WO2021204010A1

WO2021204010A1 - Time series anomaly detection method and apparatus, and computer device and storage medium

Info

Publication number: WO2021204010A1
Application number: PCT/CN2021/083751
Authority: WO
Inventors: 陈桢博; 郑立颖; 徐亮
Original assignee: 平安科技（深圳）有限公司
Priority date: 2020-11-19
Filing date: 2021-03-30
Publication date: 2021-10-14
Also published as: CN112380098A; CN112380098B

Abstract

A time series anomaly detection method and apparatus, and a computer device and a storage medium. The method comprises: using a first convolutional neural network to perform convolution processing on a time series data sample, so as to obtain a time series feature associated with a local neighboring time step (S101); using an attention mechanism to be associated with a global time step of the time series feature, so as to obtain a time series feature associated with the global time step (S102); using a variational auto-encoding algorithm to encode and decode the time series feature associated with the global time step, so as to obtain a reconstructed time series feature (S103); using a second convolutional neural network to perform convolution processing on the reconstructed time series feature, so as to obtain time series restoration data (S104); using the difference between the time series data sample and the time series restoration data to detect an outlier of the time series data sample, and completing the construction of a time series anomaly detection model (S105); and using the time series anomaly detection model to perform detection on time series data to be subjected to detection, so as to obtain an outlier of said time series data (S106). The applicability and accuracy of a model are thus improved.

Description

Time sequence abnormality detection method, device, computer equipment and storage medium

This application claims the priority of the Chinese patent application filed with the Chinese Patent Office on November 19, 2020, the application number is 202011306700.5, and the invention title is "a timing anomaly detection method, device, computer equipment and storage medium", and its entire content Incorporated in this application by reference.

Technical field

This application relates to the field of artificial intelligence technology, in particular to the field of deep learning, and in particular to a timing anomaly detection method, device, computer equipment, and storage medium.

Background technique

The anomaly detection program of the operation and maintenance system is mainly responsible for monitoring the indicators of multiple objects such as applications and hardware in the operation and maintenance system (for example, the CPU usage indicator of a certain host object). When the indicator is abnormal, it will alert in real time to prompt work Personnel conduct investigation. There are many types of anomaly detection algorithms, including statistical algorithms, machine learning algorithms, and deep learning algorithms. Among them, deep learning algorithms are more accurate and are currently the main research and application direction.

However, the inventor found that in the prior art, in the process of anomaly detection, it is generally impossible to provide a large amount of labeled data, which causes the applicability and accuracy of the supervised learning algorithm to decrease.

Application content

The purpose of this application is to provide a timing anomaly detection method, device, computer equipment and storage medium, aiming to solve the problems of reduced applicability and low accuracy of the timing anomaly detection method in the prior art.

In the first aspect, an embodiment of the present application provides a timing anomaly detection method, which includes:

Use the first convolutional neural network to perform convolution processing on the time series data samples of the operation and maintenance system to obtain the time series characteristics associated with local adjacent time steps;

Use the attention mechanism to correlate the global time steps of the time sequence features to obtain the time sequence features associated with the global time steps;

Encoding and decoding the time-series features associated with the global time step by using a variational self-encoding algorithm to obtain reconstructed time-series features;

Using a second convolutional neural network to perform convolution processing on the reconstructed time series feature to obtain time series restoration data;

Use the difference between the time series data sample and the time series restoration data to detect the abnormal value of the time series data sample, and complete the construction of the time series abnormality detection model;

The time series abnormality detection model is used to detect the time series data to be tested, and the abnormal value of the time series data to be tested is obtained.

In a second aspect, an embodiment of the present application provides a timing anomaly detection device, which includes:

The first convolution unit is configured to use the first convolutional neural network to perform convolution processing on the time series data samples of the operation and maintenance system to obtain the time series characteristics associated with local adjacent time steps;

An attention mechanism unit, configured to use the attention mechanism to correlate the global time steps of the time sequence features to obtain the time sequence features associated with the global time steps;

The self-encoding unit is configured to use a variational self-encoding algorithm to encode and decode the time-series features associated with the global time step to obtain reconstructed time-series features;

The second convolution unit is configured to use a second convolutional neural network to perform convolution processing on the reconstructed time series feature to obtain time series restoration data;

A model construction unit, configured to use the difference between the time series data sample and the time series restoration data to detect the abnormal value of the time series data sample, and complete the construction of the time series abnormality detection model;

The model detection unit is configured to detect the time series data to be tested by using the time series abnormality detection model to obtain the abnormal value of the time series data to be tested.

In a third aspect, embodiments of the present application provide a computer device, including a memory, a processor, and a computer program stored on the memory and running on the processor, wherein the processor executes the computer program When realizing the timing abnormality detection method as described in the first aspect.

In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program that, when executed by a processor, causes the processor to execute The timing anomaly detection method described in the aspect.

In the embodiment of the application, the convolutional neural network is combined with the attention mechanism to realize the extraction of time series features, and then complete the time series abnormality detection, and through the variational auto-encoding algorithm, the time series abnormality detection model is established based on the unsupervised learning method, which improves the applicability of the model And accuracy.

Description of the drawings

In order to explain the technical solutions of the embodiments of the present application more clearly, the following will briefly introduce the drawings used in the description of the embodiments. Obviously, the drawings in the following description are some embodiments of the present application. Ordinary technicians can obtain other drawings based on these drawings without creative work.

FIG. 1 is a schematic flowchart of a timing anomaly detection method provided by an embodiment of the application;

FIG. 2 is a schematic diagram of a sub-flow of the timing anomaly detection method provided by an embodiment of the application;

FIG. 3 is a schematic diagram of another sub-flow of the timing anomaly detection method provided by an embodiment of the application;

FIG. 4 is a schematic diagram of another sub-flow of the timing anomaly detection method provided by an embodiment of the application;

FIG. 5 is a schematic diagram of another sub-flow of the timing anomaly detection method provided by an embodiment of the application;

FIG. 6 is a schematic block diagram of a timing anomaly detection device provided by an embodiment of the application;

FIG. 7 is a schematic block diagram of subunits of a timing anomaly detection device provided by an embodiment of the application; FIG.

FIG. 8 is a schematic block diagram of another subunit of the timing anomaly detection device provided by an embodiment of the application; FIG.

FIG. 9 is a schematic block diagram of another subunit of the timing anomaly detection device provided by an embodiment of the application; FIG.

FIG. 10 is a schematic block diagram of another subunit of the timing anomaly detection device provided by an embodiment of the application; FIG.

FIG. 11 is a schematic block diagram of a computer device provided by an embodiment of the application.

Detailed ways

The technical solutions in the embodiments of the present application will be described clearly and completely in conjunction with the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all of them. Based on the embodiments in this application, all other embodiments obtained by those of ordinary skill in the art without creative work shall fall within the protection scope of this application.

It should be understood that when used in this specification and appended claims, the terms "including" and "including" indicate the existence of the described features, wholes, steps, operations, elements and/or components, but do not exclude one or The existence or addition of multiple other features, wholes, steps, operations, elements, components, and/or collections thereof.

It should also be understood that the terms used in the specification of this application are only for the purpose of describing specific embodiments and are not intended to limit the application. As used in the specification of this application and the appended claims, unless the context clearly indicates other circumstances, the singular forms "a", "an" and "the" are intended to include plural forms.

It should be further understood that the term "and/or" used in the specification and appended claims of this application refers to any combination and all possible combinations of one or more of the associated listed items, and includes these combinations .

Please refer to FIG. 1. FIG. 1 is a schematic flowchart of a timing anomaly detection method provided by an embodiment of the application. As shown in the figure, it includes steps S101 to S106:

S101: Use the first convolutional neural network to perform convolution processing on time series data samples of the operation and maintenance system to obtain time series characteristics associated with local adjacent time steps;

In the embodiment of this application, the function of the first convolutional neural network is to perform convolution processing on time series data samples, and then extract the time series features associated with local adjacent time steps. In the embodiment of this application, a 2-layer convolutional layer is used. : The first convolutional layer and the second convolutional layer. Of course, the embodiment of the present application can also superimpose the convolutional layer as required.

In an embodiment, as shown in FIG. 2, the step S101 includes steps S201 to S202:

S201: Perform convolution processing on the time series data sample by using the first convolution layer in the first convolutional neural network to obtain a first intermediate feature;

In this step, perform convolution processing according to the following formula: x1 = Conv1D ¹ (x0)

Where x0 is the input time series data sample, Conv1D ¹ represents the convolution operation of the first convolutional layer. In the embodiment of the present application, the first convolutional layer is a 1-dimensional convolutional layer, then Conv1D ¹ represents a 1-dimensional convolution Product operation. x1 represents the first intermediate feature obtained after convolution processing.

S202. Perform convolution processing on the first intermediate feature by using the second convolutional layer in the first convolutional neural network to obtain time-series features associated with local adjacent time steps.

In this step, perform convolution processing according to the following formula: x2 = Conv1D ² (x1)

Wherein, x1 on the right is the first time feature before processing, that is, the first time feature of the input, and Conv1D ² represents the convolution operation of the second convolutional layer. In the embodiment of the present application, the second convolutional layer is 1. One-dimensional convolution layer, then Conv1D ² represents a one-dimensional convolution operation. The x2 on the left represents the first intermediate feature obtained after convolution processing, that is, the timing feature associated with the local adjacent time step.

S102: Use the attention mechanism to correlate the global time steps of the time sequence features to obtain the time sequence features associated with the global time steps;

The above-mentioned first convolutional neural network can extract time-series features associated with local adjacent time steps, but cannot perform comprehensive associations on global time steps (steps). Therefore, the embodiment of the present application adds an attention mechanism to perform correlation calculation on the output data processed by the first convolutional neural network, so as to realize global timing correlation.

In an embodiment, as shown in FIG. 3, the step S102 includes steps S301 to S303:

S301. Use the time sequence characteristics associated with the local adjacent time steps as input data, and construct a query matrix, a key matrix, and a value matrix according to the input data.

In the step S301, firstly, the time-series features associated with local adjacent time steps are used as input data, and a query matrix, a key matrix, and a value matrix are respectively constructed. The query matrix is the query, and the key matrix is the key matrix. The value matrix is the value matrix.

Specifically, the query matrix, key matrix and value matrix are calculated according to the following formulas:

query=Dense ^q (x2)

key=Dense ^k (x2)

value=Dense ^v (x2)

Among them, x2 is the time sequence feature associated with local adjacent time steps, Dense represents the fully connected layer Dense Layer, query represents the query matrix, key represents the key matrix, and value represents the value matrix, where q, k, and v respectively represent matrix conversion.

Among them, the calculation methods of query, key, and value are the same, and the matrix can be output as the result through the fully connected layer. The fully connected layer contains parameters w and b, and the calculation method is:

y=w×x+b

For the query matrix, key matrix and value matrix, the parameters w and b of the three are different, so for the same x=x2, different ys are obtained, namely query, key and value.

S302. Multiply the query matrix by the key matrix, and use an activation function to activate the product result to obtain attention weights;

In this step, the attention weight is calculated according to the following formula: attention=softmax(query*key)

Among them, attention represents the attention weight, query represents the query matrix, key represents the key matrix, and softmax represents the softmax activation function, that is, first performs a product operation on the query matrix and the key matrix, and then activates it to obtain the attention weight attention.

The calculation method of the softmax activation function is as follows:

The softmax activation function can map the output data to the (0,1) interval, so that the output data can be understood as a probability. For example, an array V, V, V _i represents the i-th element, then the value of this element is softmax

In addition to the above softmax activation function, other activation functions may also be used in the embodiment of the present application to convert the output data into the (0,1) interval.

S303. Multiply the attention weight by the value matrix, and connect it with the input data, and output the time sequence characteristics associated with the global time step.

In this step, the timing characteristics associated with the global time step are calculated according to the following formula: x3=attention*value+x2

Among them, attention is the attention weight, value represents the value matrix, and x2 is the time sequence feature associated with the local adjacent time step.

That is, first perform the product operation of the attention weight attention and the value matrix, and then add the result of the product to the time series characteristics associated with the local adjacent time steps, so as to obtain the time series characteristics associated with the global time step. Since the attention weight in the calculation process can represent the mutual timing correlation between each time step in the entire time sequence, the embodiment of the present application realizes the global timing correlation.

S103: Use a variational self-encoding algorithm to encode and decode the time-series characteristics associated with the global time step to obtain reconstructed time-series characteristics;

After the global timing correlation calculation in step S102, the variational self-encoding operation in step S103 can be performed. Variational self-encoding algorithm VAE, as a kind of self-encoding algorithm, includes an encoder and a decoder. The encoder receives input, and the decoder reconstructs the input through sampling.

In an embodiment, as shown in FIG. 4, the step S103 includes steps S401 to S402:

S401: Input the time sequence characteristics associated with the global time step into an encoder for encoding, and generate a mean value and a standard deviation through a fully connected layer;

In this step, encoding is performed by the encoder, which performs dimensionality reduction through convolution pooling, and generates a mean value and a standard deviation through a fully connected layer for subsequent input to the decoder.

S402. Input the mean value and the standard deviation to a decoder to perform standard normal distribution sampling to obtain reconstructed time series characteristics.

In this step, the decoder performs dimensionality enhancement through deconvolution and depooling, and performs standard normal distribution sampling on the input mean and standard deviation, thereby completing the reconstruction of the timing features.

This embodiment as a whole can be expressed by the following formula: x4=VAE(x3)

Among them, x3 represents the time sequence characteristics associated with the global time step, x4 represents the time sequence characteristics of the reconstruction, and VAE represents the variational auto-encoding algorithm.

S104: Perform convolution processing on the reconstructed time series feature by using the second convolutional neural network to obtain time series restoration data;

In the above step 103, the reconstruction step is lossy to the input information, so this step cannot well restore the abnormal samples that will not be involved in the model training process. Therefore, the embodiment of the present application performs convolution processing after VAE reconstruction.

In an embodiment, as shown in FIG. 5, the step S104 includes steps S501 to S502:

S501: Perform convolution processing on the reconstructed time series feature by using the third convolution layer in the second convolutional neural network to obtain a second intermediate feature;

In this step, perform convolution processing according to the following formula: x5 = Conv1D ¹ (x4)

Where x4 is the time sequence feature of the input reconstruction, and Conv1D ¹ represents the convolution operation of the third convolutional layer. In the embodiment of the present application, the third convolutional layer is a 1-dimensional convolutional layer, then Conv1D ¹ represents 1. Dimensional convolution operation. x5 represents the second intermediate feature obtained after convolution processing.

S502. Perform convolution processing on the second intermediate feature by using the fourth convolution layer in the second convolutional neural network to obtain time-series restoration data.

In this step, perform convolution processing according to the following formula: x6 = Conv1D ² (x5)

Wherein, x5 on the right is the second time feature before processing, that is, the input second time feature, and Conv1D ² represents the convolution operation of the fourth convolutional layer. In the embodiment of the present application, the fourth convolutional layer is 1. One-dimensional convolution layer, then Conv1D ² represents a one-dimensional convolution operation. The x6 on the left represents the second intermediate feature obtained after the convolution process, that is, the time series restored data.

S105. Use the difference between the time series data sample and the time series restoration data to detect the abnormal value of the time series data sample, and complete the construction of the time series abnormality detection model;

In this step, based on the difference between the time series data sample and the time series restoration data, model training and abnormality detection can be performed, thereby completing the construction of the time series abnormality detection model.

In an embodiment, after the step S105, the method includes:

Calculating a loss function based on the difference between the time series data sample and the time series restoration data;

The loss function is used to iteratively optimize the timing anomaly detection model until the preset number of iterations is reached or the loss value is less than a preset loss threshold.

In this embodiment, based on the difference between the time series data sample and the time series restoration data, the loss function ELBO (lower bound of evidence) is calculated, and based on the loss function ELBO, the Adam (adaptive moment estimation) optimization algorithm is used to optimize the time series. The anomaly detection model is iteratively trained to complete the training of the model. The termination of training can be that the number of iterations reaches the preset number of iterations, or the loss value is less than the preset loss threshold.

S106: Use the time series abnormality detection model to detect the time series data to be tested, and obtain an abnormal value of the time series data to be tested.

In the embodiment of the present application, the time series data to be tested can be detected based on the time series abnormality detection model, so as to determine the abnormal value of the time series data to be tested. For normal samples, the model can be restored with a higher degree of similarity after reconstruction. For abnormal samples, a certain error will occur with the original data after the model is reconstructed. This error can be measured by MSE (Mean Square Error). When the MSE value reaches a preset measurement threshold, it means that the reconstruction error exceeds the upper limit, and the corresponding sample is identified as an abnormal sample.

Please refer to FIG. 6. FIG. 6 is a schematic block diagram of a timing anomaly detection device provided by an embodiment of the application, which includes:

The first convolution unit 601 is configured to use the first convolutional neural network to perform convolution processing on time series data samples of the operation and maintenance system to obtain time series characteristics associated with local adjacent time steps;

The attention mechanism unit 602 is configured to use the attention mechanism to correlate the global time steps of the time sequence features to obtain the time sequence features associated with the global time steps;

The self-encoding unit 603 is configured to use a variational self-encoding algorithm to encode and decode the time-series features associated with the global time step to obtain reconstructed time-series features;

The second convolution unit 604 is configured to use a second convolutional neural network to perform convolution processing on the reconstructed time series feature to obtain time series restoration data;

The model construction unit 605 is configured to use the difference between the time series data sample and the time series restoration data to detect the abnormal value of the time series data sample, and complete the construction of the time series abnormality detection model;

The model detection unit 606 is configured to detect the time series data to be tested by using the time series anomaly detection model to obtain the abnormal value of the time series data to be tested.

In an embodiment, as shown in FIG. 7, the first convolution unit 601 includes:

The first convolutional layer processing unit 701 is configured to use the first convolutional layer in the first convolutional neural network to perform convolution processing on the time series data sample to obtain a first intermediate feature;

The second convolutional layer processing unit 702 is configured to use the second convolutional layer in the first convolutional neural network to perform convolution processing on the first intermediate feature to obtain time sequence features associated with local adjacent time steps.

In an embodiment, as shown in FIG. 8, the attention mechanism unit 602 includes:

The matrix construction unit 801 is configured to use the time-series features associated with locally adjacent time steps as input data, and respectively construct a query matrix, a key matrix, and a value matrix according to the input data;

The activation unit 802 is configured to multiply the query matrix by the key matrix, and activate the product result by using an activation function to obtain the attention weight;

The global correlation unit 803 is configured to multiply the attention weight by the value matrix, connect it with input data, and output the time sequence characteristics associated with the global time step.

In an embodiment, as shown in FIG. 9, the self-encoding unit 603 includes:

The encoding unit 901 is configured to input the time sequence characteristics associated with the global time step into the encoder for encoding, and generate a mean value and a standard deviation through a fully connected layer;

The decoding unit 902 is configured to input the mean value and the standard deviation to the decoder to perform standard normal distribution sampling to obtain reconstructed time series characteristics.

In an embodiment, as shown in FIG. 10, the second convolution unit 604 includes:

The third convolutional layer processing unit 1001 uses the third convolutional layer in the second convolutional neural network to perform convolution processing on the reconstructed time series feature to obtain a second intermediate feature;

The fourth convolutional layer processing unit 1002 uses the fourth convolutional layer in the second convolutional neural network to perform convolution processing on the second intermediate feature to obtain time series restored data.

In an embodiment, the timing abnormality detection device 600 further includes:

A loss calculation unit, configured to calculate a loss function based on the difference between the time series data sample and the time series restoration data;

The optimization unit is configured to use the loss function to iteratively optimize the timing anomaly detection model until the preset number of iterations is reached or the loss value is less than a preset loss threshold.

In an embodiment, the convolutional layers of the first convolutional neural network and the second convolutional neural network are both 1-dimensional convolutional layers.

The device provided by the embodiment of the application realizes the extraction of timing features through the combination of convolutional neural network and the attention mechanism, and then completes timing anomaly detection, and establishes the timing anomaly detection model based on unsupervised learning through the variational autoencoding algorithm, which improves The applicability and accuracy of the model are improved.

The foregoing timing abnormality detection device 600 may be implemented in the form of a computer program, and the computer program may be run on a computer device as shown in FIG. 11.

Please refer to FIG. 11, which is a schematic block diagram of a computer device according to an embodiment of the present application. The computer device 1100 is a server, and the server may be an independent server or a server cluster composed of multiple servers.

Referring to FIG. 11, the computer device 1100 includes a processor 1102, a memory, and a network interface 1105 connected through a system bus 1101, where the memory may include a non-volatile storage medium 1103 and an internal memory 1104.

The non-volatile storage medium 1103 can store an operating system 11031 and a computer program 11032. When the computer program 11032 is executed, the processor 1102 can execute the timing abnormality detection method.

The processor 1102 is used to provide computing and control capabilities, and support the operation of the entire computer device 1100.

The internal memory 1104 provides an environment for the operation of the computer program 11032 in the non-volatile storage medium 1103. When the computer program 11032 is executed by the processor 1102, the processor 1102 can execute the timing abnormality detection method.

The network interface 1105 is used for network communication, such as providing data information transmission. Those skilled in the art can understand that the structure shown in FIG. 11 is only a block diagram of part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device 1100 to which the solution of the present application is applied. The specific computer device The 1100 may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

Wherein, the processor 1102 is used to run a computer program 11032 stored in the memory to realize the following function: use the first convolutional neural network to perform convolution processing on the time series data samples of the operation and maintenance system to obtain local adjacent time step correlations Use the attention mechanism to associate the global time step of the time sequence feature to obtain the time sequence feature associated with the global time step; use the variational auto-encoding algorithm to encode and decode the time sequence feature associated with the global time step, Obtain reconstructed time series features; use a second convolutional neural network to perform convolution processing on the reconstructed time series features to obtain time series restored data; use the difference between the time series data sample and the time series restored data to detect the time series The abnormal value of the data sample completes the construction of the time series abnormality detection model; the time series abnormality detection model is used to detect the time series data to be tested, and the abnormal value of the time series data to be tested is obtained.

Those skilled in the art can understand that the embodiment of the computer device shown in FIG. 11 does not constitute a limitation on the specific configuration of the computer device. In other embodiments, the computer device may include more or less components than those shown in the figure. Or combine certain components, or different component arrangements. For example, in some embodiments, the computer device may only include a memory and a processor. In such an embodiment, the structures and functions of the memory and the processor are consistent with the embodiment shown in FIG. 11, and will not be repeated here.

It should be understood that in this embodiment of the application, the processor 1102 may be a central processing unit (Central Processing Unit, CPU), and the processor 1102 may also be other general-purpose processors, digital signal processors (Digital Signal Processors, DSPs), Application Specific Integrated Circuit (ASIC), Field-Programmable Gate Array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. Among them, the general-purpose processor may be a microprocessor or the processor may also be any conventional processor.

In another embodiment of the present application, a computer-readable storage medium is provided. The computer-readable storage medium may be a non-volatile computer-readable storage medium, or may be a volatile computer-readable storage medium. The computer-readable storage medium stores a computer program, where the computer program implements the following steps when executed by the processor: using the first convolutional neural network to perform convolution processing on the time-series data samples of the operation and maintenance system to obtain locally adjacent time-step correlations Time sequence features; use the attention mechanism to associate the global time steps of the time sequence features to obtain the time sequence features associated with the global time steps; use the variational auto-encoding algorithm to encode and decode the time sequence features associated with the global time steps to obtain Reconstructed time series features; use a second convolutional neural network to perform convolution processing on the reconstructed time series features to obtain time series restoration data; use the difference between the time series data sample and the time series restoration data to detect the time series data The abnormal value of the sample completes the construction of the time series abnormality detection model; the time series abnormality detection model is used to detect the time series data to be tested, and the abnormal value of the time series data to be tested is obtained.

The various embodiments in the specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same or similar parts between the various embodiments can be referred to each other. It should be pointed out that for those of ordinary skill in the art, without departing from the principles of this application, several improvements and modifications can be made to this application, and these improvements and modifications also fall within the protection scope of the claims of this application.

It should also be noted that in this specification, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply these entities or operations. There is any such actual relationship or sequence between operations. Moreover, the terms "include", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements not only includes those elements, but also includes those that are not explicitly listed Other elements of, or also include elements inherent to this process, method, article or equipment. Under the condition of no more restrictions, the element defined by the sentence "including a..." does not exclude the existence of other same elements in the process, method, article or equipment including the element.

Claims

A timing anomaly detection method, which includes:

Use the first convolutional neural network to perform convolution processing on the time series data samples of the operation and maintenance system to obtain the time series characteristics associated with local adjacent time steps;

Use the attention mechanism to correlate the global time steps of the time sequence features to obtain the time sequence features associated with the global time steps;

Encoding and decoding the time-series features associated with the global time step by using a variational self-encoding algorithm to obtain reconstructed time-series features;

Using a second convolutional neural network to perform convolution processing on the reconstructed time series feature to obtain time series restoration data;

Use the difference between the time series data sample and the time series restoration data to detect the abnormal value of the time series data sample, and complete the construction of the time series abnormality detection model;

The time series abnormality detection model is used to detect the time series data to be tested, and the abnormal value of the time series data to be tested is obtained.
The timing anomaly detection method according to claim 1, wherein the using the first convolutional neural network to perform convolution processing on the timing data samples of the operation and maintenance system to obtain the timing features associated with local adjacent time steps comprises:

Using the first convolutional layer in the first convolutional neural network to perform convolution processing on the time series data sample to obtain a first intermediate feature;

The second convolutional layer in the first convolutional neural network is used to perform convolution processing on the first intermediate feature to obtain time-series features associated with local adjacent time steps.
The method for timing anomaly detection according to claim 1, wherein said using an attention mechanism to associate the global time steps of the time sequence features to obtain the time sequence features associated with the global time steps comprises:

Taking the time-series features associated with locally adjacent time steps as input data, and constructing a query matrix, a key matrix, and a value matrix according to the input data;

Multiplying the query matrix by the key matrix, and using an activation function to activate the product result to obtain the attention weight;

The attention weight is multiplied by the value matrix, and connected with the input data, and output is the time sequence feature associated with the global time step.
The method for timing anomaly detection according to claim 1, wherein the encoding and decoding of the timing features associated with the global time step using a variational self-encoding algorithm to obtain the reconstructed timing features comprises:

Input the time sequence characteristics associated with the global time step into an encoder for encoding, and generate a mean value and a standard deviation through a fully connected layer;

The mean value and standard deviation are input to the decoder to perform standard normal distribution sampling to obtain reconstructed time series characteristics.
The time sequence abnormality detection method according to claim 1, wherein said using a second convolutional neural network to perform convolution processing on the reconstructed time sequence feature to obtain time sequence restoration data comprises:

Using the third convolutional layer in the second convolutional neural network to perform convolution processing on the reconstructed time series feature to obtain a second intermediate feature;

The fourth convolutional layer in the second convolutional neural network is used to perform convolution processing on the second intermediate feature to obtain time series restored data.
The time-series abnormality detection method according to claim 1, wherein the difference between the time-series data sample and the time-series restoration data is used to detect the abnormal value of the time-series data sample, and after completing the construction of the time-series abnormality detection model, the method comprises:

Calculating a loss function based on the difference between the time series data sample and the time series restoration data;

The loss function is used to iteratively optimize the timing anomaly detection model until the preset number of iterations is reached or the loss value is less than a preset loss threshold.
The method for timing anomaly detection according to claim 1, wherein the convolutional layers of the first convolutional neural network and the second convolutional neural network are both 1-dimensional convolutional layers.
A timing abnormality detection device, which includes:

The first convolution unit is configured to use the first convolutional neural network to perform convolution processing on the time series data samples of the operation and maintenance system to obtain the time series characteristics associated with local adjacent time steps;

An attention mechanism unit, configured to use the attention mechanism to correlate the global time steps of the time sequence features to obtain the time sequence features associated with the global time steps;

The self-encoding unit is configured to use a variational self-encoding algorithm to encode and decode the time-series characteristics associated with the global time step to obtain reconstructed time-series characteristics;

The second convolution unit is configured to use a second convolutional neural network to perform convolution processing on the reconstructed time series feature to obtain time series restoration data;

A model construction unit, configured to use the difference between the time series data sample and the time series restoration data to detect the abnormal value of the time series data sample, and complete the construction of the time series abnormality detection model;

The model detection unit is configured to detect the time series data to be tested by using the time series abnormality detection model to obtain the abnormal value of the time series data to be tested.
A computer device, comprising a memory, a processor, and a computer program stored on the memory and running on the processor, wherein the processor implements the computer program described in claim 1 when the processor executes the computer program Timing anomaly detection method.
9. The computer device according to claim 9, wherein said using the first convolutional neural network to perform convolution processing on time series data samples of the operation and maintenance system to obtain time series characteristics associated with local adjacent time steps comprises:

Using the first convolutional layer in the first convolutional neural network to perform convolution processing on the time series data sample to obtain a first intermediate feature;

The second convolutional layer in the first convolutional neural network is used to perform convolution processing on the first intermediate feature to obtain time-series features associated with local adjacent time steps.
The computer device according to claim 9, wherein said using the attention mechanism to associate the global time step of the time sequence feature to obtain the time sequence feature associated with the global time step comprises:

Taking the time-series features associated with locally adjacent time steps as input data, and constructing a query matrix, a key matrix, and a value matrix according to the input data;

Multiplying the query matrix by the key matrix, and using an activation function to activate the product result to obtain the attention weight;

The attention weight is multiplied by the value matrix, and connected with the input data, and output is the time sequence feature associated with the global time step.
9. The computer device according to claim 9, wherein the encoding and decoding of the time sequence characteristics associated with the global time step using a variational self-encoding algorithm to obtain the reconstructed time sequence characteristics comprises:

Input the time sequence characteristics associated with the global time step into an encoder for encoding, and generate a mean value and a standard deviation through a fully connected layer;

The mean value and standard deviation are input to the decoder to perform standard normal distribution sampling to obtain reconstructed time series characteristics.
9. The computer device according to claim 9, wherein said using a second convolutional neural network to perform convolution processing on the reconstructed time series feature to obtain time series restoration data comprises:

Using the third convolutional layer in the second convolutional neural network to perform convolution processing on the reconstructed time series feature to obtain a second intermediate feature;

The fourth convolutional layer in the second convolutional neural network is used to perform convolution processing on the second intermediate feature to obtain time series restored data.
The computer device according to claim 9, wherein the difference between the time series data sample and the time series restoration data is used to detect the abnormal value of the time series data sample, and after completing the construction of the time series abnormality detection model, the method comprises:

Calculating a loss function based on the difference between the time series data sample and the time series restoration data;

The loss function is used to iteratively optimize the timing anomaly detection model until the preset number of iterations is reached or the loss value is less than a preset loss threshold.
A computer-readable storage medium, wherein the computer-readable storage medium stores a computer program that, when executed by a processor, causes the processor to execute the timing abnormality detection method according to claim 1.
15. The computer-readable storage medium according to claim 15, wherein the using the first convolutional neural network to perform convolution processing on the time series data samples of the operation and maintenance system to obtain the time series characteristics associated with local adjacent time steps comprises:

Using the first convolutional layer in the first convolutional neural network to perform convolution processing on the time series data sample to obtain a first intermediate feature;

The second convolutional layer in the first convolutional neural network is used to perform convolution processing on the first intermediate feature to obtain time-series features associated with local adjacent time steps.
15. The computer-readable storage medium according to claim 15, wherein said using an attention mechanism to associate the global time step of the time sequence feature to obtain the time sequence feature associated with the global time step comprises:

Taking the time-series features associated with locally adjacent time steps as input data, and constructing a query matrix, a key matrix, and a value matrix according to the input data;

Multiplying the query matrix by the key matrix, and using an activation function to activate the product result to obtain the attention weight;

The attention weight is multiplied by the value matrix, and connected with the input data, and output is the time sequence feature associated with the global time step.
The computer-readable storage medium according to claim 15, wherein the encoding and decoding of the time sequence characteristics associated with the global time step using a variational self-encoding algorithm to obtain the reconstructed time sequence characteristics comprises:

Input the time sequence characteristics associated with the global time step into an encoder for encoding, and generate a mean value and a standard deviation through a fully connected layer;

The mean value and standard deviation are input to the decoder to perform standard normal distribution sampling to obtain reconstructed time series characteristics.
15. The computer-readable storage medium according to claim 15, wherein said using a second convolutional neural network to perform convolution processing on the reconstructed time series feature to obtain time series restored data comprises:

Using the third convolutional layer in the second convolutional neural network to perform convolution processing on the reconstructed time series feature to obtain a second intermediate feature;

The fourth convolutional layer in the second convolutional neural network is used to perform convolution processing on the second intermediate feature to obtain time series restored data.
15. The computer-readable storage medium according to claim 15, wherein the difference between the time series data sample and the time series restoration data is used to detect the abnormal value of the time series data sample, and after completing the construction of the time series abnormality detection model, the method comprises:

Calculating a loss function based on the difference between the time series data sample and the time series restoration data;

The loss function is used to iteratively optimize the timing anomaly detection model until the preset number of iterations is reached or the loss value is less than a preset loss threshold.