Edge device-oriented unsupervised industrial time series data rapid anomaly detection method

Abstract

The invention discloses an edge device-oriented unsupervised industrial time series data rapid anomaly detection method, which comprises the following steps of: firstly, replacing industrial sensor time series data with data similarity as input of the method to achieve the purpose of data privacy protection; secondly, setting a trainable Gaussian distribution with only one parameter for each timestamp to replace a traditional deep and heavy neural network for modeling the potential similarity between each timestamp and a neighbor thereof, and ensuring the lightweight of the structure; and finally, designing a global and local adversarial learning strategy to amplify the difference between the global similarity and the local similarity of each timestamp, and judging whether each timestamp is abnormal or not by using the difference between the global similarity and the local similarity, so that the accuracy of the method is improved. According to the industrial time sequence anomaly rapid detection method for the resource limited edge device, a lightweight structure is utilized to guarantee data privacy, and meanwhile the method has the advantages of being high in precision, high in speed and low in resource consumption.

Description

Technical Field

[0001] The present invention relates to the technical field of industrial time series data detection, and in particular to an unsupervised industrial time series data rapid anomaly detection method for edge devices. Background Art

[0002] A large number of Internet of Things (IoT) sensors are integrated into the underlying production equipment and production lines to sense, monitor and control industrial production processes. Affected by the IoT, production equipment that was originally independent and relatively safe is forced to connect with other devices and communicate with the external Internet. This makes these production equipment or production processes vulnerable to attacks from external networks, causing them to deviate from their original normal state and abnormal events or behaviors. If these anomalies cannot be detected and processed in a timely manner, they will interfere with and interrupt the production process, and even cause damage or destruction of equipment, resulting in serious property losses and casualties. On the contrary, if these anomalies can be accurately identified and alarms can be issued in a timely manner at the early stage of their occurrence, then corresponding defensive measures can be taken to minimize losses and effectively ensure the safety and stability of the industrial production process. Therefore, anomaly detection is crucial in high-cost industrial scenarios and has always been a research hotspot.

[0003] In the past, time series anomaly detection models were often deployed on the cloud with powerful resources. Specifically, edge devices regularly upload the collected time series data to the cloud, and the cloud detection model performs anomaly identification and returns the identification results to the edge devices. In this case, most people only focus on enhancing the representation ability of the model by building a neural network with deep structure and a large number of parameters, so as to achieve the goal of improving the accuracy of the model. Therefore, unsupervised anomaly detection models based on deep neural networks are the current mainstream research direction. However, with the refinement and intelligence of industrial intelligent control, more and more IoT sensors are installed on industrial equipment to perform more intensive data collection and information monitoring. This has led to a rapid increase in the amount of industrial time series data, which has brought huge communication overhead between edge devices and the cloud. In addition, the huge amount of data further causes anomaly detection in the cloud to face problems such as high latency and high cost. Therefore, performing time series anomaly detection directly on edge devices rather than in the cloud, that is, edge computing, has become a key requirement. However, the limited computing and storage resources of edge devices make it difficult for the currently popular models based on deep neural networks to work. Specifically, the existing deep and bulky models face two major challenges on resource-constrained edge devices.

[0004] Challenge 1: It is difficult to strike a balance between accuracy, real-time performance, and low consumption. To perform anomaly detection on resource-constrained edge devices, the detection model must simultaneously meet the requirements of high accuracy, high real-time performance, and low resource consumption. However, these three characteristics often restrict each other and are difficult to strike a balance. For example, in order to achieve high accuracy, the detection model usually needs to build a deep neural network with a large number of parameters to enhance its representation capabilities. In this case, the model requires a long computing time and consumes a lot of computing and storage resources. On the contrary, in order to achieve high real-time performance and low resource consumption, the detection model usually requires a lightweight structure with fewer network layers and fewer training parameters. However, the feature capture capability of shallow models is often poor, and the detection accuracy is also unsatisfactory.

[0005] Challenge 2: Privacy data is not secure and easily leaked. In industrial scenarios, edge devices continuously collect timing signals from sensors during the production process. These sensor timing data contain a large amount of valuable information and have strong privacy, involving the production or process details of each company. At present, existing anomaly detection models for edge devices usually directly use raw sensor signals as input data. In the Industrial Internet of Things, edge devices often lack strong data privacy protection mechanisms and secure communication protocols. In this case, external attackers can easily steal the timing signal data of the original sensor through the Industrial Internet of Things, resulting in the leakage of industrial data. In more serious cases, attackers can invade edge devices and disrupt the production process.

[0006] To address the first challenge, there are two different approaches to existing solutions. The first approach is to use deep neural networks as prototypes, and use model pruning and compression techniques to reduce the number of neural network layers and redundant parameters, thereby taking into account high speed, high accuracy, and low resource consumption. In this type of solution, deep neural networks can provide higher accuracy, while model pruning and compression improve real-time performance and reduce resource consumption. For example, based on the DCdetector model, the PatchAD model uses a lightweight MLP network to replace the attention module with large computational load, and constructs a lightweight dual-branch contrast network structure. Similarly, the ANNet model employs an MLP network to optimize the LSTM unit, thereby improving the speed of the model and reducing resource consumption. However, these optimized models still have a large number of parameters and a deeper network architecture, which results in unsatisfactory resource consumption and computing time of these models. The second approach is to use shallow machine learning or statistical models as prototypes, combined with other technologies or specific accuracy optimization strategies, to build a hybrid lightweight model that combines accuracy and real-time performance. For example, the Optiforest model combines clustering learning and hashing technology to design an optimized multi-branch tree structure for the traditional Isolation Forest model. At the same time, the DIF model improves the accuracy of the Isolation Forest model by using a specific shallow neural network. The COUTA model designs multiple calibration mechanisms for the one-class support vector machine (OCSVM) to improve the accuracy of the model. In this type of scheme, the simple and shallow prototype structure ensures high real-time performance and low resource consumption, and the hybrid mechanism and optimization strategy improve the accuracy of the model. However, when encountering multi-sensor time series signals with complex feature patterns, these models will have problems with unstable performance and poor accuracy due to poor representation capabilities.

[0007] To address the second challenge, existing solutions usually use some security mechanisms to ensure data privacy. For example, the FADngs model uses a federated authorization mechanism to ensure identity authorization and data privacy. Similarly, the FedAnomaly model develops a new collaborative learning communication protocol to ensure the security of cloud-edge communication. The Fed-SCR model uses federated learning technology to achieve data privacy protection. The BCFL model uses blockchain technology to design a decentralized asynchronous federated learning framework to ensure the security of the model. The TRIDENT model designs a lightweight encryption scheme based on aggregate optimization to protect data privacy. Dajiang Chen et al. combined cryptography with blockchain technology to enhance privacy protection and communication security. The OP-ADIHT model uses interval hash tables (ADIHT) and homomorphic encryption to build a privacy-preserving anomaly detection scheme. However, before performing anomaly detection, these models usually need to be encrypted and decrypted, or third-party authentication is required to ensure the security of data or identity. Therefore, these models often require longer processing time or consume more computing resources and storage resources. On resource-limited IoT edge devices, some complex privacy protection schemes often cannot run smoothly, resulting in anomaly detection not working properly or even completely failing. Summary of the invention

[0008] In response to the above-mentioned technical problems to be solved, the present invention provides an unsupervised industrial time series data fast anomaly detection method for edge devices, which utilizes a lightweight structure to ensure data privacy while having the characteristics of high precision, high speed and low resource consumption, so that it can be easily deployed on edge devices with limited resources and ensure its process operation.

[0009] In order to solve the above technical problems, the technical solution proposed by the present invention is:

[0010] An unsupervised industrial time series data fast anomaly detection method for edge devices, the detection method comprising: first, using data similarity to replace industrial sensor time series data as the input of the method, getting rid of the dependence on privacy data, and achieving the purpose of data privacy protection; second, setting a trainable Gaussian distribution with only one parameter for each timestamp to model the potential similarity of each timestamp with its neighbors, making the structure lightweight; then, designing a global and local adversarial learning strategy to amplify the difference between the global similarity and local similarity of each timestamp; finally, using the difference between the global and local similarities as an indicator to determine whether each timestamp is abnormal.

[0011] As a further improvement of the above technical solution:

[0012] Preferably, the detection method specifically comprises the following steps:

[0013] Step S1, calculating the initial similarity as input, using the similarity of the original private data obtained from the third-party security interface or the third-party similarity calculation model as the initial input;

[0014] Step S2, construct a trainable Gaussian distribution for each timestamp, use a two-layer MLP network as a generator, take the initial neighbor similarity of each timestamp as input, and generate a private trainable variance Gaussian distribution for each timestamp;

[0015] Step S3, generating local neighbor and global neighbor fitting similarities, sampling neighbors for each timestamp, generating global neighbors and local neighbors, and then normalizing the initial similarity according to the sampled neighbor coordinates to generate global neighbor fitting similarities and local neighbor fitting similarities;

[0016] Step S4, global and local adversarial learning, from the two aspects of similarity fitting and area maximization, local similarity learning and global similarity learning are regarded as two competitors, adversarial learning is performed, and the parameters of the trainable Gaussian distribution of each timestamp are updated through reverse gradient, the global and local similarity differences of normal timestamps are reduced, and the global and local similarity differences of abnormal timestamps are amplified;

[0017] Step S5, generating an anomaly score for each timestamp, using the trained learnable Gaussian distribution model to perform an anomaly score on each timestamp in the test set, and determining whether the current timestamp is abnormal based on the anomaly score.

[0018] Preferably, in step S1, assuming that M sensors are used to observe a dynamic production system at T timestamps, an industrial multi-sensor time series data including a time dimension and a variable dimension is generated. In the time dimension, the multi-sensor time series data is: where x t represents the observed value of M sensor variables at the tth timestamp; in the variable dimension, the multi-sensor time series data is: where x m represents the observation values ​​of all T timestamps of the mth sensor;

[0019] The initial similarity calculation is as follows: First, from the original private data Extract M variables for each timestamp to form a data vector Secondly, the similarity calculation method is used to calculate the similarity between any two timestamp data vectors; finally, the original private data is converted into a similarity matrix in Represents the similarity between timestamp t and its T neighbors.

[0020] Preferably, in step S2, the process of constructing a private Gaussian distribution containing only one trainable parameter for any timestamp t is:

[0021]

[0022] Among them, x represents the coordinates of the neighbor timestamp, σ t Represents the variance of the Gaussian distribution, which is a trainable parameter;

[0023] A shared two-layer MLP network is used as the variance generator so that σ t It can be deduced that the MLP network includes an input layer with T neurons for receiving the initial similarities of all neighbors of each timestamp; a hidden layer with d neurons activated by the ReLU function; and an output layer with 1 neuron for generating private variance values ​​of different timestamps; in the MLP network, the input layer and the hidden layer form the first fully connected layer, and the hidden layer and the output layer form the second fully connected layer; taking the t-th timestamp as an example, the generation process of the private variance in its trainable Gaussian distribution is:

[0024] First, the initial neighbor similarity of length T is Input to the first fully connected layer to get the features:

[0025] F t =ReLU(s t ×W1) (5)

[0026] Among them, F t For the generated features, is the initial similarity between timestamp t and other T timestamps, is the training parameter of the first fully connected layer, and ReLU is the activation function;

[0027] Secondly, the extracted features F t This is passed to a second fully connected layer to generate the private variance in the trainable Gaussian distribution of timestamp t:

[0028] σ t =F t ×W2 (6)

[0029] Among them, σ t is the variance of the trainable Gaussian distribution of the generated timestamp t, Represents the training parameters of the second fully connected layer

[0030] Preferably, in step S3, the process of generating the local neighbor and global neighbor fitting similarity of each timestamp is:

[0031] S3-1, generating local neighbors to be fitted, with timestamp t as the center, timestamps in the range of [t-LN / 2, t+LN / 2] are selected as local neighbors to be fitted of timestamp t;

[0032] S3-2, generation of candidate global neighbors to be fitted, with timestamp t as the center, timestamps in the range [t-GN / 2, t+GN / 2] are selected as candidate global neighbors to be fitted of timestamp t, where LN <GN;

[0033] S3-3, generating the global neighbors to be fitted, marking the remaining timestamps in the candidate global neighbors sequence to be fitted except the local neighbors to be fitted as the global neighbors to be fitted with timestamp t, whose range is [t-GN / 2, t-LN / 2] and [t+LN / 2, t+GN / 2], and whose length is (GN-LN);

[0034] S3-4, the similarity of the local and global neighbors to be fitted is generated based on the coordinates of the fitted local and global neighbors, starting from the initial similarity of timestamp t Extract the initial similarity corresponding to the coordinates and perform normalization:

[0035]

[0036] Among them, s it represents the initial similarity between timestamps i and t, where i ranges from [t-GN / 2, t+GN / 2], Represents the normalized similarity to be fitted.

[0037] Preferably, in step S4, the adversarial learning process of the trainable Gaussian distribution of the t-th timestamp is specifically as follows:

[0038] S4-1, Similarity fitting learning of local neighbors

[0039] Training variance σ t , so that the Gaussian distribution of timestamp t can only fit the normalized similarity to be fitted for each local neighbor, the formula is as follows:

[0040]

[0041] Where LN represents the number of local neighbors, g t (i) The predicted similarity of the i-th neighbor in the Gaussian distribution at the t-th timestamp, is the similarity to be fitted between timestamp t and timestamp i, L1 is the local neighbor similarity fitting loss function;

[0042] S4-2, Local Neighbor Similarity Area Maximization Learning

[0043] Training variance σt , so that the area occupied by local neighbors in the Gaussian distribution of timestamp t is the largest and close to the total area 1. The formula is as follows:

[0044] L2=[1-(Area(t+LN / 2)-Area(t-LN / 2))] 2 (9)

[0045] Among them, Area(x) represents the area of ​​Gaussian distribution in the interval [-∞,x], and L2 is the local neighbor area maximization loss function;

[0046] S4-3, Similarity fitting learning of global neighbors

[0047] Training variance σ t , so that the Gaussian distribution of timestamp t can only fit the normalized similarity to be fitted for each global neighbor, the formula is as follows:

[0048]

[0049] Where (GN-LN) represents the number of global neighbors, g t (i) and g t (j) The predicted similarity between the i-th neighbor and the j-th neighbor in the Gaussian distribution at the t-th timestamp, and is the similarity to be fitted between timestamp t and timestamps i and j, L3 is the global neighbor similarity fitting loss function;

[0050] S4-4, Global Neighbor Similarity Area Maximization Learning

[0051] Training variance σ t , so that the area occupied by the global neighbors in the Gaussian distribution of timestamp t is the largest and close to the total area 1. The formula is as follows:

[0052] L4=1-2×Area(t-LN / 2) (11)

[0053] Among them, Area(x) represents the area of ​​Gaussian distribution in the interval [-∞,x], and L4 is the global neighbor area maximization loss function;

[0054] S4-5, Adversarial Learning

[0055] Local similarity learning and global similarity learning constitute two opposing competitors. Adversarial learning is used to amplify the difference between local similarity and global similarity. The loss function of adversarial learning is:

[0056] Loss=L1+L2+L3+L4 (12).

[0057] Preferably, in step S5, the scoring process of the timestamp t to be tested is: first, using the third-party security interface to calculate the initial similarity of all neighbors of the timestamp t to be tested; second, inputting the initial similarity into the shared trained two-layer MLP variance generator to generate the variance σ of the timestamp t t , and construct a private Gaussian distribution of timestamp t; then, generate the global neighbors and local neighbors of timestamp t according to the sampling strategy, and generate the normalized global neighbor similarity and local neighbor similarity to be fitted according to the initial similarity; then, use the local neighbor similarity fitting loss value as the local similarity of timestamp t, and use the global neighbor similarity fitting loss value as the global similarity of timestamp t; furthermore, use the difference between the global neighbor similarity and the local neighbor similarity as the anomaly score of timestamp t, which is:

[0058] Score t =|L1-L3| (13)

[0059] Among them, |·| is the absolute value function;

[0060] Finally, determine whether the timestamp t is abnormal. The judgment formula is:

[0061]

[0062] in, represents the abnormal judgment result, α is the preset threshold, and the value range is 0 to 1; if Then the tth timestamp is judged as an abnormal point; otherwise, the tth timestamp is considered normal.

[0063] The unsupervised industrial time series data fast anomaly detection method for edge devices provided by the present invention has the following advantages compared with the prior art:

[0064] (1) The unsupervised industrial time series data fast anomaly detection method for edge devices of the present invention is a fast industrial time series anomaly detection method based on a learnable Gaussian distribution and designed for resource-limited IoT edge devices with implicit data protection function. The method utilizes the difference in similarity between global neighbors and local neighbors, adopts a micro-learning structure and a specific adversarial learning mechanism to achieve high-speed, high-precision and low-resource consumption timestamp-level anomaly detection.

[0065] (2) The unsupervised industrial time series data fast anomaly detection method for edge devices of the present invention directly uses data similarity rather than original multi-sensor time series privacy data as the initial input, thereby protecting data privacy and facilitating flexible docking with other models or third-party interfaces. BRIEF DESCRIPTION OF THE DRAWINGS

[0066] Figure 1It is a theoretical schematic diagram of the timestamp-level timing anomaly detection of the present invention.

[0067] Figure 2 It is an overview diagram of the proposed method of the present invention.

[0068] Figure 3 It is a schematic diagram of the global and local sampling process of the present invention.

[0069] Figure 4 This is the visualization result of anomaly detection at timestamps 60500 to 63500 in the first variable of the MSL dataset in the experimental verification.

[0070] Figure 5(a) shows the deployment result on the IIoT edge device Raspberry Pi 4b.

[0071] Figure 5(b) shows the deployment result on the industrial IoT edge device Jetson Xavier NX.

[0072] Figure 6 Result diagrams of two ablation experiments verified by the present invention. DETAILED DESCRIPTION

[0073] The specific embodiments of the present invention are described in detail below. It should be understood that the specific embodiments described herein are only used to illustrate and explain the present invention, and are not used to limit the present invention.

[0074] The present invention is an unsupervised industrial time series data fast anomaly detection method for edge devices, and designs an industrial Internet of Things time series data fast anomaly detection method suitable for resource-constrained edge devices. This method uses a lightweight structure to ensure data privacy while having the characteristics of high accuracy, high speed and low resource consumption. In order to achieve these goals, two key bottlenecks must be solved.

[0075] The first bottleneck is how to build a lightweight model with high accuracy, high speed and low resource consumption. Generally, industrial time series abnormal events occur at a low frequency, and each occurrence lasts for multiple timestamps and is significantly different from the normal state, such as Figure 1 This shows that an abnormal timestamp usually has a high similarity only with other nearby timestamps (local neighbors) within the same anomaly, but has a low similarity with distant timestamps (global neighbors, most of which are normal timestamps). On the contrary, due to the periodicity or seasonality of the production process, a normal timestamp is similar not only to its local neighbors, but also to its global neighbors. Therefore, the difference in similarity between local neighbors and global neighbors is a method for identifying abnormal timestamps from normal timestamps, such as Figure 1As shown in (b) in the figure. Based on this idea, a micro trainable Gaussian distribution with only one parameter is set for each timestamp to model the similarity between its local neighbors and global neighbors. Then, a global and local adversarial learning mechanism is designed to amplify the difference between the local and global neighbor similarities of each timestamp by maximizing the local and global neighbor similarities at the same time. In this scheme, the micro trainable Gaussian distribution provides the high speed and low resource consumption of the model, and the adversarial learning mechanism ensures the high accuracy of the model.

[0076] The second bottleneck is how to achieve privacy protection for multi-sensor time series data without adding additional overhead. To solve this bottleneck, the most direct solution is to use data similarity as the initial input of the model instead of the original privacy data to achieve data privacy protection. In this solution, the initial data similarity can be directly called from a third-party security interface, or flexibly connected to other similarity calculation models. In addition, in the process of converting the original multi-sensor privacy data into non-privacy data similarity, the coupling association between multiple sensors can be further captured.

[0077] The present invention provides an unsupervised industrial time series data fast anomaly detection method for edge devices. First, data similarity is used to replace the original industrial time series privacy sensor data as the input of the model, thereby realizing data privacy protection. Secondly, a trainable Gaussian distribution with only one parameter is set for each timestamp to replace the traditional deep neural network for modeling the potential similarity of each timestamp with its neighbors, thereby achieving high speed and low consumption. Then, a global and local adversarial learning strategy is designed to amplify the difference between the global similarity and local similarity of each timestamp. Finally, the difference between global and local similarities is used as an indicator to determine whether each timestamp is abnormal. Specifically, the following steps are included:

[0078] Step S1, model parameter setting

[0079] Assume that M sensors are used to observe a dynamic production system at T timestamps. The collected data forms a multi-sensor time series data, which contains the time dimension and the variable (sensor) dimension. In the time dimension, the multi-sensor time series data can be expressed as: where x t Represents the observed value of M sensor variables at the tth timestamp. In the variable dimension, multi-sensor time series data can be expressed as: where x m represents the observations of all T timestamps of the mth sensor.

[0080] The unsupervised industrial time series data fast anomaly detection method for edge devices of the present invention first uses unlabeled epochal multi-sensor time series data to train an anomaly detection model, and then uses the trained model to generate an anomaly score for each timestamp to be detected.

[0081] Score t =PPLAD(x t ) (1)

[0082] in, Represents the observed values ​​of M variables at the tth timestamp. Ultimately, this anomaly score will be used as an indicator to determine whether the tth timestamp is anomaly.

[0083]

[0084] Among them, α is the preset threshold, ranging from 0 to 1. Then the tth timestamp is judged as an abnormal point; otherwise, the tth timestamp is considered normal.

[0085] Step S2, model framework setting

[0086] The unsupervised industrial time series data fast anomaly detection method for edge devices of the present invention constructs a fast detection model called PPLAD. The overall framework of the model is as follows: Figure 2 As shown, it contains three parts:

[0087] (1) Initial similarity calculation component: This component generates the local neighbor similarity and global neighbor similarity of each timestamp by calling a third-party security interface or connecting with a third-party similarity calculation model, and serves as the input of the fast detection method.

[0088] (2) Adversarial learning component based on trainable Gaussian distribution: In this component, a trainable Gaussian distribution with only one parameter is constructed for each timestamp to model the global and local neighbor similarities of each timestamp based on the initial similarity. At the same time, global and local adversarial learning mechanisms are designed to amplify the difference between global and local neighbor similarities, thereby improving the accuracy of anomaly detection.

[0089] (3) Anomaly scoring component: This component uses the difference between global neighbor similarity and local neighbor similarity to calculate the anomaly score of each timestamp and use it to determine whether the timestamp is an anomaly point.

[0090] Step S3, initial similarity calculation

[0091] The similarity of the original private data obtained from the third-party security interface or the third-party similarity calculation model is used as the initial input of the method of this embodiment to achieve data privacy protection. The third-party security interface can be located on the edge device or in the cloud. In this way, the original private data becomes a non-private data similarity. In this way, not only can the private data be protected on the unsafe edge device, but the multivariate correlation between the original data can also be captured.

[0092] In order to provide a reference solution for the third-party security interface, this embodiment designs a similarity calculation strategy. The detailed calculation process is as follows: First, from the original privacy data Extract M variables for each timestamp to form a data vector Secondly, we use similarity calculation methods, including distance-based mean square error (MSE) similarity, probability distribution-based Kullback-Leibler divergence similarity, and vector-based cosine similarity, to calculate the similarity between any two timestamp data vectors. Finally, we use the original private data Will be converted into a similarity matrix in Represents the similarity between timestamp t and its T neighbors.

[0093] Step S4: construct a trainable Gaussian distribution for each timestamp

[0094] Typically, industrial time series abnormal events occur at a low frequency, each occurrence lasts for multiple timestamps, and is significantly different from the normal state, such as Figure 1 This shows that an abnormal timestamp usually has a high similarity only with other nearby timestamps (local neighbors) within the same anomaly, but has a low similarity with distant timestamps (global neighbors, also commonly referred to as normal timestamps). On the contrary, due to the periodicity or seasonality of the production process, a normal timestamp is similar not only to its local neighbors, but also to its global neighbors. Therefore, the difference in similarity between local neighbors and global neighbors is an effective method for identifying abnormal timestamps from normal timestamps, such as Figure 1 Based on this method, this embodiment sets a trainable Gaussian distribution containing only one parameter for each timestamp to model the global similarity and local similarity of the timestamp based on the initial similarity, as shown in (b) of FIG. Figure 2 In addition, this embodiment also designs a customized global-local adversarial learning mechanism to further amplify the difference between global neighbor similarity and local neighbor similarity. Taking the t-th timestamp as an example, the adversarial learning process based on the trainable Gaussian distribution is as follows:

[0095] S4-1, global neighbor and local neighbor sampling

[0096] The global and local neighbor sampling process for each timestamp is as follows Figure 3 As shown. For timestamp t, timestamps in the range [t-LN / 2, t+LN / 2] are selected as local neighbors of t, where LN is a preset shaping hyperparameter representing the length of local neighbors. At the same time, timestamps in the range [t-GN / 2, t-LN / 2] and [t+LN / 2, t+GN / 2] are selected as global neighbors of t, where GN is another preset shaping hyperparameter and (GN-LN) represents the length of global neighbors. Based on the coordinates of local neighbors and global neighbors, the initial similarity of timestamp t is Extract the initial similarity of the corresponding coordinates and perform normalization:

[0097]

[0098] Among them, s it represents the initial similarity between timestamps i and t, Represents the normalized similarity.

[0099] S4-2, trainable Gaussian distribution

[0100] Construct a private Gaussian distribution for timestamp t with only one trainable parameter, expressed as follows:

[0101]

[0102] Among them, x represents the coordinates of the neighbor timestamp, σ t Represents the variance of the Gaussian distribution and is a trainable parameter.

[0103] Each timestamp has its own Gaussian distribution, and the Gaussian distributions of two timestamps are different. t It can be deduced that a shared two-layer MLP network is used as a variance generator. The MLP network includes an input layer with T neurons for receiving the initial similarities of all neighbors of each timestamp; a hidden layer with d neurons activated by the ReLU function; and an output layer with 1 neuron for generating private variance values ​​for different timestamps. In this MLP network, the input layer and the hidden layer form the first fully connected layer, and the hidden layer and the output layer form the second fully connected layer. Taking the t-th timestamp as an example, the generation process of the private variance in its trainable Gaussian distribution is described as follows:

[0104] First, the initial neighbor similarity of length T is Input to the first fully connected layer to get the features:

[0105] Ft =ReLU(s t ×W1) (5)

[0106] Among them, F t For the generated features, is the initial similarity between timestamp t and other T timestamps, is the training parameter of the first fully connected layer, and ReLU is the activation function.

[0107] Secondly, the extracted features F t This is passed to a second fully connected layer to generate the private variance in the trainable Gaussian distribution of timestamp t:

[0108] σ t =F t ×W2 (6)

[0109] Among them, σ t is the variance of the trainable Gaussian distribution of the generated timestamp t, Represents the training parameters of the second fully connected layer.

[0110] Step S5: Generate local neighbor and global neighbor fitting similarity for each timestamp

[0111] S5-1, generating local neighbors to be fitted, with timestamp t as the center, timestamps in the range of [t-LN / 2, t+LN / 2] are selected as local neighbors to be fitted of timestamp t;

[0112] S5-2, generation of candidate global neighbors to be fitted, with timestamp t as the center, timestamps in the range [t-GN / 2, t+GN / 2] are selected as candidate global neighbors to be fitted of timestamp t, where LN <GN;

[0113] S5-3, generating the global neighbors to be fitted, marking the remaining timestamps in the candidate global neighbors sequence to be fitted except the local neighbors to be fitted as the global neighbors to be fitted with timestamp t, whose range is [t-GN / 2, t-LN / 2] and [t+LN / 2, t+GN / 2], and whose length is (GN-LN);

[0114] S5-4, the similarity of the local and global neighbors to be fitted is generated based on the coordinates of the fitted local and global neighbors, starting from the initial similarity of timestamp t Extract the initial similarity corresponding to the coordinates and perform normalization:

[0115]

[0116] Among them, s it represents the initial similarity between timestamps i and t, where i ranges from [t-GN / 2, t+GN / 2], Represents the normalized similarity to be fitted.

[0117] Step S6: Global and local adversarial learning

[0118] The adversarial learning process of the trainable Gaussian distribution of the t-th timestamp is as follows:

[0119] S6-1, Similarity fitting learning of local neighbors

[0120] Training variance σ t , so that the Gaussian distribution of timestamp t can only perfectly fit the normalized similarity to be fitted of each local neighbor. The formula is as follows:

[0121]

[0122] Where LN represents the number of local neighbors, g t (i) The predicted similarity of the i-th neighbor in the Gaussian distribution at the t-th timestamp, is the similarity to be fitted between timestamp t and timestamp i, L1 is the local neighbor similarity fitting loss function;

[0123] S6-2, Local Neighbor Similarity Area Maximization Learning

[0124] Training variance σ t , so that the area occupied by local neighbors in the Gaussian distribution of timestamp t is the largest and close to the total area 1. The formula is as follows:

[0125] L2=[1-(Area(t+LN / 2)-Area(t-LN / 2))] 2 (9)

[0126] Among them, Area(x) represents the area of ​​Gaussian distribution in the interval [-∞,x], and L2 is the local neighbor area maximization loss function;

[0127] S6-3, Similarity fitting learning of global neighbors

[0128] Training variance σ t , so that the Gaussian distribution of timestamp t can only perfectly fit the normalized similarity to be fitted for each global neighbor, the formula is as follows:

[0129]

[0130] Where (GN-LN) represents the number of global neighbors, g t (i) and g t (j) The predicted similarity between the i-th neighbor and the j-th neighbor in the Gaussian distribution at the t-th timestamp, and is the similarity to be fitted between timestamp t and timestamps i and j, L3 is the global neighbor similarity fitting loss function;

[0131] S6-4, Global Neighbor Similarity Area Maximization Learning

[0132] Training variance σ t , so that the area occupied by the global neighbors in the Gaussian distribution of timestamp t is the largest and close to the total area 1. The formula is as follows:

[0133] L4=1-2×Area(t-LN / 2) (11)

[0134] Among them, Area(x) represents the area of ​​Gaussian distribution in the interval [-∞,x], and L4 is the global neighbor area maximization loss function;

[0135] S6-5, Adversarial Learning

[0136] The local similarity learning with the goal of "fitting only local similarity + maximizing only local similarity area" and the global similarity learning with the goal of "fitting only global similarity + maximizing only global similarity area" constitute two opposing competitors. Adversarial learning is used to amplify the difference between local similarity and global similarity. The loss function of adversarial learning is:

[0137] Loss=L1+L2+L3+L4 (12)

[0138] Step S7, generate anomaly score for each timestamp

[0139] After the learnable Gaussian distribution is trained, the method of the present invention can perform anomaly scoring on the timestamps of the test set. Take the timestamp t to be tested as an example. The scoring process is as follows: first, the initial similarity of all neighbors of the timestamp t to be tested is obtained using a third-party security interface; second, the initial similarity is input into the shared trained two-layer MLP variance generator to generate the variance σ of the timestamp t. t , and construct a private Gaussian distribution of timestamp t; then, generate the global neighbors and local neighbors of timestamp t according to the sampling strategy, and generate the normalized global neighbor similarity and local neighbor similarity to be fitted according to the initial similarity; then, use the local neighbor similarity fitting loss value as the local similarity of timestamp t, and use the global neighbor similarity fitting loss value as the global similarity of timestamp t; furthermore, use the difference between the global neighbor similarity and the local neighbor similarity as the anomaly score of timestamp t, which is:

[0140] Score t =|L1-L3| (13)

[0141] Among them, |·| is the absolute value function. Finally, use formula (2) to determine whether the timestamp t is abnormal.

[0142] Experimental verification

[0143] 1. Set the Experimental Goal

[0144] There are four main goals:

[0145] Objective 1 (Accuracy): Can the detection accuracy of the method of the present invention on multi-sensor time series data (multivariate time series data) exceed that of the comparison algorithm?

[0146] Objective 2 (Deployability): Can the method of the present invention be easily deployed on resource-constrained Industrial IoT edge devices?

[0147] Objective 3 (Timeliness and Resource Consumption): How does the method of the present invention perform in terms of timeliness and resource consumption on IIoT edge devices?

[0148] Objective 4 (ablation experiment): Does each innovative part of the method of the present invention contribute to the overall performance?

[0149] 2. Dataset

[0150] Eight publicly available real-world industrial multi-sensor time series datasets were selected for experiments. The specific information is shown in Table 1. These datasets cover multiple fields such as water treatment, aviation, aerospace, intelligent manufacturing, and e-commerce, thereby ensuring the fairness and impartiality of the experiments. Specifically, HAI dataset: a variety of industrial signals from pumps, valves, pressure sensors, and other common industrial equipment. MSL dataset: operating status data of multiple sensors and controllers on the Mars rover. PSM dataset: 25-dimensional monitoring information from eBay servers. PUMP: monitoring data of water pumps from multiple sensors. SKAB dataset: multi-sensor time series signals obtained from an industrial test bench. SMAP dataset: moisture level signals at different soil depths recorded by NASA's SMAP satellite. SWaT dataset: 51-dimensional data from public water treatment facilities collected by multiple sensors. WaDi dataset: 127-dimensional monitoring data from industrial control systems.

[0151] Table 1 Real-world industrial time series dataset

[0152] Dataset Feature Train Set Test Set HAI 86 280800 54000 MSL 55 58317 73729 PSM 25 132481 87841 SKAB 8 12450 5710 SMAP 25 135183 427617 PUMP 51 132192 88128 SWaT 51 495000 449919 WaDi 127 103680 69121

[0153] 3. Comparison of algorithms, evaluation indicators, and deployment environments

[0154] Comparison Algorithms: Seven representative advanced algorithms in the past two years were selected as comparison algorithms for our PPLAD method, as shown in the table. Among all the comparison algorithms, PatchAD, NPSR, DTAAD, DIF, and DCdetector are deep models with more parameters, while PPLAD, COUTA, and Optiforest are lightweight models with fewer parameters.

[0155] Table 2 Comparison of algorithms

[0156]

[0157] (1) Evaluation indicators: In order to conduct a comprehensive evaluation, four widely used evaluation indicators are adopted: accuracy (ACC), precision (Precision), recall (Recall) and F1-Score (F1). Among them, ACC: measures the proportion of correctly predicted samples to the total number of samples. Precision: indicates the proportion of actually normal timestamps among all timestamps predicted to be normal. Recall: reflects the proportion of correctly detected timestamps among actually normal timestamps. F1: provides a more balanced performance evaluation by combining precision and recall. Generally, the value range of the four evaluation indicators is 0 to 1. The larger the value, the more accurate the anomaly detection is and the better the performance of the algorithm.

[0158] (2) Deployment environment: This experiment was performed on a PC server with Windows 11 system, which was configured with Intel(R) Core(TM) i7-10700KF CPU, NVIDIA GeForce RTX 3090 GPU (24GB video memory) and 64GB memory. In addition, the deployment experiment was conducted on two IoT edge devices with limited resources: the miniature Raspberry Pi 4b and the thin NVIDIA Jetson Xavier NX. The method of the present invention was developed using Python language, and the integrated development environment was PyCharm. The other algorithms were Python codes downloaded from the official website provided by the corresponding authors, and the parameters used were also the optimal parameters provided by the authors.

[0159] 4. Accuracy Experiment

[0160] To verify Objective 1, the proposed method is compared with seven benchmark algorithms on eight multi-sensor datasets.

[0161] (1) Accuracy: Table 3 lists the detection accuracy of eight algorithms on eight data sets. The bold values ​​in the table represent the best values ​​of different algorithms on the same data set, and the underlined values ​​represent the second best values. From the table, we can draw the following observations:

[0162] Table 3 Accuracy experiment

[0163]

[0164] ① Overall performance: PPLAD algorithm has the best performance, followed by DCdetector, COUTA, PatchAD, DIF and DTAAD, and the worst performance is Optiforest and NPSR algorithms. For example, on the PUMP dataset, PPLAD achieved a Precision value of 0.9805, COUTA's Precision was only 0.7572, PatchAD's Precision was 0.931, and Optiforest's Precision was only 0.2124.

[0165] ② Stability: PPLAD shows the best stability in all four evaluation indicators on eight datasets, followed by DCdetector and DIF. In particular, PPLAD ranks first or second in all datasets and indicators.

[0166] ③ Comparison of deep and shallow models: Algorithms based on deep neural networks (such as DIF, DCdetector, DTAAD, PatchAD) are generally better than shallow algorithms (such as Optiforest, COUTA), but the shallow PPLAD algorithm of the present invention surpasses multiple deep algorithms. For example, in the MSL dataset, the ACC of PPLAD is 0.9919 and the Recall is 0.9885, while those of DTAAD are 0.9242 and 0.3754 respectively, and those of DCdetector are 0.9883 and 0.9703.

[0167] (2) Visualization: The anomaly detection results of the eight algorithms for the timestamps between 60500 and 63500 in the first variable of the MSL dataset are visualized, e.g. Figure 4 As shown in the figure, the black curve represents the true data value, the red curve represents the abnormal label, the peak represents the abnormal point, and the valley represents the normal point. In all visualizations, Ground-Truth represents the true data and the true label, and the other 8 visualizations are the detection results of the eight algorithms. Figure 4 Two findings can be drawn.

[0168] ① Accuracy: The detection accuracy of PPLAD, COUTA and DCdetector algorithms is significantly higher than that of other comparison algorithms. For example, during the time stamp period from 62300 to 62600, the detection results of PPLAD, COUTA and DCdetector are consistent with the true label, while the errors of other comparison algorithms are relatively large.

[0169] ② False alarm rate: The false alarm rates of PPLAD, COUTA and DCdetector are significantly lower than those of other algorithms. For example, within the time range of 60500 to 63500, many normal timestamps are falsely reported as abnormal timestamps by the eight algorithms, among which PPLAD, COUTA and DCDetector have the least false alarm timestamps.

[0170] Conclusion: The experimental results show that the proposed method exhibits excellent accuracy and stability in anomaly detection of industrial multi-sensor time series datasets.

[0171] V. Deployment Experiment

[0172] To verify Objective 2, eight algorithms were deployed on two IoT edge devices: the tiny Raspberry Pi 4b with scarce resources and the thin Jetson Xavier NX with average resources. Specifically, the Raspberry Pi 4b is equipped with a 1.5GHz ARM Cortex-A72 processor and 2GB of memory, while the Jetson Xavier NX is equipped with a 6-core CarmelARMv8.2 processor and 8GB of memory. In the experiment, all deep neural network-based algorithms were first trained in the cloud and then deployed to the edge device for testing, while shallow algorithms were trained and deployed directly on the edge device.

[0173] The deployment test results of the eight algorithms on two edge devices are shown in Figure 5. Figure 5(a) shows the deployment result on Raspberry Pi4b, and Figure 5(b) shows the deployment result on Jetson Xavier NX.

[0174] From Figure 5, two conclusions can be drawn:

[0175] ① Deployability: Except for PatchAD, which has storage consumption exceeding the upper limit of the device, all algorithms are successfully deployed on edge devices. Comparing the deployment process of all algorithms, the deployment of lightweight algorithms (PPLAD, Optiforest, DIF) is relatively easy.

[0176] ②Maintainability: In the industrial IoT environment, frequent changes in production processes can cause dynamic fluctuations in timing signals. Therefore, algorithms or models need to be updated regularly to maintain their optimal performance. For algorithms based on deep neural networks, the update process usually requires fine-tuning the model with new data samples in the cloud before redeploying the algorithm to the edge device; for lightweight algorithms, the update process can be performed directly on the edge device. In addition, lightweight algorithms require fewer retraining samples, consume less storage space, and have lower communication overhead.

[0177] Summary: The shallow lightweight algorithm of the present invention is easier to deploy than the deep algorithm on resource-constrained industrial IoT edge devices.

[0178] 6. Timeliness and resource consumption experiments

[0179] To verify Objective 3, the processing time and resource consumption of eight models on the MSL dataset were evaluated in three deployment environments: a powerful PC (thick edge), a Jetson XavierNX with moderate resources (thin edge), and a Raspberry Pi 4b with very few resources (micro edge).

[0180] The table lists the timeliness and resource consumption of the eight algorithms, where "Ot" means insufficient memory and "-" means no available data. From the table, we can draw several conclusions.

[0181] ① Model parameter quantity: PPLAD has only 12.0K parameters, which is much less than other comparison algorithms, such as COUTA (376.1K), PatchAD (2072.9K) and DCdetector (826.5K).

[0182] ② Real-time performance: Taking a training epoch with a batch_size of 128 as an example, the training time of PPLAD is only 10.3 seconds, while PatchAD takes 229.9 seconds, DCdetector takes 128.1 seconds, and COUTA takes 26.5 seconds. Similarly, for all the timestamps to be tested, PPLAD takes only 0.9 seconds to complete the test of all the timestamps to be tested, which is much better than other algorithms, such as PatchAD (154.5 seconds), COUTA (3.7 seconds) and DCdetector (2.9 seconds).

[0183] ③ Computational consumption: The CPU and GPU usage of shallow algorithms is much lower than that of deep algorithms. For example, on Raspberry Pi4b, the CPU usage of the shallow algorithm PPLAD is 25.5%, while the CPU usage of the deep algorithm DCdetector is 57.4%, and the CPU usage of the deep algorithm NPSR is 63.2%.

[0184] ④ Storage consumption: Deep algorithms occupy significantly more storage resources than shallow algorithms. For example, on a Jetson Xavier NX with only 8G memory, the memory usage of the deep algorithm DIF is 3.1GB, the deep algorithm DCdetector is 3.7GB, while the shallow PPLAD of the present invention is only 1.1GB, and the shallow algorithm Optiforest is only 0.8GB.

[0185] Summary: PPLAD exhibits good timeliness and low resource consumption, making it very suitable for deployment on resource-limited IIoT edge devices.

[0186] Table 4 Processing time and resource consumption

[0187]

[0188] VII. Ablation Experiment

[0189] To verify Objective 4, two sets of ablation experiments are conducted to evaluate the two key components of the PPLAD algorithm. These experiments are conducted on four multi-sensor datasets (HAI, PUMP, SMAP, and SWaT), and three evaluation metrics (ACC, Recall, and F1) are used for performance evaluation.

[0190] (1) Input similarity calculation: The first key component is to use data similarity to replace the original private data to achieve data privacy protection. Therefore, this experiment aims to verify the impact of different initial similarity calculation methods on algorithm performance. Specifically, four comparison models are designed: similarity based on MSE distance, vector similarity based on Cosine, probability distribution similarity based on KL, and attention association similarity based on the third-party DCdetector model.

[0191] Figure 6 (a) in Figure 2 shows the detection performance of four models on four datasets. From the figure, two conclusions can be drawn.

[0192] ① Overall performance: The performance of the four models on the four datasets is very close, which shows that the PPLAD algorithm of the present invention is highly robust to different initial similarity calculation methods. For example, on the SMAP dataset, the ACC score of the MSE-based model is 0.9909, while that of the Cosine-based model is 0.9901, that of the KL-based model is 0.9903, and that of the attention-based model is 0.9892.

[0193] ②Flexibility: The PPLAD algorithm of the present invention has the advantages of seamlessly connecting with third-party models and optimizing the anomaly detection performance of third-party models. For example, in the attention-based model, the trained DCdetector model is used to calculate the initial neighbor similarity of each timestamp. Then, the PPLAD model optimizes these similarities and uses the optimized similarities for anomaly detection, and it is found that better detection results will be obtained. Specifically, on the SMAP dataset, the ACC score of the attention-based PPLAD model is 0.9892, while that of the DCdetector model is 0.9843.

[0194] (2) Global-local adversarial learning: The second key component is the global-local adversarial learning mechanism, which aims to amplify the difference between local similarity and global similarity. In this adversarial learning mechanism, there are two adversarial parts: global and local similarity adversarial learning and global and local area adversarial learning. Therefore, this experiment aims to verify the impact of these two adversarial parts on model performance. Specifically, three comparison models are designed: using only similarity adversarial learning (model 1), using only area adversarial learning (model 2), and using both similarity and area adversarial learning (model 3). Figure 6 (b) shows the detection accuracy of the three models. Figure 6 Two conclusions can be drawn.

[0195] ① Overall performance: Model 3 based on similarity and area adversarial learning performs better on all three indicators and four datasets, as reflected in the highest column in the figure.

[0196] ② Comparison between Model 1 and Model 2: These two models have their own advantages and disadvantages, which shows that both similarity-based adversarial learning and area-based adversarial learning have produced positive effects. For example, in the SWaT dataset, Model 1 performs better in ACC, Recall, and F1 indicators. In the SMAP dataset, Model 2 performs better in ACC, Recall, and F1 indicators.

[0197] Summary: The joint adversarial learning of similarity and area can achieve the best anomaly detection effect.

[0198] Extensive experimental results on eight public industrial multi-sensor time series datasets and three edge devices (thick PC with powerful resources, thin Jetson Xavier NX with average resources, and micro Raspberry Pi 4b with scarce resources) show that the method designed by the present invention outperforms multiple state-of-the-art models, especially in terms of detection time and model parameters, which is only one-tenth of other compared models.

[0199] The above implementation cases are only preferred embodiments of the present invention and are not intended to limit the present invention in any form. Although the present invention has been disclosed as above with preferred embodiments, they are not intended to limit the present invention. Therefore, any simple modification, equivalent changes and modifications made to the above embodiments according to the technical essence of the present invention without departing from the content of the technical solution of the present invention shall fall within the scope of protection of the technical solution of the present invention.

Claims

1. A fast anomaly detection method for unsupervised industrial time series data for edge devices, characterized in that: The detection method includes: first, using data similarity to replace industrial sensor time series data as the input of the method, getting rid of the dependence on privacy data and achieving the purpose of data privacy protection; second, setting a trainable Gaussian distribution with only one parameter for each timestamp to model the potential similarity between each timestamp and its neighbors, making the structure lightweight; then, designing a global and local adversarial learning strategy to amplify the difference between the global similarity and local similarity of each timestamp; finally, using the difference between the global and local similarities as an indicator to determine whether each timestamp is abnormal.

2. The unsupervised industrial time series data fast anomaly detection method for edge devices according to claim 1 is characterized in that: The detection method specifically comprises the following steps: Step S1, calculating the initial similarity as input, using the similarity of the original private data obtained from the third-party security interface or the third-party similarity calculation model as the initial input; Step S2, construct a trainable Gaussian distribution for each timestamp, use a two-layer MLP network as a generator, take the initial neighbor similarity of each timestamp as input, and generate a private trainable variance Gaussian distribution for each timestamp; Step S3, generating local neighbor and global neighbor fitting similarities, sampling neighbors for each timestamp, generating global neighbors and local neighbors, and then normalizing the initial similarity according to the sampled neighbor coordinates to generate global neighbor fitting similarities and local neighbor fitting similarities; Step S4, global and local adversarial learning, from the two aspects of similarity fitting and area maximization, local similarity learning and global similarity learning are regarded as two competitors, adversarial learning is performed, and the parameters of the trainable Gaussian distribution of each timestamp are updated through reverse gradient, the global and local similarity differences of normal timestamps are reduced, and the global and local similarity differences of abnormal timestamps are amplified; Step S5, generating an anomaly score for each timestamp, using the trained learnable Gaussian distribution model to perform an anomaly score on each timestamp in the test set, and determining whether the current timestamp is abnormal based on the anomaly score.

3. The unsupervised industrial time series data fast anomaly detection method for edge devices according to claim 2 is characterized in that: In step S1, assuming that M sensors are used to observe a dynamic production system at T timestamps, an industrial multi-sensor time series data including time dimension and variable dimension will be generated. In the time dimension, the multi-sensor time series data is: where x t represents the observed value of M sensor variables at the tth time stamp; In terms of variable dimension, the multi-sensor time series data is: where x m represents the observation values ​​of all T timestamps of the mth sensor; The initial similarity calculation is as follows: First, from the original private data Extract M variables for each timestamp to form a data vector Secondly, the similarity calculation method is used to calculate the similarity between any two timestamp data vectors; finally, the original private data is converted into a similarity matrix in Represents the similarity between timestamp t and its T neighbors.

4. The unsupervised industrial time series data fast anomaly detection method for edge devices according to claim 3 is characterized in that: In step S2, the process of constructing a private Gaussian distribution containing only one trainable parameter for any timestamp t is: Among them, x represents the coordinates of the neighbor timestamp, σ t Represents the variance of the Gaussian distribution, which is a trainable parameter; A shared two-layer MLP network is used as the variance generator so that σ t It can be deduced that the MLP network includes an input layer with T neurons for receiving the initial similarities of all neighbors of each timestamp; a hidden layer with d neurons activated by the ReLU function; and an output layer with 1 neuron for generating private variance values ​​of different timestamps; in the MLP network, the input layer and the hidden layer form the first fully connected layer, and the hidden layer and the output layer form the second fully connected layer; taking the t-th timestamp as an example, the generation process of the private variance in its trainable Gaussian distribution is: First, the initial neighbor similarity of length T is Input to the first fully connected layer to get the features: F t =ReLU(s t ×W1) (5) Among them, F t For the generated features, is the initial similarity between timestamp t and other T timestamps, is the training parameter of the first fully connected layer, and ReLU is the activation function; Secondly, the extracted features F t This is passed to a second fully connected layer to generate the private variance in the trainable Gaussian distribution of timestamp t: s t =F t ×W2 (6) Among them, σ t is the variance of the trainable Gaussian distribution of the generated timestamp t, Represents the training parameters of the second fully connected layer.

5. The unsupervised industrial time series data fast anomaly detection method for edge devices according to claim 3 is characterized in that: In step S3, the process of generating the local neighbor and global neighbor fitting similarity of each timestamp is as follows: S3-1, generating local neighbors to be fitted, with timestamp t as the center, timestamps in the range of [t-LN / 2, t+LN / 2] are selected as local neighbors to be fitted of timestamp t; S3-2, generation of candidate global neighbors to be fitted, with timestamp t as the center, timestamps in the range [t-GN / 2, t+GN / 2] are selected as candidate global neighbors to be fitted of timestamp t, where LN<GN; S3-3, generating the global neighbors to be fitted, marking the remaining timestamps in the candidate global neighbors sequence to be fitted except the local neighbors to be fitted as the global neighbors to be fitted with timestamp t, whose range is [t-GN / 2, t-LN / 2] and [t+LN / 2, t+GN / 2], and whose length is (GN-LN); S3-4, the similarity of the local and global neighbors to be fitted is generated based on the coordinates of the fitted local and global neighbors, starting from the initial similarity of timestamp t Extract the initial similarity corresponding to the coordinates and perform normalization: Among them, s it represents the initial similarity between timestamps i and t, where i ranges from [t-GN / 2, t+GN / 2], Represents the normalized similarity to be fitted.

6. The unsupervised industrial time series data fast anomaly detection method for edge devices according to claim 3 is characterized in that: In step S4, the adversarial learning process of the trainable Gaussian distribution of the t-th timestamp is specifically as follows: S4-1, Similarity fitting learning of local neighbors Training variance σ t , so that the Gaussian distribution of timestamp t can only fit the normalized similarity to be fitted for each local neighbor, the formula is as follows: Where LN represents the number of local neighbors, g t (i) The predicted similarity of the i-th neighbor in the Gaussian distribution at the t-th timestamp, is the similarity to be fitted between timestamp t and timestamp i, L1 is the local neighbor similarity fitting loss function; S4-2, Local Neighbor Similarity Area Maximization Learning Training variance σ t , so that the area occupied by local neighbors in the Gaussian distribution of timestamp t is the largest and close to the total area 1. The formula is as follows: L2=[1-(Area(t+LN / 2)-Area(t-LN / 2))] 2 (9) Among them, Area(x) represents the area of ​​Gaussian distribution in the interval [-∞,x], and L2 is the local neighbor area maximization loss function; S4-3, Similarity fitting learning of global neighbors Training variance σ t , so that the Gaussian distribution of timestamp t can only fit the normalized similarity to be fitted for each global neighbor, the formula is as follows: Where (GN-LN) represents the number of global neighbors, g t (i) and g t (j) The predicted similarity between the i-th neighbor and the j-th neighbor in the Gaussian distribution at the t-th timestamp, and is the similarity to be fitted between timestamp t and timestamps i and j, L3 is the global neighbor similarity fitting loss function; S4-4, Global Neighbor Similarity Area Maximization Learning Training variance σ t , so that the area occupied by the global neighbors in the Gaussian distribution of timestamp t is the largest and close to the total area 1. The formula is as follows: L4=1-2×Area(t-LN / 2) (11) Among them, Area(x) represents the area of ​​Gaussian distribution in the interval [-∞,x], and L4 is the global neighbor area maximization loss function; S4-5, Adversarial Learning Local similarity learning and global similarity learning constitute two opposing competitors. Adversarial learning is used to amplify the difference between local similarity and global similarity. The loss function of adversarial learning is: Loss=L1+L2+L3+L4 (12).

7. The unsupervised industrial time series data fast anomaly detection method for edge devices according to claim 3 is characterized in that: In step S5, the scoring process of the timestamp t to be tested is as follows: first, the initial similarity of all neighbors of the timestamp t to be tested is calculated using the third-party security interface; second, the initial similarity is input into the shared trained two-layer MLP variance generator to generate the variance σ of the timestamp t t , and construct a private Gaussian distribution of timestamp t; then, generate the global neighbors and local neighbors of timestamp t according to the sampling strategy, and generate the normalized global neighbor similarity and local neighbor similarity to be fitted according to the initial similarity; then, use the local neighbor similarity fitting loss value as the local similarity of timestamp t, and use the global neighbor similarity fitting loss value as the global similarity of timestamp t; furthermore, use the difference between the global neighbor similarity and the local neighbor similarity as the anomaly score of timestamp t, which is: Score t =|L1-L3| (13) Among them, |·| is the absolute value function; Finally, determine whether the timestamp t is abnormal. The judgment formula is: in, Indicates the abnormal judgment result, α is the preset threshold, and the value range is 0 to 1; if Then the tth timestamp is judged as an abnormal point; otherwise, the tth timestamp is considered normal.

Images