提出一种多路运行数据异常检测方法,能发现单路正常但整体异常的罕见事件。
TRACE-C: Rank-Calibrated Relational Anomaly Detection for Multi-Stream Operational Telemetry
- 用三通道统计量融合局部、依赖关系和时间序列特征,通过秩校准提升检测精度
- 在2019年英国电网数据中,成功将风暴“阿蒂亚”排在首位,但核心贡献来自局部通道
- 结果可审计且完全由代码生成,适合电力系统等高可靠场景的异常监控
运行遥测数据可能在整体上异常,而各单独数据流仍处于正常范围。本文提出一种可审计的严格先验秩校准检测器TRACE-C,用于对齐的多路遥测数据:同一时段的滚动中位数/四分位距残差输入三个窗口通道——最大归一化局部和、基于稳健z残差的高斯伪对称依赖对比、最差标准化AR(1)创新——其通道秩经费希尔合并后与历史聚合结果比较。在六条英国电网数据流上,使用2019年1-4月拟合,7-12月发展验证,并对2020年冻结数据进行检验。结果显示,TRACE-C将风暴“阿蒂亚”排在2019年测试窗口首位,但通道消融分析表明该排名源于局部通道,仅依赖对称通道则排名第59。8月9日频率事件在融合检测器中排名第143,远低于时间通道单独评估的第40名;重建基线却将其排第一。2020年无任何窗口被选中,符合记录规则饱和而非无事之年;最高排名的冻结窗口后被解释为风暴“艾伦”。三个解释限制贯穿始终:所得p值是选择量而非事件概率;对称通道非真实对称密度,未做概率积分或正态分数变换;经验秩计数仅为诊断工具,不构成覆盖率或误报率证明。本文所有表格与图表均来自已提交的可执行报告。
原文摘要 · Abstract (English)
Operational telemetry can be jointly anomalous while every individual stream stays inside its familiar range. TRACE-C is an auditable strictly-prior rank-calibrated detector for aligned multi-stream telemetry: same-regime rolling median/MAD residuals feed three window channels -- a maximum normalized local sum, a Gaussian copula-form dependence contrast on robust-z residuals, and a worst standardized AR(1) innovation -- whose channel ranks are Fisher-aggregated and ranked against earlier aggregates. We evaluate six Great Britain grid streams with a January-April 2019 fit, July-December 2019 development evidence, and a 2020 hold-out frozen before inspection. TRACE-C ranks Storm Atiyah first among 2019 test windows, but a disclosed channel ablation attributes that rank to the local channel, not the copula-form channel: copula-only ranks Atiyah 59th. The short 9 August frequency event is ranked far lower by the fused detector (143) than by the temporal channel alone (40), and reconstruction baselines rank it first. In 2020 no window is selected, which is consistent with record-rule saturation rather than an uneventful year; the highest-ranked frozen window was later interpreted as Storm Ellen. Three interpretive limits carry throughout. The resulting p-values are selection quantities, not event probabilities. The copula-form channel is not a literal copula density: the method applies no probability-integral or normal-score transform. Empirical rank counts are diagnostics, not coverage or false-discovery proofs. Every table and figure in this paper is generated from committed machine-readable reports.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。