CN111738335A - A neural network-based anomaly detection method for time series data - Google Patents

Abstract

The invention discloses a time series data abnormity detection method based on a neural network, which comprises the following steps: collecting data, and performing an anomaly detection process based on the time series data of the neural network and performance verification of an anomaly detection method. The invention has the advantages that: (1) the anomaly detector does not make any assumption on the potential mechanism of the anomaly type and the anomaly pattern, but can obtain related concepts from the training data set through learning; (2) the anomaly detector does not need to select a threshold value, so that the tedious work of setting the threshold value is avoided, and good anomaly detection performance can be obtained; (3) with the accumulation of the anomaly detection experience, the anomaly detector continuously carries out dynamic improvement to learn new anomalies, so that the knowledge accumulation of the anomaly detection by the anomaly detector is enhanced; (4) the anomaly detection method provided by the invention can be widely applied to the fields of human body disease monitoring, traffic accident discovery, equipment fault diagnosis, network intrusion detection and the like in the industries of health care, intelligent transportation, large-scale production systems and the like.

Description

A neural network-based anomaly detection method for time series data

technical field

The invention relates to a time series abnormality detection method, in particular to a time series data abnormality detection method based on a neural network, and belongs to the technical field of artificial intelligence and big data application.

Background technique

Anomaly detection is a hot topic that exists widely in many fields. For example, human disease monitoring in health care, traffic accident detection in intelligent transportation, equipment fault diagnosis in large-scale production systems, network intrusion detection and many other fields, it can be seen that anomaly detection is very important. Ideally, anomaly detection methods should be applicable to a variety of different scenarios and can be easily manipulated.

However, existing anomaly detection methods cannot meet the demand. The literature (Chandola V, Banerjee A, and Kumar V. Anomaly detection: A survey. ACM Computing Survey, 41(3): 1-58, 2009) gave an in-depth summary of anomaly detection methods and found that different anomaly detection methods have Various strong assumptions have been made (Gandhimathi L, Murugaboopathi G. A novel hybrid intrusion detection using flow-based anomaly detection and cross-layer features in wireless sensor network. Automatic Control and Computer Sciences, 54(1):62-69, 2020 ), such as distributed-based methods, but anomaly detection methods may not achieve satisfactory results when assumptions do not hold (Feng F, Liu X, and Yong B. Anomaly detection in ad-hoc networks based on deep learning model: A plug and play device. Ad Hoc Networks, 84:82-89, 2019). On the other hand, anomaly detection methods are not always easy to operate. In 2015, Yahoo released their time series anomaly detection system EGADS (Laptev N, Amizadeh S, and Flint I. Generic andscalable framework for automated time-series anomaly detection. ACM SIGKDDInternational Conference on Knowledge Discovery and Data Mining, 1939-1947, 2015), within the system, a set of methods are implemented and integrated to generate anomaly detection results. But such complex systems require engineers to understand not only the components, but also the methodology set to be able to tune parameters for each component. Furthermore, methods used in the industry rarely consider the evolution of anomalous patterns (Carreno A, Inza I, and Lozano J. Analyzing rareevent, anomaly, novelty and outlier detection terms under the supervisedclassification framework. Artificial Intelligence Review, 53(5): 3575- 3594, 2020), which leads to poor performance of static anomaly detection parameters in dynamic scenarios.

To sum up, the existing methods have the following shortcomings:

(i) Existing anomaly detection methods make various strong assumptions on both the type of anomaly and the anomaly pattern, and when the assumptions are not satisfied, satisfactory results cannot be obtained;

(ii) The existing anomaly detection methods are complicated to construct, require frequent parameter adjustment, and are not very maneuverable;

(iii) Existing methods rarely consider the evolution of anomalous patterns and perform poorly in dynamic scenarios.

Based on this, the present invention proposes a neural network-based anomaly detection method, which does not make any assumptions about the underlying mechanism of anomaly patterns; avoids the tedious work of threshold setting to obtain good anomaly detection performance; with the growth of anomaly detection experience And continuous learning and improvement, so as to make anomaly detection on time series data.

SUMMARY OF THE INVENTION

In order to eliminate abnormal data caused by emergencies or emergencies, the present invention proposes a time series data abnormality detection method based on neural network, which is continuously trained by using a reinforcement learning framework. The process description of the anomaly detection method is shown in Fig. 2. The process consists of three main components: an anomaly detector, accumulated outliers, and empirical values, which are all self-learning.

In order to achieve above-mentioned goal, the present invention adopts following technical scheme:

A method for detecting abnormality in time series data based on neural network, characterized in that it comprises the following steps:

Step 1: Collect data

Collect certain types of time series data with a certain duration and various events that may cause data mutation, and then upload the collected data to the cloud through mobile terminals or other devices. This part is our existing technology;

Step 2: Anomaly detection process of time series data based on neural network

The present invention proposes a time series data anomaly detection method. The anomaly detector is driven by a recurrent neural network and adopts a reinforcement learning method to realize the self-learning process. For example, the X learning method is used for training to estimate X(z, a) The recurrent neural network can continuously improve the anomaly detector by self-learning from the experience value, and obtain good anomaly detection performance. The proposed anomaly detection method has the following characteristics: it does not make any assumptions about the type and pattern of anomalies, does not need to select a threshold, and continuously learns and improves with the growth of anomaly detection experience, so it can be widely used in many fields;

Step 3: Performance Verification of Anomaly Detection Method

We performed anomaly detection on multiple types of time series datasets (such as physical signs data of chronic heart failure patients, service data of public transport networks, equipment energy data in production systems, etc.) For abnormal data, firstly, the abnormality detection experience is obtained by training the data record set of a certain duration, and then the performance of the abnormality detection method in the present invention is verified in the real-time data set. The method can identify the mean value, point abnormality and abnormality of the target time series Shifting of the pattern, high-quality results can be obtained in the test dataset with an accuracy of about 100%.

The benefits of the present invention are:

(1) The anomaly detector does not make any assumptions about the underlying mechanism of anomaly types and anomaly patterns, but can obtain relevant concepts from the training dataset through learning;

(2) The anomaly detector does not need to select a threshold, which avoids the tedious work of threshold setting, so that good anomaly detection performance can be obtained;

(3) With the accumulation of anomaly detection experience, the anomaly detector continuously improves dynamically and learns new anomalies, thereby enhancing its knowledge accumulation for anomaly detection;

(4) The anomaly detection method proposed in the present invention can be widely used in many fields such as human disease monitoring, traffic accident detection, equipment fault diagnosis, network intrusion detection, etc. in industries such as health care, intelligent transportation, and large-scale production systems.

Description of drawings

Figure 1 is a screenshot of our real scientific research project HeartCarer;

Fig. 2 is the abnormal detection process of time series data based on neural network;

Figure 3 is the performance verification of the anomaly detection method.

Detailed ways

The present invention will be described in detail below with reference to the accompanying drawings and specific embodiments.

Take the monitoring data of signs of chronic heart failure patients as an example.

1. Data collection

Collect various physiological signs data (such as heart rate, blood pressure, blood sugar, etc.) of patients with chronic heart failure through wearable technology and various events that may cause sudden changes in sign data (such as emotional changes, diet, mental stress, excessive physical exertion) , environmental factors, etc.), and then upload the collected data to the cloud through a mobile terminal or phone line. This part is our prior art.

In this specific embodiment, the data comes from one of our real scientific research projects, HeartCarer, as shown in Figure 1. This is a home-oriented remote monitoring system, based on a cloud platform, dedicated to monitoring chronic heart failure patients and intervening in a timely manner. The remote monitoring system monitors various physiological signs data (specifically: heart rate, blood pressure, blood sugar, etc.) of patients with chronic heart failure through wearable technology and various events that may cause sudden changes in sign data (for example: mood changes, diet, mental stress, excessive physical exertion, environmental factors, etc.), and upload the monitored data to the cloud through a mobile terminal or phone line.

The remote monitoring system has been applied in a clinical observational study of 2,607 chronic heart failure patients in 6 medical institutions in China. These chronic heart failure patients received care from 2015 to 2019, most of them were over 60 years old (63.8 ± 12 years old), and most of them were male (70%), and the amount of various information data of these people exceeded 100GB .

We use OrientDB Cluster to store large-scale matrix graphs, HBase for vertex attributes, and Hadoop MR for data analysis and computation. The cluster consists of 8 servers running the CentOS 7.4 operating system with 12-core (24-thread) Intel Xeon CPUs running at 2.80 GHz and 64 GB of memory.

2. Anomaly detection process of time series data based on neural network

The invention proposes a time series data abnormality detection method. The abnormality detector is driven by a recurrent neural network, and adopts a reinforcement learning method to realize the self-learning process. The specific anomaly detection process is shown in Figure 2. The process includes three main components: anomaly detector, accumulated outliers and empirical values, and the relationship is described as follows:

，其中

分别表示在给定时间点有事件a和没有事件a的相应数据记录，r是由事件a引起的瞬时异常。这些事件是由异常检测方法中的异常检测器发现的，因此经验值记录了异常检测器的所有行为。The empirical value Y is a set of tuples, each represented as

,in

represent the corresponding data records with and without event a at a given point in time, respectively, and r is the instantaneous anomaly caused by event a. These events are discovered by the anomaly detector in the anomaly detection method, so the empirical value records all the behavior of the anomaly detector.

We denote the anomaly detector by the conditional probability distribution π:= p(A|Z), where A and Z are the set of events and actual data records in the project, respectively. Usually A={0,1}, where 1 indicates that the current data record has an exception, and 0 indicates that there is no exception. The formula π(z, a) = p(A=a|Z=z) represents the probability that a particular data record z has an event anomaly.

，其定义为：The present invention uses anomaly detection capabilities to measure the performance of anomaly detectors

, which is defined as:

,

,

是具有异常检测器π的实际数据记录z的概率，而X(z,a)表示在事件a作用下从数据记录z开始的累积异常。也就是说，性能是在使用异常检测器π情况下的平均累积异常。in

is the probability of the actual data record z with an anomaly detector π, and X(z, a) represents the cumulative anomaly starting from the data record z under the action of event a. That is, the performance is the average cumulative anomaly using the anomaly detector π.

If the detector meets the following conditions

，

,

，

大致相同。如果

成立，则π(z,a)=1。也就是说，最优异常检测器π^*完全由累积异常函数X(z,a)确定。Essentially this detector is an optimal anomaly detector that maximizes performance. At the same time, for all

,

roughly the same. if

is established, then π(z, a)=1. That is, the optimal anomaly detector π ^* is completely determined by the cumulative anomaly function X(z,a).

According to the above process description, empirical values can be used to better estimate X(z, a), anomaly detectors can be continuously improved by self-learning from empirical values, and X learning methods can be used to train for estimating X(z, a) a) of the recurrent neural network to obtain good anomaly detection performance. In summary, the proposed anomaly detection method has the following characteristics: (1) does not make any assumptions about anomaly types and patterns; (2) does not need to select a threshold; (3) continuously learns and improves with the growth of anomaly detection experience, so that it can be widely used Applied to many fields.

3. Performance Verification of Anomaly Detection Methods

As mentioned in step 1, the dataset used for training is the HeartCarer benchmark dataset, which includes various physiological sign data of 2607 chronic heart failure patients, and the amount of various information data exceeds 100GB.

，其中0表示没有异常，1表示有异常。为了增强模型训练的过程，使用了二叉树策略，即通过对先前的数据记录z执行不同的操作0和1，将生成的两个数据记录

和

都添加到用于训练的经验集中。也就是说，在训练的过程中将两条记录

和

添加到经验集中。通过在数据集Z中执行不同的操作，我们可以获得奖励r₀和r₁。Transform each time series into a set of multidimensional data instances using a sliding window approach. The events in X learning are

, where 0 means no exception and 1 means there is an exception. To enhance the process of model training, a binary tree strategy is used, that is, by performing different operations 0 and 1 on the previous data record z, the two data records generated are

and

are added to the experience set used for training. That is to say, during the training process, the two records are

and

Added to experience set. By performing different operations in dataset Z, we can obtain rewards r ₀ and r ₁ .

As shown in Figure 3, we perform anomaly detection on various sign datasets of chronic heart failure patients to eliminate anomalous data caused by emotional changes or environmental factors, etc. First, the abnormality detection experience is obtained by training the first three-year physical sign data record set, and then the performance of the abnormality detection method in the present invention is verified in the real-time physical sign data set. and abnormal detection performance of blood pressure and blood glucose indicators.

From Figure 3 we can see:

(1) The gray line represents the original sign data record, and the black line represents the emergencies in anomaly detection;

(2) Heart rate indicators are directly related to chronic heart failure, and the test time interval is set to 120 minutes, and indicators such as blood pressure and blood sugar are indirectly related, and the interval is set to 240 minutes;

(3) The anomaly detection method in the present invention can identify the mean value of the target time series, the point anomaly and the offset of the anomaly pattern;

(4) This anomaly detection method is able to obtain high-quality results in the test dataset with an accuracy of about 100%.

It should be noted that the above embodiments do not limit the present invention in any form, and all technical solutions obtained by means of equivalent replacement or equivalent transformation fall within the protection scope of the present invention.

Claims (3)

1. a method for detecting abnormality in time series data based on neural network, is characterized in that, comprises the following steps: Step 1: Collect data Collect certain types of time series data with a certain duration and various events that may cause data mutation, and then upload the collected data to the cloud through mobile terminals or other devices. This part is our existing technology; Step 2: Anomaly detection process of time series data based on neural network The present invention proposes a time series data anomaly detection method based on neural network, the anomaly detector is driven by a recurrent neural network, and adopts a reinforcement learning method to realize the self-learning process, for example, by using the X learning method to train to estimate X ( z, a) of the recurrent neural network, the abnormality detector does not make any assumptions about abnormality types and abnormality patterns, and continuously improves the abnormality detector by self-learning from experience values. The abnormality detection method proposed in the present invention can be widely used in health care , human disease monitoring, traffic accident detection, equipment fault diagnosis, network intrusion detection and many other fields in industries such as intelligent transportation and large-scale production systems; Step 3: Performance Verification of Anomaly Detection Method We performed anomaly detection on multiple types of time series datasets (such as physical signs data of chronic heart failure patients, service data of public transport networks, equipment energy data in production systems, etc.) For abnormal data, firstly, the abnormality detection experience is obtained by training the data record set of a certain duration, and then the performance of the abnormality detection method in the present invention is verified in the real-time data set. The method can identify the mean value, point abnormality and abnormality of the target time series Shifting of the pattern, high-quality results can be obtained in the test dataset with an accuracy of about 100%. 2 . The method for detecting anomalies in time series data based on neural network according to claim 1 , wherein, in step 2, the anomaly detector does not make any assumptions about anomaly types and anomaly patterns. 3 . 3. The method for detecting anomaly in time series data based on neural network according to claim 1, characterized in that, in step 3, the anomaly detector does not need to select a threshold value and does not need to adjust parameters.

Images