Method and device for detecting abnormal data of Internet of Things

Abstract

The invention provides an Internet of Things abnormal data detection method and device, and relates to the technical field of data processing, and the method comprises the steps: carrying out the data preprocessing of sensor original time sequence data collected by each Internet of Things sensor, and obtaining the preprocessed time sequence data of each sensor; wherein each piece of sensor time sequence data comprises sensor time sequence window data of a plurality of time windows; inputting the sensor time sequence window data into a multi-scale feature extraction model to obtain local features and global features of the sensor time sequence window data; inputting the local features and the global features of the sensor time sequence window data into a bidirectional attention reconstruction model, and outputting reconstructed local features and reconstructed global features; based on the local features, the global features, the reconstructed local features and the reconstructed global features of the sensor time sequence window data, similarity analysis and disharmony discovery analysis are carried out, and abnormal sensor time sequence window data are determined.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a method and device for detecting abnormal data in the Internet of Things. Background Art

[0002] IoT time series anomaly detection has important application value in tasks such as equipment monitoring and fault warning. Its core goals include timely identification of abnormal patterns in time series data collected by edge sensors and real-time detection and warning when anomalies occur, as well as accurate segmentation of variable-length abnormal time periods to support automatic extraction of representative abnormal behaviors from massive monitoring data.

[0003] Therefore, how to effectively detect abnormal data from IoT sensors has become an urgent problem to be solved in the industry. Summary of the Invention

[0004] The present invention provides an Internet of Things abnormal data detection method and device, which are used to solve the problem of how to effectively detect abnormal data of Internet of Things sensors in the prior art.

[0005] The present invention provides a method for detecting abnormal data in the Internet of Things, comprising: Preprocessing the original sensor time series data collected by each IoT sensor to obtain preprocessed sensor time series data; wherein each of the sensor time series data includes sensor time series window data of multiple time windows; Inputting the sensor time series window data into a multi-scale feature extraction model to obtain local features and global features of the sensor time series window data; Inputting the local features and global features of the sensor time series window data into a bidirectional attention reconstruction model, and outputting reconstructed local features and reconstructed global features; Based on the local features, global features, and reconstructed local features and reconstructed global features of the sensor time series window data, similarity analysis and discordance discovery analysis are performed to determine abnormal sensor time series window data.

[0006] According to the present invention, a method for detecting abnormal data in the Internet of Things is provided. Based on the local features and global features of the sensor time series window data, and the reconstruction of the local features and the reconstruction of the global features, similarity analysis and discordance discovery analysis are performed to determine abnormal sensor time series window data, including: Determine the contrast loss corresponding to each sensor time series window data based on the local features and global features of each sensor time series window data, so as to determine the first suspicious sensor time series window data in each of the sensor time series window data according to the contrast loss; Determine, based on the reconstructed local features and the reconstructed global features corresponding to each sensor time series window data, a reconstruction error corresponding to each sensor time series window data, and determine second suspicious sensor time series window data in each of the sensor time series window data; By using a discordance discovery algorithm, abnormal section analysis is performed on the first suspicious sensor time series window data and the second suspicious sensor time series window data to obtain abnormal sensor time series window data.

[0007] According to a method for detecting abnormal data in the Internet of Things provided by the present invention, before the step of inputting the sensor time series window data into a multi-scale feature extraction model to obtain local features and global features of the sensor time series window data, the method further includes: Preprocessing the sensor sample time series data of each IoT sensor to obtain preprocessed sensor sample time series data; Performing random data enhancement on the sensor sample time series data to obtain a negative sample of the sensor sample time series data; Based on the sensor sample time series data and the negative samples of the sensor sample time series data, a multi-scale feature extraction model is trained to output corresponding local feature samples, global feature samples, local feature negative samples, and global feature negative samples; wherein the multi-scale feature extraction model includes a local convolutional network and a global convolutional network with shared weights; Based on the local feature samples, global feature samples, local feature negative samples, and global feature negative samples, a bidirectional attention reconstruction model is trained to output corresponding reconstructed local feature samples and reconstructed global feature samples.

[0008] According to a method for detecting abnormal data in the Internet of Things provided by the present invention, a multi-scale feature extraction model is trained based on the sensor sample time series data and the negative samples of the sensor sample time series data, including: Perform cross-scale contrast loss calculation and intra-scale contrast loss calculation based on the local feature samples, the global feature samples, the local feature negative samples, the global feature negative samples, the sensor sample time series data, and the sensor sample time series data negative samples; Calculating a multi-scale contrast total loss based on the cross-scale contrast loss and the intra-scale contrast loss; The multi-scale feature extraction model is optimized according to the multi-scale contrast total loss until a first preset condition is met, thereby obtaining a trained multi-scale feature extraction model.

[0009] According to a method for detecting abnormal data in the Internet of Things provided by the present invention, the bidirectional attention reconstruction model is trained based on the local feature samples, the global feature samples, the local feature negative samples, and the global feature negative samples, including: Through the negative sample-aware bidirectional attention mechanism, the local feature sample, the global feature sample, the local feature negative sample, and the global feature negative sample are used as queries and keys, and attention weights are calculated to reconstruct the local feature sample and the global feature sample according to the attention weights to obtain reconstructed local feature samples and reconstructed global feature samples; According to the reconstructed local feature samples and the reconstructed global feature samples, as well as the original local feature samples, global feature samples, local feature negative samples, and global feature negative samples, the regularization loss is calculated. According to the regularization loss, the bidirectional attention reconstruction model is optimized until the second preset training condition is met to obtain a trained bidirectional attention reconstruction model.

[0010] According to a method for detecting abnormal data in the Internet of Things provided by the present invention, the data preprocessing method includes at least one of the following: Introducing random noise, applying random scaling factors, adjusting the signal amplitude according to a smooth curve, and rearranging parts of the time series.

[0011] The present invention also provides an IoT abnormal data detection device, comprising the following modules: A preprocessing module is used to preprocess the original sensor time series data collected by each IoT sensor to obtain preprocessed sensor time series data; wherein each of the sensor time series data includes sensor time series window data of multiple time windows; A first input module is used to input the sensor time series window data into a multi-scale feature extraction model to obtain local features and global features of the sensor time series window data; A second input module is used to input the local features and global features of the sensor time series window data into the bidirectional attention reconstruction model, and output the reconstructed local features and the reconstructed global features; The detection module is used to perform similarity analysis and discordance detection analysis based on the local features, global features, and reconstructed local features and reconstructed global features of the sensor time series window data to determine abnormal sensor time series window data.

[0012] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the method for detecting abnormal data in the Internet of Things as described above is implemented.

[0013] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements any of the above-described methods for detecting abnormal data in the Internet of Things.

[0014] The present invention also provides a computer program product, comprising a computer program, which, when executed by a processor, implements any of the above-described methods for detecting abnormal data in the Internet of Things.

[0015] The IoT anomaly data detection method and device provided by the present invention preprocesses the raw time series data collected by various IoT sensors, including missing value filling, noise suppression, and normalization, to generate a unified multivariate time series format as input for subsequent modeling. This step addresses the issue of uneven sensor data quality, ensures the accuracy and consistency of the data input to the model, and lays the foundation for further feature extraction and analysis. The preprocessed sensor time series window data is input into a multi-scale feature extraction model, which can simultaneously capture both short-term and long-term dependencies in the time series, obtaining both local and global features of the data. This step, through multi-scale analysis, can more comprehensively characterize the characteristics of the time series, focusing on both subtle local changes and grasping overall global trends, effectively improving the model's ability to detect different types of anomalies. The extracted local and global features are input into a bidirectional attention reconstruction model, which outputs reconstructed local and global features. The design of the bidirectional attention reconstruction model enables the model to fully utilize the information interaction between local and global features, more accurately restoring the characteristic patterns of normal samples during the reconstruction process. In this way, the model learns the feature representations of normal samples and compares them with the original features in subsequent analysis to identify potential anomalies. Similarity analysis and discordance detection analysis are performed based on the local and global features of the sensor time series window data, as well as the reconstructed local and global features. Similarity analysis measures the degree of difference between the original and reconstructed features, while discordance detection further identifies anomalous portions that significantly deviate from the normal pattern. Through these two analyses, it is possible to accurately determine which sensor time series windows contain anomalies, thereby achieving precise detection and segmentation of anomalies. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions in the present invention or the prior art, a brief introduction is given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0017] Figure 1This is a flow chart of the method for detecting abnormal data in the Internet of Things provided by the present invention; Figure 2 A schematic diagram of the detection process provided by the present invention; Figure 3 A diagram of the multi-scale comparison process provided by the present invention; Figure 4 A diagram of the reconstruction process under multiple modes provided by the present invention; Figure 5 This is a schematic diagram of the structure of the abnormal data detection device for the Internet of Things provided by the present invention; Figure 6 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0018] To make the objectives, technical solutions, and advantages of the present invention more clear, the technical solutions of the present invention will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the embodiments described are only some of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0019] Figure 1 This is a flow chart of the method for detecting abnormal data in the Internet of Things provided by the present invention. Figure 1 As shown, the method includes the following: Step 110: preprocessing the original sensor time series data collected by each IoT sensor to obtain preprocessed sensor time series data; wherein each of the sensor time series data includes sensor time series window data of multiple time windows; In the present invention, the raw sensor time series data collected by the IoT sensors are the raw data collected by various sensors deployed in the IoT environment without any processing. These data are carried out in time series and reflect the status of the device or environment at different time points.

[0020] Raw sensor time series data is a continuous data stream generated by IoT sensors such as industrial equipment and environmental monitoring instruments during operation. For example, on an automated industrial production line, a temperature sensor records the device's temperature at regular intervals (e.g., every second), forming a time-varying temperature series. Similarly, a vibration sensor collects vibration intensity data in real time, generating a vibration intensity time series. This raw data may contain noise, missing values, and other issues, and the data format may vary depending on the sensor type.

[0021] Data preprocessing can refer to a series of operations performed on the collected raw time series data to improve the data quality and make it suitable for subsequent analysis and modeling.

[0022] More specifically, data preprocessing includes operations such as missing value completion (e.g., using interpolation to fill missing data points), noise suppression (e.g., using filtering techniques to remove random noise in the data), and normalization (e.g., scaling the data to a specific range to make data from different sensors comparable). For example, for temperature sensor data, if data at a certain time point is missing, an estimated value for that missing point can be obtained by linear interpolation using data from adjacent time points. For noisy vibration sensor data, a low-pass filter can be used to remove high-frequency noise while retaining the main vibration characteristics.

[0023] In this invention, preprocessed sensor time series data is complete, consistent, and comparable. For example, processed temperature sensor data eliminates missing values, effectively suppresses noise, and normalizes temperature values ​​to a range of 0-1. Vibration sensor data is similarly filtered and normalized, allowing data from different sensors to be compared and analyzed on the same scale.

[0024] In the present invention, the time series data of each sensor is divided into multiple time windows, and each time window corresponds to a continuous period of time series data.

[0025] Time windowing is used to split long series data into multiple shorter segments for easier model processing and analysis. For example, a temperature sensor time series data with 1000 time points can be divided into multiple time windows of length 100, each containing 100 consecutive temperature values. Adjacent time windows may or may not overlap.

[0026] After this division, the data in each time window can be input into the subsequent model as an independent sample for feature extraction and analysis.

[0027] Step 120: Input the sensor time series window data into a multi-scale feature extraction model to obtain local features and global features of the sensor time series window data; In the present invention, the sensor time series window data is a data segment within each time window obtained after dividing the sensor time series data into multiple time windows.

[0028] For example, a temperature sensor time series data with 1000 time points can be divided into multiple time windows of length 100. Each time window contains 100 consecutive temperature values, and adjacent time windows may or may not overlap. The data within each such time window is called sensor time series window data.

[0029] In the present invention, the multi-scale feature extraction model refers to a model that can simultaneously capture the short-term dependency and long-term dependency of a time series.

[0030] Multi-scale feature extraction models typically consist of two branches: one for extracting local features and the other for extracting global features. For example, the local feature extraction branch might use causal convolution to capture short-term dependencies, while the global feature extraction branch might use dilated convolution to expand the receptive field to capture long-term dependencies.

[0031] In this paper, local features reflect the characteristics of time series variation on short-term timescales. Local features can be obtained by processing sensor time series window data using the local feature extraction branch of a multi-scale feature extraction model. For example, in temperature sensor data, local features may reflect the temperature fluctuation pattern over a short period of time (e.g., a few minutes).

[0032] Global features reflect the changing trends and overall patterns of a time series over long timescales. Global features can be obtained by processing sensor time series window data using the global feature extraction branch of the multi-scale feature extraction model. For example, in temperature sensor data, global features may reflect the overall temperature trend over a longer period of time, such as hours or days.

[0033] Step 130: Input the local features and global features of the sensor time series window data into a bidirectional attention reconstruction model, and output the reconstructed local features and the reconstructed global features; In the present invention, the local features and global features of the sensor time series window data extracted in step 120 are passed as input to the bidirectional attention reconstruction model.

[0034] In the present invention, the bidirectional attention reconstruction model is a model that uses the attention mechanism to reconstruct input features, aiming to generate reconstructed local features and global features through the interaction of local and global features.

[0035] The bidirectional attention reconstruction model consists of two main parts, one for processing local features and the other for processing global features. It uses a bidirectional attention mechanism to allow these two parts to interact and influence each other. In this way, the model can more accurately capture the characteristic patterns of normal samples and attempt to reconstruct the input features.

[0036] The model processes the input local and global features through a bidirectional attention mechanism to generate corresponding reconstructed local and global feature vectors. These reconstructed feature vectors are compared with the original feature vectors to assess the degree of abnormality of the sample.

[0037] Consider a temperature sensor whose time series window data contains a local feature vector [0.1, 0.3, 0.5] and a global feature vector [0.2, 0.4, 0.6]. After inputting these features into the bidirectional attention reconstruction model for processing, the model outputs a reconstructed local feature vector of [0.12, 0.31, 0.49] and a reconstructed global feature vector of [0.21, 0.39, 0.62]. By comparing the differences between the original and reconstructed features, we can determine whether the sensor's time series window data contains anomalies.

[0038] Step 140 : Based on the local features, global features, and reconstructed local features and global features of the sensor time series window data, similarity analysis and discordance detection analysis are performed to identify abnormal sensor time series window data. The similarity between the original local features and global features and the reconstructed local features and global features is compared.

[0039] In the present invention, similarity analysis specifically refers to calculating the similarity between original and reconstructed features using a similarity metric function (such as cosine similarity). For example, for the original local feature vector [0.1, 0.3, 0.5] and the reconstructed local feature vector [0.12, 0.31, 0.49], their similarity score can be calculated using cosine similarity. A higher similarity score indicates a closer match between the original and reconstructed features, while a lower similarity score indicates a greater difference.

[0040] In this invention, discordance detection analysis utilizes discordance detection algorithms, such as the MERLIN algorithm, to detect anomalous patterns in time series. This algorithm calculates the similarity between subsequences to quickly locate abnormal segments of variable length within massive amounts of data. For example, in temperature sensor data, if the temperature variation pattern within a certain time window is significantly different from other normal patterns, discordance detection analysis will mark that time window as anomalous.

[0041] In the present invention, the raw time series data collected by each IoT sensor is subjected to data preprocessing operations, including missing value filling, noise suppression, and normalization, to generate a multivariate time series in a unified format as input for subsequent modeling. This step solves the problem of uneven sensor data quality, ensures the accuracy and consistency of the data input into the model, and lays the foundation for further feature extraction and analysis. The preprocessed sensor time series window data is input into a multi-scale feature extraction model, which can simultaneously capture the short-term and long-range dependencies in the time series and obtain local and global features of the data. This step can more comprehensively characterize the characteristics of the time series through multi-scale analysis, paying attention to both local subtle changes and grasping the overall trend of the world, effectively improving the model's ability to detect different types of anomalies. The extracted local features and global features are input into a bidirectional attention reconstruction model, which outputs reconstructed local features and reconstructed global features. The design of the bidirectional attention reconstruction model enables the model to fully utilize the information interaction between local and global features, and more accurately restore the characteristic patterns of normal samples during the reconstruction process. In this way, the model learns the feature representations of normal samples and compares them with the original features in subsequent analysis to identify potential anomalies. Similarity analysis and discordance detection analysis are performed based on the local and global features of the sensor time series window data, as well as the reconstructed local and global features. Similarity analysis measures the degree of difference between the original and reconstructed features, while discordance detection further identifies anomalous portions that significantly deviate from the normal pattern. Through these two analyses, it is possible to accurately determine which sensor time series windows contain anomalies, thereby achieving precise detection and segmentation of anomalies.

[0042] Optionally, performing similarity analysis and discordance detection analysis based on the local features, global features, and reconstructed local features and reconstructed global features of the sensor time series window data to determine abnormal sensor time series window data includes: Determine the contrast loss corresponding to each sensor time series window data based on the local features and global features of each sensor time series window data, so as to determine the first suspicious sensor time series window data in each of the sensor time series window data according to the contrast loss; Determine, based on the reconstructed local features and the reconstructed global features corresponding to each sensor time series window data, a reconstruction error corresponding to each sensor time series window data, and determine second suspicious sensor time series window data in each of the sensor time series window data; By using a discordance discovery algorithm, abnormal section analysis is performed on the first suspicious sensor time series window data and the second suspicious sensor time series window data to obtain abnormal sensor time series window data.

[0043] In this paper, for each sensor time series window, the contrastive loss is calculated using its local and global features. This contrastive loss measures the difference between the original and reconstructed features. For example, for a given sensor time series window, the contrastive loss is calculated by comparing the original and reconstructed local features, as well as the original and reconstructed global features. Common contrastive loss functions include mean squared error (MSE) and cosine similarity.

[0044] Based on the contrast loss, sensor time series window data with large contrast loss is selected as the first suspicious data. A contrast loss threshold is set. For all sensor time series window data, if the contrast loss of a data exceeds the set threshold, it is considered highly likely to be abnormal and is thus identified as the first suspicious sensor time series window data.

[0045] For each sensor time series window, the reconstruction error is calculated using its reconstructed local and global features. The reconstruction error reflects the degree of difference between the original and reconstructed features. For example, for a given sensor time series window, the reconstruction error is calculated by comparing its original and reconstructed local features, and its original and reconstructed global features. Common reconstruction error functions include mean squared error (MSE) and absolute error.

[0046] Based on the size of the reconstruction error, the sensor time series window data with a large reconstruction error is selected as the second suspicious data. A reconstruction error threshold is set. For all sensor time series window data, if the reconstruction error of a data exceeds the set threshold, it is considered that the data is likely to be abnormal and is thus identified as the second suspicious sensor time series window data.

[0047] More specifically, a discordance detection algorithm is used to comprehensively analyze the first and second suspicious sensor time series window data to determine the final abnormal sensor time series window data. Discordance detection algorithms (such as the MERLIN algorithm) calculate the similarity between subsequences to quickly locate variable-length abnormal segments in massive data.

[0048] For example, the first suspicious and second suspicious sensor time series window data are input into the inharmony discovery algorithm. The algorithm will analyze the distribution and pattern of these suspicious data in the time series and ultimately determine which sensor time series window data are abnormal.

[0049] In the present invention, the contrast loss and reconstruction error can be effectively combined, and the inharmonic discovery algorithm can be used to perform abnormal segment analysis, thereby accurately locating abnormal sensor time series window data.

[0050] Optionally, before the step of inputting the sensor time series window data into a multi-scale feature extraction model to obtain local features and global features of the sensor time series window data, the method further includes: Preprocessing the sensor sample time series data of each IoT sensor to obtain preprocessed sensor sample time series data; Performing random data enhancement on the sensor sample time series data to obtain a negative sample of the sensor sample time series data; Based on the sensor sample time series data and the negative samples of the sensor sample time series data, a multi-scale feature extraction model is trained to output corresponding local feature samples, global feature samples, local feature negative samples, and global feature negative samples; wherein the multi-scale feature extraction model includes a local convolutional network and a global convolutional network with shared weights; Based on the local feature samples, global feature samples, local feature negative samples, and global feature negative samples, a bidirectional attention reconstruction model is trained to output corresponding reconstructed local feature samples and reconstructed global feature samples.

[0051] In the present invention, the sensor sample time series data of each IoT sensor is preprocessed to obtain the preprocessed sensor sample time series data.

[0052] The preprocessing steps include missing value filling, noise suppression, and normalization, with the aim of improving data quality and making it suitable for subsequent analysis and modeling.

[0053] For example, for temperature sensor data, if the data at a certain time point is missing, the estimated value of the missing point can be obtained by linear interpolation of the data at adjacent time points; for vibration sensor data containing noise, a low-pass filter can be used to filter out high-frequency noise and retain the main vibration characteristics.

[0054] Specifically, let the original time series be , split it into several random lengths Window ;in Represents the starting point. The following enhancement operations can be applied to each window: (1) Introduce random noise into the data in the following form: ; in is the noise added at a specific time step, Represents variance.

[0055] (2) Apply a random scaling factor to the data, defined as: ; in is the scaling factor acting on each time step.

[0056] (3) According to the smooth curve, the signal amplitude is adjusted. The present invention uses a Butterworth filter to highlight the main frequency components: ; in is the cutoff frequency.

[0057] (4) Rearrange some sections of the time series without changing the specific values ​​of individual data points. Its form can be described as: ; in The sequence index of the randomly shuffled fragments.

[0058] Through the above-mentioned multiple enhancement methods, a variety of potential abnormal morphologies can be simulated on the original normal sequence.

[0059] The subsequent contrastive learning process treats these "pseudo-anomalies" as negative samples, allowing the model to better learn the difference between normal and abnormal patterns.

[0060] In the present invention, a multi-scale feature extraction model is trained based on sensor sample time series data and negative samples of sensor sample time series data, and corresponding local feature samples, global feature samples, local feature negative samples, and global feature negative samples are output.

[0061] The multi-scale feature extraction model consists of a local convolutional network and a global convolutional network with shared weights. The local convolutional network uses causal convolution to capture short-term dependencies, while the global convolutional network uses dilated convolution to capture long-term dependencies. During training, the model learns feature representations of normal and negative samples at both local and global scales, enabling it to distinguish between normal and abnormal patterns.

[0062] In the present invention, the bidirectional attention reconstruction model is trained based on local feature samples, global feature samples, local feature negative samples, and global feature negative samples, and the corresponding reconstructed local feature samples and reconstructed global feature samples are output.

[0063] The bidirectional attention reconstruction model leverages the information interaction between local and global features to reconstruct features through an attention mechanism. During training, the model learns the characteristic patterns of normal samples and can accurately reconstruct the local and global features of normal samples while maintaining differences from the reconstruction results of negative samples. This helps improve the model's ability to capture abnormal features.

[0064] Optionally, training a multi-scale feature extraction model based on the sensor sample time series data and the negative samples of the sensor sample time series data includes: Perform cross-scale contrast loss calculation and intra-scale contrast loss calculation based on the local feature samples, the global feature samples, the local feature negative samples, the global feature negative samples, the sensor sample time series data, and the sensor sample time series data negative samples; Calculating a multi-scale contrast total loss based on the cross-scale contrast loss and the intra-scale contrast loss; The multi-scale feature extraction model is optimized according to the multi-scale contrast total loss until a first preset condition is met, thereby obtaining a trained multi-scale feature extraction model.

[0065] In the present invention, the intra-scale contrast loss calculation refers to calculating the similarity between different views of the same real sample for feature samples at the same scale and maximizing this similarity; at the same time, calculating the similarity between the real sample and other samples and minimizing this similarity.

[0066] For example, for a local feature sample, its similarity with other local feature views of the same real sample is calculated, and then the similarity between this local feature sample and the local features of all other samples is calculated.

[0067] Cross-scale contrastive loss calculation involves calculating the similarity between the feature representations of the same true sample at different scales and maximizing this similarity. Simultaneously, it calculates the similarity between the feature representation of the true sample at one scale and the feature representation of the negative sample at another scale and minimizes this similarity. For example, the similarity between a local feature sample and a global feature sample is calculated, and then the similarity between the local feature sample and the global feature negative sample is calculated.

[0068] More specifically, in practical applications, the length and periodicity of time series data vary significantly. For example, monitoring data for some devices may be sampled at a high frequency, resulting in a very long time series; while monitoring data for other devices may be sampled at a low frequency, resulting in a shorter time series. Furthermore, the operating cycles of different devices may also vary; some devices may complete a full operating cycle every hour, while others may only complete a full operating cycle every day. Traditional fixed-length block partitioning methods struggle to adapt to this diversity, potentially leading to inaccurate feature extraction or inefficient computation. The adaptive multi-scale block partitioning strategy can dynamically determine the block length based on the length and characteristics of the time series data, thereby better extracting features and improving computational efficiency.

[0069] For a given time series, first analyze its length and periodic characteristics. Then, find a suitable block length so that the factor distribution of the block length is more reasonable, which is convenient for subsequent feature extraction operations. At the same time, the block length should be as close as possible to the original time series length to reduce information loss and computational complexity. For example, if the original time series length is 1000, the possible block lengths can be 500, 200, 250, etc., but the factor distribution must be reasonable and not much different from 1000. Reasonable factor distribution means that the length of each block after block division should be divisible by some common convolution kernel sizes to facilitate convolution operations.

[0070] After determining the appropriate block length, the original time series is divided into multiple continuous or discontinuous subsequences (patches). These subsequences serve as input to subsequent local and global convolutional networks to extract short-term and long-term dependency features. For example, a time series of length 1000 can be divided into two patches of length 500, or four patches of length 250, depending on the selected block length. Each patch can be processed independently by the local and global convolutional networks, extracting features at different scales.

[0071] More specifically, the multi-scale feature extraction module includes causal convolution to capture short-term dependencies. Its core operation can be expressed as:

[0072] in, Indicates the Layer network at time The output (local scale), is the activation function (such as ReLU, sigmoid, etc.), The convolution kernel size is All indexes of Sum, For the The convolution kernel of the layer is at index The weight of For the Layer network at time The output features of For the The bias term of the layer.

[0073] In addition, the dilated convolution module in the multi-scale feature extraction module expands the receptive field of the time dimension to capture long-range dependencies. The formula is as follows:

[0074] in Indicates the Layer network at time The output of (global scale), is the activation function (such as ReLU, tanh, etc.), is the convolution kernel size, For the Layer dilated convolution at index The weight of is the void coefficient, Indicates the Layer network at time The output features of For the The bias term of the layer.

[0075] After inputting the input sequence into the local convolutional network and the global convolutional network respectively, the short-term and long-term feature representations can be obtained in parallel. and . Then the Transformer structure is introduced to perform deep relationship modeling, and finally we get and , negative samples share the feature extraction module at multiple scales and maintain the same data flow as positive samples.

[0076] A further approach to constrained data construction is to treat the two perspectives of the same real sample in a batch as positive samples, and other samples or data enhancements as negative samples. The intra-scale contrast loss used in this invention is:

[0077] in is the intra-scale contrast loss, For scale Feature representation (local or global), is a set of batch samples, For The set of positive sample pairs belonging to the same real sample, is a similarity measurement function (such as cosine similarity), For the Samples at scale Some kind of data augmentation version of .

[0078] Under normal circumstances, local and global features usually maintain consistency; if there is an anomaly, it is difficult for the two scales to maintain high similarity at the same time. To this end, the cross-scale contrast loss adopted in this paper is:

[0079] in is the cross-scale contrast loss, is the sum of similarities of positive samples in the same scale, represents a set of negative sample pairs from different scales, For Different scales The feature representation of are the corresponding non-self positive samples in the same scale.

[0080] Combining the above two parts, we get the total loss of multi-scale comparison:

[0081] in is the multi-scale contrast loss, To adjust the hyperparameters of the importance of the same-scale and cross-scale comparison, .

[0082] In this paper, an optimization algorithm is used to update the parameters of the multi-scale feature extraction model based on the total multi-scale contrast loss to minimize this loss function. In each iteration, the total multi-scale contrast loss is calculated for the current model parameters, and the model parameters are adjusted based on the loss value, gradually improving the model's ability to distinguish between normal and negative samples.

[0083] The optimization process continues until the first precondition is met. Common preconditions include reaching the maximum number of training iterations, the loss value falling below a certain threshold, and no further performance improvement on the validation set. When the stopping condition is met, the model is considered trained and a trained multi-scale feature extraction model is obtained.

[0084] In this paper, two mainstream deep learning methods based on contrastive learning and reconstruction models are unified. This method covers a multi-scale feature extraction module and a multi-mode negative sample-aware bidirectional attention reconstruction module. It constructs a local-global multi-scale contrastive learning process, and constructs a reconstruction process by designing a local-global attention mechanism with bidirectional fusion of negative sample perception, thus achieving a bidirectional association between the contrast process and the reconstruction process. It effectively integrates the respective advantages of the contrast model and the reconstruction model, overcomes the problems of traditional contrastive learning models' over-reliance on data augmentation strategies and insufficient consistency between local and global information, and suppresses the overfitting phenomenon of the reconstruction model in small abnormal areas.

[0085] Optionally, the training of the bidirectional attention reconstruction model based on the local feature samples, the global feature samples, the local feature negative samples, and the global feature negative samples includes: Through the negative sample-aware bidirectional attention mechanism, the local feature sample, the global feature sample, the local feature negative sample, and the global feature negative sample are used as queries and keys, and attention weights are calculated to reconstruct the local feature sample and the global feature sample according to the attention weights to obtain reconstructed local feature samples and reconstructed global feature samples; According to the reconstructed local feature samples and the reconstructed global feature samples, as well as the original local feature samples, global feature samples, local feature negative samples, and global feature negative samples, the regularization loss is calculated. According to the regularization loss, the bidirectional attention reconstruction model is optimized until the second preset training condition is met to obtain a trained bidirectional attention reconstruction model.

[0086] In the present invention, through the negative sample-aware bidirectional attention mechanism, the model uses local feature samples, global feature samples and corresponding negative sample features as queries and keys to calculate attention weights during training, thereby guiding the reconstruction process.

[0087] This attention-based reconstruction method enables the model to learn the characteristic patterns of normal samples more specifically based on the relationship between the features of positive and negative samples, ensuring that the reconstructed local feature samples and global feature samples are as close as possible to the original normal sample features while maintaining differences with the negative sample features, which helps the model accurately capture the characteristic differences between normal and abnormal samples.

[0088] When calculating the regularization loss, the model compares the reconstructed features with the original positive and negative sample features. This prompts the model to continuously correct its own reconstruction results during training, making the reconstruction error of normal samples as small as possible and the reconstruction error of negative samples as large as possible.

[0089] After such training, the model can better distinguish normal samples from abnormal samples, improve sensitivity to abnormal patterns, reduce the occurrence of missed reports and false positives, and enhance the ability to effectively identify various types of anomalies in practical applications.

[0090] In the present invention, the bidirectional attention reconstruction model is optimized according to the regularization loss, which can provide a clear direction and goal for model training.

[0091] The optimization process continuously adjusts model parameters, gradually reducing the loss until a second pre-set training condition is met, such as reaching a certain number of training iterations or the loss falling below a set threshold. This helps ensure the stability and effectiveness of model training, allowing the model to ultimately converge to a preferred parameter state, providing reliable feature reconstruction and discrimination capabilities for subsequent anomaly detection tasks.

[0092] More specifically, the present invention designs a reconstruction technology of negative sample-aware bidirectional attention mechanism, and Each other as a query (query) and key (key), get the updated reconstructed sequence and The following is an example: ; ; in and Respectively The reconstructed sequence after the update, and Respectively The local-global characteristics of the update time, and is the attention matrix between local and global, The projection matrix of the "value" vector (value).

[0093] If the original sequence is , then the results of local and global guided reconstruction should be consistent with Maintain a high similarity. Measured by mean square error: ; in is the mean square error of the reconstruction process, Indicates the total length of the sequence, Represents the input sequence at time The true value of and Respectively local / global reconstruction at time Output.

[0094] In order to prevent the model from over-reconstructing abnormal areas, the present invention designs a reconstruction module that is aware of negative samples and uses contrast loss. As a regularization term: ; in is the regularization loss of the reconstruction link, is a set of batch samples, and Represents the reconstruction result obtained after data augmentation or anomaly simulation.

[0095] is the reconstruction loss after synthesis, To balance the reconstruction error and regularization loss The hyperparameters are expressed as: ; In this paper, an optimization algorithm (such as Adam or stochastic gradient descent) is used to minimize the regularization loss. In each iteration, the regularization loss value under the current model parameters is calculated, and then the model parameters are adjusted according to the loss value.

[0096] The purpose of updating the model parameters is to make the reconstructed local feature samples and global feature samples closer to the original local feature samples and global feature samples, while making the reconstruction error of the negative samples larger, thereby enhancing the model's ability to distinguish normal and abnormal patterns.

[0097] Through continuous optimization, the model gradually learns how to more accurately reconstruct the local and global features of normal samples, and can effectively distinguish normal samples from negative samples (abnormal patterns).

[0098] Finally, when the optimization process meets the second preset training condition (such as reaching the predetermined number of training rounds, the loss value is stable, or the performance of the validation set reaches a satisfactory level), the training is completed and a trained bidirectional attention reconstruction model is obtained.

[0099] In this paper, we design and implement a bidirectional fusion local-global attention mechanism for negative sample perception. This promotes information exchange between the contrastive learning and reconstruction processes, and incorporates contrastive loss as a regularization term, enabling accurate reconstruction of normal samples while making reconstruction of abnormal samples difficult. This fully utilizes and coordinates local and global information in normal regions, effectively improving the model's ability to capture abnormal features and overcoming the problem of reconstruction problems in small abnormal regions caused by the model's strong robustness.

[0100] In an optional embodiment, the present invention also includes both event-level and segmentation-level evaluation. For event-level evaluation, the desired anomaly location is obtained. If the detected location deviates from the true location within a range of ±100 data points, it is considered accurate (score 1.0); otherwise, it is considered inaccurate (score 0.0). The accuracy of all anomaly events is averaged to obtain the final accuracy score. The model's segmentation capability is evaluated using the original F1 and the F1 under PA%K.

[0101] For segmentation-level evaluation, standard F1 and F1 under Affiliation are used for evaluation. Specifically, standard F1 score is a strict point-by-point metric used to calculate precision and recall without time tolerance; F1 under PA%K is a robust metric that balances point-by-point precision and event-level recall. The predicted value at time step n is for: ; in is the anomaly score, is the detection threshold, It's a real abnormal fragment. belong ,and Controlling The minimum detection ratio in . This metric calculates the area under the precision-recall curve for different values ​​of K.

[0102] F1 under Affiliation is a temporal proximity-aware metric with probabilistic matching, denoted as F1-Aff. It evaluates detection performance by weighting precision based on predicted relevance and recall based on ground-truth coverage, emphasizing alignment rather than precise boundaries.

[0103] Figure 2 The detection process diagram provided by the present invention is as follows: Figure 2 As shown, including: Step S1, input time series + preprocessing + partitioning sliding windows: preprocess the original IoT sensor time series data (such as missing value filling, noise suppression, normalization, etc.), and then partition it into sliding windows to generate sequence data of multiple time windows.

[0104] Step S2, generate negative samples (training phase) + instance normalization: In the training phase, data augmentation is performed on the preprocessed data to generate negative samples, and the instances are normalized.

[0105] Step S3, multi-scale comparison process (process 1): Multi-scale adaptive patch: Perform multi-scale adaptive patch processing on data.

[0106] Local feature representation contrast network: extract local features and perform comparison.

[0107] Global Feature Representation Contrast Network: Extracts global features and compares them. Local and global feature contrast networks share weights.

[0108] This step captures feature representations at different scales through contrastive learning.

[0109] Step S4, reconstruction process in multiple modes (process 2): Negative Sample-Aware Bidirectional Attention Mechanism Reconstruction Network: Negative sample-aware bidirectional attention mechanism is used to reconstruct features and share weights.

[0110] This step aims to learn more robust feature representations by reconstructing the network for subsequent anomaly detection.

[0111] Step S5, consistent discovery algorithm under multiple processes (processes 1 and 2): Combine the results of steps S3 and S4 and use the consistent discovery algorithm to perform anomaly detection.

[0112] Abnormal window voting in multiple modes: Abnormal windows are determined through the multi-mode abnormal window voting mechanism.

[0113] Step S6, event-level and segmentation-level evaluation system: Evaluate the detection results, including event-level and segmentation-level evaluation, to verify the performance of the model.

[0114] The entire process begins with data preprocessing and continues through multiple steps, including feature extraction, contrastive learning, feature reconstruction, and anomaly detection. Ultimately, an evaluation system is used to measure the performance of the entire anomaly detection system. This multi-step, multi-module approach aims to improve the accuracy and efficiency of anomaly detection in IoT time series data.

[0115] Figure 3 The multi-scale comparison process diagram provided by the present invention is as follows: Figure 3 As shown in the figure, data preprocessing and negative sample generation are performed. After the raw time series data is input, a sliding window operation is performed to divide the long sequence into multiple short sequence segments to meet the model's batch processing requirements. Each short sequence segment is instance-normalized to a mean of 0 and a standard deviation of 1. This eliminates dimensional and statistical differences between sensor data and accelerates model convergence. Negative samples are generated by perturbing the original sequence using data augmentation techniques, including random region selection and augmentation methods such as scaling, permutation, warping, and jittering.

[0116] Adaptive multi-scale patching calculates the power spectrum density to obtain the maximum cycle length, and performs adaptive multi-scale patching based on this length, dividing the time series into segments of different lengths to adapt to feature extraction at different scales.

[0117] The local feature extraction network and the global feature extraction network share weights and are responsible for extracting local features and global features respectively. Local features reflect the changes of time series on a short-term time scale, while global features reflect the changing trends and patterns of time series on a long-term time scale.

[0118] Transformer block, the extracted local and global features are processed by the Transformer block. The Transformer block uses the self-attention mechanism to capture the long-term dependencies in the feature sequence, and transforms and fuses the features to enhance the expressiveness of the features.

[0119] Multi-patch renormalization performs multi-patch renormalization on the features output by the Transformer block and normalizes the features to make them have more stable statistical characteristics, which is convenient for subsequent comparative learning.

[0120] Intra-domain consistency comparison representation, within the same scale, the similarity between different samples is calculated to obtain the intra-domain consistency comparison representation, which measures the feature similarity of different samples at the same scale.

[0121] Inter-domain consistency comparison representation, at different scales, the similarity between local features and global features is calculated to obtain the inter-domain consistency comparison representation, which measures the consistency between local features and global features.

[0122] Compare positive and negative samples, and calculate the similarity between positive and negative samples at the same scale and different scales.

[0123] Intra-domain contrast loss and inter-domain contrast loss: Based on the similarity calculation results, the intra-domain contrast loss and inter-domain contrast loss are obtained.

[0124] Learnable parameters,The model contains learnable parameters, which are continuously adjusted by the optimization algorithm during the training process to minimize the contrast loss function.

[0125] Optimization process. During the training process, the model uses an optimization algorithm (such as stochastic gradient descent or Adam optimizer) to update the learnable parameters according to the value of the contrast loss function, thereby optimizing the performance of the model.

[0126] Figure 4 The reconstruction process diagram under multiple modes provided by the present invention is as follows: Figure 4 As shown in the figure, the reconstruction of a positive sample begins with the original sequence. After preprocessing, such as feature extraction, the original sequence is input into a local-global fusion bidirectional attention network. This network fuses local and global feature information and outputs a locally guided reconstruction vector and a globally guided reconstruction vector. These two vectors are concatenated to form the reconstruction vector of the positive sample. The reconstruction vector of the positive sample is used to reconstruct the original sequence. The goal is to minimize the reconstruction loss, meaning that the reconstructed sequence should be as close to the original as possible.

[0127] The negative-aware reconstruction process also begins with the original sequence. The original sequence is input into the negative-aware network, which also outputs a locally guided negative reconstruction vector and a globally guided negative reconstruction vector. These two vectors are concatenated to form the negative-aware reconstruction vector. The negative-aware reconstruction vector is used to distinguish between positive and negative samples. The goal is to maximize the difference between the reconstruction losses of positive and negative samples. In other words, the reconstructed sequence of negative samples should be significantly different from the original sequence.

[0128] During training, the model calculates the positive reconstruction loss and the positive-negative reconstruction difference loss. The positive reconstruction loss measures the difference between the reconstructed sequence and the original sequence. A smaller loss indicates a better reconstruction of the positive samples. The positive-negative reconstruction difference loss ensures a clear distinction between positive and negative samples in the reconstruction space, preventing the model from overfitting to the anomalous features of negative samples. By optimizing these two loss functions, the model can learn more robust feature representations and improve the accuracy of anomaly detection.

[0129] The following describes the abnormal data detection device for the Internet of Things provided by the present invention. The abnormal data detection device for the Internet of Things described below and the abnormal data detection method for the Internet of Things described above can be referenced to each other.

[0130] Figure 5 This is a schematic diagram of the structure of the abnormal data detection device for the Internet of Things provided by the present invention, as shown in FIG. Figure 5 As shown, including: The preprocessing module 510 is used to preprocess the original sensor time series data collected by each IoT sensor to obtain preprocessed sensor time series data; wherein each of the sensor time series data includes sensor time series window data of multiple time windows; The first input module 520 is used to input the sensor time series window data into a multi-scale feature extraction model to obtain local features and global features of the sensor time series window data; The second input module 530 is used to input the local features and global features of the sensor time series window data into the bidirectional attention reconstruction model, and output the reconstructed local features and the reconstructed global features; The detection module 540 is used to perform similarity analysis and discordance detection analysis based on the local features, global features, and reconstructed local features and reconstructed global features of the sensor time series window data to determine abnormal sensor time series window data.

[0131] In the present invention, the raw time series data collected by each IoT sensor is subjected to data preprocessing operations, including missing value filling, noise suppression, and normalization, to generate a multivariate time series in a unified format as input for subsequent modeling. This step solves the problem of uneven sensor data quality, ensures the accuracy and consistency of the data input into the model, and lays the foundation for further feature extraction and analysis. The preprocessed sensor time series window data is input into a multi-scale feature extraction model, which can simultaneously capture the short-term and long-range dependencies in the time series and obtain local and global features of the data. This step can more comprehensively characterize the characteristics of the time series through multi-scale analysis, paying attention to both local subtle changes and grasping the overall trend of the world, effectively improving the model's ability to detect different types of anomalies. The extracted local features and global features are input into a bidirectional attention reconstruction model, which outputs reconstructed local features and reconstructed global features. The design of the bidirectional attention reconstruction model enables the model to fully utilize the information interaction between local and global features, and more accurately restore the characteristic patterns of normal samples during the reconstruction process. In this way, the model learns the feature representations of normal samples and compares them with the original features in subsequent analysis to identify potential anomalies. Similarity analysis and discordance detection analysis are performed based on the local and global features of the sensor time series window data, as well as the reconstructed local and global features. Similarity analysis measures the degree of difference between the original and reconstructed features, while discordance detection further identifies anomalous portions that significantly deviate from the normal pattern. Through these two analyses, it is possible to accurately determine which sensor time series windows contain anomalies, thereby achieving precise detection and segmentation of anomalies.

[0132] Figure 6 Schematic diagram of the structure of the electronic device provided by the present invention, such as Figure 6 As shown, the electronic device may include: a processor 610, a communication interface 620, a memory 630, and a communication bus 640, wherein the processor 610, the communication interface 620, and the memory 630 communicate with each other via the communication bus 640. The processor 610 may call the logic instructions in the memory 630 to execute the method for detecting abnormal data in the Internet of Things, which includes: performing data preprocessing on the original sensor time series data collected by each Internet of Things sensor to obtain preprocessed sensor time series data; wherein each of the sensor time series data includes sensor time series window data of multiple time windows; Inputting the sensor time series window data into a multi-scale feature extraction model to obtain local features and global features of the sensor time series window data; Inputting the local features and global features of the sensor time series window data into a bidirectional attention reconstruction model, and outputting reconstructed local features and reconstructed global features; Based on the local features, global features, and reconstructed local features and reconstructed global features of the sensor time series window data, similarity analysis and discordance discovery analysis are performed to determine abnormal sensor time series window data.

[0133] Furthermore, the logic instructions in the aforementioned memory 630 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the portion that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for causing a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, a mobile hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0134] On the other hand, the present invention also provides a computer program product, which includes a computer program. The computer program can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the IoT abnormal data detection method provided by the above methods, which includes: performing data preprocessing on the original sensor time series data collected by each IoT sensor to obtain preprocessed sensor time series data; wherein each of the sensor time series data includes sensor time series window data of multiple time windows; Inputting the sensor time series window data into a multi-scale feature extraction model to obtain local features and global features of the sensor time series window data; Inputting the local features and global features of the sensor time series window data into a bidirectional attention reconstruction model, and outputting reconstructed local features and reconstructed global features; Based on the local features, global features, and reconstructed local features and reconstructed global features of the sensor time series window data, similarity analysis and discordance discovery analysis are performed to determine abnormal sensor time series window data.

[0135] In another aspect, the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method for detecting abnormal data in the Internet of Things provided by the above methods, the method comprising: performing data preprocessing on the original sensor time series data collected by each Internet of Things sensor to obtain preprocessed sensor time series data; wherein each of the sensor time series data includes sensor time series window data of multiple time windows; Inputting the sensor time series window data into a multi-scale feature extraction model to obtain local features and global features of the sensor time series window data; Inputting the local features and global features of the sensor time series window data into a bidirectional attention reconstruction model, and outputting reconstructed local features and reconstructed global features; Based on the local features, global features, and reconstructed local features and reconstructed global features of the sensor time series window data, similarity analysis and discordance discovery analysis are performed to determine abnormal sensor time series window data.

[0136] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e., they may be located in one location or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of the present embodiment. Persons of ordinary skill in the art will be able to understand and implement the present invention without inventive effort.

[0137] Through the above description of the embodiments, those skilled in the art will clearly understand that each embodiment can be implemented using software plus a necessary general-purpose hardware platform, or of course, hardware. Based on this understanding, the essence of the above technical solution, or the portion that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, or an optical disk, and includes a number of instructions for causing a computer device (such as a personal computer, server, or network device) to execute the methods described in each embodiment or certain portions of the embodiments.

[0138] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A method for detecting abnormal data in the Internet of Things, characterized in that: include: Preprocessing the original sensor time series data collected by each IoT sensor to obtain preprocessed sensor time series data; wherein each of the sensor time series data includes sensor time series window data of multiple time windows; Inputting the sensor time series window data into a multi-scale feature extraction model to obtain local features and global features of the sensor time series window data; Inputting the local features and global features of the sensor time series window data into a bidirectional attention reconstruction model, and outputting reconstructed local features and reconstructed global features; Based on the local features, global features, and reconstructed local features and reconstructed global features of the sensor time series window data, similarity analysis and discordance discovery analysis are performed to determine abnormal sensor time series window data.

2. The method for detecting abnormal data in the Internet of Things according to claim 1, characterized in that: Based on the local features, global features, and reconstructed local features and global features of the sensor time series window data, similarity analysis and discordance discovery analysis are performed to determine abnormal sensor time series window data, including: Determine the contrast loss corresponding to each sensor time series window data based on the local features and global features of each sensor time series window data, so as to determine the first suspicious sensor time series window data in each of the sensor time series window data according to the contrast loss; Determine, based on the reconstructed local features and the reconstructed global features corresponding to each sensor time series window data, a reconstruction error corresponding to each sensor time series window data, and determine second suspicious sensor time series window data in each of the sensor time series window data; By using a discordance discovery algorithm, abnormal section analysis is performed on the first suspicious sensor time series window data and the second suspicious sensor time series window data to obtain abnormal sensor time series window data.

3. The method for detecting abnormal data in the Internet of Things according to claim 1, wherein: Before the step of inputting the sensor time series window data into a multi-scale feature extraction model to obtain local features and global features of the sensor time series window data, the method further includes: Preprocessing the sensor sample time series data of each IoT sensor to obtain preprocessed sensor sample time series data; Performing random data enhancement on the sensor sample time series data to obtain a negative sample of the sensor sample time series data; Based on the sensor sample time series data and the negative samples of the sensor sample time series data, a multi-scale feature extraction model is trained to output corresponding local feature samples, global feature samples, local feature negative samples, and global feature negative samples; wherein the multi-scale feature extraction model includes a local convolutional network and a global convolutional network with shared weights; Based on the local feature samples, global feature samples, local feature negative samples, and global feature negative samples, a bidirectional attention reconstruction model is trained to output corresponding reconstructed local feature samples and reconstructed global feature samples.

4. The method for detecting abnormal data in the Internet of Things according to claim 3, characterized in that: Training a multi-scale feature extraction model based on the sensor sample time series data and the negative sample of the sensor sample time series data includes: Perform cross-scale contrast loss calculation and intra-scale contrast loss calculation based on the local feature samples, the global feature samples, the local feature negative samples, the global feature negative samples, the sensor sample time series data, and the sensor sample time series data negative samples; Calculating a multi-scale contrast total loss based on the cross-scale contrast loss and the intra-scale contrast loss; The multi-scale feature extraction model is optimized according to the multi-scale contrast total loss until a first preset condition is met, thereby obtaining a trained multi-scale feature extraction model.

5. The method for detecting abnormal data in the Internet of Things according to claim 3, characterized in that: The bidirectional attention reconstruction model is trained based on the local feature samples, the global feature samples, the local feature negative samples, and the global feature negative samples, including: Through the negative sample-aware bidirectional attention mechanism, the local feature sample, the global feature sample, the local feature negative sample, and the global feature negative sample are used as queries and keys, and attention weights are calculated to reconstruct the local feature sample and the global feature sample according to the attention weights to obtain reconstructed local feature samples and reconstructed global feature samples; Calculating a regularization loss based on the reconstructed local feature samples and the reconstructed global feature samples, as well as the original local feature samples, the global feature samples, the local feature negative samples, and the global feature negative samples; According to the regularization loss, the bidirectional attention reconstruction model is optimized until the second preset training condition is met to obtain a trained bidirectional attention reconstruction model.

6. The method for detecting abnormal data in the Internet of Things according to claim 3, characterized in that: The data preprocessing method includes at least one of the following: Introducing random noise, applying random scaling factors, adjusting the signal amplitude according to a smooth curve, and rearranging parts of the time series.

7. An abnormal data detection device for the Internet of Things, characterized in that: include: A preprocessing module is used to preprocess the original sensor time series data collected by each IoT sensor to obtain preprocessed sensor time series data; wherein each of the sensor time series data includes sensor time series window data of multiple time windows; A first input module is used to input the sensor time series window data into a multi-scale feature extraction model to obtain local features and global features of the sensor time series window data; A second input module is used to input the local features and global features of the sensor time series window data into the bidirectional attention reconstruction model, and output the reconstructed local features and the reconstructed global features; The detection module is used to perform similarity analysis and discordance detection analysis based on the local features, global features, and reconstructed local features and reconstructed global features of the sensor time series window data to determine abnormal sensor time series window data.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the method for detecting abnormal data in the Internet of Things as described in any one of claims 1 to 6 is implemented.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method for detecting abnormal data in the Internet of Things as claimed in any one of claims 1 to 6 is implemented.

10. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the method for detecting abnormal data in the Internet of Things as claimed in any one of claims 1 to 6 is implemented.

Images