CN-121997047-A - Multi-dimensional time sequence unsupervised anomaly detection method based on cyclic neural network

CN121997047ACN 121997047 ACN121997047 ACN 121997047ACN-121997047-A

Abstract

The invention discloses a multi-dimensional time sequence unsupervised anomaly detection method based on a recurrent neural network, which comprises the steps of inputting a to-be-detected multi-variable time sequence into a trained unsupervised multi-layer dynamic probability model to obtain hidden variables corresponding to the to-be-detected multi-variable time sequence, calculating to obtain anomaly scores according to hidden variables corresponding to the to-be-detected multi-variable time sequence and the to-be-detected multi-variable time sequence, judging that the to-be-detected multi-variable time sequence is anomaly data when the anomaly scores are lower than a preset threshold value, and judging that the to-be-detected multi-variable time sequence is normal data when the anomaly scores are higher than or equal to the preset threshold value. The method and the device remarkably improve the performance of MTS abnormality detection tasks, can more comprehensively represent abnormal conditions of multivariate time sequences, and remarkably improve the detection accuracy and robustness.

Inventors

CHEN WENCHAO
ZHANG TONG
WEN WEI
CHEN BO
WANG PENGHUI
LIU HONGWEI

Assignees

西安电子科技大学

Dates

Publication Date: 20260508
Application Date: 20260121

Claims (8)

1. A multi-dimensional time series unsupervised anomaly detection method based on a recurrent neural network, the method comprising: Inputting a multi-variable time sequence to be detected into a trained unsupervised multi-layer dynamic probability model to obtain hidden variables corresponding to the multi-variable time sequence to be detected, wherein the unsupervised multi-layer dynamic probability model is a stacked anti-variational cyclic neural network; Calculating to obtain an abnormal score according to the hidden variable corresponding to the multi-variable time sequence to be detected and the multi-variable time sequence to be detected; when the anomaly score is lower than a preset threshold value, judging that the multivariate time sequence to be detected is anomaly data; and when the abnormal score is higher than or equal to the preset threshold value, judging the multivariate time sequence to be detected as normal data.
2. The multi-dimensional time series unsupervised anomaly detection method based on the recurrent neural network according to claim 1, wherein the training process of the unsupervised multi-layer dynamic probability model comprises: Inputting the sample time sequence into the unsupervised multi-layer dynamic probability model to obtain a sample hidden variable and a reconstructed sample time sequence; inputting the sample hidden variable, the sample time sequence and the sample hidden state of the previous time step into a stacking cyclic neural network in the unsupervised multi-layer dynamic probability model to obtain the sample hidden state of the current time step; obtaining the sample hidden variable variation distribution of the current time step according to random noise, the sample time sequence, the sample hidden variable and the sample hidden state of the last time step; Constructing an inference network variation distribution according to the stacked anti-variation cyclic neural network, the reconstructed sample time sequence and the sample hidden state of the current time step; Constructing an initial optimization target of the unsupervised multi-layer dynamic probability model according to a VAE model training strategy, and performing countermeasure optimization on the initial optimization target by utilizing a discrimination network to obtain an optimization target; And carrying out maximized ELBO processing on the optimization target so as to train the unsupervised multi-layer dynamic probability model, and obtaining the unsupervised multi-layer dynamic probability model after training.
3. The multi-dimensional time series unsupervised anomaly detection method based on recurrent neural network according to claim 2, wherein the sample hidden variables are represented as follows: ; Wherein, the Representation of Time sample time series of time instants The time series data is at the first The sample hidden variable of the layer obeys the gaussian distribution, , The total number of layers of the unsupervised multi-layer dynamic probability model, Is that Is used for the average value of (a), Is that Is a function of the variance of (a), The representation takes diagonal elements.
4. The multi-dimensional time series unsupervised anomaly detection method based on recurrent neural network of claim 3, wherein the reconstructed sample time series is represented as follows: ; Wherein, the Representation of Time sample time series of time instants A time series of reconstructed samples corresponding to the time series data and subject to a gaussian distribution, Is that Is used for the average value of (a), Is that Is a variance of (c).
5. The multi-dimensional time series unsupervised anomaly detection method based on recurrent neural network according to claim 4, wherein the sample hidden state of the current time step is represented as follows: ; Wherein, the Representation of Time sample time series of time instants The time series data is at the first The sample of the layer is in a hidden state, Represent the first The long and short time memory network of the layer, A fully connected network is represented as such, Representing the presentation to be And The splicing is carried out, Representation of Time sample time series The time-series data of the time-series, Representation of Time sample time series of time instants The time series data is at the first The sample of the layer is in a hidden state, Representation of Time sample time series of time instants The time series data is at the first The sample of the layer is in hidden state.
6. According to claim 5 The multi-dimensional time sequence unsupervised anomaly detection method based on the cyclic neural network is characterized in that the inference network variation distribution is expressed as follows: ; Wherein, the Representing the distribution of the inference network variations, Representing the probability distribution of random noise entering the inference network.
7. The multi-dimensional time series unsupervised anomaly detection method based on recurrent neural network according to claim 5, wherein the optimization objective is represented as follows: ; Wherein, the The object of the optimization is indicated as such, Indicating the number of instants, indicating the total number of time series data in the time series of samples, Indicating the desire in solving the log-likelihood, Representation of Time sample time series of time instants The time series data is at the first The random noise of the layer is used to determine, Parameters of the decoding network representing the unsupervised multi-layer dynamic probability model, Coding network parameters representing an unsupervised multi-layer dynamic probability model, To adjust the first The super-parameters of the layer against the loss, To complete training The optimal discriminant of the layer, Representation Time sample time series of time instants The time series data is at the first Standard gaussian noise of the layer.
8. A multi-dimensional time series unsupervised anomaly detection apparatus based on a recurrent neural network, the apparatus comprising: The hidden variable acquisition module is used for inputting the multivariate time sequence to be detected into a trained unsupervised multi-layer dynamic probability model to obtain hidden variables corresponding to the multivariate time sequence to be detected, wherein the unsupervised multi-layer dynamic probability model is a stacked anti-variation cyclic neural network; The anomaly score calculation module is used for calculating to obtain an anomaly score according to the hidden variable corresponding to the multivariate time sequence to be detected and the multivariate time sequence to be detected; The first judging module is used for judging that the multivariate time sequence to be detected is abnormal data when the abnormal score is lower than a preset threshold value; And the second judging module is used for judging that the multivariate time sequence to be detected is normal data when the abnormal score is higher than or equal to the preset threshold value.

Description

Multi-dimensional time sequence unsupervised anomaly detection method based on cyclic neural network Technical Field The invention belongs to the technical field of anomaly detection, and particularly relates to a multidimensional time series unsupervised anomaly detection method based on a cyclic neural network. Background In recent years, with the rapid development of deep learning technology, the field of time series anomaly detection has made remarkable progress. The unsupervised deep learning network model has obvious advantages in the aspects of processing long-term and short-term dependence, nonlinear relation and the like by virtue of strong self-adaptive capacity. Compared with the traditional statistical model and machine learning method, the deep learning method can directly act on the original time sequence data, and the key mode can be extracted without complex feature engineering. With the improvement of computing capability and the wide application of a graphic processor, the training efficiency of the unsupervised deep learning model in a big data environment is remarkably improved, and the unsupervised deep learning model is widely applied to time sequence anomaly detection tasks in a plurality of fields such as finance, energy, traffic and the like. The method based on unsupervised deep learning has the following significant advantages: 1. The ability to process complex nonlinear relationships, namely, the unsupervised deep learning model can capture complex patterns and long-short-term dependency relationships in data, so that high-precision abnormal detection results are generated. 2. The high-efficiency processing capacity of large-scale data is that the unsupervised deep learning model not only can rapidly process mass data, but also can effectively capture complex relations between input and output through continuous iterative learning. 3. The non-supervision deep learning model can adjust the architecture, parameters and training modes according to specific requirements, and can be used in combination with other statistical or machine learning models to form a hybrid model so as to adapt to detection tasks in different fields. Learning the normal mode of MTS (Multivariate TIMES SERIES, multivariate time series) data is a key step in achieving anomaly detection for it, and has received increasing attention in recent years to engineering application science. In view of this, some machine learning-based methods have been proposed. As a representative study, encDec-AD captured the MTS time-dependent normal pattern using an LSTM (Long Short-Term Memory network) based encoder/decoder and determined anomalies based on reconstruction errors. Telemanom predicts the values of the spacecraft telemetry channels using LSTM and detects anomalies from residuals between predicted and observed values. In addition, MSCRED introduces a multi-scale convolutional recursive coder-decoder that learns the spatial correlation and timing characteristics in the MTS and then detects anomalies using residual feature matrices. MAD-GAN captures normal spatiotemporal patterns using LSTM-RNN as a basic framework for generating a countermeasure Network (GAN) model, omniAnormaly introduces a random recurrent neural Network (Stochastic RNN, SRNN) to help learn more robust characterizations. SDFVAE introduces a framework for self-coding based on static and dynamic factorization variations to explicitly learn time-invariant and time-variant properties. OmniAnormaly and SDFVAE are both methods of using reconstructed likelihoods to detect anomalies because the smaller the likelihood, the more likely the anomaly. Notably, however, the above-described unsupervised works employ an RNN-based shallow structure to capture time dependencies in the MTS. In addition, there are also some unsupervised anomaly detection methods that ignore timing dependencies between different times in the MTS. For example, the unsupervised method DOMI combines gaussian mixture variation self-encoding (Gaussian mixture Variational AutoEncoder, gmVAE) with one-dimensional convolution to detect abnormal machine instances for large data centers, DAGMM uses self-encoder learning characterization, and uses gaussian mixture models (Gaussian Mixture Model, GMM) for distribution estimation. USAD, however, devised an unsupervised anomaly detection by a self-encoder based on countermeasure training. To model non-stationarity in the time series GmSVRNN introduces a hybrid model and switching mechanism to VRNN. To further consider the correlation between channels in MTS, some unsupervised anomaly detection models based on graph neural networks have been proposed, in which deep-variational graph rolling dynamic networks (Deep Variational Graph Convolutional Recurrent Network, DVGCRN) creatively integrate graph network structures into dynamic probability generating networks and achieve excellent performance. Although the existing unsupervised anomaly detection meth