Alarm analysis method, system, device and medium of internet of things equipment
By constructing a time-series anomaly detection algorithm and an isolated forest model, complex abnormal behaviors of IoT devices are identified, and structured alarm events are generated. This solves the problems of insufficient accuracy and timeliness of alarms in existing technologies and achieves efficient operation and maintenance management.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-01-20
- Publication Date
- 2026-06-09
AI Technical Summary
Existing IoT device monitoring and alarm solutions struggle to identify complex abnormal behaviors, resulting in insufficient accuracy and timeliness of alarms. Furthermore, they lack the ability to conduct macro-level analysis and trend perception of device group behavior patterns, which can easily lead to an "alarm storm" and impact operational efficiency.
Employing a pre-built time-series anomaly detection algorithm, this system collects and structures the status data of IoT devices, uses an isolated forest model to identify abnormal behaviors, generates structured alarm events, and combines visualization and root cause analysis to improve the accuracy and timeliness of alarms.
It has enabled a shift from passive threshold alarms to proactive behavior anomaly detection, improving the accuracy and timeliness of alarms, supporting rapid querying and location of anomalies in individual devices, and enhancing operational efficiency and system observability.
Smart Images
Figure CN122179289A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of remote control technology for Internet of Things (IoT) devices, and more specifically to an alarm analysis method, system, device, and medium for IoT devices. Background Technology
[0002] With the rapid development of IoT technology, a massive number of terminal devices have been connected to the network, enabling widespread sensing and interconnection of the physical world. In this context, real-time monitoring of IoT device status, timely anomaly alerts, and efficient analysis have become crucial for ensuring stable system operation and improving operational efficiency. However, existing IoT device monitoring and alarm solutions generally suffer from technical bottlenecks, making it difficult to meet the increasingly complex and large-scale application needs.
[0003] In terms of anomaly detection mechanisms, existing solutions mostly rely on rule-based judgments based on fixed thresholds. For example, an alarm is triggered only when CPU utilization consistently exceeds 80% or memory usage exceeds a certain preset limit. This method is effective for simple, sudden out-of-bounds metric violations, but it cannot effectively identify complex anomalies that do not violate a single threshold but exhibit deviations in behavioral patterns, such as slow performance degradation, occasional intermittent failures, or abnormal changes in the correlation between multiple metrics. These types of "soft faults" or complex anomalies are often more insidious but are important factors affecting system reliability.
[0004] Moreover, existing systems lack the ability to perform macro-level analysis and trend perception of the behavior patterns of device groups. When local problems begin to spread, or when a batch of related devices experience abnormalities due to root cause events (such as network jitter or service updates), traditional point-based alarms can easily form an "alarm storm." It is difficult for maintenance personnel to quickly identify common patterns, locate the scope of impact, and identify the root cause, resulting in delayed response and an inability to effectively control the impact of the fault. Summary of the Invention
[0005] The purpose of this invention is to provide an alarm analysis method, system, device, and medium for IoT devices. Based on a pre-built time-series anomaly detection algorithm, it compares and analyzes the current state of the device with historical behavior patterns, enabling accurate identification of complex abnormal behaviors and generation of structured alarm events. This achieves a shift from passive threshold alarms to proactive behavior anomaly detection, improving the accuracy and timeliness of alarms.
[0006] To achieve the above objectives, embodiments of the present invention provide an alarm analysis method for Internet of Things (IoT) devices, comprising: Collect status data from IoT devices; The status data of the IoT devices are classified and processed, and then stored in a structured manner. Based on a pre-built time-series anomaly detection algorithm, the state data of stored structured IoT devices is analyzed. By comparing the current state of IoT devices with historical behavior patterns, abnormal behavior is identified and anomaly alarm events containing device identifier, anomaly type and timestamp are generated. It visualizes abnormal device alarm events and abnormal behaviors, and supports status query and location of individual IoT devices.
[0007] Optionally, the status data of the IoT device includes at least one of CPU utilization, CPU temperature, CPU frequency, memory utilization, network connection status, and sensor data; the IoT device asynchronously reports the status data to the message broker server via the MQTT protocol.
[0008] Optionally, the status data of the IoT devices is classified and stored in a structured manner, including: The status data is received, associated with the device identifier, and classified into predefined system, quality of service, network, and sensor alarm types before being stored in a relational database. The alarm data in the relational database is cleaned and converted in format, and an index is created according to the device identifier and stored in the distributed retrieval engine.
[0009] Optionally, based on a pre-built time-series anomaly detection algorithm, the stored structured IoT device status data is analyzed. By comparing the current state of the IoT devices with historical behavior patterns, abnormal behavior is identified and anomaly alarm events containing device identifiers, anomaly types, and timestamps are generated, including: Preprocess the status data of each IoT device to construct a feature vector containing the status features of multiple IoT devices; The feature vectors are input into a pre-constructed isolated forest model, and the average path length of each feature vector in the isolated forest is calculated. The isolated forest model consists of multiple isolated trees. Each isolated tree recursively divides the data space by randomly selecting features and splitting values until each data point is isolated. The path length represents the number of edges traversed from the root of the isolated tree to the corresponding leaf node. The anomaly score for each data point is calculated based on the average path length. If the anomaly score exceeds a preset threshold, the corresponding IoT device is determined to be in an abnormal state, and an anomaly alarm event is generated. The time-series anomaly detection algorithm is an isolated forest anomaly detection algorithm.
[0010] Optionally, the training process of the isolated forest model is as follows: From the historical IoT device status dataset, for the construction of each subsample, random sampling without replacement is used; For each subsample, iteratively construct an isolation tree: In each internal node of the isolation tree, randomly select a feature dimension and randomly select a cut point between the maximum and minimum values of that dimension to recursively divide the state dataset into two subsets until the isolation tree reaches the preset maximum depth limit, or all data points in the current node have the same feature value, or the current node contains a data point. Integrate all the generated isolated trees to form an isolated forest model; The isolated forest model is traversed using the validation dataset, the anomaly score of each sample in the validation dataset is calculated, and a preset threshold for the anomaly score is determined based on a preset anomaly ratio.
[0011] Optionally, the alarm analysis method for the IoT device further includes: aggregating and performing root cause analysis on abnormal alarm events, specifically including: Within a preset analysis time window, duplicate abnormal alarms generated by the same IoT device are merged, and the frequency of alarms occurring for each IoT device or each type of abnormality is counted. Based on the frequency of alarms obtained from statistics, identify high-frequency abnormal IoT devices whose alarm frequency exceeds a preset frequency threshold, or identify abnormal patterns that occur simultaneously on multiple IoT devices. Obtain the physical topology connection relationships or preset business logic association relationships of IoT devices, and construct an IoT device association graph; wherein, the business logic association relationships include direct network connections between devices, data flow dependencies, service call links, or business processing flow dependencies; Within a preset time period, when multiple IoT devices that have direct or indirect connections in the IoT device association graph simultaneously or successively generate abnormal alarms, the timestamps of each alarm are extracted to determine the order in which the alarms occur, and the association strength is quantified based on the connection type and dependency strength between IoT devices in the IoT device association graph. Causal inference is performed based on the chronological order and the quantified correlation strength to identify the root cause IoT device or root cause event that triggers the chain of anomalies.
[0012] Optionally, abnormal device alarm events and behaviors can be visualized, and the status query and location of individual IoT devices can be supported, including: Kibana is used to read alarm data from a distributed search engine and is configured to generate visualization charts including real-time alarm heatmaps, device health status trend charts, and abnormal event timeline charts. The various visualization charts are integrated into a unified dashboard for display, and can be filtered and statistically analyzed by multiple dimensions such as time, frequency of occurrence, device type, and region.
[0013] Secondly, the present invention also provides an alarm analysis system for Internet of Things (IoT) devices, used to implement the alarm analysis method for IoT devices, comprising: The device layer is used to collect and report status data of IoT devices; The communication layer is used to receive and forward the status data; The service layer is used to classify and structure the received status data; The analysis layer is used to execute time-series anomaly detection algorithms, analyze the state data of the stored structured IoT devices, identify abnormal behaviors by comparing the current state of IoT devices with historical behavior patterns, and generate anomaly alarm events containing device identifiers, anomaly types and timestamps. The interaction layer provides a visual display interface and an interface for querying the status of IoT devices.
[0014] Thirdly, the present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of the alarm analysis method for the IoT device described above.
[0015] Fourthly, the present invention also provides a storage medium storing a computer program thereon, wherein the computer program, when executed by a processor, implements the steps of the alarm analysis method for the IoT device described above.
[0016] The above technical solution collects and structures IoT device status data, and based on a pre-built time-series anomaly detection algorithm, compares and analyzes the current device status with historical behavior patterns. This enables accurate identification of complex abnormal behaviors and generation of structured alarm events. It achieves a shift from passive threshold alarms to proactive behavior anomaly detection, improving the accuracy and timeliness of alarms. Simultaneously, it integrates and displays abnormal alarms and device status in a visual manner, supporting rapid querying and location of individual devices, thus improving operational efficiency and system observability.
[0017] Other features and advantages of the embodiments of the present invention will be described in detail in the following detailed description section. Attached Figure Description
[0018] The accompanying drawings are provided to further illustrate embodiments of the present invention and form part of the specification. They are used together with the following detailed description to explain the embodiments of the present invention, but do not constitute a limitation thereof. In the drawings: Figure 1 This is a flowchart of an alarm analysis method for IoT devices provided in an embodiment of the present invention; Figure 2 This is a flowchart of an alarm reporting process provided by an embodiment of the present invention; Figure 3 This is a schematic diagram of the structure of an alarm analysis system for an Internet of Things (IoT) device provided in an embodiment of the present invention; Figure 4 This is a schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation
[0019] Various embodiments of this disclosure will be described more fully in the following detailed description. This disclosure may have various embodiments, and adjustments and changes may be made therein. However, it should be understood that there is no intention to limit the various embodiments of this disclosure to the specific embodiments disclosed herein, but rather this disclosure should be understood to cover all adjustments, equivalents, and / or alternatives falling within the spirit and scope of the various embodiments of this disclosure.
[0020] In the following, the terms “comprising” or “may include”, which may be used in various embodiments of this disclosure, indicate the presence of the disclosed functions or operations and do not limit the addition of one or more functions or operations. Furthermore, as used in various embodiments of this disclosure, the terms “comprising,” “having,” and their cognates are intended only to indicate a specific feature, number, step, operation, or combination of the foregoing and should not be construed as primarily excluding the presence of one or more other features, numbers, steps, operations, or combinations of the foregoing, or the possibility of adding one or more features, numbers, steps, operations, or combinations of the foregoing.
[0021] In various embodiments of this disclosure, the expression "or" or "at least one of A and / or B" includes any combination or all combinations of the words listed simultaneously. For example, the expression "A or B" or "at least one of A and / or B" may include A, may include B, or may include both A and B.
[0022] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0023] See Figure 1 The diagram shows a flowchart of an alarm analysis method for an IoT device in a specific embodiment, including the following execution steps: Step 100: Collect status data of IoT devices.
[0024] Specifically, the status data of the IoT device includes at least one of CPU utilization, CPU temperature, CPU frequency, memory utilization, network connection status, and sensor data; the IoT device asynchronously reports the status data to the message broker server via the MQTT protocol.
[0025] Step 101: Classify the status data of the IoT devices and store it in a structured manner.
[0026] Specifically, when executing step 101, the following steps can be performed: S1010: Receive the status data, associate it with the device identifier, and classify it according to predefined system type, quality of service type, network type and sensor type alarm type before storing it in a relational database.
[0027] S1011: Cleans and converts the format of alarm data in the relational database, creates an index by device identifier, and stores it in the distributed retrieval engine.
[0028] Step 102: Based on the pre-built time-series anomaly detection algorithm, analyze the stored structured IoT device status data, identify abnormal behaviors by comparing the current status of IoT devices with historical behavior patterns, and generate anomaly alarm events containing device identifiers, anomaly types, and timestamps.
[0029] Specifically, when executing step 102, the following steps can be performed: S1020: Preprocess the status data of each IoT device to construct a feature vector containing the status features of multiple IoT devices.
[0030] S1021: Input the feature vectors into the pre-built isolated forest model and calculate the average path length of each feature vector in the isolated forest.
[0031] The isolated forest model consists of multiple isolated trees. Each isolated tree recursively divides the data space by randomly selecting features and splitting values until each data point is isolated. The path length represents the number of edges traversed from the root of the isolated tree to the corresponding leaf node.
[0032] S1022: Calculate the anomaly score for each data point based on the average path length. If the anomaly score exceeds a preset threshold, determine that the corresponding IoT device is in an abnormal state and generate an anomaly alarm event.
[0033] The time-series anomaly detection algorithm is an isolated forest anomaly detection algorithm.
[0034] In one specific implementation, the training process of the isolated forest model includes the following steps: S1: From the historical IoT device state dataset, construct each subsample using random sampling without replacement.
[0035] S2: For each subsample, iteratively construct an isolation tree: In each internal node of the isolation tree, randomly select a feature dimension and randomly select a cut point between the maximum and minimum values of that dimension, recursively dividing the state dataset into two subsets until the isolation tree reaches the preset maximum depth limit, or all data points in the current node have the same feature value, or the current node contains a data point.
[0036] S3: Integrate all the generated isolated trees to form an isolated forest model.
[0037] S4: Use the validation dataset to traverse the isolated forest model, calculate the anomaly score of each sample in the validation dataset, and determine the preset threshold of the anomaly score according to the preset anomaly ratio.
[0038] In one specific embodiment, the alarm analysis method for the Internet of Things (IoT) device further includes: aggregating and performing root cause analysis on abnormal alarm events, specifically including the following steps: SA: Within a preset analysis time window, duplicate abnormal alarms generated by the same IoT device are merged, and the frequency of alarms occurring for each IoT device or each type of abnormality is counted.
[0039] SB: Based on the frequency of alarm occurrences obtained from statistics, identify high-frequency abnormal IoT devices whose alarm occurrence frequency exceeds a preset frequency threshold, or identify specific abnormal patterns that occur simultaneously on multiple IoT devices.
[0040] SC: Obtain the physical topology connection relationship or the preset business logic association relationship of IoT devices, and construct an IoT device association graph; wherein, the business logic association relationship includes direct network connection between devices, data flow dependency, service call link or business processing process dependency relationship.
[0041] SD: Within a preset time period, when multiple IoT devices that have direct or indirect connections in the IoT device association graph simultaneously or successively generate abnormal alarms, the timestamps of each alarm are extracted to determine the order in which the alarms occur, and the association strength is quantified according to the connection type and dependency strength between IoT devices in the IoT device association graph.
[0042] SE: Based on the aforementioned sequence and the quantified correlation strength, perform causal inference to identify the root cause IoT device or root cause event that triggers the chain of anomalies.
[0043] Step 103: Visualize and display abnormal device alarm events and abnormal behaviors, and support status query and location of individual IoT devices.
[0044] Specifically, when executing step 103, the following steps can be performed: S1030: Reads alarm data from the distributed search engine via Kibana and is configured to generate visualization charts including real-time alarm heatmaps, device health status trend charts, and abnormal event timeline charts.
[0045] For example, alarm data includes at least: sensor alarm information: temperature, water immersion, smoke, vulnerability; alarm information from different devices, such as gateway devices: offline, smart gateway devices: black screen; server alarm information: CPU greater than 75%, memory greater than 80%, storage greater than 80%; and business alarm information: data cleaning anomaly, service health status anomaly.
[0046] S1031: Integrate various visualization charts into a unified dashboard for display, and support filtering and statistics by multiple dimensions such as time, frequency of occurrence, device type, and region.
[0047] In one specific implementation, see [reference] Figure 2 , 3 As shown, the alarm reporting process is as follows: The client reports alarm information to the IoT service layer via MQTT for real-time data reporting. Upon receiving the request, the IoT service layer associates the device alarm information with unique identifiers such as device SN / ID, categorizes them into several types such as System, QoE, and Wi-Fi, and saves them into the database. The application service layer filters, processes, and discards the device alarm information (System, QoE, Wi-Fi, etc.), finally sorting it into data such as temperature, CPU alarms, black screen, and memory alarms, and saving it into multiple indexes according to SN into Elasticsearch. Kibana analyzes the cleaned data, configuring the multiple indexes of temperature, CPU alarms, black screen, and memory alarms into multiple charts according to time, frequency of occurrence, and location of occurrence, and finally configuring them into a dashboard to generate a master analysis chart for visualizing the analysis results. Through the HTTP interface, users can query the device image using unique identifiers such as SN and MAC, view current and historical alarms in real time, and locate device status and problems.
[0048] In this embodiment, long-term alarm data collection and monitoring of the equipment is performed. For intermittent problems, the alarm can be located at the time of occurrence based on the actual occurrence time, and the cause of the anomaly can be quickly identified. When operating a large number of devices, alarm collection and statistics can detect anomalies and notify the operator via email, SMS, etc., so as to promptly detect and perceive equipment problems and control the scope of disaster impact. Data is reported in real time using MQTT alarm reporting, which allows real-time viewing of information such as CPU utilization, CPU temperature, and CPU frequency, facilitating real-time analysis of the status of individual devices.
[0049] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.
[0050] The above technical solution collects and structures IoT device status data, and based on a pre-built time-series anomaly detection algorithm, compares and analyzes the current device status with historical behavior patterns. This enables accurate identification of complex abnormal behaviors and generation of structured alarm events. It achieves a shift from passive threshold alarms to proactive behavior anomaly detection, improving the accuracy and timeliness of alarms. Simultaneously, it integrates and displays abnormal alarms and device status in a visual manner, supporting rapid querying and location of individual devices, thus improving operational efficiency and system observability.
[0051] like Figure 3 As shown, the following are embodiments of the alarm analysis system for IoT devices provided in this disclosure. The alarm analysis methods for IoT devices in the above embodiments belong to the same inventive concept. For details not described in detail in the embodiments of the alarm analysis system for IoT devices, please refer to the embodiments of the above-described alarm analysis methods for IoT devices.
[0052] An alarm analysis system for IoT devices, used to implement alarm analysis methods for IoT devices, including: The device layer is used to collect and report status data of IoT devices; The communication layer is used to receive and forward the status data; The service layer is used to classify and structure the received status data; The analysis layer is used to execute time-series anomaly detection algorithms, analyze the state data of the stored structured IoT devices, identify abnormal behaviors by comparing the current state of IoT devices with historical behavior patterns, and generate anomaly alarm events containing device identifiers, anomaly types and timestamps. The interaction layer provides a visual display interface and an interface for querying the status of IoT devices.
[0053] In one specific implementation, see [reference] Figure 3As shown, the top layer is the device layer, containing "IoT devices," which are the system's alarm data collection and reporting terminals, communicating with the next layer via the MQTT protocol. The "IoT devices" connect downwards to the "MQTT Broker" in the communication layer, enabling asynchronous message sending and receiving between devices and the server based on the MQTT protocol, ensuring communication reliability under low bandwidth and unstable networks. The communication layer connects downwards to the service layer, which primarily transforms the alarm information reported by the devices and writes it to MQSQL. The application service layer mainly cleans the data written to MySQL by the upper layer and writes the cleaned data to Elasticsearch (ES), providing conditions for subsequent alarm analysis. After the application service layer, the collected alarm data is categorized and displayed to users. This allows for troubleshooting and analysis of individual devices, and Kibana provides chart visualizations of the ES data, enabling effective analysis of large-scale device anomalies.
[0054] Figure 4 This is a schematic diagram of the hardware structure of an electronic device that implements various embodiments of the present invention.
[0055] The alarm analysis method for IoT devices provided in this application can be applied to electronic devices. Those skilled in the art will understand that the electronic device structure involved in the embodiments of this invention does not constitute a limitation on the electronic device. An electronic device may include more or fewer components than illustrated, or combine certain components, or have different component arrangements. In the embodiments of this invention, the electronic device includes, but is not limited to, laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the embodiments of this application described and / or claimed herein.
[0056] Electronic devices may include processors, external memory interfaces, internal memory, universal serial bus (USB) interfaces, charging management modules, power management modules, batteries, wireless communication modules, audio modules, speakers, microphones, sensor modules, buttons, cameras, displays, and SIM card interfaces, etc.
[0057] It is understood that the structures illustrated in the embodiments of this application do not constitute a specific limitation on the electronic device. In other embodiments of this application, the electronic device may include more or fewer components than illustrated, or combine some components, or split some components, or have different component arrangements. The illustrated components may be implemented in hardware, software, or a combination of software and hardware.
[0058] A processor may include one or more processing units, such as: a central processing unit (CPU), an application processor (AP), a modem processor, a graphics processing unit (GPU), an image signal processor (ISP), a controller, memory, a video codec, a digital signal processor (DSP), a baseband processor, and / or a neural network processing unit (NPU). Different processing units may be independent devices or integrated into one or more processors.
[0059] The processor can serve as the nerve center and command center of an electronic device. The controller can generate operation control signals based on the instruction opcode and timing signals to control the fetching and execution of instructions.
[0060] The processor may also include memory for storing instructions and data. In some embodiments, the memory in the processor is a cache memory. This memory can store instructions or data that the processor has just used or that are used repeatedly. If the processor needs to use the instruction or data again, it can retrieve it directly from this memory. This avoids repeated accesses, reduces processor latency, and thus improves system efficiency.
[0061] An external storage interface (ESI) can be used to connect external memory cards, such as microSD cards, to expand the storage capacity of electronic devices. The external memory card communicates with the processor through the ESI to perform data storage functions, such as saving music and video files on the external memory card.
[0062] Internal memory can be used to store computer executable program code, which includes instructions. The processor executes various functional applications and data processing of electronic devices by running the instructions stored in internal memory. Internal memory can include a program storage area and a data storage area. Internal memory can include high-speed random access memory, and can also include non-volatile memory, such as at least one disk storage device, flash memory device, universal flash storage (UFS), etc.
[0063] Wireless communication functionality in electronic devices can be achieved through antennas, wireless communication modules, modem processors, and baseband processors.
[0064] Wireless communication modules can provide solutions for wireless communication applications in electronic devices, including wireless local area networks (WLANs) (such as wireless fidelity (Wi-Fi) networks), Bluetooth (BT), global navigation satellite system (GNSS), frequency modulation (FM), near field communication (NFC), and infrared (IR) technologies.
[0065] Electronic devices can implement audio functions through audio modules, speakers, receivers, microphones, headphone jacks, and application processors.
[0066] Electronic devices can achieve shooting functions through ISPs, cameras, video codecs, GPUs, displays, and application processors.
[0067] Electronic devices can achieve display functions through GPUs, displays, and application processors.
[0068] A GPU is a microprocessor for image processing, connected to the display screen and application processor. GPUs are used to perform mathematical and geometric calculations for graphics rendering. A processor may include one or more GPUs, which execute program instructions to generate or modify display information.
[0069] A display screen is used to display images, videos, etc. A display screen includes a display panel.
[0070] The storage medium provided in this application stores a program product capable of implementing an alarm analysis method for Internet of Things (IoT) devices.
[0071] The alarm analysis method for IoT devices includes: collecting status data of IoT devices; classifying and storing the status data of IoT devices in a structured manner; analyzing the stored structured status data of IoT devices based on a pre-built time-series anomaly detection algorithm, identifying abnormal behaviors and generating anomaly alarm events containing device identifiers, anomaly types, and timestamps by comparing the current status of IoT devices with historical behavior patterns; visualizing the device anomaly alarm events and abnormal behaviors, and supporting status query and location of individual IoT devices.
[0072] In some possible implementations, the subject matter of this disclosure, namely, the alarm analysis method and system for Internet of Things devices, can be implemented as a program product including program code. When the program product is run on a terminal device, the program code is used to cause the terminal device to perform the steps described in the "Exemplary Methods" section above according to various exemplary embodiments of this disclosure.
[0073] The storage medium disclosed herein may be any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples (a non-exhaustive list) of readable storage media include: an electrical connection having one or more wires, a portable disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof.
[0074] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.
Claims
1. A method for alarm analysis of Internet of Things (IoT) devices, characterized in that, include: Collect status data from IoT devices; The status data of the IoT devices are classified and stored in a structured manner. Based on a pre-built time-series anomaly detection algorithm, the state data of stored structured IoT devices is analyzed. By comparing the current state of IoT devices with historical behavior patterns, abnormal behavior is identified and anomaly alarm events containing device identifier, anomaly type and timestamp are generated. It visualizes abnormal device alarm events and abnormal behaviors, and supports status query and location of individual IoT devices.
2. The alarm analysis method for IoT devices according to claim 1, characterized in that, The status data of the IoT device includes at least one of CPU utilization, CPU temperature, CPU frequency, memory utilization, network connection status, and sensor data; the IoT device asynchronously reports the status data to the message broker server via the MQTT protocol.
3. The alarm analysis method for IoT devices according to claim 1, characterized in that, The status data of the IoT devices is classified and stored in a structured manner, including: The status data is received, associated with the device identifier, and classified into predefined alarm types such as system type, quality of service type, network type, and sensor type before being stored in a relational database. The alarm data in the relational database is cleaned and converted in format, and an index is created according to the device identifier and stored in the distributed retrieval engine.
4. The alarm analysis method for IoT devices according to claim 1, characterized in that, Based on a pre-built time-series anomaly detection algorithm, the stored structured IoT device status data is analyzed. By comparing the current state of IoT devices with historical behavior patterns, abnormal behaviors are identified and anomaly alarm events containing device identifiers, anomaly types, and timestamps are generated, including: Preprocess the status data of each IoT device to construct a feature vector containing the status features of multiple IoT devices; The feature vectors are input into a pre-constructed isolated forest model, and the average path length of each feature vector in the isolated forest is calculated. The isolated forest model consists of multiple isolated trees. Each isolated tree recursively divides the data space by randomly selecting features and splitting values until each data point is isolated. The path length represents the number of edges traversed from the root of the isolated tree to the corresponding leaf node. The anomaly score for each data point is calculated based on the average path length. If the anomaly score exceeds a preset threshold, the corresponding IoT device is determined to be in an abnormal state, and an anomaly alarm event is generated. The temporal anomaly detection algorithm is an isolated forest anomaly detection algorithm.
5. The alarm analysis method for IoT devices according to claim 4, characterized in that, The training process of the isolated forest model is as follows: From the historical IoT device status dataset, for the construction of each subsample, random sampling without replacement is used; For each subsample, iteratively construct an isolation tree: In each internal node of the isolation tree, randomly select a feature dimension and randomly select a cut point between the maximum and minimum values of that dimension to recursively divide the state dataset into two subsets until the isolation tree reaches the preset maximum depth limit, or all data points in the current node have the same feature value, or the current node contains a data point. Integrate all the generated isolated trees to form an isolated forest model; The isolated forest model is traversed using the validation dataset, the anomaly score of each sample in the validation dataset is calculated, and a preset threshold for the anomaly score is determined based on a preset anomaly ratio.
6. The alarm analysis method for IoT devices according to claim 4, characterized in that, The alarm analysis method for IoT devices further includes: aggregating and performing root cause analysis on abnormal alarm events, specifically including: Within a preset analysis time window, duplicate abnormal alarms generated by the same IoT device are merged, and the frequency of alarms occurring for each IoT device or each type of abnormality is counted. Based on the frequency of alarms obtained from statistics, identify high-frequency abnormal IoT devices whose alarm frequency exceeds a preset frequency threshold, or identify abnormal patterns that occur simultaneously on multiple IoT devices. Obtain the physical topology connection relationships or preset business logic association relationships of IoT devices, and construct an IoT device association graph; wherein, the business logic association relationships include direct network connections between devices, data flow dependencies, service call links, or business processing flow dependencies; Within a preset time period, when multiple IoT devices that have direct or indirect connections in the IoT device association graph simultaneously or successively generate abnormal alarms, the timestamps of each alarm are extracted to determine the order in which the alarms occur, and the association strength is quantified based on the connection type and dependency strength between IoT devices in the IoT device association graph. Causal inference is performed based on the chronological order and the quantified correlation strength to identify the root cause IoT device or root cause event that triggers the chain of anomalies.
7. The alarm analysis method for IoT devices according to claim 3, characterized in that, Visualize device anomaly alarms and abnormal behaviors, and support status query and location of individual IoT devices, including: Kibana is used to read alarm data from a distributed search engine and is configured to generate visualization charts including real-time alarm heatmaps, device health status trend charts, and abnormal event timeline charts. The various visualization charts are integrated into a unified dashboard for display, and can be filtered and statistically analyzed by multiple dimensions such as time, frequency of occurrence, device type, and region.
8. An alarm analysis system for Internet of Things (IoT) devices, used to implement the alarm analysis method for IoT devices according to any one of claims 1-7, characterized in that, include: The device layer is used to collect and report status data of IoT devices; The communication layer is used to receive and forward the status data; The service layer is used to classify and structure the received status data; The analysis layer is used to execute time-series anomaly detection algorithms, analyze the state data of the stored structured IoT devices, identify abnormal behaviors by comparing the current state of IoT devices with historical behavior patterns, and generate anomaly alarm events containing device identifiers, anomaly types and timestamps. The interaction layer provides a visual display interface and an interface for querying the status of IoT devices.
9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the alarm analysis method for the Internet of Things device as described in any one of claims 1 to 7.
10. A storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the alarm analysis method for the Internet of Things device as described in any one of claims 1 to 7.