A device anomaly detection method and system with a layered architecture

Abstract

This invention provides a device anomaly detection method and system with a layered architecture, comprising: determining a first server and a second server according to preset conditions in a multi-layered network; pre-storing a first instance model in the first server and a second instance model in the second server; acquiring observation data of the device through the first server; inputting the observation data into the first instance model to obtain first reconstructed data, thereby obtaining a first data anomaly detection result; if the first data anomaly detection result indicates that the difference between the first reconstructed error and a preset anomaly threshold is less than a preset difference threshold, forwarding the observation data to the second server through the first server; inputting the observation data into the second instance model to obtain second reconstructed data, thereby obtaining a second data anomaly detection result. This invention improves the accuracy and efficiency of anomaly detection and avoids unnecessary computation and communication overhead in the transmission network and central platform.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and in particular to a method and system for detecting device anomalies in a layered architecture. Background Technology

[0002] Anomaly detection refers to a method for detecting the operational status of devices by analyzing target data streams and their implicit data patterns. In modern industrial applications, a large number of devices are deployed to carry out related target tasks. The occurrence of abnormal data may lead to production interruptions, reduced operational efficiency, and even affect product quality. Therefore, early detection and handling of abnormal data is of great significance for ensuring the smooth operation of IoT-related applications. To ensure the stable operation of the overall IoT platform, it is necessary to ensure the long-term normal operation of subordinate devices. However, these devices are characterized by dispersed deployment locations, complex operating conditions, massive data uploads, and long task durations, making it difficult to use manual training and on-call methods to detect the operational status of deployed device nodes. To achieve automated and adaptive operational status analysis of these devices, anomaly detection algorithms are needed.

[0003] Currently, existing mainstream anomaly detection solutions mainly fall into two categories: 1) distributed deployment solutions that deploy models to devices; and 2) centralized deployment solutions that aggregate and process data. The first type of solution, to adapt to the computing power and energy consumption of relevant terminal nodes, requires a trade-off between model complexity and operational efficiency to ensure the stable and normal operation of the algorithm model on IoT terminal nodes without affecting the normal operation of other services. Limited by computing power and energy consumption, this type of solution often only allows for the deployment of relatively simplified models, leaving room for improvement in anomaly detection performance. The second type of solution leverages the ample computing resources of cloud centers to drive more powerful end-to-end anomaly detection solutions. However, this type of solution requires all nodes under test to report full data, leading to excessive consumption of communication and computing resources and shortening the node's endurance.

[0004] In summary, existing anomaly detection solutions cannot adequately adapt to the limitations of computing resources, memory resources, communication resources, and battery life of the devices under test in IoT application scenarios. Furthermore, they cannot directly utilize the computing resources of each layer in the common "cloud-edge-device" multi-layer architecture of IoT applications. Summary of the Invention

[0005] The embodiments of the present invention provide a method and system for detecting device anomalies in a layered architecture, thereby overcoming the deficiencies of the prior art.

[0006] To achieve the above objectives, the present invention adopts the following technical solution.

[0007] In a first aspect, the present invention provides a method for detecting device anomalies in a layered architecture, comprising:

[0008] In a multi-layer network, a first server and a second server are determined according to preset conditions; the preset conditions include at least one or more of the following: the distance between the device and different servers, the network structure in which the device is located, and the connection topology; the first server pre-stores a first instance model, which is a lightweight variational autoencoder, and the second server pre-stores a second instance model, which is a full variational autoencoder.

[0009] The device's observation data is obtained through the first server;

[0010] The observation data is input into the first instance model to obtain the first reconstructed data;

[0011] A first data anomaly detection result is obtained based on the first reconstruction error between the first reconstructed data and the observed data;

[0012] If the first data anomaly detection result indicates that the difference between the first reconstruction error and the preset anomaly threshold is less than the preset difference threshold, the observation data is forwarded to the second server through the first server.

[0013] The observation data is input into the second instance model to obtain the second reconstruction data;

[0014] The second data anomaly detection result is obtained based on the second reconstruction error between the second reconstructed data and the observed data;

[0015] The first instance model or the second instance model is obtained by adjusting the structure, layer depth, number of nodes or convolutional kernel size in the pre-trained variational autoencoder according to the computing power of the server and the network level.

[0016] Optionally, the difference threshold is a confidence threshold, which is dynamically generated based on the resource usage of the first server, the backhaul network usage, and the topological complexity between the device and the first server.

[0017] Optionally, the pre-trained variational autoencoder is trained based on a preset loss function, which is a loss function including a penalty term:

[0018]

[0019] Where a and b are predefined constant values, and η is a trainable penalty term. p is the posterior distribution expectation. θ (x|z) is the likelihood distribution of the generative model, p θ (z) represents the latent variable distribution. Let x be the posterior distribution, x be the observed data, and z be the latent variable.

[0020] Optionally, after obtaining the first data anomaly detection result based on the first reconstruction error between the first reconstructed data and the observed data, the method further includes:

[0021] If the first data anomaly detection result indicates that the difference between the first reconstruction error and the preset anomaly threshold exceeds the preset difference threshold, the first data anomaly detection result will be output as the final data anomaly detection result.

[0022] Optionally, before inputting the observation data into the first instance model to obtain the first reconstructed data, the method further includes:

[0023] The maximum and minimum values ​​of each channel under the observation data are determined based on the type of the observation data and prior knowledge.

[0024] The observed data is scaled based on the maximum and minimum values ​​to obtain scaled data.

[0025] The scaled data is subjected to numerical clamping to obtain clamped data;

[0026] Perform a sliding window segmentation operation on the clamped data to obtain the segmented data;

[0027] Accordingly, inputting the observation data into the first instance model to obtain the first reconstructed data includes:

[0028] The fragmented data is input into the first instance model to obtain the first reconstructed data.

[0029] Optionally, obtaining the first data anomaly detection result based on the first reconstruction error between the first reconstructed data and the observed data includes:

[0030] A first reconstruction error is obtained by calculating the first reconstructed data and the observed data using a preset reconstruction error calculation algorithm; wherein the preset reconstruction error calculation algorithm is at least one of mean absolute error calculation, mean squared error calculation, or cross-entropy calculation.

[0031] The anomaly threshold is determined based on the distribution pattern of the first reconstruction error in historical observation data;

[0032] The reconstruction error is determined based on the anomaly threshold to obtain the data anomaly detection result.

[0033] Optionally, after inputting the observation data into the first instance model to obtain the first reconstructed data, the method further includes:

[0034] The observed data and the first reconstructed data are input into a pre-trained classification model to obtain the first data anomaly detection result;

[0035] The pre-trained classification model is a deep learning model, trained based on historical observation data and the reconstructed data corresponding to the historical observation data.

[0036] Secondly, the present invention also provides a layered architecture device anomaly detection system, comprising:

[0037] The server determination module is used to determine a first server and a second server in a multi-layer network according to preset conditions. The preset conditions include at least one or more of the following: the distance between the device and different servers, the network structure in which the device is located, and the connection topology. The first server has a first instance model pre-stored, which is a lightweight variational autoencoder, and the second server has a second instance model pre-stored, which is a full variational autoencoder.

[0038] The data acquisition module is used to acquire observation data of the device through the first server;

[0039] The first data reconstruction module is used to input the observation data into the first instance model to obtain the first reconstructed data;

[0040] The first anomaly detection module is used to obtain a first data anomaly detection result based on the first reconstruction error between the first reconstructed data and the observed data.

[0041] The data forwarding module is used to forward the observation data to the second server through the first server when the first data anomaly detection result indicates that the difference between the first reconstruction error and the preset anomaly threshold is less than the preset difference threshold.

[0042] The second data reconstruction module is used to input the observation data into the second instance model to obtain the second reconstructed data;

[0043] The second anomaly detection module is used to obtain a second data anomaly detection result based on the second reconstruction error between the second reconstructed data and the observed data.

[0044] The first instance model or the second instance model is obtained by adjusting the structure, layer depth, number of nodes or convolutional kernel size in the pre-trained variational autoencoder according to the computing power of the server and the network level.

[0045] Thirdly, the present invention also provides an electronic device, including a memory and a processor, wherein the processor and the memory communicate with each other, the memory stores program instructions that can be executed by the processor, and the processor calls the program instructions to execute the device anomaly detection method with the above-described hierarchical architecture.

[0046] Fourthly, the present invention also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the device anomaly detection method with the layered architecture described above.

[0047] The beneficial effects of this invention are as follows: The layered architecture device anomaly detection method and system provided by this invention, during the anomaly detection operation, distributes the computational load for large-scale anomaly detection scenarios through the variational autoencoder in the first server. That is, the observation data is reconstructed by the first instance model distributed in different servers, and the anomaly of the observation data is determined based on the reconstruction error between the reconstructed data and the observation data. Based on the confidence level of the reconstruction error, it is determined whether the observation data needs to be forwarded to the second server for anomaly detection again. This improves the accuracy and efficiency of anomaly detection. Furthermore, it effectively utilizes the layered structure in the Internet of Things environment to distribute the computational load of the anomaly detection model, avoids unnecessary computation and communication overhead between the transmission network and the central platform, effectively improves the timeliness of anomaly detection, protects the overall operational efficiency of the business under the platform, increases the added value of the product, and enhances the competitiveness of the product.

[0048] Additional aspects and advantages of the invention will be set forth in part in the description which follows, and will become apparent from the description or may be learned by practice of the invention. Attached Figure Description

[0049] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0050] Figure 1 A flowchart illustrating a layered architecture device anomaly detection method provided in an embodiment of the present invention;

[0051] Figure 2 This is a schematic diagram of the variational autoencoder structure provided in an embodiment of the present invention;

[0052] Figure 3 This is a schematic diagram of the basic framework of cloud-edge-device provided in an embodiment of the present invention. Detailed Implementation

[0053] Embodiments of the present invention are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and should not be construed as limiting the present invention.

[0054] Those skilled in the art will understand that, unless specifically stated otherwise, the singular forms “a,” “an,” “the,” and “the” used herein may also include the plural forms. It should be further understood that the term “comprising” as used in this specification means the presence of features, integers, steps, operations, elements, and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof. It should be understood that when we say an element is “connected” or “coupled” to another element, it can be directly connected or coupled to the other element, or there may be intermediate elements. Furthermore, “connected” or “coupled” as used herein can include wireless connections or couplings. The term “and / or” as used herein includes any and all combinations of one or more of the associated listed items.

[0055] It will be understood by those skilled in the art that, unless otherwise defined, all terms used herein (including technical and scientific terms) have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains. It should also be understood that terms such as those defined in general dictionaries should be understood to have the same meaning as in the context of the prior art, and should not be interpreted in an idealized or overly formal sense unless defined as herein.

[0056] To facilitate understanding of the embodiments of the present invention, the following will provide further explanation and description with reference to the accompanying drawings and several specific embodiments. These embodiments do not constitute a limitation on the embodiments of the present invention.

[0057] Example 1

[0058] Figure 1 A flowchart illustrating a layered architecture device anomaly detection method provided in an embodiment of the present invention; as shown below. Figure 1 As shown, a device anomaly detection method with a layered architecture includes the following steps:

[0059] S101, in a multi-layer network hierarchy, the first server and the second server are determined according to preset conditions.

[0060] The preset conditions include at least one or more of the following: the distance between the device and different servers, the network structure in which the device is located, and the connection topology. The first server pre-stores a first instance model, which is a lightweight variational autoencoder (VAE). The second server pre-stores a second instance model, which is a full variational autoencoder. The first or second instance model is obtained by adjusting the structure, layer depth, number of nodes, or convolutional kernel size of a pre-trained variational autoencoder (VAE model) according to the computing power of the server and the network level it is in.

[0061] The pre-trained variational autoencoder is trained based on historical data, which is at least one or more of the following: device perception data, device occupancy data, attribute data, call data, or interconnection information between devices.

[0062] It should be noted here that the VAE model deployed on the second server is the full model designed without excessive consideration of computational overhead.

[0063] In IoT or IT scenarios, some servers located close to the device being monitored (i.e., the first server) are limited by space, energy, heat dissipation, and cost, and cannot be configured with the same hardware resources as the second server. Therefore, adjustments to the full variational autoencoder are necessary. The adjustment process specifically includes:

[0064] The number of layers in the variational autoencoder is reduced: based on the full model, some intermediate layers are removed.

[0065] Simplify some convolutional layers of the variational autoencoder: Based on the full model, adjust by reducing the number of convolutional kernels in some convolutional layers, or reduce the number of stacked convolutional layers.

[0066] The fully connected layers of the variational autoencoder are simplified: based on the full model, the number of hidden layer nodes in some of the fully connected layers is reduced.

[0067] The residual layers of the variational autoencoder are simplified: based on the full model, the depth of some residual layers is simplified.

[0068] The lightweight VAE model, namely the first instance model, is obtained through the above simplification methods.

[0069] The relevant servers need to be determined by taking into account factors such as the distance between the device and different servers, network architecture, and connection topology.

[0070] Additionally, it's important to note that the server hosting the variational autoencoder (VAC) training process may or may not overlap with the server where the VAC is ultimately deployed. This means that the VAC can be trained on suitable hardware with sufficient computing power. After adjustments, individual instance models are created and deployed on different servers within the network architecture to enable rapid anomaly detection in the observed data. Alternatively, the VAC can be trained on a cloud server within the network architecture, and then the instance models can be deployed on edge servers for fine-tuning. Furthermore, to ensure that the normal data patterns learned by the VAC match the latest business data, the VAC will undergo periodic training.

[0071] S102, Obtain the device's observation data through the first server.

[0072] In this step, after determining the first server, the observation data returned by different terminal devices is obtained through the first server. More specifically, this can be IoT devices in an IoT environment, or devices in any computer network architecture environment with a layered architecture; this invention does not limit this. Furthermore, the observation data includes, but is not limited to, the sensing data returned by the device, the occupancy data, attribute data, and call status of various modules on the device, and the interconnection information between devices.

[0073] S103, the observation data is input into the first instance model to obtain the first reconstruction data.

[0074] In this step, the observed data are reconstructed using the first instance model, such as... Figure 2 As shown, the first instance model (i.e., the lightweight VAE model) includes an encoder and a decoder. The encoder includes convolutional layers and recurrent neural network layers (specifically, a long short-term memory network), which map data from a high-dimensional space to a low-dimensional space; the decoder includes inverse convolutional layers and recurrent neural network layers, which are used to reconstruct data from a low-dimensional space to a high-dimensional space.

[0075] In the encoding part, the variational autoencoder will learn the data x. t The representation of the input data is obtained, thereby generating the corresponding latent space. In the decoding part, the variational autoencoder generates the mean vector μ of the input data based on the pattern learned in the encoding part. t With the log variance vector δ t 2 Based on these two vectors, a sampling operation is performed to generate the hidden layer representation vector z for the decoder, which is then used to reconstruct the reconstructed data.

[0076] S104, obtain a first data anomaly detection result based on the first reconstruction error between the first reconstructed data and the observed data.

[0077] In this step, the reconstruction error between the first reconstructed data and the observed data is calculated using MSE (Mean Squared Error), MAE (Mean Average Error), and CE (Cross Entropy). Based on the calculated first reconstruction error, it is determined whether the observed data is abnormal data.

[0078] S105, if the first data anomaly detection result indicates that the difference between the first reconstruction error and the preset anomaly threshold is less than the preset difference threshold, the observation data is forwarded to the second server through the first server.

[0079] The difference threshold is a confidence threshold, which is dynamically generated based on the resource usage of the first server, the backhaul network usage, and the topological complexity between the device and the first server.

[0080] Additionally, in this step, there may be multiple second servers that are equidistant from the data source (i.e., the first server running the simplified model). All equidistant second servers constitute a second server group. The first server can forward the observation data to a specific second server within the second server group. This specific second server is determined by engineers according to predefined forwarding rules.

[0081] In addition, in this embodiment, the second server is a cloud server. In other embodiments of the present invention, the second server may also be a server at a higher level than the first server. In this scenario, the second instance model has more parameters than the first instance model, but it is not the full VAE model, thus still achieving layered detection. In this multi-level network, the flow direction of data from lower-level servers to higher-level servers is predefined by engineers.

[0082] If the first data anomaly detection result indicates that the difference between the first reconstruction error and the preset anomaly threshold exceeds the preset difference threshold, the first data anomaly detection result will be output as the final data anomaly detection result.

[0083] S106, The observation data is input into the second instance model to obtain the second reconstruction data.

[0084] The data reconstruction process is similar to that of the first instance model, and will not be described in detail here.

[0085] S107, a second data anomaly detection result is obtained based on the second reconstruction error between the second reconstructed data and the observed data. The process of obtaining the second data anomaly detection result is similar to that of obtaining the first data anomaly detection result, and will not be described in detail here.

[0086] More specifically, based on the VAE instance models with different parameter counts mentioned above, this invention deploys the low-parameter model on a server close to the data source (i.e., close to the device generating the observation data), and deploys the high-parameter model on a cloud server (in a multi-layered "cloud-edge-device" architecture). This deployment scheme effectively distributes most of the computational load on the server close to the data source, avoiding unnecessary backhaul tasks on the transmission network. Furthermore, based on the output results of the low-parameter model, further judgment is made. When the reconstruction error of a data slice is near a preset anomaly threshold, the data slice is forwarded and a secondary confirmation is performed using the high-parameter model. When the reconstruction error of a data slice is far from the preset anomaly threshold, the corresponding anomaly detection result is taken as the final result.

[0087] like Figure 3 As shown, the following example illustrates an IoT scenario with a "cloud-edge" two-layer architecture. This scenario includes a cloud server (application layer), n edge servers (network layer), and multiple devices to be detected (sensing layer). Cloud devices possess strong computing, storage, and communication resources, but due to their distance from the data generation node, they cannot generate relatively low-latency responses to the relevant data. Edge devices, with relatively limited computing, storage, and communication resources, are deployed near the data generation node to share some of the computing tasks. Because of their closer physical distance to the data source, these devices can generate low-latency responses to the target data. For ease of description, the lightweight variational autoencoder instance on the edge is denoted as M2 (the first instance model), and the full variational autoencoder instance on the cloud is denoted as M1 (the second instance model).

[0088] Specifically, taking time step t as an example, at time step t, the sliced ​​data obtained is x. t-L+1:t First, model M2 of edge load is used to evaluate x. t-L+1:t Perform data reconstruction to obtain reconstructed data. Then based on the reconstruction data The reconstruction error is calculated using the observation data.

[0089] To determine whether a data slice at time step t is abnormal, it is necessary to determine the relationship between the reconstruction error and the corresponding threshold. Here, the reconstruction error is denoted as e, and the corresponding anomaly threshold is denoted as n. Considering that the M2 model has a small number of parameters, its inference time and computational resources are relatively small, but its inference accuracy may be poor. To address this issue, this invention proposes a confidence-based data forwarding scheme.

[0090] Specifically, based on the reconstruction error e and its anomaly threshold n, it is determined whether the data slice at the relevant time step t is abnormal. When the reconstruction error e is far from the anomaly threshold n, the data anomaly detection result on the edge server is considered accurate and effective. That is, when the reconstruction error is small enough, there is sufficient reason to believe that the data at that time step is normal data; when the reconstruction error is large enough, there is sufficient reason to believe that the data at that time step is abnormal data.

[0091] When the reconstruction error is close to the anomaly threshold n, the confidence level of the discrimination result generated by model M2 is considered to be low.

[0092] To address situations with low confidence levels, this invention constructs a "confidence-forwarding" relationship based on prior knowledge, expert information, and other conditions. Specifically, based on fundamental information such as the current resource usage of cloud devices and the connectivity of the current transmission network, a confidence threshold m is dynamically generated. The confidence level of the discrimination result is then determined based on the confidence threshold m (i.e., the difference threshold), building upon the anomaly threshold n. That is, when the reconstruction error e is within the range n ± m, the relevant discrimination result is considered unreliable; otherwise, the relevant discrimination result is accepted.

[0093] The aforementioned method for dynamically generating the confidence threshold m can be either calculated based on basic information using a pre-designed formula, or calculated using deep learning schemes such as CNN (Convolutional Neural Networks) models.

[0094] It should be noted that the anomaly threshold is fixed and obtained during VAE model training. The difference threshold, on the other hand, is used to determine whether the anomaly detection result represented by the first reconstruction error is reliable or unreliable. If unreliable, the data is forwarded to the second server for re-judgment using the second model. In other words, the aforementioned difference threshold is a confidence threshold dynamically generated based on information such as the current resource usage of the first server, the backhaul network usage, and the topological complexity of the device under test relative to the first server.

[0095] When the judgment result generated by model M2 is unreliable at a certain time step, a data forwarding operation is initiated on the first server. Through the connection path established between the edge device and the cloud device, the data slice x that has generated unreliable judgment results using model M2 is forwarded. t-L+1:t Uploaded to the cloud, using the full model M1 on the cloud to analyze x. t-L+1:t Perform data reconstruction to obtain reconstructed data. This leads to the reconstruction error. After comparing the reconstruction error (e) with the corresponding threshold (n), the output is the data slice x. t-L+1:t The result of whether it is abnormal shall be used as the final result.

[0096] According to the device anomaly detection method with a layered architecture provided by the present invention, during the anomaly detection operation, the computational load for large-scale anomaly detection scenarios is distributed through the variational autoencoder in the first server. That is, the observation data is reconstructed by the first instance model distributed in different servers, and the anomaly of the observation data is determined based on the reconstruction error between the reconstructed data and the observation data. Based on the confidence level of the reconstruction error, it is determined whether the observation data needs to be forwarded to the second server for anomaly detection again. This improves the accuracy and efficiency of anomaly detection, and effectively utilizes the layered structure in the Internet of Things environment to distribute the computational load of the anomaly detection model, avoiding unnecessary computation and communication overhead on the transmission network and the central platform, effectively improving the timeliness of anomaly detection, protecting the overall operational efficiency of the business under the platform, increasing the added value of the product, and improving the competitiveness of the product.

[0097] Furthermore, based on the above embodiments, the pre-trained variational autoencoder is trained using a preset loss function, which is a loss function including a penalty term:

[0098]

[0099] Where a and b are predefined constant values, and η is a trainable penalty term. p is the posterior distribution expectation. θ (x|z) is the likelihood distribution of the generative model, p θ (z) represents the latent variable distribution. Let x be the posterior distribution, x be the observed data, and z be the latent variable.

[0100] In this embodiment, to further improve the performance of the variational autoencoder, the loss function in the existing variational autoencoder is improved, specifically:

[0101] The loss function Loss' in the existing variational autoencoder is:

[0102]

[0103] The two parts of Loss' mentioned above exhibit an imbalance in numerical range. To better match the numerical relationship between the two parts, this invention proposes adding a penalty term to Loss' to stabilize the convergence of the variational autoencoder in practical implementation. The modified loss function Loss is as follows:

[0104]

[0105] The device anomaly detection method with a hierarchical architecture provided by the present invention improves the performance of the variational autoencoder by adding a penalty term to the loss function of the existing variational autoencoder.

[0106] Furthermore, before inputting the observation data into the first instance model to obtain the first reconstructed data, the method further includes:

[0107] The maximum and minimum values ​​of each channel under the observation data are determined based on the type of the observation data and prior knowledge.

[0108] The observed data is scaled based on the maximum and minimum values ​​to obtain scaled data.

[0109] The scaled data is subjected to numerical clamping to obtain clamped data;

[0110] Perform a sliding window segmentation operation on the clamped data to obtain the segmented data;

[0111] Accordingly, inputting the observation data into the first instance model to obtain the first reconstructed data includes:

[0112] The fragmented data is input into the first instance model to obtain the first reconstructed data.

[0113] In this embodiment, the observed data is x = {x} (1) ,x (2) ,x (3) ,…,x (N)}, where x∈R N×M It is an N-row, M-column matrix.

[0114] The data streams in different columns of the above observation data are generated by relevant sensing nodes. During the acquisition and transmission process, data loss may occur due to factors such as sensing capability failure, transmission network failure, or excessive electromagnetic noise. Therefore, it is necessary to fill in the missing values ​​of the acquired data x according to certain rules. Filling schemes include, but are not limited to, zero-padding, specific value filling, and preceding / following value filling.

[0115] Furthermore, since the data streams in different columns are generated by different nodes, or originate from different types of physical quantities sensed by the same node, their numerical ranges differ significantly. To ensure the normal training of the subsequent variational autoencoder under these circumstances, it is necessary to first scale the observed data using a data normalization scheme. Data normalization schemes here include, but are not limited to, Max-Min Scaler and Z-Score normalization. Taking Max-Min Scaler as an example, the following column-by-column transformation is performed on the target data x:

[0116]

[0117] Here, min and max refer to the minimum and maximum values ​​of each column in the observed data, respectively. By applying this data transformation scheme, each column in the target data x is scaled to the range [0,1].

[0118] Specifically, considering that abnormal perceived values ​​in the data stream under the above scaling method will affect min and max, thereby changing the scaling relationship of the corresponding data, and since the data sources of different columns in the observed data x are relatively clear, their corresponding physical meanings determine that their numerical ranges can be inferred, this invention proposes an improved process for the data scaling algorithm, specifically:

[0119] For different columns of data in the observed data x, based on their source or corresponding physical meaning, the normal range of each column of data is inferred based on prior knowledge. Then, the lower and upper bounds of the aforementioned normal range are used as the min and max values ​​of each column during the aforementioned data scaling process.

[0120] Considering that during the aforementioned scaling operation, abnormal data may exceed the presumed lower and upper bounds of normal data, resulting in data value overflow, this invention performs numerical clamping on the data after the scaling operation. The numerical ranges of each column of the scaled data are clamped as follows to ensure normal training and convergence of the subsequent model:

[0121]

[0122] Here, scalar x is an element in matrix x' after the aforementioned scaling operation.

[0123] Furthermore, to facilitate the subsequent training of the variational autoencoder, the scheme performs a sliding window slicing operation on the data matrix x' processed by the aforementioned numerical scaling scheme: a sliding window of length L is used to slice the matrix x' obtained after the aforementioned scaling operation in the row direction, thereby completing the slicing along the time step dimension. Taking the data slicing at time step t as an example, the slicing data x' obtained after sliding window slicing of length L is... t-L+1:t ∈R L×M It is an L-row, M-column matrix.

[0124] After obtaining the fragmented data x t-L+1:t Next, the segmented data is input into the trained variational autoencoder to obtain the corresponding reconstructed data. By comparing x t-L+1:t and The degree of deviation is used to determine whether there are anomalies in the data at time step t. That is, when relative to x t-L+1:tWhen the reconstruction error is large, the observed data at time step t is considered to be abnormal data.

[0125] It should be noted that the above data preprocessing methods can be used both during the training of the variational autoencoder and when using the trained variational autoencoder for inference, in order to improve the performance of the variational autoencoder or enhance the inference accuracy of the model.

[0126] The device anomaly detection method with a hierarchical architecture provided by the present invention analyzes the impact of abnormal data during data preprocessing, and performs pre-processing such as padding, specific scaling, numerical clamping, and slicing on the observed data to obtain higher quality data. This can improve the performance of the variational autoencoder during the training process and improve the accuracy of inference results in practical applications.

[0127] Furthermore, based on the above embodiments, obtaining the first data anomaly detection result based on the first reconstruction error between the first reconstructed data and the observed data includes:

[0128] A first reconstruction error is obtained by calculating the first reconstructed data and the observed data using a preset reconstruction error calculation algorithm; wherein the preset reconstruction error calculation algorithm is at least one of mean absolute error calculation, mean squared error calculation, or cross-entropy calculation.

[0129] The anomaly threshold is determined based on the distribution pattern of the first reconstruction error in historical observation data;

[0130] The reconstruction error is determined based on the anomaly threshold to obtain the data anomaly detection result.

[0131] It should be noted that the anomaly threshold in this embodiment is determined during the training of the VAE model, based on the distribution pattern of the first reconstruction error of historical observation data.

[0132] After inputting the observation data into the first instance model to obtain the first reconstructed data, the method further includes:

[0133] The observed data and the first reconstructed data are input into a pre-trained classification model to obtain the first data anomaly detection result;

[0134] The pre-trained classification model is a deep learning model, trained based on historical observation data and the reconstructed data corresponding to the historical observation data.

[0135] In this embodiment, the reconstruction error calculation includes, but is not limited to, MSE (Mean Squared Error), MAE (Mean Average Error), and CE (Cross Entropy).

[0136] After obtaining the reconstruction error, it is necessary to determine whether the observed data is anomalous based on the magnitude of the reconstruction error. This process of determining the reconstruction error can be understood as a screening process. Methods used in this screening process include, but are not limited to: calculating the reconstruction error at all time steps on a data slice, then taking the average as an anomaly threshold, comparing the reconstruction error with the anomaly threshold, and outputting anomaly detection results (i.e., whether the observed data is anomalous) based on the comparison results. Alternatively, calculating the reconstruction error at all time steps on a data slice, comparing the reconstruction error at each time step, and outputting anomaly detection results according to strategies such as counting and setting preset thresholds. Or, using a deep learning model to process and classify the reconstruction errors on the data slice.

[0137] More specifically, the reconstruction error distribution of each data slice is enumerated on a normal dataset, and a threshold is selected according to certain criteria based on the distribution pattern. For example, the reconstruction errors of all data slices are arranged from smallest to largest, and the octet is taken as the threshold; if the error exceeds this threshold, the data is considered abnormal. For deep learning models analyzing observations and reconstructed values, the classification threshold is learned autonomously by the model during the iteration process.

[0138] The device anomaly detection method with a hierarchical architecture provided by the present invention determines whether the observed data is abnormal data by calculating different reconstruction errors and screening the reconstruction errors, thus providing diversity in the judgment of abnormal data.

[0139] Example 2

[0140] Based on Embodiment 1, Embodiment 2 provides a layered architecture device anomaly detection system, which corresponds to the above-mentioned data anomaly detection system, and specifically includes:

[0141] The server determination module is used to determine a first server and a second server in a multi-layer network according to preset conditions. The preset conditions include at least one or more of the following: the distance between the device and different servers, the network structure in which the device is located, and the connection topology. The first server has a first instance model pre-stored, which is a lightweight variational autoencoder, and the second server has a second instance model pre-stored, which is a full variational autoencoder.

[0142] The data acquisition module is used to acquire observation data of the device through the first server;

[0143] The first data reconstruction module is used to input the observation data into the first instance model to obtain the first reconstructed data;

[0144] The first anomaly detection module is used to obtain a first data anomaly detection result based on the first reconstruction error between the first reconstructed data and the observed data.

[0145] The data forwarding module is used to forward the observation data to the second server through the first server when the first data anomaly detection result indicates that the difference between the first reconstruction error and the preset anomaly threshold is less than the preset difference threshold.

[0146] The second data reconstruction module is used to input the observation data into the second instance model to obtain the second reconstructed data;

[0147] The second anomaly detection module is used to obtain a second data anomaly detection result based on the second reconstruction error between the second reconstructed data and the observed data.

[0148] The first instance model or the second instance model is obtained by adjusting the structure, layer depth, number of nodes or convolutional kernel size in the pre-trained variational autoencoder according to the computing power of the server and the network level.

[0149] For specific details, please refer to the description of the device anomaly detection method section of the layered architecture; it will not be repeated here.

[0150] Example 3

[0151] Embodiment 3 of the present invention provides an electronic device, including a memory and a processor, which communicate with each other. The memory stores program instructions that can be executed by the processor. The processor calls the program instructions to execute a layered architecture device anomaly detection method, which includes the following steps:

[0152] In a multi-layer network, a first server and a second server are determined according to preset conditions; the preset conditions include at least one or more of the following: the distance between the device and different servers, the network structure in which the device is located, and the connection topology; the first server pre-stores a first instance model, which is a lightweight variational autoencoder, and the second server pre-stores a second instance model, which is a full variational autoencoder.

[0153] The device's observation data is obtained through the first server;

[0154] The observation data is input into the first instance model to obtain the first reconstructed data;

[0155] A first data anomaly detection result is obtained based on the first reconstruction error between the first reconstructed data and the observed data;

[0156] If the first data anomaly detection result indicates that the difference between the first reconstruction error and the preset anomaly threshold is less than the preset difference threshold, the observation data is forwarded to the second server through the first server.

[0157] The observation data is input into the second instance model to obtain the second reconstruction data;

[0158] The second data anomaly detection result is obtained based on the second reconstruction error between the second reconstructed data and the observed data;

[0159] The first instance model or the second instance model is obtained by adjusting the structure, layer depth, number of nodes or convolutional kernel size in the pre-trained variational autoencoder according to the computing power of the server and the network level.

[0160] Example 4

[0161] Embodiment 4 of the present invention provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, it implements a device anomaly detection method with a layered architecture. The method includes the following steps:

[0162] In a multi-layer network, a first server and a second server are determined according to preset conditions; the preset conditions include at least one or more of the following: the distance between the device and different servers, the network structure in which the device is located, and the connection topology; the first server pre-stores a first instance model, which is a lightweight variational autoencoder, and the second server pre-stores a second instance model, which is a full variational autoencoder.

[0163] The device's observation data is obtained through the first server;

[0164] The observation data is input into the first instance model to obtain the first reconstructed data;

[0165] A first data anomaly detection result is obtained based on the first reconstruction error between the first reconstructed data and the observed data;

[0166] If the first data anomaly detection result indicates that the difference between the first reconstruction error and the preset anomaly threshold is less than the preset difference threshold, the observation data is forwarded to the second server through the first server.

[0167] The observation data is input into the second instance model to obtain the second reconstruction data;

[0168] The second data anomaly detection result is obtained based on the second reconstruction error between the second reconstructed data and the observed data;

[0169] The first instance model or the second instance model is obtained by adjusting the structure, layer depth, number of nodes or convolutional kernel size in the pre-trained variational autoencoder according to the computing power of the server and the network level.

[0170] In summary, during the anomaly detection operation, the embodiments of the present invention distribute the computational load for large-scale anomaly detection scenarios by using a variational autoencoder in the first server. Specifically, the observed data is reconstructed using a first instance model distributed across different servers. The anomaly of the observed data is determined based on the reconstruction error between the reconstructed data and the observed data. Furthermore, the confidence level of the reconstruction error determines whether the observed data needs to be forwarded to a second server for further anomaly detection. This improves the accuracy and efficiency of anomaly detection. Moreover, the hierarchical structure in the IoT environment effectively distributes the computational load of the anomaly detection model, avoiding unnecessary computational and communication overhead on the transmission network and central platform. This effectively improves the timeliness of anomaly detection, protects the overall operational efficiency of the business under the platform, increases the added value of the product, and enhances its competitiveness.

[0171] Those skilled in the art will understand that the accompanying drawings are merely schematic diagrams of one embodiment, and the modules or processes shown in the drawings are not necessarily essential for implementing the present invention.

[0172] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, for method or system embodiments, since they are basically similar to method embodiments, the description is relatively simple; relevant parts can be referred to the description of the method embodiments. The method and system embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0173] The above are merely preferred embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for detecting device anomalies in a layered architecture, characterized in that, include: In a multi-layered network, the first server and the second server are determined according to preset conditions; The preset conditions include at least one or more of the following: the distance between the device and different servers, the network structure in which the device is located, and the connection topology; the first server pre-stores a first instance model, which is a lightweight variational autoencoder, and the second server pre-stores a second instance model, which is a full variational autoencoder. The device's observation data is obtained through the first server; The observation data is input into the first instance model to obtain the first reconstructed data; A first data anomaly detection result is obtained based on the first reconstruction error between the first reconstructed data and the observed data; If the first data anomaly detection result indicates that the difference between the first reconstruction error and the preset anomaly threshold is less than the preset difference threshold, the observation data is forwarded to the second server through the first server. The observation data is input into the second instance model to obtain the second reconstruction data; The second data anomaly detection result is obtained based on the second reconstruction error between the second reconstructed data and the observed data; The first instance model or the second instance model is obtained by adjusting the structure, layer depth, number of nodes or convolutional kernel size in the pre-trained variational autoencoder according to the computing power of the server and the network level. The difference threshold is a confidence threshold, which is dynamically generated based on the resource usage of the first server, the backhaul network usage, and the topological complexity between the device and the first server.

2. The device anomaly detection method with a layered architecture according to claim 1, characterized in that, The pre-trained variational autoencoder is trained based on a preset loss function, which is a loss function that includes a penalty term. Where a and b are predefined constant values, and η is a trainable penalty term. p is the posterior distribution expectation. θ (x|z) is the likelihood distribution of the generative model, p θ (z) represents the latent variable distribution. Let x be the posterior distribution, x be the observed data, and z be the latent variable.

3. The device anomaly detection method with a layered architecture according to claim 1, characterized in that, After obtaining the first data anomaly detection result based on the first reconstruction error between the first reconstructed data and the observed data, the method further includes: If the first data anomaly detection result indicates that the difference between the first reconstruction error and the preset anomaly threshold exceeds the preset difference threshold, the first data anomaly detection result will be output as the final data anomaly detection result.

4. The device anomaly detection method with a layered architecture according to any one of claims 1-3, characterized in that, Before inputting the observation data into the first instance model to obtain the first reconstructed data, the method further includes: The maximum and minimum values ​​of each channel under the observation data are determined based on the type of the observation data and prior knowledge. The observed data is scaled based on the maximum and minimum values ​​to obtain scaled data. The scaled data is subjected to numerical clamping to obtain clamped data; Perform a sliding window segmentation operation on the clamped data to obtain the segmented data; Accordingly, inputting the observation data into the first instance model to obtain the first reconstructed data includes: The fragmented data is input into the first instance model to obtain the first reconstructed data.

5. The device anomaly detection method with a layered architecture according to claim 4, characterized in that, The step of obtaining the first data anomaly detection result based on the first reconstruction error between the first reconstructed data and the observed data includes: A first reconstruction error is obtained by calculating the first reconstructed data and the observed data using a preset reconstruction error calculation algorithm; wherein the preset reconstruction error calculation algorithm is at least one of mean absolute error calculation, mean squared error calculation, or cross-entropy calculation. The anomaly threshold is determined based on the distribution pattern of the first reconstruction error in historical observation data; The reconstruction error is determined based on the anomaly threshold to obtain the data anomaly detection result.

6. The device anomaly detection method with a layered architecture according to claim 1, characterized in that, After inputting the observation data into the first instance model to obtain the first reconstructed data, the method further includes: The observed data and the first reconstructed data are input into a pre-trained classification model to obtain the first data anomaly detection result; The pre-trained classification model is a deep learning model, trained based on historical observation data and the reconstructed data corresponding to the historical observation data.

7. A layered architecture device anomaly detection system, characterized in that, include: The server determination module is used to determine the first server and the second server based on preset conditions in a multi-layer network hierarchy. The preset conditions include at least one or more of the following: the distance between the device and different servers, the network structure in which the device is located, and the connection topology; the first server pre-stores a first instance model, which is a lightweight variational autoencoder, and the second server pre-stores a second instance model, which is a full variational autoencoder. The data acquisition module is used to acquire observation data of the device through the first server; The first data reconstruction module is used to input the observation data into the first instance model to obtain the first reconstructed data; The first anomaly detection module is used to obtain a first data anomaly detection result based on the first reconstruction error between the first reconstructed data and the observed data. The data forwarding module is used to forward the observation data to the second server through the first server when the first data anomaly detection result indicates that the difference between the first reconstruction error and the preset anomaly threshold is less than the preset difference threshold. The second data reconstruction module is used to input the observation data into the second instance model to obtain the second reconstructed data; The second anomaly detection module is used to obtain a second data anomaly detection result based on the second reconstruction error between the second reconstructed data and the observed data. The first instance model or the second instance model is obtained by adjusting the structure, layer depth, number of nodes or convolutional kernel size in the pre-trained variational autoencoder according to the computing power of the server and the network level. The difference threshold is a confidence threshold, which is dynamically generated based on the resource usage of the first server, the backhaul network usage, and the topological complexity between the device and the first server.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the device anomaly detection method of the layered architecture as described in any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, It stores a computer program that, when executed by a processor, implements the device anomaly detection method of the layered architecture as described in any one of claims 1-6.

Images