| 摘 要: 金融机构IT基础设施的稳定运行是保障业务连续性和信息安全的重要基础,而运营数据中的异常往往是系统故障或潜在风险的早期信号。针对金融运营数据呈现出的高维、多源、强时间依赖性以及异常样本稀缺等特点,提出了一种基于分层混合策略的无监督时间序列异常检测感知框架。基于 CHANDOLA等提出的经典异常检测理论,对点异常、情境异常和集合异常进行了形式化定义。方法采用3阶段分层检测:阶段1利用 K 近邻(KNN)进行快速全局筛选;阶段2基于(门控循环单元 GRU)自编码器模型对时间序列上下文进行建模;阶段3通过加权融合机制与动态阈值策略实现最终异常判定。实验在包含 4981个时间点、15 维特征、异常比例约 0.7% 的运营数据集上 进 行。结 果 表 明,KNN+GRU 在 GPU 环 境 下 取 得 AUC-ROC(Area Under Receiver Operating CharacteristicCurve)为0.8376、F1值为0.1711,综合性能优于IForest+CNN-LSTM 对比方法。进一步地,给出基于OpenTelemetry的工程化实现方案,为金融系统智能运维提供了可落地的技术路径。 |
| 关键词: 时间序列异常检测 金融运营数据 OpenTelemetry 多层混合策略 |
|
中图分类号: TP391
文献标识码: A
|
|
| Perception-Oriented Time-Series Anomaly Detection for Financial Operational Data |
|
DIAO Yong
|
(Library and Archives, Dalian Maritime University, Dalian 116026, China)
diao_yong@dlmu.edu.cn
|
| Abstract: The stable operation of IT infrastructure in financial institutions is critical for ensuring business continuity and information security, while anomalies in operational data often serve as early indicators of system failures or potential risks. Financial operational data typically exhibit high dimensionality, mult-i source heterogeneity,strong temporal dependence, and extreme class imbalance, with anomalous events being very rare. To address these challenges, this paper proposes an unsupervised time-series anomaly detection framework based on a hierarchical hybrid strategy. Built upon the classical anomaly detection theory of CHANDOLA et al., the framework formally defines point, contextual, and collective anomalies, and decomposes the detection task into three stages. Stage 1 employs a K-Nearest Neighbors (KNN) model for fast global screening of outliers. Stage 2 uses a gated recurrent unit (GRU)-based autoEncoder to model temporal context and capture complex sequence patterns. Stage 3 integrates mult-i stage anomaly scores through weighted fusion and a dynamic thresholding mechanism to generate final decisions.Experiments are conducted on a rea-l world financial operational dataset with 4981 time points, 15-dimensional feature vectors, and an anomaly ratio of approximately 0.7% , representing a highly imbalanced scenario. The results show that the proposed KNN+ GRU hybrid method, when accelerated by GPU, achieves an Area Under Receiver Operating Characteristic Curve(AUC-ROC) of 0.8376 and an F1-score of 0.171 1, outperforming the baseline IForest+ CNN-LSTM pipeline in terms of both detection accuracy and recall. Furthermore, this paper discusses an engineering implementation based on OpenTelemetry, demonstrating the practical feasibility of deploying the proposed method in production-grade financial AIOps environments. |
| Keywords: time series anomaly detection financial operational data OpenTelemetry hierarchical hybrid strategy |
