Industrial Internet of Things anomaly detection method based on time-frequency domain cooperation under full MLP lightweight architecture

Abstract

The invention discloses a time-frequency domain cooperative industrial Internet of Things anomaly detection method under a full MLP lightweight architecture, and the method only employs four parallel two-layer MLP networks to construct a lightweight full MLP architecture with high timeliness and low resource consumption, and guarantees that the lightweight full MLP architecture can be flexibly applied in an industrial scene with limited resources. According to the architecture, a double-branch reconstruction learning process is constructed from two angles of'local to global 'and'global to local'; in order to further improve the accuracy, the reconstruction learning process of each branch utilizes two two-layer MLP networks to carry out reconstruction learning in a time domain and a frequency domain respectively, and the time domain and the frequency domain are aligned by utilizing reconstruction consistency, so that the feature capture capability of the full MLP architecture is improved; and finally, designing an anomaly scoring scheme based on a time-frequency reconstruction error, fusing the time-frequency domain reconstruction error obtained in double-branch reconstruction learning by using different weights, thereby generating a final anomaly score for each timestamp, and further judging whether the timestamp is abnormal or not.

Description

Technical Field

[0001] The present invention relates to the technical field of abnormal signal detection of sensors, and in particular to an industrial Internet of Things anomaly detection method based on time-frequency domain collaboration under a full MLP lightweight architecture. Background Art

[0002] The Industrial Internet of Things plays a vital role in promoting industrial intelligence and intelligent manufacturing. Specifically, it integrates a variety of heterogeneous sensors, such as pressure, vibration, and angle sensors, to monitor and control the operating status of industrial equipment or industrial production processes. Under the influence of the Industrial Internet of Things, traditional independent and relatively safe industrial systems or industrial equipment have begun to interconnect with each other and connect to external networks, which has led to these systems or equipment becoming increasingly vulnerable to external attacks and abnormal operation. In addition, the rapid expansion of the Industrial Internet of Things has also forced the deployment of more sensors to perform more fine-grained management and control of industrial systems and equipment. However, these sensors are often exposed to harsh production environments, such as humidity and darkness, making them susceptible to external interference and mechanical failures that lead to abnormalities. Under such circumstances, abnormal events often occur in sensors in the Industrial Internet of Things system, which may hinder the intelligent management and maintenance of industrial equipment or production, or even cause equipment damage, property loss, or casualties. Therefore, anomaly detection in the Industrial Internet of Things is crucial and has always been a challenging research hotspot.

[0003] In order to detect abnormal events in the Industrial Internet of Things, early methods relied on the statistical characteristics of sensor signals (such as distance, variance, and density) to build detection models. However, these models have difficulty capturing the complex characteristics of sensor signals, resulting in insufficient accuracy. To solve this problem, people began to explore machine learning and deep learning-based models. They use large historical data sets and expensive manual labels and use supervised learning or semi-supervised learning to accurately capture the complex characteristics in sensor signals, thereby improving model accuracy. However, abnormal labels in Industrial Internet of Things systems are very scarce and the cost of generating labels is very expensive, which has caused supervised or semi-supervised deep anomaly detection models to gradually lose their competitiveness. For this reason, anomaly detection models based on unsupervised deep learning [8] have become the mainstream research in recent years.

[0004] The sensor signals of the Industrial Internet of Things have some new characteristics, which also bring some new challenges to anomaly detection.

[0005] Challenge 1: It is difficult to accurately extract complex features within sensor signals. Driven by the growing demand for high-quality production, traditional production processes have become increasingly complex, showing multiple operating modes such as seasonality, cyclicality, and trending. These complex production processes not only lead to increasingly complex signals collected by sensors, but also require more fine-grained intelligent management and monitoring. To this end, the Industrial Internet of Things needs to deploy more sensors to monitor the production process more deeply and comprehensively. Therefore, the Industrial Internet of Things sensor signals collected by multiple sensors present some new characteristics: more complex features, more variables, stronger variable coupling, larger data volume, and scarcer labels. These new characteristics make it more difficult to identify abnormal signals from normal sensor signals.

[0006] Challenge 2: Ignoring the high timeliness and low consumption required by the model in resource-limited scenarios. In general, the resources of control and perception devices in industrial scenarios are very limited, such as weak computing power and limited storage capacity. However, fine-grained industrial intelligent control requires real-time and accurate monitoring and management of these resource-limited devices. In this context, an efficient anomaly detection model in the Industrial Internet of Things should have high timeliness, low resource consumption and high accuracy. Only with these three advantages can the accurate and real-time detection of early anomalies be achieved in resource-efficient industrial scenarios. Moreover, compared with high accuracy, high timeliness and low resource consumption are the capabilities that anomaly detection models or methods should pursue or possess first. Therefore, an ideal Industrial Internet of Things anomaly detection model should minimize the use of computing and storage resources while detecting sensor signal anomalies as quickly as possible. However, existing models are often only keen on pursuing high accuracy by building deep and large neural networks, ignoring the problem of limited resources, resulting in poor timeliness and high resource consumption of existing models. Most of them can only be deployed in the cloud and cannot be deployed on edge devices with limited resources.

[0007] To address the first challenge, existing solutions focus on building bloated neural networks with deep structures and large parameters to enhance the model's feature capture capabilities and thus improve model accuracy. For example, the AnomalyTransformer model and the DCdetector model use Transformer networks and attention networks as feature extractors, respectively, to extract complex features from sensor signals. C. Tang et al. employed a gated recurrent unit network (GRU) to accurately capture short-term and long-term temporal dependencies. The DTAAD model integrates a Transformer network and a bidirectional temporal convolutional network (TCN) to improve feature extraction capabilities. Similarly, the MSt-Gat model and the 2P-DAs model use graph neural networks (GNNs) and generative adversarial networks (GANs) to more accurately capture the features of sensor signals. However, the huge parameters in these models usually lead to high CPU / GPU resource consumption, and their deep architectures significantly increase training and detection time. This results in existing models being able to only be deployed on resource-rich clouds and difficult to deploy directly on resource-limited edge devices.

[0008] To address the second challenge, existing solutions are divided into the following two categories. The first category uses technologies such as parallel computing and federated learning to accelerate the detection model, thereby improving the timeliness of the model. However, although this solution achieves high timeliness, it requires more computing and storage resources. Therefore, this solution is difficult to deploy on resource-limited industrial IoT edge devices. The second category uses lightweight components to replace the computationally intensive components in the bloated deep model, thereby greatly reducing model parameters, improving model timeliness, and reducing model resource consumption. However, these models still have deep structures, and their improvements in timeliness and resource consumption are still unsatisfactory. This makes it difficult for them to be deployed and run smoothly on resource-limited edge devices.

[0009] In summary, most existing models are keen on obtaining high accuracy by building bloated neural networks with deep structures and huge parameters. As a result, these models usually exhibit poor timeliness and high resource consumption, making them unsuitable for resource-limited edge industrial scenarios. Summary of the invention

[0010] In response to the above-mentioned technical problems to be solved, the present invention provides an industrial Internet of Things anomaly detection method with time-frequency domain collaboration under a full MLP lightweight architecture, which has the advantages of high precision, high timeliness and low resource consumption.

[0011] In order to solve the above technical problems, the technical solution proposed by the present invention is:

[0012] An industrial Internet of Things anomaly detection method with time-frequency domain collaboration under a full MLP lightweight architecture, the anomaly detection method constructs a dual-branch reconstruction learning process from the two perspectives of "local to global" and "global to local"; the reconstruction learning process of each branch uses two two-layer MLP networks to perform reconstruction learning in the time domain and frequency domain respectively, and aligns the time domain and frequency domain using reconstruction consistency; the time-frequency domain reconstruction errors obtained in the reconstruction learning of the two branches are fused using different weights to determine whether each timestamp is abnormal; specifically, the following steps are included:

[0013] Step S1, variables are sampled independently to generate local neighbors and global neighbors for each timestamp;

[0014] Step S2, local to global time-frequency domain collaborative reconstruction learning, as the first reconstruction learning branch of the full MLP framework; employ a two-layer MLP network based on real numbers to perform "local to global" reconstruction learning in the time domain; and employ another two-layer MLP network based on complex numbers to perform "local to global" reconstruction learning in the frequency domain; and use the consistency of the global reconstruction values ​​in the time domain and frequency domain to align the time domain and frequency domain;

[0015] Step S3, global to local time-frequency domain collaborative reconstruction learning, as the second reconstruction learning branch of the full MLP framework, applies a two-layer MLP network based on real numbers to perform "global to local" reconstruction learning in the time domain; at the same time, another two-layer MLP network based on complex numbers is applied to perform "global to local" reconstruction learning in the frequency domain; the consistency of local reconstruction values ​​in the time domain and frequency domain is used to align the time domain and frequency domain;

[0016] Step S4, based on the anomaly scoring of the time-frequency reconstruction error, based on the time-frequency domain reconstruction error obtained in the dual-branch reconstruction learning process, uses different weights to fuse the two errors to generate an anomaly score for each timestamp to determine whether it is abnormal.

[0017] As a further improvement of the above technical solution:

[0018] Preferably, in step S1, the independent sampling process of the variable at the t-th time on the m-th variable is assumed to be:

[0019] S1-1, local neighbor generation, intercepting a neighbor sequence of length L with timestamp t as the center as local neighbors of timestamp t;

[0020] S1-2, candidate global neighbor generation, extracting a neighbor sequence of length G with timestamp t as the center As candidate global neighbors, where L < G;

[0021] S1-3, global neighbor generation, mark the remaining timestamps in the candidate neighbor sequence except the local neighbors as the global neighbors of timestamp t Its length is (GL);

[0022] S1-4, multi-variable parallel sampling, the sampling process of multiple variables in the same industrial IoT sensor data set is the same and can be executed in parallel.

[0023] Preferably, in step S2, the specific learning process is:

[0024] S2-1, time domain reconstruction learning, uses a two-layer MLP network based on real numbers to perform local to global reconstruction learning in the time domain; the MLP network includes an input layer with L neurons for receiving local neighbors of each timestamp; a hidden layer with d neurons and a ReLU activation function for capturing associated features; and an output layer with (GL) neurons for reconstructing global neighbors; the input layer and the hidden layer form a first fully connected layer with L×d trainable parameters; the hidden layer and the output layer form a second fully connected layer with d×(GL) trainable parameters;

[0025] S2-2, frequency domain reconstruction learning, uses another two-layer MLP network based on complex numbers to perform reconstruction learning, wherein the MLP network consists of an input layer with L / 2 neurons, a hidden layer with d neurons and a zReLU activation function, and an output layer with (GL) / 2 neurons; the input layer and the hidden layer form a first fully connected layer containing (L / 2)×d parameters, and the hidden layer and the output layer form a second fully connected layer containing d×[(GL) / 2] parameters;

[0026] S2-3, loss function, constructs a loss function consisting of three parts, including time domain reconstruction loss, frequency domain reconstruction loss and time-frequency domain consistency loss;

[0027] The first part is the reconstruction loss of the global neighbors in the time domain, which is:

[0028]

[0029] Where T is the number of timestamps, M is the number of variables, (GL) is the length of the global neighborhood, and are the time-domain reconstructed value and actual value of the i-th global neighbor at timestamp t on the m-th variable, respectively;

[0030] The second part is the reconstruction loss of the global neighbors in the frequency domain, which is:

[0031]

[0032] in, is the reconstructed value of the global neighbor in the frequency domain;

[0033] The third part is the time-frequency domain consistency loss, which is used to align the time domain and the frequency domain. The time-frequency domain consistency loss aims to minimize the difference between the reconstructed values ​​in the time domain and the frequency domain, which is:

[0034]

[0035] 1. Preferably, in the time domain reconstruction learning, the local to global reconstruction learning process of the t-th timestamp of the m-th variable is assumed to be:

[0036] S2-1-1, local neighbors of length L Input into the first fully connected layer of the first real MLP in the first reconstruction branch to extract the time domain features. The extraction formula is:

[0037]

[0038] in, is the output of the first fully connected layer, is the training parameter of the first fully connected layer, and ReLU is the activation function;

[0039] S2-1-2, extract the time domain features LF t Tim The global neighbors of timestamp t are reconstructed by the second fully connected layer of the first real MLP in the first reconstruction branch. The reconstruction formula is:

[0040]

[0041] in, represents the global reconstruction value, Represents the training parameters of the second fully connected layer.

[0042] 10. Preferably, in the frequency domain reconstruction learning, the local to global reconstruction process of the t-th timestamp of the m-th variable is as follows:

[0043] S2-2-1, use fast Fourier transform to transform the local neighborhood of length L Converted to frequency components of length L / 2 The formula is:

[0044]

[0045] where each frequency component is a complex number,

[0046] S2-2-2, the frequency component Input to the first fully connected layer of the second complex MLP in the first reconstruction branch to obtain the frequency domain feature LF t Fre :

[0047]

[0048] in, is the output of the first fully connected layer, is the training parameter of the first fully connected layer; zReLU() is the complex activation function, θ z represents the phase of the complex number z;

[0049] S2-2-3, the obtained frequency domain feature LF t Fre The second fully connected layer of the second complex MLP in the first reconstruction branch is fed into the frequency components of the global neighbors:

[0050]

[0051] in, is the output of the second fully connected layer, are the training parameters of the second fully connected layer;

[0052] S2-2-4, apply inverse fast Fourier transform to reconstruct the frequency component GF t m Transform back to the global neighborhood of timestamp t in the time domain:

[0053]

[0054] in, is the reconstructed value of the global neighbor generated from the frequency domain.

[0055] 11. Preferably, in step S3, the specific learning process is:

[0056] S3-1, time domain reconstruction learning, uses a two-layer MLP network based on real numbers to perform global-to-local reconstruction learning in the time domain, wherein the MLP network consists of an input layer with (GL) neurons, a hidden layer with d neurons, and an output layer with L neurons; the input layer and the hidden layer form a first fully connected layer containing (GL)×d training parameters, and the hidden layer and the output layer form a second fully connected layer containing d×L training parameters;

[0057] S3-2, frequency domain reconstruction learning, uses another complex-based two-layer MLP network to perform global-to-local reconstruction learning in the frequency domain, wherein the MLP consists of an input layer with (GL) / 2 neurons, a hidden layer with d neurons, and an output layer with L / 2 neurons; the input layer and the hidden layer form a network containing

[0058] A first fully connected layer of [(GL) / 2]×d training parameters, wherein the hidden layer and the output layer form a second fully connected layer containing d×(L / 2) training parameters;

[0059] S3-3, loss function, the loss function consists of three parts, including time domain reconstruction loss, frequency domain reconstruction loss and time-frequency domain consistency loss;

[0060] The time domain reconstruction loss is:

[0061]

[0062] Where L is the length of the local neighborhood, and are the reconstructed values ​​and true values ​​of the local neighbors in the time domain; the frequency domain reconstruction loss is:

[0063]

[0064] in, is the reconstructed value of the local neighbor in the frequency domain;

[0065] The time-frequency domain consistency loss is:

[0066]

[0067] 12. Preferably, in the time domain reconstruction learning, the global to local reconstruction process of the t-th timestamp on the m-th variable is assumed to be:

[0068] S3-1-1, the global neighbors of length (GL) Input to the first fully connected layer of the first real MLP in the second reconstruction branch to extract time domain features:

[0069]

[0070] in, is the output of the first fully connected layer, is the training parameter of the first fully connected layer, ReLU activation function;

[0071] S3-1-2, GF t TimInput to the second fully connected layer of the first real MLP in the second reconstruction branch to reconstruct the local neighbors of timestamp t:

[0072]

[0073] in, represents the reconstructed value of the local neighbor in the time domain, is the second fully connected layer training parameter.

[0074] 13. Preferably, in the frequency domain reconstruction learning, the global to local reconstruction process of the t-th timestamp on the m-th variable is assumed to be:

[0075] S3-2-1, use the fast Fourier transform function to transform the global neighbors of length (GL) Convert to frequency components of length (GL) / 2 The formula is:

[0076]

[0077] where each frequency component is a complex number,

[0078] S3-2-2, the obtained frequency components Input to the first fully connected layer of the second complex MLP in the second reconstruction branch to generate frequency domain features GF t Fre , the formula is:

[0079]

[0080] in, is the output of the first fully connected layer, is the training parameter of the first fully connected layer;

[0081] S3-2-3, frequency domain feature GF t Fre The frequency components of the local neighbors are input to the second fully connected layer of the second complex MLP in the second reconstruction branch. The formula is:

[0082]

[0083] in, is the output of the second fully connected layer, is the second fully connected layer training parameter;

[0084] S3-2-4, using inverse fast Fourier transform rFFT to generate the local neighbors of the reconstructed timestamp t:

[0085]

[0086] in, represents the reconstructed value of the global neighborhood generated from the frequency domain.

[0087] 14. Preferably, in step S4, the timestamp to be tested is set to t, and the abnormality scoring process is:

[0088] S4-1, the local neighbors and global neighbors of timestamp t are simultaneously input into two reconstruction learning branches to perform reconstruction learning of M variables in parallel;

[0089] S4-2, each branch generates three loss values ​​for each timestamp on each variable, and the sum of the three loss values ​​is regarded as the abnormal score of the variable at timestamp t. is the score of timestamp t on variable M in the first branch, is the score of timestamp t on variable M in the second branch;

[0090] S4-3, calculate the average anomaly score of the two branches on M variables and

[0091] S4-4, the two average anomaly scores are combined with different weights to generate the final anomaly score of timestamp t, which is:

[0092] Score t =β×ScoreL t +(1-β)×ScoreG t (twenty one)

[0093] Among them, β∈[0,1] is a preset parameter. When β=0, only the anomaly score of the second reconstruction branch is considered. When β=1, only the anomaly score of the first reconstruction branch is considered.

[0094] S4-5, after obtaining the anomaly score of timestamp t, determine whether the tth timestamp is abnormal:

[0095]

[0096] Among them, λ represents the preset threshold, ranging from 0 to 1; if The tth timestamp is an abnormal timestamp; otherwise, the tth timestamp is a normal timestamp.

[0097] Compared with the prior art, the time-frequency domain collaborative industrial Internet of Things anomaly detection method under the full MLP lightweight architecture provided by the present invention has the following advantages:

[0098] (1) The method of industrial IoT anomaly detection based on time-frequency domain collaboration under the full MLP lightweight architecture of the present invention abandons the traditional scheme based on deep and huge neural networks, and only uses four parallel two-layer MLPs to build a lightweight full MLP architecture, thereby achieving high-precision, high-timeliness and low-resource consumption timestamp-level anomaly detection. This is the first work on timestamp-level anomaly detection designed using only the full MLP lightweight architecture. Experiments on two edge terminals, Raspberry Pi 4b and NVIDIA JetsonXavier NX, prove that the LTFAD method can be easily deployed and run in industrial scenarios with limited resources.

[0099] (2) The present invention designs a novel dual-branch reconstruction learning framework for the time-frequency domain collaborative anomaly detection method of the industrial Internet of Things under the full MLP lightweight architecture. It uses a simple and shallow MLP network as the backbone, regards "global to local reconstruction learning" and "local to global reconstruction learning" as two independent branches, and simultaneously performs collaborative learning in the time domain and frequency domain in each branch to improve the reconstruction accuracy and enhance the accuracy of anomaly detection. This learning framework can provide a method reference for other fields such as sensor signal analysis or time series prediction. BRIEF DESCRIPTION OF THE DRAWINGS

[0100] Figure 1 It is an overview diagram of the detection method of the present invention.

[0101] Figure 2 It is a schematic diagram of independent sampling of variables of the present invention.

[0102] Figure 3 It is a diagram of the abnormal scoring process based on time-frequency reconstruction error of the present invention.

[0103] Figure 4 It is a screenshot of the operation process of the detection method of the present invention.

[0104] Figure 5 It is a graph of the detection results of all methods in the experimental verification of the present invention for the 4800 to 5000 timestamps of the first variable on the MSL dataset.

[0105] Figure 6 It is the deployment result on two industrial IoT edge devices in the experimental verification of the present invention.

[0106] Figure 7 It is a screenshot of the log file of the experimental verification shown in the present invention. DETAILED DESCRIPTION

[0107] The specific embodiments of the present invention are described in detail below. It should be understood that the specific embodiments described herein are only used to illustrate and explain the present invention, and are not used to limit the present invention.

[0108] The IIoT sensor signal is a time series, usually T observations of M heterogeneous sensors on an industrial dynamic system, expressed as This time series contains two dimensions: time dimension and variable (space) dimension. In the time dimension: the series is represented as where x t represents the observation value at the tth time stamp from M sensors. In the variable (space) dimension, the sequence is represented as where x m represents the observations at T timestamps from the mth sensor.

[0109] like Figures 1 to 3 As shown in the figure, the time-frequency domain collaborative anomaly detection method of the industrial Internet of Things under the full MLP lightweight architecture of the present invention, first, unlike the deep and bloated traditional solutions, the present invention designs a shallow lightweight full MLP architecture to achieve high timeliness and low resource consumption of anomaly detection. Secondly, based on the lightweight full MLP architecture, a dual-branch reconstruction network is constructed to simultaneously perform "global to local" and "local to global" reconstruction learning to improve the model accuracy. Finally, time-frequency domain collaborative learning is adopted in each reconstruction branch to further improve the accuracy of the model.

[0110] The time-frequency domain collaborative industrial Internet of Things anomaly detection method under the full MLP lightweight architecture of the present invention specifically includes the following steps:

[0111] Step S1, variable independent sampling.

[0112] Quickly generate local and global neighbors for each timestamp to prepare for the subsequent reconstruction learning of the two branches. In order to improve the speed, independent sampling of variables is performed, that is, the sampling process of each variable does not interfere with each other and can be executed in parallel.

[0113] like Figure 2 As shown, this embodiment designs a simple and fast variable-independent sampling strategy for generating a local neighbor and a global neighbor for each timestamp. Variable-independent sampling means that the sampling process of each variable does not interfere with each other and is executed in parallel.

[0114] Taking the tth timestamp on the mth variable as an example, the sampling process is as follows Figure 3 First, a neighbor sequence of length L is intercepted with timestamp t as the center as its local neighbor Secondly, another neighbor sequence of length G is extracted with timestamp t as the center, where L < G. Finally, the remaining timestamps in the second neighbor sequence except the local neighbors are identified as the global neighbors of timestamp t Its length is (GL).

[0115] Step S2: local to global time-frequency domain collaborative reconstruction learning.

[0116] A two-layer MLP network based on real numbers is employed to perform "local to global" reconstruction learning in the time domain, and another two-layer MLP network based on complex numbers is employed to perform "local to global" reconstruction learning in the frequency domain. The consistency of the global reconstruction values ​​in the time domain and frequency domain is used to align the time domain and frequency domain to improve the detection accuracy.

[0117] This embodiment designs a timestamp-level anomaly detection model with a shallow and lightweight full MLP architecture. However, compared with the traditional deep and large neural network, the lightweight architecture of the full MLP must have weaker representation capabilities, and thus the accuracy of anomaly detection is reduced. To solve this problem, this embodiment improves the accuracy of anomaly detection from two aspects.

[0118] The first aspect is to optimize the design of the full MLP architecture.

[0119] In general, normal timestamps in sensor signals present cyclical patterns such as periodicity and seasonality, while an anomaly is sudden, lasts for multiple timestamps, and has a significant difference in value from normal timestamps. In this case, the similarity between the local neighbors (closer timestamps) and global neighbors (farther timestamps) of the abnormal timestamp will be significantly different from the similarity between the local neighbors and global neighbors of the normal timestamp. This means that the similarity between local neighbors and global neighbors is used as an evaluation indicator for discovering abnormal timestamps from normal timestamps, so as to optimize the design of the full MLP lightweight architecture. Limited by the shallow full MLP architecture, the present invention selects reconstruction learning as a method for similarity calculation. Based on this, the present invention designs a dual-branch reconstruction network to learn the similarity between local and global neighbors from two perspectives: "local to global reconstruction" and "global to local reconstruction". In the learning of each perspective, the present invention uses one and only one two-layer MLP network to perform reconstruction learning.

[0120] The second aspect is to coordinate time domain and frequency domain learning to enhance the representation ability of the full MLP architecture.

[0121] Generally speaking, the time domain and the frequency domain are two complementary perspectives for analyzing a time signal. It is difficult to extract accurate features from sensor signals with complex features in the time domain, but their features are very simple in the frequency domain, and feature extraction is also easy. Therefore, the present invention simultaneously performs the reconstruction learning process of each branch in the time domain and the frequency domain, and uses consistency loss to align the time domain and the frequency domain. Through the collaborative learning mode of the time and frequency domains, the representation ability of the dual-branch reconstruction network based on the full MLP architecture will be enhanced.

[0122] Based on the above ideas, the present invention designs a local-to-global time-frequency domain collaborative reconstruction learning component as the first branch of the dual-branch reconstruction network. In this branch, the local neighbors of each timestamp will reconstruct their global neighbors through a two-layer MLP network in the time and frequency domains respectively. The resulting time-frequency domain reconstruction error will be used to represent the similarity between the two neighbors.

[0123] Specifically:

[0124] S2-1, Time Domain Reconstruction Learning

[0125] This embodiment uses only a two-layer MLP network to perform local-to-global reconstruction learning in the time domain. The MLP network includes an input layer with L neurons for receiving local neighbors for each timestamp; a hidden layer with d neurons activated by a ReLU function for capturing associated features; and an output layer with (GL) neurons for reconstructing global neighbors. In this MLP network, the input layer and the hidden layer form a first fully connected layer with L×d trainable parameters. The hidden layer and the output layer form a second fully connected layer with d×(GL) trainable parameters.

[0126] Taking the t-th timestamp of the m-th variable as an example, the local-to-global reconstruction learning process is described as follows:

[0127] S2-1-1, local neighbors of length L Input into the first fully connected layer of the first real MLP in the first reconstruction branch to extract the time domain features. The extraction formula is:

[0128]

[0129] in, is the output of the first fully connected layer, is the training parameter of the first fully connected layer, and ReLU is the activation function;

[0130] S2-1-2, extract the time domain features LF t Tim The second fully connected layer of the first real MLP in the first reconstruction branch is passed to reconstruct the global neighbors of timestamp t. The reconstruction formula is as follows:

[0131]

[0132] in, represents the global reconstruction value, Represents the training parameters of the second fully connected layer.

[0133] S2-2, frequency domain reconstruction learning

[0134] Similar to time domain reconstruction, frequency domain reconstruction learning employs another two-layer MLP network based on complex numbers to perform reconstruction learning. Specifically, the MLP network consists of an input layer with L / 2 neurons, a hidden layer with d neurons and zReLU activation function, and an output layer with (GL) / 2 neurons. In this network, the first fully connected layer contains (L / 2)×d parameters, and the second fully connected layer contains d×[(GL) / 2] parameters. Unlike the time domain MLP, each training parameter of the frequency domain MLP is a complex number instead of a real number.

[0135] Taking the tth timestamp of the mth variable as an example, the local to global reconstruction process is as follows:

[0136] S2-2-1, use fast Fourier transform to transform the local neighborhood of length L Converted to frequency components of length L / 2 The formula is as follows:

[0137]

[0138] where each frequency component is a complex number,

[0139] S2-2-2, the frequency component Input to the first fully connected layer of the second complex MLP in the first reconstruction branch to obtain the frequency domain feature LF t Fre :

[0140]

[0141] in, is the output of the first fully connected layer, is the training parameter of the first fully connected layer; zReLU() is the complex activation function, θ z represents the phase of the complex number z;

[0142] S2-2-3, the obtained frequency domain feature LF t Fre The second fully connected layer of the second complex MLP in the first reconstruction branch is input to reconstruct the frequency components of the global neighbors:

[0143]

[0144] in, is the output of the second fully connected layer, are the training parameters of the second fully connected layer;

[0145] S2-2-4, apply inverse fast Fourier transform to reconstruct the frequency component GFt m Transform back to the global neighborhood of timestamp t in the time domain:

[0146]

[0147] in, is the reconstructed value of the global neighbor generated from the frequency domain.

[0148] Furthermore, the reconstruction process of each timestamp within a variable is independent of each other. Similarly, the reconstruction process of M variables is also independent and can be calculated in parallel.

[0149] S2-3, loss function

[0150] To train two MLP networks in the time and frequency domains, the present invention constructs a loss function consisting of three parts.

[0151] The first part is the reconstruction loss of the global neighbors in the time domain, defined as:

[0152]

[0153] Where TL represents the time domain reconstruction loss, T is the number of timestamps, M is the number of variables, (GL) is the length of the global neighborhood, and are the time domain reconstructed value and actual value of the i-th global neighbor at timestamp t on the m-th variable, respectively.

[0154] The second part is the reconstruction loss of the global neighbors in the frequency domain, expressed as follows:

[0155]

[0156] Among them, FL represents the frequency domain reconstruction loss, is the reconstructed value of the global neighbor in the frequency domain.

[0157] The third part is the time-frequency domain consistency loss, which is used to align the time domain and the frequency domain. This loss aims to minimize the difference between the reconstructed values ​​in the time domain and the frequency domain, and is defined as follows:

[0158]

[0159] Among them, TFL represents the time-frequency domain consistency loss.

[0160] Step S3: global to local time-frequency domain collaborative reconstruction learning.

[0161] A two-layer MLP network based on real numbers is employed to perform "global to local" reconstruction learning in the time domain, while another two-layer MLP network based on complex numbers is employed to perform "global to local" reconstruction learning in the frequency domain, and the consistency of local reconstruction values ​​in the time domain and frequency domain are utilized to align the time domain and frequency domain.

[0162] In this embodiment, a global-to-local time-frequency domain collaborative reconstruction learning component is designed as the second branch of the dual-branch reconstruction network. The global neighbors of each timestamp are used to reconstruct its local neighbors, measuring the similarity between the two neighbors from another perspective to supplement the first branch.

[0163] Specifically:

[0164] S3-1, Time Domain Reconstruction Learning

[0165] A two-layer real MLP network is employed to perform global-to-local reconstruction learning in the time domain. The MLP network consists of an input layer with (GL) neurons, a hidden layer with d neurons, and an output layer with L neurons. In this MLP, the first fully connected layer contains (GL)×d training parameters, and the second fully connected layer contains d×L training parameters.

[0166] Taking the t-th timestamp on the m-th variable as an example, the global-to-local reconstruction process is as follows:

[0167] S3-1-1, the global neighbors of length (GL) Input to the first fully connected layer of the first real MLP in the second reconstruction branch to extract time domain features:

[0168]

[0169] in, is the output of the first fully connected layer, is the training parameter of the first fully connected layer, ReLU activation function;

[0170] S3-1-2, GF t Tim Input to the second fully connected layer of the first real MLP in the second reconstruction branch to reconstruct the local neighbors of timestamp t:

[0171]

[0172] in, represents the reconstructed value of the local neighbor in the time domain, is the second fully connected layer training parameter.

[0173] S3-2, Frequency Domain Reconstruction Learning

[0174] Another two-layer complex MLP network is employed to perform global-to-local reconstruction learning in the frequency domain. The MLP consists of an input layer with (GL) / 2 neurons, a hidden layer with d neurons, and an output layer with L / 2 neurons. The first fully connected layer contains [(GL) / 2]×d training parameters, and the second fully connected layer contains d×(L / 2) training parameters.

[0175] Taking the tth timestamp on the mth variable as an example, the global to local reconstruction process is as follows:

[0176] S3-2-1, use the fast Fourier transform function to transform the global neighbors of length (GL) Convert to frequency components of length (GL) / 2 The formula is:

[0177]

[0178] where each frequency component is a complex number,

[0179] S3-2-2, the obtained frequency components Input to the first fully connected layer of the second complex MLP in the second reconstruction branch to generate frequency domain features GF t Fre , the formula is:

[0180]

[0181] in, is the output of the first fully connected layer, is the training parameter of the first fully connected layer;

[0182] S3-2-3, frequency domain feature GF t Fre The frequency components LF of the local neighbors are reconstructed by inputting into the second fully connected layer of the second complex MLP in the second reconstruction branch t m , the formula is:

[0183]

[0184] in, is the output of the second fully connected layer, is the second fully connected layer training parameter;

[0185] S3-2-4, using inverse fast Fourier transform rFFT to generate the local neighbors of the reconstructed timestamp t:

[0186]

[0187] in, represents the reconstructed value of the global neighborhood generated from the frequency domain.

[0188] S3-3, loss function

[0189] The loss function consists of three parts: time domain reconstruction loss, frequency domain reconstruction loss and time-frequency domain consistency loss.

[0190] The time domain reconstruction loss is:

[0191]

[0192] Among them, TG represents the time domain reconstruction loss, L is the length of the local neighborhood, and are the reconstructed and true values ​​of the local neighbors in the time domain.

[0193] The frequency domain reconstruction loss is:

[0194]

[0195] Among them, FG represents the frequency domain reconstruction loss, is the reconstructed value of the local neighborhood in the frequency domain.

[0196] The time-frequency domain consistency loss is defined as follows:

[0197]

[0198] Among them, TFG represents the time-frequency domain consistency loss.

[0199] Step S4, anomaly scoring based on time-frequency reconstruction error.

[0200] The present invention combines the dual-branch time-frequency reconstruction error to generate an anomaly score for each timestamp, thereby determining whether it is an anomaly.

[0201] The present invention designs a personalized anomaly scoring strategy for joint time-frequency domain reconstruction errors to generate an anomaly score for each test timestamp. Figure 4 As shown in the figure, taking the time stamp t to be tested as an example, the detailed anomaly scoring process is as follows:

[0202] S4-1, the local neighbors and global neighbors of timestamp t are simultaneously input into two reconstruction branches to perform reconstruction learning in parallel. The reconstruction learning process of M variables in the two branches is performed in parallel.

[0203] In S4-2, each branch generates three loss values ​​for each timestamp on each variable, and the three loss values ​​are regarded as the anomaly scores of timestamp t on the variable.

[0204] For example, in the first reconstruction branch, timestamp t in the Mth variable will generate the following anomaly score in and Represent local time domain reconstruction, local frequency domain reconstruction, and local consistency error in time and frequency domains, respectively. Similarly, the second reconstruction branch generates an anomaly score for timestamp t on the Mth variable in and They represent global time domain reconstruction, global frequency domain reconstruction and global consistency error in time-frequency domain respectively.

[0205] S4-3, calculate the average anomaly score of the two branches on M variables and

[0206] S4-4, these two average anomaly scores are combined with different weights to generate the final anomaly score of timestamp t, which is defined as follows:

[0207] Score t =β×ScoreL t +(1-β)×ScoreG t (twenty one)

[0208] Where β∈[0,1] is a preset parameter. When β=0, only the anomaly score of the second reconstruction branch is considered; when β=1, only the anomaly score of the first reconstruction branch is considered.

[0209] S4-5, after obtaining the anomaly score of timestamp t, use the following formula to determine whether the tth timestamp is abnormal:

[0210]

[0211] Where λ represents the preset threshold, ranging from 0 to 1. The tth timestamp is an abnormal timestamp; otherwise, the tth timestamp is a normal timestamp.

[0212] Experimental verification

[0213] (1) Experimental Dataset

[0214] Twelve publicly available sensor signal datasets were selected from the industrial Internet of Things environment as experimental datasets, including 5 univariate datasets and 7 multivariate datasets, as shown in Table 1. The selected datasets cover multiple industrial fields such as aviation, manufacturing, water treatment, and telemetry, with the goal of ensuring fairness and impartiality in the experimental evaluation.

[0215] Table 1 Twelve industrial IoT sensor signal datasets

[0216]

[0217] 1) Multivariate datasets: SKAB is a multi-sensor time signal from an industrial test platform; Genesis is five continuous signals and thirteen discrete signals from multi-sensors of the Industrial Internet of Things; MSL is the operating status of multiple sensors or controllers on the Mars rover; PSM is 25-dimensional monitoring information from eBay server machines; SWaT is 51-dimensional data collected by multiple sensors in public water treatment infrastructure; WADI is 127-dimensional monitoring data from industrial control systems; PUMP is inspection data from multiple sensors on pumps.

[0218] 2) Univariate dataset: Dodgers is traffic flow collected by inductive loop sensors near the Dodger Stadium in Los Angeles data; ECG is the electrocardiogram data of abnormal ventricular premature beats; NAB is the operation status record of the server cluster; SensorScope e is the weather monitoring data from the wireless sensor network; SVDB is 7 half-hour electrocardiogram tracings, among which there are supraventricular arrhythmia abnormalities.

[0219] (2) Comparison of models and evaluation indicators

[0220] 1) Comparison Model

[0221] Nine representative state-of-the-art (SOTA) methods were selected as competitors of the lightweight time-frequency collaborative anomaly detection method (LTFAD) based on the full MLP architecture of the present invention, as shown in Table 2. The above comparison methods were selected from the following aspects:

[0222] In terms of model structure, DCdetector, ATF-UAD, TFMAE, PatchAD, DTAAD, and SimAD are deep anomaly detection methods with multi-layer structures and a large number of parameters. In contrast, DIFFI, Couta, Loda, and LTFAD are shallow methods.

[0223] In terms of time and frequency domain, DCdetector, DIFFI, COUTA, LODA, PatchAD, DTAAD and Si mAD are anomaly detection methods that are only in the time domain. In contrast, ATF-UAD, TFMAE and LTFAD are anomaly detection methods that combine time and frequency domains.

[0224] In terms of network backbone, DIFFI, COUTA and LODA are based on machine learning methods, while the remaining models are based on neural network methods.

[0225] 2) Evaluation Metrics

[0226] In order to comprehensively evaluate the performance of the method, four widely used evaluation indicators were selected: accuracy (ACC), precision (Precision), recall (Recall) and F1 score (F-Score). Among them, accuracy (ACC) is used to measure the ratio of correctly predicted samples to the total number of samples. Precision (Precision) indicates how many of the timestamps predicted as normal are actually normal. Recall (Recall) describes how many timestamps that are actually normal are correctly predicted. F1 score (F-Score) combines recall and precision to provide a more balanced performance evaluation.

[0227] Generally speaking, these metrics range from 0 to 1, with higher values ​​representing better anomaly detection performance.

[0228] Table 2 Comparison methods

[0229]

[0230]

[0231] (3) Accuracy experiment

[0232] The LTFAD method is compared with nine comparison methods on twelve public Industrial Internet of Things datasets.

[0233] 1) Performance comparison on univariate datasets: Table 3 lists the detection results of ten methods on five univariate datasets. In the table, bold text indicates the best performance, and underlined text indicates the second best performance. The following findings can be seen from the table:

[0234] ① Overall performance: LT-FAD, TFMAE, COUTA, DCdetector, and ATF-UAD show better overall performance than other methods. For example, on the SensorScope dataset, LTFAD achieved an ACC of 0.9921 and an F-Score of 0.9815, followed by DCdetector (0.9920 and 0.9813), while SimAD performed the worst (0.3335 and 0.3347).

[0235] ② Stability: The LTFAD method shows the most stable performance in the four indicators, followed by TFMAE, DCdetector and ATF-UAD. For example, on the ECG, SensorScope and NAB datasets, LTFAD won three first places and one second place.

[0236] ③ Time-frequency domain collaborative learning: The models based on time-frequency domain collaborative learning (LTFAD, TFMAE and ATF-UAD) have higher detection accuracy than other models based only on the time domain. Among the three time-frequency domain collaborative learning models, the LTFAD method of the present invention ranks the highest.

[0237] ④ Lightweight structure: Deep methods (PatchAD, TFMAE, DCdetector, DTAAD, ATF-UAD, SimAD) are generally better than shallow lightweight methods (LODA, DIFFI, COUTA). However, the lightweight LTFAD method of the present invention surpasses multiple deep methods. For example, on the NAB dataset, the Precision score of LTFAD is 0.9700, the Precision score of DCdetector is 0.9659, the Precision score of TF-MAE is 0.9675, the Precision score of COUTA is 0.6254, and the Precision score of DIFFI is only 0.3943.

[0238] 2) Performance comparison on multivariate datasets: The detection accuracy of the ten methods on seven multivariate sensor signals is listed in Table 4. From the table, similar observations can be made.

[0239] ① Overall performance: The LTFAD method shows the best performance, followed by TFMAE, DCdetector, PatchAD and ATF-UAD. For example, on the SKAB dataset, LTFAD achieves an ACC of 0.9974 and a Recall of 1.0, while COUTA only obtains an ACC of 0.9121 and a Recall of 0.7775.

[0240] ② Stability: LTFAD, TFMAE, DCdetector, and PatchAD show relatively stable accuracy in four indicators. For example, on the PSM dataset, LTFAD ranks first in three indicators and second in one indicator, while DIFFI and SimAD show instability.

[0241] ③ Time-frequency domain collaborative learning: TFMAE, LTFAD and ATF-UAD using time-frequency coordinated learning are superior to pure time-domain learning methods such as DIFFI, PatchAD and DTAAD. For example, on the WADI dataset, the ACC of LTFAD and TFMAE are both 0.9934, the ACC of DTAAD is 0.9533, and the ACC of DIFFI is only 0.6543.

[0242] ④ Lightweight structure: The lightweight LTFAD method surpasses multiple deep and shallow methods. For example, on the PUMP dataset, LTFAD achieved a Precision of 0.9407 and an F-Score of 0.9648, which is better than deep methods such as PatchAD (Precision 0.9311, F-Score 0.9579) and DCdetector (Precision 0.9407, F-Score 0.9606).

[0243] Table 3 Performance analysis on univariate datasets

[0244]

[0245] 3) Visual comparison: Figure 4 The detection results of all methods for the 4800 to 5000 timestamps of the first variable on the MSL dataset are presented. In the figure, the black line represents the true data curve, and the red line represents the corresponding label (the peak represents anomaly, and the valley represents normal state). From the figure, two findings can be obtained.

[0246] ① Accuracy: COUTA, DCdetector, LTFAD, TFMAE, and LODA match the true labels better than other methods. For example, these methods can accurately identify anomalies in the range of 48700 to 48950, while other methods produce a large number of errors.

[0247] ② False alarm rate: LTFAD, DCdetector and LTFAD perform particularly well, with significantly less false alarm rates than other methods.

[0248] 4) Conclusion: The above experimental results show that the LTFAD method can accurately identify anomalies in sensor signals in an industrial IoT environment. Specifically, the lightweight LTFAD method of the present invention always ranks first or second in the four indicators of multiple datasets, outperforming multiple deep methods. These findings further demonstrate the effectiveness of collaborative learning in the time-frequency domain in anomaly detection.

[0249] Table 4 Performance analysis on multivariate datasets

[0250]

[0251] 4) Deployability Experiment

[0252] Ten methods were deployed on two IIoT edge devices: Raspberry Pi 4b (less resources) and Jetson Xavier NX (normal resources). Specifically, Raspberry Pi 4b is equipped with a 1.5GHz ARMCortex-A72 processor and 2GB RAM, while Jetson Xavier NX is equipped with a 6-core Carmel ARMv8.2 processor and 8GB RAM. In the experiments, all methods were initially trained in the cloud and then deployed to the edge device for testing. The deployment results are shown in Figure 2. Figure 6 shown.

[0253] From the figure, two observations can be made:

[0254] ① Deployability: 9 methods were successfully deployed, while PatchAD failed because the storage requirements exceeded the capacity of two edge devices. In contrast, lightweight methods are easier to deploy and maintain.

[0255] ② Convenience: In the industrial IoT environment, frequent changes in the production process can lead to dynamic fluctuations in time signals. Therefore, the method needs to be updated regularly to maintain its optimal performance. However, the update process involves fine-tuning the method using the latest data samples in the cloud and redeploying the fine-tuned method to the edge device. In this process, the lightweight method consumes fewer data samples, and has lower communication overhead and labor costs than the deep method.

[0256] Summary: Compared with deep methods, shallow and lightweight methods are easier to deploy and maintain on resource-limited Industrial IoT edge devices.

[0257] 5) Time-effectiveness experiment

[0258] The timeliness and resource consumption of ten methods are evaluated in three deployment environments, such as Figure 5 and Figure 7As shown. These environments include a powerful PC, a Raspberry Pi 4b with fewer resources, and a Jetson Xavier NX with average resources. In this experiment, the PC environment selected model parameters (Parameters), the processing time of the next epoch of the same batch_size (One-epoch-time), CPU and GPU usage (CPU-Usage and GPU-Usage), RAM usage (RAM-Usage), and VGA RAM usage (VGA-RAM-Usage) as evaluation indicators; the Raspberry Pi 4b environment used the detection time of 100 timestamps (100-timestamps-time), CPU-Usage, and RAM-Usage as evaluation indicators; the Jetson XavierNX environment used the processing time of 10,000 timestamps (10,000-timestamps-time), CPU-Usage, and RAM-Usage as evaluation indicators.

[0259] Table 5 lists the comparison results of the ten methods, where “-” indicates no available data and “Ot” indicates insufficient memory. From the table, we can get several important findings:

[0260] ① In terms of training parameters: Compared with PatchAD (1230.7K) and DTAAD (123.4K), the LTFAD method has the least training parameters (75K).

[0261] ② In terms of timeliness: In the three deployment environments, the processing time of shallow lightweight methods (LTFAD, LODA, DIFFI, and COUTA) is significantly faster than that of deep methods (PatchAD, SimAD, TFMAE, DCdetector, ATF-UAD, DTAAD). For example, in the PC environment, the processing time of LTFAD is 37.4 seconds, DIFFI is only 8.8 seconds, but PatchAD is 461.2 seconds and DCdetector is 300.1 seconds.

[0262] ③ In terms of computational consumption: Compared with deep methods, shallow methods have significantly lower CPU and GPU usage. For example, the CPU usage of shallow DIFFI on Raspberry Pi 4b is 27%, while the CPU usage of deep DCdetector is 72.2% and the CPU usage of deep ATF-UAD is 68.6%. Comparing these four shallow methods, their CPU usage is similar.

[0263] ④ In terms of storage consumption: Deep methods occupy significantly more storage resources than shallow methods. For example, in a Jetson Xavier NX environment with only 8G RAM, the RAM usage of deep ATF-UAD is 7.5GB, the RAM usage of deep DCdetector is 7.1GB, while the RAM usage of LTFAD of the present invention is 4.5GB, and the RAM usage of shallow DIFFI is 3.4GB.

[0264] Conclusion: The LTFAD approach exhibits good timeliness and low resource consumption, ensuring its applicability to resource-limited IIoT edge devices.

[0265] Table 6 Timeliness and resource consumption

[0266]

[0267] Experimental results on twelve public datasets show that the LTFAD method of the present invention outperforms multiple deep SOTA methods. Experiments on two edge terminals, Raspberry Pi 4b and NVIDIA Jetson Xavier NX, further prove that the LTFAD method can be easily deployed and run in industrial scenarios with limited resources.

[0268] The above implementation cases are only preferred embodiments of the present invention and are not intended to limit the present invention in any form. Although the present invention has been disclosed as above with preferred embodiments, they are not intended to limit the present invention. Therefore, any simple modification, equivalent changes and modifications made to the above embodiments according to the technical essence of the present invention without departing from the content of the technical solution of the present invention shall fall within the scope of protection of the technical solution of the present invention.

Claims

1. A method for industrial Internet of Things anomaly detection based on time-frequency domain collaboration under a full MLP lightweight architecture, characterized in that: The anomaly detection method constructs a dual-branch reconstruction learning process from the perspectives of "local to global" and "global to local". The reconstruction learning process of each branch uses two two-layer MLP networks to perform reconstruction learning in the time domain and frequency domain respectively, and uses reconstruction consistency to align the time domain and frequency domain. The time-frequency domain reconstruction error obtained in the two branches reconstruction learning is fused using different weights to determine whether each timestamp is abnormal; The specific steps include: Step S1, variables are sampled independently to generate local neighbors and global neighbors for each timestamp; Step S2, local to global time-frequency domain collaborative reconstruction learning, as the first reconstruction learning branch of the full MLP framework; employ a two-layer MLP network based on real numbers to perform "local to global" reconstruction learning in the time domain; and employ another two-layer MLP network based on complex numbers to perform "local to global" reconstruction learning in the frequency domain; and use the consistency of the global reconstruction values ​​in the time domain and frequency domain to align the time domain and frequency domain; Step S3, global to local time-frequency domain collaborative reconstruction learning, as the second reconstruction learning branch of the full MLP framework, applies a two-layer MLP network based on real numbers to perform "global to local" reconstruction learning in the time domain; at the same time, another two-layer MLP network based on complex numbers is applied to perform "global to local" reconstruction learning in the frequency domain; the consistency of local reconstruction values ​​in the time domain and frequency domain is used to align the time domain and frequency domain; Step S4, based on the anomaly scoring of the time-frequency reconstruction error, based on the time-frequency domain reconstruction error obtained in the dual-branch reconstruction learning process, uses different weights to fuse the two errors to generate an anomaly score for each timestamp to determine whether it is abnormal.

2. According to the time-frequency domain collaborative industrial Internet of Things anomaly detection method under the full MLP lightweight architecture of claim 1, it is characterized in that: In step S1, the independent sampling process of the variable at the t-th time on the m-th variable is assumed to be: S1-1, local neighbor generation, intercepting a neighbor sequence of length L with timestamp t as the center as local neighbors of timestamp t; S1-2, candidate global neighbor generation, extracting a neighbor sequence of length G with timestamp t as the center As candidate global neighbors, where L < G; S1-3, global neighbor generation, mark the remaining timestamps in the candidate neighbor sequence except the local neighbors as the global neighbors of timestamp t Its length is (GL); S1-4, multi-variable parallel sampling, the sampling process of multiple variables in the same industrial IoT sensor data set is the same and can be executed in parallel.

3. According to claim 1, the time-frequency domain collaborative industrial Internet of Things anomaly detection method under the full MLP lightweight architecture is characterized in that: In step S2, the specific learning process is: S2-1, time domain reconstruction learning, uses a two-layer MLP network based on real numbers to perform local-to-global reconstruction learning in the time domain; the MLP network includes an input layer with L neurons for receiving local neighbors of each timestamp; a hidden layer with d neurons and a ReLU activation function for capturing correlation features; and an output layer with (GL) neurons for reconstructing global neighbors; the input layer and the hidden layer form a first fully connected layer with L×d trainable parameters; the hidden layer and the output layer form a second fully connected layer with d×(GL) trainable parameters; S2-2, frequency domain reconstruction learning, uses another two-layer MLP network based on complex numbers to perform reconstruction learning, wherein the MLP network consists of an input layer with L / 2 neurons, a hidden layer with d neurons and a zReLU activation function, and an output layer with (GL) / 2 neurons; the input layer and the hidden layer form a first fully connected layer containing (L / 2)×d parameters, and the hidden layer and the output layer form a second fully connected layer containing d×[(GL) / 2] parameters; S2-3, loss function, constructs a loss function consisting of three parts, including time domain reconstruction loss, frequency domain reconstruction loss and time-frequency domain consistency loss; The first part is the reconstruction loss of the global neighbors in the time domain, which is: Where T is the number of timestamps, M is the number of variables, (GL) is the length of the global neighborhood, and are the time-domain reconstructed value and actual value of the i-th global neighbor at timestamp t on the m-th variable, respectively; The second part is the reconstruction loss of the global neighbors in the frequency domain, which is: in, is the reconstructed value of the global neighbor in the frequency domain; The third part is the time-frequency domain consistency loss, which is used to align the time domain and the frequency domain. The time-frequency domain consistency loss aims to minimize the difference between the reconstructed values ​​in the time domain and the frequency domain, which is:

4. The method for detecting anomalies in the industrial Internet of Things based on time-frequency domain collaboration under the full MLP lightweight architecture according to claim 3 is characterized in that: In the time domain reconstruction learning, the local to global reconstruction learning process of the t-th timestamp of the m-th variable is assumed to be: S2-1-1, local neighbors of length L Input into the first fully connected layer of the first real MLP in the first reconstruction branch to extract the time domain features. The extraction formula is: in, is the output of the first fully connected layer, is the training parameter of the first fully connected layer, and ReLU is the activation function; S2-1-2, extract the time domain features LF t Tim The global neighbors of timestamp t are reconstructed by the second fully connected layer of the first real MLP in the first reconstruction branch. The reconstruction formula is: in, represents the global reconstruction value, Represents the training parameters of the second fully connected layer.

5. According to claim 4, the time-frequency domain collaborative industrial Internet of Things anomaly detection method under the full MLP lightweight architecture is characterized in that: In the frequency domain reconstruction learning, the local to global reconstruction process of the t-th timestamp of the m-th variable is assumed to be as follows: S2-2-1, use fast Fourier transform to transform the local neighborhood of length L Converted to frequency components of length L / 2 The formula is: where each frequency component is a complex number, S2-2-2, the frequency component Input to the first fully connected layer of the second complex MLP in the first reconstruction branch to obtain the frequency domain feature LF t Fre : in, is the output of the first fully connected layer, is the training parameter of the first fully connected layer; zReLU() is the complex activation function, θ z represents the phase of the complex number z; S2-2-3, the obtained frequency domain feature LF t Fre The second fully connected layer of the second complex MLP in the first reconstruction branch is fed into the frequency components of the global neighbors: in, is the output of the second fully connected layer, is the training parameter of the second fully connected layer; S2-2-4, apply inverse fast Fourier transform to reconstruct the frequency component GF t m Transform back to the global neighborhood of timestamp t in the time domain: in, is the reconstructed value of the global neighbor generated from the frequency domain.

6. The time-frequency domain collaborative industrial Internet of Things anomaly detection method under the full MLP lightweight architecture according to claim 3 is characterized in that: In step S3, the specific learning process is: S3-1, time domain reconstruction learning, uses a two-layer MLP network based on real numbers to perform global-to-local reconstruction learning in the time domain, wherein the MLP network consists of an input layer with (GL) neurons, a hidden layer with d neurons, and an output layer with L neurons; the input layer and the hidden layer form a first fully connected layer containing (GL)×d training parameters, and the hidden layer and the output layer form a second fully connected layer containing d×L training parameters; S3-2, frequency domain reconstruction learning, uses another complex-based two-layer MLP network to perform global-to-local reconstruction learning in the frequency domain, wherein the MLP consists of an input layer with (GL) / 2 neurons, a hidden layer with d neurons, and an output layer with L / 2 neurons; the input layer and the hidden layer form a first fully connected layer containing [(GL) / 2]×d training parameters, and the hidden layer and the output layer form a second fully connected layer containing d×(L / 2) training parameters; S3-3, loss function, the loss function consists of three parts, including time domain reconstruction loss, frequency domain reconstruction loss and time-frequency domain consistency loss; The time domain reconstruction loss is: Where L is the length of the local neighborhood, and are the reconstructed values ​​and true values ​​of the local neighbors in the time domain; the frequency domain reconstruction loss is: in, is the reconstructed value of the local neighbor in the frequency domain; The time-frequency domain consistency loss is:

7. The method for detecting anomalies in the industrial Internet of Things based on time-frequency domain collaboration under the full MLP lightweight architecture according to claim 6 is characterized in that: In the time domain reconstruction learning, the global to local reconstruction process of the t-th timestamp on the m-th variable is assumed to be: S3-1-1, the global neighbors of length (GL) Input to the first fully connected layer of the first real MLP in the second reconstruction branch to extract time domain features: in, is the output of the first fully connected layer, is the training parameter of the first fully connected layer, ReLU activation function; S3-1-2, GF t Tim Input to the second fully connected layer of the first real MLP in the second reconstruction branch to reconstruct the local neighbors of timestamp t: in, represents the reconstructed value of the local neighbor in the time domain, is the second fully connected layer training parameter.

8. The method for detecting anomalies in the industrial Internet of Things based on time-frequency domain collaboration under the full MLP lightweight architecture according to claim 6 is characterized in that: In the frequency domain reconstruction learning, the global to local reconstruction process of the t-th timestamp on the m-th variable is assumed to be: S3-2-1, use the fast Fourier transform function to transform the global neighbors of length (GL) Convert to frequency components of length (GL) / 2 The formula is: where each frequency component is a complex number, S3-2-2, the obtained frequency components Input to the first fully connected layer of the second complex MLP in the second reconstruction branch to generate frequency domain features GF t Fre , the formula is: in, is the output of the first fully connected layer, is the training parameter of the first fully connected layer; S3-2-3, frequency domain feature GF t Fre The frequency components LF of the local neighbors are reconstructed by inputting into the second fully connected layer of the second complex MLP in the second reconstruction branch t m , the formula is: in, is the output of the second fully connected layer, is the second fully connected layer training parameter; S3-2-4, using inverse fast Fourier transform rFFT to generate the local neighbors of the reconstructed timestamp t: in, represents the reconstructed value of the global neighborhood generated from the frequency domain.

9. The method for detecting anomalies in the industrial Internet of Things based on time-frequency domain collaboration under the full MLP lightweight architecture according to claim 8 is characterized in that: In step S4, assuming that the timestamp to be tested is t, the abnormality scoring process is: S4-1, the local neighbors and global neighbors of timestamp t are simultaneously input into two reconstruction learning branches to perform reconstruction learning of M variables in parallel; S4-2, each branch generates three loss values ​​for each timestamp on each variable, and the sum of the three loss values ​​is regarded as the abnormal score of the variable at timestamp t. is the score of timestamp t on variable M in the first branch, is the score of timestamp t on variable M in the second branch; S4-3, calculate the average anomaly score of the two branches on M variables and S4-4, the two average anomaly scores are combined with different weights to generate the final anomaly score of timestamp t, which is: Score t =β×ScoreL t +(1-β)×ScoreG t (21) Among them, β∈[0,1] is a preset parameter. When β=0, only the anomaly score of the second reconstruction branch is considered. When β=1, only the anomaly score of the first reconstruction branch is considered. S4-5, after obtaining the anomaly score of timestamp t, determine whether the tth timestamp is abnormal: Among them, λ represents the preset threshold, ranging from 0 to 1; if The tth timestamp is an abnormal timestamp; otherwise, the tth timestamp is a normal timestamp.

Images