Electronic equipment anomaly detection system and detection method

Abstract

The invention provides an electronic equipment anomaly detection system and method, and belongs to the technical field of electronic equipment, the electronic equipment anomaly detection system comprises a data acquisition module, a data preprocessing module, a feature extraction module, a threshold dynamic adjustment module, a model establishment module and an alarm module, the data acquisition module uses a sensor to acquire operation parameter data of electronic equipment in real time; the feature extraction module extracts key features from the preprocessed data by using a feature extraction algorithm; the threshold value dynamic adjustment module is used for adjusting the detection threshold value according to the running state of the equipment and the environment change, and the threshold value dynamic adjustment module comprises an association rule mining unit, a classification model construction unit and a D-AHP analysis unit; and the model building module is used for carrying out model training on normal behaviors and abnormal behaviors of the electronic equipment. The problems that the manual inspection efficiency of a traditional anomaly detection method is low, real-time monitoring of the equipment is difficult to realize, dynamic changes of the equipment are difficult to adapt, and false alarms and missing alarms are easy to generate are solved.

Description

Technical Field

[0001] The present invention belongs to the technical field of electronic equipment, and in particular, relates to an electronic equipment abnormality detection system and a detection method. Background Art

[0002] With the continuous development of electronic technology, electronic equipment is increasingly used in various fields. However, during long-term operation, electronic equipment will inevitably encounter various abnormalities, leading to equipment failure. In order to ensure the normal operation of electronic equipment and reduce the failure rate, it is necessary to monitor and detect abnormalities of electronic equipment in real time.

[0003] Traditional anomaly detection methods Traditional electronic equipment anomaly detection methods mainly include the following: a. Manual inspection: technicians regularly check the equipment. This method relies on the experience and intuition of technicians, is inefficient, and it is difficult to achieve real-time monitoring of the equipment. b. Fixed threshold alarm: By setting a fixed threshold on the key parameters of the equipment, an alarm is triggered when the parameter exceeds the threshold. This method is simple and easy to implement, but it is difficult to adapt to the dynamic changes of the equipment and is prone to false alarms and missed alarms. To this end, an electronic equipment anomaly detection system and detection method are designed. Summary of the invention

[0004] The embodiments of the present invention provide an electronic equipment anomaly detection system and detection method, which solve the problems of low efficiency of manual inspection of traditional anomaly detection methods, difficulty in achieving real-time monitoring of equipment, difficulty in adapting to dynamic changes of equipment, and easy generation of false alarms and missed alarms.

[0005] In view of the above problems, the technical solution proposed by the present invention is:

[0006] The present invention provides an electronic equipment anomaly detection system, comprising a data acquisition module, a data preprocessing module, a feature extraction module, a threshold dynamic adjustment module, a model building module and an alarm module;

[0007] The data acquisition module uses sensors to collect operating parameter data of electronic equipment in real time, including temperature, current and voltage, electromagnetic, vibration, sound and performance indicators;

[0008] The data preprocessing module is used to clean and format the collected data in preparation for feature extraction, and convert the collected device data into a format suitable for LDA2Vec processing;

[0009] The feature extraction module extracts key features from the preprocessed data using a feature extraction algorithm;

[0010] The threshold dynamic adjustment module is used to adjust the detection threshold according to the operating state of the device and environmental changes. The threshold dynamic adjustment module includes an association rule mining unit, a classification model building unit and a D-AHP analysis unit;

[0011] The association rule mining unit uses association rule mining technology to mine association rules in data for classification, and finds frequent data sets from normal and abnormal data;

[0012] The classification model building unit builds a classification model based on the association rules to distinguish between normal and abnormal behaviors;

[0013] The D-AHP analysis unit determines the weights of different decision criteria through the hierarchical analysis method to dynamically adjust the detection threshold, determine the decision criteria for threshold adjustment, and construct a hierarchical structure model to determine the weights of threshold adjustment;

[0014] The model building module is used to perform model training on normal behavior and abnormal behavior of the electronic device;

[0015] The alarm module is used to alarm the system and notify the operator when the model of the model building module detects an abnormality.

[0016] As a preferred technical solution of the present invention, the feature extraction module includes a Word2Vec training unit, an LDA model training unit and a feature merging unit;

[0017] The Word2Vec training unit uses the CBOW model to learn word vectors of electronic device parameters;

[0018] The LDA model training unit applies the topic distribution of the LDA model learning parameters based on Word2Vec;

[0019] The feature merging unit merges the word vector and topic distribution of each parameter based on the data of the Word2Vec training unit and the LDA model training unit to form a final feature vector.

[0020] As a preferred technical solution of the present invention, the detailed processing steps of the Word2Vec training unit are as follows:

[0021] Step a, collect text data of device parameters, remove irrelevant characters, convert text to lowercase or uppercase, split text into words or parameter names, extract all unique words from the cleaned data, build a vocabulary, and assign a unique index to each word;

[0022] Step b: CBOW model construction: input the index of the context word, map the index to a low-dimensional vector, use the softmax function to predict the central word, randomly initialize the word vector matrix and the weight of the softmax function to predict the central word.

[0023] Step c, using negative sampling to reduce the amount of calculation, select a certain number of negative samples, use the cross entropy loss function to measure the difference between the predicted value and the true value, use the probability distribution of the predicted center word and the true center word index to calculate the loss function, about the gradient of the model parameters, update the index of the upper and lower layers and the weight of the predicted center word;

[0024] Step d: Use the validation set to evaluate the model performance. After training, save the word vector matrix and model parameters.

[0025] Step e: Use the trained word vectors to perform tasks such as device parameter anomaly detection, cluster analysis, and text classification;

[0026] The detailed processing steps of the LDA model training unit are as follows:

[0027] Step 1, based on the data obtained by the Word2Vec training unit, convert the text data into a bag-of-words model representation;

[0028] Step 2: Maximize the probability of co-occurrence of context words and central words, maximize the probability of document-generated topics and topic-generated words, and use the word vector trained by Word2Vec as the initial word vector of the LDA model;

[0029] Step 3: For each word in each document, calculate the probability that the word belongs to each topic, update the word vector of Word2Vec and the document-topic distribution and topic-word distribution of LDA, use the posterior probability of LDA as the weight, update the word vector of Word2Vec, and use the updated word vector to recalculate the document-topic distribution and topic-word distribution.

[0030] As a preferred technical solution of the present invention, the model building module includes a model training layer and an abnormality judgment layer;

[0031] The model training layer uses the established behavior model of the electronic device to provide a data basis for abnormal judgment of the electronic device, and the model training layer includes a normal behavior model and an abnormal behavior model;

[0032] The abnormality judgment layer performs abnormality judgment on the behavior of the electronic device in real time based on the model data, and the abnormality judgment layer includes a real-time monitoring unit and an abnormality judgment unit.

[0033] As a preferred technical solution of the present invention, the steps of distinguishing normal and abnormal behavior data sets of the feature extraction module are as follows:

[0034] Use the LOF algorithm on the training set to determine a suitable neighborhood parameter k. For each data point in the training set, calculate its local reachable density. Calculate the LOF score of each data point based on the local reachable density. Set a threshold to distinguish normal and abnormal behaviors based on the distribution of the LOF score. Mark data points with LOF scores higher than the threshold as abnormal behaviors, and mark data points with LOF scores lower than or equal to the threshold as normal behaviors.

[0035] The normal behavior model is based on the normal behavior feature data set of the feature extraction module, the data set is divided into a training set and a test set, the training set is trained using a naive Bayes classifier, the model is evaluated through cross-validation, and the trained normal behavior model is applied;

[0036] The abnormal behavior model is based on the abnormal behavior data set of the feature extraction module or the same data set as the normal behavior model. The isolation forest model is trained using the entire data set, and appropriate hyperparameters are set. For each sample, the average path length in the isolation forest is calculated, and the model performance is evaluated using a test set with known labels. The trained isolation forest model is applied to actual use.

[0037] As a preferred technical solution of the present invention, the real-time monitoring unit is used to receive data from the data acquisition module in real time and display it graphically to provide a data basis for the abnormality judgment unit;

[0038] The abnormality judgment unit compares the real-time data received by the real-time monitoring unit with the normal behavior model and the abnormal behavior model of the model training layer to determine whether the real-time data represents abnormal behavior and identify the abnormal behavior.

[0039] As a preferred technical solution of the present invention, the detailed processing steps of the threshold dynamic adjustment module are as follows:

[0040] Step A, based on the features extracted by the feature extraction module, using an association rule mining algorithm to find frequent item sets in the data, generating association rules from the frequent item sets, and generating high-confidence association rules from the frequent item sets;

[0041] Step B, based on the association rule mining results, select the features that contribute to the classification model, establish the classification model, and use the output of the model as the evaluation index of each scheme in D-AHP;

[0042] Step C, using D-AHP to decompose the problem into different levels, including the target level, criterion level and solution level, and calculating the weight of each criterion and solution through the normalization of the feature vector;

[0043] Step D: Determine the strategy and direction of threshold adjustment based on the evaluation results obtained by D-AHP, and dynamically adjust the decision threshold of the classification model based on the association rules and the results of D-AHP.

[0044] On the other hand, a detection method of an electronic device abnormality detection system comprises the following steps:

[0045] S1, configuring the data acquisition module, ensuring that all sensors and data interfaces work properly, collecting the operation data of the electronic equipment in real time, and cleaning, normalizing and formatting the collected data;

[0046] S2, extract feature vectors from preprocessed data using LDA2Vec technology, build normal and abnormal behavior models using the model building module, compare the real-time feature vectors with the model to determine whether the behavior is normal or abnormal;

[0047] S3, dynamically adjust the threshold based on association rules and D-AHP analysis according to the actual operation of the electronic equipment and environmental changes;

[0048] S4: If the abnormal data exceeds the threshold, it is determined to be abnormal, the alarm module is triggered, and the abnormal information is recorded.

[0049] Compared with the prior art, the beneficial effects of the present invention are:

[0050] (1) The present invention combines Word2Vec and LDA models to extract deep features that can effectively characterize the device status. Through deep feature extraction and integrated models, the abnormal behavior of the device can be more accurately identified;

[0051] (2) The present invention utilizes association rule mining and D-AHP analysis to dynamically adjust the detection threshold according to the actual operation of the equipment and environmental changes. The dynamic threshold adjustment mechanism enables the system to adapt to environmental changes and equipment aging;

[0052] (3) The present invention combines normal behavior models with abnormal behavior models to improve the accuracy of anomaly detection, monitor the device status in real time, and immediately trigger an alarm when an anomaly is detected to notify the operator and respond in real time: the real-time monitoring and alarm system can respond to abnormal situations in a timely manner and reduce potential safety risks.

[0053] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented according to the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Figure 1It is a system schematic diagram of an electronic device abnormality detection system disclosed in the present invention;

[0055] Figure 2 It is a schematic diagram of the structure of an electronic device abnormality detection system disclosed in the present invention;

[0056] Figure 3 It is a flow chart of a detection method of an electronic device abnormality detection system disclosed in the present invention;

[0057] Explanation of the accompanying drawings: 100, anomaly detection system; 101, data acquisition module; 102, data preprocessing module; 103, feature extraction module; 1031, Word2Vec training unit; 1032, LDA model training unit; 1033, feature merging unit; 104, threshold dynamic adjustment module; 1041, association rule mining unit; 1042, classification model building unit; 1043, D-AHP analysis unit; 105, model building module; 1501, model training layer; 15011, normal behavior model; 10512, abnormal behavior model; 1052, abnormal judgment layer; 10521, real-time monitoring unit; 10522, abnormal judgment unit; 106, alarm module. DETAILED DESCRIPTION

[0058] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0059] Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the invention claimed for protection, but merely represents selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0060] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, further definition and explanation thereof is not required in subsequent drawings.

[0061] In the description of the present invention, it is necessary to understand that the terms "center," "longitudinal," "lateral," "length," "width," "thickness," "up," "down," "front," "back," "left," "right," "vertical," "horizontal," "top," "bottom," "inside," "outside," "clockwise," "counterclockwise," etc., indicating orientations or positional relationships, are based on the orientations or positional relationships shown in the accompanying drawings and are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the referred device or element must have a specific orientation, be constructed and operated in a specific orientation, and therefore should not be understood as a limitation on the present invention.

[0062] In addition, the terms "first," "second," and "first" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first," "second" may explicitly or implicitly include one or more of the feature. In the description of the present invention, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0063] Embodiment 1

[0064] See attached Figure 1 As shown, the present invention provides a technical solution: an electronic device abnormality detection system, including a data acquisition module 101, a data preprocessing module 102, a feature extraction module 103, a threshold dynamic adjustment module 104, a model building module 105 and an alarm module 106;

[0065] The data acquisition module 101 uses sensors to collect operating parameter data of electronic devices in real time, including temperature, current and voltage, electromagnetic, vibration, sound and performance indicators;

[0066] The data preprocessing module 102 is used to clean and format the collected data in preparation for feature extraction, and convert the collected device data into a format suitable for LDA2Vec processing;

[0067] The feature extraction module 103 extracts key features from the preprocessed data using a feature extraction algorithm;

[0068] The threshold dynamic adjustment module 104 is used to adjust the detection threshold according to the operating state of the device and environmental changes. The threshold dynamic adjustment module 104 includes an association rule mining unit 1041, a classification model building unit 1042 and a D-AHP analysis unit 1043;

[0069] The association rule mining unit 1041 uses association rule mining technology to mine association rules in data for classification and find frequent data sets from normal and abnormal data;

[0070] The classification model building unit 1042 builds a classification model based on the association rules to distinguish between normal and abnormal behaviors;

[0071] The D-AHP analysis unit 1043 determines the weights of different decision criteria through the hierarchical analysis method to dynamically adjust the detection threshold, determine the decision criteria for threshold adjustment, such as the operation stability of the equipment, environmental changes, historical failure rate, etc., and construct a hierarchical model to determine the weight of threshold adjustment, including the target layer (optimal threshold adjustment), the criterion layer (decision criteria), and the solution layer (different threshold settings). Through data analysis, weights are assigned to the elements of each layer. Finally, according to the output of the associated classification model and the results of the D-AHP analysis, the detection threshold is dynamically adjusted;

[0072] The model building module 105 is used to perform model training on normal behavior and abnormal behavior of the electronic device;

[0073] The alarm module 106 is used to generate an alarm and notify the operator when the model of the model building module 105 detects an abnormality. The abnormality information includes the abnormality type, occurrence time, equipment status, etc., which are recorded in the system for subsequent analysis.

[0074] In addition, if Figure 2 As shown, the electronic device anomaly detection system 100 is an independent electronic device that is specifically used to monitor the operating status of other electronic devices. It exchanges data with sensors used to monitor electronic devices through wireless communication, and is configured with a mobile terminal to facilitate viewing of detection data. As an independent system, it will not occupy the resources of the monitored device, and can monitor a variety of different electronic devices, and only needs to adapt to the corresponding sensors and data interfaces.

[0075] The embodiment of the present invention is also implemented through the following technical solutions.

[0076] In an embodiment of the present invention, the feature extraction module 103 includes a Word2Vec training unit 1031, an LDA model training unit 1032 and a feature merging unit 1033;

[0077] The Word2Vec training unit 1031 uses the CBOW model to learn word vectors of electronic device parameters;

[0078] The LDA model training unit 1032 applies the topic distribution of the LDA model learning parameters based on Word2Vec;

[0079] The feature merging unit 1033 merges the word vector and topic distribution of each parameter based on the data of the Word2Vec training unit 1031 and the LDA model training unit 1032 to form a final feature vector.

[0080] In an embodiment of the present invention, the detailed processing steps of the Word2Vec training unit 1031 are as follows:

[0081] Step a, collect text data of device parameters, remove irrelevant characters such as punctuation marks, special symbols, etc., convert text to lowercase or uppercase, maintain text consistency, split text into words or parameter names, extract all unique words from the cleaned data, build a vocabulary, and assign a unique index to each word;

[0082] Step b: CBOW model construction: input the index of the context word, map the index to a low-dimensional vector, use the softmax function to predict the central word, randomly initialize the word vector matrix and the weight of the softmax function to predict the central word.

[0083] Step c, use negative sampling to reduce the amount of calculation, select a certain number of negative samples (non-context words), use the cross entropy loss function to measure the difference between the predicted value and the true value, for a given context word index, map the index to a low-dimensional vector to obtain their word vectors, calculate the average of these word vectors as input, predict the probability distribution of the central word, use the predicted probability distribution of the central word and the true central word index to calculate the loss function, about the gradient of the model parameters, update the index of the upper and lower layers and the weight of the predicted central word, for each positive sample, randomly select negative samples, and update their weights, use gradient descent to update the model parameters;

[0084] Step d: Use grid search, random search, or Bayesian optimization to adjust hyperparameters such as learning rate, number of negative samples, word vector dimension, and window size to optimize model performance. Use the validation set to evaluate model performance. Evaluate the quality of word vectors by calculating similarity and performing word vector analogy tasks. After training, save the word vector matrix and model parameters for subsequent use.

[0085] Step e: Use the trained word vectors to perform tasks such as device parameter anomaly detection, cluster analysis, and text classification;

[0086] The detailed processing steps of the LDA model training unit 1032 are as follows:

[0087] Step 1: Based on the data obtained by the Word2Vec training unit 1031, the text data is converted into a bag-of-words model representation, that is, each document is represented as a word frequency vector, and parameters such as the number of topics and the number of iterations are set;

[0088] Step 2: Maximize the probability of co-occurrence of context words and central words, maximize the probability of document-generated topics and topic-generated words, and use the word vector trained by Word2Vec as the initial word vector of the LDA model;

[0089] Step 3: For each word in each document, calculate the probability that the word belongs to each topic, i.e., the posterior probability, update the word vector of Word2Vec and the document-topic distribution and topic-word distribution of LDA, use the posterior probability of LDA as the weight, update the word vector of Word2Vec, and use the updated word vector to recalculate the document-topic distribution and topic-word distribution;

[0090] The detailed processing steps of the feature merging unit 1033 are as follows:

[0091] The Word2Vec training unit 1031 outputs a word vector of a fixed dimension, and the LDA model training unit 1032 outputs a topic distribution vector whose dimension is equal to the number of topics. For each word in the document, its Word2Vec word vector is merged with the corresponding LDA topic distribution vector. The two vectors can be simply connected to form a new vector. For the entire document, the average value of the Word2Vec word vectors of all words and the average value of the LDA topic distribution can be calculated, and then the two average vectors can be connected to form the final feature vector of the document.

[0092] In an embodiment of the present invention, the model building module 105 includes a model training layer 1501 and an abnormality determination layer 1052;

[0093] The model training layer 1501 uses the established behavior model of the electronic device to provide a data basis for abnormal judgment of the electronic device. The model training layer 1501 includes a normal behavior model 15011 and an abnormal behavior model 10512;

[0094] The abnormality judgment layer 1052 performs abnormality judgment on the behavior of the electronic device in real time based on the model data. The abnormality judgment layer 1052 includes a real-time monitoring unit 10521 and an abnormality judgment unit 10522 .

[0095] In an embodiment of the present invention, the steps of distinguishing normal and abnormal behavior data sets of the feature extraction module 103 are as follows:

[0096] Use the LOF algorithm on the training set to determine a suitable neighborhood parameter k, which will affect the calculation of the local reachable density. For each data point in the training set, calculate its local reachable density. Calculate the LOF score of each data point based on the local reachable density. The LOF score is the inverse of the sum of the ratios of the local reachable densities of all neighborhood points. Observe the distribution of the LOF scores in the training set, analyze the score distribution by drawing box plots, histograms and other visualization methods, and set a threshold to distinguish normal and abnormal behaviors based on the distribution of the LOF scores. The threshold can be a certain percentile of the highest LOF score. For example, the threshold can be set to the 5% with the highest LOF score. Mark the data in the training set, mark the data points with LOF scores higher than the threshold as abnormal behaviors, and mark the data points with LOF scores lower than or equal to the threshold as normal behaviors. Test the LOF model using the test set. According to the verification results, adjust the neighborhood parameter k and the threshold to improve the model performance.

[0097] The normal behavior model 15011 is based on the normal behavior feature data set of the feature extraction module 103, the data set is divided into a training set and a test set, the training set is trained using a naive Bayes classifier, the model is evaluated through cross-validation, and the trained normal behavior model 15011 is applied;

[0098] The abnormal behavior model 10512 is based on the abnormal behavior data set of the feature extraction module 103 or the same data set as the normal behavior model 15011. The isolation forest model is trained using the entire data set and appropriate hyperparameters are set, such as the number of trees, subsampling size, etc. For each sample, its average path length in the isolation forest is calculated. The shorter the path length, the greater the possibility that the sample is abnormal. The model performance is evaluated using a test set with known labels, and indicators such as precision, recall, and F1 score are calculated. The trained isolation forest model is applied to actual use for abnormal behavior detection of real-time or batch data.

[0099] In the embodiment of the present invention, the real-time monitoring unit 10521 is used to receive data from the data acquisition module 101 in real time and display it graphically, providing a data basis for the abnormality judgment unit 10522;

[0100] The abnormality judgment unit 10522 compares the real-time data received by the real-time monitoring unit 10521 with the normal behavior model 15011 and the abnormal behavior model 10512 of the model training layer 1501 to determine whether the real-time data represents abnormal behavior and identify abnormal behavior.

[0101] In the embodiment of the present invention, the detailed processing steps of the threshold dynamic adjustment module 104 are as follows:

[0102] Step A, based on the features extracted by the feature extraction module 103, use the association rule mining algorithm to find the frequent item sets in the data, generate association rules from the frequent item sets, these rules describe the correlation between the features, generate high-confidence association rules from the frequent item sets, for each frequent item set, generate all possible non-empty subsets, for each generated rule, calculate its confidence, if the confidence of the rule meets the minimum confidence requirement, then the rule is a valid association rule;

[0103] Step B: According to the association rule mining results, select the features that contribute to the classification model, and use support vector machine or decision tree to establish the classification model. The trained classification model can provide important decision-making basis for D-AHP. The output results of the model (such as classification probability or prediction value) are used as evaluation indicators of each scheme in D-AHP to help decision makers better understand the advantages and disadvantages of different schemes.

[0104] Step C: Use D-AHP to decompose the problem into different levels, including the target level, criterion level, and solution level. Perform pairwise comparisons at the criterion level and solution level, build a pairwise comparison matrix, and perform consistency checks. Calculate the weights of each criterion and solution through normalization of the eigenvectors.

[0105] Step D, according to the evaluation results obtained by D-AHP, determine the strategy and direction of threshold adjustment, dynamically adjust the decision threshold of the classification model according to the association rules and the results of D-AHP, and optimize the effect of the dynamic threshold adjustment algorithm by adjusting the block size and constant parameters.

[0106] Embodiment 2

[0107] See attached Figure 3 As shown, an embodiment of the present invention further provides a detection method of an electronic device abnormality detection system, comprising the following steps:

[0108] S1, configure the data acquisition module 101, ensure that all sensors and data interfaces work normally, collect the operation data of the electronic equipment in real time, and clean, normalize and format the collected data;

[0109] S2, extracting feature vectors from the preprocessed data using LDA2Vec technology, building normal and abnormal behavior models 10512 using model building module 105, comparing the real-time feature vectors with the model to determine whether the behavior is normal or abnormal;

[0110] S3, dynamically adjust the threshold based on association rules and D-AHP analysis according to the actual operation of the electronic equipment and environmental changes;

[0111] S4, if the abnormal data exceeds the threshold, it is determined to be abnormal, the alarm module 106 is triggered, and the abnormal information is recorded;

[0112] S5, model update and optimization: Regularly update the model with new normal data to optimize detection performance.

[0113] The above are only preferred embodiments of the present invention and are not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

[0114] It should be understood that the specific order or hierarchy of steps in the disclosed process is an example of an exemplary method. Based on design preferences, it should be understood that the specific order or hierarchy of steps in the process can be rearranged without departing from the scope of protection of the present disclosure. The attached method claims present the elements of the various steps in an exemplary order and are not intended to be limited to a specific order or hierarchy.

[0115] In the above detailed description, various features are grouped together in a single embodiment to simplify the disclosure. This method of disclosure should not be interpreted as reflecting an intention that the embodiments of the claimed subject matter require more features than are clearly stated in each claim. On the contrary, as reflected in the appended claims, the invention is in a state of having less than all the features of the disclosed individual embodiments. Therefore, the appended claims are hereby expressly incorporated into the detailed description, with each claim standing on its own as a separate preferred embodiment of the invention.

[0116] Those skilled in the art will also appreciate that the various illustrative logic blocks, modules, circuits, and algorithmic steps described in conjunction with the embodiments herein can all be implemented as electronic hardware, computer software, or a combination thereof. In order to clearly illustrate the interchangeability between hardware and software, various illustrative components, blocks, modules, circuits, and steps are generally described above around their functions. Whether such functions are implemented as hardware or software depends on specific applications and the design constraints imposed on the entire system. A skilled person can implement the described functions in an alternative manner for each specific application, but such implementation decisions should not be interpreted as departing from the scope of protection of the present disclosure.

[0117] The steps of the method or algorithm described in conjunction with the embodiments herein may be directly embodied as hardware, a software module executed by a processor, or a combination thereof. The software module may be located in a RAM memory, a flash memory, a ROM memory, an EPROM memory, an EEPROM memory, a register, a hard disk, a mobile disk, a CD-ROM, or any other form of storage medium well known in the art. An exemplary storage medium is connected to the processor so that the processor can read information from the storage medium and can write information to the storage medium. Of course, the storage medium may also be an integral part of the processor. The processor and the storage medium may be located in an ASIC. The ASIC may be located in a user terminal. Of course, the processor and the storage medium may also be present in a user terminal as discrete components.

[0118] For software implementation, the techniques described in this application can be implemented with modules (e.g., procedures, functions, etc.) that perform the functions described in this application. These software codes can be stored in a memory unit and executed by a processor. The memory unit can be implemented within the processor or outside the processor. In the latter case, it is coupled to the processor in a communication manner via various means, which are well known in the art.

[0119] The above description includes examples of one or more embodiments. Of course, it is not possible to describe all possible combinations of components or methods for the purpose of describing the above embodiments, but it will be appreciated by those skilled in the art that the various embodiments may be further combined and arranged. Therefore, the embodiments described herein are intended to cover all such changes, modifications and variations that fall within the scope of protection of the appended claims. In addition, with respect to the term "comprising" used in the specification or claims, the term is intended to be encompassed in a manner similar to the term "including," as explained by "including" used as a transitional word in the claims. In addition, any term "or" used in the specification of the claims is intended to mean a "non-exclusive or."

Claims

1. An electronic equipment abnormality detection system, characterized in that: It includes a data acquisition module (101), a data preprocessing module (102), a feature extraction module (103), a threshold dynamic adjustment module (104), a model building module (105) and an alarm module (106); The data acquisition module (101) uses sensors to collect operating parameter data of the electronic device in real time, including temperature, current and voltage, electromagnetic, vibration, sound and performance indicators; The data preprocessing module (102) is used to clean the collected data and format the raw data to prepare for feature extraction, and convert the collected device data into a format suitable for LDA2Vec processing; The feature extraction module (103) extracts key features from the preprocessed data using a feature extraction algorithm; The threshold dynamic adjustment module (104) is used to adjust the detection threshold according to the operation state of the device and the environmental changes, and the threshold dynamic adjustment module (104) includes an association rule mining unit (1041), a classification model building unit (1042) and a D-AHP analysis unit (1043); The association rule mining unit (1041) uses association rule mining technology to mine association rules in data for classification, and finds frequent data sets from normal and abnormal data; The classification model building unit (1042) builds a classification model based on the association rules to distinguish between normal and abnormal behaviors; The D-AHP analysis unit (1043) determines the weights of different decision criteria through a hierarchical analysis method to dynamically adjust the detection threshold, determine the decision criteria for threshold adjustment, and construct a hierarchical structure model to determine the weights for threshold adjustment; The model building module (105) is used to perform model training on normal behavior and abnormal behavior of the electronic device; The alarm module (106) is used to generate an alarm and notify the operator when the model of the model building module (105) detects an abnormality.

2. The electronic device abnormality detection system according to claim 1, characterized in that: The feature extraction module (103) includes a Word2Vec training unit (1031), an LDA model training unit (1032) and a feature merging unit (1033); The Word2Vec training unit (1031) uses the CBOW model to learn word vectors of electronic device parameters; The LDA model training unit (1032) applies the topic distribution of the LDA model learning parameters based on Word2Vec; The feature merging unit (1033) merges the word vector and topic distribution of each parameter based on the data of the Word2Vec training unit (1031) and the LDA model training unit (1032) to form a final feature vector.

3. The electronic equipment abnormality detection system according to claim 2, characterized in that: The detailed processing steps of the Word2Vec training unit (1031) are as follows: Step a, collect text data of device parameters, remove irrelevant characters, convert text to lowercase or uppercase, split text into words or parameter names, extract all unique words from the cleaned data, build a vocabulary, and assign a unique index to each word; Step b: CBOW model construction: input the index of the context word, map the index to a low-dimensional vector, use the softmax function to predict the central word, randomly initialize the word vector matrix and the weight of the softmax function to predict the central word. Step c, using negative sampling to reduce the amount of calculation, select a certain number of negative samples, use the cross entropy loss function to measure the difference between the predicted value and the true value, use the probability distribution of the predicted center word and the true center word index to calculate the loss function, about the gradient of the model parameters, update the index of the upper and lower layers and the weight of the predicted center word; Step d: Use the validation set to evaluate the model performance. After training, save the word vector matrix and model parameters. Step e: Use the trained word vectors to perform tasks such as device parameter anomaly detection, cluster analysis, and text classification; The detailed processing steps of the LDA model training unit (1032) are as follows: Step 1, based on the data obtained by the Word2Vec training unit (1031), converting the text data into a bag-of-words model representation; Step 2: Maximize the probability of co-occurrence of context words and central words, maximize the probability of document-generated topics and topic-generated words, and use the word vector trained by Word2Vec as the initial word vector of the LDA model; Step 3: For each word in each document, calculate the probability that the word belongs to each topic, update the word vector of Word2Vec and the document-topic distribution and topic-word distribution of LDA, use the posterior probability of LDA as the weight, update the word vector of Word2Vec, and use the updated word vector to recalculate the document-topic distribution and topic-word distribution.

4. The electronic equipment anomaly detection system according to claim 3, characterized in that: The model building module (105) includes a model training layer (1501) and an abnormality judgment layer (1052); The model training layer (1501) uses a behavior model of the electronic device to provide a data basis for abnormal judgment of the electronic device, and the model training layer (1501) includes a normal behavior model (15011) and an abnormal behavior model (10512); The abnormality judgment layer (1052) performs abnormality judgment on the behavior of the electronic device in real time based on the model data, and the abnormality judgment layer (1052) includes a real-time monitoring unit (10521) and an abnormality judgment unit (10522).

5. The electronic equipment abnormality detection system according to claim 4, characterized in that: The steps of distinguishing normal and abnormal behavior data sets of the feature extraction module (103) are as follows: Use the LOF algorithm on the training set to determine a suitable neighborhood parameter k. For each data point in the training set, calculate its local reachable density. Calculate the LOF score of each data point based on the local reachable density. Set a threshold to distinguish normal and abnormal behaviors based on the distribution of the LOF score. Mark data points with LOF scores higher than the threshold as abnormal behaviors, and mark data points with LOF scores lower than or equal to the threshold as normal behaviors. The normal behavior model (15011) is based on the normal behavior feature data set of the feature extraction module (103), the data set is divided into a training set and a test set, the training set is trained using a naive Bayes classifier, the model is evaluated through cross-validation, and the trained normal behavior model (15011) is applied; The abnormal behavior model (10512) is based on the abnormal behavior data set of the feature extraction module (103) or the same data set as the normal behavior model (15011), uses the entire data set to train the isolation forest model, sets appropriate hyperparameters, calculates the average path length of each sample in the isolation forest, uses a test set with known labels to evaluate the model performance, and applies the trained isolation forest model to actual use.

6. The electronic equipment abnormality detection system according to claim 5, characterized in that: The real-time monitoring unit (10521) is used to receive data from the data acquisition module (101) in real time and display it graphically, thereby providing a data basis for the abnormality judgment unit (10522); The abnormality judgment unit (10522) compares the real-time data received by the real-time monitoring unit (10521) with the normal behavior model (15011) and the abnormal behavior model (10512) of the model training layer (1501) to determine whether the real-time data represents abnormal behavior and identify abnormal behavior.

7. The electronic device anomaly detection system according to claim 6, characterized in that: The detailed processing steps of the threshold dynamic adjustment module (104) are as follows: Step A, based on the features extracted by the feature extraction module (103), using an association rule mining algorithm to find frequent item sets in the data, generating association rules from the frequent item sets, and generating high-confidence association rules from the frequent item sets; Step B, based on the association rule mining results, select the features that contribute to the classification model, establish the classification model, and use the output of the model as the evaluation index of each scheme in D-AHP; Step C, using D-AHP to decompose the problem into different levels, including the target level, criterion level and solution level, and calculating the weight of each criterion and solution through the normalization of the feature vector; Step D: Determine the strategy and direction of threshold adjustment based on the evaluation results obtained by D-AHP, and dynamically adjust the decision threshold of the classification model based on the association rules and the results of D-AHP.

8. A method for using an electronic device anomaly detection system and a detection method, applied to an electronic device anomaly detection system and a detection method as claimed in any one of claims 1 to 7, characterized in that: The following steps are involved: S1, configuring the data acquisition module (101), ensuring that all sensors and data interfaces operate normally, collecting operation data of electronic devices in real time, and cleaning, normalizing and formatting the collected data; S2, extracting feature vectors from the preprocessed data using LDA2Vec technology, establishing normal and abnormal behavior models (10512) using a model building module (105), comparing the real-time feature vectors with the model, and determining whether the behavior is normal or abnormal; S3, dynamically adjust the threshold based on association rules and D-AHP analysis according to the actual operation of the electronic equipment and environmental changes; S4: If the abnormal data exceeds the threshold, it is determined to be abnormal, the alarm module (106) is triggered, and the abnormal information is recorded.

Images