基于多尺度特征信息融合的时间序列异常检测  

Time series anomaly detection based on multi-scale feature information fusion

作　　者：衡红军[1] 喻龙威 HENG Hongjun;YU Longwei(College of Computer Science and Technology,Civil Aviation University of China,Tianjin 300300,China)

机构地区：[1]中国民航大学计算机科学与技术学院,天津300300

出　　处：《西安电子科技大学学报》2024年第3期203-214,共12页Journal of Xidian University

基　　金：国家自然科学基金(U1333109)。

摘　　要：目前大多数的时间序列都缺少相应的异常标签,且现有基于重构的异常检测算法不能很好地捕获到多维数据间复杂的潜在相关性和时间依赖性,为了构建特征丰富的时间序列,提出一种多尺度特征信息融合的异常检测模型。该模型首先通过卷积神经网络对滑动窗口内的不同序列进行特征卷积来获取不同尺度下的局部上下文信息。然后,利用Transformer中的位置编码对卷积后的时间序列窗口进行位置嵌入,增强滑动窗口中每一个时间序列和邻近序列之间的位置联系,并引入时间注意力获取数据在时间维度上的自相关性,并进一步通过多头自注意力自适应地为窗口内不同时间序列分配不同的权重。最后,对反卷积过程中上采样得到的窗口数据与不同尺度下得到的局部特征和时间上下文信息进行逐步融合,从而准确重构原始时间序列,并将重构误差作为最终的异常得分进行异常判定。实验结果表明,所构建模型在SWaT和SMD数据集上与基线模型相比F1分数均有所提升。在数据维度高且均衡性较差的WADI数据集上与GDN模型相比F1分数降低了1.66%。Currently,most time series lack corresponding anomaly labels and existing reconstruction-based anomaly detection algorithms fail to capture the complex underlying correlations and temporal dependencies among multidimensional data effectively.To construct feature-rich time series,a multi-scale feature information fusion anomaly detection model is proposed.First,the model employs convolutional neural networks to perform feature convolution on different sequences within sliding windows,capturing local contextual information at different scales.Then,position encoding from the Transformer is utilized to embed the convolved time series windows,enhancing the positional relationships between each time series and its neighboring sequences within the sliding window.Time attention is introduced to capture the temporal autocorrelation of the data,and multi-head self-attention adaptively assigns different weights to different time series within the window.Finally,the reconstructed window data obtained through the down-sampling process is progressively fused with the local features and temporal context information at different scales.This process accurately reconstructs the original time series,with the reconstruction error used as the final anomaly score for anomaly determination.Experimental results indicate that the constructed model achieves improved F1 scores compared to the baseline models on both the SWaT and SMD datasets.On the high-dimensional and imbalanced WADI dataset,the F1 score decreases by 1.66%compared to the GDN model.

关 键 词：异常检测 多尺度信息融合 卷积神经网络 TRANSFORMER 多维时间序列 自编码器 

分 类 号：TP391[自动化与计算机技术—计算机应用技术]