西安电子科技大学学报 ›› 2024, Vol. 51 ›› Issue (3): 203-214.doi: 10.19665/j.issn1001-2400.20230906

• 网络空间安全 • 上一篇    

基于多尺度特征信息融合的时间序列异常检测

衡红军(), 喻龙威()   

  1. 中国民航大学 计算机科学与技术学院,天津 300300
  • 收稿日期:2023-07-28 出版日期:2024-06-20 发布日期:2023-09-27
  • 通讯作者: 喻龙威(1997—),男,中国民航大学硕士研究生,E-mail:ylwlongwei@163.com
  • 作者简介:衡红军(1968—),男,副教授,E-mail:henghjcauc@163.com
  • 基金资助:
    国家自然科学基金(U1333109)

Time series anomaly detection based on multi-scale feature information fusion

HENG Hongjun(), YU Longwei()   

  1. College of Computer Science and Technology,Civil Aviation University of China,Tianjin 300300,China
  • Received:2023-07-28 Online:2024-06-20 Published:2023-09-27

摘要:

目前大多数的时间序列都缺少相应的异常标签,且现有基于重构的异常检测算法不能很好地捕获到多维数据间复杂的潜在相关性和时间依赖性,为了构建特征丰富的时间序列,提出一种多尺度特征信息融合的异常检测模型。该模型首先通过卷积神经网络对滑动窗口内的不同序列进行特征卷积来获取不同尺度下的局部上下文信息。然后,利用Transformer中的位置编码对卷积后的时间序列窗口进行位置嵌入,增强滑动窗口中每一个时间序列和邻近序列之间的位置联系,并引入时间注意力获取数据在时间维度上的自相关性,并进一步通过多头自注意力自适应地为窗口内不同时间序列分配不同的权重。最后,对反卷积过程中上采样得到的窗口数据与不同尺度下得到的局部特征和时间上下文信息进行逐步融合,从而准确重构原始时间序列,并将重构误差作为最终的异常得分进行异常判定。实验结果表明,所构建模型在SWaT和SMD数据集上与基线模型相比F1分数均有所提升。在数据维度高且均衡性较差的WADI数据集上与GDN模型相比F1分数降低了1.66%。

关键词: 异常检测, 多尺度信息融合, 卷积神经网络, Transformer, 多维时间序列, 自编码器

Abstract:

Currently,most time series lack corresponding anomaly labels and existing reconstruction-based anomaly detection algorithms fail to capture the complex underlying correlations and temporal dependencies among multidimensional data effectively.To construct feature-rich time series,a multi-scale feature information fusion anomaly detection model is proposed.First,the model employs convolutional neural networks to perform feature convolution on different sequences within sliding windows,capturing local contextual information at different scales.Then,position encoding from the Transformer is utilized to embed the convolved time series windows,enhancing the positional relationships between each time series and its neighboring sequences within the sliding window.Time attention is introduced to capture the temporal autocorrelation of the data,and multi-head self-attention adaptively assigns different weights to different time series within the window.Finally,the reconstructed window data obtained through the down-sampling process is progressively fused with the local features and temporal context information at different scales.This process accurately reconstructs the original time series,with the reconstruction error used as the final anomaly score for anomaly determination.Experimental results indicate that the constructed model achieves improved F1 scores compared to the baseline models on both the SWaT and SMD datasets.On the high-dimensional and imbalanced WADI dataset,the F1 score decreases by 1.66% compared to the GDN model.

Key words: anomaly detection, multi-scale information fusion, convolutional neural network, transformer, multidimensional time series, autoencoder

中图分类号: 

  • TP391
Baidu
map