according to the training loss value; repeat the training process of the timing anomaly detection model until the loss value converges, set the timing anomaly judgment threshold and output the trained timing anomaly detection model.

Preferably, the process of constructing the graph structure G(V, E) based on the unit samples in the sample set includes:

Unit Sample For input data, construct node information , where the node , Represented as a learnable weight matrix, It is expressed as a unit attribute feature representation of a time series, where T is the length of the sequence and N is the number of features;

Build Node and nodes The side information between ; Among them, the connecting edge , , \ is the node number removal operation;

According to the edge information, the K connecting edges with the highest relevance for each node are selected, and the graph structure G(V, E) is constructed based on the node information V and the edge information E.

Preferably, the unit sample is input into the time domain dilation convolution to obtain the time series The process includes:

Split the unit sample x into N groups of one-dimensional sequences of length T Then input to the time domain dilation convolution, where The corresponding convolution kernel is ; the expansion factor is df ; the receptive field is ; k represents the number of convolution kernel layers, which is used to abstract deeper time domain feature representation;

Finally, a dilated convolution operation is applied to the sequence position t, the convolution kernel length K, and the feature channel n to obtain the time series , defined as .

Preferably, the time series And the graph structure G(V,E) is input into the graph attention influence network to obtain the fusion time series The process includes:

For time series Extract subsequences according to the time domain dimension Then split it into ;

Calculate the weight of each connecting edge ,in: Represented as a learnable weight matrix, It is a single-layer fully connected layer, based on the weight of each connection edge Calculate the attention coefficient, the expression formula is:

;

in: is the activation function, represents matrix connection, is the weight vector; Represented as the target node The set of adjacent nodes of ;

According to the attention coefficient, the target node Update to get new nodes , the expression formula is:

;

in, represents a multi-layer perceptron; Expressed as attention coefficient; new node information is obtained through spatiotemporal relationship learning ; Make the time series after time domain learning Processed into a time series after spatial domain relationship learning .

Preferably, the fused time series Input to encoder output intermediate features The process includes:

Fusion of time series Input to the encoder, which includes a multi-branch attention mechanism, layer normalization B1, a feedforward neural network and layer normalization B2 in sequence;

Fusion of time series Input the multi-branch attention mechanism to obtain the feature sequence output; input the feature sequence output to the layer normalization B1 to obtain the time series , the expression formula is:

;

The time series Input to the feedforward neural network to obtain the time series , the expression formula is:

;

The time series Input to layer normalization B2 to obtain intermediate features , the expression formula is:

;

In the formula, Expressed as a normalized function; Represented as a feed-forward neural network.

Preferably, the fused time series The process of inputting into the multi-branch attention mechanism to obtain the feature sequence output includes:

The multi-branch attention mechanism includes Vaswani self-attention mechanism, dense integrated attention mechanism and dynamic convolutional neural network;

Fusion of time series Input to Vaswani self-attention mechanism to obtain feature sequence , the expression formula is:

;

In the formula, is the Vaswani Self Attention mechanism; W _Q is the weight matrix used to linearly map the input sequence to the query matrix; W _K is the weight matrix used to linearly map the input sequence to the key matrix; W _V is the weight matrix used to linearly map the input sequence to the value matrix; d _att is the feature dimension of the output sequence of the attention mechanism;

Fusion of time series Input to the dense comprehensive attention mechanism to obtain the feature sequence output ₂ , expressed as:

;

;

In the formula, _W1 represents the learnable weight matrix; _W2 represents the learnable weight matrix; _b1 represents the learnable bias parameter; _b2 represents the learnable bias parameter;

Fusion of time series Input into the dynamic convolutional neural network to obtain the feature sequence output ₃ , expressed as:

Preset Convolutional Neural Network , using the fused time series Convolutional Neural Network Training to learn attention weights , the expression formula is:

;

Among them, AvgPool is the average pooling layer, FC is the fully connected layer, ReLU is the nonlinear activation function, and Softmax is the normalization function; W _Avg represents the learnable weight matrix;

Preset Convolutional Neural Network ConvNet parameters , the attention weight Input to the convolutional neural network ConvNet to obtain the feature sequence output ₃ , expressed as:

;

;

The feature sequence output ₁ , feature sequence output ₂ and feature sequence output ₃ are weighted and summed to obtain the feature sequence output; the expression formula is:

;

in, are learnable weights.

Preferably, the fused time series and intermediate features The process of inputting to the decoder to obtain the training output sequence includes:

Fusion of time series The self-attention mechanism input to the decoder obtains intermediate features , the expression formula is: ;

In the formula, is the Vaswani Self Attention mechanism; W _Q is the weight matrix used to linearly map the input sequence to the query matrix; W _K is the weight matrix used to linearly map the input sequence to the key matrix; W _V is the weight matrix used to linearly map the input sequence to the value matrix; d _att is the feature dimension of the output sequence of the attention mechanism; T is the sequence length;

The intermediate features The layer normalization D1 input to the decoder obtains the intermediate features , the expression formula is:

;

The intermediate features and intermediate features The cross attention mechanism input to the decoder obtains intermediate features , the expression formula is:

;

The intermediate features The layer normalization D2 input to the decoder obtains the intermediate features , the expression formula is:

;

The intermediate features The feedforward neural network FFN input to the decoder obtains the training output sequence, which is expressed as:

;

In the formula, Represented as the training output sequence, Expressed as a normalized function; Represented as a feed-forward neural network.

Preferably, the process of calculating the training loss value based on the training output sequence includes:

;

In the formula, Represented as the reconstructed signal in the training output sequence, Represents the input signal in unit samples.

Preferably, the process of calculating the time series anomaly score based on the detection output sequence and the time series input data, and outputting the judgment result by comparing the time series anomaly score with a preset time series anomaly judgment threshold comprises:

;

;

In the formula, It is expressed as a time series anomaly score; Represented as time series input data; Represents the detection output sequence data, Indicates the judgment result; anomal indicates abnormal data; and nomal indicates normal data.

A second aspect of the present invention provides a multivariate time series anomaly detection system based on a graph neural network, comprising:

A detection unit is used to obtain time series input data to be detected, input the time series input data into a preset time series anomaly detection model to obtain a detection output sequence, calculate a time series anomaly score based on the detection output sequence and the time series input data, and output a judgment result by comparing the time series anomaly score with a preset time series anomaly judgment threshold;

The acquisition unit acquires the sample set and uses the sample set to train the time series anomaly detection model, wherein the time series anomaly detection model includes a time series reconstruction module, an encoder, and a decoder; constructs a graph structure G(V, E) based on the unit samples in the sample set; inputs the unit samples into the time domain dilation convolution to obtain the time series ; The time series And the graph structure G(V,E) are simultaneously input into the graph attention influence network to obtain the fused time series ;

Training unit, used to fuse time series Input to encoder output intermediate features ; The fused time series and intermediate features Input into the decoder to obtain the training output sequence, calculate the training loss value based on the training output sequence, and optimize the parameters of the timing anomaly detection model according to the training loss value; repeat the training process of the timing anomaly detection model until the loss value converges, set the timing anomaly judgment threshold and output the trained timing anomaly detection model.

Compared with the prior art, the present invention has the following beneficial effects:

The present invention processes multidimensional data with time and space relationships based on a graph attention influence network and a time-domain dilated convolutional network, and reconstructs the time series using an encoder-decoder structure. By comparing the difference between the input sequence and the reconstructed sequence, the abnormal state can be effectively determined; the present invention can more comprehensively analyze multivariate time series data, thereby improving the accuracy and reliability of anomaly detection.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG1 is a flow chart of a multivariate time series anomaly detection method based on a graph neural network provided in Embodiment 1;

FIG2 is a model diagram of a multivariate time series anomaly detection method based on a graph neural network provided in Embodiment 1;

FIG. 3 is a diagram of a spatiotemporal relationship learning module provided in the first embodiment.

DETAILED DESCRIPTION

The present invention will be further described below in conjunction with the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solution of the present invention, and cannot be used to limit the protection scope of the present invention.

Example 1

As shown in Figures 1 to 3, this implementation provides a multivariate time series anomaly detection method based on graph neural network, including:

The process of obtaining time series input data to be detected, inputting the time series input data into a preset time series anomaly detection model to obtain a detection output sequence, calculating a time series anomaly score based on the detection output sequence and the time series input data, and outputting a judgment result by comparing the time series anomaly score with a preset time series anomaly judgment threshold includes:

;

;

In the formula, It is expressed as a time series anomaly score; Represented as time series input data; Represents the detection output sequence data, Indicates the judgment result; anomal indicates abnormal data; and nomal indicates normal data.

The construction process of the time series anomaly detection model includes:

Get the sample set. The sample set is divided into "training set", "validation set" and "test set". Among them, the "training set" contains flawless data and unlabeled samples, which are used to train the prediction model; the "validation set" is a labeled sample, which contains flawed data and flawless data, which is used to find a reasonable threshold and debug the anomaly evaluator; the "test set" is a labeled sample, which contains flawed data and flawless data, which is used to test the generalization performance of the prediction model and anomaly evaluator.

In addition, the unit samples in the training set are defined as ,in, Represented as time series data of unit samples, , N is the number of features, T is the sequence length, and t is the starting point of the current sample; the labeled unit samples in the validation set and the test set are defined as , Represented as sample label, .

Using the sample set to train a time series anomaly detection model, the time series anomaly detection model includes an encoder and a decoder;

The process of constructing the graph structure G(V,E) based on the unit samples in the sample set includes:

Unit Sample For input data, construct node information , where the node , Represented as a learnable weight matrix, Represented as a unit attribute feature representation of a time series,

Build Node and nodes The side information between ; Among them, the connecting edge , , \ is the node number removal operation;

According to the edge information, the K connecting edges with the highest relevance for each node are selected, and the graph structure G(V, E) is constructed based on the node information V and the edge information E.

Input the unit sample into the time domain dilation convolution to obtain the time series The process includes:

Split the unit sample x into N groups of one-dimensional sequences of length T Then input to the time domain dilation convolution, where The corresponding convolution kernel is ; the expansion factor is df ; the receptive field is ; k represents the number of convolution kernel layers, which is used to abstract deeper time domain feature representation;

Finally, a dilated convolution operation is applied to the sequence position t, the convolution kernel length K, and the feature channel n to obtain the time series , defined as .

The time series And the graph structure G(V,E) is input into the graph attention influence network to obtain the fusion time series The process includes:

For time series Extract subsequences according to the time domain dimension Then split it into ;

Calculate the weight of each connecting edge ,in: Represented as a learnable weight matrix, It is a single-layer fully connected layer, based on the weight of each connection edge Calculate the attention coefficient, the expression formula is:

;

in: is the activation function, represents matrix connection, is the weight vector; Represented as the target node The set of adjacent nodes of ;

According to the attention coefficient, the target node Update to get new nodes , the expression formula is:

;

in, represents a multi-layer perceptron; Expressed as attention coefficient; new node information is obtained through spatiotemporal relationship learning ; Make the time series after time domain learning Processed into a time series after spatial domain relationship learning The graph attention influence network is adopted to flexibly allocate the attention coefficient between the target node and the source node by calculating the edge weight, and update the target node based on the screened adjacent nodes and attention coefficients.

Fusion of time series Input to encoder output intermediate features The process includes:

Fusion of time series Input to the encoder, which includes a multi-branch attention mechanism, layer normalization B1, a feedforward neural network and layer normalization B2 in sequence;

Fusion of time series The process of inputting into the multi-branch attention mechanism to obtain the feature sequence output includes:

The multi-branch attention mechanism includes Vaswani self-attention mechanism, dense integrated attention mechanism and dynamic convolutional neural network;

Fusion of time series Input to Vaswani self-attention mechanism to obtain feature sequence , the expression formula is:

;

In the formula, is the Vaswani Self Attention mechanism; W _Q is the weight matrix used to linearly map the input sequence to the query matrix; W _K is the weight matrix used to linearly map the input sequence to the key matrix; W _V is the weight matrix used to linearly map the input sequence to the value matrix; d _att is the feature dimension of the output sequence of the attention mechanism;

Fusion of time series Input to the dense comprehensive attention mechanism to obtain the feature sequence output ₂ , expressed as:

;

;

In the formula, _W1 represents the learnable weight matrix; _W2 represents the learnable weight matrix; _b1 represents the learnable bias parameter; _b2 represents the learnable bias parameter;

Fusion of time series Input into the dynamic convolutional neural network to obtain the feature sequence output ₃ , expressed as:

Preset Convolutional Neural Network , using the fused time series Convolutional Neural Network Training to learn attention weights , the expression formula is:

;

Among them, AvgPool is the average pooling layer, FC is the fully connected layer, ReLU is the nonlinear activation function, and Softmax is the normalization function; W _Avg represents the learnable weight matrix;

Preset Convolutional Neural Network ConvNet parameters , the attention weight Input to the convolutional neural network ConvNet to obtain the feature sequence output ₃ , expressed as:

;

;

The feature sequence output ₁ , feature sequence output ₂ and feature sequence output ₃ are weighted and summed to obtain the feature sequence output; the expression formula is:

;in, are learnable weights.

The multi-branch attention mechanism is used to integrate the "Vaswani attention mechanism", "dynamic convolutional network" and "dense integrated attention", and these three types of attention are merged into a whole through learnable weights, so that each variant of the attention mechanism can play its own advantages.

Input the feature sequence output to the layer normalization B1 to obtain the time series , the expression formula is:

;

The time series Input to the feedforward neural network to obtain the time series , the expression formula is:

;

The time series Input to layer normalization B2 to obtain intermediate features , the expression formula is:

;

In the formula, Expressed as a normalized function; Represented as a feed-forward neural network.

Fusion of time series and intermediate features The process of inputting to the decoder to obtain the training output sequence includes:

Fusion of time series The self-attention mechanism input to the decoder obtains intermediate features , the expression formula is:

;

In the formula, is the Vaswani Self Attention mechanism; W _Q is the weight matrix used to linearly map the input sequence to the query matrix; W _K is the weight matrix used to linearly map the input sequence to the key matrix; W _V is the weight matrix used to linearly map the input sequence to the value matrix; d _att is the feature dimension of the output sequence of the attention mechanism;

The intermediate features The layer normalization D1 input to the decoder obtains the intermediate features , the expression formula is:

;

The intermediate features and intermediate features The cross attention mechanism input to the decoder obtains intermediate features , the expression formula is:

;

The intermediate features The layer normalization D2 input to the decoder obtains the intermediate features , the expression formula is:

;

The intermediate features The feedforward neural network FFN input to the decoder obtains the training output sequence, which is expressed as:

;

In the formula, is represented as the training output sequence.

The training loss value is calculated based on the training output sequence, and the expression formula is:

;

In the formula, Represented as the reconstructed signal in the training output sequence, Represents the input signal in unit samples.

The parameters of the time series anomaly detection model are optimized according to the training loss value; the training process of the time series anomaly detection model is iterated repeatedly until the loss value converges.

Based on the validation set and grid search algorithm, the time series anomaly judgment threshold is adjusted. In order to adjust the time series anomaly judgment threshold for each feature dimension (N in total), first, the standard deviation of the features of N different dimensions is calculated. The standard deviation calculation formula of the n-th dimension feature is:

;

in, , It is expressed as the number of unit samples in the validation set; Represented as a unit sample in the validation set

N standard deviations share a variable parameter , the two are multiplied as the time series anomaly judgment threshold of N feature dimensions, and the expression formula is:

;

This embodiment processes multidimensional data with temporal and spatial relationships based on a graph attention influence network and a time-domain dilated convolutional network, and reconstructs the time series using an encoder-decoder structure. By comparing the difference between the input sequence and the reconstructed sequence, the abnormal state can be effectively determined, and multivariate time series data can be analyzed more comprehensively, thereby improving the accuracy and reliability of anomaly detection.

Example 2

This embodiment provides a multivariate time series anomaly detection system based on a graph neural network. The multivariate time series anomaly detection system can be applied to the multivariate time series anomaly detection method described in Example 1. The multivariate time series anomaly detection system includes:

A detection unit is used to obtain time series input data to be detected, input the time series input data into a preset time series anomaly detection model to obtain a detection output sequence, calculate a time series anomaly score based on the detection output sequence and the time series input data, and output a judgment result by comparing the time series anomaly score with a preset time series anomaly judgment threshold;

The acquisition unit acquires the sample set and uses the sample set to train the time series anomaly detection model, wherein the time series anomaly detection model includes a time series reconstruction module, an encoder, and a decoder; constructs a graph structure G(V, E) based on the unit samples in the sample set; inputs the unit samples into the time domain dilation convolution to obtain the time series ; The time series And the graph structure G(V,E) are simultaneously input into the graph attention influence network to obtain the fused time series ;

Training unit, used to fuse time series Input to encoder output intermediate features ; The fused time series and intermediate features Input into the decoder to obtain the training output sequence, calculate the training loss value based on the training output sequence, and optimize the parameters of the timing anomaly detection model according to the training loss value; repeat the training process of the timing anomaly detection model until the loss value converges, set the timing anomaly judgment threshold and output the trained timing anomaly detection model.

Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

The present application is described with reference to the flowcharts and/or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and/or box in the flowchart and/or block diagram, as well as the combination of the processes and/or boxes in the flowchart and/or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate a device for implementing the functions specified in one process or multiple processes in the flowchart and/or one box or multiple boxes in the block diagram.

These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device that implements the functions specified in one or more processes in the flowchart and/or one or more boxes in the block diagram.

These computer program instructions may also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, whereby the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more processes in the flowchart and/or one or more boxes in the block diagram.

The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims (8)

1. A multivariate time series anomaly detection method based on graph neural network, characterized by comprising: Obtain the time series input data to be detected, input the time series input data into a preset time series anomaly detection model to obtain a detection output sequence, calculate the time series anomaly score based on the detection output sequence and the time series input data, and output the judgment result by comparing the time series anomaly score with a preset time series anomaly judgment threshold; The construction process of the time series anomaly detection model includes: After obtaining the sample set, the time series anomaly detection model is trained using the sample set, wherein the time series anomaly detection model includes a time series reconstruction module, an encoder, and a decoder; Construct a graph structure G(V,E) based on the unit samples in the sample set; input the unit samples into the time domain dilation convolution to obtain the time series ; The time series And the graph structure G(V,E) are simultaneously input into the graph attention influence network to obtain the fused time series ; Fusion of time series Input to encoder output intermediate features The process includes: Fusion of time series Input to the encoder, which includes a multi-branch attention mechanism, layer normalization B1, a feedforward neural network and layer normalization B2 in sequence; Fusion of time series Input to a multi-branch attention mechanism, wherein the multi-branch attention mechanism includes a Vaswani self-attention mechanism, a dense integrated attention mechanism, and a dynamic convolutional neural network; Fusion of time series Input to Vaswani self-attention mechanism to obtain feature sequence , the expression formula is: ; In the formula, is the Vaswani Self Attention mechanism; W _Q is the weight matrix used to linearly map the input sequence to the query matrix; W _K is the weight matrix used to linearly map the input sequence to the key matrix; W _V is the weight matrix used to linearly map the input sequence to the value matrix; d _att is the feature dimension of the output sequence of the attention mechanism; Fusion of time series Input to the dense comprehensive attention mechanism to obtain the feature sequence output ₂ , expressed as: ; ; In the formula, _W1 represents the learnable weight matrix; _W2 represents the learnable weight matrix; _b1 represents the learnable bias parameter; _b2 represents the learnable bias parameter; Fusion of time series Input into the dynamic convolutional neural network to obtain the feature sequence output ₃ , expressed as: Preset Convolutional Neural Network , using the fused time series Convolutional Neural Network Training to learn attention weights , the expression formula is: ; Among them, AvgPool is the average pooling layer, FC is the fully connected layer, ReLU is the nonlinear activation function, and Softmax is the normalization function; W _Avg represents the learnable weight matrix; Preset Convolutional Neural Network ConvNet parameters , the attention weight Input to the convolutional neural network ConvNet to obtain the feature sequence output ₃ , expressed as: ; ; The feature sequence output ₁ , feature sequence output ₂ and feature sequence output ₃ are weighted and summed to obtain the feature sequence output; the expression formula is: ; in, is the learnable weight; Input the feature sequence output to the layer normalization B1 to obtain the time series , the expression formula is: ; The time series Input to the feedforward neural network to obtain the time series , the expression formula is: ; The time series Input to layer normalization B2 to obtain intermediate features , the expression formula is: ; In the formula, Expressed as a normalized function; Represented as a feed-forward neural network; Fusion of time series and intermediate features Input into the decoder to obtain the training output sequence, calculate the training loss value based on the training output sequence, and optimize the parameters of the timing anomaly detection model according to the training loss value; repeat the training process of the timing anomaly detection model until the loss value converges, set the timing anomaly judgment threshold and output the trained timing anomaly detection model. 2. The multivariate time series anomaly detection method according to claim 1, characterized in that the process of constructing a graph structure G(V, E) based on unit samples in the sample set comprises: Unit Sample For input data, construct node information , where the node , Represented as a learnable weight matrix, It is expressed as a unit attribute feature representation of a time series, where T is the length of the sequence and N is the number of features; Build Node and nodes The side information between ; Among them, the connecting edge , , \ is the node number removal operation; According to the edge information, the K connecting edges with the highest relevance for each node are selected, and the graph structure G(V, E) is constructed based on the node information V and the edge information E. 3. The multivariate time series anomaly detection method according to claim 2 is characterized in that the unit sample is input into the time domain dilation convolution to obtain the time series The process includes: Split the unit sample x into N groups of one-dimensional sequences of length T Then input to the time domain dilation convolution, where The corresponding convolution kernel is ; the expansion factor is df ; the receptive field is ; k represents the number of convolution kernel layers, which is used to abstract deeper time domain feature representation; Finally, a dilated convolution operation is applied to the sequence position t, the convolution kernel length K, and the feature channel n to obtain the time series , defined as . 4. The multivariate time series anomaly detection method according to claim 3 is characterized in that the time series And the graph structure G(V,E) is input into the graph attention influence network to obtain the fusion time series The process includes: For time series Extract subsequences according to the time domain dimension Then split it into ; Calculate the weight of each connecting edge ,in: Represented as a learnable weight matrix, It is a single-layer fully connected layer, based on the weight of each connection edge Calculate the attention coefficient, the expression formula is: ; in: is the activation function, represents matrix connection, is the weight vector; Represented as the target node The set of adjacent nodes of ; According to the attention coefficient, the target node Update to get new nodes , the expression formula is: ; in, represents a multi-layer perceptron; Expressed as attention coefficient; new node information is obtained through spatiotemporal relationship learning ; Make the time series after time domain learning Processed into a time series after spatial domain relationship learning . 5. The multivariate time series anomaly detection method according to claim 1 is characterized in that the fusion time series and intermediate features The process of inputting to the decoder to obtain the training output sequence includes: Fusion of time series The self-attention mechanism input to the decoder obtains intermediate features , the expression formula is: ; In the formula, is the Vaswani Self Attention mechanism; W _Q is the weight matrix used to linearly map the input sequence to the query matrix; W _K is the weight matrix used to linearly map the input sequence to the key matrix; W _V is the weight matrix used to linearly map the input sequence to the value matrix; d _att is the feature dimension of the output sequence of the attention mechanism; T is the sequence length; The intermediate features The layer normalization D1 input to the decoder obtains the intermediate features , the expression formula is: ; The intermediate features and intermediate features The cross attention mechanism input to the decoder obtains intermediate features , the expression formula is: ; The intermediate features The layer normalization D2 input to the decoder obtains the intermediate features , the expression formula is: ; The intermediate features The feedforward neural network FFN input to the decoder obtains the training output sequence, which is expressed as: ; In the formula, Represented as the training output sequence, Expressed as a normalized function; Represented as a feed-forward neural network. 6. The multivariate time series anomaly detection method according to claim 5, wherein the process of calculating the training loss value based on the training output sequence comprises: ; In the formula, Represented as the reconstructed signal in the training output sequence, Represents the input signal in unit samples. 7. The multivariate time series anomaly detection method according to claim 1, characterized in that the process of calculating the time series anomaly score based on the detection output sequence and the time series input data, and outputting the judgment result by comparing the time series anomaly score with a preset time series anomaly judgment threshold comprises: ; ; In the formula, It is expressed as a time series anomaly score; Represented as time series input data; Represents the detection output sequence data, Indicates the judgment result; anomal indicates abnormal data; and nomal indicates normal data. 8. A multivariate time series anomaly detection system based on graph neural network, characterized by comprising: A detection unit is used to obtain time series input data to be detected, input the time series input data into a preset time series anomaly detection model to obtain a detection output sequence, calculate a time series anomaly score based on the detection output sequence and the time series input data, and output a judgment result by comparing the time series anomaly score with a preset time series anomaly judgment threshold; The acquisition unit acquires the sample set and uses the sample set to train the time series anomaly detection model, wherein the time series anomaly detection model includes a time series reconstruction module, an encoder, and a decoder; constructs a graph structure G(V, E) based on the unit samples in the sample set; inputs the unit samples into the time domain dilation convolution to obtain the time series ; The time series And the graph structure G(V,E) are simultaneously input into the graph attention influence network to obtain the fused time series ; Training unit, used to fuse time series Input to encoder output intermediate features ; The fused time series and intermediate features Input to the decoder to obtain the training output sequence, calculate the training loss value based on the training output sequence, and optimize the parameters of the timing anomaly detection model according to the training loss value; repeat the training process of the timing anomaly detection model until the loss value converges, set the timing anomaly judgment threshold and output the trained timing anomaly detection model; The training unit will fuse the time series Input to encoder output intermediate features The process includes: Fusion of time series Input to the encoder, which includes a multi-branch attention mechanism, layer normalization B1, a feedforward neural network and layer normalization B2 in sequence; Fusion of time series Input to a multi-branch attention mechanism, wherein the multi-branch attention mechanism includes a Vaswani self-attention mechanism, a dense integrated attention mechanism, and a dynamic convolutional neural network; Fusion of time series Input to Vaswani self-attention mechanism to obtain feature sequence , the expression formula is: ; In the formula, is the Vaswani Self Attention mechanism; W _Q is the weight matrix used to linearly map the input sequence to the query matrix; W _K is the weight matrix used to linearly map the input sequence to the key matrix; W _V is the weight matrix used to linearly map the input sequence to the value matrix; d _att is the feature dimension of the output sequence of the attention mechanism; Fusion of time series Input to the dense comprehensive attention mechanism to obtain the feature sequence output ₂ , expressed as: ; ; In the formula, _W1 represents the learnable weight matrix; _W2 represents the learnable weight matrix; _b1 represents the learnable bias parameter; _b2 represents the learnable bias parameter; Fusion of time series Input into the dynamic convolutional neural network to obtain the feature sequence output ₃ , expressed as: Preset Convolutional Neural Network , using the fused time series Convolutional Neural Network Training to learn attention weights , the expression formula is: ; Among them, AvgPool is the average pooling layer, FC is the fully connected layer, ReLU is the nonlinear activation function, and Softmax is the normalization function; W _Avg represents the learnable weight matrix; Preset Convolutional Neural Network ConvNet parameters , the attention weight Input to the convolutional neural network ConvNet to obtain the feature sequence output ₃ , expressed as: ; ; The feature sequence output ₁ , feature sequence output ₂ and feature sequence output ₃ are weighted and summed to obtain the feature sequence output; the expression formula is: ; in, is the learnable weight; Input the feature sequence output to the layer normalization B1 to obtain the time series , the expression formula is: ; The time series Input to the feedforward neural network to obtain the time series , the expression formula is: ; The time series Input to layer normalization B2 to obtain intermediate features , the expression formula is: ; In the formula, Expressed as a normalized function; Represented as a feed-forward neural network.