CN-121980458-A - Multivariate time sequence abnormal data detection method based on double-stage reconstruction mechanism

CN121980458ACN 121980458 ACN121980458 ACN 121980458ACN-121980458-A

Abstract

The invention provides a multivariate time sequence abnormal data detection method based on a double-stage reconstruction mechanism, which comprises the steps of obtaining original multivariate time sequence data and initializing error information in a first stage, adopting an encoder to encode the original multivariate time sequence data and the initializing error information to obtain a first stage encoded representation, inputting the first stage encoded representation into a reconstruction network to obtain a first stage reconstruction result, calculating error information of the first stage reconstruction result and the original multivariate time sequence data in a second stage, encoding the error information and the original multivariate time sequence data to obtain a second stage encoded representation, inputting the second stage encoded representation into an error-driven reconstruction network to obtain a second stage reconstruction result, and obtaining a multivariate time sequence abnormal data detection result based on the second stage reconstruction result.

Inventors

ZHOU JUNJIE
LI YANG
TANG YING
TANG SHU
LI HAORONG

Assignees

中国烟草总公司重庆市公司物流分公司
重庆邮电大学

Dates

Publication Date: 20260505
Application Date: 20260123

Claims (10)

1. The multivariate time sequence abnormal data detection method based on the double-stage reconstruction mechanism is characterized by comprising the steps of constructing an abnormal data detection model based on the double-stage reconstruction mechanism, wherein the model consists of a reconstruction network and an error driving reconstruction network, and processing input data based on the abnormal data detection model of the double-stage reconstruction mechanism comprises the following steps: In the first stage, original multivariable time sequence data are obtained, and error information is initialized; the method comprises the steps of adopting an encoder to encode original multivariable time sequence data and initialization error information to obtain a first stage encoded representation; In the second stage, error information of a first stage reconstruction result and original multivariable time sequence data is calculated, the error information and the original multivariable time sequence data are encoded to obtain second stage encoded representation, the second stage encoded representation is input into an error driving reconstruction network to obtain a second stage reconstruction result, and a multivariable time sequence abnormal data detection result is obtained based on the second stage reconstruction result.
2. The method for detecting multivariate time series abnormal data based on a two-stage reconstruction mechanism according to claim 1, wherein the encoding of the original multivariate time series data and the initialization error information by using the encoder comprises the steps of splicing the original multivariate time series data and the initialization error information in characteristic dimensions, and compressing the spliced data in characteristic dimensions through linear mapping to obtain a first-stage encoded representation.
3. The method for detecting multivariate time series abnormal data based on a dual-stage reconstruction mechanism according to claim 1, wherein the reconstruction network is sequentially composed of a layer normalization module, a time sequence information aggregation attention module and a multi-scale time sequence information modeling module, and feature fusion is achieved through residual connection.
4. A multivariate time sequence abnormal data detection method based on a double-stage reconstruction mechanism is characterized in that a reconstruction network processes first-stage coded representation and comprises the steps of carrying out layer normalization processing on the first-stage coded representation through a layer normalization module, carrying out time sequence information aggregation on the first-stage coded representation after layer normalization through a time sequence information aggregation attention module, carrying out pooling operation on the time sequence information aggregation and calculating relevance among time steps in an input sequence by combining attention mechanisms to obtain key historical information for detecting current moment abnormality, inputting the key historical information into a multi-scale time sequence information modeling module to obtain multi-scale features, fusing the key historical information with the multi-scale features through residual connection to obtain fusion features, and obtaining a first-stage reconstruction result based on the fusion features.
5. The method for detecting multivariate time series anomaly data based on a two-stage reconstruction mechanism of claim 1, wherein calculating error information of the first stage reconstruction result and the original multivariate time series data comprises: ; Where c 1 is the data used to characterize the potential anomaly region, X1 is the first stage reconstruction result, and src is the raw multivariate time series data.
6. The method for detecting multivariate time series anomaly data based on a two-stage reconstruction mechanism of claim 1, wherein the error driven reconstruction network comprises a time series information aggregation attention module and a multi-scale time series information modeling module, wherein the time series information aggregation attention module is used for capturing local abrupt anomalies of data, and the multi-scale time series information modeling module is used for extracting time series characteristics under different time spans.
7. The method for detecting multivariate time series abnormal data based on a dual-stage reconstruction mechanism according to claim 6, wherein the time series information aggregation attention module processes the second stage coded representation, and the method is characterized in that the second stage coded representation is subjected to pooling operation in a time dimension, namely, a time window of each sample is clustered to obtain a global representation, a query vector, a key vector and a value vector are built based on the global representation, similarity weights of aggregation time series information among different batches are calculated based on the query vector, the key vector and the value vector, the information is aggregated in a cross batch mode based on the similarity weights, a cross sample aggregation result is broadcasted back to the time dimension and is fused with an original feature, then a Mamba state space model is input, long-range dependence is captured while approximate linear time and memory complexity are maintained through a linear recursion and input selection mechanism, and an aggregation feature map is output.
8. The method of claim 6, wherein the multi-scale time series anomaly data processing module processes the input features by linear projection of feature dimensions and applying element-by-element nonlinearity to obtain features Z1, inputting Z1 into a low resolution Mamba path to extract long-range dependencies and overall trends, performing sequence recursion and selective input on smooth feature channels by selective state space modeling to obtain Will (i) be And a high resolution path to Obtaining a characteristic Z2 by another linear mapping for input, reserving a discrimination clue with finer granularity for the characteristic Z2 at the characteristic level to obtain the characteristic Will (i) be And And realizing trans-scale information fusion and redundancy inhibition through a position-by-position feed-forward network to obtain a second-stage reconstruction result.
9. A computer readable storage medium having stored thereon a computer program, characterized in that the computer program is executed by a processor to implement the multivariate time series abnormal data detection method based on the two-stage reconstruction mechanism of any one of claims 1 to 8.
10. A multivariate time series abnormal data detection device based on a two-stage reconstruction mechanism, which is characterized by comprising a processor and a memory, wherein the memory is used for storing a computer program, and the processor is connected with the memory and is used for executing the computer program stored in the memory, so that the multivariate time series abnormal data detection device based on the two-stage reconstruction mechanism performs the multivariate time series abnormal data detection method based on the two-stage reconstruction mechanism according to any one of claims 1 to 8.

Description

Multivariate time sequence abnormal data detection method based on double-stage reconstruction mechanism Technical Field The invention belongs to the field of artificial intelligence, and particularly relates to a multivariate time sequence abnormal data detection method based on a double-stage reconstruction mechanism. Background In recent years, the use of well-designed deep learning structures to achieve high-precision multivariate time series detection has attracted considerable attention from researchers. Ren et al propose a method to combine spectral residuals with Convolutional Neural Networks (CNNs) to detect timing anomalies in a service system. In the real world, multivariate time series data is difficult to have all tag information, so the unsupervised anomaly diagnosis method proposed by Li et al is widely studied, in which multivariate spectral signal frequency consistency is used for unsupervised anomaly detection. For time series anomaly detection, an unsupervised method using an LSTM network is proposed, wherein the common sense is realized by combining structural optimization of the LSTM model with a support vector machine algorithm. USAD employs an automatic encoder based on resistance training, ensuring efficient model training. In the unsupervised learning method, the reconstruction-based anomaly detection technique has been widely studied for its effectiveness in solving the high and nonlinear data problems. However, they tend to overadapt to abnormal patterns, which may result in failure to accurately diagnose the abnormality. Although reconstruction-based anomaly detection methods can effectively identify pattern anomalies, they may overfit anomaly data, reconstruct the same anomaly data, which makes detection of amplitude anomalies difficult. To address these issues, some studies have attempted to amplify the differences between the anomaly data and the reconstructed data to enable the model to better diagnose amplitude anomalies. To further address the problem of overfitting to outlier data, many studies have aimed at preventing erroneous fit results from being reconstructed by enabling models to learn potential trends of the raw data. Revin recover the statistics of the time series data by reversible instance normalization. The DC detector uses a single scale structure to extract local features and global correlations to effectively capture time information of long-term sequences. D3R supplements global information of data by decomposing and reconstructing. While these approaches alleviate the problem of overfitting the outlier data to some extent by capturing global trend information, most models do not learn the reconstructed trend of the data themselves. Instead, they rely on pre-processing the data outside the model, resulting in an insufficient ability to capture the reconstruction trend. Therefore, the abnormality detection performance is still unsatisfactory. In addition, the method based on the self-encoder and the variant thereof identifies abnormal data through reconstruction errors, and related researches comprise FCVAE and other documents, which utilize the variation self-encoder to model time sequence distribution characteristics, thereby achieving a certain effect in an unsupervised scene. Further, tranAD et al incorporated a transducer structure to enhance modeling ability on long-term dependencies through sequence-to-sequence reconstruction mechanisms. UNITS, RTDetector, the study attempts to combine the local timing pattern with the global statistics to enhance the capability of describing complex multivariate relationships. In addition, the timesNet, KAN-AD and other works improve the expression capacity of the model on periodic and nonlinear characteristics from the viewpoint of frequency domain modeling or structured function modeling. The technology forms the closest prior art foundation of the invention, and relevant contents can be found in the academic papers published by TranAD, UNITS, timesNet and the like. However, the prior art still has the following defects that firstly, most methods focus on time sequence modeling of a single visual angle, and are difficult to simultaneously consider individual local characteristics and group global associated information, secondly, under the condition of no label or weak label, abnormal judgment threshold depends on experience setting, generalization capability is limited, thirdly, the method based on a transducer is high in calculation complexity and difficult to adapt to application scenes with high requirements on real-time performance and stability, such as medical treatment, and thirdly, the prior method mainly aims at industrial or system data, and is insufficient in consideration of heterogeneity, missing and risk evolution characteristics existing in medical multi-variable time sequence data. Therefore, there is a need for an anomaly detection and risk prediction technique that can effectively fuse local and