# Time Series Anomaly Detection for KPIs Based on Correlation Analysis and HMM
## 3 Method
### 1D-CNN-TCN Time Series Prediction Model  
The Convolutional Neural Network (CNN) was first proposed by [PERSON] et al. [27] and is currently mainly used in the fields of image recognition and natural language processing. 1D CNN is suitable for time series with a one-dimensional structure and has characteristics of easy parallel, and does not induce gradient explosion or error accumulation. However, its ability to capture temporal dependency relations between time series data points is poor. After the continuous optimization and development of a CNN, the Time-Series Convolutional Neural Network (TCN) has appeared. The TCN mainly deals with time-series data, and uses dilated convolution [28] and residual connection [29] to increase the receptive field of a network and accelerate training speed. The general network structure of the TCN algorithm is shown in Figure 2. The TCN can make up for the 1D CNN's inability to capture temporal dependence, and also has other characteristics of the 1D CNN. The use of expanded convolution not only ensures that the network covers all effective information, but it also enables the deep network to obtain more effective information. The formula of expanded convolution is:  
\[F(s)=(x*_{d}f)(s)=\sum_{i=0}^{k-1}f(i)\cdot x_{s-d\cdot i} \tag{1}\]  
Figure 1: Method flow chart.  
Here, \(d\) represents expansion coefficient, and \(k\) represents convolution kernel size. When \(d\) is 1, the extended convolution degenerates into ordinary convolution. By controlling the size of \(d\), the receptive field is broadened without changing the amount of calculation.  
This paper combines 1D CNN with TCN. The first layer of the 1D-CNN-TCN model uses 1D CNN to perform convolution on local regions of the input data to obtain its local features. There are 128 convolution kernels in 1D CNN, and the convolution kernel size is 2. The ReLU activation function is used to realize nonlinear transformation such that the model is more convergent. After extracting local features with the 1D CNN, the data dimension will expand. Therefore, in the second layer, a MaxPooling layer is used to downsample the obtained feature sequence, so as to reduce the data dimension of the feature sequence. The pooling window size is 2. Based on the extracted local features, the third layer uses TCN to obtain temporal features, wherein the TCN has 64 convolution kernels, the convolution kernel size is 20, the activation function is LeakyReLU, and the dropout rate is 0.5. Finally, the final prediction time series is output through a full connection layer Dense. The specific network structure is shown in Figure 3. Compared with RNN and LSTM, 1D-CNN-TCN has a better prediction effect and calculation efficiency.  
The specific steps are as follows:  
Figure 3: 1D-CNN-TCN network structure.  
Figure 2: Basic TCN network structure.  
1. Firstly, time series data are processed in a sliding window, sliding one data point forward each time to predict the value of the next moment;
2. Preprocessed time series are input into the 1D CNN, and the convolution kernel performs the convolution operation on the local region of the input sequence with a certain step length to extract the local features of the time series. Then, the Relu activation function is used to realize the nonlinear transformation, which can make the model converge better and assume a sparse representation so as to prevent the gradient from disappearing;
3. After the convolution operation, the number of feature sequences extracted increases, resulting in the expansion of the data dimension and the increasing of the computational complexity. Through the pooling operation, the feature sequence is downsampled to reduce the dimension of the feature sequence data;
4. Based on local features extracted by the 1D CNN, TCN is used to further extract time features;
5. Finally, the time series predicted via the full connection layer Dense is output.