北京邮电大学学报

  • EI核心期刊

北京邮电大学学报 ›› 2024, Vol. 47 ›› Issue (2): 51-57.

• 论文 • 上一篇    下一篇

基于得分生成模型的时间序列异常检测方法

周浩1,禹可2,吴晓非1   

  1. 1. 北京邮电大学
    2. 北京邮电大学人工智能学院
  • 收稿日期:2023-05-04 修回日期:2023-06-21 出版日期:2024-04-28 发布日期:2024-01-24
  • 通讯作者: 禹可 E-mail:yuke@bupt.edu.cn
  • 基金资助:
    国家自然科学基金资助项目;国家自然科学基金资助项目;国家111 项目;北京邮电大学博士生创新基金资助项目

Score-based generative model for time series anomaly detection

Hao ZHOU1, 2, 2   

  1. 1. Beijing University of Posts and Telecommunications
    2.
  • Received:2023-05-04 Revised:2023-06-21 Online:2024-04-28 Published:2024-01-24
  • Supported by:
    The National Natural Science Foundation of China;The National Natural Science Foundation of China;the 111 Project of China;BUPT Excellent Ph.D. Students Foundation

摘要: 为了解决传统时间序列异常检测模型在时序数据随机性表征不足以及模型泛化能力较弱的问题, 提出了一种基于得分生成的异常检测模型。针对复杂信息物理系统中运行监控的时序数据, 设计了一个多维时间序列异常检测框架,利用回归模型捕捉数据内在的时间模式。考虑时序生成过程的随机性, 采用去噪得分匹配的方法来估计梯度信息,并利用估计的梯度信息, 设计了高效的异常评分方法。在公开的池化服务器数据集和安全水处理数据集上,所提模型的异常检测 F1 值分别达到了 96% 和 90. 18% ,比使用基线模型得到的最高 F1 值分别提高了1.02% 和 1.01% 。消融实验和案例分析结果表明,用噪声索引模块和签名矩阵模块可增强模型的特征提取能力,所提模型的异常阈值在[0.386, 0.8)之间时的 F1 值大于等于 0.8。

关键词: 信息物理系统, 时间序列, 异常检测, 得分生成模型

Abstract: To solve the problems such as the difficulty to learn the representative stochastic variables of data and poor generalization ability for traditional time series anomaly detection methods, a score-based generative model was proposed. To detect anomalies for time series data in complex Cyber-Physical Systems, a regression model based anomaly detection method was devised to capture the intrinsic temporal pattern of the multivariate time series data. Considering the stochastic of the time series generation process, the gradient information was estimated based on the denoising score matching method. Using the estimated gradient information, an efficient anomaly scoring method was devised to improve the accuracy of the time series anomaly detection task. Experiments on Pooled Server Metrics (PSM) dataset and Secure Water Treatment (SWaT) dataset showed that the proposed method can achieve F1 score of 96% and 90.18% respectively, boosting accuracy by more than 1.02% and 1.01% compared than best baseline. Furthermore, the ablation experiments and case study proved the effectiveness of each module of the proposed method.

Key words: Cyber Physical System, time series, anomaly detection, score-based generative model

中图分类号: