Unsupervised industrial time series data fast anomaly detection method for edge devices

Abstract

The application discloses an unsupervised industrial time series data fast anomaly detection method for edge devices, which comprises the following steps: firstly, data similarity is used to replace industrial sensor time series data as the input of the method, so as to achieve the purpose of data privacy protection; secondly, a trainable Gaussian distribution with only one parameter is set for each timestamp to replace the traditional deep and heavy neural network for modeling the potential similarity between each timestamp and its neighbor, so as to ensure the lightweight structure; finally, a global and local adversarial learning strategy is designed to amplify the difference between the global similarity and the local similarity of each timestamp, and the global and local similarity difference is used to determine whether each timestamp is abnormal, so as to improve the accuracy of the method. The industrial time series anomaly fast detection method for resource-limited edge devices has the characteristics of high precision, high speed and low resource consumption while ensuring data privacy by using a lightweight structure.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of industrial time series data detection, and particularly relates to an unsupervised industrial time series data fast anomaly detection method for edge devices. BACKGROUND

[0002] A large number of Internet of Things (IoT) sensors are integrated into the underlying production devices and production lines for the purpose of perception, monitoring and control of industrial production processes. Influenced by the Internet of Things, production devices that were originally independent of each other and relatively secure are forced to be connected to other devices and communicate with the external Internet. This results in these production devices or production processes being vulnerable to attacks from the external network, causing them to deviate from the original normal state and exhibit abnormal events or behaviors. If these abnormalities cannot be detected and handled in a timely manner, they will interfere with and interrupt the production process, and even cause damage or destruction to the devices, thereby causing serious property losses and casualties. On the contrary, if these abnormalities can be accurately identified at an early stage and timely alarms are issued, appropriate defense measures can be taken to minimize losses and effectively ensure the safety and stability of industrial production processes. Therefore, anomaly detection is crucial in high-cost industrial scenarios, and has always been a research hotspot.

[0003] In the past, time series anomaly detection models were often deployed in the cloud with strong resources. Specifically, the edge device will periodically upload the collected time series data to the cloud, and the cloud detection model will perform anomaly identification and return the identification result to the edge device. In this case, people mostly focus on enhancing the representation ability of the model by constructing a deep neural network with a large number of parameters, so as to achieve the goal of improving the accuracy of the model. Therefore, unsupervised anomaly detection models based on deep neural networks are the current mainstream research direction. However, with the refinement and intelligentization of industrial intelligent control, more and more Internet of Things sensors are installed on industrial devices to perform more intensive data collection and information monitoring. This results in a rapid increase in the amount of industrial time series data, thereby causing a huge communication overhead between the edge device and the cloud. In addition, the large amount of data further causes the cloud-based anomaly detection to face problems such as high delay and high cost. Therefore, directly performing time series anomaly detection on the edge device rather than the cloud, i.e., edge computing, has become a key requirement. However, the limited computing and storage resources of the edge device make it difficult for the current popular deep neural network-based models to function. Specifically, the existing deep and heavy models face two major challenges on the resource-constrained edge device.

[0004] Challenge 1: Difficulty in balancing accuracy, real-time performance, and low consumption. To perform anomaly detection on resource-constrained edge devices, the detection model must simultaneously satisfy high accuracy, high real-time performance, and low resource consumption. However, these three characteristics often conflict with each other and are difficult to balance. For example, to achieve high accuracy, the detection model usually needs to build a deep neural network with a large number of parameters to enhance its representation ability. In this case, the model needs longer computation time and consumes a large amount of computing resources and storage resources. Conversely, to achieve high real-time performance and low resource consumption, the detection model usually needs a lightweight structure with fewer network layers and fewer training parameters. However, the feature capturing ability of shallow models is often poor, and the detection accuracy is not satisfactory.

[0005] Challenge 2: Insecure and easily leaked private data. In industrial scenarios, edge devices continuously collect time series signals of sensors in the production process. These sensor time series data contain a large amount of valuable information and have strong privacy, involving the production or process details of each company. Currently, existing anomaly detection models for edge devices usually directly use the original sensor signals as input data. In industrial Internet of Things, edge devices often lack strong data privacy protection mechanisms and secure communication protocols. In this case, external attackers can easily steal the original sensor time series signal data through the industrial Internet of Things, leading to the leakage of industrial data. In more serious cases, attackers can hack edge devices, thereby disrupting the production process.

[0006] To address the first challenge, existing solutions have two different ways. The first way is to take deep neural networks as the prototype, and reduce the number of layers and redundant parameters of the neural network through model pruning and compression techniques, so as to balance high speed, high accuracy and low resource consumption. In this kind of solution, deep neural networks can provide higher accuracy, and model pruning and compression can improve real-time performance and reduce resource consumption. For example, on the basis of the DCdetector model, the PatchAD model uses a lightweight MLP network to replace the attention module with large computational load, and constructs a lightweight dual-branch contrast network structure. Similarly, the ANNet model employs an MLP network to optimize the LSTM unit, thereby improving the speed of the model and reducing resource consumption. However, these optimized models still have a large number of parameters and a deep network architecture, which leads to unsatisfactory resource consumption and computation time of these models. The second way is to take shallow machine learning or statistical models as the prototype, and combine other techniques or specific accuracy optimization strategies to construct hybrid lightweight models with accuracy and real-time performance. For example, the Optiforest model combines clustering learning and hashing technology to design an optimized multi-branch tree structure for the traditional Isolation Forest model. At the same time, the DIF model improves the accuracy of the Isolation Forest model by using a specific shallow neural network. The COUTA model designs multiple calibration mechanisms for the One-class support vector machine (OCSVM) to improve the accuracy of the model. In this kind of solution, simple and shallow prototype structures guarantee higher real-time performance and lower resource consumption, and hybrid mechanisms and optimization strategies improve the accuracy of the model. However, when encountering multi-sensor time series signals with complex feature patterns, these models will have unstable performance and poor accuracy due to poor representation ability.

[0007] To address the second challenge, existing solutions usually employ some security mechanisms to protect data privacy. For example, the FADngs model uses a federated authorization mechanism to ensure identity authorization and data privacy. Similarly, the FedAnomaly model develops a new type of collaborative learning communication protocol to ensure the security of cloud-edge communication. The Fed-SCR model uses federated learning technology to protect data privacy. The BCFL model uses blockchain technology to design a decentralized asynchronous federated learning framework to ensure model security. The TRIDENT model designs a lightweight encryption scheme based on aggregation optimization to protect data privacy. Dajiang Chen et al. combine cryptography and blockchain technology to enhance privacy protection and communication security. The OP-ADIHT model uses interval hash table (ADIHT) and homomorphic encryption to build a privacy-protected anomaly detection scheme. However, before performing anomaly detection, these models usually need to be encrypted and decrypted, or authenticated by a third party to ensure the security of data or identity. Therefore, these models often require longer processing time, or consume more computing resources and storage resources. On resource-limited Internet of Things edge devices, some complex privacy protection schemes often cannot run smoothly, causing anomaly detection to malfunction or even completely fail. SUMMARY

[0008] To solve the above technical problems, the present application provides an unsupervised industrial time series data fast anomaly detection method for edge devices, which uses a lightweight structure to ensure data privacy while having high precision, high speed and low resource consumption, making it easy to deploy on resource-limited edge devices and ensure its process runs.

[0009] To solve the above technical problems, the technical solution provided by the present application is:

[0010] An unsupervised industrial time series data fast anomaly detection method for edge devices, the detection method comprising: first, using data similarity instead of industrial sensor time series data as the input of the method, getting rid of the dependence on private data, and achieving the purpose of data privacy protection; second, setting a trainable Gaussian distribution with only one parameter for each timestamp to model the potential similarity of each timestamp and its neighbors, making the structure lightweight; third, designing a global and local adversarial learning strategy to amplify the difference between the global similarity and the local similarity of each timestamp; and finally, using the difference between the global and local similarity as an indicator to determine whether each timestamp is abnormal.

[0011] As a further improvement of the above technical solution:

[0012] Preferably, the detection method specifically comprises the following steps:

[0013] Step S1, calculate the initial similarity as input, use the similarity of the original privacy data obtained from the third-party security interface or the third-party similarity calculation model as the initial input;

[0014] Step S2, construct a trainable Gaussian distribution for each timestamp, use a two-layer MLP network as a generator to generate a private trainable variance Gaussian distribution for each timestamp, with the initial neighbor similarity of each timestamp as input;

[0015] Step S3, generate local neighbor and global neighbor fitting similarity, sample neighbors for each timestamp, generate global neighbors and local neighbors, and then normalize the initial similarity according to the sampling neighbor coordinates to generate the fitting similarity of the global neighbors and the fitting similarity of the local neighbors;

[0016] Step S4, global and local adversarial learning, from the aspects of similarity fitting and area maximization, treat local similarity learning and global similarity learning as two competitors, perform adversarial learning, and update the parameters of the trainable Gaussian distribution of each timestamp through backpropagation, to narrow the global and local similarity difference of normal timestamps and enlarge the global and local similarity difference of abnormal timestamps;

[0017] Step S5, generate an anomaly score for each timestamp, use the trained learnable Gaussian distribution model to perform anomaly scoring on each timestamp in the test set, and determine whether the current timestamp is abnormal according to the anomaly score.

[0018] Preferably, in step S1, using M sensors to observe a dynamic production system at T timestamps will generate an industrial multi-sensor time series data containing time and variable dimensions In the time dimension, the multi-sensor time series data is: where x t represents the observation value of the M sensor variables at the t-th timestamp; in the variable dimension, the multi-sensor time series data is: where x m represents the observation value of all T timestamps of the m-th sensor;

[0019] The initial similarity calculation is: first, extract the M variables of each timestamp from the original privacy data to form a data vector Second, calculate the similarity between the data vectors of any two timestamps using a similarity calculation method; finally, the original privacy data is converted into a similarity matrix where represents the similarity between timestamp t and its T neighbors.

[0020] Preferably, in step S2, the process of constructing a private Gaussian distribution containing only one trainable parameter for any timestamp t is as follows:

[0021]

[0022] Where x represents the coordinates of the neighbor's timestamp, σ t The variance, representing the Gaussian distribution, is a trainable parameter.

[0023] Using a shared two-layer MLP network as a variance generator makes σ t It can be deduced that the MLP network includes an input layer with T neurons, used to receive the initial similarity of all neighbors at each time point; a hidden layer with d neurons activated by the ReLU function; and an output layer with 1 neuron, used to generate private variance values ​​for different time points. In the MLP network, the input layer and the hidden layer form the first fully connected layer, and the hidden layer and the output layer form the second fully connected layer. Taking the t-th time point as an example, the generation process of its private variance in the trainable Gaussian distribution is as follows:

[0024] First, the initial neighbor similarity of length T is... The features are obtained by inputting into the first fully connected layer:

[0025] F t =ReLU(s) t ×W1) (5)

[0026] Among them, F t For the generated features, Let be the initial similarity between timestamp t and the other T timestamps. These are the training parameters for the first fully connected layer, and ReLU is the activation function.

[0027] Secondly, the extracted features F t The private variance in a trainable Gaussian distribution of timestamp t is passed into a second fully connected layer:

[0028] σ t =F t ×W2 (6)

[0029] Where, σ t The variance of the trainable Gaussian distribution for the generated timestamp t. Indicates the training parameters of the second fully connected layer

[0030] Preferably, in step S3, the process of generating the fitting similarity between local and global neighbors for each timestamp is as follows:

[0031] S3-1, generating a to-be-fitted local neighbor, time stamps in the range of [t-LN / 2, t+LN / 2] centered at time stamp t are selected as the to-be-fitted local neighbor of time stamp t;

[0032] S3-2, generating a to-be-fitted candidate global neighbor, time stamps in the range of [t-GN / 2, t+GN / 2] centered at time stamp t are selected as the to-be-fitted candidate global neighbor of time stamp t, wherein LN<GN;

[0033] S3-3, generating a to-be-fitted global neighbor, the remaining time stamps in the to-be-fitted candidate global neighbor sequence except the to-be-fitted local neighbor are identified as the to-be-fitted global neighbor of time stamp t, the range is [t-GN / 2, t-LN / 2] and [t+LN / 2, t+GN / 2], and the length is (GN-LN);

[0034] S3-4, generating a similarity of the to-be-fitted local and global neighbors, based on the coordinates of the fitted local and global neighbors, the initial similarity corresponding to the coordinates is extracted from the initial similarity of time stamp t , and normalized processing is performed:

[0035]

[0036] wherein, s it represents the initial similarity between time stamp i and t, wherein the range of i is [t-GN / 2, t+GN / 2], represents the normalized to-be-fitted similarity.

[0037] Preferably, in the step S4, the adversarial learning process of the trainable Gaussian distribution of the tth time stamp is specifically:

[0038] S4-1, similarity fitting learning of the local neighbor

[0039] The variance σ t is trained so that the Gaussian distribution of time stamp t can only fit the normalized to-be-fitted similarity of each local neighbor, and the formula is as follows:

[0040]

[0041] wherein, LN represents the number of local neighbors, g t (i) the predicted similarity of the ith neighbor in the Gaussian distribution of the tth time stamp, is the to-be-fitted similarity between time stamp t and time stamp i, and L1 is the local neighbor similarity fitting loss function;

[0042] S4-2, local neighbor similarity area maximization learning

[0043] The variance σt such that the area of local neighbors in the Gaussian distribution of timestamp t is maximized, close to the total area 1, as follows:

[0044] L2 = [1 - (Area(t + LN / 2) - Area(t - LN / 2))] (10) 2 (9)

[0045] where Area(x) represents the area of the Gaussian distribution in the interval [-∞, x], and L2 is the loss function of local neighbor area maximization;

[0046] S4-3, similarity fitting learning of global neighbors

[0047] Training variance σ t such that the Gaussian distribution of timestamp t can only fit the normalized similarity of each global neighbor to be fitted, as follows:

[0048]

[0049] where (GN-LN) represents the number of global neighbors, g t (i) and g t (j) the predicted similarity of the i-th neighbor and the j-th neighbor in the Gaussian distribution of the t-th timestamp, and is the similarity to be fitted between timestamps t, i and j, and L3 is the loss function of global neighbor similarity fitting;

[0050] S4-4, global neighbor similarity area maximization learning

[0051] Training variance σ t such that the area of global neighbors in the Gaussian distribution of timestamp t is maximized, close to the total area 1, as follows:

[0052] L4 = 1 - 2 x Area(t - LN / 2) (11)

[0053] where Area(x) represents the area of the Gaussian distribution in the interval [-∞, x], and L4 is the loss function of global neighbor area maximization;

[0054] S4-5, adversarial learning

[0055] Local similarity learning and global similarity learning constitute two opposing competitors, and adversarial learning is used to amplify the difference between local similarity and global similarity. The loss function of adversarial learning is:

[0056] Loss = L1 + L2 + L3 + L4 (12).

[0057] Preferably, in the step S5, the scoring process of the to-be-tested timestamp t is: first, using the third-party security interface to obtain the initial similarity of all neighbors of the to-be-tested timestamp t; second, inputting the initial similarity into the shared trained two-layer MLP variance generator to generate the variance σ of the timestamp t t , and constructing the private Gaussian distribution of the timestamp t; then, generating the global neighbors and local neighbors of the timestamp t according to the sampling strategy, and generating the normalized to-be-fitted global neighbor similarity and local neighbor similarity according to the initial similarity; next, taking the local neighbor similarity fitting loss value as the local similarity of the timestamp t, and taking the global neighbor similarity fitting loss value as the global similarity of the timestamp t; further, taking the difference between the global neighbor similarity and the local neighbor similarity as the anomaly score of the timestamp t, which is:

[0058] Score t =|L1-L3| (13)

[0059] Wherein, |·| is an absolute value function;

[0060] Finally, it is judged whether the timestamp t is abnormal or not, and the judgment formula is:

[0061]

[0062] Wherein, represents the abnormality judgment result, and alpha is a preset threshold value, which is in the range of 0 to 1; if the tth timestamp is determined as an abnormal point; otherwise, the tth timestamp is regarded as normal.

[0063] The edge device-oriented unsupervised industrial time series data fast anomaly detection method provided by the application has the following advantages compared with the prior art:

[0064] (1) The edge device-oriented unsupervised industrial time series data fast anomaly detection method of the application is an industrial time series anomaly fast detection method designed for resource-limited Internet of Things edge devices, having data implicit protection function and based on learnable Gaussian distribution. The method uses the difference between the global neighbor similarity and the local neighbor similarity, adopts a micro learning structure and a specific adversarial learning mechanism to realize high-speed, high-precision and low-resource consumption timestamp-level anomaly detection.

[0065] (2) The edge device-oriented unsupervised industrial time series data fast anomaly detection method of the application directly uses data similarity instead of original multi-sensor time series privacy data as initial input, thereby protecting data privacy and facilitating flexible docking with other models or third-party interfaces. DETAILED DESCRIPTION

[0066] Figure 1is a theoretical schematic diagram of the timestamp-level temporal anomaly detection of the present application.

[0067] Figure 2 is an overview of the proposed method of the present application.

[0068] Figure 3 is a schematic diagram of the global and local sampling process of the present application.

[0069] Figure 4 is the visualization result of anomaly detection on 60500 to 63500 timestamps in the 1st variable of the MSL dataset in the experimental verification.

[0070] Figure 5(a) is the deployment result on the industrial Internet of Things edge device Raspberry Pi 4b.

[0071] Figure 5(b) is the deployment result on the industrial Internet of Things edge device Jetson Xavier NX.

[0072] Figure 6 is the result graph of two ablation experiments in the experimental verification of the present application. DETAILED DESCRIPTION

[0073] The specific embodiments of the present application are described in detail below. It should be understood that the specific embodiments described herein are only for illustration and explanation of the present application, and are not intended to limit the present application.

[0074] The edge device-oriented unsupervised industrial time series data fast anomaly detection method of the present application designs an industrial Internet of Things time series data fast anomaly detection method suitable for resource-constrained edge devices. This method uses a lightweight structure to ensure data privacy while having high precision, high speed and low resource consumption. In order to achieve these goals, two key bottlenecks must be addressed.

[0075] The first bottleneck is how to build a lightweight model with high precision, high speed and low resource consumption. Under normal circumstances, industrial time series anomaly events occur less frequently, last for multiple time stamps each time, and are significantly different from normal states, as shown in (a) of Figure 1 This indicates that an abnormal timestamp is usually only highly similar to other adjacent timestamps (local neighbors) within the same anomaly, and has a lower similarity with distant timestamps (global neighbors, most of which are normal timestamps). On the contrary, because of the periodicity or seasonality of the production process, a normal timestamp is similar not only to its local neighbors, but also to global neighbors. Therefore, the difference in similarity between local neighbors and global neighbors is a method for identifying abnormal timestamps from normal timestamps, as shown in Figure 1Based on this idea, a tiny trainable Gaussian distribution with only one parameter is set for each timestamp to model its local and global neighbor similarities. Then, a global and local adversarial learning mechanism is designed to amplify the difference between the local and global similarities of each timestamp. In this scheme, the tiny trainable Gaussian distribution provides high speed and low resource consumption of the model, and the adversarial learning mechanism guarantees high precision of the model.

[0076] The second bottleneck is how to achieve privacy protection of multi-sensor time series data without increasing additional overhead. To solve this bottleneck, the most direct solution is to use the similarity of data as the initial input of the model instead of the original private data, thereby achieving data privacy protection. In this scheme, the initial data similarity can be directly called from a third-party secure interface or flexibly obtained by interfacing with other similarity calculation models. In addition, in the process of converting the original multi-sensor private data into non-private data similarity, the coupling relationship between the multi-sensors can be further captured.

[0077] The edge device-oriented unsupervised industrial time series data fast anomaly detection method of the application first uses data similarity to replace the original industrial time series private sensor data as the input of the model, thereby achieving data privacy protection. Secondly, a trainable Gaussian distribution with only one parameter is set for each timestamp to replace the traditional deep neural network for modeling the potential similarity of each timestamp and its neighbor, thereby achieving high speed and low consumption. Then, a global and local adversarial learning strategy is designed to amplify the difference between the global and local similarities of each timestamp. Finally, the difference between the global and local similarities is used as an indicator to determine whether each timestamp is abnormal. Specifically, it includes the following steps:

[0078] Step S1, model parameter setting

[0079] Suppose that a dynamic production system is observed using M sensors at T timestamps, and the collected data forms a multi-sensor time series data, which contains time dimension and variable (sensor) dimension. In the time dimension, the multi-sensor time series data can be represented as: where x t represents the observation value of the M sensor variables at the t-th timestamp. In the variable dimension, the multi-sensor time series data can be represented as: where x m represents the observation value of the m-th sensor at all T timestamps.

[0080] The edge device-oriented unsupervised industrial time series data rapid anomaly detection method of the application first trains an anomaly detection model using unlabeled duration multi-sensor time series data, and then uses the trained model to generate an anomaly score for each time stamp to be detected.

[0081] Score t =PPLAD(x t ) (1)

[0082] wherein, represents the observation value of the M variables at the tth time stamp. Finally, this anomaly score will be used as an indicator to determine whether the tth time stamp is abnormal.

[0083]

[0084] wherein, a is a preset threshold, and the value range is 0 to 1. If , the tth time stamp is determined to be an abnormal point; otherwise, the tth time stamp is regarded as normal.

[0085] Step S2, model framework setting

[0086] The edge device-oriented unsupervised industrial time series data rapid anomaly detection method of the application constructs a rapid detection model called PPLAD, and the overall framework of the model is as shown in Figure 2 , which includes three parts:

[0087] (1) Initial similarity calculation component: this component generates the local neighbor similarity and global neighbor similarity of each time stamp by calling a third-party security interface or connecting with a third-party similarity calculation model, and serves as the input of the rapid detection method.

[0088] (2) Adversarial learning component based on trainable Gaussian distribution: in this component, a trainable Gaussian distribution containing only one parameter is constructed for each time stamp, which is used to model the global neighbor similarity and local neighbor similarity of each time stamp based on the initial similarity. At the same time, a global and local adversarial learning mechanism is designed to put the difference between the global neighbor similarity and the local neighbor similarity, so as to improve the accuracy of anomaly detection.

[0089] (3) Abnormal score component: this component uses the difference between the global neighbor similarity and the local neighbor similarity to calculate the anomaly score of each time stamp, and uses it to judge whether the time stamp is an abnormal point.

[0090] Step S3, initial similarity calculation

[0091] The similarity of the original privacy data obtained from a third-party security interface or a third-party similarity calculation model is used as an initial input of the method of the embodiment to achieve privacy protection of the data. The third-party security interface can be located on an edge device or in the cloud. In this way, the originally private data becomes a non-private data similarity. In this way, not only is the private data protected on the insecure edge device, but the multivariate correlation between the original data is also captured.

[0092] To provide a reference scheme for the third-party security interface, the embodiment designs a similarity calculation strategy. The detailed calculation process is as follows: first, M variables of each timestamp are extracted from the original privacy data to form a data vector Second, a similarity calculation method is used, including one of a distance-based mean square error MSE similarity, a probability distribution-based Kullback-Leibler divergence similarity, and a vector-based cosine Cosine similarity, to calculate the similarity between the data vectors of any two timestamps. Finally, the original privacy data is converted into a similarity matrix wherein represents the similarity between the timestamp t and the T neighbors.

[0093] Step S4, a trainable Gaussian distribution is constructed for each timestamp

[0094] Generally, the frequency of industrial time series abnormal events is low, each occurrence lasts for multiple timestamps, and there is a significant difference from the normal state, as shown in (a) of Figure 1 . This indicates that an abnormal timestamp usually has a high similarity only with other neighboring timestamps (local neighbors) within the same anomaly, and a low similarity with distant timestamps (global neighbors, usually also referred to as normal timestamps). On the contrary, because of the periodicity or seasonality of the production process, a normal timestamp is similar not only to its local neighbors, but also to global neighbors. Therefore, the difference between the local neighbor similarity and the global neighbor similarity is an effective method for identifying abnormal timestamps from normal timestamps, as shown in (b) of Figure 1 . Based on this method, the embodiment sets a trainable Gaussian distribution containing only one parameter for each timestamp to model the global similarity and the local similarity of the timestamp based on the initial similarity, as shown in (b) of Figure 2 . In addition, the embodiment also designs a customized global-local adversarial learning mechanism to further amplify the difference between the global neighbor similarity and the local neighbor similarity. Taking the tth timestamp as an example, the adversarial learning process based on the trainable Gaussian distribution is as follows:

[0095] S4-1, global and local neighbor sampling

[0096] The global and local neighbor sampling process for each timestamp is shown in Figure 3 For a timestamp t, the timestamps in the range [t-LN / 2, t+LN / 2] are selected as the local neighbors of t, LN is a preset shaping hyper-parameter representing the length of the local neighbors. Meanwhile, the timestamps in the range [t-GN / 2, t-LN / 2] and [t+LN / 2, t+GN / 2] are selected as the global neighbors of t, GN is another preset shaping hyper-parameter, (GN-LN) represents the length of the global neighbors. Based on the coordinates of the local neighbors and the global neighbors, the initial similarity of the corresponding coordinates from the initial similarity of the timestamp t is extracted and normalized:

[0097]

[0098] where s it represents the initial similarity between timestamps i and t, represents the normalized similarity.

[0099] S4-2, trainable Gaussian distribution

[0100] A private Gaussian distribution containing only one trainable parameter is constructed for timestamp t, expressed as follows:

[0101]

[0102] where x represents the coordinates of the neighbor timestamps, σ t represents the variance of the Gaussian distribution, which is a trainable parameter.

[0103] Each timestamp has its own Gaussian distribution, and the Gaussian distributions of two timestamps are not the same. In order to make σ t derivable, a shared two-layer MLP network is used as a variance generator. The MLP network includes an input layer with T neurons to receive the initial similarity of all neighbors of each timestamp, a hidden layer with d neurons and ReLU activation function, and an output layer with 1 neuron to generate private variance values for different timestamps. In this MLP network, the input layer and the hidden layer form the first fully connected layer, and the hidden layer and the output layer form the second fully connected layer. Taking the tth timestamp as an example, the generation process of the private variance in the trainable Gaussian distribution is described as follows:

[0104] First, the initial neighbor similarity of length T is input into the first fully connected layer to obtain the features:

[0105] Ft = ReLU(s t x W1) (5)

[0106] where F t is the generated feature, is the initial similarity of the timestamp t with other T timestamps, is the training parameter of the first fully connected layer, and ReLU is the activation function.

[0107] Secondly, the extracted feature F t is input into the second fully connected layer to generate the private variance of the trainable Gaussian distribution of the timestamp t:

[0108] σ t = F t x W2 (6)

[0109] where σ t is the variance of the generated trainable Gaussian distribution of the timestamp t, denotes the training parameter of the second fully connected layer.

[0110] Step S5, generate the local neighbor and global neighbor fitting similarity of each timestamp

[0111] S5-1, generate the to-be-fitted local neighbor, select the timestamps within the range [t-LN / 2, t+LN / 2] centered on the timestamp t as the to-be-fitted local neighbor of the timestamp t;

[0112] S5-2, generate the to-be-fitted candidate global neighbor, select the timestamps within the range [t-GN / 2, t+GN / 2] centered on the timestamp t as the to-be-fitted candidate global neighbor of the timestamp t, where LN<GN;

[0113] S5-3, generate the to-be-fitted global neighbor, identify the remaining timestamps in the to-be-fitted candidate global neighbor sequence except the to-be-fitted local neighbor as the to-be-fitted global neighbor of the timestamp t, which ranges from [t-GN / 2, t-LN / 2] and [t+LN / 2, t+GN / 2] and has a length of (GN-LN);

[0114] S5-4, generate the similarity of the to-be-fitted local and global neighbors, based on the coordinates of the fitted local and global neighbors, extract the initial similarity corresponding to the coordinates from the initial similarity of the timestamp t:

[0115]

[0116] where s it denotes the initial similarity between the timestamps i and t, where i ranges from [t-GN / 2, t+GN / 2], denotes the normalized to-be-fitted similarity of the t-th time stamp.

[0117] Step S6, global and local adversarial learning

[0118] The adversarial learning process of the trainable Gaussian distribution of the t-th time stamp is specifically:

[0119] S6-1, similarity fitting learning of local neighbors

[0120] Training variance σ t So that the Gaussian distribution of the t-th time stamp can only perfectly fit the normalized to-be-fitted similarity of each local neighbor, the formula is as follows:

[0121]

[0122] Where LN denotes the number of local neighbors, g t (i) the predicted similarity of the i-th neighbor in the Gaussian distribution of the t-th time stamp, is the to-be-fitted similarity between the t-th time stamp and the i-th time stamp, and L1 is the local neighbor similarity fitting loss function;

[0123] S6-2, local neighbor similarity area maximization learning

[0124] Training variance σ t So that the area occupied by the local neighbors in the Gaussian distribution of the t-th time stamp is maximized, close to the total area 1, the formula is as follows:

[0125] L2 = [1-(Area(t+LN / 2)-Area(t-LN / 2))] 2 (9)

[0126] Where Area(x) denotes the area of the Gaussian distribution in the interval [-∞, x], and L2 is the local neighbor area maximization loss function;

[0127] S6-3, similarity fitting learning of global neighbors

[0128] Training variance σ t So that the Gaussian distribution of the t-th time stamp can only perfectly fit the normalized to-be-fitted similarity of each global neighbor, the formula is as follows:

[0129]

[0130] Where (GN-LN) denotes the number of global neighbors, g t (i) and g t (j) the predicted similarity of the i-th neighbor and the j-th neighbor in the Gaussian distribution of the t-th time stamp, and L3 is a global neighbor similarity fitting loss function for the similarity to be fitted between the timestamp t and the timestamps i and j;

[0131] S6-4, global neighbor similarity area maximization learning

[0132] Training variance σ t So that the area of the global neighbor in the Gaussian distribution of the timestamp t is maximized, close to the total area 1, the formula is as follows:

[0133] L4 = 1-2 x Area (t-LN / 2) (11)

[0134] Wherein, Area (x) represents the area of the Gaussian distribution in the interval [-∞, x], and L4 is a global neighbor area maximization loss function;

[0135] S6-5, adversarial learning

[0136] The local similarity learning with the goal of “only fitting local similarity + only maximizing local similarity area” and the global similarity learning with the goal of “only fitting global similarity + only maximizing global similarity area” constitute two opposing competitors, and the difference between the local similarity and the global similarity is amplified by using adversarial learning, and the loss function of the adversarial learning is:

[0137] Loss = L1 + L2 + L3 + L4 (12)

[0138] Step S7, generating an anomaly score for each timestamp

[0139] After the learnable Gaussian distribution is trained, the method of the present application can perform anomaly scoring on the timestamps to be tested. Taking the timestamp t to be tested as an example, the scoring process is as follows. First, the initial similarity of all neighbors of the timestamp t to be tested is obtained by using a third-party security interface; second, the initial similarity is input into the shared trained two-layer MLP variance generator to generate the variance σ t of the timestamp t, and a private Gaussian distribution of the timestamp t is constructed; then, the global neighbors and the local neighbors of the timestamp t are generated according to the sampling strategy, and the normalized global neighbor similarity to be fitted and the local neighbor similarity to be fitted are generated according to the initial similarity; then, the local neighbor similarity fitting loss value is taken as the local similarity of the timestamp t, and the global neighbor similarity fitting loss value is taken as the global similarity of the timestamp t; further, the difference between the global neighbor similarity and the local neighbor similarity is taken as the anomaly score of the timestamp t, which is:

[0140] Score t = |L1-L3| (13)

[0141] where | · | is the absolute value function. Finally, we use formula (2) to determine whether the timestamp t is abnormal.

[0142] Experimental verification

[0143] I. Set the experimental goal

[0144] There are four main goals:

[0145] Goal 1 (Accuracy): Can the detection accuracy of the method of the present application on multi-sensor time series data (multivariate time series data) exceed that of the comparative algorithm?

[0146] Goal 2 (Deployability): Can the method of the present application be easily deployed on resource-constrained industrial Internet of Things edge devices?

[0147] Goal 3 (Timeliness and resource consumption): How does the method of the present application perform in terms of timeliness and resource consumption on industrial Internet of Things edge devices?

[0148] Goal 4 (Ablation experiment): Does each innovative part of the method of the present application contribute to the overall performance?

[0149] II. Data sets

[0150] Eight publicly available real-world industrial multi-sensor time series data sets were selected for the experiment, as shown in Table 1. These data sets cover water treatment, aviation, aerospace, intelligent manufacturing, e-commerce and other fields, ensuring the fairness and impartiality of the experiment. Specifically, the HAI data set: multiple industrial signals from pumps, valves, pressure sensors and other common industrial devices. The MSL data set: operational status data from multiple sensors and controllers on a Mars rover. The PSM data set: 25-dimensional monitoring information from an eBay server. PUMP: monitoring data from multiple sensors on a water pump. The SKAB data set: multi-sensor time series signals obtained from an industrial test bench. The SMAP data set: moisture level signals recorded by NASA's SMAP satellite at different soil depths. The SWaT data set: 51-dimensional data collected by multiple sensors from a public water treatment facility. The WaDi data set: 127-dimensional monitoring data from an industrial control system.

[0151] Table 1 Real-world industrial time series data sets

[0152] Dataset Feature Train Set Test Set HAI 86 280800 54000 MSL 55 58317 73729 PSM 25 132481 87841 SKAB 8 12450 5710 SMAP 25 135183 427617 PUMP 51 132192 88128 SWaT 51 495000 449919 WaDi 127 103680 69121

[0153] III. Comparative algorithm, evaluation index, deployment environment

[0154] Comparison algorithms: Seven representative advanced algorithms in the past two years were selected as the comparison algorithms of our PPLAD method, as shown in the table. Among all the comparison algorithms, PatchAD, NPSR, DTAAD, DIF and DCdetector are deep models with more parameters, while PPLAD, COUTA and Optiforest are lightweight models with fewer parameters.

[0155] Table 2 Comparison algorithms

[0156]

[0157] (1) Evaluation indicators: In order to conduct a comprehensive evaluation, four widely used evaluation indicators are adopted: accuracy (ACC), precision (Precision), recall (Recall) and F1-Score (F1). Among them, ACC: measures the proportion of correctly predicted samples in the total number of samples. Precision: represents the proportion of actual normal timestamps among all timestamps predicted as normal. Recall: reflects the proportion of correctly detected actual normal timestamps. F1: by combining precision and recall, it provides a more balanced performance evaluation. Generally, the value range of the four evaluation indicators is 0 to 1, and the larger the value, the more accurate the anomaly detection, and the better the performance of the algorithm.

[0158] (2) Deployment environment: This experiment is performed on a PC server equipped with Windows 11 system, with Intel(R) Core(TM) i7-10700KF CPU, NVIDIA GeForce RTX 3090 GPU (24GB video memory) and 64GB memory. In addition, the deployment experiment is carried out on two resource-limited Internet of Things edge devices: a micro RaspberryPi 4b and a thin NVIDIA Jetson Xavier NX. The method of the present invention is developed using Python language, and the integrated development environment is PyCharm. Other algorithms are Python codes downloaded from the official website provided by the corresponding authors, and the parameters used are also the best parameters provided by the authors.

[0159] Four, accuracy experiment

[0160] In order to verify target 1, the method of the present invention is compared with seven benchmark algorithms on eight multi-sensor data sets.

[0161] (1) Accuracy: Table 3 lists the detection accuracy of the eight algorithms on the eight data sets. The bold values in the table represent the best value of different algorithms in the same data set in this indicator, and the underlined values represent the second best value. From the table, the following observations can be made:

[0162] Table 3 Accuracy experiments

[0163]

[0164] ① Overall performance: PPLAD performs the best, followed by DCdetector, COUTA, PatchAD, DIF and DTAAD, and Optiforest and NPSR perform the worst. For example, PPLAD achieves a Precision of 0.9805 on the PUMP dataset, while COUTA only achieves a Precision of 0.7572, PatchAD achieves a Precision of 0.931, and Optiforest only achieves a Precision of 0.2124.

[0165] ② Stability: PPLAD performs the best in all four evaluation metrics on the eight datasets, followed by DCdetector and DIF. In particular, PPLAD ranks first or second on all datasets and metrics.

[0166] ③ Comparison between deep and shallow models: Deep neural network-based algorithms (e.g., DIF, DCdetector, DTAAD, PatchAD) generally outperform shallow algorithms (e.g., Optiforest, COUTA), but the shallow PPLAD algorithm of the present application outperforms multiple deep algorithms. For example, in the MSL dataset, PPLAD achieves an ACC of 0.9919 and a Recall of 0.9885, while DTAAD achieves an ACC of 0.9242 and a Recall of 0.3754, and DCdetector achieves an ACC of 0.9883 and a Recall of 0.9703.

[0167] (2) Visualization: The anomaly detection results of the eight algorithms on the MSL dataset for time stamps between 60500 and 63500 in the first variable are visualized as shown in Figure 4 In the figure, the black curve represents the true data value, the red curve represents the anomaly label, the peak represents the anomaly point, and the valley represents the normal point. In all the visualization figures, Ground-Truth represents the true data and the true label, and the other eight visualization figures are the detection results of the eight algorithms. From Figure 4 , two findings can be made.

[0168] ① Accuracy: The detection accuracy of PPLAD, COUTA and DCdetector algorithms is significantly higher than that of other comparative algorithms. For example, during the time stamps 62300 to 62600, the detection results of PPLAD, COUTA and DCdetector are consistent with the true label, and the errors of other comparative algorithms are relatively large.

[0169] ② False positive rate: The false positive rates of PPLAD, COUTA and DCdetector are significantly lower than those of other algorithms. For example, in the time stamps from 60500 to 63500, many normal time stamps are misreported as abnormal time stamps by eight algorithms, and the false positive time stamps of PPLAD, COUTA and DCdetector are the least.

[0170] Conclusion: The experimental results show that the application has excellent accuracy and stability in anomaly detection of industrial multi-sensor time series data sets.

[0171] V. Deployment experiment

[0172] In order to verify target 2, deployment experiments are carried out on two kinds of Internet of Things edge devices: resource-poor micro Raspberry Pi 4b and resource-general thin Jetson Xavier NX. Specifically, Raspberry Pi 4b is equipped with a 1.5GHz ARM Cortex-A72 processor and 2GB of memory, while Jetson Xavier NX is equipped with a 6-core Carmel ARMv8.2 processor and 8GB of memory. In the experiment, all deep neural network-based algorithms are first trained in the cloud and then deployed on the edge device for testing, while the shallow algorithm is directly trained and deployed on the edge device.

[0173] The deployment test results of the eight algorithms on the two edge devices are shown in Figure 5, Figure 5(a) is the deployment result on Raspberry Pi 4b, and Figure 5(b) is the deployment result on Jetson Xavier NX.

[0174] From Figure 5, two conclusions can be drawn:

[0175] ① Deployability: Except for PatchAD, which consumes more storage than the device limit, all algorithms are successfully deployed on the edge device. Compared with the deployment process of all algorithms, the deployment of lightweight algorithms (PPLAD, Optiforest, DIF) is relatively easy.

[0176] ② Maintainability: In the industrial Internet of Things environment, frequent changes in production processes can cause dynamic fluctuations in time series signals. Therefore, it is necessary to update the algorithm or model regularly to maintain its optimal performance. For deep neural network-based algorithms, the update process usually requires fine-tuning the model on the cloud using new data samples before redeploying the algorithm to the edge device; for lightweight algorithms, the update process can be directly performed on the edge device. In addition, lightweight algorithms require fewer retraining samples, consume less storage space, and have less communication overhead.

[0177] Summary: The shallow lightweight algorithm of the present application is more easily deployed on resource-constrained industrial Internet of Things edge devices than deep algorithms.

[0178] Six, timeliness and resource consumption experiment

[0179] In order to verify target 3, the processing time and resource consumption of eight models on the MSL dataset were evaluated under three deployment environments: resource powerful PC (thick edge), resource general Jetson XavierNX (thin edge), and resource very little Raspberry Pi 4b (micro edge).

[0180] The table lists the timeliness and resource consumption of the eight algorithms, where "Ot" represents insufficient memory, and "-" represents no available data. From the table, several conclusions can be drawn.

[0181] ① Model parameter quantity: PPLAD has only 12.0K parameters, far less than other comparative algorithms such as COUTA (376.1K), PatchAD (2072.9K), and DCdetector (826.5K).

[0182] ② Real-time performance: Taking a training epoch with a batch_size of 128 as an example, PPLAD only takes 10.3 seconds, while PatchAD takes 229.9 seconds, DCdetector takes 128.1 seconds, and COUTA takes 26.5 seconds. Similarly, in terms of completing all test timestamps, PPLAD takes only 0.9 seconds, which is much better than other algorithms such as PatchAD (154.5 seconds), COUTA (3.7 seconds), and DCdetector (2.9 seconds).

[0183] ③ Computing consumption: The CPU and GPU usage of shallow algorithms is much lower than that of deep algorithms. For example, on Raspberry Pi4b, the CPU usage of shallow algorithm PPLAD is 25.5%, while the CPU usage of deep algorithm DCdetector is 57.4%, and the CPU usage of deep algorithm NPSR is 63.2%.

[0184] ④ Storage consumption: Deep algorithms consume significantly more storage resources than shallow algorithms. For example, on Jetson Xavier NX with only 8G memory, the memory usage of deep algorithm DIF is 3.1GB, the memory usage of deep algorithm DCdetector is 3.7GB, while the memory usage of shallow PPLAD of the present application is only 1.1GB, and the memory usage of shallow Optiforest is only 0.8GB.

[0185] Summary: PPLAD exhibits good timeliness and low resource consumption, and is very suitable for deployment on resource-limited industrial Internet of Things edge devices.

[0186] Table 4 Processing time and resource consumption

[0187]

[0188] Seven, ablation experiment

[0189] In order to verify target 4, two groups of ablation experiments are carried out to evaluate the two key components of the PPLAD algorithm. These experiments are carried out on four multi-sensor datasets (HAI, PUMP, SMAP and SWaT), and three evaluation indicators (ACC, Recall and F1) are used for performance evaluation.

[0190] (1) Input similarity calculation: The first key component is to use data similarity to replace the original private data, so as to realize data privacy protection. Therefore, this experiment aims to verify the influence of different initial similarity calculation methods on the performance of the algorithm. Specifically, four comparison models are designed: similarity based on MSE distance, vector similarity based on Cosine, probability distribution similarity based on KL, and attention correlation similarity based on the third-party DCdetector model.

[0191] Figure 6 Figure (a) in the figure shows the detection performance of the four models on the four datasets. From the figure, two conclusions can be drawn.

[0192] ① Overall performance: The performance of the four models on the four datasets is very close, which shows that the PPLAD algorithm of the present application has strong robustness to different initial similarity calculation methods. For example, on the SMAP dataset, the ACC score of the model based on MSE is 0.9909, while the model based on Cosine is 0.9901, the model based on KL is 0.9903, and the model based on attention is 0.9892.

[0193] ② Flexibility: The PPLAD algorithm of the present application has the advantage of seamlessly integrating with third-party models and optimizing the anomaly detection performance of third-party models. For example, in the attention-based model, the trained DCdetector model is used to calculate the initial neighbor similarity of each timestamp. Then, the PPLAD model optimizes these similarities and uses the optimized similarities for anomaly detection, which will get better detection results. Specifically, on the SMAP dataset, the ACC score of the attention-based PPLAD model is 0.9892, while the ACC score of the DCdetector model is 0.9843.

[0194] (2) Global-local adversarial learning: The second key component is the global-local adversarial learning mechanism, which aims to amplify the difference between local similarity and global similarity. In this adversarial learning mechanism, there are two adversarial parts: global and local similarity adversarial learning and global and local area adversarial learning. Therefore, this experiment aims to verify the impact of these two adversarial parts on the performance of the model. Specifically, three comparative models are designed: only using similarity adversarial learning (model 1), only using area adversarial learning (model 2), and using both similarity and area adversarial learning (model 3). Figure 6 Figure (b) in the figure shows the detection accuracy of the three models. From Figure 6 Figure (b) in the figure shows the detection accuracy of the three models. From

[0195] ① Overall performance: Model 3 based on similarity and area adversarial learning performs better on all three indicators and four datasets, as shown by the highest column in the figure.

[0196] ② Compare model 1 and model 2: These two models have their advantages and disadvantages, which shows that similarity-based adversarial learning and area-based adversarial learning both have positive effects. For example, in the SWaT dataset, model 1 performs better in ACC, Recall, and F1 indicators. While in the SMAP dataset, model 2 performs better in ACC, Recall, and F1 indicators.

[0197] Summary: The joint adversarial learning of similarity and area can achieve the best anomaly detection effect.

[0198] The results of a large number of experiments on eight public industrial multi-sensor time series datasets and three edge devices (resource-rich thick PC, resource-ordinary thin Jetson Xavier NX, and resource-scarce micro Raspberry Pi 4b) show that the performance of the method designed by the invention is better than that of many latest models. Especially in terms of detection time and model parameters, it is only one-tenth of other comparative models.

[0199] The above implementation cases are only preferred embodiments of the present application, and do not limit the present application in any form. Although the present application has been disclosed as above with preferred embodiments, it is not intended to limit the present application. Therefore, any simple modification, equivalent change and modification made to the above embodiments without departing from the technical solution of the present application, according to the technical essence of the present application, shall fall within the scope of protection of the technical solution of the present application.

Claims

1. An edge device-oriented unsupervised industrial time series data fast anomaly detection method, characterized in that, The detection method comprises the following steps: firstly, using data similarity to replace industrial sensor time series data as the input of the method, so as to get rid of the dependence on private data and achieve the purpose of data privacy protection; secondly, setting a trainable Gaussian distribution with only one parameter for each timestamp to model the potential similarity of each timestamp and its neighbors, so as to make the structure lightweight; thirdly, designing a global and local adversarial learning strategy to amplify the difference between the global similarity and the local similarity of each timestamp; and finally, using the difference between the global similarity and the local similarity as an index to determine whether each timestamp is abnormal. The detection method specifically comprises the following steps: In step S1, the initial similarity is calculated as the input, and the similarity of the original private data obtained from the third-party security interface or the third-party similarity calculation model is used as the initial input; In step S2, a trainable Gaussian distribution is constructed for each timestamp, and a two-layer MLP network is used as a generator to generate a private trainable variance Gaussian distribution for each timestamp by taking the initial neighbor similarity of each timestamp as the input; In step S3, the local neighbor and global neighbor fitting similarity are generated, the neighbor sampling is performed for each timestamp, the global neighbor and the local neighbor are generated, and the initial similarity is normalized according to the sampling neighbor coordinates to generate the fitting similarity of the global neighbor and the fitting similarity of the local neighbor; In step S4, global and local adversarial learning is performed, the local similarity learning and the global similarity learning are regarded as two competitors from the aspects of similarity fitting and area maximization, the adversarial learning is performed, and the parameters of the trainable Gaussian distribution of each timestamp are updated through the backpropagation to narrow the difference between the global and local similarity of the normal timestamp and amplify the difference between the global and local similarity of the abnormal timestamp; In step S5, the abnormal score of each timestamp is generated, the trained learnable Gaussian distribution model is used to perform abnormal scoring on each timestamp in the test set, and whether the current timestamp is abnormal is determined according to the abnormal score.

2. The edge device oriented unsupervised industrial time series data fast anomaly detection method according to claim 1, characterized in that, In the step S1, suppose that a dynamic production system is observed by using sensors at time stamps, and an industrial multi-sensor time series data including a time dimension and a variable dimension is generated ; in the time dimension, the multi-sensor time series data is: , wherein represents the observation value of the t th sensor variable at the th time stamp; In the variable dimension, the multi-sensor time series data is: wherein denotes the observation value of the i-th sensor for all m time stamps; and T denotes the number of time stamps. The initial similarity calculation is as follows: First, from the original privacy data... Extract each timestamp Several variables form a data vector. Secondly, a similarity calculation method is used to calculate the similarity between any two timestamp data vectors; finally, the original privacy data... Converted into a similarity matrix ,in Represents timestamp and Similarity between neighbors.

3. The edge device oriented unsupervised industrial time series data fast anomaly detection method according to claim 2, characterized in that, The step S2 is for any timestamp t Constructing a private Gaussian distribution process with only one trainable parameter is: (4) wherein, denotes the coordinates of the neighbor timestamps, represents the variance of the Gaussian distribution, which is a trainable parameter; Using a shared two-layer MLP network as the variance generator makes it derivable; the MLP network includes an input layer with T neurons for receiving initial similarities of all neighbors of each timestamp, a hidden layer with neurons and activated by a ReLU activation function, and an output layer with 1 neuron for generating private variance values of different timestamps; in the MLP network, the input layer and the hidden layer form a first fully connected layer, and the hidden layer and the output layer form a second fully connected layer; taking the first t timestamp as an example, the generation process of the private variance in the Gaussian distribution can be trained as follows: First, the initial neighbor similarity T with length is input to the first fully connected layer to get the features: (5) wherein, are generated features, is a timestamp t with other T initial similarities of timestamps, are training parameters of the first fully connected layer, and ReLU is an activation function. Second, the extracted features are passed into a second fully connected layer to generate a timestamp t Private variance in the trainable Gaussian distribution: (6) wherein, the variance of the trainable Gaussian distribution of the generated timestamp t the variance of the trainable Gaussian distribution of the generated timestamp denote the training parameters of the second fully connected layer.

4. The edge device oriented unsupervised industrial time series data fast anomaly detection method according to claim 2, characterized in that, In step S3, the process of generating the local neighbor and global neighbor fitting similarity of each timestamp is as follows: S3-1, to-be-fitted local neighbors generated, with timestamps t are selected as the to-be-fitted local neighbors of timestamp , where t is the number of local neighbors of timestamp t; and is the number of local neighbors of timestamp t; and S3-2, to-be-fitted candidate global neighbors generated, with timestamps t centered, range timestamps within the range are selected as timestamps t to-be-fitted candidate global neighbors of the timestamps, wherein denotes the total number of to-be-observed neighbors of timestamp t, ; S3-3, to-be-fitted global neighbor generation, identify the rest of the time stamp in the to-be-fitted candidate global neighbor sequence except the to-be-fitted local neighbor as a time stamp t to-be-fitted global neighbor, the range is and , the length is ; S3-4, generate the similarity of the local and global neighbors to be fitted, based on the coordinates of the fitted local and global neighbors, from the timestamps t of the initial similarity of the initial similarity corresponding to the coordinates, perform normalization processing: (7) wherein, represents the initial similarity between the timestamps i and t wherein i ranges from , represents the normalized similarity to be fitted.

5. The edge device oriented unsupervised industrial time series data fast anomaly detection method according to claim 2, characterized in that, In the step S4, the first t The adversarial learning process of the trainable Gaussian distribution of the first timestamp is specifically: S4-1, local neighbor similarity fitting learning Training variance such that the timestamp t of a Gaussian distribution can only fit the normalized similarity of each local neighbor, which is formulated as follows: (8) wherein, represents the number of local neighbors, the predicted similarity of the i th neighbor in a Gaussian distribution of the t th timestamp, is the similarity to be fitted between the t th timestamp and the i th timestamp, is the local neighbor similarity fitting loss function; S4-2, local neighbor similarity area maximization learning Training variance So that the area of the local neighbors in the Gaussian distribution of the timestamp t is maximized, close to the total area 1, as follows: (9) wherein, denotes the area of a Gaussian distribution within the interval , is a local neighborhood area maximization loss function; S4-3, global neighbor similarity fitting learning Training variance such that the timestamp t of a Gaussian distribution can only fit the normalized similarity of each global neighbor, which is formulated as follows: (10) wherein, GN - LN denotes the number of global neighbors of the timestamp t, and the predicted similarity of the t th neighbor in the Gaussian distribution of the i th neighbor and the j th neighbor at the th timestamp, and t the similarity to be fitted between the timestamp i and the timestamp j , is the global neighbor similarity fitting loss function; S4-4, global neighbor similarity area maximization learning Training variance such that the area of the global neighbors in the Gaussian distribution of timestamps t is maximized, close to the total area 1, as follows: (11) wherein, denotes the area of a Gaussian distribution within the interval , is a global neighbor area maximization loss function; S4-5, adversarial learning The local similarity learning and the global similarity learning constitute two opposing competitors, and the difference between the local similarity and the global similarity is amplified by using adversarial learning. The loss function of the adversarial learning is as follows: (12)。 6. The edge device-oriented unsupervised industrial time series data fast anomaly detection method according to claim 5, characterized in that, The scoring process of the to-be-tested timestamp t in step S5 is as follows: first, the initial similarity of all neighbors of the to-be-tested timestamp t is obtained by using the third-party security interface; second, the initial similarity is input into the shared trained two-layer MLP variance generator to generate the variance t of the timestamp , and a private Gaussian distribution of the timestamp t is constructed. Then, the time stamp is generated according to the sampling strategy t The global neighbor and the local neighbor are generated according to the initial similarity, and the normalized global neighbor similarity and the local neighbor similarity to be fitted are generated; then, the local neighbor similarity fitting loss value is taken as the local similarity of the time stamp t The global neighbor similarity fitting loss value is taken as the global similarity of the time stamp t The difference between the global neighbor similarity and the local neighbor similarity is taken as the abnormal score of the time stamp t, which is (13) wherein is an absolute value function; Finally, the time stamp is judged t whether it is abnormal, and the judging formula is: (2) in, This indicates the result of the anomaly assessment. The preset threshold value ranges from 0 to 1; if Then the first t The first timestamp is identified as an anomaly; otherwise, the second timestamp is identified as an anomaly. t Each timestamp is considered normal.

Images