受限分布映射和伪异常校准引导下的时序异常检测

doi:10.3778/j.issn.1002-8331.2309-0473

摘要/Abstract

摘要： 时间序列异常检测旨在识别与正常行为显著不同的稀有模式或偏差。现有的研究侧重于设计更先进的网络架构或优化目标来尽可能准确地捕获数据的正常模式。然而，异常污染下的训练数据和异常信息的缺失会致使传统方法学习到的正态决策边界产生偏差，从而导致次优级的检测性能。提出一种受限分布映射和伪异常校准引导下的无监督异常检测方法。具体地，利用时间卷积网络提取输入数据特征。为了学习更精确的正态决策边界，从两个方面优化正态表征学习过程：第一，提出一种受限分布映射方法，通过特征归一化将训练数据的未知分布映射至高斯分布，并最小化正常数据与超球中心的单类距离，使数据在特征空间中更加紧凑；第二，提出一种伪异常校准机制，利用数据扰动操作从原始数据生成多种类型的伪异常数据，并通过区分正常数据和伪异常数据向模型注入异常知识，矫正决策边界。同时，通过最大化伪异常数据与超球中心的单类距离，扩大正常与异常数据之间的类可分离性。在测试阶段，通过测量输入数据与超球中心的单类距离来检测异常。在5个真实数据集上进行的大量实验表明，该方法实现了相比目前主流方法的更优性能，并且在不同程度的异常污染训练数据下具备更高的鲁棒性。

关键词: 时间序列, 异常检测, 受限分布映射, 伪异常校准

Abstract: Time series anomaly detection aims to identify rare patterns or deviations that significantly differ from normal behavior. Existing research focuses on designing more advanced network architectures or optimizing objectives to accurately capture the normal patterns in the data. However, training data contaminated with anomalies and the lack of anomalous information can lead to biases in the normal decision boundary learned by traditional methods, resulting in suboptimal detection performance. This paper proposes an unsupervised anomaly detection method based on restricted distribution mapping and pseudo anomaly calibration. Specifically, the input data features are first extracted using a temporal convolutional network. Then, to learn a more accurate normal decision boundary, this method optimizes the normal representation learning process from two aspects. Firstly, a restricted distribution mapping method is proposed to map the unknown distribution of the training data to a Gaussian distribution through feature normalization, and to minimize the one-class distance between the normal data and the center of the hypersphere, to make the data more compact in the feature space. Secondly, a pseudo anomaly calibration mechanism is proposed to generate multiple types of pseudo-anomaly data through data perturbation operations applied to the original data. This mechanism incorporates anomaly knowledge into the model by distinguishing between normal and pseudo-anomaly data, thereby refining the decision boundary. Meanwhile, the class separability between normal and abnormal data is expanded by maximizing the one-class distance between the pseudo-anomalous data and the center of the hypersphere. In the testing phase, anomalies are detected by measuring the one-class distance between the input data and the hyper-sphere center. Extensive experiments conducted on five real-world datasets demonstrate the superior performance of this method compared to current mainstream methods, as well as its higher robustness under different levels of training data contamination with anomalies.

Key words: time series, anomaly detection, restricted distribution mapping, pseudo anomaly calibration

陈泽健, 李佐勇, 胡蓉, 樊好义. 受限分布映射和伪异常校准引导下的时序异常检测[J]. 计算机工程与应用, 2025, 61(5): 134-146.

CHEN Zejian, LI Zuoyong, HU Rong, FAN Haoyi. Time Series Anomaly Detection Based on Restricted Distribution Mapping and Pseudo Anomaly Calibration[J]. Computer Engineering and Applications, 2025, 61(5): 134-146.

参考文献

[1] ZHANG Y X, CHEN Y Q, PAN Z W. A deep temporal model for mental fatigue detection[C]//Proceedings of the 2018 IEEE International Conference on Systems, Man, and Cybernetics , 2018: 1879-1884.
[2] LI D, CHEN D C, JIN B H, et al. MAD-GAN: multivariate anomaly detection for time series data with generative adversarial networks[C]//Proceedings of the International Conference on Artificial Neural Networks, 2019: 703-716.
[3] SARDA K, ACERNESE A, NOLE V, et al. A multi-step anomaly detection strategy based on robust distances for the steel industry[J]. IEEE Access, 2021, 9: 53827-53837.
[4] 宋春雷, 赵旭俊, 高亚星, 等. 采用分段特征表示的异常序列检测算法[J]. 计算机工程与应用, 2023, 59(9): 262-271.
SONG C L, ZHAO X J, GAO Y X, et al. Anomaly series detection algorithm based on segmentation feature representation[J]. Journal of Computer Engineering and Applications, 2023, 59(9): 262-271.
[5] 王昊天, 郑栋毅, 刘芳, 等. 面向多元时序数据的个性化联邦异常检测方法[J]. 计算机工程与应用, 2022, 58(11): 60-65.
WANG H T, ZHENG D Y, LIU F, et al. Personalized federated anomaly detection method for multivariate time series data[J]. Journal of Computer Engineering and Applications, 2022, 58(11): 60-65.
[6] 展鹏, 陈琳, 曹鲁慧, 等. 核转折点裁剪表示的时间序列异常检测算法[J]. 计算机工程与应用, 2020, 56(23): 130-138.
ZHAN P, CHEN L, CAO L H, et al. Time series anomaly detection based on kernel turning points clipped representation[J]. Journal of Computer Engineering and Applications, 2020, 56(23): 130-138.
[7] 席亮, 王瑞东, 樊好义, 等. 基于样本关联感知的无监督深度异常检测模型[J]. 计算机学报, 2021, 44(11): 2317-2331.
XI L, WANG R D, FAN H Y, et al. Sample-correlation-aware unsupervised deep anomaly detection model[J]. Chinese Journal of Computers, 2021, 44(11): 2317-2331.
[8] 黄训华, 张凤斌, 樊好义, 等. 基于多模态对抗学习的无监督时间序列异常检测[J]. 计算机研究与发展, 2021, 58(8): 1655-1667.
HUANG X H, ZHANG F B, FAN H Y, et al. Multimodal adversarial learning based unsupervised time series anomaly detection[J]. Journal of Computer Research and Development, 2021, 58(8): 1655-1667.
[9] 席亮, 刘涵, 樊好义, 等. 基于深度对抗学习潜在表示分布的异常检测模型[J]. 电子学报, 2021, 49(7): 1257-1265.
XI L, LIU H, FAN H Y, et al. Deep adversarial learning latent representation distribution model for anomaly detection[J]. Acta Electronica Sinica, 2021, 49(7): 1257-1265.
[10] BREUNIG M M, KRIEGEL H P, NG R T, et al. LOF: identifying density-based local outliers[C]//Proceedings of the International Conference on Management of Data, 2000: 93-104.
[11] SCHOLKOPF B, PLATT J C, SHAWE-TAYLOR J, et al. Estimating the support of a high-dimensional distribution[J]. Neural Computation, 2001, 13(7): 1443-1471.
[12] SAKURADA M, YAIRI T. Anomaly detection using autoencoders with nonlinear dimensionality reduction[C]//Proceedings of the 2nd Workshop on Machine Learning for Sensory Data Analysis, 2014: 4-11.
[13] ZHANG Y X, WANG J D, CHEN Y Q, et al. Adaptive memory networks with self-supervised learning for unsupervised anomaly detection[J]. IEEE Transactions on Knowledge and Data Engineering, 2022, 35(12): 12068-12080.
[14] ERGEN T, KOZAT S S. Unsupervised anomaly detection with LSTM neural networks[J]. IEEE Transactions on Neural Networks and Learning Systems, 2019, 31(8): 3127-3141.
[15] LU W N, CHENG Y, XIAO C, et al. Unsupervised sequential outlier detection with deep architectures[J]. IEEE Transactions on Image Processing, 2017, 26(9): 4321-4330.
[16] ZHENG Y, KOH H Y, JIN M, et al. Correlation-aware spatial-temporal graph learning for multivariate time-series anomaly detection[J]. arXiv:2307.08390, 2023.
[17] XU J H, WU H X, WANG J M, et al. Anomaly transformer: time series anomaly detection with association discrepancy[C]//Proceedings of the International Conference on Learning Representations, 2021.
[18] TAX D M, DUIN R P. Support vector data description[J]. Machine Learning, 2004, 54: 45-66.
[19] PAFFENROTH R, DU T P, NONG R, et al. Space-time signal processing for distributed pattern detection in sensor networks[J]. IEEE Journal of Selected Topics in Signal Processing, 2013, 7(1): 38-49.
[20] SCHOLKOPF B, SMOLA A, MULLER K R. Nonlinear component analysis as a kernel eigenvalue problem[J]. Neural Computation, 1998, 10(5): 1299-1319.
[21] HOFFMANN H. Kernel PCA for novelty detection[J]. Pattern Recognition, 2007, 40(3): 863-874.
[22] PAFFENROTH R, KAY K, SERVI L. Robust PCA for anomaly detection in cyber networks[J]. arXiv:1801.01571,2018.
[23] GüNNEMANN N, GUNNEMANN S, FALOUTSOS C. Robust multivariate autoregression for anomaly detection in dynamic product ratings[C]//Proceedings of the 23rd International Conference on World Wide Web, 2014: 361-372.
[24] MOAYEDI H Z, MASNADI-SHIRAZI M A. Arima model for network traffic prediction and anomaly detection[C]//Proceedings of the 2008 International Symposium on Information Technology, 2008, 4: 1-6.
[25] ZHANG C K, LI S C, ZHANG H Y, et al. VELC: a new variational autoencoder based model for time series anomaly detection[J]. arXiv:1907.01702,2019.
[26] LAI G K, CHANG W C, YANG Y M, et al. Modeling long-and short-term temporal patterns with deep neural networks[C]//Proceedings of the 41st International Conference on Research & Development in Information Retrieval, 2018: 95-104.
[27] WONG L, LIU D, BERTI-EQUILLE L, et al. AER: auto-encoder with regression for time series anomaly detection[C]//Proceedings of the 2022 IEEE International Conference on Big Data, 2022: 1152-1161.
[28] XIAO Q F, SHAO S K, WANG J. Memory-augmented adversarial autoencoders for multivariate time-series anomaly detection with deep reconstruction and prediction[J]. arXiv:2110.08306, 2021.
[29] DARBAN Z Z, WEBB G I, PAN S, et al. CARLA: a self-supervised contrastive representation learning approach for time series anomaly detection[J]. arXiv:2308.09296,2023.
[30] CHEN K, FENG M, WIRJANTO T S. Time-series anomaly detection via contextual discriminative contrastive learning[J]. arXiv:2304.07898, 2023
[31] XU H Z, WANG Y J, JIAN S L, et al. Calibrated one-class classification for unsupervised time series anomaly detection[J]. arXiv:2207.12201, 2022.
[32] XIAO F, SUN R, FAN J. Restricted generative projection for one-class classification and anomaly detection[J]. arXiv:2307.04097,2023.
[33] ABDULAAL A, LIU Z, LANCEWICKI T. Practical approach to asynchronous multivariate time series anomaly detection and localization[C]//Proceedings of the 27th Conference on Knowledge Discovery & Data Mining, 2021: 2485-2494.
[34] MATHUR A P, TIPPENHAUER N O. SWaT: a water treatment testbed for research and training on ICS security[C]//Proceedings of the 2016 International Workshop on Cyber-Physical Systems for Smart Water Networks, 2016: 31-36.
[35] ALTUN K, BARSHAN B, TUNCEL O. Comparative study on classifying human activities with miniature inertial and magnetic sensors[J]. Pattern Recognition, 2010, 43(10): 3605-3620.
[36] ANGRYK R, MARTENS P, AYDIN B, et al. SWAN-SF[EB/OL]. (2019-01-31)[2023-08-01]. https://doi.org/10.7910/DVN/EBCFKM.
[37] LAI K H, ZHA D C, XU J J, et al. Revisiting time series outlier detection: definitions and benchmarks[C]//Proceedings of the 35th Conference on Neural Information Processing Systems Datasets and Benchmarks Track, 2021.
[38] MORITZ S, REHBACH F, CHANDRASEKARAN S, et al. GECCO industrial challenge 2018 dataset: a water quality dataset for the “Internet of Things: online anomaly detection for drinking water quality”[C]//Proceedings of the Genetic and Evolutionary Computation Conference, 2018.
[39] ZHAO Y, NASRULLAH Z, LI Z. Pyod: a python toolbox for scalable outlier detection[J]. arXiv:1901.01588, 2019.
[40] BHATNAGAR A, KASSIANIK P, LIU C H, et al. Merlion: a machine learning library for time series[J]. arXiv:2109. 09265, 2021.
[41] BALDI P. Autoencoders, unsupervised learning, and deep architectures[C]//Proceedings of the Workshop on Unsupervised and Transfer Learning, 2012: 37-49.
[42] SUTSKEVER I, VINYALS O, LE Q V. Sequence to sequence learning with neural networks[C]//Proceedings of the 28th International Conference on Neural Information Processing Systems, 2014: 3104-3112.
[43] RUFF L, VANDERMEULEN R, GOERNITZ N, et al. Deep one-class classification[C]//Proceedings of the International Conference on Machine Learning, 2018: 4393-4402.
[44] ZONG B, SONG Q, MIN M R, et al. Deep autoencoding Gaussian mixture model for unsupervised anomaly detection[C]//Proceedings of the International Conference on Learning Representations, 2018.
[45] SU Y, ZHAO Y J, NIU C H, et al. Robust anomaly detection for multivariate time series through stochastic recurrent neural network[C]//Proceedings of the 25th International Conference on Knowledge Discovery & Data Mining, 2019: 2828-2837.
[46] ZHAO H, WANG Y J, DUAN J Y, et al. Multivariate time-series anomaly detection via graph attention network[C]//Proceedings of the 2020 IEEE International Conference on Data Mining, 2020: 841-850.
[47] QIU C, PFROMMER T, KLOFT M, et al. Neural transformation learning for deep anomaly detection beyond images[C]//Proceedings of the International Conference on Machine Learning, 2021: 8703-8714.
[48] MIAO Q C, XU C F, ZHAN J, et al. An unsupervised short-and long-term mask representation for multi-variate time series anomaly detection[C]//Proceedings of the International Conference on Neural Information Processing, 2022: 504-516.
[49] TULI S, CASALE G, JENNINGS N R. TranAD: deep transformer networks for anomaly detection in multivariate time series data[J]. Proceedings of the VLDB Endowment, 2022, 15(6): 1201-1214.
[50] LI Z, ZHAO Y, HU X Y. ECOD: unsupervised outlier detection using empirical cumulative distribution functions[J]. IEEE Transactions on Knowledge and Data Engineering, 2022, 35(12): 12181-12193.