提出SMKC框架,解决变量数量动态变化的时序异常检测难题。
SMKC: Sketch Based Kernel Correlation Images for Variable Cardinality Time Series Anomaly Detection
- 用不变特征哈希将动态输入压缩为固定长度序列。
- 通过混合核图像捕捉全局时序结构,识别异常模式。
- 随机投影+最近邻方法无需训练,适合资源受限场景。
传统多变量时序异常检测依赖变量集合保持静态,但在实际运维中传感器常发生增减或重命名,导致数据窗口的变量数动态变化且包含训练中未见值。为此,我们提出SMKC框架,将动态输入结构与异常检测器解耦。首先采用置换不变特征哈希将原始输入映射为固定长度状态序列;随后构建混合核图像,通过序列及其导数的成对比较捕捉全局时序结构。模型通过掩码重建和师生预测目标学习正常模式。评估显示,鲁棒的对数距离通道提供主要判别信号,而余弦表示常缺乏足够对比度。值得注意的是,仅使用随机投影与最近邻的检测器在SMKC表示上表现媲美全训练基线,且无需梯度更新,凸显该表示的有效性,为资源受限环境提供了实用的冷启动方案。
原文摘要 · Abstract (English)
Conventional anomaly detection in multivariate time series relies on the assumption that the set of observed variables remains static. In operational environments, however, monitoring systems frequently experience sensor churn. Signals may appear, disappear, or be renamed, creating data windows where the cardinality varies and may include values unseen during training. To address this challenge, we propose SMKC, a framework that decouples the dynamic input structure from the anomaly detector. We first employ permutation-invariant feature hashing to sketch raw inputs into a fixed size state sequence. We then construct a hybrid kernel image to capture global temporal structure through pairwise comparisons of the sequence and its derivatives. The model learns normal patterns using masked reconstruction and a teacher-student prediction objective. Our evaluation reveals that robust log-distance channels provide the primary discriminative signal, whereas cosine representations often fail to capture sufficient contrast. Notably, we find that a detector using random projections and nearest neighbors on the SMKC representation performs competitively with fully trained baselines without requiring gradient updates. This highlights the effectiveness of the representation itself and offers a practical cold-start solution for resource-constrained deployments.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。