提取时空特征的无监督时间序列异常检测

Time Series Anomaly Detection Model Based on Deep Mining of Spatio-Temporal Features

摘要: 为解决web应用程序及服务中的异常自动发现问题，针对互联网运维中常用监控指标的异常检测提出了一种基于深度挖掘时空特征的时间序列异常检测模型。考虑到web服务场景中异常发现的时效性要求，模型加强了编码器对空间信息的建模能力。模型使用基于VGG+Bi-LSTM的编码器用于挖掘时序数据中时空特征，使用全连接神经网络与Bi-LSTM构成的解码器重构输入数据。异常判定模块基于重构结果与原始输入的偏离程度计算异常得分与发现异常。这是一种无监督、不需要对异常数据进行分布假设，是纯数据驱动的方法。基于重构输入数据的方式使其拥有发现不可预见错误的能力。充分挖掘时空特征使模型能够及时准确地发现异常。实验结果表明，模型相较于目前常用的时间序列异常检测模型具有更高的异常识别准确率。在公开数据集上的实验结果表明，模型召回率提高6%，F1-score提高0.04。

Abstract: To solve the problem of automatic anomaly detection in web applications and services, a time series anomaly detection model based on deep mining of spatio-temporal features is proposed for the anomaly detection of commonly used monitoring indicators in Internet operation and maintenance. Taking into account the timeliness requirements of abnormal discovery in web service scenarios, the model strengthens the encoder’s ability to model spatial information. The model uses an encoder based on VGG+Bi-LSTM to mine spatio-temporal features in time series data, and uses a decoder composed of a fully connected neural network and Bi-LSTM to reconstruct the input data. The abnormality determination module calculates the abnormality score and finds the abnormality based on the degree of deviation between the reconstruction result and the original input. This is an unsupervised method that makes no distribution assumption on the abnormal data, and is a purely data-driven method. Based on the way of reconstructing the input data, it has the ability to find unforeseen errors. Fully excavate spatio-temporal features so that the model can find anomalies in a timely and accurate manner. The experimental results show that the model in this paper has higher recognition accuracy than the current time series anomaly detection models. The experimental results on the public data set show that the model recall is increased by 6%, and the F1-score is increased by 0.04.