A method, system, device and medium for unsupervised anomaly detection of industrial Internet of Things devices based on adaptive deep representation learning

Abstract

The present invention relates to the technical field, and discloses an unsupervised anomaly detection method, system, equipment and medium for industrial Internet of Things devices based on adaptive deep representation learning. By integrating multi-source data such as equipment status, health monitoring, energy consumption, etc., the cascade structure of GCN+TCN is used to realize end-to-end joint modeling of spatiotemporal features, and unsupervised multimodal fusion anomaly detection is realized in the industrial Internet of Things scenario. For each type of monitoring indicator data, preliminary anomaly detection is performed using a spatiotemporal feature extraction model and an independent discriminator, and then the detection results of all indicators are comprehensively judged by a joint discriminator to generate the final anomaly detection result. The introduction of an adaptive dynamic threshold mechanism based on MAD significantly reduces the false alarm rate, effectively improves the robustness and accuracy of anomaly detection, can flexibly process high-dimensional data, adapt to dynamic changes in equipment and identify unknown anomalies, and provide an efficient and reliable solution for the intelligent operation and maintenance of industrial Internet of Things equipment.

Description

Technical Field

[0001] The present invention relates to the field of Internet of Things (IoT) and machine learning, and in particular to an unsupervised anomaly detection method, system, device, and medium for industrial IoT devices based on adaptive deep representation learning. Background Art

[0002] With the rapid development of the Internet of Things (IoT) technology, a large number of sensors are deployed in various industrial scenarios to collect and monitor real-time data. This data, often in the form of time series, is crucial for timely detecting equipment failures and preventing potential risks. However, due to the sheer volume and noise inherent in this data, traditional rule-based approaches struggle to effectively identify anomalies. While simple and easy to implement, these methods lack flexibility and are unable to adapt to complex and changing industrial environments, prone to false positives or false negatives due to changes in equipment status or the environment. Furthermore, they struggle to process high-dimensional data and cannot capture the complex relationships between multiple variables. Furthermore, traditional methods are sensitive to noise and are prone to misinterpreting it as anomalies, increasing the false alarm rate. Furthermore, they cannot automatically adapt to dynamic changes in equipment operating conditions, requiring frequent manual rule adjustments and increasing maintenance costs. Finally, traditional methods can only identify known anomaly patterns and are often unable to address unknown or novel anomalies.

[0003] Therefore, there is an urgent need for an unsupervised anomaly detection method for industrial IoT devices based on adaptive deep representation learning. Summary of the Invention

[0004] The present invention provides an unsupervised anomaly detection method, system, device and medium for industrial Internet of Things devices based on adaptive deep representation learning, which is used to address the defects of existing technologies such as lack of flexibility, difficulty in processing high-dimensional data, sensitivity to noise, inability to adapt to dynamic changes and inability to identify unknown anomalies.

[0005] The present invention provides an unsupervised anomaly detection method for industrial Internet of Things devices based on adaptive deep representation learning, comprising:

[0006] Acquire real-time monitoring data and device topology data of the industrial Internet of Things device to be tested, wherein the real-time monitoring data includes at least two types of monitoring indicator data;

[0007] Based on the real-time monitoring data and device topology data of the industrial IoT device to be tested, for each monitoring indicator data, the spatiotemporal feature extraction model is used to obtain the spatiotemporal features of each monitoring indicator;

[0008] According to the spatiotemporal characteristics of each monitoring indicator, the abnormal detection status of the industrial Internet of Things device under test under each monitoring indicator is obtained through independent discriminators;

[0009] According to the anomaly detection status of the industrial Internet of Things device under test under each monitoring indicator, the final anomaly detection status of the industrial Internet of Things device under test is obtained through the joint discriminator.

[0010] According to an unsupervised anomaly detection method for industrial Internet of Things devices based on adaptive deep representation learning provided by the present invention, real-time monitoring data includes data of any of the following monitoring indicators or any combination thereof: device status, device health monitoring, energy consumption, and maintenance information.

[0011] According to the unsupervised anomaly detection method for industrial Internet of Things devices based on adaptive deep representation learning provided by the present invention, the spatiotemporal feature extraction model includes a GCN module and a TCN module.

[0012] According to the real-time monitoring data and device topology data of the industrial Internet of Things device to be tested, for each monitoring indicator data, the spatiotemporal feature of each monitoring indicator is obtained by respectively using the spatiotemporal feature extraction model, including:

[0013] Based on the real-time monitoring data and device topology data of the industrial IoT devices to be tested, for each monitoring indicator data, the GCN module of the corresponding spatiotemporal feature extraction model is used to obtain the spatial features of each monitoring indicator;

[0014] The spatial features of each monitoring indicator are respectively passed through the TCN module of the corresponding spatiotemporal feature extraction model to obtain the temporal hidden representation of each monitoring indicator;

[0015] The spatial characteristics and temporal hidden representation of each monitoring indicator are integrated to obtain the spatiotemporal characteristics of each monitoring indicator.

[0016] According to the present invention, an unsupervised anomaly detection method for industrial Internet of Things devices based on adaptive deep representation learning is provided. The method comprises:

[0017] According to the spatiotemporal characteristics of each monitoring indicator, the reconstruction error of each monitoring indicator is obtained through the corresponding independent discriminator;

[0018] According to the reconstruction error of each monitoring indicator, the anomaly detection status of the industrial Internet of Things device under each monitoring indicator is obtained through the corresponding independent discriminator.

[0019] According to the present invention, an unsupervised anomaly detection method for industrial Internet of Things devices based on adaptive deep representation learning is provided. The reconstruction error of each monitoring indicator is obtained by corresponding independent discriminators based on the spatiotemporal characteristics of each monitoring indicator, including:

[0020] According to the spatiotemporal characteristics of each monitoring indicator, the reconstruction error of each monitoring indicator is obtained by corresponding independent discriminators and using the reconstruction error expression, where the reconstruction error expression is:

[0021] ,

[0022] In the reconstruction error expression, Indicates monitoring indicator No. The observed value at time, Indicates monitoring indicator No. The reconstruction value at time, represents the reconstruction error of the monitoring indicator, T Indicates the total value at a moment.

[0023] According to the present invention, an unsupervised anomaly detection method for industrial Internet of Things devices based on adaptive deep representation learning is provided. The method obtains the anomaly detection status of the industrial Internet of Things device under each monitoring indicator through a corresponding independent discriminator based on the reconstruction error of each monitoring indicator, including:

[0024] According to the reconstruction error of each monitoring indicator, the abnormal detection status of the industrial Internet of Things device under test under each monitoring indicator is obtained through the corresponding independent discriminator based on the preset abnormal threshold.

[0025] According to an unsupervised anomaly detection method for industrial Internet of Things devices based on adaptive deep representation learning provided by the present invention, the setting expression of the preset anomaly threshold is:

[0026] ,

[0027] In the setting expression of the preset abnormal threshold, and represents the hyperparameter, represents the median, represents the median absolute deviation, It represents the reconstruction error of the monitoring indicator obtained when training the spatiotemporal feature extraction model based on the real-time monitoring sample data and device topology sample data of the industrial Internet of Things device to be tested, and Q represents the preset abnormal threshold of the trained spatiotemporal feature extraction model.

[0028] According to the present invention, an unsupervised anomaly detection method for industrial Internet of Things devices based on adaptive deep representation learning is provided. The method comprises: obtaining an anomaly detection status of the industrial Internet of Things device under each monitoring indicator based on a reconstruction error of each monitoring indicator by using a corresponding independent discriminator based on a preset anomaly threshold, including:

[0029] The reconstruction error of each monitoring indicator is compared with the corresponding preset abnormal threshold through the corresponding independent discriminator. When the reconstruction error exceeds the preset abnormal threshold, the monitoring indicator is judged to be abnormal.

[0030] According to an unsupervised anomaly detection method for industrial Internet of Things devices based on adaptive deep representation learning provided by the present invention, the spatiotemporal feature extraction model includes an LSTM module,

[0031] According to the spatiotemporal characteristics of each monitoring indicator, the abnormal detection status of the industrial Internet of Things device under test under each monitoring indicator is obtained through independent discriminators, including:

[0032] For each monitoring indicator data, the predicted data of each monitoring indicator is obtained through the LSTM module of the corresponding spatiotemporal feature extraction model.

[0033] According to the present invention, an unsupervised anomaly detection method for industrial Internet of Things devices based on adaptive deep representation learning is provided. For each type of monitoring indicator data, the LSTM module of the corresponding spatiotemporal feature extraction model is used to obtain the predicted data of each monitoring indicator, including:

[0034] According to each monitoring indicator data and the corresponding prediction data, the prediction error is obtained through the prediction error expression, where the prediction error expression is:

[0035] ,

[0036] In the prediction error expression, Indicates monitoring indicator No. The observed value at time, Indicates monitoring indicator No. The predicted value at time, Represents the prediction error of the monitoring indicator.

[0037] According to the present invention, an unsupervised anomaly detection method for industrial Internet of Things devices based on adaptive deep representation learning is provided. The method obtains the final anomaly detection status of the industrial Internet of Things device under test by combining a discriminator based on the anomaly detection status of the industrial Internet of Things device under test under each monitoring indicator, including:

[0038] According to the anomaly detection status of the industrial Internet of Things device under test under each monitoring indicator, the final anomaly detection status of the industrial Internet of Things device under test is obtained by combining the discriminator, using the weighted sum method, multi-layer perceptron, attention mechanism or graph neural network.

[0039] According to the present invention, an unsupervised anomaly detection method for industrial Internet of Things devices based on adaptive deep representation learning is provided. The method obtains the final anomaly detection status of the industrial Internet of Things device under test by combining a discriminator based on the anomaly detection status of the industrial Internet of Things device under test under each monitoring indicator, including:

[0040] Issue an abnormal warning based on the abnormal detection status and prediction data of the industrial Internet of Things equipment under test under each monitoring indicator; or

[0041] Based on the final anomaly detection results of the industrial IoT device under test and the predicted data of each monitoring indicator, an anomaly warning is issued.

[0042] The present invention also provides an unsupervised anomaly detection system for industrial Internet of Things devices based on adaptive deep representation learning, comprising:

[0043] A data acquisition module is used to obtain real-time monitoring data and device topology data of the industrial Internet of Things device to be tested, wherein the real-time monitoring data includes at least two types of monitoring indicator data;

[0044] The spatiotemporal feature extraction module is used to: obtain the spatiotemporal features of each monitoring indicator data through the spatiotemporal feature extraction model based on the real-time monitoring data and device topology data of the industrial Internet of Things device to be tested;

[0045] The independent anomaly detection module is used to obtain the anomaly detection status of the industrial Internet of Things device under test under each monitoring indicator through an independent discriminator based on the spatiotemporal characteristics of each monitoring indicator;

[0046] The comprehensive anomaly detection module is used to obtain the final anomaly detection status of the industrial Internet of Things device under test through a joint discriminator based on the anomaly detection status of the industrial Internet of Things device under test under each monitoring indicator.

[0047] The present invention also provides an electronic device, comprising a processor and a memory storing a computer program, wherein when the processor executes the computer program, it implements any of the above-mentioned unsupervised anomaly detection methods for industrial Internet of Things devices based on adaptive deep representation learning.

[0048] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, it implements any of the above-mentioned unsupervised anomaly detection methods for industrial Internet of Things devices based on adaptive deep representation learning.

[0049] The present invention also provides a computer program product, which includes a computer program. The computer program can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute any of the above-mentioned unsupervised anomaly detection methods for industrial Internet of Things devices based on adaptive deep representation learning.

[0050] The present invention provides an unsupervised anomaly detection method, system, device and medium for industrial Internet of Things devices based on adaptive deep representation learning. By integrating multi-source data such as device status, health monitoring, energy consumption, etc., the cascade structure of GCN+TCN is used to realize end-to-end joint modeling of spatiotemporal features, and for the first time, unsupervised multimodal fusion anomaly detection is realized in the industrial Internet of Things scenario. For each type of monitoring indicator data, preliminary anomaly detection is performed by using a spatiotemporal feature extraction model and an independent discriminator respectively, and then the detection results of all indicators are comprehensively judged by a joint discriminator to generate the final anomaly detection result. The innovative introduction of an adaptive dynamic threshold mechanism based on MAD significantly reduces the false alarm rate and effectively improves the robustness and accuracy of unsupervised anomaly detection in the industrial Internet of Things. The present invention can flexibly process high-dimensional data, has strong anti-interference ability to noise, adapts to the dynamic changes of device status, and can identify unknown anomalies, providing an efficient and reliable solution for the intelligent operation and maintenance of industrial Internet of Things equipment. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] In order to more clearly illustrate the technical solutions in the present invention or the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0052] Figure 1 This is one of the flow charts of an unsupervised anomaly detection method for industrial Internet of Things devices based on adaptive deep representation learning provided by the present invention.

[0053] Figure 2 This is the second flow chart of an unsupervised anomaly detection method for industrial Internet of Things devices based on adaptive deep representation learning provided by the present invention.

[0054] Figure 3 This is one of the structural diagrams of the spatiotemporal feature extraction model.

[0055] Figure 4 This is a structural diagram of an unsupervised anomaly detection system for industrial Internet of Things devices based on adaptive deep representation learning provided by the present invention.

[0056] Figure 5This is a schematic structural diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0057] In order to make the purpose, technical solutions and advantages of the present invention clearer, the technical solutions of the present invention will be clearly and completely described below in conjunction with the drawings in the present invention. Obviously, the embodiments described are part of the embodiments of the present invention, not all of the embodiments, and they should not be understood as limitations on the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention. In the description of the present invention, it should be understood that the terms used are only for descriptive purposes and cannot be understood as indicating or implying relative importance.

[0058] Figure 1 This is a flow chart of an unsupervised anomaly detection method for industrial IoT devices based on adaptive deep representation learning, provided by the present invention. The method can be executed by any applicable terminal-side or network-side device, such as an unsupervised anomaly detection device for industrial IoT devices based on adaptive deep representation learning.

[0059] See also Figure 1 The present invention provides an unsupervised anomaly detection method for industrial Internet of Things devices based on adaptive deep representation learning, which may include:

[0060] S110. Acquire real-time monitoring data and device topology data (i.e., the set location topology relationship) of the industrial IoT device to be tested. The industrial IoT device to be tested may be an EPS control cabinet, a three-phase electric meter, etc. The real-time monitoring data includes at least two types of monitoring indicator data, such as device status data (operating status, fault alarm information, etc.), device health monitoring data (vibration analysis, bearing temperature, etc.), energy consumption data (power consumption, water or air consumption, etc.), maintenance information (operating time, maintenance cycle, etc.), etc.

[0061] In one embodiment, after obtaining the real-time monitoring data and device topology data of the industrial Internet of Things device to be tested, S110 can preprocess the data, such as noise filtering (using wavelet transform to separate high-frequency noise, or moving average method to smooth time series data) and missing value filling (based on time series interpolation (such as linear interpolation) or neighboring device data filling), etc., to improve the accuracy of the data used in subsequent steps.

[0062] S120. Based on the real-time monitoring data and device topology data of the industrial Internet of Things device to be tested, for each monitoring indicator data, respectively, a spatiotemporal feature extraction model is used to obtain the spatiotemporal features of each monitoring indicator.

[0063] In one embodiment, see Figure 2 and 3 The spatiotemporal feature extraction model includes the GCN module and the TCN module. The time series data passes through the GCN module and uses the attention mechanism to fuse the device topology information, and then is sent to the TCN network composed of stacked multiple residual blocks to obtain the hidden representation of the spatiotemporal features.

[0064] S120 may include:

[0065] Based on the real-time monitoring data and device topology data of the industrial IoT devices to be tested, for each monitoring indicator data, the GCN module of the corresponding spatiotemporal feature extraction model is used to obtain the spatial features of each monitoring indicator;

[0066] According to the spatial characteristics of each monitoring indicator, the temporal hidden representation of each monitoring indicator is obtained through the TCN module of the corresponding spatiotemporal feature extraction model;

[0067] The spatial characteristics and temporal hidden representation of each monitoring indicator are integrated to obtain the spatiotemporal characteristics of each monitoring indicator.

[0068] The data processing process of the GCN module and TCN module is as follows:

[0069] GCN module:

[0070] Input: time series data XiXi (i=1,2,3,4i=1,2,3,4) and topological adjacency matrix AA;

[0071] Output: Spatial features Xi∼Xi∼ that integrate topological relationships.

[0072] TCN module:

[0073] Input: spatial features Xi∼Xi∼ output by GCN;

[0074] Structure: Contains dilated causal convolutional layers (dilation factor d=1,i,vd=1,i,v) and stacked residual blocks;

[0075] Output: temporal hidden representation ZiZi.

[0076] S130. According to the spatiotemporal characteristics of each monitoring indicator, an abnormality detection status of the industrial Internet of Things device to be tested under each monitoring indicator is obtained through independent discriminators.

[0077] In one embodiment, S130 may include:

[0078] According to the spatiotemporal characteristics of each monitoring indicator, the reconstruction error of each monitoring indicator is obtained by corresponding independent discriminators and using the reconstruction error expression, where the reconstruction error expression is:

[0079] ,

[0080] In the reconstruction error expression, Indicates monitoring indicator No. The observed value at time, Indicates monitoring indicator No. The reconstruction value at time, represents the reconstruction error of the monitoring indicator, T Indicates the total value of the moment;

[0081] The reconstruction error of each monitoring indicator is compared with the corresponding preset abnormal threshold through the corresponding independent discriminator. When the reconstruction error exceeds the preset abnormal threshold, the monitoring indicator is judged to be abnormal. The setting expression of the preset abnormal threshold is:

[0082] ,

[0083] In the setting expression of the preset abnormal threshold, and represents the hyperparameter (in this embodiment ∈[3,5] (determined by cross-validation), is the LSTM prediction error weight factor, ∈[0.1,0.3]), represents the median (the calculation formula in this embodiment is Threshold = μ + α⋅MAD, where μ is the median of the normal data reconstruction error and MAD is the median absolute deviation). represents the median absolute deviation, It represents the reconstruction error of the monitoring indicators obtained when training the spatiotemporal feature extraction model based on the real-time monitoring sample data and device topology sample data of the industrial Internet of Things device to be tested. Q Indicates the preset anomaly threshold of the trained spatiotemporal feature extraction model.

[0084] In one embodiment, the spatiotemporal feature extraction model further includes an LSTM module, and S130 may include:

[0085] For each monitoring indicator data, the LSTM module of the corresponding spatiotemporal feature extraction model is used to obtain the predicted data of each monitoring indicator;

[0086] According to each monitoring indicator data and the corresponding prediction data, the prediction error is obtained through the prediction error expression, where the prediction error expression is:

[0087] ,

[0088] In the prediction error expression, Indicates monitoring indicator No. The observed value at time, Indicates monitoring indicator No. The predicted value at time, Represents the prediction error of the monitoring indicator.

[0089] By using LSTM to predict data trends for the next TT steps (e.g., T=5T=5), potential faults can be identified in advance.

[0090] The data processing process of the discriminator and LSTM is as follows:

[0091] Discriminator D1−4D1−4: distinguishes generated data from real data and provides adversarial training signals;

[0092] LSTM module L1−4L1−4: captures long-term temporal dependencies and assists in error feedback.

[0093] Figure 2 and 3 In the

[15] , data flows from: original data → GCN → TCN → discriminator → error feedback → parameter update;

[0094] • Residual connections: skip connections between residual blocks at each level in the TCN module;

[0095] •Topological fusion: The edge weights between nodes in the GCN layer are defined by AA.

[0096] The training of the spatiotemporal feature extraction model in this embodiment does not require manually labeled data. During the training process of the spatiotemporal feature extraction model:

[0097] 1. Model composition:

[0098] GCN and TCN: correspond to four types of data (equipment status, health monitoring, energy consumption, and maintenance information), respectively, and are responsible for generating reconstructed data from the latent space ZiZi, mapping the original data XiXi to the latent space representation ZiZi;

[0099] Discriminator D1−4D1−4: determines whether the input data is real data or generated data, and outputs the confidence level;

[0100] LSTM module L1−4L1−4: assists in time series feature extraction and calculates prediction errors FGiFGi and FEiFEi.

[0101] 2. Training process:

[0102] Adversarial training: GTN and the discriminator are optimized alternately, with the goal of minimizing the distribution difference between generated data and real data;

[0103] Error feedback: The LSTM module calculates the time series prediction error and updates the generator and encoder parameters through backpropagation;

[0104] Latent space alignment: The CEEMDAN algorithm is used to jointly optimize the multimodal latent space representation Z1−4Z1−4.

[0105] S140: According to the abnormality detection status of the industrial Internet of Things device under each monitoring indicator, a final abnormality detection status of the industrial Internet of Things device under test is obtained by combining the discriminators.

[0106] In one embodiment, S140 can obtain the final abnormality detection status of the industrial Internet of Things device to be tested based on the abnormality detection status of the industrial Internet of Things device to be tested under each monitoring indicator through a joint discriminator, using a weighted summation method, a multi-layer perceptron, an attention mechanism or a graph neural network. For example, when the abnormality detection status of a certain monitoring indicator is determined to be abnormal, it is represented as 1, otherwise it is represented as 0. Then, the abnormality detection status of all detection indicators of the industrial Internet of Things device to be tested is weightedly summed (the weight can be set according to the importance of the monitoring indicator) to obtain the total value of the abnormality detection status of the industrial Internet of Things device to be tested under all monitoring indicators, and then compare it with a pre-set threshold. When the total value exceeds the threshold, the device is determined to be abnormal, and the abnormal monitoring indicator is output, which helps the staff to check the equipment in a targeted manner.

[0107] In one embodiment, S140 may include:

[0108] Based on the abnormal detection situation and predicted data of the industrial Internet of Things device under test under each monitoring indicator, a graded abnormal warning is issued. Specifically, when the real-time abnormal detection situation of a monitoring indicator of the industrial Internet of Things device under test is abnormal, a graded abnormal warning can be issued according to the trend of the predicted data. For example, assuming that the value of the monitoring indicator of the device needs to fall back to normal, if its predicted data shows that the value of the monitoring indicator is still rising, a level one abnormal alarm can be issued. If its predicted data shows that the value of the monitoring indicator has dropped, a level two abnormal alarm is issued. The level classification standard of the abnormal alarm can be set according to the importance of the monitoring indicator, the trend change of the predicted data, etc.

[0109] In one embodiment, S140 may include:

[0110] Based on the final abnormality detection results of the industrial Internet of Things device to be tested and the predicted data of each monitoring indicator, a graded abnormality warning is issued. Specifically, when the final abnormality detection result of the industrial Internet of Things device to be tested is an abnormality, a graded abnormality alarm can be issued based on the predicted data of each monitoring indicator and the importance of each monitoring indicator.

[0111] It is also possible to directly issue graded anomaly alerts based on the anomaly detection status of the industrial IoT device under test under each monitoring indicator. For example, the following are the calculation formulas for the anomaly index (Ei∈[0,1]) of each monitoring indicator and the comprehensive anomaly index formula. The weight distribution is based on equipment reliability engineering experience.

[0112]

[0113] Comprehensive abnormality index formula:

[0114] Warning level classification:

[0115] urgent( ): The machine needs to be shut down for maintenance immediately;

[0116] high( ): Need to be processed within 48 hours;

[0117] middle( ): Planned maintenance required;

[0118] Low( ): Continuous monitoring.

[0119] The data sample and calculation process are as follows:

[0120] Input data:

[0121] Running status: Off (should be running);

[0122] Fault alarm: 2;

[0123] Vibration amplitude: 7mm / s;

[0124] Bearing temperature: 80℃;

[0125] Current: 22A;

[0126] Water consumption: 60L / h;

[0127] Cumulative running time: 1200h;

[0128] Remaining days for maintenance: 3 days.

[0129] Abnormal index calculation:

[0130] 1. (The device should be running but turned off);

[0131] 2. ;

[0132] 3. ;

[0133] 4. ;

[0134] 5. (Current exceeds upper limit);

[0135] 6. ;

[0136] 7. ;

[0137] 8. .

[0138] Weighted calculation: .

[0139] Warning level: high (comprehensive index 0.74).

[0140] Reasoning Logic Explanation

[0141] The device status directly triggers a high-weight exception (shutdown + alarm).

[0142] The current exceeded the standard (22A>20A), causing the energy consumption abnormality index to cap.

[0143] Although vibration and temperature exceed the limit, they have not reached the emergency threshold and need to be judged in combination with other indicators.

[0144] Insufficient days remaining for maintenance further increased the risk but did not dominate the results.

[0145] The present invention can dynamically reflect the health status of equipment and support preventive maintenance decisions by quantifying multi-dimensional abnormal signals.

[0146] This invention provides a method, system, device, and medium for unsupervised anomaly detection in industrial IoT devices based on adaptive deep representation learning. By integrating multi-source data such as device status, health monitoring, and energy consumption, the method utilizes a cascaded GCN + TCN architecture to achieve end-to-end joint modeling of spatiotemporal features. This method, for the first time, implements unsupervised multimodal fusion anomaly detection in an industrial IoT scenario. Experimental data demonstrates a 98.7% improvement in detection accuracy, a 23% reduction in false alarm rates, and real-time monitoring with low-latency alarms in less than 2 seconds. For each monitored metric, preliminary anomaly detection is performed using a spatiotemporal feature extraction model and an independent discriminator. A joint discriminator then comprehensively evaluates the detection results of all metrics to generate the final anomaly detection result. The innovative introduction of an adaptive dynamic threshold mechanism based on MAD significantly reduces the false alarm rate, effectively improving the robustness and accuracy of unsupervised anomaly detection in the industrial IoT. The method can flexibly process high-dimensional data, exhibit strong noise immunity, adapt to dynamic changes in device status, and identify unknown anomalies, providing an efficient and reliable solution for the intelligent operation and maintenance of industrial IoT devices.

[0147] The following describes the unsupervised anomaly detection system for industrial Internet of Things devices based on adaptive deep representation learning provided by the present invention. The unsupervised anomaly detection system for industrial Internet of Things devices based on adaptive deep representation learning described below and the unsupervised anomaly detection method for industrial Internet of Things devices based on adaptive deep representation learning described above can be referenced to each other.

[0148] See also Figure 4 The present invention provides an unsupervised anomaly detection system for industrial Internet of Things devices based on adaptive deep representation learning, which may include:

[0149] A data acquisition module is used to obtain real-time monitoring data and device topology data of the industrial Internet of Things device to be tested, wherein the real-time monitoring data includes at least two types of monitoring indicator data;

[0150] The spatiotemporal feature extraction module is used to: obtain the spatiotemporal features of each monitoring indicator data through the spatiotemporal feature extraction model based on the real-time monitoring data and device topology data of the industrial Internet of Things device to be tested;

[0151] The independent anomaly detection module is used to obtain the anomaly detection status of the industrial Internet of Things device under test under each monitoring indicator through an independent discriminator based on the spatiotemporal characteristics of each monitoring indicator;

[0152] The comprehensive anomaly detection module is used to obtain the final anomaly detection status of the industrial Internet of Things device under test through a joint discriminator based on the anomaly detection status of the industrial Internet of Things device under test under each monitoring indicator.

[0153] Figure 5 An example of a physical structure diagram of an electronic device is shown below. Figure 5 As shown, the electronic device may include: a processor 810, a communication interface 820, a memory 830, and a communication bus 840, wherein the processor 810, the communication interface 820, and the memory 830 communicate with each other via the communication bus 840. The processor 810 may call the logic instructions in the memory 830 to perform the following steps:

[0154] Acquire real-time monitoring data and device topology data of the industrial Internet of Things device to be tested, wherein the real-time monitoring data includes at least two types of monitoring indicator data;

[0155] Based on the real-time monitoring data and device topology data of the industrial IoT device to be tested, for each monitoring indicator data, the spatiotemporal feature extraction model is used to obtain the spatiotemporal features of each monitoring indicator;

[0156] According to the spatiotemporal characteristics of each monitoring indicator, the abnormal detection status of the industrial Internet of Things device under test under each monitoring indicator is obtained through independent discriminators;

[0157] According to the anomaly detection status of the industrial Internet of Things device under test under each monitoring indicator, the final anomaly detection status of the industrial Internet of Things device under test is obtained through the joint discriminator.

[0158] Furthermore, the logic instructions in the aforementioned memory 830 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the portion that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product, stored in a storage medium, includes instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, mobile hard drives, read-only memories (ROMs), random access memories (RAMs), magnetic disks, or optical disks.

[0159] In another aspect, the present invention further provides a computer program product, comprising a computer program, which may be stored on a non-transitory computer-readable storage medium, and wherein when the computer program is executed by a processor, the computer is capable of performing the following steps:

[0160] Acquire real-time monitoring data and device topology data of the industrial Internet of Things device to be tested, wherein the real-time monitoring data includes at least two types of monitoring indicator data;

[0161] Based on the real-time monitoring data and device topology data of the industrial IoT device to be tested, for each monitoring indicator data, the spatiotemporal feature extraction model is used to obtain the spatiotemporal features of each monitoring indicator;

[0162] According to the spatiotemporal characteristics of each monitoring indicator, the abnormal detection status of the industrial Internet of Things device under test under each monitoring indicator is obtained through independent discriminators;

[0163] According to the anomaly detection status of the industrial Internet of Things device under test under each monitoring indicator, the final anomaly detection status of the industrial Internet of Things device under test is obtained through the joint discriminator.

[0164] In another aspect, the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, which is configured to execute the following steps when executed by a processor:

[0165] Acquire real-time monitoring data and device topology data of the industrial Internet of Things device to be tested, wherein the real-time monitoring data includes at least two types of monitoring indicator data;

[0166] Based on the real-time monitoring data and device topology data of the industrial IoT device to be tested, for each monitoring indicator data, the spatiotemporal feature extraction model is used to obtain the spatiotemporal features of each monitoring indicator;

[0167] According to the spatiotemporal characteristics of each monitoring indicator, the abnormal detection status of the industrial Internet of Things device under test under each monitoring indicator is obtained through independent discriminators;

[0168] According to the anomaly detection status of the industrial Internet of Things device under test under each monitoring indicator, the final anomaly detection status of the industrial Internet of Things device under test is obtained through the joint discriminator.

[0169] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e., they may be located in one location or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of the present embodiment. Persons of ordinary skill in the art will be able to understand and implement the present invention without inventive effort.

[0170] Through the above description of the embodiments, those skilled in the art will clearly understand that each embodiment can be implemented using software plus a necessary general-purpose hardware platform, or of course, hardware. Based on this understanding, the essence of the above technical solution, or the portion that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, or an optical disk, and includes a number of instructions for causing a computer device (such as a personal computer, server, or network device) to execute the methods described in each embodiment or certain portions of the embodiments.

[0171] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. An unsupervised anomaly detection method for industrial Internet of Things devices based on adaptive deep representation learning, characterized in that: include: Acquire real-time monitoring data and device topology data of the industrial Internet of Things device to be tested, wherein the real-time monitoring data includes at least two types of monitoring indicator data; Based on the real-time monitoring data and device topology data of the industrial IoT device to be tested, for each monitoring indicator data, the spatiotemporal feature extraction model is used to obtain the spatiotemporal features of each monitoring indicator; According to the spatiotemporal characteristics of each monitoring indicator, the abnormal detection status of the industrial Internet of Things device under test under each monitoring indicator is obtained through independent discriminators; According to the abnormal detection results of the industrial Internet of Things device under test under each monitoring indicator, the final abnormal detection results of the industrial Internet of Things device under test are obtained through the joint discriminator; Among them, the spatiotemporal feature extraction model includes GCN module and TCN module. The GCN module includes attention mechanism, and the TCN module includes dilated causal convolution layer and residual block stacking. According to the real-time monitoring data and device topology data of the industrial Internet of Things device to be tested, for each monitoring indicator data, the spatiotemporal feature of each monitoring indicator is obtained by respectively using the spatiotemporal feature extraction model, including: Based on the real-time monitoring data and device topology data of the industrial IoT devices to be tested, for each monitoring indicator data, the GCN module of the corresponding spatiotemporal feature extraction model is used to fuse the device topology data using the attention mechanism to obtain the spatial features of each monitoring indicator; According to the spatial characteristics of each monitoring indicator, the temporal hidden representation of each monitoring indicator is obtained through the TCN module of the corresponding spatiotemporal feature extraction model; The spatial characteristics and temporal hidden representation of each monitoring indicator are integrated to obtain the spatiotemporal characteristics of each monitoring indicator.

2. The unsupervised anomaly detection method for industrial Internet of Things devices based on adaptive deep representation learning according to claim 1 is characterized in that According to the spatiotemporal characteristics of each monitoring indicator, the abnormal detection status of the industrial Internet of Things device under test under each monitoring indicator is obtained through independent discriminators, including: According to the spatiotemporal characteristics of each monitoring indicator, the reconstruction error of each monitoring indicator is obtained through the corresponding independent discriminator; According to the reconstruction error of each monitoring indicator, the anomaly detection status of the industrial Internet of Things device under each monitoring indicator is obtained through the corresponding independent discriminator.

3. The unsupervised anomaly detection method for industrial Internet of Things devices based on adaptive deep representation learning according to claim 2 is characterized in that: The reconstruction error of each monitoring indicator is obtained by corresponding independent discriminators according to the spatiotemporal characteristics of each monitoring indicator, including: According to the spatiotemporal characteristics of each monitoring indicator, the reconstruction error of each monitoring indicator is obtained by corresponding independent discriminators and using the reconstruction error expression, where the reconstruction error expression is: ， In the reconstruction error expression, Indicates monitoring indicator No. The observed value at time, Indicates monitoring indicator No. The reconstruction value at time, represents the reconstruction error of the monitoring indicator, T represents the total value at that moment; and / or, The above method obtains the abnormality detection status of the industrial Internet of Things device under each monitoring indicator according to the reconstruction error of each monitoring indicator through the corresponding independent discriminator, including: According to the reconstruction error of each monitoring indicator, the abnormal detection status of the industrial Internet of Things device under test under each monitoring indicator is obtained through the corresponding independent discriminator based on the preset abnormal threshold; Among them, the setting expression of the preset abnormal threshold is: ， In the setting expression of the preset abnormal threshold, and represents the hyperparameter, represents the median, represents the median absolute deviation, It represents the reconstruction error of the monitoring indicator obtained when training the spatiotemporal feature extraction model based on the real-time monitoring sample data and device topology sample data of the industrial Internet of Things device to be tested, and Q represents the preset abnormal threshold of the trained spatiotemporal feature extraction model.

4. The unsupervised anomaly detection method for industrial Internet of Things devices based on adaptive deep representation learning according to claim 2 is characterized in that: The abnormality detection status of the industrial Internet of Things device under test under each monitoring indicator is obtained based on the reconstruction error of each monitoring indicator through the corresponding independent discriminator based on the preset abnormality threshold, including: The reconstruction error of each monitoring indicator is compared with the corresponding preset abnormal threshold through the corresponding independent discriminator. When the reconstruction error exceeds the preset abnormal threshold, the monitoring indicator is judged to be abnormal.

5. The unsupervised anomaly detection method for industrial Internet of Things devices based on adaptive deep representation learning according to any one of claims 1 to 4, characterized in that: The spatiotemporal feature extraction model includes LSTM modules, According to the spatiotemporal characteristics of each monitoring indicator, the abnormal detection status of the industrial Internet of Things device under test under each monitoring indicator is obtained through independent discriminators, including: For each monitoring indicator data, the predicted data of each monitoring indicator is obtained through the LSTM module of the corresponding spatiotemporal feature extraction model.

6. The unsupervised anomaly detection method for industrial Internet of Things devices based on adaptive deep representation learning according to claim 5 is characterized in that: The method of obtaining the final abnormality detection status of the industrial Internet of Things device under test by combining the discriminator based on the abnormality detection status of the industrial Internet of Things device under test under each monitoring indicator includes: Based on the anomaly detection status of the IIoT device under each monitoring indicator, a weighted sum method, a multi-layer perceptron, an attention mechanism, or a graph neural network is used to obtain a final anomaly detection status of the IIoT device under test; and / or, The method of obtaining the final abnormality detection status of the industrial Internet of Things device under test by combining the discriminator based on the abnormality detection status of the industrial Internet of Things device under test under each monitoring indicator includes: Issue an abnormal warning based on the abnormal detection status and prediction data of the industrial Internet of Things equipment under test under each monitoring indicator; or Based on the final anomaly detection results of the industrial IoT device under test and the predicted data of each monitoring indicator, an anomaly warning is issued.

7. An unsupervised anomaly detection system for industrial IoT devices based on adaptive deep representation learning, characterized in that: include: A data acquisition module is used to obtain real-time monitoring data and device topology data of the industrial Internet of Things device to be tested, wherein the real-time monitoring data includes at least two types of monitoring indicator data; The spatiotemporal feature extraction module is used to: obtain the spatiotemporal features of each monitoring indicator data through the spatiotemporal feature extraction model based on the real-time monitoring data and device topology data of the industrial Internet of Things device to be tested; The independent anomaly detection module is used to obtain the anomaly detection status of the industrial Internet of Things device under test under each monitoring indicator through an independent discriminator based on the spatiotemporal characteristics of each monitoring indicator; The comprehensive anomaly detection module is used to obtain the final anomaly detection status of the industrial Internet of Things device under test by combining the discriminators based on the anomaly detection status of the industrial Internet of Things device under test under each monitoring indicator; Among them, the spatiotemporal feature extraction model includes GCN module and TCN module. The GCN module includes attention mechanism, and the TCN module includes dilated causal convolution layer and residual block stacking. According to the real-time monitoring data and device topology data of the industrial Internet of Things device to be tested, for each monitoring indicator data, the spatiotemporal feature of each monitoring indicator is obtained by respectively using the spatiotemporal feature extraction model, including: Based on the real-time monitoring data and device topology data of the industrial IoT devices to be tested, for each monitoring indicator data, the GCN module of the corresponding spatiotemporal feature extraction model is used to fuse the device topology data using the attention mechanism to obtain the spatial features of each monitoring indicator; According to the spatial characteristics of each monitoring indicator, the temporal hidden representation of each monitoring indicator is obtained through the TCN module of the corresponding spatiotemporal feature extraction model; The spatial characteristics and temporal hidden representation of each monitoring indicator are integrated to obtain the spatiotemporal characteristics of each monitoring indicator.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, it implements the unsupervised anomaly detection method for industrial Internet of Things devices based on adaptive deep representation learning as described in any one of claims 1 to 6.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method for unsupervised anomaly detection of industrial Internet of Things devices based on adaptive deep representation learning is implemented.

Images