Dual-channel anomaly detection method and system based on local entropy and isolated forest

Abstract

The invention relates to the technical field of industrial Internet of Things data processing, in particular to a dual-channel anomaly detection method based on local entropy and isolated forest, and the method comprises the steps: collecting multi-dimensional time sequence data of equipment operation in real time; extracting local data of the multi-dimensional time series data in each sliding window by using a variable step size sliding window technology, calculating four statistical indexes according to the local data to construct a multi-dimensional entropy model, and obtaining a local entropy score according to the multi-dimensional entropy model; utilizing an isolated forest algorithm to calculate an isolated forest abnormal score of the multi-dimensional time series data; and constructing a joint scoring model, dynamically adjusting the weight of the local entropy score and the weight of the isolated forest abnormal score to obtain a joint score, and judging the abnormal level of the equipment according to the joint score and a preset abnormal threshold value. Therefore, the problems of insufficient real-time performance, insufficient feature utilization, low decision collaboration efficiency and the like in an industrial scene are solved.

Description

Technical Field

[0001] This application relates to the field of industrial Internet of Things (IoT) data processing technology, and in particular to a dual-channel anomaly detection method based on local entropy and isolated forest. Background Technology

[0002] Against the backdrop of the integration of big data and the Industrial Internet of Things, the multi-dimensional time-series data collected at high frequencies by industrial sensors exhibit nonlinear and non-stationary characteristics due to the influence of factors such as environmental noise and equipment vibration coupling.

[0003] In related technologies, threshold detection methods based on global statistical features and single machine learning algorithms can be used for anomaly detection. However, threshold detection methods based on global statistical features are difficult to accurately capture subtle anomalies in local data distribution. Single machine learning algorithms suffer from insufficient feature utilization and inadequate detection robustness when processing high-dimensional sparse data. Furthermore, in industrial scenarios, they are often limited to task allocation and resource scheduling, lacking deep collaboration across the entire process, which can easily lead to information silos and decision-making delays. Therefore, improvements are urgently needed. Summary of the Invention

[0004] The purpose of this application is to overcome the shortcomings of the existing technology and provide a dual-channel anomaly detection method based on local entropy and isolated forest, which can accurately extract abnormal features, improve real-time performance in industrial scenarios, make full use of features, and enhance decision-making collaboration efficiency.

[0005] To solve the above-mentioned technical problems, this application adopts the following technical solution:

[0006] In a first aspect, this application provides a dual-channel anomaly detection method based on local entropy and isolated forest, comprising the following steps: real-time acquisition of multidimensional time-series data of device operation; extraction of local data in each sliding window of the multidimensional time-series data using variable step-size sliding window technology, calculation of four statistical indicators based on the local data, construction of a multidimensional entropy model based on the four statistical indicators, and obtaining a local entropy score based on the multidimensional entropy model; calculation of an isolated forest anomaly score of the multidimensional time-series data using the isolated forest algorithm; construction of a joint scoring model based on the local entropy score and the isolated forest anomaly score, dynamically adjusting the weights of the local entropy score and the isolated forest anomaly score, obtaining a joint score based on the joint scoring model, and determining the anomaly level of the device based on the joint score and a preset anomaly threshold.

[0007] Optionally, in one embodiment of this application, the step of extracting local data from each sliding window of the multidimensional time series data using the variable step-size sliding window technique includes: dynamically and adaptively adjusting the size and step size of the sliding window based on the fluctuation characteristics of the multidimensional time series data, so as to extract local data from each sliding window one by one, wherein the expression for the size of the sliding window is:

[0008] ,

[0009] Where W is the size of the sliding window; The standard deviation of multidimensional time series data; This represents the mean of the multidimensional time series data.

[0010] Optionally, in one embodiment of this application, the construction of a multidimensional entropy model based on the four statistical indicators includes: calculating four statistical indicators—information entropy, rate of change, normalized variance, and randomness index—based on the local data, wherein the expression for the information entropy is:

[0011] ,

[0012] Where H is the information entropy; Let be the probability density of the i-th data point within the window; n is the total number of data points in the window.

[0013] The expression for the rate of change is:

[0014] ,

[0015] Where R is the rate of change; For the device running multi-dimensional time series data points acquired at the i-th time point within the sliding window; For the device running multi-dimensional time series data points acquired at time i-1 within the sliding window, and... Data pairs that form adjacent time points; This is the minimum compensation coefficient;

[0016] The expression for the normalized variance is:

[0017]

[0018] Where V is the normalized variance; Let x be the standard deviation of the local multidimensional time series data within the sliding window; let x be the set of local multidimensional time series data extracted within the sliding window; max(x) is the maximum value in the set of local multidimensional time series data x within the sliding window; and min(x) is the minimum value in the set of local multidimensional time series data x within the sliding window.

[0019] The expression for the randomness index is:

[0020]

[0021] Where S is the randomness index; run_length is the length of the continuous ascending / descending data run within the sliding window; and W is the size of the sliding window.

[0022] The four statistical indicators characterize local data features from four dimensions: data disorder, mutation intensity, volatility dispersion, and random continuity. These indicators are then combined with preset weights to construct the multidimensional entropy model through weighted fusion. The expression for the multidimensional entropy model is as follows:

[0023]

[0024] Where E is the local entropy score.

[0025] Optionally, in one embodiment of this application, the step of calculating the isolated forest anomaly score of the multidimensional time-series data using the isolated forest algorithm includes: dividing the multidimensional time-series data into random subspaces to construct multiple isolated trees based on the generated random subspaces; traversing the multiple isolated trees in each random subspace to obtain the path length and average path length; and obtaining the isolated forest anomaly score based on the path length and the average path length, wherein the expression for the isolated forest anomaly score is:

[0026]

[0027] Where S(x) is the isolated forest anomaly score; h(x) is the path length; E[h(x)] is the average path length; and x is the random subspace.

[0028] Optionally, in one embodiment of this application, obtaining the joint score based on the joint scoring model includes: generating a joint scoring model by weighting and summing the local entropy score and the isolated forest anomaly score according to dynamically adjusted weights, wherein the expression of the joint scoring model is:

[0029]

[0030] Where J is the joint score; a is the weight of the local entropy score; E is the local entropy score; and S(x) is the isolated forest anomaly score.

[0031] Optionally, in one embodiment of this application, determining the abnormality level of the device based on the joint score and a preset abnormality threshold includes: determining the abnormality level of the device as normal if the joint score does not exceed the preset abnormality threshold; determining the abnormality level of the device based on the joint score and the preset abnormality threshold if the joint score exceeds the preset abnormality threshold, wherein the preset abnormality threshold includes a warning threshold, a fault threshold, and a severe fault threshold; if the joint score is at the warning threshold, determining the abnormality level of the device as a warning; if the joint score is at the fault threshold, determining the abnormality level of the device as a fault; and if the joint score is at the severe fault threshold, determining the abnormality level of the device as a severe fault.

[0032] Optionally, in one embodiment of this application, the method further includes: uploading the local entropy score, the isolated forest anomaly score, the joint score, and the anomaly level to the cloud for collaborative decision-making to obtain multi-layer processing results, thereby optimizing the dynamic weights of the joint scoring model; wherein, the multi-layer processing results include: uploading the local entropy score, the isolated forest anomaly score, the joint score, and the anomaly level to the cloud for information interaction to obtain device status information; analyzing and predicting the local entropy score and the isolated forest anomaly score to obtain device trend information; and generating a device control strategy based on the joint score and the anomaly level.

[0033] Secondly, this application provides a dual-channel anomaly detection system based on local entropy and isolated forest, comprising: a data acquisition module for real-time acquisition of multidimensional time-series data of device operation; a first scoring module for extracting local data of the multidimensional time-series data in each sliding window using variable step-size sliding window technology, calculating four statistical indicators based on the local data, constructing a multidimensional entropy model based on the four statistical indicators, and obtaining a local entropy score based on the multidimensional entropy model; a second scoring module for calculating an isolated forest anomaly score of the multidimensional time-series data using the isolated forest algorithm; and an anomaly determination module for constructing a joint scoring model based on the local entropy score and the isolated forest anomaly score, dynamically adjusting the weights of the local entropy score and the isolated forest anomaly score, obtaining a joint score based on the joint scoring model, and determining the anomaly level of the device based on the joint score and a preset anomaly threshold.

[0034] Thirdly, this application provides an electronic terminal, including a processor and a memory connected to the processor, wherein a computer program is stored in the memory, and when the computer program is executed by the processor, it is used to implement the above-mentioned dual-channel anomaly detection method based on local entropy and isolated forest.

[0035] Fourthly, this application provides a computer program product, including a computer program / instructions that, when executed by a processor, are used to implement the dual-channel anomaly detection method based on local entropy and isolated forests as described above.

[0036] This application's embodiments can collect multi-dimensional time-series data of device operation in real time. Utilizing variable-step-size sliding window technology, it extracts local data from each sliding window to calculate four statistical indicators and constructs a multi-dimensional entropy model to obtain local entropy scores. Simultaneously, it can use the isolated forest algorithm to calculate isolated forest anomaly scores for the multi-dimensional time-series data and construct a joint scoring model. By dynamically adjusting the weights of the local entropy scores and isolated forest anomaly scores, a joint score is obtained. This allows for the determination of the device's anomaly level based on the joint score and a preset anomaly threshold, achieving accurate extraction of anomaly features. Furthermore, through intelligent collaborative interaction, it improves the intelligence of detection and enables efficient decision-making and collaboration. Therefore, it solves the problems in related technologies, such as difficulty in accurately capturing subtle anomalies in local data distribution, insufficient detection robustness, lack of deep collaboration throughout the entire process, and the potential for information silos leading to decision delays.

[0037] Additional aspects and advantages of this application will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of this application. Attached Figure Description

[0038] The above and / or additional aspects and advantages of this application will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein:

[0039] Figure 1 This is a flowchart of a dual-channel anomaly detection method based on local entropy and isolated forest, according to an embodiment of this application.

[0040] Figure 2 Here is a flowchart of a dual-channel anomaly detection method according to an embodiment of this application;

[0041] Figure 3 This is a schematic diagram illustrating the principle of a dual-channel anomaly detection method based on local entropy and isolated forest according to an embodiment of this application.

[0042] Figure 4 This is a schematic diagram illustrating the principle of data acquisition based on industrial sensors according to an embodiment of this application;

[0043] Figure 5 This is a schematic diagram of a dual-channel anomaly detection system based on local entropy and isolated forest, according to an embodiment of this application. Detailed Implementation

[0044] The technical solution of the present invention will be described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the embodiments and specific features in the embodiments are detailed descriptions of the technical solution of the present application, rather than limitations thereof. In the absence of conflict, the embodiments and technical features in the embodiments can be combined with each other.

[0045] Example 1:

[0046] Figure 1 This is a flowchart illustrating a dual-channel anomaly detection method based on local entropy and isolated forest provided in an embodiment of this application.

[0047] like Figure 1 As shown, this dual-channel anomaly detection method based on local entropy and isolated forests includes the following steps:

[0048] In step S101, multi-dimensional time-series data of the device operation are collected in real time.

[0049] Understandably, multidimensional time-series data includes, but is not limited to, equipment vibration, temperature, and pressure.

[0050] Specifically, in combination Figure 2 As shown, the embodiments of this application can collect equipment operation data in real time through industrial sensors, including time-series characteristics, status parameters, etc., covering multiple dimensions of monitoring indicators such as equipment vibration, temperature, and pressure.

[0051] Furthermore, in this embodiment of the application, the data is preprocessed. To ensure data quality and consistency, noise and outliers are first removed by cleaning, and then the data is organized into a format suitable for analysis. The format is standardized, including unit standardization, timestamp alignment, and data completion. This provides a data foundation for subsequent anomaly detection of the equipment and improves the comprehensiveness of the detection.

[0052] In step S102, the variable step-size sliding window technique is used to extract local data of multidimensional time series data in each sliding window. Four statistical indicators are calculated based on the local data to construct a multidimensional entropy model, and the local entropy value score is obtained based on the multidimensional entropy model.

[0053] In actual implementation, combined with Figure 2 As shown, the embodiments of this application can adopt a "dual-channel" combination strategy, which integrates local entropy analysis and isolated forest algorithm to construct a parallel dual-channel detection architecture of "local entropy analysis + isolated forest algorithm" to jointly complete the identification of data anomalies.

[0054] Optionally, in one embodiment of this application, the variable step-size sliding window technique is used to extract local data from multidimensional time-series data in each sliding window, including: dynamically and adaptively adjusting the size and step size of the sliding window based on the fluctuation characteristics of the multidimensional time-series data, so as to extract local data from each sliding window one by one, wherein the expression for the size of the sliding window is:

[0055] ,

[0056] Where W is the size of the sliding window; The standard deviation of multidimensional time series data; This represents the mean of the multidimensional time series data.

[0057] Specifically, this application employs a variable-step sliding window technique to perform regional analysis on time-series data. The window size W = 50~200ms, and the step size is 1 / 2 to 2 / 3 times the window size. For example, with a window length of 200ms (covering 3-5 vibration cycles of industrial equipment) and a sliding step size of 50ms, data segments are extracted window by window to ensure that the time resolution meets the requirements of real-time monitoring.

[0058] Furthermore, the embodiments of this application can quantify the fluctuation characteristics of multidimensional time-series data in real time, and adaptively adjust according to the data fluctuation frequency. When there is high-frequency fluctuation, the window is automatically reduced and the step size is decreased; when the low frequency is stable, the window is automatically expanded and the step size is increased.

[0059] Preferably, the embodiments of this application can proactively predict fluctuation trends and adjust the window size in advance.

[0060] This application embodiment, by quantifying data fluctuation characteristics in real time and precisely adjusting the window size, can efficiently scan a large range when the data is calm and automatically focus on key subtle changes when there are violent fluctuations, thus achieving truly intelligent anomaly detection.

[0061] Optionally, in one embodiment of this application, a multidimensional entropy model is constructed based on four statistical indicators, including: calculating four statistical indicators—information entropy, rate of change, normalized variance, and randomness index—based on local data; calculating the entropy score E∈[0,100] of the fusion of the four statistics for data within each window; adaptively adjusting the model according to the data sampling frequency; and using the Shannon entropy formula to calculate the information entropy within the window, wherein the expression for information entropy is:

[0062] ,

[0063] Where H is the information entropy; Let be the probability density of the i-th data point within the window; n is the total number of data points in the window.

[0064] Rate of change: Calculates the median of relative fluctuations between adjacent points. The expression for the rate of change is:

[0065] ,

[0066] Where R is the rate of change; For the device running multi-dimensional time series data points acquired at the i-th time point within the sliding window; For the device running multi-dimensional time series data points acquired at time i-1 within the sliding window, and... Data pairs that form adjacent time points; This is the minimum compensation coefficient;

[0067] The expression for normalized variance is:

[0068]

[0069] Where V is the normalized variance; Let x be the standard deviation of the local multidimensional time series data within the sliding window; let x be the set of local multidimensional time series data extracted within the sliding window; max(x) is the maximum value in the set of local multidimensional time series data x within the sliding window; and min(x) is the minimum value in the set of local multidimensional time series data x within the sliding window.

[0070] Randomness index: Based on the runs test, the expression for the randomness index is:

[0071]

[0072] Where S is the randomness index; run_length is the length of the continuous ascending / descending data run within the sliding window; and W is the size of the sliding window.

[0073] Four statistical indicators are used to characterize local data features from four dimensions: data disorder, mutation intensity, fluctuation dispersion, and random continuity. These indicators are then combined with preset weights to construct a multidimensional entropy model through weighted fusion, enabling the capture of multidimensional anomalies. The expression for the multidimensional entropy model is as follows:

[0074]

[0075] Where E is the local entropy score.

[0076] It is understandable that the preset weights refer to the weights of the four statistical indicators determined through gradient boosting tree training; information entropy is used to measure the disorder of data distribution, and the value increases significantly when there are anomalies; the rate of change is used to calculate the relative fluctuation of adjacent data points and sensitively capture abrupt changes; normalized variance is used to reflect the relative relationship between data fluctuation and extreme values; and the randomness index is used to detect the periodicity of data sequences based on the runs test.

[0077] In summary, calculations show that the R value increases by ≥50% in the mutation scenario, the V value deviates from the historical average by ±3σ during abnormal fluctuations, and the S value decreases by ≥20% during periodic anomalies. Furthermore, the weights of the four statistical indicators are determined through gradient boosting tree training, which can improve the sensitivity to abnormal features by 40%. Among them, normal data E∈[20,60], and the higher the anomaly level, the higher the score.

[0078] Furthermore, local entropy analysis supports multi-resolution analysis. By decomposing the data into low-frequency trend components and high-frequency detail components through wavelet transform, entropy scores are calculated separately and then weighted and fused (low-frequency weight 0.7, high-frequency weight 0.3), which can improve the detection capability of composite anomalies.

[0079] The embodiments of this application employ a local entropy analysis algorithm and a sliding window technique. Instead of relying on global information entropy, they combine multiple statistical indicators to perform dynamic data feature analysis, which can discover potential periodic fluctuation anomalies, accurately detect minute changes in data, effectively improve the efficiency and accuracy of processing and analyzing high-dimensional time-series data from industrial sensors, and significantly enhance the accuracy of data preprocessing and anomaly detection.

[0080] In step S103, the isolated forest anomaly score of the multidimensional time series data is calculated using the isolated forest algorithm.

[0081] Optionally, in one embodiment of this application, the isolated forest algorithm is used to calculate the isolated forest anomaly score of multidimensional time-series data, including: dividing the multidimensional time-series data into random subspaces to construct multiple isolated trees based on the generated random subspaces; traversing the multiple isolated trees in each random subspace to obtain the path length and average path length; and obtaining the isolated forest anomaly score based on the path length and average path length, wherein the expression for the isolated forest anomaly score is:

[0082]

[0083] Where S(x) is the isolated forest anomaly score; h(x) is the path length; E[h(x)] is the average path length; and x is the random subspace.

[0084] In actual implementation, this application embodiment can construct n=100~200 isolated trees through random subspace partitioning. Each tree randomly selects k=3~5 high variance features (such as vibration effective value, kurtosis, temperature gradient) and recursively splits them into single sample nodes. The shorter the path length h(x), the stronger the outlier. The formula for the isolated forest anomaly score is used to calculate the outlier score, which is the isolated forest anomaly score S(x)∈[0,1]. For example, the normal data S(x) ranges from 0.3 to 0.6, and the outlier point, which is the isolated forest anomaly score S(x)≥0.8, achieves a detection accuracy of 100% for sudden anomalies such as sensor disconnection, and the detection delay of a single data point is ≤50ms.

[0085] This application utilizes the isolated forest algorithm, which can be used for outlier detection in global data. By constructing multiple random split trees, it can quickly identify sparsely distributed data points in space, thereby finding data that significantly deviates from the normal pattern and improving the efficiency of anomaly detection.

[0086] In step S104, a joint scoring model is constructed based on the local entropy score and the isolated forest anomaly score. The weights of the local entropy score and the isolated forest anomaly score are dynamically adjusted to obtain a joint score based on the joint scoring model. The anomaly level of the device is then determined based on the joint score and a preset anomaly threshold.

[0087] Optionally, in one embodiment of this application, obtaining the joint score based on the joint scoring model includes: generating a joint scoring model by weighting and summing the local entropy score and the isolated forest anomaly score according to dynamically adjusted weights, wherein the expression of the joint scoring model is:

[0088]

[0089] Where J is the joint score; a is the weight of the local entropy score; E is the local entropy score; and S(x) is the isolated forest anomaly score.

[0090] Most notably, the dynamic adjustment of weights is based on the scenario adaptability of dual-channel scores. Specifically, when local data fluctuations are complex (e.g., the standard deviation of data increases by more than 20% in three consecutive windows), the weight of the local entropy score is increased to [0.5-0.7]. When the data distribution is discrete (e.g., the ratio of the data range to the mean exceeds 1.5), the weight of the isolated forest anomaly score is increased to [0.5-0.7]. The weights are optimized through feedback from historical anomaly data and iterative optimization of real-time data features.

[0091] In practical engineering implementation, local entropy values ​​and the isolated forest algorithm can be combined for scoring. A dynamic weighted joint scoring mechanism can be designed to integrate local entropy scores and isolated forest scores, and combine them with adaptive thresholds to determine the anomaly level. The weight of the local entropy score is a = 0.3~0.7, and the weight of the isolated forest score is 1-a = 0.7~0.3. The weight a can be optimized through reinforcement learning. For example, in the wind power equipment monitoring scenario, the F1 value for detecting early gearbox faults can be improved to 0.92, which is 22% higher than that of fixed weights.

[0092] This application's embodiments combine local entropy analysis and the isolated forest algorithm, leveraging their complementary characteristics to solve the challenges in processing global and local data features, thereby improving the accuracy of anomaly detection.

[0093] Optionally, in one embodiment of this application, determining the abnormality level of the device based on the joint score and a preset abnormality threshold includes: determining the abnormality level of the device as normal if the joint score does not exceed the preset abnormality threshold; determining the abnormality level of the device based on the joint score and the preset abnormality threshold if the joint score exceeds the preset abnormality threshold, wherein the preset abnormality threshold includes a warning threshold, a fault threshold, and a severe fault threshold; if the joint score is at the warning threshold, determining the abnormality level of the device as a warning; if the joint score is at the fault threshold, determining the abnormality level of the device as a fault; and if the joint score is at the severe fault threshold, determining the abnormality level of the device as a severe fault.

[0094] In actual implementation, the embodiments of this application can automatically update the abnormal threshold based on historical data statistics and support manual correction to adapt to the operating characteristics of different devices (such as the threshold automatically increasing by 10% in high temperature environments). Then, the abnormal level of the device can be divided according to the abnormal threshold as shown in Table 1. Table 1 is the abnormal level classification table.

[0095] Table 1 Classification of Abnormal Levels

[0096]

[0097] This application embodiment can issue an anomaly alarm when the joint score is detected to exceed a preset anomaly threshold, and classify the data into "early warning", "fault" or "serious fault". Combining the advantages of local entropy analysis and isolated forest algorithm, it can comprehensively and accurately identify and evaluate abnormal data behavior, improve the accuracy and robustness of anomaly detection, enhance the reliability and timeliness of decision-making, and accurately discover potential abnormal behavior in real time to support subsequent decision-making.

[0098] Optionally, in one embodiment of this application, the method further includes: uploading the local entropy score, isolated forest anomaly score, joint score, and anomaly level to the cloud for collaborative decision-making to obtain multi-layer processing results, thereby optimizing the dynamic weights of the joint scoring model; wherein, the multi-layer processing results include: uploading the local entropy score, isolated forest anomaly score, joint score, and anomaly level to the cloud for information interaction to obtain device status information; analyzing and predicting the local entropy score and isolated forest anomaly score to obtain device trend information; and generating a device control strategy based on the joint score and anomaly level.

[0099] This application embodiment can use a weight self-optimization model built in the cloud to map the multi-layer processing results to the adjustment parameters of the dynamic weight of the joint scoring model. For example, the weight correction can be driven by the equipment life data. Real-time equipment life prediction data (such as the remaining equipment life) is input, and the mapping logic can be: if the remaining life is less, the local entropy value score weight is automatically increased; if the remaining life is more, the weight is decreased.

[0100] Specifically, embodiments of this application can integrate the anomaly detection results of the equipment into an industrial intelligent agent system to achieve anomaly information interaction, trend prediction, and control strategy triggering, specifically including:

[0101] Basic intelligent agent: By inputting the joint score, anomaly level (early warning / fault / serious fault), entropy value and isolated forest score details output by the anomaly detection layer, it can respond to basic questions and answers such as device status query and log retrieval in real time, and supports natural language interaction and structured data output.

[0102] Analysis agent: Based on historical detection data (entropy value / isolated forest score sequence) and equipment parameters, it generates in-depth analysis results such as equipment status trend reports and remaining life prediction.

[0103] Control agent: Trigger corresponding strategies based on the anomaly level. Trigger rules can be: Warning (J∈[0.5,0.8)): Encrypt sampling and push work order; Fault (J∈[0.8,0.95)): Reduce load by 15% and generate maintenance plan; Critical fault (J≥0.95): Emergency shutdown and SMS notification to maintenance personnel.

[0104] The specific agent collaboration logic is shown in Table 2, which is a table of agent collaboration logic corresponding to different anomaly levels.

[0105] Table 2. Agent cooperation logic corresponding to different anomaly levels

[0106]

[0107] Furthermore, embodiments of this application can combine an edge-cloud collaborative architecture, deploying a lightweight model at the edge, and through quantization compression and knowledge distillation optimization, reducing resource consumption by 80% compared to traditional deep learning solutions, being compatible with multiple industrial protocols, having a response latency of <50ms, and supporting 72 hours of offline detection and 365 days of historical data storage in the cloud.

[0108] Combination Figure 3 and Figure 4 As shown, an embodiment of the dual-channel anomaly detection method based on local entropy and isolated forest of this application is described in detail.

[0109] Since the abnormal monitoring data is transmitted to the intelligent agent, a platform is provided for interactive feedback in order to present it to users in a more visual way. This platform includes real-time light intensity monitoring, intelligent interaction and decision support, and report generation. The platform adopts a B / S architecture with a front-end and back-end separation design, supports multi-user access, real-time monitoring, data analysis, AI interaction, report generation and other functions, and has good scalability and cross-platform compatibility.

[0110] Front-end modules: HTML5, CSS3, JavaScript, Bootstrap

[0111] Backend module: The Python + Flask framework includes:

[0112] (1) Data Acquisition and Simulation (LightIntensityDataCollector)

[0113] (2) Data Analysis and Alarm Detection (LightIntensityAnalyzer)

[0114] (3) Report generation (LightIntensityReportGenerator)

[0115] (4) AI service interface

[0116] (5) Log recording and management

[0117] The details are as follows:

[0118] 1. Real-time light intensity monitoring module:

[0119] The real-time light intensity monitoring module is a real-time monitoring component that integrates data acquisition, status recognition, and visualization. It continuously acquires ambient light intensity values ​​(in lux) through sensors or analog data sources, dynamically displays the current light intensity, and classifies and marks its status (such as "normal", "abrupt", "gradual change"). It also triggers color indicators (green indicates normal, red indicates abnormal, etc.) based on threshold judgments. At the same time, it provides multi-area comparative monitoring and historical trend charts (displayed at time granularities such as hourly and daily) to achieve comprehensive perception and intuitive presentation of ambient light conditions.

[0120] For example, the LightIntensityDataCollector class collects sensor data once per second;

[0121] The LightIntensityAnalyzer class performs data analysis to determine whether an alert has been triggered.

[0122] If the change in light intensity exceeds the sudden change threshold (default 25%) or the gradual change threshold (default 15%), it will be recorded as an abnormal event.

[0123] All data and analysis results are saved to the data / statistics.json file;

[0124] The front-end page displays the latest light intensity value, trend chart, and alarm status in real time.

[0125] 2. Intelligent Interaction and Decision Support Module:

[0126] This module allows users to input their query requests for real-time light intensity data and historical trend analysis via a dialog box interface or voice interaction, and dynamically generates professional responses based on context-aware technology. It incorporates a hybrid inference mechanism combining multiple mainstream large-scale models and a local rule engine, possessing three levels of fault tolerance (automatically switching to a backup model or predefined template when the primary service fails). At the decision support level, the module can analyze light intensity fluctuation trends (abrupt / gradual) in real time, dynamically calculate energy consumption models, generate equipment health assessment reports, and provide energy-saving optimization suggestions based on historical data and scene characteristics. During interaction, speech synthesis is achieved through the PaddleSpeech speech processing toolkit, supporting multi-turn dialogue memory and adaptive learning of user preferences to continuously optimize response accuracy.

[0127] 3. Report generation module:

[0128] This module provides automated report generation and professional formatting, supporting both PDF and Word output. It features a built-in industry-standard template library, automatically matching templates based on report type (e.g., daily, weekly, alarm-specific reports) and supporting template version management and visual editing. By integrating core information such as real-time light intensity data, historical trend analysis, alarm records, and device status, it automatically generates structured reports including data summaries, anomaly annotations, and comments. Logs contain information on data processing, model inference, and alarm triggering.

[0129] For example, log viewing and downloading include:

[0130] Users can access the / api / system / logs interface to obtain a list of all log files in the logs directory;

[0131] Clicking on a specific log file name calls / api / system / logs / <filename>Interface download log content;

[0132] It supports cross-domain access and is compatible with browsers and API (Application Programming Interface) testing tools.

[0133] Specifically, in combination Figure 3 As shown, the workflow for anomaly detection can be as follows:

[0134] 1. Sensor data access can be combined with... Figure 4 As shown:

[0135] (1) Real-time acquisition of sensor data such as temperature and current through standardized interface protocols;

[0136] (2) Supports access to multiple heterogeneous devices, including industrial PLC devices, IoT terminal devices, and RS485 serial port devices;

[0137] (3) Data acquisition frequency is configurable;

[0138] 2. Data standardization processing can be combined with... Figure 4 As shown:

[0139] (1) Standardize the format of the raw data, including unit standardization, timestamp alignment, and data completion (linear interpolation to handle missing data).

[0140] (2) Perform abnormal data pre-detection, including range detection, mutation detection, and persistent zero value detection.

[0141] 3. Anomaly detection and alarms:

[0142] (1) A "dual-channel" collaborative detection mechanism is adopted, integrating local entropy analysis and the isolated forest algorithm. This improves anomaly identification accuracy through multi-dimensional feature fusion and agent collaboration. The local entropy analysis module segments time-series data using a sliding window technique, extracts four-dimensional features, and calculates the local entropy score using a weighted formula. Normal data scores are typically between 20-60 points, early anomalies rise to 60-80 points, and severe faults exceed 90 points. The basic agent receives the entropy score results in real time and, combined with the global outlier score (0-1 points) from the isolated forest algorithm, generates a joint score, dynamically adjusting the weights to adapt to different scenarios. The analysis agent generates device trend reports and power consumption predictions based on historical score sequences, and the control agent triggers response strategies based on the joint score, achieving closed-loop management from detection to decision-making.

[0143] (2) The system adopts a three-level threshold adjustment strategy, combining a baseline threshold, adaptive optimization, and manual correction to ensure detection sensitivity and stability. The baseline threshold is automatically calculated based on historical data statistics. Manual correction provides a visual interface for maintenance personnel to manually adjust parameters.

[0144] 4. Intelligent Interaction and Report Generation:

[0145] (1) Supports natural language query processing, including voice / text input, and can handle typical queries such as "What was the highest temperature in the past 2 hours?";

[0146] For example, a user enters a question in the chat box;

[0147] The frontend submits the message to the / api / chat interface;

[0148] The backend calls the AI ​​assistant API to retrieve the reply content;

[0149] When a user clicks the "Play Voice" button, the / api / speech interface is called to generate a voice file;

[0150] The audio file is saved to the static / audio directory and a URL is returned for the front end to play.

[0151] (2) Contextual association analysis supports the memory of the last 10 rounds of interaction and has an intelligent questioning mechanism, which can automatically associate information such as the device's historical alarm records and changes in environmental parameters;

[0152] (3) Automated report generation includes standard report templates and custom report functions, and supports exporting to PDF / Excel / CSV formats;

[0153] For example, a user clicks the "Generate Report with One Click" button;

[0154] The frontend sends a POST request to the / api / generate_report interface;

[0155] The backend searches for an existing PDF file in the reports directory as a template.

[0156] Copy the template and generate a report using the new filename, then save it to the reports directory;

[0157] The download link is provided for users to view or export.

[0158] The dual-channel anomaly detection method based on local entropy and isolated forest proposed in this application can collect multi-dimensional time-series data of device operation in real time. It utilizes variable-step-size sliding window technology to extract local data from each sliding window to calculate four statistical indicators and construct a multi-dimensional entropy model to obtain a local entropy score. Simultaneously, it can use the isolated forest algorithm to calculate the isolated forest anomaly score of the multi-dimensional time-series data and construct a joint scoring model. By dynamically adjusting the weights of the local entropy score and the isolated forest anomaly score, a joint score is obtained. This allows for the determination of the device's anomaly level based on the joint score and a preset anomaly threshold, achieving accurate extraction of anomaly features. Furthermore, through intelligent collaborative interaction, it can improve the intelligence of detection and enable efficient decision-making collaboration. Therefore, it solves the problems in related technologies, such as difficulty in accurately capturing subtle anomalies in local data distribution, insufficient detection robustness, lack of deep collaboration throughout the entire process, and the tendency to form information silos, leading to decision-making delays.

[0159] Example 2:

[0160] Next, referring to the accompanying drawings, a dual-channel anomaly detection system based on local entropy and isolated forest proposed according to an embodiment of this application is described.

[0161] Figure 5 This is a schematic diagram of the structure of a dual-channel anomaly detection system based on local entropy and isolated forest, according to an embodiment of this application.

[0162] like Figure 5 As shown, the dual-channel anomaly detection system 10 based on local entropy and isolated forest includes: a data acquisition module 100, a first scoring module 200, a second scoring module 300, and an anomaly determination module 400.

[0163] Specifically, the acquisition module 100 is used to acquire multi-dimensional time-series data of the device operation in real time;

[0164] The first scoring module 200 is used to extract local data of the multidimensional time series data in each sliding window using the variable step size sliding window technique, calculate four statistical indicators based on the local data, construct a multidimensional entropy model based on the four statistical indicators, and obtain a local entropy value score based on the multidimensional entropy model.

[0165] The second scoring module 300 is used to calculate the isolated forest anomaly score of the multidimensional time series data using the isolated forest algorithm.

[0166] The anomaly determination module 400 is used to construct a joint scoring model based on the local entropy score and the isolated forest anomaly score, dynamically adjust the weights of the local entropy score and the isolated forest anomaly score to obtain a joint score according to the joint scoring model, and determine the anomaly level of the device according to the joint score and a preset anomaly threshold.

[0167] It should be noted that the foregoing explanation of the dual-channel anomaly detection method based on local entropy and isolated forest also applies to the dual-channel anomaly detection system based on local entropy and isolated forest in this embodiment, and will not be repeated here.

[0168] The dual-channel anomaly detection system based on local entropy and isolated forest proposed in this application can collect multi-dimensional time-series data of device operation in real time. It utilizes variable-step-size sliding window technology to extract local data from each sliding window to calculate four statistical indicators and construct a multi-dimensional entropy model to obtain a local entropy score. Simultaneously, it can use the isolated forest algorithm to calculate the isolated forest anomaly score of the multi-dimensional time-series data and construct a joint scoring model. By dynamically adjusting the weights of the local entropy score and the isolated forest anomaly score, a joint score is obtained. This allows for the determination of the device's anomaly level based on the joint score and a preset anomaly threshold, achieving accurate extraction of anomaly features. Furthermore, through intelligent collaborative interaction, it can improve the intelligence of detection and enable efficient decision-making and collaboration. Therefore, it solves the problems in related technologies, such as difficulty in accurately capturing subtle anomalies in local data distribution, insufficient detection robustness, lack of deep collaboration throughout the entire process, and the tendency to form information silos, leading to decision-making delays.

[0169] Example 3:

[0170] This invention also provides an electronic terminal, including a processor and a memory connected to the processor. The memory stores a computer program, and when the computer program is executed by the processor, it performs the steps of the dual-channel anomaly detection method based on local entropy and isolated forest described in Embodiment 1.

[0171] Example 4:

[0172] This embodiment provides a computer program product, including a computer program / instruction, characterized in that, when the computer program / instruction is executed by a processor, it implements the steps of the dual-channel anomaly detection method based on local entropy and isolated forest as described in any one of Embodiment 1.

[0173] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0174] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0175] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0176] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0177] The embodiments of the present invention have been described above with reference to the accompanying drawings. However, the present invention is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of the present invention without departing from the spirit and scope of the claims. All of these forms are within the protection scope of the present invention.< / filename>

Claims

1. A dual-channel anomaly detection method based on local entropy and isolated forest, characterized in that, The method includes the following steps: Real-time acquisition of multi-dimensional time-series data of equipment operation; The variable step-size sliding window technique is used to extract local data from the multidimensional time series data in each sliding window. Specified statistical indicators are calculated based on the local data to construct a multidimensional entropy model. Local entropy scores are obtained based on the multidimensional entropy model. The isolated forest algorithm is used to calculate the isolated forest anomaly score of the multidimensional time series data; A joint scoring model is constructed based on the local entropy score and the isolated forest anomaly score. The weights of the local entropy score and the isolated forest anomaly score are dynamically adjusted to obtain a joint score according to the joint scoring model. The anomaly level of the device is then determined based on the joint score and a preset anomaly threshold.

2. The dual-channel anomaly detection method based on local entropy and isolated forest as described in claim 1, characterized in that, The method of extracting local data from each sliding window of the multidimensional time series data using the variable step-size sliding window technique includes: dynamically and adaptively adjusting the size and step size of the sliding window based on the fluctuation characteristics of the multidimensional time series data, so as to extract local data from each sliding window one by one, wherein the expression for the size of the sliding window is: ， Where W is the size of the sliding window; The standard deviation of multidimensional time series data; This represents the mean of the multidimensional time series data.

3. The dual-channel anomaly detection method based on local entropy and isolated forest as described in claim 1, characterized in that, The construction of the multidimensional entropy model based on the specified statistical indicators includes: Based on the local data, four statistical indicators are calculated: information entropy, rate of change, normalized variance, and randomness index. The expression for information entropy is: ， Where H is the information entropy; Let be the probability density of the i-th data point within the window; n is the total number of data points in the window. The expression for the rate of change is: ， Where R is the rate of change; For the device running multi-dimensional time series data points acquired at the i-th time point within the sliding window; For the device running multi-dimensional time series data points acquired at time i-1 within the sliding window, and... Data pairs that form adjacent time points; This is the minimum compensation coefficient; The expression for the normalized variance is: ， Where V is the normalized variance; Let x be the standard deviation of the local multidimensional time series data within the sliding window; let x be the set of local multidimensional time series data extracted within the sliding window; max(x) is the maximum value in the set of local multidimensional time series data x within the sliding window; and min(x) is the minimum value in the set of local multidimensional time series data x within the sliding window. The expression for the randomness index is: ， Where S is the randomness index; run_length is the length of the continuous ascending / descending data run within the sliding window; and W is the size of the sliding window. The four statistical indicators characterize local data features from four dimensions: data disorder, mutation intensity, volatility dispersion, and random continuity. These are then combined with preset weights to construct the multidimensional entropy model through weighted fusion. The expression for the multidimensional entropy model is as follows: ， Where E is the local entropy score.

4. The dual-channel anomaly detection method based on local entropy and isolated forest as described in claim 1, characterized in that, The calculation of the isolated forest anomaly score of the multidimensional time series data using the isolated forest algorithm includes: The multidimensional time-series data is randomly subdivided to construct multiple isolated trees based on the generated random subspaces; Based on each random subspace, the path length and average path length are obtained by traversing multiple isolated trees in each random subspace. The isolated forest anomaly score is obtained based on the path length and the average path length, wherein the expression for the isolated forest anomaly score is: ， Where S(x) is the isolated forest anomaly score; h(x) is the path length; E[h(x)] is the average path length; and x is the random subspace.

5. The dual-channel anomaly detection method based on local entropy and isolated forest according to claim 3 or 4, characterized in that, The process of obtaining the joint score based on the joint scoring model includes: The local entropy score and the isolated forest anomaly score are weighted and summed according to dynamically adjusted weights to generate a joint scoring model, wherein the expression of the joint scoring model is: ， Where J is the joint score; a is the weight of the local entropy score; E is the local entropy score; and S(x) is the isolated forest anomaly score.

6. The dual-channel anomaly detection method based on local entropy and isolated forest as described in claim 1, characterized in that, The step of determining the anomaly level of the device based on the joint score and the preset anomaly threshold includes: If the combined score does not exceed the preset anomaly threshold, the anomaly level of the device is determined to be normal; If the combined score exceeds the preset anomaly threshold, the anomaly level of the device is determined based on the combined score and the preset anomaly threshold, wherein the preset anomaly threshold includes a warning threshold, a fault threshold, and a severe fault threshold; If the combined score is at the warning threshold, the abnormality level of the device is determined to be a warning. If the combined score is at the fault threshold, the abnormality level of the device is determined to be a fault; If the combined score is at the severe fault threshold, the abnormality level of the device is determined to be a severe fault.

7. The dual-channel anomaly detection method based on local entropy and isolated forest as described in claim 1, characterized in that, Also includes: The local entropy score, the isolated forest anomaly score, the joint score, and the anomaly level are uploaded to the cloud for collaborative decision-making to obtain multi-layered processing results, thereby optimizing the dynamic weights of the joint scoring model; wherein, the multi-layered processing results include: The local entropy score, the isolated forest anomaly score, the joint score, and the anomaly level are uploaded to the cloud for information exchange to obtain device status information. The local entropy score and the isolated forest anomaly score are analyzed and predicted to obtain equipment trend information; A device control strategy is generated based on the joint score and the anomaly level.

8. A dual-channel anomaly detection system based on local entropy and isolated forest, characterized in that, The system includes: Acquisition module: Used for real-time acquisition of multi-dimensional time-series data of device operation; The first scoring module is used to extract local data of the multidimensional time series data in each sliding window using the variable step size sliding window technique, calculate four statistical indicators based on the local data, construct a multidimensional entropy model based on the four statistical indicators, and obtain a local entropy value score based on the multidimensional entropy model. The second scoring module is used to calculate the isolated forest anomaly score of the multidimensional time series data using the isolated forest algorithm. Anomaly determination module: used to construct a joint scoring model based on the local entropy score and the isolated forest anomaly score, dynamically adjust the weights of the local entropy score and the isolated forest anomaly score to obtain a joint score according to the joint scoring model, and determine the anomaly level of the device according to the joint score and a preset anomaly threshold.

9. An electronic terminal, characterized in that, The system includes a processor and a memory connected to the processor, wherein a computer program is stored in the memory, and when the computer program is executed by the processor, the steps of the dual-channel anomaly detection method based on local entropy and isolated forest as described in any one of claims 1 to 7 are performed.

10. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instruction is executed by the processor, it implements the steps of the dual-channel anomaly detection method based on local entropy and isolated forest as described in any one of claims 1 to 7.

Images