Time Series Anomaly Detection Based On Trend Representation

Time series anomaly detection is one of the important research contents of time series excavation.The application scenarios of time series anomaly detection tasks are usually complex,such as a large amount of disaster monitoring data generated by underground safety production monitoring systems with complex time dependence and spatial dependence,and the trending patterns contained in the data are important disaster precursors,and the identification of such patterns is of great significance for disaster warning and prevention.Traditional multidimensional time series anomaly detection cannot integrate the trend features and the temporal dependence and spatial correlation between multidimensional series with the anomaly detection task,thus the application in such problems is not effective.To address the above problems,this thesis addresses the feature representation of trending patterns in multidimensional time series data and implements adaptive,unsupervised anomaly detection based on this feature,as follows:(1)To address the problem that the traditional multidimensional time series anom alydetection does not integrate the data trend features with the time and space dependence of the series,a self-coding anomaly detection method based on multiscale trend and SPD(Symmetric Positive Definite)representation(Trend SPD Auto Encoder Anomaly Detection method,TSAD).First,a multiscale trend feature is used to represent the trending pattern of multidimensional time series,and the SPD matrix that maintains positive definite is generated with this feature as the parameter input kernel function to express the complex spatial structure of multidimensional time series data constructs.Then,SPD-AE networks maintaining the SPD matrix characteristics are designed to learn the potential representation of the data and define matrix reconstruction errors as loss functions and anomaly scores for anomaly detection.The validation experiments conducted on public test data and self-mined impact ground pressure monitoring data(MINE)show that the method in this thesis achieves the best F1 values on the WADI dataset and the MINE dataset,and the effect is improved by9.8% over the GDN method on the WADI dataset and 2.9% over the MSCRED method on the MINE dataset.(2)To address the problem that the original multidimensional time series contains a large number of missing values that affect the accuracy of anomaly detection tasks and that the use of predefined thresholds based on empirical or enumeration methods is not conducive to automated anomaly detection,a trend feature-based time series adaptive threshold anomaly detection method(TSAD*)is proposed on the basis of the TSAD model.First,a random forest method is used to fill in the missing values of the original sensor data to obtain the complete multidimensional time series data.Then,the logarithmic Euclidean metric applicable to the SPD matrix is defined as the reconstruction error,and the average value of the maximum error on the validation set is used as the threshold for anomaly detection.The validation experiments conducted on the public test data and the self-extracted impact ground pressure monitoring data(MINE)show that the random forest method fills the missing values with better anomaly detection than the mean fill,and the F1 values of TSAD* are improved by1.22%,1.93%,1.94% and 0.7% compared to TSAD on the SWAT,WADI,SMD and MINE data sets,respectively.(3)For the realistic application of multidimensional time series anomaly detection,a prototype system of multidimensional time series anomaly detection is designed and implemented in the context of mine disaster monitoring and surveillance system by combining the TSAD* method proposed in this thesis.The system acquires gas,acoustic emission and electromagnetic data from underground,uses the TSAD* model proposed in this thesis for data processing and anomaly detection,visualizes the anomaly detection results,and the system detects underground disaster anomalies in real time,queries historical anomalous events,and performs classification queries and comprehensive queries on anomalous events.