一种基于交互式卷积和Transformer的异常检测算法

doi:10.3969/j.issn.1671-1122.2026.07.006

信息网络安全 ›› 2026, Vol. 26 ›› Issue (7): 1077-1086.doi: 10.3969/j.issn.1671-1122.2026.07.006

一种基于交互式卷积和Transformer的异常检测算法

郑天明¹, 刘尚东²(), 李海天², 李华³

¹ 南京航空航天大学计算机科学与技术学院，南京 211106
² 南京邮电大学计算机学院，南京 210023
³ 中国人民解放军陆军工程大学石家庄校区，石家庄 050003

收稿日期:2025-12-19 出版日期:2026-07-10 发布日期:2026-09-03
通讯作者: 刘尚东 E-mail:lsd@njupt.edu.cn
作者简介:郑天明（1985—），男，江苏，高级工程师，博士研究生，主要研究方向为网络安全防御、人工智能安全|刘尚东（1979—），男，甘肃，副教授，博士，主要研究方向为大数据、人工智能、网络安全|李海天（1999—），男，山东，硕士研究生，主要研究方向为异常检测|李华（1981—），男，河北，高级工程师，博士，主要研究方向为网络安全防御、信息系统智能化
基金资助:
国家重点研发计划(2023YFB2904000);国家重点研发计划(2023YFB2904004);江苏省重点研发计划(BE2023004-2)

Interactive convolution and Transformer based anomaly detection algorithm

Zheng Tianming¹, Liu Shangdong²(), Li Haitian², Li Hua³

¹ College of Computer Science and Technology, Nanjing University of Aeronautics and Astronautics, Nanjing 211106, China
² School of Computer Science, Nanjing University of Posts and Telecommunications, Nanjing 210023, China
³ Shijiazhuang Campus of PLA Army Engineering University, Shijiazhuang 050003, China

Received:2025-12-19 Online:2026-07-10 Published:2026-09-03
Contact: Liu Shangdong E-mail:lsd@njupt.edu.cn

摘要/Abstract

摘要：

为解决Transformer模型注意力机制在处理时间序列数据时，对数据中固有噪声与冗余信息存在局限性的问题，文章提出一种基于交互式卷积与Transformer的异常检测算法ICT-AD。该算法采用自适应频率滤波器（AFF）去除高频噪声与冗余信息，并以Anomaly Transformer作为骨干网络。同时，引入自适应交互式卷积块（AIC）进一步增强模型对复杂时间序列模式的捕捉与解释能力。在4个数据集上的多项实验结果表明，ICT-AD的性能优于现有方法。

关键词: 时间序列, 异常检测, Transformer, 交互式卷积

Abstract:

To address the limitations of the Transformer model’s attention mechanism in handling the inherent noise and redundant information in time series data, this paper proposed an anomaly detection algorithm based on interactive convolution and Transformer, termed ICT-AD. The algorithm employed an adaptive frequency filter (AFF) to remove high-frequency noise and redundant information, and adopted Anomaly Transformer as its backbone network. Additionally, an adaptive interactive convolution (AIC) block was introduced to further enhance the model’s ability to capture and interpret complex temporal patterns. Extensive experimental results on four datasets demonstrate that ICT-AD outperforms existing methods.

Key words: time series, anomaly detection, Transformer, interactive convolution

中图分类号:

TP309

郑天明, 刘尚东, 李海天, 李华. 一种基于交互式卷积和Transformer的异常检测算法[J]. 信息网络安全, 2026, 26(7): 1077-1086.

Zheng Tianming, Liu Shangdong, Li Haitian, Li Hua. Interactive convolution and Transformer based anomaly detection algorithm[J]. Netinfo Security, 2026, 26(7): 1077-1086.

图/表 4

图1

图2

表1

表2

参考文献 26

[1]	Xu Jiehui, Wu Haixu, Wang Jianmin, et al. Anomaly transformer: time series anomaly detection with association discrepancy[EB/OL]. (2022-04-25)[2025-08-12]. https://arxiv.org/abs/2110.02642.
[2]	Zhang Tianping, Zhang Yizhuo, Cao Wei, et al. Less is more: fast multivariate time series forecasting with light sampling-oriented mlp structures[EB/OL]. (2022-07-04)[2025-08-12]. https://arxiv.org/abs/2207.01186.
[3]	Sellam A Z, Benaissa I, Taleb-ahmed A, et al. Mamba adaptive anomaly transformer with association discrepancy for time series[J]. Engineering Applications of Artificial Intelligence, 2025, 160(5): 11-16.
[4]	Liu Qingxiang, Liu Chenghao, Sun Sheng, et al. GDformer: going beyond subsequence isolation for multivariate time series anomaly detection[EB/OL]. (2025-01-30)[2025-08-12]. https://arxiv.org/abs/2501.18196.
[5]	Yue Wenzhen, Ying Xianghua, Guo Ruohao, et al. Sub-adjacent transformer: improving time series anomaly detection with reconstruction error from sub-adjacent neighborhoods[EB/OL]. (2024-08-03)[2025-08-12]. https://arxiv.org/abs/2404.18948.
[6]	Song J, Kim K, Oh J, et al. MEMTO: memory-guided transformer for multivariate time series anomaly detection[J]. Advances in Neural Information Processing Systems, 2023, 36: 57947-57963.
[7]	Eldele E, Ragab M, Chen Z, et al. TSLANet: rethinking transformers for time series representation learning[EB/OL]. (2024-03-02)[2025-08-12]. https://proceedings.mlr.press/v235/eldele24a.html.
[8]	Zeng Ailing, Chen Muxi, Zhang Lei, et al. Are transformers effective for time series forecasting?[C]// The 37th AAAI Conference on Artificial Intelligence. Menlo Park: AAAI, 2023, 37(9): 11121-11128.
[9]	Cui Manjun, Zhang Zhichao. Generalized convolution and product theorems associated with the free metaplectic transformation and their applications[J]. Digital Signal Processing, 2024, 145(2): 104350-104351. doi: 10.1016/j.dsp.2023.104350 URL
[10]	Omuya E O, Okeyo G O, Kimwele M W. Feature selection for classification using principal component analysis and information gain[J]. Expert Systems with Applications, 2021, 174(18): 27-30
[11]	Shin Y, Lee S, Tariq S, et al. ITAD: integrative tensor-based anomaly detection system for reducing false positives of satellite systems[C]// The 29th ACM International Conference on Information & Knowledge Management. New York: ACM, 2020: 2733-2740.
[12]	Shen Lifeng, Li Zhuocong, Kwok J. Timeseries anomaly detection using temporal hierarchical one-class network[J]. Advances in Neural Information Processing Systems, 2020, 33(22): 13016-13026.
[13]	Ruff L, Vandermeulen R, Goernitz N, et al. Deep one-class classification[C]// The International Conference on Machine Learning. Stockholm: PMLR, 2018: 4393-4402.
[14]	Zong Bo, Song Qi, Min M R, et al. Deep autoencoding gaussian mixture model for unsupervised anomaly detection[C]// The International Conference on Learning Representations. San Diego: ICLR, 2018: 1-19.
[15]	Yairi T, Takeishi N, Oda T, et al. A data-driven health monitoring method for satellite housekeeping data based on probabilistic clustering and dimensionality reduction[J]. Transactions on Aerospace and Electronic Systems, 2017, 53(3): 1384-1401. doi: 10.1109/TAES.2017.2671247 URL
[16]	Breunig M M, Kriegel H P, Ng R T, et al. LOF: identifying density-based local outliers[C]// ACM SIGMOD International Conference on Management of Data. New York: ACM, 2000: 93-104.
[17]	Tariq S, Lee S, Shin Y, et al. Detecting anomalies in space using multivariate convolutional LSTM with mixtures of probabilistic PCA[C]// The International Conference on Multimedia. New York: ACM, 2019: 2123-2133.
[18]	Hundman K, Constantinou V, Laporte C, et al. Detecting spacecraft anomalies using LSTMS and nonparametric dynamic thresholding[C]// The 24th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining. New York: ACM, 2018: 387-395.
[19]	Park D, Hoshi Y, Kemp C C. A multimodal anomaly detector for robot-assisted feeding using an LSTM-based variational autoencoder[J]. Robotics and Automation Letters, 2018, 3(3): 1544-1551.
[20]	Su Ya, Zhao Youjian, Niu Chenhao, et al. Robust anomaly detection for multivariate time series through stochastic recurrent neural network[C]// The International Conference on Multimedia. New York: ACM, 2019: 2828-2837.
[21]	Tuli S, Casale G, Jennings N R. TRANAD: deep transformer networks for anomaly detection in multivariate time series data[EB/OL]. (2022-05-14)[2025-08-12]. https://arxiv.org/abs/2201.07284.
[22]	Wu Qiang, Yao Gechang, Feng Zhixi, et al. PERI-Midformer: periodic pyramid transformer for time series analysis[J]. Advances in Neural Information Processing Systems, 2024, 37(11): 13035-13073.
[23]	Zhang Zhenhua, Li Leyao, Mu Lingxia, et al. Anomaly detection using bidirectional prediction and dynamic thresholding for a spacecraft[C]// The 37th Chinese Control and Decision Conference. New York: IEEE, 2025: 2327-2332.
[24]	Abdulaal A, Liu Zhuanghua, Lancewicki T. Practical approach to asynchronous multivariate time series anomaly detection and localization[C]// ACM SIGKDD International Conference on Knowledge Discovery and Data Mining. New York: ACM, 2021: 2485-2494.
[25]	Entekhabi D, Njoku E G, O’neill P E, et al. The soil moisture active passive (smap) mission[J]. Proceedings of the IEEE, 2010, 98(5): 704-716. doi: 10.1109/JPROC.2010.2043918 URL
[26]	Goh J, Adepu S, Junejo K N, et al. A dataset to support research in the design of secure water treatment systems[C]// The International Conference on Critical Information Infrastructures Security. Heidelberg: Springer, 2017: 88-99.

模型	MSL			PSM
模型	P	R	F1	P	R	F1
DAGMM	89.60%	63.93%	74.62%	93.49%	70.03%	80.08%
MMPCACD	81.42%	61.31%	69.95%	76.26%	78.35%	77.29%
LOF	47.72%	85.25%	61.18%	57.89%	90.49%	70.61%
ITAD	69.44%	84.09%	76.07%	72.80%	64.02%	68.13%
THOC	88.45%	90.97%	89.69%	88.14%	90.99%	89.54%
Deep-SVDD	91.92%	76.63%	83.58%	95.41%	86.49%	90.73%
CL-MPPCA	73.71%	88.54%	80.44%	56.02%	99.93%	71.80%
LSTM	85.45%	82.50%	83.95%	76.93%	89.64%	82.80%
LSTM-VAE	85.49%	79.94%	82.62%	73.62%	89.92%	80.96%
OmniAnomaly	89.02%	86.37%	87.67%	88.39%	74.46%	80.83%
TSLANet	77.46%	90.12%	83.32%	98.36%	98.55%	97.73%
Peri-midFormer	89.66%	75.31%	81.83%	98.40%	96.01%	97.19%
TranAD	90.38%	99.99%	94.94%	—	—	—
AnomalyTrans	92.09%	95.15%	93.59%	96.91%	98.90%	97.89%
ICT-AD	92.14%	98.07%	95.01%	97.39%	99.14%	98.26%
模型	SMAP			SWaT
模型	P	R	F1	P	R	F1
DAGMM	86.45%	56.73%	68.51%	89.92%	57.84%	70.40%
MMPCACD	88.61%	75.84%	81.73%	82.52%	68.29%	74.73%
LOF	58.93%	56.33%	57.60%	72.15%	65.43%	68.62%
ITAD	82.42%	66.89%	73.85%	63.13%	52.08%	57.08%
THOC	92.06%	89.34%	90.68%	83.94%	86.36%	85.13%
Deep-SVDD	89.93%	56.02%	69.04%	80.42%	84.45%	82.39%
CL-MPPCA	86.13%	63.16%	72.88%	76.78%	81.50%	79.07%
LSTM	89.41%	78.13%	83.39%	86.15%	83.27%	84.69%
LSTM-VAE	92.20%	67.75%	78.10%	76.00%	89.50%	82.20%
OmniAnomaly	92.49%	81.99%	86.92%	81.42%	84.30%	82.83%
TSLANet	92.45%	64.47%	75.96%	91.50%	94.14%	92.80%
Peri-midFormer	90.40%	56.10%	68.62%	91.91%	94.95%	93.40%
TranAD	80.43%	99.99%	89.15%	97.60%	69.97%	84.91%
AnomalyTrans	94.13%	99.40%	96.69%	91.55%	96.73%	94.07%
ICT-AD	94.63%	98.99%	96.76%	94.58%	96.75%	95.65%

模型	MSL	PSM	SMAP	SWaT
Baseline	93.59%	97.89%	96.69%	94.07%
Baseline+AFF	94.31%	98.02%	96.49%	94.60%
Baseline+AIC	94.99%	97.94%	96.48%	94.90%
Baseline+AFF+AIC	95.01%	98.26%	96.76%	95.65%

一种基于交互式卷积和Transformer的异常检测算法

Interactive convolution and Transformer based anomaly detection algorithm

RichHTML

PDF (PC)

可视化

摘要/Abstract

引用本文

使用本文

图/表 4

参考文献 26

相关文章 15

编辑推荐

Metrics

本文评价

[1]	钱晓晟, 王利莹, 赵宇, 刘光亚, 王成. 基于行为注意力的算力网络异常检测系统[J]. 信息网络安全, 2026, 26(7): 1101-1114.
[2]	李锦凯, 王靖雯, 董立波, 姚文翰, 刘成杰, 文伟平. 基于时序图注意力网络的区块链异常交易检测方法[J]. 信息网络安全, 2026, 26(4): 579-590.
[3]	胡文涛, 丁伟杰. DiffGuard：基于扩散模型与自适应序列学习的网络流量异常检测框架[J]. 信息网络安全, 2026, 26(3): 378-388.
[4]	陈宇琪, 钱汉伟, 夏玲玲, 王群. FEViT：一种基于频域增强ViT的深度伪造检测模型[J]. 信息网络安全, 2026, 26(3): 432-441.
[5]	梁广俊, 裘宇辰, 司宏韬, 王群, 马卓, 陈宇琪. 区块链虚拟货币溯源与分析[J]. 信息网络安全, 2026, 26(3): 482-490.
[6]	李冬, 高源, 于俊清, 曾木虹, 陈俊鑫. 一种基于P4的多模态网络控制与安全检测方案[J]. 信息网络安全, 2026, 26(1): 115-124.
[7]	赵文宇, 党晨曦, 杜振华, 张健. 基于硬件性能计数器的勒索软件检测技术研究与实现[J]. 信息网络安全, 2025, 25(9): 1397-1406.
[8]	孙剑文, 张斌, 司念文, 樊莹. 基于知识蒸馏的轻量化恶意流量检测方法[J]. 信息网络安全, 2025, 25(6): 859-871.
[9]	韦超仁, 夏万煦, 屈刚, 白万荣, 杨立群. 面向智能系统开源模糊测试框架优化技术研究[J]. 信息网络安全, 2025, 25(4): 587-597.
[10]	陈红松, 刘新蕊, 陶子美, 王志恒. 基于深度学习的时序数据异常检测研究综述[J]. 信息网络安全, 2025, 25(3): 364-391.
[11]	张新有, 高志超, 冯力, 邢焕来. 基于FFT-iTransformer的网络安全态势特征插补与预测[J]. 信息网络安全, 2025, 25(2): 228-239.
[12]	刘强, 王坚, 王亚男, 王珊. 基于集成学习的恶意代码动态检测方法[J]. 信息网络安全, 2025, 25(1): 159-172.
[13]	周书丞, 李杨, 李传荣, 郭璐璐, 贾辛洪, 杨兴华. 基于上下文的异常根因算法[J]. 信息网络安全, 2024, 24(7): 1062-1075.
[14]	张浩, 谢大智, 胡云晟, 叶骏威. 基于半监督学习的网络异常检测研究综述[J]. 信息网络安全, 2024, 24(4): 491-508.
[15]	王健, 陈琳, 王凯崙, 刘吉强. 基于时空图神经网络的应用层DDoS攻击检测方法[J]. 信息网络安全, 2024, 24(4): 509-519.