Timestamp-level fast anomaly detection method for industrial Internet of Things based on frequency domain spectrum difference

Abstract

The present invention discloses a timestamp-level fast anomaly detection method for an industrial Internet of Things based on frequency domain spectrum differences, which adopts a non-neural network solution to perform fine-grained industrial sensor signal anomaly detection; it includes the following contents: proposing to use only spectrum differences in the frequency domain as the evaluation index for timestamp-level anomaly detection; designing point-level and sequence-level spectrum difference calculation modules as two complementary branches to jointly generate the spectrum differences of each timestamp in the frequency domain; designing an anomaly scoring strategy to combine point-level and sequence-level spectrum differences to generate anomaly scores for each timestamp; wherein, the point-level spectrum difference calculation module is used to identify explicit anomalies in industrial time signals, and the sequence-level spectrum difference calculation module is used to identify implicit anomalies in industrial time signals. The timestamp-level fast anomaly detection method for an industrial Internet of Things based on frequency domain spectrum differences of the present invention can achieve high-speed and high-precision anomaly detection on resource-limited industrial Internet of Things edge devices.

Description

Technical Field

[0001] The present invention relates to the technical field of anomaly detection of industrial sensor time signals (time series), and in particular to a timestamp-level rapid anomaly detection method for the industrial Internet of Things based on frequency domain spectrum differences. Background Art

[0002] In the Industrial Internet of Things (IIoT), underlying industrial production equipment is often equipped with numerous sensors to enable intelligent sensing and remote control. Driven by the IIoT, traditional production processes are gradually transforming into automated and intelligent production. In this scenario, the various underlying production devices are not only interconnected but also able to communicate with external networks. Consequently, production equipment or processes, once relatively secure due to isolation, are inevitably vulnerable to attacks from external networks, causing them to deviate from normal operation and generate anomalies. If these anomalies can be detected early, even in their infancy, timely warnings can be issued and proactive defense measures can be implemented, thereby ensuring the security and stability of production equipment and business processes. Otherwise, these anomalies can cause damage to production equipment, interruption of production processes, and even casualties and significant financial losses. Therefore, anomaly detection, particularly fine-grained timestamp-level anomaly detection, is crucial for the IIoT.

[0003] In the era of Industry 4.0, industrial production processes are experiencing increasingly complex and dynamic operational modes, requiring more sophisticated intelligent sensing and remote control. To meet this demand, the Industrial Internet requires the deployment of more intelligent sensors and more intensive data collection. This results in new characteristics in sensor signal data from multiple sensors within the Industrial Internet of Things (IIoT): more complex features, more variables, larger data volumes, and scarcer labels. At the same time, IIoT anomaly detection is facing new demands: high accuracy, high speed, and low resource consumption. These new detection requirements and data characteristics pose new challenges to existing anomaly detection models.

[0004] Challenge 1: High precision and high speed are difficult to achieve at the same time. Existing timestamp-level anomaly detection models are mainly divided into two categories: deep models based on neural networks and shallow models based on non-neural networks.

[0005] Deep models are currently a hot topic and a mainstream research direction. Most of these models focus solely on high accuracy, using deep neural networks with large parameters. This often results in long training and testing times. When faced with large amounts of sensor signals, these models can take hours or even days to process. In contrast, lightweight models based on non-neural networks are typically much faster. They typically rely on statistical features and similarity distances to identify anomalies. However, due to their limited feature capture capabilities, their accuracy is often low when faced with complex data. Consequently, current Industrial IoT timestamp-level anomaly detection models struggle to achieve both high accuracy and high speed, making them uncompetitive in the context of Industry 4.0.

[0006] Challenge 2: Limited resources in the Industrial Internet of Things are rarely considered. The previous Industrial Internet of Things anomaly detection process included the following steps:

[0007] First, deploy the anomaly detection model on a cloud server with powerful resources; second, upload all sensor signal data collected by the industrial IoT edge device to the cloud; finally, generate the detection results in the cloud and return them to the edge device.

[0008] Due to the powerful computing and storage capabilities of cloud servers, traditional anomaly detection models rarely consider resource constraints. However, in the era of Industry 4.0, massive sensor signals, intensive resource scheduling, and frequent computing tasks have brought problems such as high latency and high cost to cloud-based anomaly detection. In addition, existing models are keen to build deep neural networks with huge parameters to achieve high-precision anomaly detection, which further increases the computing load and processing time for cloud-based anomaly detection. In order to improve the timeliness of anomaly detection, one of the most direct methods is to deploy anomaly detection models on edge devices rather than in the cloud. However, edge devices in the Industrial Internet of Things often have very limited resources. For example, the STM32 microcontroller based on the micro computing unit MCU has only and Clock calculation frequency. Even the high-performance Raspberry Pi 4b has only 2 GB RAM and 1.5 GHz Clock computing frequency. These limited resources are often insufficient to support the smooth and stable operation of anomaly detection models based on deep neural networks, or even to guarantee their operation.

[0009] To address these challenges, existing solutions can be mainly divided into two categories.

[0010] The first category uses acceleration technologies such as model compression, parallel computing, and federated learning to improve the speed of existing deep anomaly detection models, thereby achieving both high speed and high accuracy. For example, the FATRAF model uses a federated learning mechanism for distributed anomaly detection. De et al. utilize lightweight echo state networks to replace computationally intensive components. In this type of model, deep neural networks provide high accuracy, while acceleration technologies ensure high speed. While these models achieve high speed and high accuracy, they still retain deep structures and a large number of parameters. This means that they still require significant computing and storage resources, and can only be deployed in the cloud, making them difficult to apply directly to resource-limited edge devices.

[0011] The second category integrates multiple non-neural network technologies, or combines them with shallow neural networks, to build high-speed, high-precision hybrid anomaly detection models. For example, Li et al. combined fuzzy C-means and particle swarm optimization (PSO) to improve anomaly detection accuracy. Similarly, Shanmuganath et al. incorporated Markov learning into LSTM networks to improve model accuracy. In this type of model, non-neural network methods provide high speed, while the fusion of multiple technologies provides high accuracy. Although these methods can be directly deployed on resource-limited edge devices, their representational capabilities are often weak. When applied to industrial physical network sensor signal datasets with complex features, their accuracy is often low.

[0012] In summary, both solutions have their own advantages and disadvantages. However, they cannot fully meet the requirements of high speed, high accuracy and low resource consumption for anomaly detection in Industry 4.0. Summary of the Invention

[0013] In response to the above-mentioned technical problems to be solved, the present invention provides an industrial Internet of Things timestamp-level rapid anomaly detection method based on frequency domain spectrum differences, which can quickly and accurately identify abnormal events of multi-sensor signals in the industrial Internet of Things on edge devices with limited resources.

[0014] In order to solve the above technical problems, the technical solution proposed by the present invention is:

[0015] A fast timestamp-level anomaly detection method for the Industrial Internet of Things (IIoT) based on frequency domain spectrum differences is characterized by using a non-neural network scheme to perform fine-grained anomaly detection on multi-sensor signals of the Industrial Internet only in the frequency domain. The method includes the following contents:

[0016] The algorithm uses only the spectrum difference in the frequency domain as the evaluation metric for timestamp-level anomaly detection. It designs point-level and sequence-level spectrum difference calculation modules as two complementary branches to jointly generate the spectrum difference in the frequency domain for each timestamp. It also designs an anomaly scoring strategy that combines the point-level and sequence-level spectrum differences to generate an anomaly score for each timestamp, thereby determining whether the timestamp is an anomaly.

[0017] The point-level spectrum difference calculation module is used to identify explicit anomalies in industrial time signals, and the sequence-level spectrum difference calculation module is used to identify implicit anomalies in time signals.

[0018] As a further improvement of the above technical solution:

[0019] Preferably, the anomaly detection method comprises the following steps:

[0020] Step S1: Using a point-level spectrum difference calculation module to identify dominant anomalies in multi-sensor time signals using frequency domain features; calculating the difference in frequency domain features between each timestamp within a fixed-length domain with and without the timestamp, and using this difference as the substitutability of the timestamp in the frequency domain; identifying dominant timestamp anomalies based on the substitutability;

[0021] Step S2: Using a sequence-level spectrum difference calculation module to identify hidden anomalies in multi-sensor time signals; using several adjacent timestamps around each timestamp as its surrogate subsequences; calculating the change in frequency domain characteristics of each timestamp within a fixed-length region with and without its surrogate sequence; using the difference in spectral feature changes of the surrogate subsequences as the substitutability of the timestamp; and identifying hidden timestamp anomalies based on the substitutability;

[0022] In step S3, the point-level and sequence-level spectrum differences are fused with different weights to generate an anomaly score for each timestamp; whether each timestamp is an anomaly point is determined by formula (2):

[0023] (2)

[0024] in, represents the final anomaly score at the t-th timestamp, is the preset threshold, ranging from 0 to 1; represents the predicted label of the t-th timestamp; if , then the tth timestamp is judged to be abnormal; otherwise, it is judged to be normal.

[0025] Preferably, step S1 and step S2 are two independent complementary branches, and the learning processes of the two branches are executed in parallel with complementary interference.

[0026] Preferably, the step S1 specifically includes the following:

[0027] S1-1, point-level sampling: Generate a length of L The length of the neighborhood sequence and another one that does not contain the timestamp is L replacement sequence; in a M variables and Ttimestamps in industrial multi-sensor time signals , the generation process of the neighborhood sequence and replacement sequence of the t-th timestamp on the m-th variable is:

[0028] First, generate the neighborhood sequence: from the mth variable Extract the range in arrive The timestamps between them form a neighborhood sequence ;

[0029] Next, generate the replacement sequence: calculate The average value Avg of all timestamps except the t-th timestamp is replaced by Avg The value of the t-th timestamp in generates a replacement sequence ;

[0030] Finally, the spectrum difference between the neighborhood sequence of length L and the replacement sequence is calculated in the frequency domain to evaluate the replaceability of timestamp t in the frequency domain;

[0031] S1-2, spectrum difference calculation: The spectrum difference calculation process of the t-th timestamp on the m-th variable in the frequency domain is:

[0032] First, the fast Fourier transform function is used to transform two neighborhood sequences of length L into and Transformed into frequency components, as follows:

[0033] (3)

[0034] in, , ; represents the fast Fourier function, represents the frequency component of the neighborhood sequence in the frequency domain, Represents the frequency components of the replacement sequence in the frequency domain;

[0035] Secondly, calculate and The amplitude in the frequency domain is given by and The frequency domain characteristics are:

[0036] (4)

[0037] in, , represents the amplitude calculation function, represents the amplitude value of the neighborhood sequence, represents the amplitude value of the replacement sequence;

[0038] Finally, the mean square error function is used to measure the amplitude difference of the t-th timestamp in the frequency domain, which is:

[0039] (5)

[0040] in, , It represents the point-level spectrum difference of the t-th timestamp, is the mean square error function.

[0041] Preferably, the step S2 specifically includes the following:

[0042] S2-1, sequence level sampling: Generate a sequence of length LG A substitute subsequence of length , and then generate a substitute subsequence of length LS The length of the neighborhood sequence and another subsequence that does not contain a substitute is LS replacement sequence; in a M variables and T timestamps in industrial multi-sensor time signals , the sampling process of the t-th timestamp on the m-th variable is as follows:

[0043] First, extract neighbors: from the mth variable Extract the range in arrive The timestamp in the initial neighborhood sequence ;

[0044] Then, group: All data in are divided into G groups in sequence, each group contains LG timestamps, ;

[0045] Secondly, generate a substitute subsequence: consider the group where timestamp t is located as its substitute subsequence;

[0046] Next, generate a neighborhood sequence for the surrogate subsequence: consider the entire initial neighborhood sequence as the neighborhood sequence of the surrogate subsequence ;

[0047] Again, generate a replacement sequence for the substitute subsequence: replace the value of each timestamp in the substitute subsequence with the average value of the corresponding position in other groups to generate a replacement sequence for the substitute subsequence ;

[0048] Finally, the spectrum difference between the neighborhood sequence of length LS and the replacement sequence is calculated in the frequency domain, and the sequence-level replaceability of timestamp t in the frequency domain is measured;

[0049] S2-2, spectrum difference calculation: The sequence-level spectrum difference calculation process of the t-th timestamp on the m-th variable is:

[0050] First, the two neighborhood sequences are transformed using the fast Fourier transform function FFT() and Transformed into Frequency components:

[0051] (6)

[0052] in, , . represents the frequency component of the neighborhood sequence in the frequency domain, Represents the frequency components of the replacement sequence in the frequency domain;

[0053] Secondly, in the frequency domain, we calculate and The amplitude is:

[0054] (7)

[0055] in, , represents the amplitude calculation function, represents the amplitude of the neighborhood sequence in the frequency domain, represents the amplitude of the replacement sequence in the frequency domain;

[0056] Finally, the mean square error function is used to measure the sequence-level spectrum difference of each timestamp:

[0057] (8)

[0058] in, is the sequence-level spectrum difference at the t-th timestamp.

[0059] Preferably, in step S1 or step S2, the spectrum difference calculation process adopts a variable-independent learning mode; the sampling process or spectrum difference calculation process on each variable is independent and does not interfere with each other, and is executed in parallel to enhance the timeliness of the algorithm.

[0060] Preferably, step S3 includes the following:

[0061] First, have M A timestamp in the sensor signal to be detected for each variable It will be input into the point-level and sequence-level spectrum difference calculation modules to perform variable-independent difference calculations.

[0062] Then, in a variable Two frequency domain differences are generated for timestamp t: point-level spectrum differences and sequence-level spectral differences , and as the t-th timestamp in the variable m Point-level anomaly scores and sequence-level anomaly scores on ;

[0063] Next, calculate the point-level and sequence-level average anomaly scores of the M variables respectively:

[0064] ;

[0065] ;

[0066] Finally, the final anomaly score for the t-th timestamp is generated:

[0067] (9)

[0068] in, is a preset parameter, ranging from [0 to 1]; when When it is 0, only the sequence-level anomaly score is considered; when When it is 1, only the point-level anomaly score is considered;

[0069] After obtaining the final anomaly score, use formula (2) to determine whether the tth timestamp is an anomaly point.

[0070] The industrial Internet of Things timestamp-level rapid anomaly detection method based on frequency domain spectrum differences provided by the present invention has the following advantages over the existing technology:

[0071] (1) The method for fast timestamp-level anomaly detection in the industrial Internet of Things based on frequency domain spectrum difference of the present invention introduces spectrum difference to measure the characteristics of each timestamp in the frequency domain, breaking the traditional dilemma of being unable to extract the characteristics of each timestamp in the frequency domain. It provides a solution for performing timestamp-level anomaly detection in the frequency domain and also provides a reference idea for other tasks in the field of time signal analysis and processing to perform fine-grained analysis in the frequency domain.

[0072] (2) This invention proposes a fast timestamp-level anomaly detection method for the Industrial Internet of Things based on frequency-domain spectral differences. It constructs a non-neural network detection solution consisting of a "point-level spectral difference calculation module + a sequence-level spectral difference calculation module + a joint point-level and sequence-level scoring strategy." This method utilizes spectral differences solely in the frequency domain to achieve high-speed, high-precision, and low-resource timestamp-level anomaly detection. This is the first work in the field of anomaly detection to perform timestamp-level anomaly detection solely using frequency-domain features.

[0073] (3) The frequency domain spectrum difference-based timestamp-level fast anomaly detection method for industrial IoT of the present invention can be deployed online in real time on resource-limited edge devices, rather than the traditional cloud-based offline deployment mode that requires training before deployment. This greatly simplifies the deployment difficulty and maintenance cost of anomaly detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0074] Figure 1 Schematic diagram of spectrum differences in the frequency domain in the present invention.

[0075] Figure 2 It is a framework diagram of anomaly detection in the present invention.

[0076] Figure 3 It is the point-level and sequence-level sampling diagram in the present invention.

[0077] Figure 4 This is the deployment result on the resource-limited edge device Raspberry Pi 4b in the experimental verification of this invention.

[0078] Figure 5 This is the deployment result on the resource-limited edge device STM32 in the experimental verification of the present invention. DETAILED DESCRIPTION

[0079] The following is a detailed description of the specific embodiments of the present invention. It should be understood that the specific embodiments described herein are only used to illustrate and explain the present invention and are not intended to limit the present invention.

[0080] The present invention presents a non-neural network-based timestamp-level fast anomaly detection method for the Industrial Internet of Things (IIoT) based on frequency-domain spectral differences. This method (FADSD) is a non-neural network-based timestamp-level fast anomaly detection method. Unlike existing deep neural network-based methods, FADSD utilizes only spectral differences in the frequency domain, a non-neural network approach, to achieve high-precision, high-speed, and low-resource fine-grained anomaly detection for the Industrial Internet. First, the concept of spectral differences is introduced to overcome the previous inability to perform timestamp-level feature extraction and anomaly detection in the frequency domain. Second, a novel point-level and sequence-level difference calculation module is designed as two complementary branches to jointly generate the spectral difference of each timestamp in the frequency domain. Finally, a personalized anomaly scoring strategy is designed to combine point-level and sequence-level spectral differences, ultimately achieving accurate timestamp-level fine-grained anomaly detection, performing timestamp-level anomaly detection solely in the frequency domain.

[0081] The anomaly detection method of the present invention has the following two difficulties:

[0082] The first difficulty is which non-neural network technology should be selected for the anomaly detection model.

[0083] Compared with deep neural networks, simple and lightweight non-neural network technologies can improve processing speed and reduce resource consumption, but their representation capabilities are limited. However, the goal of the present invention is to develop a lightweight anomaly detection model that is both high-speed and highly accurate. This forces the present invention to select a non-neural network technology with strong representation capabilities. The complex features of multi-sensor time signals are difficult to extract in the time domain, but are simple and easy in the frequency domain. Therefore, frequency domain analysis is an ideal non-neural network technology that provides both powerful representation capabilities and fast processing speeds. Specifically, the present invention selects the fast Fourier transform (FFT) as the feature extractor and performs timestamp-level anomaly detection directly in the frequency domain rather than the time domain.

[0084] The second difficulty is how to perform timestamp-level anomaly detection in the frequency domain.

[0085] So far, no research has been conducted to directly perform timestamp-level anomaly detection in the frequency domain. The main reason for this dilemma is that it is difficult to directly measure the characteristics of each timestamp in the frequency domain. Generally, the time domain and the frequency domain are two complementary perspectives for analyzing time signals, and there is no direct one-to-one correspondence between them. For example, in the time domain, the length of L The time series of timestamps is decomposed into L / 2 frequency components. In this case, the characteristics of each time stamp in the time domain will be scattered L On the 1 / 2 frequency components, it is impossible to measure which information of each frequency component is characteristic of which timestamp. If the characteristics of the timestamp cannot be measured, it is impossible to score the timestamp for anomaly and ultimately determine whether a timestamp is anomaly.

[0086] To solve this problem, two things must be done. First, an indicator must be defined or a mechanism must be designed to measure the characteristics or information of a timestamp in the frequency domain. To this end, the present invention introduces spectrum difference to measure the characteristics of a timestamp in the frequency domain. Specifically, in a fixed-length time series, when there is or is not a timestamp, the spectrum (amplitude) difference is regarded as the characteristic of the timestamp in the frequency domain, such as Figure 1 (a) shows two contrasting branches of the two sequences with and without red-marked timestamps. The spectral difference between the two sequences is considered a characteristic of the red-marked timestamps. Secondly, it is necessary to verify whether this measurement metric or mechanism can effectively distinguish abnormal timestamps from normal timestamps. To test this, we selected a time series of length 20 containing at least one abnormal timestamp from two real datasets, Yahoo and SMTP. Figure 1(b) and (c) plot the amplitude differences between normal and abnormal timestamps in the two datasets, respectively. It is easy to see that the spectrum difference can effectively distinguish abnormal and normal timestamps.

[0087] In summary, the present invention utilizes the spectrum difference of each timestamp in the frequency domain to perform timestamp-level fine-grained anomaly detection from both point-level and sequence-level perspectives.

[0088] The time signal of multi-sensor of industrial IoT can be expressed as , where T represents the number of timestamps and M represents the number of variables. Specifically, a multi-sensor time signal consists of both the time dimension and the variable dimension. In the time dimension, the multi-sensor time signal can be expressed as ,in Represents the value of M variables at the t-th timestamp. In the variable (space) dimension, the multi-sensor time signal can be expressed as ,in Indicates the value of the mth variable at T timestamps.

[0089] The industrial Internet of Things timestamp-level fast anomaly detection method based on frequency domain spectrum difference of the present invention first needs to be used for each timestamp in x (such as t timestamps) to generate an anomaly score:

[0090] (1)

[0091] in, represents the anomaly detection method of the present invention, Indicates the t M variable values ​​at timestamps, Indicates the t The anomaly score for each timestamp.

[0092] Secondly, based on the generated anomaly score, we can determine whether this timestamp is abnormal:

[0093] (2)

[0094] in, is the preset threshold, ranging from 0 to 1. Indicates the t The predicted label of the timestamp. If , then the tth timestamp is judged to be abnormal; otherwise, it is judged to be normal.

[0095] The method for rapid anomaly detection at the timestamp level of the industrial Internet of Things based on frequency domain spectrum differences of the present invention specifically comprises the following steps:

[0096] Step S1, point-level spectrum difference calculation

[0097] like Figure 2 As shown in (a) of the figure, this step designs a customized point-level sampling strategy and works in conjunction with the fast Fourier transform (FFT) to calculate point-level spectral (amplitude) differences in the frequency domain. This is used to accurately identify significant anomalies in multi-sensor signals in the Industrial Internet of Things. It is important to note that the calculation of point-level spectral differences uses a variable-independent execution mode, meaning that the calculation of all variables is independent of each other and can be executed in parallel.

[0098] Anomalies in multi-sensor time signals in the Industrial Internet of Things (IIoT) typically persist across multiple timestamps and can be categorized into two main types: explicit anomalies and implicit anomalies. Fine-grained timestamp-level anomaly detection can provide early warnings, ensuring the security and stability of IIoT systems. To this end, this embodiment designs a point-level spectrum difference calculation module to accurately identify explicit anomalies.

[0099] In a significant anomaly, the value of each timestamp is significantly different from the normal timestamp. Figure 3 (a) in the figure shows a significant anomaly between 1600 and 1700 in the sensor (variable) 136 of the real-world UCR dataset. Indicates the exception timestamp, Represents a normal timestamp. As shown in the figure, when comparing these two timestamps in a neighborhood sequence of the same length ( The purple area, Green area), is significantly different from its neighbors, and is relatively smooth with its neighbors. This means is not similar to its neighbors, and More similar to its neighbors. Therefore, the similarity between a timestamp and its neighbors in the frequency domain can be used to identify explicit anomalies. To calculate similarity, this embodiment needs to obtain the features of each timestamp in the frequency domain.

[0100] To solve this problem, the frequency domain characteristics of each timestamp are measured to evaluate the substitutability of each timestamp in the frequency domain. If a timestamp is not substitutable in its neighborhood sequence, it is not similar to its neighbors in the neighborhood. On the contrary, it is similar to its neighbors in the neighborhood. Based on this idea, this embodiment introduces spectrum differences to quantify the substitutability of each timestamp in its neighborhood sequence. The specific idea is to observe the amplitude difference of the sequence when a specific timestamp is present or absent in a fixed-length neighborhood sequence, such as Figure 1 In summary, this embodiment designs a novel point-level spectrum difference calculation component to identify dominant anomalies in multi-sensor signals using frequency domain features.

[0101] Specifically include the following:

[0102] S1-1, point-level sampling: In order to calculate the spectrum difference, this embodiment designs a variable-independent point-level sampling strategy, the goal of which is to generate a neighborhood sequence and another replacement sequence that does not contain the timestamp for each timestamp, such as Figure 3 As shown in (c) in the time domain. The length in the time domain is L The time series of timestamps is decomposed into frequency components. Taking the t-th timestamp of the m-th variable as an example, the generation process of these two sequences is as follows:

[0103] First, generate the neighborhood sequence: from the mth variable Extract the range in arrive The timestamps between them form a neighborhood sequence , L is the length of the neighborhood sequence, that is, the number of timestamps contained in the sequence. Next, generate the replacement sequence: Calculate The average value Avg of all timestamps except the t-th timestamp is replaced by Avg The value of the t-th timestamp in generates a replacement sequence .

[0104] Finally, the spectrum difference between the neighborhood sequence of length L and the replacement sequence is calculated in the frequency domain and used to evaluate the replaceability of timestamp t in the frequency domain.

[0105] Furthermore, the sampling process of the M variables and all timestamps within each variable can be executed in parallel.

[0106] S1-2, spectrum difference calculation: After two adjacent sequences are generated, the spectrum difference calculation of each timestamp becomes simple. Taking the t-th timestamp of the m-th variable as an example, the spectrum difference calculation process in the frequency domain is as follows:

[0107] First, the fast Fourier transform (FFT) is used to transform two neighborhood sequences of length L into and Transformed into frequency components, as follows:

[0108] (3)

[0109] in, , . represents the fast Fourier function, represents the frequency component of the neighborhood sequence in the frequency domain, Represents the frequency components of the replacement sequence in the frequency domain.

[0110] Secondly, calculate and The amplitude in the frequency domain is given by and The frequency domain characteristics are as follows:

[0111] (4)

[0112] in, , represents the amplitude calculation function, represents the amplitude value of the neighborhood sequence, Indicates the amplitude value of the replacement sequence.

[0113] Finally, the mean square error (MSE) function is used to measure the amplitude difference of the t-th timestamp in the frequency domain, which is defined as follows:

[0114] (5)

[0115] in, , It represents the point-level spectrum difference at the t-th timestamp.

[0116] Furthermore, M The calculation of the difference in amplitude for each time stamp in each variable can also be performed in parallel to increase speed.

[0117] Step S2, sequence-level spectrum difference calculation

[0118] like Figure 2 As shown in (b), this step complements step S1 by designing a sequence-level sampling strategy. This strategy, combined with the Fast Fourier Transform (FFT), calculates sequence-level amplitude differences in the frequency domain, enabling accurate identification of hidden anomalies in multi-sensor signals in the Industrial Internet of Things. It's important to note that the calculation of sequence-level spectral differences also uses a variable-independent execution mode, meaning all variables are calculated independently and can be executed in parallel.

[0119] Unlike explicit anomalies, implicit anomalies exhibit more complex characteristic patterns. In such anomalies, the similarity associations between some timestamps and their neighbors are significantly different from those of normal timestamps, while the similarity associations between other timestamps and their neighbors are very similar to those of normal timestamps. For example, Figure 3 (b) shows a hidden anomaly in the range of 8580 to 8640 in the real-world single sensor signal (univariate) Sed dataset. is the exception timestamp, is a normal timestamp. It is not difficult to find that and have the same value, and their local neighborhood sequences are also very similar. In this case, and The correlation between them and their neighbors is also very similar. If in the frequency domain, their replaceability in their respective local neighborhood sequences is also very similar. This makes it impossible to identify the image using the point-level spectrum difference scheme. Such an abnormal timestamp.

[0120] In order to solve this problem, the most direct way is to let and There is significant distinguishability in their respective neighborhood sequences. To this end, this embodiment attempts to extract multiple timestamps around each timestamp, generate a shorter sub-training, and use it to replace the current timestamp as a substitute subsequence. When observing its neighborhood as a substitute subsequence, it is not difficult to find that there are obvious differences between the two substitute subsequences corresponding to two timestamps that are originally similar at the point level. For example, in Figure 3 In (b), this example uses the dark red subsequence as The dark green subsequence is a substitute for In this case, and The substitutability of the surrogate subsequences within their respective sequence-level neighborhood sequences (the long purple and long green regions) becomes significantly different. In this way, this embodiment leverages frequency domain differences to address the issue of inaccurate latent anomaly identification. Based on this concept, this embodiment designs a sequence-level spectrum difference calculation module to accurately identify latent anomalies.

[0121] Specifically include the following:

[0122] S2-1, sequence-level sampling: Similar to point-level sampling, this embodiment designs a variable-independent sequence-level sampling strategy, the goal of which is to generate a substitute subsequence for each timestamp, and based on this, generate a neighborhood sequence for the substitute subsequence and another replacement sequence that does not contain the substitute subsequence, such as Figure 3 As shown in (d). Taking the t-th timestamp of the m-th variable as an example, the detailed sampling process is as follows:

[0123] First, extract neighbors: from the mth variable Extract the range in arrive The timestamp in the initial neighborhood sequence , LS represents the sequence length, i.e., the number of timestamps in the sequence.

[0124] Then, group: All data in the is divided into G groups in chronological order, each group contains LG timestamps. .

[0125] Secondly, generate a substitute subsequence: regard the group where the timestamp t is located as its substitute subsequence, and the length of the subsequence is LG.

[0126] Next, generate a neighborhood sequence for the substitute subsequence: consider the entire initial neighbor sequence as the neighborhood sequence of the substitute subsequence .

[0127] Again, generate a replacement sequence for the substitute subsequence: replace the value of each timestamp in the substitute subsequence with the average value of the corresponding position in other groups to generate a replacement sequence for the substitute .

[0128] Finally, the spectrum difference between the neighborhood sequence of length LS and the replacement sequence is calculated in the frequency domain, and the sequence-level replaceability of timestamp t in the frequency domain is measured.

[0129] S2-2, Spectral Difference Calculation: Similar to the point-level spectral difference calculation, the sequence-level spectral difference calculation process is also very simple. Taking the t-th timestamp of the m-th variable as an example, the calculation process is as follows:

[0130] First, the two neighborhood sequences are transformed using the Fast Fourier Transform function FFT and (each sequence length is LS) is transformed into Frequency components:

[0131] (6)

[0132] in, , . represents the fast Fourier function, represents the frequency component of the neighborhood sequence in the frequency domain, Represents the frequency components of the replacement sequence in the frequency domain.

[0133] Secondly, in the frequency domain, we calculate and The amplitude of is defined as follows:

[0134] (7)

[0135] in, , represents the amplitude calculation function, represents the amplitude of the neighborhood sequence in the frequency domain, Represents the amplitude of the replacement sequence in the frequency domain.

[0136] Finally, the mean square error (MSE) function is used to measure the sequence-level spectrum difference of each timestamp as follows:

[0137] (8)

[0138] in, is the sequence-level spectrum difference at the t-th timestamp.

[0139] Step S3: Abnormal scoring based on spectral differences

[0140] In this embodiment, a personalized scoring strategy based on spectrum difference is proposed, which combines the point-level and sequence-level spectrum differences to generate an anomaly score for each timestamp in the industrial multi-sensor signal. The scoring process of the t-th timestamp is as follows: Figure 2 As shown in (c).

[0141] First, the tth timestamp It is input into the point-level and sequence-level spectrum difference calculation modules at the same time. Then, in each module, M Second, after the calculation is completed, each variable Generates point-level and sequence-level spectrum differences and , and used as the point-level and sequence-level anomaly scores of the t-th timestamp on its variable. Then, the point-level and sequence-level average anomaly scores of the M variables are calculated respectively:

[0142] ;

[0143] ;

[0144] Finally, the final score of the t-th timestamp is generated by the following formula:

[0145] (9)

[0146] in, It is a preset parameter, ranging from [0 to 1]. When is 0, only the sequence-level anomaly score is considered. When is 1, only the point-level anomaly score is considered. After obtaining the anomaly score, use formula (2) to determine whether the tth timestamp is an anomaly point.

[0147] Experimental verification

[0148] (1) Experimental dataset

[0149] This verification selected eight publicly available real-world sensor time signals from diverse IIoT environments as experimental datasets. These datasets include two univariate and six multivariate datasets, as shown in Table 1. MSL, GECCO, Genesis, HAI, SKAB, and SWaT are multivariate IIoT time signals, while Dodgers and UCR are univariate IIoT time signals. These datasets cover various industrial sectors, including aviation, water treatment, mechanical manufacturing, and transportation, to ensure fair evaluation.

[0150] Table 1 Eight public datasets

[0151]

[0152] Specifically: The MSL dataset captures the operating status of multiple sensors or controllers on the Mars rover. The GECCO dataset stores drinking water quality data from multiple IoT sensors. The Genesis dataset records five continuous signals and thirteen discrete signals from multiple sensors in the Industrial IoT. The SWAT dataset consists of 51-dimensional data collected by sensors in public water treatment infrastructure. The HAI dataset contains multiple industrial signals from pumps, valves, pressure sensors, and other common industrial equipment. The Dodgers dataset consists of traffic flow data collected by induction loop sensors on roads near the Los Angeles Dodger Stadium. The UCR dataset is a publicly available Industrial IoT dataset that contains only one signal and one anomaly.

[0153] (2) Comparison methods and evaluation indicators

[0154] 1) Comparison method

[0155] To validate the effectiveness of our FADSD method, nine representative state-of-the-art (SOTA) methods were selected as competitors, as listed in Table 2. In terms of network structure, DCdetector, ATF-UAD, FC-VAC, DTAAD, and DIF are anomaly detection methods based on deep neural networks, with multi-layer structures and large parameters. In contrast, IForest, PCA, Optiforst, LODA, and FADSD are shallow anomaly detection methods based on non-neural networks. In terms of time and frequency domains, DIF, Optiforest, DCdetector, LODA, PCA, IFoest, and DTAAD perform anomaly detection only in the time domain. FCVAE and ATF-UAD perform anomaly detection in both the time and frequency domains, while our FADSD only uses the frequency domain to perform anomaly detection.

[0156] Table 2 Comparison methods

[0157]

[0158] 2) Evaluation Metrics

[0159] To perform a comprehensive and comprehensive evaluation, four widely recognized metrics were used: Accuracy (ACC), Precision, Recall, and F1-Score. Accuracy (ACC) represents the ratio of correctly predicted samples to the total number of samples. Precision represents the proportion of correctly predicted normal timestamps among all predicted normal timestamps. Recall reflects the proportion of actual normal timestamps that were correctly identified. The F1-Score combines Recall and Precision to provide a more balanced evaluation. Generally speaking, these evaluation metrics range from 0 to 1, with higher values ​​indicating better anomaly detection accuracy.

[0160] (3) Accuracy experiment

[0161] Ten methods are compared on eight industrial IoT datasets, and their accuracy is shown in Table 3. In the table, the best performance is highlighted in bold, while the second best performance is underlined. From the table, several findings can be observed:

[0162] 1) Overall Performance: FADSD performs best, followed by DCdetector, FCVAE, ATF-UAD, DIF, and DTAAD, while Optiforest, LODA, IForest, and PCA perform worst. For example, on the SWAT dataset, FADSD achieves an ACC of 0.9924 and an F1 of 0.9688, while PCA achieves an ACC of only 0.5761 and an F1 of only 0.5852.

[0163] 2) Stability: FADSD showed the most stable performance in all four evaluation metrics, followed closely by DC detector, DIF, and FCVAE. For example, on the HAI and SKAB datasets, FADSD achieved three first-place and one second-place results.

[0164] 3) Joint Time-Frequency Domain: The FADSD method outperforms other methods based on joint time-frequency domain learning (FC-VAE and ATF-UAD). For example, on the MSL dataset, FADSD achieved an ACC of 0.9926 and an F1 of 0.9378, while FCVAE achieved an ACC of 0.9632 and an F1 of 0.8440, and ATF-UAD achieved an ACC of 0.9223 and an F1 of 0.7789.

[0165] 4) Deep vs. Shallow Architectures: Deep neural network-based methods (DIF, DCdetector, FCVAE, ATF-UAD, DTAAD) generally outperform shallow methods (IForest, PCA, Optiforest, LODA). However, our shallow FADSD method surpasses several deep methods. For example, on the SWAT dataset, FADSD achieves an F1 score of 0.9688, surpassing DCdetector's 0.9649, FCVAE's 0.9459, IForest's 0.4182, and LODA's 0.7469.

[0166] 5) Conclusion: The non-neural network-based FADSD demonstrated comparable performance to deep methods, and even surpassed them in some datasets. This result further demonstrates the effectiveness of the proposed frequency domain analysis for sensor signal anomaly detection.

[0167] Table 3 Performance analysis of eight industrial physical network datasets

[0168]

[0169] (4) Deployability Experiment

[0170] Ten methods are deployed experimentally on two IIoT edge devices with different resources.

[0171] 1) Thick Edge Device: Raspberry Pi 4b. A Raspberry Pi 4b equipped with a 1.5GHz ARM Cortex-A72 processor and 2GB of RAM was selected as the first edge device. In this experiment, two shallow methods (PCA and FADSD) used an online deployment scheme, performing real-time anomaly detection without training. The other three shallow machine learning-based methods (IForest, LODA, and Optiforest) and five deep methods (DIF, DCdetector, FCVAE, ATF-UAD, and DTAAD) all used an offline deployment scheme. These models were first trained in the cloud and then deployed to the edge device.

[0172] Figure 4 The figure shows the results of deployment on a Raspberry Pi 4b. Two results are shown in the figure: deployability and convenience.

[0173] Deployability: All ten methods can be successfully deployed. In comparison, the shallow method has a simpler and easier deployment process.

[0174] Convenience: In an IIoT environment, production processes frequently change, leading to dynamic fluctuations in time signals. Shallow methods deployed online can be used directly to address these dynamic IIoT time signals. In contrast, deep methods deployed offline must be fine-tuned in the cloud and redeployed at the edge before they can be reused. Furthermore, shallow methods are generally faster and require fewer resources.

[0175] 2) Thin edge device: STM32. We chose the STM32F407 with a 160MHz ARM Cortex-M4 processor and 1MB RAM as the second edge device. Due to the 1MB RAM limitation, many deep methods cannot be deployed. The deployment results on the STM32 are shown in Figure 2. Figure 5 As shown in the figure, we can see that:

[0176] Deployability: Only five shallow non-neural network-based methods were successfully deployed, as deep neural network-based methods required more than 1MB of RAM.

[0177] Convenience: Compared with other shallow methods, the FADSD method is easier to deploy and has similar speed and resource consumption.

[0178] 3) Summary: Compared with methods based on deep neural networks, anomaly detection methods based on shallow non-neural networks are easier to deploy on resource-limited industrial IoT edge devices and are more suitable for the anomaly detection needs of Industry 4.0.

[0179] (5) Timeliness and resource consumption experiments

[0180] This experiment further compared the timeliness and resource consumption of ten methods in three deployment environments: a powerful PC, a moderately resourced Raspberry Pi 4b, and a resource-scarce STM32 F407. In the PC environment, model parameters, one-epoch processing time for the same batch size (one-epoch-time), CPU and GPU usage (CPU-GPU-Usage), RAM usage (RAM-Usage), and VGA RAM usage (VGA-RAM-Usage) were selected as evaluation metrics. In the Raspberry Pi 4b environment, the detection time for 100 timestamps (100-timestamps-time), CPU usage (CPU-Usage), and RAM usage (RAM-Usage) were selected as evaluation metrics. In the STM32 environment, the detection time for a single timestamp (1-timestamp-time), CPU usage (CPU-Usage), and RAM usage (RAM-Usage) were used as evaluation metrics.

[0181] Table 4 lists the comparison results of the ten methods, where “-” indicates that no data is available. From the table, we can get:

[0182] 1) Timeliness: The five shallow methods (IForest, PCA, Optiforst, Loda, and FADSD) were significantly faster than the deep methods (DIF, DCdetector, FCVAE, ATF-UAD, and DTAAD) in all three deployment environments. For example, on a PC, the five shallow methods averaged 81.18 seconds, while the five deep methods averaged 326.74 seconds. Among the five shallow methods, our FADSD method achieved comparable detection times to the others. For example, on a Raspberry Pi 4b, FADFD took 29.2 seconds, while PCA took 24.1 seconds.

[0183] 2) Computational Consumption: Shallow methods have slightly higher computational resource utilization than deep methods. This is primarily because deep methods are deployed offline on edge devices, with all training computation performed in the cloud. For example, the shallow IForest method uses 52% CPU on a Raspberry Pi 4b, while the deep ATF-UAD method uses 32%. Comparing these five shallow methods, their CPU utilization is similar.

[0184] 3) Memory Consumption: Deep methods consume more memory resources than shallow methods. For example, in a PC environment, the deep DCdetector method uses 18.1GB of RAM and 15.3GB of VGA RAM, while the FADSD method uses 2.9GB. Among shallow methods, the FADSD method uses slightly more memory resources than other methods. For example, on an STM32, FADSD uses 154KB of RAM, IForest uses 136KB of RAM, and LODA uses 132KB of RAM.

[0185] 4) Summary: The FADSD method exhibits good timeliness and low resource consumption, enabling it to run well on resource-limited edge devices.

[0186] Table 4 Timeliness and resource consumption

[0187]

[0188] This paper proposes a timestamp-level anomaly detection method (FADSD) based on spectral differences for Industrial Internet of Things (IIoT) sensor signals (time series). This method offers the advantages of high speed, high accuracy, and low resource consumption. Unlike traditional neural network-based approaches, FADSD adopts a lightweight, non-neural network-based approach that utilizes only frequency domain features for anomaly detection. This is the first work in the field of anomaly detection to achieve fine-grained timestamp-level anomaly detection using only the frequency domain. First, a point-level spectral difference calculation module is designed to accurately identify overt anomalies in multi-sensor signals. Second, a sequence-level spectral difference calculation module is designed to complement the first module and accurately identify latent anomalies in multi-sensor signals. Finally, a novel anomaly scoring strategy is proposed that combines point-level and sequence-level spectral differences to generate an accurate identification score for each timestamp. Extensive experiments on eight IIoT sensor time signal datasets demonstrate that the FADSD method outperforms several deep state-of-the-art methods in detection accuracy. Furthermore, deployment experiments on an STM32 and a Raspberry Pi 4b further demonstrate the high speed and low resource consumption of the FADSD method, making it easily deployable on resource-constrained edge devices.

[0189] The above examples are merely preferred embodiments of the present invention and are not intended to limit the present invention in any way. Although the present invention has been disclosed above with reference to preferred embodiments, they are not intended to limit the present invention. Therefore, any simple modifications, equivalent variations, and modifications to the above examples that do not depart from the technical solution of the present invention and are based on the technical essence of the present invention shall fall within the scope of protection of the technical solution of the present invention.

Claims

1. A timestamp-level fast anomaly detection method for industrial Internet of Things based on frequency domain spectrum difference, characterized in that: Fine-grained anomaly detection of multi-sensor signals for the Industrial Internet is performed using a non-neural network approach in the frequency domain only; this includes the following: The algorithm uses only the spectrum difference in the frequency domain as the evaluation metric for timestamp-level anomaly detection. It designs point-level and sequence-level spectrum difference calculation modules as two complementary branches to jointly generate the spectrum difference in the frequency domain for each timestamp. It also designs an anomaly scoring strategy that combines the point-level and sequence-level spectrum differences to generate an anomaly score for each timestamp, thereby determining whether the timestamp is an anomaly. The point-level spectrum difference calculation module is used to identify explicit anomalies in industrial time signals, and the sequence-level spectrum difference calculation module is used to identify implicit anomalies in time signals. The design point-level spectrum difference calculation module includes point-level sampling, and the point-level sampling includes: generating a length of L The length of the neighborhood sequence and another one that does not contain the timestamp is L replacement sequence; in a M variables and T timestamps in industrial multi-sensor time signals ; The generation process of the neighborhood sequence and replacement sequence of the t-th timestamp on the m-th variable is: First, generate the neighborhood sequence: from the mth variable Extract the range in arrive The timestamps between them form a neighborhood sequence ; Next, generate the replacement sequence: calculate The average value Avg of all timestamps except the t-th timestamp is replaced by Avg The value of the t-th timestamp in generates a replacement sequence ; Finally, the spectrum difference between the neighborhood sequence of length L and the replacement sequence is calculated in the frequency domain to evaluate the replaceability of timestamp t in the frequency domain; The design sequence level spectrum difference calculation module includes sequence level sampling, and the sequence level sampling includes: generating a length of for each timestamp LG A substitute subsequence of length , and then generate a substitute subsequence of length LS The length of the neighborhood sequence and another subsequence that does not contain a substitute is LS replacement sequence; in a M variables and T timestamps in industrial multi-sensor time signals , the sampling process of the t-th timestamp on the m-th variable is as follows: First, extract neighbors: from the mth variable Extract the range in arrive The timestamp in the initial neighborhood sequence ; Then, group: All data in are divided into G groups in sequence, each group contains LG timestamps, ; Secondly, generate a substitute subsequence: consider the group where timestamp t is located as its substitute subsequence; Next, generate a neighborhood sequence for the surrogate subsequence: consider the entire initial neighborhood sequence as the neighborhood sequence of the surrogate subsequence ; Again, generate a replacement sequence for the substitute subsequence: replace the value of each timestamp in the substitute subsequence with the average value of the corresponding position in other groups to generate a replacement sequence for the substitute subsequence ; Finally, the spectrum difference between the neighborhood sequence of length LS and the replacement sequence is calculated in the frequency domain, and the sequence-level replaceability of timestamp t in the frequency domain is measured.

2. The method for rapid anomaly detection at timestamp level based on frequency domain spectrum difference in industrial Internet of Things according to claim 1 is characterized in that: The anomaly detection method comprises the following steps: Step S1: Using a point-level spectrum difference calculation module to identify dominant anomalies in multi-sensor time signals using frequency domain features; calculating the difference in frequency domain features between each timestamp within a fixed-length neighborhood with and without the timestamp, and using this difference as the substitutability of the timestamp in the frequency domain; identifying dominant timestamp anomalies based on the substitutability; Step S2: Using a sequence-level spectrum difference calculation module to identify hidden anomalies in multi-sensor time signals; using several adjacent timestamps around each timestamp as its stand-in subsequences; calculating the change in frequency domain characteristics of each timestamp within a fixed-length neighborhood with and without its stand-in sequence; using the difference in spectral feature changes of the stand-in subsequences as the substitutability of the timestamp; and identifying hidden timestamp anomalies based on the substitutability; In step S3, the point-level and sequence-level spectrum differences are fused with different weights to generate an anomaly score for each timestamp; whether each timestamp is an anomaly point is determined by formula (2): （2） in, represents the final anomaly score at the t-th timestamp, is the preset threshold, ranging from 0 to 1; represents the predicted label of the t-th timestamp; if , then the tth timestamp is judged to be abnormal; otherwise, it is judged to be normal.

3. The method for fast anomaly detection at timestamp level based on frequency domain spectrum difference in industrial Internet of Things according to claim 2 is characterized in that: The steps S1 and S2 are two independent complementary branches, and the learning processes of the two branches are executed in parallel with complementary interference.

4. The method for fast anomaly detection at timestamp level based on frequency domain spectrum difference in industrial Internet of Things according to claim 2 is characterized in that: The spectrum difference calculation in step S1: The spectrum difference calculation process of the t-th timestamp on the m-th variable in the frequency domain is: First, the fast Fourier transform function is used to transform two neighborhood sequences of length L into and Transformed into frequency components, as follows: （3） in, , ; represents the fast Fourier function, represents the frequency component of the neighborhood sequence in the frequency domain, Represents the frequency components of the replacement sequence in the frequency domain; Secondly, calculate and The amplitude in the frequency domain is given by and The frequency domain characteristics are: （4） in, , represents the amplitude calculation function, represents the amplitude value of the neighborhood sequence, represents the amplitude value of the replacement sequence; Finally, the mean square error function is used to measure the amplitude difference of the t-th timestamp in the frequency domain, which is: （5） in, , It represents the point-level spectrum difference of the t-th timestamp, is the mean square error function.

5. The method for rapid anomaly detection at timestamp level based on frequency domain spectrum difference in industrial Internet of Things according to claim 4 is characterized in that: The spectrum difference calculation in step S2: The sequence-level spectrum difference calculation process of the t-th timestamp on the m-th variable is: First, the two neighborhood sequences are transformed using the fast Fourier transform function FFT() and Transformed into Frequency components: （6） in, , ; represents the frequency component of the neighborhood sequence in the frequency domain, Represents the frequency components of the replacement sequence in the frequency domain; Secondly, in the frequency domain, we calculate and The amplitude is: （7） in, , represents the amplitude calculation function, represents the amplitude of the neighborhood sequence in the frequency domain, represents the amplitude of the replacement sequence in the frequency domain; Finally, the mean square error function is used to measure the sequence-level spectrum difference of each timestamp: （8） in, is the sequence-level spectrum difference at the t-th timestamp.

6. The method for rapid anomaly detection at timestamp level based on frequency domain spectrum difference in industrial Internet of Things according to claim 5 is characterized in that: In step S1 or step S2, the spectrum difference calculation process adopts a variable-independent learning mode; the sampling process or spectrum difference calculation process on each variable is independent and does not interfere with each other and is executed in parallel.

7. The method for fast anomaly detection at timestamp level based on frequency domain spectrum difference in industrial Internet of Things according to claim 4 is characterized in that: In the step S3, Includes the following: First, have M A timestamp in the sensor signal to be detected for each variable It will be input into the point-level and sequence-level spectrum difference calculation modules to perform variable-independent difference calculations. Then, in a variable Two frequency domain differences are generated for timestamp t: point-level spectrum differences and sequence-level spectral differences , and as the t-th timestamp in the variable m Point-level anomaly scores and sequence-level anomaly scores on ; Next, calculate the point-level and sequence-level average anomaly scores of the M variables respectively: ； ； Finally, the final anomaly score for the t-th timestamp is generated: （9） in, is a preset parameter, ranging from [0 to 1]; when When it is 0, only the sequence-level anomaly score is considered; when When it is 1, only the point-level anomaly score is considered; After obtaining the final anomaly score, use formula (2) to determine whether the tth timestamp is an anomaly point.

Images