Intelligent data anomaly detection method and system based on Internet of Things integrated management and control technology
By combining isolation forest with self-supervised anomaly detection enhancer, efficient and accurate anomaly detection is achieved in the Internet of Things environment, solving the problems of inaccurate anomaly scoring and model lag in existing technologies, and improving the accuracy and stability of detection.
Patent Information
- Application Number
- CN202510816744.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-06-18
- Publication Date
- 2025-09-16
- Estimated Expiration
- Not applicable · inactive patent
AI Technical Summary
Existing technologies make it difficult to achieve efficient and accurate intelligent data anomaly detection in the Internet of Things environment. In particular, the isolation forest algorithm has inaccurate anomaly scoring when faced with complex and changeable data, and lacks the dynamic correction and threshold adjustment of self-supervised learning, resulting in frequent misjudgments and missed judgments.
Combining the isolation forest algorithm with the self-supervised anomaly detection enhancer, fine-tuning and optimization of anomaly scores are achieved through data preprocessing, self-supervised training sample generation, dynamic threshold adjustment, and online model optimization.
It significantly improves the accuracy and robustness of anomaly detection, reduces the risk of misjudgment and missed judgment, ensures that the detection model adapts to data changes, and improves the long-term stability and detection efficiency of the system.
Smart Images

Figure CN120654159A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of Internet of Things data anomaly detection, and in particular to an intelligent data anomaly detection method and system based on Internet of Things integrated management and control technology. Background Art
[0002] With the rapid development of the Internet of Things (IoT) system, a large amount of multimodal intelligent data has been widely collected and used to achieve device status monitoring and abnormal behavior detection. At present, traditional anomaly detection methods mainly rely on statistical analysis, clustering algorithms, or distance- and density-based detection technologies. Their detection process often relies on pre-set thresholds or fixed model parameters. However, when processing high-dimensional, diverse, and real-time changing data, these methods often find it difficult to balance accuracy and real-time performance. They are easily affected by noise, data missing, and nonlinear characteristics, resulting in frequent misjudgments or missed judgments. In particular, isolation forest, as an anomaly detection algorithm based on random sampling to construct decision trees, although it has high detection efficiency and certain robustness, relies on a randomly divided data structure and a fixed anomaly score calculation formula. When faced with complex and changeable data in the IoT, it is prone to inaccurate anomaly scores, thereby reducing overall detection performance.
[0003] In existing technologies, a single isolation forest algorithm often fails to fully utilize the complex patterns contained in the data, and is also difficult to deal with potential biases introduced during data enhancement, noise removal, and standardization. At the same time, self-supervised learning methods have been applied to data reconstruction and feature extraction in recent years. By constructing self-supervised training samples and utilizing an encoder-decoder structure to effectively capture the internal structural information of the data, the accuracy of anomaly detection has been improved to a certain extent. However, there is currently no technical solution that organically combines the isolation forest algorithm with a self-supervised anomaly detection enhancer, and the advantages of the two have not been fully complemented. In the existing detection framework, there is a lack of a mechanism for dynamic correction and threshold adjustment of anomaly scores, and it is impossible to perform online optimization of the detection model based on real-time feedback data, resulting in certain lags and insufficient accuracy in the processing of anomaly data.
[0004] Therefore, the existing technology urgently needs a new intelligent data anomaly detection method. This method can not only give full play to the advantages of isolation forest in efficient anomaly detection, but also combine the adaptive learning ability of self-supervised anomaly detection enhancer, and realize fine-tuning and optimization of anomaly scores through data enhancement, reconstruction error correction and dynamic threshold adjustment, thereby improving the accuracy and stability of anomaly detection. Through the integrated application of the above technical means, it can effectively overcome the shortcomings of existing technologies in data preprocessing, model correction and online updating, and meet the actual needs of intelligent data anomaly detection in the Internet of Things environment. Summary of the Invention
[0005] One purpose of the present invention is to propose an intelligent data anomaly detection method and system based on the integrated management and control technology of the Internet of Things. The present invention can provide an efficient and scientific optimization solution in the intelligent data anomaly detection of the Internet of Things, bringing significant technical value and economic benefits to practical applications.
[0006] According to an embodiment of the present invention, an intelligent data anomaly detection method based on Internet of Things integrated management and control technology includes the following steps: S1, collect intelligent data and preprocess it to build a standardized data set; S2. Use the isolation forest algorithm to perform preliminary anomaly detection on the standardized data set. By randomly sampling and constructing multiple isolation trees, the average path length required to separate each data point in each isolation tree is calculated. Based on the average path length, the anomaly score of each data point is calculated, and potential anomaly data points are screened out according to a predetermined threshold. S3. Constructing self-supervised training samples based on the screened abnormal data points, and using a self-supervised anomaly detection enhancer to enhance the detection of the abnormal data point set to generate a correction factor for correcting the isolation forest anomaly score; S4. Recalculate the anomaly score for each abnormal data point based on the correction factor, and recalibrate each data point in combination with the dynamic threshold technology, and identify the data point whose recalibrated anomaly score is greater than the corresponding dynamic threshold as an abnormal data point; S5. Classify, group and store abnormal data points output by the recalibration, start the alarm module and generate log information; S6. Based on the real-time feedback detection results in the IoT system, the model parameters of the isolation forest and self-supervised anomaly detection enhancers are dynamically optimized.
[0007] Optionally, the S1 includes the following steps: S11. Use the IoT system to collect intelligent data from multiple nodes and perform cleaning processing, including deleting data samples with missing values, eliminating noisy data, and filtering out irrelevant features; S12. Standardize the cleaned data to construct a standardized data set Z.
[0008] Optionally, the S2 includes the following steps: S21. For the standardized data set Z, a random sampling method is used to construct an isolation forest. The isolation forest consists of t isolated trees, and each isolated tree is recorded as , j=1,2,...,t; S22. In each isolated tree For each data point Recursively perform random partitioning until the preset tree depth limit is reached to obtain data points In the tree The path length in ; S23. Calculate data points Average path length among all isolated trees : ; Where t represents the number of isolated trees; S24, based on average path length Calculate data points Anomaly score : ; in, is the scaling adjustment factor, is the correction index, is the natural exponential function, When the number of samples is The average unsuccessful search path length is The calculation formula is: ; in, is the harmonic number, and the calculation formula is: ; S25, based on the preset threshold For each data point Anomaly score Make a judgment, if it meets , then the data points Screen as potentially anomalous data points.
[0009] Optionally, S3 includes the following steps: S31. Construct a set of potentially abnormal data points that have been screened out : ; S32, pair set Each data point in Using data enhancement function Generate self-supervised training samples: ; in, represents the enhanced sample, is a random noise vector, is the weight matrix, is the bias vector, represents element-wise multiplication; S33, enhance the sample Input self-supervised anomaly detection enhancer, which includes encoder and decoder , the encoder and decoder are defined as: ; ; in, for The implicit feature representation of is the reconstructed sample, is the weight matrix of the encoder, is the encoder bias, is the weight matrix of the decoder, is the decoder bias, is the sigmoid activation function; S34. Calculate reconstruction error : ; in, represents the enhanced sample, is the reconstructed sample, represents the Euclidean norm; Based on the reconstruction error Construct correction factor: ; in, Represents a data point The corresponding correction factor, is the mean of the reconstruction error in the training set, is the correction index, is the natural exponential function, is the adjustment constant.
[0010] Optionally, the S4 includes the following steps: S41. For each data point Leveraging Anomaly Scoring and correction factors Perform correction calculations to obtain recalibrated abnormality scores : ; in, is the score amplification factor, is the correction factor weight, is the score smoothing index, is the proportional adjustment coefficient, To prevent small positive numbers with zero denominators, is the natural exponential function; S42, using dynamic threshold technology to each data point Calculating dynamic thresholds : ; in, Represents a data point The dynamic threshold of is the basic threshold, is the threshold adjustment amplitude, is the scaling factor, is the correction factor, is the reference value of the correction factor; S43, if the data point Recalibrated abnormality score Greater than the corresponding dynamic threshold , then the data points It is identified as an abnormal data point, otherwise it is identified as a normal data point.
[0011] Optionally, the S5 includes the following steps: S51, according to each data point Recalibrated abnormality score and the corresponding dynamic threshold , forming a set of abnormal data points : ; S52. For abnormal data point set Data points in Use K-means clustering algorithm for classification and grouping, and perform storage processing; S53, start the alarm module, and Calculate the statistical anomaly rate for the data points in : ; in, is the number of abnormal data points, is the total number of data points in the normalized dataset, when Greater than the preset alarm threshold Activate alarm when S54, pair set Perform data cleaning operations on abnormal data points in the dataset; S55. Generate log information for the classification results and alarm results.
[0012] Optionally, the S6 includes the following steps: S61. Collect detection feedback data from the Internet of Things system in real time to form a feedback data set F: ; in, Representation and data points The corresponding feedback detection results, N is the total number of data points; S62. Calculate the overall error index E: ; in, to score abnormalities for recalibration; S63, Model parameter set for isolation forest and self-supervised anomaly detection enhancer Perform iterative updates: ; in, represents the model parameters at the tth iteration, is the learning rate, is the gradient of the error E with respect to the model parameters; S64. Dynamically adjust the hyperparameter set based on feedback data and error indicator E: ; in, represents the value of the jth hyperparameter at the tth iteration, is the reference error constant, is the adjustment factor; S65. Monitor the error changes of the updated isolation forest and self-supervised anomaly detection booster models in successive iterations until the convergence conditions are met: ; in, is the error index at the tth iteration, is the error index at the t+1th iteration, is the preset convergence tolerance.
[0013] An intelligent data anomaly detection system based on IoT integrated management and control technology according to an embodiment of the present invention includes the following modules: The data acquisition and preprocessing module is used to collect intelligent data from the IoT system, clean the raw data, remove noise, and standardize it to build a standardized data set; Isolation forest detection module, which is used to construct an isolation forest using random sampling based on a standardized data set and calculate the average path length and anomaly score of each data point in the isolation tree; The self-supervised enhancement detection module is used to filter potential abnormal data points from the isolation forest, generate self-supervised training samples using the data enhancement function, and calculate the reconstruction error and correction factor through the encoder and decoder; Anomaly score recalibration module, which is used to calculate the recalibrated anomaly score based on the original anomaly score and the correction factor, and classify the data points using dynamic threshold technology; The storage and processing module is used to cluster, store, and alarm abnormal data points after recalibration, and generate log information; The online update module is used to iteratively update and optimize the model parameters of the isolation forest and self-supervised anomaly detection enhancers based on real-time feedback data and error indicators.
[0014] The beneficial effects of the present invention are: First, the present invention significantly improves the accuracy and robustness of intelligent data anomaly detection by combining isolation forest with self-supervised anomaly detection enhancer. After collecting multimodal data using the Internet of Things system, the quality of the input data is ensured through data preprocessing, noise removal and standardization. Subsequently, the isolation forest algorithm is used to achieve efficient preliminary anomaly detection, and the original anomaly score is obtained by constructing random isolation trees and calculating the average path length, laying the foundation for subsequent anomaly detection. Furthermore, the present invention introduces a self-supervised anomaly detection enhancer. By constructing self-supervised training samples through data augmentation, encoder, and decoder architectures, and using reconstruction errors to generate correction factors, the proposed method effectively corrects the deviations in the isolation forest’s anomaly scores, enabling refined adjustments to anomaly scores. Furthermore, the introduction of dynamic thresholding technology enables the system to dynamically adjust anomaly detection criteria based on real-time feedback, further reducing the risk of misjudgments and missed detections. The online update module iteratively optimizes model parameters and hyperparameters by collecting feedback data in real time, ensuring that the detection model can adapt to changing data patterns and improving the long-term stability of the overall system. BRIEF DESCRIPTION OF THE DRAWINGS
[0015] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings: Figure 1 This is an overall flow chart of an intelligent data anomaly detection method based on the Internet of Things integrated management and control technology proposed by the present invention; Figure 2 This is a structural diagram of an intelligent data anomaly detection system based on the Internet of Things integrated management and control technology proposed by the present invention. DETAILED DESCRIPTION
[0016] The present invention will now be described in further detail with reference to the accompanying drawings, which are simplified schematic diagrams that illustrate the basic structure of the present invention in a schematic manner.
[0017] refer to Figure 1, an intelligent data anomaly detection method based on Internet of Things integrated management and control technology, comprising the following steps: S1, collect intelligent data and preprocess it to build a standardized data set; S2. Use the isolation forest algorithm to perform preliminary anomaly detection on the standardized data set. By randomly sampling and constructing multiple isolation trees, the average path length required to separate each data point in each isolation tree is calculated. Based on the average path length, the anomaly score of each data point is calculated, and potential anomaly data points are screened out according to a predetermined threshold. S3. Constructing self-supervised training samples based on the screened abnormal data points, and using a self-supervised anomaly detection enhancer to enhance the detection of the abnormal data point set to generate a correction factor for correcting the isolation forest anomaly score; S4. Recalculate the anomaly score for each abnormal data point based on the correction factor, and recalibrate each data point in combination with the dynamic threshold technology, and identify the data point whose recalibrated anomaly score is greater than the corresponding dynamic threshold as an abnormal data point; S5. Classify, group and store abnormal data points output by the recalibration, start the alarm module and generate log information; S6. Based on the real-time feedback detection results in the IoT system, the model parameters of the isolation forest and self-supervised anomaly detection enhancers are dynamically optimized.
[0018] In this embodiment, S1 includes the following steps: S11. Use the IoT system to collect intelligent data from multiple nodes and perform cleaning processing, including deleting data samples with missing values, eliminating noisy data, and filtering out irrelevant features; S12. Standardize the cleaned data to construct a standardized data set Z.
[0019] In this embodiment, S2 includes the following steps: S21. For the standardized data set Z, a random sampling method is used to construct an isolation forest. The isolation forest consists of t isolated trees, and each isolated tree is recorded as , j=1,2,...,t; S22. In each isolated tree For each data point Recursively perform random partitioning until the preset tree depth limit is reached to obtain data points In the tree The path length in ; S23. Calculate data points Average path length among all isolated trees : ; Where t represents the number of isolated trees; S24, based on average path length Calculate data points Anomaly score : ; in, is the scaling adjustment factor, is the correction index, is the natural exponential function, When the number of samples is The average unsuccessful search path length is The calculation formula is: ; in, is the harmonic number, and the calculation formula is: ; S25, based on the preset threshold For each data point Anomaly score Make a judgment, if it meets , then the data points Screen as potentially anomalous data points.
[0020] In this embodiment, S3 includes the following steps: S31. Construct a set of potentially abnormal data points that have been screened out : ; S32, pair set Each data point in Using data enhancement function Generate self-supervised training samples: ; in, represents the enhanced sample, is a random noise vector, is the weight matrix, is the bias vector, represents element-wise multiplication; S33, enhance the sample Input self-supervised anomaly detection enhancer, which includes encoder and decoder , the encoder and decoder are defined as: ; ; in, for The implicit feature representation of is the reconstructed sample, is the weight matrix of the encoder, is the encoder bias, is the weight matrix of the decoder, is the decoder bias, is the sigmoid activation function; S34. Calculate reconstruction error : ; in, represents the enhanced sample, is the reconstructed sample, represents the Euclidean norm; Based on the reconstruction error Construct correction factor: ; in, Represents a data point The corresponding correction factor, is the mean of the reconstruction error in the training set, is the correction index, is the natural exponential function, is the adjustment constant.
[0021] In this embodiment, S4 includes the following steps: S41. For each data point Leveraging Anomaly Scoring and correction factors Perform correction calculations to obtain recalibrated abnormality scores : ; in, is the score amplification factor, is the correction factor weight, is the score smoothing index, is the proportional adjustment coefficient, To prevent small positive numbers with zero denominators, is the natural exponential function; S42, using dynamic threshold technology to each data point Calculating dynamic thresholds : ; in, Represents a data point The dynamic threshold of is the basic threshold, is the threshold adjustment amplitude, is the scaling factor, is the correction factor, is the reference value of the correction factor; S43, if the data point Recalibrated abnormality score Greater than the corresponding dynamic threshold , then the data points It is identified as an abnormal data point, otherwise it is identified as a normal data point.
[0022] In this embodiment, S5 includes the following steps: S51, according to each data point Recalibrated abnormality score and the corresponding dynamic threshold , forming a set of abnormal data points : ; S52. For abnormal data point set Data points in Use K-means clustering algorithm for classification and grouping, and perform storage processing; S53, start the alarm module, and Calculate the statistical anomaly rate for the data points in : ; in, is the number of abnormal data points, is the total number of data points in the normalized dataset, when Greater than the preset alarm threshold Activate alarm when S54, pair set Perform data cleaning operations on abnormal data points in the dataset; S55. Generate log information for the classification results and alarm results.
[0023] In this embodiment, S6 includes the following steps: S61. Collect detection feedback data from the Internet of Things system in real time to form a feedback data set F: ; in, Representation and data points The corresponding feedback detection results, N is the total number of data points; S62. Calculate the overall error index E: ; in, to score abnormalities for recalibration; S63, Model parameter set for isolation forest and self-supervised anomaly detection enhancer Perform iterative updates: ; in, represents the model parameters at the tth iteration, is the learning rate, is the gradient of the error E with respect to the model parameters; S64. Dynamically adjust the hyperparameter set based on feedback data and error indicator E: ; in, represents the value of the jth hyperparameter at the tth iteration, is the reference error constant, is the adjustment factor; S65. Monitor the error changes of the updated isolation forest and self-supervised anomaly detection booster models in successive iterations until the convergence conditions are met: ; in, is the error index at the tth iteration, is the error index at the t+1th iteration, is the preset convergence tolerance.
[0024] refer to Figure 2 , an intelligent data anomaly detection system based on IoT integrated management and control technology, including the following modules: The data acquisition and preprocessing module is used to collect intelligent data from the IoT system, clean the raw data, remove noise, and standardize it to build a standardized data set; Isolation forest detection module, which is used to construct an isolation forest using random sampling based on a standardized data set and calculate the average path length and anomaly score of each data point in the isolation tree; The self-supervised enhancement detection module is used to filter potential abnormal data points from the isolation forest, generate self-supervised training samples using the data enhancement function, and calculate the reconstruction error and correction factor through the encoder and decoder; Anomaly score recalibration module, which is used to calculate the recalibrated anomaly score based on the original anomaly score and the correction factor, and classify the data points using dynamic threshold technology; The storage and processing module is used to cluster, store, and alarm abnormal data points after recalibration, and generate log information; The online update module is used to iteratively update and optimize the model parameters of the isolation forest and self-supervised anomaly detection enhancers based on real-time feedback data and error indicators.
[0025] Example: In a large-scale intelligent manufacturing enterprise, a large number of IoT sensors are deployed in its production lines to monitor the operating status of production equipment and prevent production accidents caused by equipment anomalies. The company's production environment is extremely complex, including temperature sensors, pressure sensors, vibration sensors, airflow sensors and other equipment, which generate more than 100,000 pieces of data every day. However, due to equipment aging, environmental changes and external interference, the collected data often contains noise, missing values or abnormal jump points, which poses a great challenge to anomaly detection. Traditional rule-based threshold detection or clustering-based anomaly detection methods have the defects of high false positive rate and poor model adaptability, resulting in some anomalies not being identified in time, affecting the normal operation of the equipment.
[0026] To solve this problem, the company decided to introduce the intelligent data anomaly detection method based on isolation forest and self-supervised anomaly detection enhancer of the present invention to build an efficient and accurate anomaly detection system. The system can automatically learn the normal patterns of sensor data, detect potential anomalies in real time, and perform adaptive optimization to ensure that the detection model can be dynamically adjusted as the environment changes.
[0027] The intelligent data anomaly detection system of the present invention is deployed in the enterprise's intelligent control center and connected to the Internet of Things sensor network of all key devices.
[0028] Every day, the IoT system collects data from 500 sensor nodes on the production line, including parameters such as temperature (°C), vibration frequency (Hz), pressure (Pa), and flow rate (L / min). The collected data is first processed through noise removal, missing value filling, and Z-score normalization to eliminate the impact of environmental interference on the detection results.
[0029] The cleaned data is input into the isolation forest algorithm, which constructs 100 isolated trees through random partitioning and calculates the average path length of each data point to generate the original anomaly score. When the average path length of a data point is shorter, it means that it is more likely to be isolated and may be anomaly data.
[0030] The potential abnormal data points filtered out by the isolation forest are further input into the self-supervised anomaly detection enhancer. First, this module uses data augmentation methods to slightly perturb the data to simulate abnormal situations in different situations, and calculates the reconstruction error through the encoder-decoder network. A higher reconstruction error indicates that the characteristics of the data point do not conform to the normal data distribution, further enhancing the accuracy of anomaly detection.
[0031] This system adopts a dynamic threshold calculation method to recalculate the anomaly score of each data point according to the correction factor of the self-supervised enhancer, and determines the judgment criteria of abnormal data through dynamic adjustment. Finally, all data points are classified according to the adjusted score and an anomaly alarm is triggered.
[0032] Every day, the system summarizes the detection results of the previous 24 hours, combines them with feedback data from equipment operators and maintenance personnel, calculates detection errors, and automatically adjusts the model parameters of the isolation forest and self-supervised anomaly detection enhancers. Through online learning algorithms, the system can adapt to different production scenarios and continuously optimize detection accuracy.
[0033] During a 30-day test period in October 2024, the system detected and analyzed 150,000 production data points and compared them with traditional detection methods. The following is the performance of different detection methods in this production environment: By comparing with the traditional method, the specific data are as follows Table 1: Table 1 Comparison of the performance of the present invention and the traditional method in this production environment ; The results show that the accuracy of the proposed method reaches 98.7%, which is 13.5% higher than that of traditional threshold detection and 5.2% higher than that of isolation forest alone. At the same time, the false alarm rate of this method is reduced to 1.8%, which is 4.1% lower than that of K-Means. In addition, due to the introduction of dynamic threshold adjustment and online learning, the missed alarm rate is only 0.9%, which effectively avoids the problem of potential equipment anomalies not being identified. In terms of detection speed, this method only takes an average of 2.9 seconds. Compared with traditional methods, the detection efficiency is improved by nearly 5 times, ensuring the real-time response capability of equipment anomalies.
[0034] The above description is only a preferred specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any technician familiar with the technical field, within the technical scope disclosed by the present invention, who makes equivalent replacements or changes based on the technical solution and inventive concept of the present invention, should be covered by the scope of protection of the present invention.
Claims
1. An intelligent data anomaly detection method based on Internet of Things integrated management and control technology, characterized in that: The steps include: S1, collect intelligent data and preprocess it to build a standardized data set; S2. Use the isolation forest algorithm to perform preliminary anomaly detection on the standardized data set. By randomly sampling and constructing multiple isolation trees, the average path length required to separate each data point in each isolation tree is calculated. Based on the average path length, the anomaly score of each data point is calculated, and potential anomaly data points are screened out according to a predetermined threshold. S3. Constructing self-supervised training samples based on the screened abnormal data points, and using a self-supervised anomaly detection enhancer to enhance the detection of the abnormal data point set to generate a correction factor for correcting the isolation forest anomaly score; S4. Recalculate the anomaly score for each abnormal data point based on the correction factor, and recalibrate each data point in combination with the dynamic threshold technology, and identify the data point whose recalibrated anomaly score is greater than the corresponding dynamic threshold as an abnormal data point; S5. Classify, group and store abnormal data points output by the recalibration, start the alarm module and generate log information; S6. Based on the real-time feedback detection results in the IoT system, the model parameters of the isolation forest and self-supervised anomaly detection enhancers are dynamically optimized.
2. The intelligent data anomaly detection method based on the Internet of Things integrated management and control technology according to claim 1 is characterized in that: Said S1 comprises the following steps: S11. Use the IoT system to collect intelligent data from multiple nodes and perform cleaning processing, including deleting data samples with missing values, eliminating noisy data, and filtering out irrelevant features; S12. Standardize the cleaned data to construct a standardized data set Z.
3. The intelligent data anomaly detection method based on the Internet of Things integrated management and control technology according to claim 1 is characterized in that: The S2 comprises the following steps: S21. For the standardized data set Z, a random sampling method is used to construct an isolation forest. The isolation forest consists of t isolated trees, and each isolated tree is recorded as , j=1,2,...,t; S22. In each isolated tree For each data point Recursively perform random partitioning until the preset tree depth limit is reached to obtain data points In the tree The path length in ; S23. Calculate data points Average path length among all isolated trees : ; Where t represents the number of isolated trees; S24, based on average path length Calculate data points Anomaly score : ; in, is the scaling adjustment factor, is the correction index, is the natural exponential function, When the number of samples is The average unsuccessful search path length is The calculation formula is: ; in, is the harmonic number, and the calculation formula is: ; S25, based on the preset threshold For each data point Anomaly score Make a judgment, if it meets , then the data points Screen as potentially anomalous data points.
4. The intelligent data anomaly detection method based on the Internet of Things integrated management and control technology according to claim 1 is characterized in that: The S3 includes the following steps: S31. Construct a set of potentially abnormal data points that have been screened out : ; S32, pair set Each data point in Using data enhancement function Generate self-supervised training samples: ; in, represents the enhanced sample, is a random noise vector, is the weight matrix, is the bias vector, represents element-wise multiplication; S33, enhance the sample Input self-supervised anomaly detection enhancer, which includes encoder and decoder , the encoder and decoder are defined as: ; ; in, for The implicit feature representation of is the reconstructed sample, is the weight matrix of the encoder, is the encoder bias, is the weight matrix of the decoder, is the decoder bias, is the sigmoid activation function; S34. Calculate reconstruction error : ; in, represents the enhanced sample, is the reconstructed sample, represents the Euclidean norm; Based on the reconstruction error Construct correction factor: ; in, Represents a data point The corresponding correction factor, is the mean of the reconstruction error in the training set, is the correction index, is the natural exponential function, is the adjustment constant.
5. The intelligent data anomaly detection method based on the Internet of Things integrated management and control technology according to claim 1 is characterized in that: The S4 comprises the following steps: S41. For each data point Leveraging Anomaly Scoring and correction factors Perform correction calculations to obtain recalibrated abnormality scores : ; in, is the score amplification factor, is the correction factor weight, is the score smoothing index, is the proportional adjustment coefficient, To prevent small positive numbers with zero denominators, is the natural exponential function; S42, using dynamic threshold technology to each data point Calculating dynamic thresholds : ; in, Represents a data point The dynamic threshold of is the basic threshold, is the threshold adjustment amplitude, is the scaling factor, is the correction factor, is the reference value of the correction factor; S43, if the data point Recalibrated abnormality score Greater than the corresponding dynamic threshold , then the data points It is identified as an abnormal data point, otherwise it is identified as a normal data point.
6. The intelligent data anomaly detection method based on the Internet of Things integrated management and control technology according to claim 1 is characterized in that: The S5 comprises the following steps: S51, according to each data point Recalibrated abnormality score and the corresponding dynamic threshold , forming a set of abnormal data points : ; S52. For abnormal data point set Data points in Use K-means clustering algorithm for classification and grouping, and perform storage processing; S53, start the alarm module, and Calculate the statistical anomaly rate for the data points in : ; in, is the number of abnormal data points, is the total number of data points in the normalized dataset, when Greater than the preset alarm threshold Activate alarm when S54, pair set Perform data cleaning operations on abnormal data points in the dataset; S55. Generate log information for the classification results and alarm results.
7. The intelligent data anomaly detection method based on the Internet of Things integrated management and control technology according to claim 1 is characterized in that: The S6 comprises the following steps: S61. Collect detection feedback data from the Internet of Things system in real time to form a feedback data set F: ; in, Representation and data points The corresponding feedback detection results, N is the total number of data points; S62. Calculate the overall error index E: ; in, to score abnormalities for recalibration; S63, Model parameter set for isolation forest and self-supervised anomaly detection enhancer Perform iterative updates: ; in, represents the model parameters at the tth iteration, is the learning rate, is the gradient of the error E with respect to the model parameters; S64. Dynamically adjust the hyperparameter set based on feedback data and error indicator E: ; in, represents the value of the jth hyperparameter at the tth iteration, is the reference error constant, is the adjustment factor; S65. Monitor the error changes of the updated isolation forest and self-supervised anomaly detection booster models in successive iterations until the convergence conditions are met: ; in, is the error index at the tth iteration, is the error index at the t+1th iteration, is the preset convergence tolerance.
8. An intelligent data anomaly detection system based on the Internet of Things integrated management and control technology, which executes the automatic tightening method for pitch bearing bolts according to any one of claims 1 to 7, characterized in that: Includes the following modules: The data acquisition and preprocessing module is used to collect intelligent data from the IoT system, clean the raw data, remove noise, and standardize it to build a standardized data set; Isolation forest detection module, which is used to construct an isolation forest using random sampling based on a standardized data set and calculate the average path length and anomaly score of each data point in the isolation tree; The self-supervised enhancement detection module is used to filter potential abnormal data points from the isolation forest, generate self-supervised training samples using the data enhancement function, and calculate the reconstruction error and correction factor through the encoder and decoder; Anomaly score recalibration module, which is used to calculate the recalibrated anomaly score based on the original anomaly score and the correction factor, and classify the data points using dynamic threshold technology; The storage and processing module is used to cluster, store, and alarm abnormal data points after recalibration, and generate log information; The online update module is used to iteratively update and optimize the model parameters of the isolation forest and self-supervised anomaly detection enhancers based on real-time feedback data and error indicators.
Citation Information
Cited By
Wetland group dynamic water distribution method, device and equipment based on adaptive optimization model
CN121352434A
Wetland group dynamic water distribution method, device and equipment based on adaptive optimization model
CN121352434B
Measurement and control device two-remote information verification method based on machine learning
CN122153676A
A Machine Learning-Based Method for Verifying Remote Sensing Information from Measurement and Control Devices
CN122153676B