Industrial Internet of Things timestamp-level rapid anomaly detection method based on frequency domain spectrum difference

Abstract

The invention discloses an industrial Internet of Things timestamp-level rapid anomaly detection method based on frequency domain spectrum difference. A non-neural network scheme is adopted to execute fine-grained industrial sensor signal anomaly detection. Comprising the following steps: proposing an evaluation index which only takes frequency spectrum difference in a frequency domain as timestamp-level anomaly detection; point-level and sequence-level spectrum difference calculation modules are designed as two complementary branches to jointly generate the spectrum difference of each timestamp in a frequency domain; designing an exception scoring strategy to generate an exception score for each timestamp in combination with point-level and sequence-level spectrum differences; wherein the point-level spectrum difference calculation module is used for identifying dominant anomalies in the industrial time signals, and the sequence-level spectrum difference calculation module is used for identifying implicit anomalies in the industrial time signals. According to the industrial Internet of Things timestamp-level rapid anomaly detection method based on the frequency domain spectrum difference, high-speed and high-precision anomaly detection can be realized on industrial Internet of Things edge equipment with limited resources.

Description

Technical Field

[0001] The present invention relates to the technical field of anomaly detection of industrial sensor time signals (time series), and in particular to a timestamp-level rapid anomaly detection method for the industrial Internet of Things based on frequency domain spectrum differences. Background Art

[0002] In the Industrial Internet of Things (IIoT), underlying industrial production equipment is often equipped with numerous sensors to enable intelligent sensing and remote control. Driven by the IIoT, traditional production processes are gradually transforming into automated and intelligent production. In this scenario, the various underlying production devices are not only interconnected but also able to communicate with external networks. Consequently, production equipment or processes, once relatively secure due to isolation, are inevitably vulnerable to attacks from external networks, causing them to deviate from normal operation and generate anomalies. If these anomalies can be detected early, even in their infancy, timely warnings can be issued and proactive defense measures can be implemented, thereby ensuring the security and stability of production equipment and business processes. Otherwise, these anomalies can cause damage to production equipment, interruption of production processes, and even casualties and significant financial losses. Therefore, anomaly detection, particularly fine-grained timestamp-level anomaly detection, is crucial for the IIoT.

[0003] In the era of Industry 4.0, industrial production processes are experiencing increasingly complex and dynamic operational modes, requiring more sophisticated intelligent sensing and remote control. To meet this demand, the Industrial Internet requires the deployment of more intelligent sensors and more intensive data collection. This results in new characteristics in sensor signal data from multiple sensors within the Industrial Internet of Things (IIoT): more complex features, more variables, larger data volumes, and scarcer labels. At the same time, IIoT anomaly detection is facing new demands: high accuracy, high speed, and low resource consumption. These new detection requirements and data characteristics pose new challenges to existing anomaly detection models.

[0004] Challenge 1: High precision and high speed are difficult to achieve at the same time. Existing timestamp-level anomaly detection models are mainly divided into two categories: deep models based on neural networks and shallow models based on non-neural networks.

[0005] Deep models are currently a hot topic and a mainstream research direction. Most of these models focus solely on high accuracy, using deep neural networks with large parameters. This often results in long training and testing times. When faced with large amounts of sensor signals, these models can take hours or even days to process. In contrast, lightweight models based on non-neural networks are typically much faster. They typically rely on statistical features and similarity distances to identify anomalies. However, due to their limited feature capture capabilities, their accuracy is often low when faced with complex data. Consequently, current Industrial IoT timestamp-level anomaly detection models struggle to achieve both high accuracy and high speed, making them uncompetitive in the context of Industry 4.0.

[0006] Challenge 2: Limited resources in the Industrial Internet of Things are rarely considered. The previous Industrial Internet of Things anomaly detection process included the following steps:

[0007] First, deploy the anomaly detection model on a cloud server with powerful resources; second, upload all sensor signal data collected by the industrial IoT edge device to the cloud; finally, generate the detection results in the cloud and return them to the edge device.

[0008] Due to the powerful computing and storage capabilities of cloud servers, traditional anomaly detection models rarely consider resource constraints. However, in the era of Industry 4.0, massive sensor signals, intensive resource scheduling, and frequent computational tasks pose challenges for cloud-based anomaly detection, such as high latency and high costs. Furthermore, existing models favor the construction of deep neural networks with large parameters to achieve high-precision anomaly detection, further increasing the computational load and processing time for cloud-based anomaly detection. To improve the timeliness of anomaly detection, a straightforward approach is to deploy anomaly detection models on edge devices rather than in the cloud. However, edge devices in the Industrial Internet of Things often have very limited resources. For example, the STM32 microcontroller, based on a microprocessor (MCU), has less than 1MB of SRAM and a clock frequency of less than 168MHz. Even the high-performance Raspberry Pi 4b has only 2GB of RAM and a clock frequency of 1.5GHz. These limited resources are often insufficient to support the smooth and stable operation of anomaly detection models based on deep neural networks, or even to guarantee their operation.

[0009] To address these challenges, existing solutions can be mainly divided into two categories.

[0010] The first category uses acceleration technologies such as model compression, parallel computing, and federated learning to improve the speed of existing deep anomaly detection models, thereby achieving both high speed and high accuracy. For example, the FATRAF model uses a federated learning mechanism for distributed anomaly detection. De et al. utilize lightweight echo state networks to replace computationally intensive components. In this type of model, deep neural networks provide high accuracy, while acceleration technologies ensure high speed. While these models achieve high speed and high accuracy, they still retain deep structures and a large number of parameters. This means that they still require significant computing and storage resources, and can only be deployed in the cloud, making them difficult to apply directly to resource-limited edge devices.

[0011] The second category integrates multiple non-neural network technologies, or combines them with shallow neural networks to build high-speed, high-precision hybrid anomaly detection models. For example, Li et al. combined fuzzy C-means and particle swarm optimization (PSO) to improve anomaly detection accuracy. Similarly, Shanmuganath et al. incorporated Markov learning into LSTM networks to improve model accuracy. In this type of model, non-neural network methods provide high speed, while the fusion of multiple technologies provides high accuracy. Although these methods can be directly deployed on resource-limited edge devices, their representational capabilities are often weak. When faced with industrial physical network sensor signal datasets with complex features, their accuracy is often low.

[0012] In summary, both solutions have their own advantages and disadvantages. However, they cannot fully meet the requirements of high speed, high accuracy and low resource consumption for anomaly detection in Industry 4.0. Summary of the Invention

[0013] In response to the above-mentioned technical problems to be solved, the present invention provides an industrial Internet of Things timestamp-level rapid anomaly detection method based on frequency domain spectrum differences, which can quickly and accurately identify abnormal events of multi-sensor signals in the industrial Internet of Things on edge devices with limited resources.

[0014] In order to solve the above technical problems, the technical solution proposed by the present invention is:

[0015] A fast timestamp-level anomaly detection method for the Industrial Internet of Things (IIoT) based on frequency domain spectrum differences is characterized by using a non-neural network scheme to perform fine-grained anomaly detection on multi-sensor signals of the Industrial Internet only in the frequency domain. The method includes the following contents:

[0016] The algorithm uses only the spectrum difference in the frequency domain as the evaluation metric for timestamp-level anomaly detection. It designs point-level and sequence-level spectrum difference calculation modules as two complementary branches to jointly generate the spectrum difference in the frequency domain for each timestamp. It also designs an anomaly scoring strategy that combines the point-level and sequence-level spectrum differences to generate an anomaly score for each timestamp, thereby determining whether the timestamp is an anomaly.

[0017] The point-level spectrum difference calculation module is used to identify explicit anomalies in industrial time signals, and the sequence-level spectrum difference calculation module is used to identify implicit anomalies in time signals.

[0018] As a further improvement of the above technical solution:

[0019] Preferably, the anomaly detection method comprises the following steps:

[0020] Step S1: Using a point-level spectrum difference calculation module to identify dominant anomalies in multi-sensor time signals using frequency domain features; calculating the difference in frequency domain features between each timestamp with and without the timestamp within a fixed-length domain, and using this difference as the substitutability of the timestamp in the frequency domain; identifying dominant timestamp anomalies based on the substitutability;

[0021] Step S2: Using a sequence-level spectrum difference calculation module to identify hidden anomalies in multi-sensor time signals; using several adjacent timestamps around each timestamp as its surrogate subsequences; calculating the change in frequency domain characteristics of each timestamp within a fixed-length region with and without its surrogate sequence; using the difference in spectral feature changes of the surrogate subsequences as the substitutability of the timestamp; and identifying hidden timestamp anomalies based on the substitutability;

[0022] In step S3, the point-level and sequence-level spectrum differences are fused with different weights to generate an anomaly score for each timestamp; whether each timestamp is an anomaly point is determined by formula (2):

[0023]

[0024] Among them, Score t represents the final anomaly score at the t-th timestamp, λ is the preset threshold, ranging from 0 to 1; represents the predicted label of the t-th timestamp; if Then the tth timestamp is judged to be abnormal; otherwise, it is judged to be normal.

[0025] Preferably, step S1 and step S2 are two independent complementary branches, and the learning processes of the two branches are executed in parallel with complementary interference.

[0026] Preferably, the step S1 specifically includes the following:

[0027] S1-1, point-level sampling: Generate a neighborhood sequence of length L for each timestamp and another replacement sequence of length L that does not contain the timestamp; in an industrial multi-sensor time signal with M variables and T timestamps The generation process of the domain sequence and replacement sequence of the t-th timestamp on the m-th variable is:

[0028] First, generate the neighborhood sequence: from the mth variable Extract the timestamps between (tL / 2) and (t+L / 2) to form a neighborhood sequence

[0029] Next, generate the replacement sequence: calculate P t m The average value Avg of all timestamps except the t-th timestamp in , replace P with Avg t m The value of the t-th timestamp in generates a replacement sequence

[0030] Finally, the spectrum difference between the domain sequence of length L and the replacement sequence is calculated in the frequency domain to evaluate the substitutability of timestamp t in the frequency domain;

[0031] S1-2, spectrum difference calculation: The spectrum difference calculation process of the t-th timestamp on the m-th variable in the frequency domain is:

[0032] First, the fast Fourier transform function is used to transform two neighborhood sequences P of length L into t m and They are transformed into L / 2 frequency components respectively, as shown below:

[0033]

[0034] in, FFT() stands for Fast Fourier Function, FP t m Represents the frequency component of the domain sequence in the frequency domain, Represents the frequency components of the replacement sequence in the frequency domain;

[0035] Secondly, calculate FP separately t m and The amplitude in the frequency domain is expressed as P t m and The frequency domain characteristics are:

[0036]

[0037] in, abs(·) represents the amplitude calculation function, AP t m represents the amplitude value of the field sequence, represents the amplitude value of the replacement sequence;

[0038] Finally, the mean square error function is used to measure the amplitude difference of the t-th timestamp in the frequency domain, which is:

[0039]

[0040] in, DP t m It represents the point-level spectrum difference at the t-th timestamp, and MSE() is the mean square error function.

[0041] Preferably, the step S2 specifically includes the following:

[0042] S2-1, sequence-level sampling: Generate a surrogate subsequence of length LG for each timestamp, then generate a neighborhood sequence of length LS for the surrogate subsequence and another replacement sequence of length LS that does not contain the surrogate subsequence; in an industrial multi-sensor time signal with M variables and T timestamps The sampling process of the t-th timestamp on the m-th variable is as follows:

[0043] First, extract neighbors: from the mth variable Extract the timestamps in the range of (t-LS / 2) to (t+LS / 2) as the initial domain sequence

[0044] Then, group: All data in are divided into G groups in sequence, each group contains LG timestamps, LS = G × LG;

[0045] Secondly, generate a substitute subsequence: consider the group where timestamp t is located as its substitute subsequence;

[0046] Next, generate a domain sequence for the substitute subsequence: consider the entire initial domain sequence as the neighborhood sequence of the substitute subsequence

[0047] Again, generate a replacement sequence for the substitute subsequence: replace the value of each timestamp in the substitute subsequence with the average value of the corresponding position in other groups to generate a replacement sequence for the substitute subsequence

[0048] Finally, the spectrum difference between the domain sequence of length LS and the replacement sequence is calculated in the frequency domain, and the sequence-level replaceability of timestamp t in the frequency domain is measured;

[0049] S2-2, spectrum difference calculation: The sequence-level spectrum difference calculation process of the t-th timestamp on the m-th variable is:

[0050] First, the two domain sequences are transformed using the Fast Fourier Transform function FFT() and Transformed into LS / 2 frequency components:

[0051]

[0052] in, represents the frequency component of the domain sequence in the frequency domain, Represents the frequency components of the replacement sequence in the frequency domain;

[0053] Secondly, in the frequency domain, we calculate and The amplitude is:

[0054]

[0055] in, abs(·) represents the amplitude calculation function, represents the amplitude of the field sequence in the frequency domain, represents the amplitude of the replacement sequence in the frequency domain;

[0056] Finally, the mean square error function is used to measure the sequence-level spectrum difference of each timestamp:

[0057]

[0058] in, is the sequence-level spectrum difference at the t-th timestamp.

[0059] Preferably, in step S1 or step S2, the spectrum difference calculation process adopts a variable-independent learning mode; the sampling process or spectrum difference calculation process on each variable is independent and does not interfere with each other, and is executed in parallel to enhance the timeliness of the algorithm.

[0060] Preferably, step S3 includes the following:

[0061] First, we have a timestamp in the sensor signal to be detected with M variables It will be input into the point-level and sequence-level spectrum difference calculation modules to perform variable-independent difference calculations.

[0062] Then, on a variable m∈(1,…,M), two frequency domain differences are generated for timestamp t: point-level spectrum differences and sequence-level spectral differences And as the point-level anomaly score and sequence-level anomaly score of the t-th timestamp on the variable m;

[0063] Next, calculate the point-level and sequence-level average anomaly scores of the M variables respectively:

[0064]

[0065] Finally, the final anomaly score for the t-th timestamp is generated:

[0066] Score t =α×DP(x t )+(1-α)×DS(x t ) (9)

[0067] Among them, α is a preset parameter ranging from [0 to 1]. When α is 0, only the sequence-level anomaly score is considered; when α is 1, only the point-level anomaly score is considered.

[0068] After obtaining the final anomaly score, use formula (2) to determine whether the tth timestamp is an anomaly point.

[0069] The industrial Internet of Things timestamp-level rapid anomaly detection method based on frequency domain spectrum differences provided by the present invention has the following advantages over the existing technology:

[0070] (1) The industrial Internet of Things timestamp-level fast anomaly detection method based on frequency domain spectrum difference of the present invention introduces spectrum difference to measure the characteristics of each timestamp in the frequency domain, breaking the traditional dilemma of being unable to extract the characteristics of each timestamp in the frequency domain. It provides a solution for performing timestamp-level anomaly detection in the frequency domain and also provides a reference idea for other tasks in the field of time signal analysis and processing to perform fine-grained analysis in the frequency domain.

[0071] (2) This invention's fast timestamp-level anomaly detection method for the Industrial Internet of Things (IIoT) based on frequency-domain spectral differences constructs a non-neural network detection solution consisting of a "point-level spectral difference calculation module + a sequence-level spectral difference calculation module + a joint point-level and sequence-level scoring strategy." This method utilizes spectral differences solely in the frequency domain to achieve high-speed, high-precision, and low-resource timestamp-level anomaly detection. This is the first work in the field of anomaly detection to perform timestamp-level anomaly detection solely using frequency-domain features.

[0072] (3) The industrial Internet of Things timestamp-level rapid anomaly detection method based on frequency domain spectrum differences of the present invention can be deployed online in real time on resource-limited edge devices, rather than the traditional cloud-based offline deployment mode that requires training before deployment, which greatly simplifies the deployment difficulty and maintenance cost of anomaly detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0073] Figure 1 Schematic diagram of spectrum differences in the frequency domain in the present invention.

[0074] Figure 2 It is a framework diagram of anomaly detection in the present invention.

[0075] Figure 3It is the point-level and sequence-level sampling diagram in the present invention.

[0076] Figure 4 This is the deployment result on the resource-limited edge device Raspberry Pi 4b in the experimental verification of this invention.

[0077] Figure 5 This is the deployment result on the resource-limited edge device STM32 in the experimental verification of the present invention. DETAILED DESCRIPTION

[0078] The following is a detailed description of the specific embodiments of the present invention. It should be understood that the specific embodiments described herein are only used to illustrate and explain the present invention and are not intended to limit the present invention.

[0079] The timestamp-level fast anomaly detection method for industrial Internet of Things based on frequency domain spectrum difference of the present invention is a timestamp-level fast anomaly detection method based on non-neural network (FADSD for short). Unlike the existing traditional methods based on deep neural networks, FADSD only uses the non-neural network method of spectrum difference in the frequency domain to achieve high-precision, high-speed and low-resource consumption fine-grained industrial Internet anomaly detection. First, the concept of spectrum difference is introduced to break the previous dilemma of not being able to perform timestamp-level feature extraction and anomaly detection in the frequency domain; secondly, a novel point-level and sequence-level difference calculation module is designed as two complementary branches to jointly generate the spectrum difference of each timestamp in the frequency domain; finally, a personalized anomaly scoring strategy is designed to combine point-level and sequence-level spectrum differences, and finally achieve accurate timestamp-level fine-grained anomaly detection, and perform timestamp-level anomaly detection only using the frequency domain.

[0080] The anomaly detection method of the present invention has the following two difficulties:

[0081] The first difficulty is which non-neural network technology should be selected for the anomaly detection model.

[0082] Compared with deep neural networks, simple and lightweight non-neural network technologies can improve processing speed and reduce resource consumption, but their representation capabilities are limited. However, the goal of the present invention is to develop a lightweight anomaly detection model that is both high-speed and high-precision. This forces the present invention to select a non-neural network technology with stronger representation capabilities. The complex features of multi-sensor time signals are difficult to extract in the time domain, but are simple and easy in the frequency domain. Therefore, frequency domain analysis is an ideal non-neural network technology that provides both powerful representation capabilities and fast processing speeds. Specifically, the present invention selects fast Fourier transform (FFT) as a feature extractor and performs timestamp-level anomaly detection directly in the frequency domain rather than the time domain.

[0083] The second difficulty is how to perform timestamp-level anomaly detection in the frequency domain.

[0084] To date, no research has been conducted to directly perform timestamp-level anomaly detection in the frequency domain. The main reason for this dilemma is the difficulty of directly measuring the characteristics of each timestamp in the frequency domain. Generally, the time domain and frequency domain are two complementary perspectives for analyzing time signals, and there is no direct one-to-one correspondence between them. For example, a time series of L timestamps in the time domain is decomposed into L / 2 frequency components in the frequency domain through FFT transformation. In this case, the characteristics of each timestamp in the time domain are dispersed across the L / 2 frequency components, making it impossible to determine which information in each frequency component is characteristic of which timestamp. If the characteristics of a timestamp cannot be measured, it is impossible to assign an anomaly score to the timestamp, and it is impossible to ultimately determine whether a timestamp is an anomaly.

[0085] In order to solve this difficulty, two things must be done. First, an indicator must be defined or a mechanism must be designed to measure the characteristics or information of the timestamp in the frequency domain. To this end, the present invention introduces spectrum difference to measure the characteristics of a timestamp in the frequency domain. Specifically, in a fixed-length time series, when there is or is not a timestamp, the spectrum (amplitude) difference is regarded as the characteristic of the timestamp in the frequency domain, such as Figure 1 (a) shows two contrasting branches of the two sequences with and without red-marked timestamps. The spectral difference between the two sequences is considered a characteristic of the red-marked timestamps. Secondly, it is necessary to verify whether this measurement metric or mechanism can effectively distinguish abnormal timestamps from normal timestamps. To test this, we selected a time series of length 20 containing at least one abnormal timestamp from two real datasets, Yahoo and SMTP. Figure 1 (b) and (c) plot the amplitude differences between normal and abnormal timestamps in the two datasets, respectively. It is easy to see that the spectrum difference can effectively distinguish abnormal and normal timestamps.

[0086] In summary, the present invention utilizes the spectrum difference of each timestamp in the frequency domain to perform timestamp-level fine-grained anomaly detection from both point-level and sequence-level perspectives.

[0087] The time signal of multi-sensor of industrial IoT can be expressed as Where T represents the number of timestamps and M represents the number of variables. Specifically, a multi-sensor time signal consists of both the time dimension and the variable dimension. In the time dimension, the multi-sensor time signal can be expressed as where x t Represents the value of M variables at the t-th timestamp. In the variable (space) dimension, the multi-sensor time signal can be expressed as where x mIndicates the value of the mth variable at T timestamps.

[0088] The industrial Internet of Things timestamp-level fast anomaly detection method based on frequency domain spectrum difference of the present invention first needs to generate an anomaly score for each timestamp in X (such as the t-th timestamp):

[0089] Score t =FADSD(x t ) (1)

[0090] Wherein, FADSD() represents the anomaly detection method of the present invention, x t Indicates the M variable values ​​at the tth timestamp, Score t represents the anomaly score at the t-th timestamp.

[0091] Secondly, based on the generated anomaly score, we can determine whether this timestamp is abnormal:

[0092]

[0093] Here, λ is a preset threshold, ranging from 0 to 1. represents the predicted label of the t-th timestamp. If Then the tth timestamp is judged to be abnormal; otherwise, it is judged to be normal.

[0094] The method for rapid anomaly detection at the timestamp level of the industrial Internet of Things based on frequency domain spectrum differences of the present invention specifically comprises the following steps:

[0095] Step S1, point-level spectrum difference calculation

[0096] like Figure 2 As shown in (a) of the figure, this step designs a personalized point-level sampling strategy and works in conjunction with the fast Fourier transform (FFT) to calculate point-level spectral (amplitude) differences in the frequency domain. This is used to accurately identify significant anomalies in multi-sensor signals in the Industrial Internet of Things. It is important to note that the calculation of point-level spectral differences uses a variable-independent execution mode, meaning that the calculation of all variables is independent of each other and can be executed in parallel.

[0097] Anomalies in multi-sensor time signals in the Industrial Internet of Things (IIoT) typically persist across multiple timestamps and can be categorized into two main types: explicit anomalies and implicit anomalies. Fine-grained timestamp-level anomaly detection can provide early warnings, ensuring the security and stability of IIoT systems. To this end, this embodiment designs a point-level spectrum difference calculation module to accurately identify explicit anomalies.

[0098] In a significant anomaly, the value of each timestamp is significantly different from the normal timestamp. Figure 3(a) in the figure shows a dominant anomaly ranging from 1600 to 1700 in sensor (variable) No. 136 of the real-world UCR dataset. In the figure, x1 represents the abnormal timestamp and y1 represents the normal timestamp. As can be seen from the figure, when these two timestamps are compared in a neighborhood sequence of the same length (x1 is the purple area and y1 is the green area), x1 is significantly different from its neighbors, while y1 is relatively smooth with its neighbors. This means that x1 is not similar to its neighbors, while y1 is more similar to its neighbors. Therefore, the similarity between a timestamp and its neighbors in the frequency domain can be used to identify dominant anomalies. To calculate the similarity, this embodiment needs to obtain the features of each timestamp in the frequency domain.

[0099] To solve this problem, the frequency domain characteristics of each timestamp are measured to evaluate the substitutability of each timestamp in the frequency domain. If a timestamp is not substitutable in its neighborhood sequence, it is not similar to its neighbors in the neighborhood. On the contrary, it is similar to its neighbors in the neighborhood. Based on this idea, this embodiment introduces spectrum differences to quantify the substitutability of each timestamp in its neighborhood sequence. The specific idea is to observe the amplitude difference of the sequence when a specific timestamp is present or absent in a fixed-length neighborhood sequence, such as Figure 1 In summary, this embodiment designs a novel point-level spectrum difference calculation component to identify dominant anomalies in multi-sensor signals using frequency domain features.

[0100] Specifically include the following:

[0101] S1-1, point-level sampling: In order to calculate the spectrum difference, this embodiment designs a variable-independent point-level sampling strategy, the goal of which is to generate a neighborhood sequence and another replacement sequence that does not contain the timestamp for each timestamp, such as Figure 3 As shown in (c) in the figure, a time series of L timestamps in the time domain is decomposed into L / 2 frequency components in the frequency domain through FFT transformation. Taking the t-th timestamp of the m-th variable as an example, the generation process of these two sequences is as follows:

[0102] First, generate the neighborhood sequence: from the mth variable Extract the timestamps between (tL / 2) and (t+L / 2) to form a neighborhood sequence L is the length of the domain sequence, that is, the number of timestamps contained in the sequence.

[0103] Next, generate the replacement sequence: calculate P t m The average value Avg of all timestamps except the t-th timestamp in , replace P with Avg t m The value of the t-th timestamp in generates a replacement sequence

[0104] Finally, the spectrum difference between the domain sequence and the replacement sequence of length L is calculated in the frequency domain and used to evaluate the substitutability of timestamp t in the frequency domain.

[0105] Furthermore, the sampling process of the M variables and all timestamps within each variable can be executed in parallel.

[0106] S1-2, spectrum difference calculation: When two adjacent sequences are generated, the spectrum difference calculation of each timestamp becomes simple.

[0107] Taking the t-th timestamp of the m-th variable as an example, the spectrum difference calculation process in the frequency domain is as follows:

[0108] First, two neighborhood sequences P of length L are transformed by Fast Fourier Transform (FFT) t m and They are transformed into L / 2 frequency components respectively, as shown below:

[0109]

[0110] in, FFT() stands for Fast Fourier Function, FP t m Represents the frequency component of the domain sequence in the frequency domain, Represents the frequency components of the replacement sequence in the frequency domain.

[0111] Secondly, calculate FP separately t m and The amplitude in the frequency domain is expressed as P t m and The frequency domain characteristics are as follows:

[0112]

[0113] in, abs(·) represents the amplitude calculation function, AP t m represents the amplitude value of the field sequence, Indicates the amplitude value of the replacement sequence.

[0114] Finally, the mean square error (MSE) function is used to measure the amplitude difference of the t-th timestamp in the frequency domain, which is defined as follows:

[0115]

[0116] in, DP t mIt represents the point-level spectrum difference at the t-th timestamp.

[0117] Furthermore, the calculation of the difference in amplitude for each time stamp in the M variables can also be performed in parallel to increase the speed.

[0118] Step S2, sequence-level spectrum difference calculation

[0119] like Figure 2 As shown in (b), this step complements step S1 by designing a sequence-level sampling strategy. This strategy, combined with the Fast Fourier Transform (FFT), calculates sequence-level amplitude differences in the frequency domain, enabling accurate identification of hidden anomalies in multi-sensor signals in the Industrial Internet of Things. It's important to note that the calculation of sequence-level spectral differences also uses a variable-independent execution mode, meaning all variables are calculated independently and can be executed in parallel.

[0120] Unlike explicit anomalies, implicit anomalies exhibit more complex characteristic patterns. In such anomalies, the similarity associations between some timestamps and their neighbors are significantly different from those of normal timestamps, while the similarity associations between other timestamps and their neighbors are very similar to those of normal timestamps. For example, Figure 3 (b) shows a hidden anomaly between 8580 and 8640 in the Sed dataset, a real-world single-sensor signal (univariate). In the figure, x2 is the anomaly timestamp and y2 is the normal timestamp. It is not difficult to see that x2 and y2 have the same value, and their local neighborhood sequences are also very similar. In this case, the correlation between x2 and y2 and their neighbors is also very similar. In the frequency domain, their substitutability in their respective local neighborhood sequences is also very similar. This makes it impossible to identify anomaly timestamps like x2 using point-level spectral difference schemes.

[0121] To solve this problem, the most direct approach is to make x2 and y2 significantly distinguishable in their respective neighborhood sequences. To this end, this embodiment attempts to extract multiple timestamps around each timestamp, generate a shorter sub-training, and use it to replace the current timestamp as a substitute subsequence. When observing its neighborhood in units of substitute subsequences, it is not difficult to find that there are obvious differences between the two substitute subsequences corresponding to two timestamps that were originally similar at the point level. For example, in Figure 3 In (b), this embodiment uses a dark red subsequence as a stand-in for x2 and a dark green subsequence as a stand-in for y2. In this case, the interchangeability of the stand-in subsequences for x2 and y2 within their respective sequence-level neighborhood sequences (the long purple and long green regions) becomes significantly different. In this way, this embodiment can utilize frequency domain differences to address the issue of inaccurate latent anomaly identification. Based on this idea, this embodiment designs a sequence-level spectrum difference calculation module to accurately identify latent anomalies.

[0122] Specifically include the following:

[0123] S2-1, sequence-level sampling: Similar to point-level sampling, this embodiment designs a variable-independent sequence-level sampling strategy, the goal of which is to generate a substitute subsequence for each timestamp, and based on this, generate a neighborhood sequence for the substitute subsequence and another replacement sequence that does not contain the substitute subsequence, such as Figure 3 As shown in (d). Taking the t-th timestamp of the m-th variable as an example, the detailed sampling process is as follows:

[0124] First, extract neighbors: from the mth variable Extract the timestamps in the range of (t-LS / 2) to (t+LS / 2) as the initial domain sequence LS represents the sequence length, which is the number of timestamps in the sequence.

[0125] Then, group: All data in are divided into G groups in chronological order, each group contains LG timestamps, LS = G × LG.

[0126] Secondly, generate a substitute subsequence: regard the group where the timestamp t is located as its substitute subsequence, and the length of the subsequence is LG.

[0127] Next, generate a neighborhood sequence for the surrogate subsequence: consider the entire initial neighbor sequence as the neighborhood sequence of the surrogate subsequence

[0128] Again, generate a replacement sequence for the substitute subsequence: replace the value of each timestamp in the substitute subsequence with the average value of the corresponding position in other groups to generate a replacement sequence for the substitute

[0129] Finally, the spectrum difference between the domain sequence of length LS and the replacement sequence is calculated in the frequency domain, and the sequence-level replaceability of timestamp t in the frequency domain is measured.

[0130] S2-2, Spectral Difference Calculation: Similar to the point-level spectral difference calculation, the sequence-level spectral difference calculation process is also very simple. Taking the t-th timestamp of the m-th variable as an example, the calculation process is as follows:

[0131] First, the two domain sequences are transformed using the Fast Fourier Transform function FFT and (Each sequence length is LS) is transformed into LS / 2 frequency components:

[0132]

[0133] in, FFT() stands for Fast Fourier Function, FSt m represents the frequency component of the domain sequence in the frequency domain, Represents the frequency components of the replacement sequence in the frequency domain.

[0134] Secondly, in the frequency domain, we calculate and The amplitude of is defined as follows:

[0135]

[0136] in, abs(·) represents the amplitude calculation function, represents the amplitude of the field sequence in the frequency domain, Represents the amplitude of the replacement sequence in the frequency domain.

[0137] Finally, the mean square error (MSE) function is used to measure the sequence-level spectrum difference of each timestamp as follows:

[0138]

[0139] in, is the sequence-level spectrum difference at the t-th timestamp.

[0140] Step S3: Abnormal scoring based on spectrum differences

[0141] In this embodiment, a personalized scoring strategy based on spectrum difference is proposed, which combines the point-level and sequence-level spectrum differences to generate an anomaly score for each timestamp in the industrial multi-sensor signal. The scoring process of the t-th timestamp is as follows: Figure 2 As shown in (c).

[0142] First, the tth timestamp At the same time, it is input into the point-level and sequence-level spectrum difference calculation modules. Then, in each module, M variables are calculated in parallel. Secondly, after the calculation is completed, each variable m∈(1,…,M) will generate point-level and sequence-level spectrum differences and And as the point-level and sequence-level anomaly scores of the t-th timestamp on its variable. Then, calculate the point-level and sequence-level average anomaly scores of M variables respectively:

[0143]

[0144] Finally, the final score of the t-th timestamp is generated by the following formula:

[0145] Score t =α×DP(x t )+(1-α)×DS(x t) (9)

[0146] Where α is a preset parameter ranging from 0 to 1. When α is 0, only the sequence-level anomaly score is considered. When α is 1, only the point-level anomaly score is considered. After obtaining the anomaly score, formula (2) is used to determine whether the tth timestamp is an anomaly point.

[0147] Experimental verification

[0148] (1) Experimental dataset

[0149] This verification selected eight publicly available real-world sensor time signals from diverse IIoT environments as experimental datasets. These datasets include two univariate and six multivariate datasets, as shown in Table 1. MSL, GECCO, Genesis, HAI, SKAB, and SWaT are multivariate IIoT time signals, while Dodgers and UCR are univariate IIoT time signals. These datasets cover various industrial sectors, including aviation, water treatment, mechanical manufacturing, and transportation, to ensure fair evaluation.

[0150] Table 1 Eight public datasets

[0151] Dataset Number of features training set Test set MSL 55 58317 73729 GECCO 9 69260 69261 Genesis 18 16220 16220 HAI 86 132480 87840 SKAB 8 135183 427617 SWAT 51 494999 449918 Dodgers 1 182319 45580 UCR 1 2300 5200

[0152] Specifically: The MSL dataset captures the operating status of multiple sensors or controllers on the Mars rover. The GECCO dataset stores drinking water quality data from multiple IoT sensors. The Genesis dataset records five continuous signals and thirteen discrete signals from multiple sensors in the Industrial IoT. The SWAT dataset consists of 51-dimensional data collected by sensors in public water treatment infrastructure. The HAI dataset contains multiple industrial signals from pumps, valves, pressure sensors, and other common industrial equipment. The Dodgers dataset consists of traffic flow data collected by induction loop sensors on roads near the Los Angeles Dodger Stadium. The UCR dataset is a publicly available Industrial IoT dataset that contains only one signal and one anomaly.

[0153] (2) Comparison methods and evaluation indicators

[0154] 1) Comparison method

[0155] In order to verify the effectiveness of the FADSD method of the present invention, nine representative state-of-the-art (SOTA) methods were selected as competitors, as listed in Table 2. In terms of network structure: DCdetector, ATF-UAD, FC-VAC, DTAAD and DIF are anomaly detection methods based on deep neural networks, with multi-layer structures and large parameters. In contrast, IForest, PCA, Optiforst, LODA and FADSD are shallow anomaly detection methods based on non-neural networks. In time and frequency domains: DIF, Optiforest, DCdetector, LODA, PCA, IFoest and DTAAD only perform anomaly detection in the time domain. FCVAE and ATF-UAD perform anomaly detection in the time domain and frequency domain, while the FADSD of the present invention only uses the frequency domain to perform anomaly detection.

[0156] Table 2 Comparison methods

[0157]

[0158] 2) Evaluation Metrics

[0159] To perform a comprehensive and comprehensive evaluation, four widely recognized metrics were used: Accuracy (ACC), Precision, Recall, and F1-Score. Accuracy (ACC) represents the ratio of correctly predicted samples to the total number of samples. Precision represents the proportion of correctly predicted normal timestamps among all predicted normal timestamps. Recall reflects the proportion of actual normal timestamps that were correctly identified. The F1-Score combines Recall and Precision to provide a more balanced evaluation. Generally speaking, these evaluation metrics range from 0 to 1, with higher values ​​indicating better anomaly detection accuracy.

[0160] (3) Accuracy experiment

[0161] Ten methods were compared across eight Industrial IoT datasets, and their accuracy is presented in Table 3. In the table, the best performance is highlighted in bold, while the second-best performance is underlined. Several observations can be made from the table: 1) Overall Performance: FADSD performed best, followed by DCdetector, FCVAE, ATF-UAD, DIF, and DTAAD, while Optiforest, LODA, IForest, and PCA performed worst. For example, on the SWAT dataset, FADSD achieved an ACC of 0.9924 and an F1 of 0.9688, while PCA achieved an ACC of only 0.5761 and an F1 of 0.5852.

[0162] 2) Stability: FADSD showed the most stable performance in all four evaluation metrics, followed by DC detector, DIF, and FCVAE. For example, on the HAI and SKAB datasets, FADSD achieved three first-place and one second-place stable results.

[0163] 3) Joint Time-Frequency Domain: The FADSD method outperforms other methods based on joint time-frequency domain learning (FC-VAE and ATF-UAD). For example, on the MSL dataset, FADSD achieves an ACC of 0.9926 and an F1 of 0.9378, while FCVAE achieves an ACC of 0.9632 and an F1 of 0.8440, and ATF-UAD achieves an ACC of 0.9223 and an F1 of 0.7789.

[0164] 4) Deep vs. Shallow Architectures: Deep neural network-based methods (DIF, DCdetector, FCVAE, ATF-UAD, DTAAD) generally outperform shallow methods (IForest, PCA, Optiforest, LODA). However, our shallow FADSD method surpasses several deep methods. For example, on the SWAT dataset, FADSD achieves an F1 score of 0.9688, surpassing DCdetector's 0.9649, FCVAE's 0.9459, IForest's 0.4182, and LODA's 0.7469.

[0165] 5) Conclusion: The non-neural network-based FADSD demonstrates comparable performance to deep methods and even surpasses them in some datasets. This result further demonstrates the effectiveness of the proposed frequency domain analysis for sensor signal anomaly detection.

[0166] Table 3 Performance analysis of eight industrial physical network datasets

[0167]

[0168]

[0169] (4) Deployability Experiment

[0170] Ten methods are deployed experimentally on two IIoT edge devices with different resources.

[0171] 1) Thick Edge Device: Raspberry Pi 4b. A Raspberry Pi 4b equipped with a 1.5GHz ARM Cortex-A72 processor and 2GB of RAM was selected as the first edge device. In this experiment, two shallow methods (PCA and FADSD) used an online deployment scheme, performing real-time anomaly detection without training. The other three shallow machine learning-based methods (IForest, LODA, and Optiforest) and five deep methods (DIF, DCdetector, FCVAE, ATF-UAD, and DTAAD) all used an offline deployment scheme. These models were first trained in the cloud and then deployed to the edge device.

[0172] Figure 4 The figure shows the results of deployment on a Raspberry Pi 4b. Two results are shown in the figure: deployability and convenience.

[0173] Deployability: All ten methods can be successfully deployed. In comparison, the shallow method has a simpler and easier deployment process.

[0174] Convenience: In an IIoT environment, production processes frequently change, leading to dynamic fluctuations in time signals. Shallow methods deployed online can be used directly to address these dynamic IIoT time signals. In contrast, deep methods deployed offline must be fine-tuned in the cloud and redeployed at the edge before they can be reused. Furthermore, shallow methods are generally faster and require fewer resources.

[0175] 2) Thin edge device: STM32. We chose the STM32F407 with a 160MHz ARM Cortex-M4 processor and 1MB RAM as the second edge device. Due to the 1MB RAM limitation, many deep methods cannot be deployed. The deployment results on the STM32 are shown in Figure 2. Figure 5 As shown in the figure, we can see that:

[0176] Deployability: Only five shallow non-neural network-based methods were successfully deployed, as deep neural network-based methods required more than 1MB of RAM.

[0177] Convenience: Compared with other shallow methods, the FADSD method is easier to deploy and has similar speed and resource consumption.

[0178] 3) Summary: Compared with methods based on deep neural networks, anomaly detection methods based on shallow non-neural networks are easier to deploy on resource-limited industrial IoT edge devices and are more suitable for the anomaly detection needs of Industry 4.0.

[0179] (5) Timeliness and resource consumption experiments

[0180] This experiment further compared the timeliness and resource consumption of ten methods in three deployment environments: a powerful PC, a moderately resourced Raspberry Pi 4b, and a resource-limited STM32 F407. In the PC environment, model parameters, one-epoch processing time for the same batch size, CPU and GPU usage, RAM usage, and VGA RAM usage were selected as evaluation metrics. In the Raspberry Pi 4b environment, the detection time for 100 timestamps, CPU usage, and RAM usage were selected as evaluation metrics. In the STM32 environment, the detection time for one timestamp, CPU usage, and RAM usage were used as evaluation metrics.

[0181] Table 4 lists the comparison results of the ten methods, where “-” indicates that no data is available. From the table, we can get:

[0182] 1) Timeliness: The five shallow methods (IForest, PCA, Optiforst, Loda, and FADSD) are significantly faster than the deep methods (DIF, DCdetector, FCVAE, ATF-UAD, DTAAD) in all three deployment environments. For example, in the PC environment, the average time of the five shallow methods is 81.18 seconds, while the average time of the five deep methods is 326.74 seconds. Among the five shallow methods, the detection time of the FADSD method of the present invention is comparable to the other methods. For example, on a Raspberry Pi 4b, FADFD takes 29.2 seconds, while PCA takes 24.1 seconds.

[0183] 2) Computational Consumption: Shallow methods have slightly higher computational resource utilization than deep methods. This is primarily because deep methods are deployed offline on edge devices, with all the computation required for training occurring in the cloud. For example, the shallow IForest method uses 52% CPU on a Raspberry Pi 4b, while the deep ATF-UAD method uses 32%. Comparing these five shallow methods, their CPU utilization is similar.

[0184] 3) Memory usage: Deep methods consume more memory resources than shallow methods. For example, in a PC environment, the RAM usage of the deep DCdetector method is 18.1GB, the VGA RAM usage is 15.3GB, and the FADSD method of the present invention is 2.9GB. Among shallow methods, the FADSD of the present invention occupies slightly more memory resources than other methods. For example, on an STM32, the RAM usage of FADSD is 154KB, the RAM usage of IForest is 136KB, and the RAM usage of LODA is 132KB.

[0185] 4) Summary: The FADSD method exhibits good timeliness and low resource consumption, enabling it to run well on resource-limited edge devices.

[0186] Table 4 Timeliness and resource consumption

[0187]

[0188] This paper proposes a timestamp-level anomaly detection method (FADSD) based on spectral differences for Industrial Internet of Things (IIoT) sensor signals (time series). This method offers the advantages of high speed, high accuracy, and low resource consumption. Unlike traditional neural network-based approaches, FADSD adopts a lightweight, non-neural network-based approach that utilizes only frequency domain features for anomaly detection. This is the first work in the field of anomaly detection to achieve fine-grained timestamp-level anomaly detection using only the frequency domain. First, a point-level spectral difference calculation module is designed to accurately identify overt anomalies in multi-sensor signals. Second, a sequence-level spectral difference calculation module is designed to complement the first module and accurately identify latent anomalies in multi-sensor signals. Finally, a novel anomaly scoring strategy is proposed that combines point-level and sequence-level spectral differences to generate an accurate identification score for each timestamp. Extensive experiments on eight IIoT sensor time signal datasets demonstrate that the FADSD method outperforms several deep state-of-the-art methods in detection accuracy. Furthermore, deployment experiments on an STM32 and a Raspberry Pi 4b further demonstrate the high speed and low resource consumption of the FADSD method, making it easily deployable on resource-constrained edge devices.

[0189] The above examples are merely preferred embodiments of the present invention and are not intended to limit the present invention in any way. Although the present invention has been disclosed above with reference to preferred embodiments, they are not intended to limit the present invention. Therefore, any simple modifications, equivalent variations, and modifications to the above examples that do not depart from the technical solution of the present invention and are based on the technical essence of the present invention shall fall within the scope of protection of the technical solution of the present invention.

Claims

1. A timestamp-level fast anomaly detection method for industrial Internet of Things based on frequency domain spectrum difference, characterized in that: Fine-grained anomaly detection of multi-sensor signals for the Industrial Internet is performed using non-neural network solutions only in the frequency domain; including the following: The spectral difference in the frequency domain is used as the evaluation index for timestamp-level anomaly detection. The point-level and sequence-level spectral difference calculation modules are designed as two complementary branches to jointly generate the spectral difference of each timestamp in the frequency domain. The anomaly scoring strategy is designed to generate an anomaly score for each timestamp by combining the point-level and sequence-level spectral differences to determine whether the timestamp is an anomaly point. The point-level spectrum difference calculation module is used to identify explicit anomalies in industrial time signals, and the sequence-level spectrum difference calculation module is used to identify implicit anomalies in time signals.

2. The method for fast anomaly detection at timestamp level of industrial Internet of Things based on frequency domain spectrum difference according to claim 1 is characterized in that: The anomaly detection method comprises the following steps: Step S1, using a point-level spectrum difference calculation module to identify explicit anomalies in multi-sensor time signals using frequency domain features; calculating the difference in frequency domain features of each timestamp with and without the timestamp in a fixed-length domain, and using the difference as the interchangeability of the timestamp in the frequency domain; identifying explicit timestamp anomalies based on the interchangeability; Step S2, using a sequence-level spectrum difference calculation module to identify hidden anomalies of multi-sensor time signals; using several adjacent timestamps around each timestamp as its substitute subsequences; calculating the changes in frequency domain features of each timestamp within a fixed length domain with and without its substitute sequence; using the difference in spectrum feature changes of the substitute subsequences as the substitutability of the timestamp; and identifying hidden timestamp anomalies based on the substitutability; Step S3: Use different weights to fuse the point-level and sequence-level spectrum differences to generate an anomaly score for each timestamp; use formula (2) to determine whether each timestamp is an anomaly point: Among them, Score t represents the final anomaly score of the t-th timestamp, λ is the preset threshold, ranging from 0 to 1; represents the predicted label of the tth timestamp; if Then the tth timestamp is judged as abnormal; otherwise, it is judged as normal.

3. The method for fast anomaly detection at timestamp level of industrial Internet of Things based on frequency domain spectrum difference according to claim 2 is characterized in that: The step S1 and step S2 are two independent complementary branches, and the learning processes of the two branches are executed in parallel with complementary interference.

4. The method for fast anomaly detection at timestamp level of industrial Internet of Things based on frequency domain spectrum difference according to claim 2 is characterized in that: The step S1 specifically includes the following contents: S1-1, point-level sampling: Generate a neighborhood sequence of length L for each timestamp and another replacement sequence of length L that does not contain the timestamp; in an industrial multi-sensor time signal with M variables and T timestamps The generation process of the domain sequence and replacement sequence of the t-th timestamp on the m-th variable is: First, generate the neighborhood sequence: from the mth variable Extract the timestamps between (tL / 2) and (t+L / 2) to form a neighborhood sequence Next, generate the replacement sequence: calculate P t m The average value Avg of all timestamps except the t-th timestamp in , replace P with Avg t m The value of the t-th timestamp in generates a replacement sequence Finally, the spectrum difference between the domain sequence of length L and the replacement sequence is calculated in the frequency domain to evaluate the replaceability of timestamp t in the frequency domain; S1-2, spectrum difference calculation: The spectrum difference calculation process of the t-th timestamp on the m-th variable in the frequency domain is: First, the fast Fourier transform function is used to transform two neighborhood sequences P of length L t m and They are transformed into L / 2 frequency components respectively, as shown below: in, FFT() stands for Fast Fourier Transform Function. t m Represents the frequency component of the domain sequence in the frequency domain, Represents the frequency components of the replacement sequence in the frequency domain; Secondly, calculate FP separately t m and The amplitude in the frequency domain is given as P t m and The frequency domain characteristics are: in, abs(·) represents the amplitude calculation function, AP t m represents the amplitude value of the domain sequence, represents the amplitude value of the replacement sequence; Finally, the mean square error function is used to measure the amplitude difference of the t-th timestamp in the frequency domain: in, DP t m It represents the point-level spectrum difference at the t-th timestamp, and MSE() is the mean error function.

5. The method for fast anomaly detection at timestamp level of industrial Internet of Things based on frequency domain spectrum difference according to claim 4 is characterized in that: The step S2 specifically includes the following contents: S2-1, sequence-level sampling: Generate a substitute subsequence of length LG for each timestamp, then generate a neighborhood sequence of length LS and another replacement sequence of length LS that does not contain the substitute subsequence; in an industrial multi-sensor time signal with M variables and T timestamps The sampling process of the t-th timestamp on the m-th variable is as follows: First, extract neighbors: From the mth variable Extract the timestamps in the range of (t-LS / 2) to (t+LS / 2) as the initial domain sequence Then, group: All data in are divided into G groups in order, each group contains LG timestamps, LS = G × LG; Secondly, generate a substitute subsequence: consider the group containing timestamp t as its substitute subsequence; Next, generate a domain sequence for the substitute subsequence: treat the entire initial domain sequence as the neighborhood sequence of the substitute subsequence Again, generate a replacement sequence for the substitute subsequence: replace the value of each timestamp in the substitute subsequence with the average value of the corresponding position in other groups to generate a replacement sequence for the substitute subsequence Finally, the spectrum difference between the domain sequence and the replacement sequence of length LS is calculated in the frequency domain, and the sequence-level replaceability of timestamp t in the frequency domain is measured; S2-2, spectrum difference calculation: The sequence-level spectrum difference calculation process of the t-th timestamp on the m-th variable is: First, the two domain sequences are transformed using the fast Fourier transform function FFT() and Transformed into LS / 2 frequency components: in, represents the frequency component of the domain sequence in the frequency domain, Represents the frequency components of the replacement sequence in the frequency domain; Secondly, in the frequency domain, we calculate and The amplitude of is: in, abs(·) represents the amplitude calculation function, represents the amplitude of the field sequence in the frequency domain, represents the amplitude of the replacement sequence in the frequency domain; Finally, the mean square error function is used to measure the sequence-level spectrum difference of each timestamp: in, is the sequence-level spectrum difference at the t-th timestamp.

6. The method for fast anomaly detection at timestamp level of industrial Internet of Things based on frequency domain spectrum difference according to claim 5 is characterized in that: In step S1 or step S2, the spectrum difference calculation process adopts a variable independent learning mode; the sampling process or spectrum difference calculation process on each variable is independent and does not interfere with each other and is executed in parallel.

7. The method for fast anomaly detection at timestamp level of industrial Internet of Things based on frequency domain spectrum difference according to claim 4 is characterized in that: The step S3 includes the following contents: First, we have a timestamp in the sensor signal to be detected among the M variables It will be input into the point-level and sequence-level spectrum difference calculation modules to perform variable-independent difference calculations; Then, on a variable m∈(1,…,M), two frequency domain differences are generated for timestamp t: point-level spectral differences and sequence-level spectral differences And as the point-level anomaly score and sequence-level anomaly score of the t-th timestamp on the variable m; Next, calculate the point-level and sequence-level average anomaly scores of the M variables respectively: Finally, the final anomaly score for the t-th timestamp is generated: Score t =α×DP(x t )+(1-α)×DS(x t ) (9) Among them, α is a preset parameter ranging from [0 to 1]; when α is 0, only the sequence-level anomaly score is considered; when α is 1, only the point-level anomaly score is considered; After obtaining the final anomaly score, use formula (2) to determine whether the tth timestamp is an anomaly point.

Images