基于深度迁移学习的多变量时间序列异常检测

Multivariate Time Series Anomaly Detection Based on Deep Transfer Learning

多变量时间序列异常检测是指从相互关联的多个单变量时间序列中识别不正常的事件或行为的过程。现有的多变量时间序列异常检测方法在应用到新领域时,由于样本分布差异导致检测性能下降。而重新训练模型需要大量新领域的标注数据,且不能有效利用源领域的领域知识。针对这一问题,提出了一种基于深度迁移学习的多变量时间序列异常检测框架,该框架设计了编码器-解码器结构来提取多变量时间序列的特征,同时通过最小化嵌入层向量的距离来减小领域分布差异。基于该框架,提出一种基于ConvLSTM和最大均值差异(MMD)的多变量时间序列异常检测迁移学习方法,并利用解码后的重构误差检测多变量时间序列中的异常。最后,在服务器和空气质量两个多变量时间序列数据集上进行了实验。实验结果显示,目标域训练样本较少时,所提方法在迁移后的检测F1值比迁移前分别提升1.8%和4.2%。对比直接在目标域少量样本上训练模型,F1值提升了约9%。实验表明,所提迁移学习框架和方法对于有效提升多变量时间序列异常检测的性能。

Multivariate time series anomaly detection refers to the process of identifying abnormal events or behaviors from multiple univariate time series.When the existing multivariate time series anomaly detection methods are applied to new fields,the detection performance decreases due to the difference of sample distribution.However,the retraining model needs a lot of annotation data in the new domain,and can't effectively use the domain knowledge in the source domain.To solve this problem,a multivariable time series anomaly detection framework based on deep transfer learning is proposed.The framework designs an encoder-decoder structure to extract the features of multivariable time series,and reduces the domain distribution difference by minimizing the distance between embedding layer vectors.Based on this framework,a transfer learning method for anomaly detection in multivariate time series based on ConvLSTM and maximum mean discrepancy(MMD)is proposed,and the reconstructed error after decoding is used to detect anomalies in multivariate time series.Finally,experiments are carried out on two multivariable time series data sets of server and air quality.The experimental results show that the detection F1 value of the proposed method after transfer is 1.8%and 4.2%higher than that before transfer when the training samples in the target domain are small.Compared with training the model directly on a small number of samples in the target domain,F1 value increased by about 9%.Experimental results show that the proposed transfer learning framework and method can effectively improve the performance of multivariate time series anomaly detection.