Iot abnormal data detection method and device

Abstract

The application provides an Internet of Things abnormal data detection method and device, and relates to the technical field of data processing, comprising: performing data preprocessing on sensor original time series data collected by each Internet of Things sensor to obtain preprocessed sensor time series data; wherein each sensor time series data comprises sensor time series window data of multiple time windows; inputting the sensor time series window data into a multi-scale feature extraction model to obtain local features and global features of the sensor time series window data; inputting the local features and global features of the sensor time series window data into a bidirectional attention reconstruction model to output reconstructed local features and reconstructed global features; and performing similarity analysis and disharmony discovery analysis based on the local features, global features, reconstructed local features and reconstructed global features of the sensor time series window data to determine abnormal sensor time series window data.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data processing, and in particular to an Internet of Things (IoT) abnormal data detection method and device. BACKGROUND

[0002] IoT time series anomaly detection has important application value in device monitoring, fault warning and other tasks. Its core goals include timely identification of abnormal patterns in time series data collected by edge sensors and real-time detection and warning when an anomaly occurs, as well as accurate segmentation of variable-length abnormal time periods to support automatic extraction of representative abnormal behaviors from massive monitoring data.

[0003] Therefore, how to effectively detect abnormal data of IoT sensors has become a problem to be solved in the industry. SUMMARY

[0004] The present application provides an IoT abnormal data detection method and device to solve the problem of how to effectively detect abnormal data of IoT sensors in the prior art.

[0005] The present application provides an IoT abnormal data detection method, comprising:

[0006] The sensor raw time series data collected by each IoT sensor is preprocessed to obtain preprocessed sensor time series data; wherein each sensor time series data comprises sensor time series window data of multiple time windows;

[0007] The sensor time series window data is input into a multi-scale feature extraction model to obtain local features and global features of the sensor time series window data;

[0008] The local features and global features of the sensor time series window data are input into a bidirectional attention reconstruction model to output reconstructed local features and reconstructed global features;

[0009] Based on the local features, global features, reconstructed local features and reconstructed global features of the sensor time series window data, similarity analysis and disharmony discovery analysis are performed to determine abnormal sensor time series window data.

[0010] According to the IoT abnormal data detection method provided by the present application, based on the local features, global features, reconstructed local features and reconstructed global features of the sensor time series window data, similarity analysis and disharmony discovery analysis are performed to determine abnormal sensor time series window data, comprising:

[0011] Determine a contrast loss corresponding to each sensor time window data based on the local feature and the global feature of each sensor time window data, so as to determine a first suspicious sensor time window data in each sensor time window data according to the contrast loss;

[0012] Determine a reconstruction error corresponding to each sensor time window data based on the reconstructed local feature and the reconstructed global feature corresponding to each sensor time window data, so as to determine a second suspicious sensor time window data in each sensor time window data;

[0013] Perform abnormal section analysis on the first suspicious sensor time window data and the second suspicious sensor time window data through a discordance finding algorithm, so as to obtain abnormal sensor time window data.

[0014] According to the method for detecting abnormal data of the Internet of Things provided by the application, before the step of inputting the sensor time window data into a multi-scale feature extraction model to obtain the local feature and the global feature of the sensor time window data, the method further comprises:

[0015] Perform data preprocessing on the sensor sample time series data of each Internet of Things sensor to obtain preprocessed sensor sample time series data of each sensor;

[0016] Perform random data enhancement on the sensor sample time series data to obtain sensor sample time series data negative samples;

[0017] Train a multi-scale feature extraction model based on the sensor sample time series data and the sensor sample time series data negative samples, and output corresponding local feature samples, global feature samples, local feature negative samples, and global feature negative samples; wherein the multi-scale feature extraction model comprises a local convolutional network and a global convolutional network sharing weights;

[0018] Train a bidirectional attention reconstruction model based on the local feature samples, the global feature samples, the local feature negative samples, and the global feature negative samples, and output corresponding reconstructed local feature samples and reconstructed global feature samples.

[0019] According to the method for detecting abnormal data of the Internet of Things provided by the application, training a multi-scale feature extraction model based on the sensor sample time series data and the sensor sample time series data negative samples comprises:

[0020] According to the local feature samples, the global feature samples, the local feature negative samples, the global feature negative samples, the sensor sample time series data, and the sensor sample time series data negative samples, perform cross-scale contrast loss calculation and intra-scale contrast loss calculation;

[0021] Calculating a multi-scale contrast total loss based on the cross-scale contrast loss and the intra-scale contrast loss;

[0022] The multi-scale feature extraction model is optimized according to the multi-scale contrast total loss until a first preset condition is met, thereby obtaining a trained multi-scale feature extraction model.

[0023] According to a method for detecting abnormal data in the Internet of Things provided by the present invention, the bidirectional attention reconstruction model is trained based on the local feature samples, the global feature samples, the local feature negative samples, and the global feature negative samples, including:

[0024] Through the negative sample-aware bidirectional attention mechanism, the local feature sample, the global feature sample, the local feature negative sample, and the global feature negative sample are used as queries and keys, and attention weights are calculated to reconstruct the local feature sample and the global feature sample according to the attention weights to obtain reconstructed local feature samples and reconstructed global feature samples;

[0025] According to the reconstructed local feature samples and the reconstructed global feature samples, as well as the original local feature samples, global feature samples, local feature negative samples, and global feature negative samples, the regularization loss is calculated.

[0026] According to the regularization loss, the bidirectional attention reconstruction model is optimized until the second preset training condition is met to obtain a trained bidirectional attention reconstruction model.

[0027] According to a method for detecting abnormal data in the Internet of Things provided by the present invention, the data preprocessing method includes at least one of the following:

[0028] Introducing random noise, applying random scaling factors, adjusting the signal amplitude according to a smooth curve, and rearranging parts of the time series.

[0029] The present invention also provides an IoT abnormal data detection device, comprising the following modules:

[0030] A preprocessing module is used to preprocess the original sensor time series data collected by each IoT sensor to obtain preprocessed sensor time series data; wherein each of the sensor time series data includes sensor time series window data of multiple time windows;

[0031] A first input module is used to input the sensor time series window data into a multi-scale feature extraction model to obtain local features and global features of the sensor time series window data;

[0032] The second input module is configured to input the local features and the global features of the sensor time window data into the bidirectional attention reconstruction model, and output reconstructed local features and reconstructed global features.

[0033] The detection module is configured to perform similarity analysis and inharmonious discovery analysis based on the local features, the global features, the reconstructed local features and the reconstructed global features of the sensor time window data, and determine abnormal sensor time window data.

[0034] The application further provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the Internet of Things abnormal data detection method as described above when executing the computer program.

[0035] The application further provides a non-transitory computer readable storage medium, which stores a computer program, and the computer program is executable on a processor to implement the Internet of Things abnormal data detection method as described above.

[0036] The application further provides a computer program product, which includes a computer program, and the computer program is executable on a processor to implement the Internet of Things abnormal data detection method as described above.

[0037] The Internet of Things abnormal data detection method and device provided by the application, through data preprocessing operation of the original time series data collected by each Internet of Things sensor, including missing value completion, noise suppression and normalization, etc., a unified format multivariate time series is generated as the input of subsequent modeling. This step solves the problem of uneven sensor data quality, ensures the accuracy and consistency of the data input into the model, and lays a foundation for further feature extraction and analysis. The preprocessed sensor time series window data is input into the multi-scale feature extraction model, which can capture short-term and long-term dependencies in the time series simultaneously, and obtain local features and global features of the data. Through multi-scale analysis, this step can more comprehensively describe the features of the time series, focusing on local subtle changes and grasping the overall trend, effectively improving the model's detection ability of different types of abnormalities. The extracted local features and global features are input into the bidirectional attention reconstruction model, and the reconstructed local features and reconstructed global features are output. The design of the bidirectional attention reconstruction model enables the model to fully utilize the information interaction between local and global features, and more accurately restore the feature mode of normal samples in the reconstruction process. In this way, the model can learn the feature representation of normal samples and compare it with the original features in subsequent analysis, so as to discover potential abnormalities. Based on the local features, global features, reconstructed local features and reconstructed global features of the sensor time series window data, similarity analysis and disharmony discovery analysis are carried out. Similarity analysis is used to measure the difference between the original features and the reconstructed features, and disharmony discovery analysis further identifies the abnormal part that deviates from the normal mode. Through these two aspects of analysis, it can accurately determine which sensor time series window data is abnormal, so as to realize accurate detection and segmentation of abnormalities. BRIEF DESCRIPTION OF DRAWINGS

[0038] In order to more clearly illustrate the technical solutions in the application or prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description are some embodiments of the application, and those skilled in the art can obtain other drawings according to these drawings without creative labor.

[0039] Figure 1 It is the flowchart of the Internet of Things abnormal data detection method provided by the application;

[0040] Figure 2 It is the detection flowchart provided by the application;

[0041] Figure 3 It is the comparison process diagram under multi-scale provided by the application;

[0042] Figure 4The multi-mode reconstruction process diagram provided by the present application is shown in the figure;

[0043] Figure 5 The structure schematic diagram of the Internet of Things abnormal data detection device provided by the present application is shown in the figure;

[0044] Figure 6 The structure schematic diagram of the electronic device provided by the present application is shown in the figure. DETAILED DESCRIPTION

[0045] In order to make the objects, technical solutions and advantages of the present application clearer, the technical solutions in the present application will be described clearly and completely below in combination with the drawings in the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0046] Figure 1 The flowchart of the Internet of Things abnormal data detection method provided by the present application is shown in the figure. Figure 1 As shown in the figure, the method comprises the following steps:

[0047] In step 110, the sensor raw time series data collected by each Internet of Things sensor is preprocessed to obtain preprocessed sensor time series data of each sensor; wherein each sensor time series data comprises sensor time series window data of multiple time windows.

[0048] In the present application, the sensor raw time series data collected by the Internet of Things sensor is the raw data collected by various sensors deployed in the Internet of Things environment without any processing. These data take time series as the carrier and reflect the state of the device or environment at different time points.

[0049] The sensor raw time series data is a continuous data stream generated by the Internet of Things sensor such as industrial equipment and environmental monitoring instrument during operation. For example, on an industrial automatic production line, the temperature sensor will record the temperature value of the device once every certain time (such as every second), forming a temperature sequence that changes with time; for another example, the vibration sensor will collect the vibration intensity of the device in real time, generating a vibration intensity time series. These raw data may contain noise, missing values, etc., and the data format may vary depending on the sensor type.

[0050] Data preprocessing can refer to a series of operations on the collected raw time series data to improve data quality and make it suitable for subsequent analysis and modeling.

[0051] More specifically, data preprocessing includes operations such as missing value imputation (e.g., filling in missing data points with interpolation methods), noise suppression (e.g., removing random noise in data with filtering techniques), normalization (e.g., scaling data to a certain range to make data from different sensors comparable), etc. For example, for temperature sensor data, if a data point is missing at a certain time point, an estimated value for the missing point can be obtained by linear interpolation from the data at adjacent time points; for vibration sensor data containing noise, a low-pass filter can be used to filter out high-frequency noise and retain the main vibration characteristics.

[0052] In the present application, the pre-processed sensor time series data has completeness, consistency and comparability. For example, the processed temperature sensor data no longer has missing values, and the noise is effectively suppressed, and the temperature values are normalized to the range of 0-1; the vibration sensor data is also filtered and normalized, and the data from different sensors can be compared and analyzed on the same scale.

[0053] In the present application, the time series data of each sensor is divided into multiple time windows, each time window corresponding to a continuous time series data.

[0054] The division of time windows is to divide long sequence data into multiple shorter segments to facilitate model processing and analysis. For example, for a temperature sensor time series data with a length of 1000 time points, it can be divided into multiple time windows with a length of 100, each time window containing 100 consecutive temperature values, and there can be or can not be overlapping parts between adjacent time windows.

[0055] After such division, the data in each time window can be input as an independent sample into the subsequent model for feature extraction and analysis.

[0056] Step 120, inputting the sensor time series window data into a multi-scale feature extraction model to obtain local features and global features of the sensor time series window data;

[0057] In the present application, the sensor time series window data is the data segment in each time window obtained after dividing the sensor time series data into multiple time windows.

[0058] For example, for a temperature sensor time series data with a length of 1000 time points, it can be divided into multiple time windows with a length of 100, each time window containing 100 consecutive temperature values, and there can be or can not be overlapping parts between adjacent time windows. The data in each such time window is referred to as sensor time series window data.

[0059] In the present application, the multi-scale feature extraction model refers to a model that can capture both short-term and long-range dependencies of time series.

[0060] The multi-scale feature extraction model usually contains two branches, one for extracting local features and the other for extracting global features. For example, the local feature extraction branch may use causal convolution to capture short-term dependencies, while the global feature extraction branch may use dilated convolution to expand the receptive field to capture long-range dependencies.

[0061] In the present application, the local feature reflects the changing characteristics of the time series on a short-term time scale. By processing the sensor time window data through the local feature extraction branch of the multi-scale feature extraction model, the local feature can be obtained. For example, in temperature sensor data, the local feature may reflect the fluctuation pattern of temperature in a short time (such as a few minutes).

[0062] The global feature reflects the changing trend and overall pattern of the time series on a long-term time scale. By processing the sensor time window data through the global feature extraction branch of the multi-scale feature extraction model, the global feature can be obtained. For example, in temperature sensor data, the global feature may reflect the overall changing trend of temperature in a longer period of time (such as several hours or several days).

[0063] Step 130, input the local feature and the global feature of the sensor time window data into the bidirectional attention reconstruction model, and output the reconstructed local feature and the reconstructed global feature;

[0064] In the present application, the local feature and the global feature of the sensor time window data extracted in step 120 are input into the bidirectional attention reconstruction model.

[0065] In the present application, the bidirectional attention reconstruction model is a model that uses attention mechanism to reconstruct the input features, aiming to generate reconstructed local features and global features through the interaction of local and global features.

[0066] The bidirectional attention reconstruction model contains two main parts, which are used to process local features and global features respectively, and use bidirectional attention mechanism to make the two parts of features interact and influence each other. In this way, the model can more accurately capture the feature patterns of normal samples and try to reconstruct the input features.

[0067] For the input local feature and global feature, the model generates the corresponding reconstructed local feature vector and reconstructed global feature vector after processing through the bidirectional attention mechanism. These reconstructed feature vectors will be compared with the original feature vectors to evaluate the abnormality of the sample.

[0068] Suppose there is a temperature sensor whose time series window data contains local feature vector [0.1, 0.3, 0.5] and global feature vector [0.2, 0.4, 0.6]. After inputting these features into the bidirectional attention reconstruction model for processing, the reconstructed local feature vector output by the model may be [0.12, 0.31, 0.49], and the reconstructed global feature vector may be [0.21, 0.39, 0.62]. By comparing the differences between the original features and the reconstructed features, it can be determined whether the sensor time series window data is abnormal.

[0069] Step 140, based on the local features, global features, and reconstructed local features and reconstructed global features of the sensor time series window data, similarity analysis and discord discovery analysis are performed to determine abnormal sensor time series window data. The similarity between the original local features, global features and the reconstructed local features, reconstructed global features is compared.

[0070] In the present application, similarity analysis can specifically refer to using a similarity measure function (such as cosine similarity) to calculate the similarity between the original features and the reconstructed features. For example, for the original local feature vector [0.1, 0.3, 0.5] and the reconstructed local feature vector [0.12, 0.31, 0.49], the similarity score between them can be calculated by cosine similarity. The higher the similarity score, the closer the original features and the reconstructed features, and vice versa, the greater the difference.

[0071] In the present application, discord discovery analysis uses discord discovery algorithms, such as the MERLIN algorithm, to detect abnormal patterns in time series. This algorithm quickly locates variable-length abnormal segments in massive data by calculating the similarity between sub-sequences. For example, in temperature sensor data, if the temperature change pattern in a certain time window is significantly different from other normal patterns, discord discovery analysis will mark that time window as abnormal.

[0072] In the present application, by performing data preprocessing operations on the raw time series data collected by each Internet of Things sensor, including missing value completion, noise suppression, and normalization, a unified format multivariate time series is generated as the input for subsequent modeling. This step solves the problem of uneven sensor data quality, ensuring the accuracy and consistency of the data input into the model, laying the foundation for further feature extraction and analysis. The preprocessed sensor time series window data is input into a multi-scale feature extraction model, which can capture both short-term and long-range dependencies in the time series, obtaining local features and global features of the data. This step can more comprehensively characterize the features of the time series through multi-scale analysis, focusing on both local subtle changes and overall trends, effectively improving the model's ability to detect different types of anomalies. The extracted local features and global features are input into a bidirectional attention reconstruction model, which outputs reconstructed local features and reconstructed global features. The design of the bidirectional attention reconstruction model enables the model to fully utilize the information interaction between local and global features, more accurately restoring the feature patterns of normal samples during the reconstruction process. In this way, the model can learn the feature representation of normal samples and compare it with the original features in subsequent analysis, thereby discovering potential anomalies. Based on the local features, global features, reconstructed local features, and reconstructed global features of the sensor time series window data, similarity analysis and discordance discovery analysis are performed. Similarity analysis is used to measure the degree of difference between the original features and the reconstructed features, while discordance discovery analysis further identifies abnormal parts that deviate significantly from the normal pattern. Through these two aspects of analysis, it can accurately determine which sensor time series window data is abnormal, thereby achieving precise detection and segmentation of anomalies.

[0073] Optionally, based on the local features, global features, and reconstructed local features and reconstructed global features of the sensor time series window data, similarity analysis and discordance discovery analysis are performed to determine the abnormal sensor time series window data, including:

[0074] Based on the local features and global features of each sensor time series window data, a contrast loss corresponding to each sensor time series window data is determined to determine a first suspicious sensor time series window data in each sensor time series window data according to the contrast loss;

[0075] Based on the reconstructed local features and reconstructed global features of each sensor time series window data, a reconstruction error corresponding to each sensor time series window data is determined to determine a second suspicious sensor time series window data in each sensor time series window data;

[0076] The first suspicious sensor time window data and the second suspicious sensor time window data are subjected to abnormal section analysis by a discord discovery algorithm to obtain abnormal sensor time window data.

[0077] In the present application, for each sensor time window data, a contrast loss is calculated using its local feature and global feature. The contrast loss measures the difference between the original feature and the reconstructed feature. For example, for a certain sensor time window data, the contrast loss is calculated by comparing its original local feature and reconstructed local feature, original global feature and reconstructed global feature. Common contrast loss functions include mean square error (MSE) or cosine similarity, etc.

[0078] According to the size of the contrast loss, the sensor time window data with larger contrast loss is selected as the first suspicious data. A threshold of the contrast loss is set. For the contrast loss calculated for all sensor time window data, if the contrast loss of a certain data exceeds the set threshold, it is considered that the data has a greater possibility of abnormality, and is thus determined as the first suspicious sensor time window data.

[0079] For each sensor time window data, a reconstruction error is calculated using its reconstructed local feature and reconstructed global feature. The reconstruction error reflects the degree of difference between the original feature and the reconstructed feature. For example, for a certain sensor time window data, the reconstruction error is calculated by comparing its original local feature and reconstructed local feature, original global feature and reconstructed global feature. Common reconstruction error functions include mean square error (MSE) or absolute error, etc.

[0080] According to the size of the reconstruction error, the sensor time window data with larger reconstruction error is selected as the second suspicious data. A threshold of the reconstruction error is set. For the reconstruction error calculated for all sensor time window data, if the reconstruction error of a certain data exceeds the set threshold, it is considered that the data has a greater possibility of abnormality, and is thus determined as the second suspicious sensor time window data.

[0081] More specifically, the first suspicious and second suspicious sensor time window data are subjected to comprehensive analysis by a discord discovery algorithm to determine the final abnormal sensor time window data. The discord discovery algorithm (such as the MERLIN algorithm) quickly locates the variable-length abnormal section in a large amount of data by calculating the similarity between sub-sequences.

[0082] For example, the first suspicious and second suspicious sensor time window data are input into the discord discovery algorithm, which analyzes the distribution and pattern of these suspicious data in the time series, and finally determines which sensor time window data is abnormal.

[0083] In the present invention, the contrast loss and reconstruction error can be effectively combined, and the inharmonic discovery algorithm can be used to perform abnormal segment analysis, thereby accurately locating abnormal sensor time series window data.

[0084] Optionally, before the step of inputting the sensor time series window data into a multi-scale feature extraction model to obtain local features and global features of the sensor time series window data, the method further includes:

[0085] Preprocessing the sensor sample time series data of each IoT sensor to obtain preprocessed sensor sample time series data;

[0086] Performing random data enhancement on the sensor sample time series data to obtain a negative sample of the sensor sample time series data;

[0087] Based on the sensor sample time series data and the negative samples of the sensor sample time series data, a multi-scale feature extraction model is trained to output corresponding local feature samples, global feature samples, local feature negative samples, and global feature negative samples; wherein the multi-scale feature extraction model includes a local convolutional network and a global convolutional network with shared weights;

[0088] Based on the local feature samples, global feature samples, local feature negative samples, and global feature negative samples, a bidirectional attention reconstruction model is trained to output corresponding reconstructed local feature samples and reconstructed global feature samples.

[0089] In the present invention, the sensor sample time series data of each IoT sensor is preprocessed to obtain the preprocessed sensor sample time series data.

[0090] The preprocessing steps include missing value filling, noise suppression, and normalization, with the aim of improving data quality and making it suitable for subsequent analysis and modeling.

[0091] For example, for temperature sensor data, if the data at a certain time point is missing, the estimated value of the missing point can be obtained by linear interpolation of the data at adjacent time points; for vibration sensor data containing noise, a low-pass filter can be used to filter out high-frequency noise and retain the main vibration characteristics.

[0092] Specifically, let the original time series be , split it into several random lengths Window ;in Represents the starting point. The following enhancement operations can be applied to each window:

[0093] (1) Introduce random noise into the data in the following form:

[0094] ;

[0095] where is the noise added at a specific time step, denotes the variance.

[0096] (2) Apply a random scaling factor to the data, defined as:

[0097] ;

[0098] where is the scaling factor acting on each time step.

[0099] (3) Adjust the signal amplitude according to the smooth curve, and the application adopts a Butterworth filter to highlight the main frequency components:

[0100] ;

[0101] where is the cutoff frequency.

[0102] (4) Rearrange part of the time series without changing the specific values of individual data points, which can be described as:

[0103] ;

[0104] where is the order index of the randomly shuffled segment.

[0105] Through the above-mentioned multiple enhancement means, diversified potential abnormal patterns can be simulated on the original normal sequence.

[0106] The subsequent contrast learning process regards these "pseudo abnormalities" as negative samples, so that the model can better learn the difference between normal patterns and abnormal patterns.

[0107] In the application, based on the sensor sample time series data and the sensor sample time series data negative sample, a multi-scale feature extraction model is trained to output corresponding local feature samples, global feature samples, and local feature negative samples, and global feature negative samples.

[0108] The multi-scale feature extraction model includes a local convolutional network and a global convolutional network with shared weights. The local convolutional network uses causal convolution to capture short-term dependencies, and the global convolutional network uses dilated convolution to capture long-range dependencies. During the training process, the model learns the feature representation of normal samples and negative samples at local and global scales, so as to be able to distinguish normal patterns and abnormal patterns.

[0109] In the present application, the bidirectional attention reconstruction model is trained based on local feature samples, global feature samples, and local feature negative samples and global feature negative samples to output corresponding reconstructed local feature samples and reconstructed global feature samples.

[0110] The bidirectional attention reconstruction model utilizes information interaction between local and global features to reconstruct features through an attention mechanism. During training, the model learns feature patterns of normal samples and can accurately reconstruct local and global features of normal samples while maintaining differences from reconstruction results of negative samples. This helps improve the model's ability to capture abnormal features.

[0111] Optionally, a multi-scale feature extraction model is trained based on the sensor sample time series data and the sensor sample time series data negative samples, including:

[0112] According to the local feature samples, global feature samples, local feature negative samples, global feature negative samples, and the sensor sample time series data and the sensor sample time series data negative samples, cross-scale contrast loss calculation and intra-scale contrast loss calculation are performed.

[0113] According to the cross-scale contrast loss and the intra-scale contrast loss, a multi-scale contrast total loss is calculated.

[0114] According to the multi-scale contrast total loss, the multi-scale feature extraction model is optimized until a first preset condition is met, obtaining a trained multi-scale feature extraction model.

[0115] In the present application, intra-scale contrast loss calculation refers to calculating the similarity between different views of the same real sample for feature samples under the same scale and maximizing this similarity; at the same time, calculating the similarity between the real sample and other samples and minimizing this similarity.

[0116] For example, for local feature samples, the similarity with other local feature views of the same real sample is calculated, and then the similarity of the local feature sample with local features of all other samples is calculated.

[0117] Cross-scale contrast loss calculation refers to calculating the similarity between feature representations of the same real sample under different scales for feature samples under different scales and maximizing this similarity; at the same time, calculating the similarity between the feature representation of the real sample under a certain scale and the feature representation of the negative sample under another scale and minimizing this similarity. For example, the similarity between local feature samples and global feature samples is calculated, and then the similarity between local feature samples and global feature negative samples is calculated.

[0118] More specifically, in practical applications, the length and periodicity of time series data vary significantly. For example, monitoring data for some devices may be sampled at a high frequency, resulting in a very long time series; while monitoring data for other devices may be sampled at a low frequency, resulting in a shorter time series. Furthermore, the operating cycles of different devices may also vary; some devices may complete a full operating cycle every hour, while others may only complete a full operating cycle every day. Traditional fixed-length block partitioning methods struggle to adapt to this diversity, potentially leading to inaccurate feature extraction or inefficient computation. The adaptive multi-scale block partitioning strategy can dynamically determine the block length based on the length and characteristics of the time series data, thereby better extracting features and improving computational efficiency.

[0119] For a given time series, first analyze its length and periodic characteristics. Then, find a suitable block length so that the factor distribution of the block length is more reasonable, which is convenient for subsequent feature extraction operations. At the same time, the block length should be as close as possible to the original time series length to reduce information loss and computational complexity. For example, if the original time series length is 1000, the possible block lengths can be 500, 200, 250, etc., but the factor distribution must be reasonable and not much different from 1000. Reasonable factor distribution means that the length of each block after block division should be divisible by some common convolution kernel sizes to facilitate convolution operations.

[0120] After determining the appropriate block length, the original time series is divided into multiple continuous or discontinuous subsequences (patches). These subsequences serve as input to subsequent local and global convolutional networks to extract short-term and long-term dependency features. For example, a time series of length 1000 can be divided into two patches of length 500, or four patches of length 250, depending on the selected block length. Each patch can be processed independently by the local and global convolutional networks, extracting features at different scales.

[0121] More specifically, the multi-scale feature extraction module includes causal convolution to capture short-term dependencies. Its core operation can be expressed as:

[0122]

[0123] in, Indicates the Layer network at time The output (local scale), is the activation function (such as ReLU, sigmoid, etc.), The convolution kernel size is All indexes of Sum, For the The convolution kernel of the layer is at index The weight of For the Layer network at time The output features of For the The bias term of the layer.

[0124] In addition, the dilated convolution module in the multi-scale feature extraction module expands the receptive field of the time dimension to capture long-range dependencies. The formula is as follows:

[0125]

[0126] in Indicates the Layer network at time The output of (global scale), is the activation function (such as ReLU, tanh, etc.), is the convolution kernel size, For the Layer dilated convolution at index The weight of is the void coefficient, Indicates the Layer network at time The output features of For the The bias term of the layer.

[0127] After inputting the input sequence into the local convolutional network and the global convolutional network respectively, the short-term and long-term feature representations can be obtained in parallel. and . Then the Transformer structure is introduced to perform deep relationship modeling, and finally we get and , negative samples share the feature extraction module at multiple scales and maintain the same data flow as positive samples.

[0128] A further approach to constrained data construction is to treat the two perspectives of the same real sample in a batch as positive samples, and other samples or data enhancements as negative samples. The intra-scale contrast loss used in this invention is:

[0129]

[0130] in is the intra-scale contrast loss, For scale Feature representation (local or global), a batch of sample sets, a positive sample pair set, a positive sample pair set belonging to the same real sample, a similarity measure function (e.g. cosine similarity), a certain data augmentation version of the i-th sample in scale .

[0131] In normal cases, local and global features usually maintain consistency; if there is an anomaly, it is difficult for both scales to maintain high similarity at the same time. Therefore, the cross-scale contrast loss adopted by the present application is:

[0132]

[0133] wherein is the cross-scale contrast loss, is the sum of positive sample similarities in the same scale, represents a negative sample pair set from different scales, is the feature representation of the i-th sample in scale . is the corresponding non-self positive sample in the same scale.

[0134] Combining the above two parts, the multi-scale contrast total loss is obtained:

[0135]

[0136] wherein is the multi-scale contrast loss, is a hyperparameter that adjusts the importance of the same scale and cross-scale contrast, .

[0137] In the present application, according to the multi-scale contrast total loss, the parameters of the multi-scale feature extraction model are updated using an optimization algorithm to minimize the loss function. In each iteration, the multi-scale contrast total loss under the current model parameters is calculated, and the model parameters are adjusted according to the loss value to gradually improve the model's ability to distinguish between normal samples and negative samples.

[0138] The optimization process continues until the first preset condition is met. Common preset conditions include reaching the maximum number of training iterations, the loss value being below a certain threshold, the performance on the validation set no longer improving, etc. When the stopping condition is met, it is considered that the model has been trained and a trained multi-scale feature extraction model is obtained.

[0139] ​​In the present application, two mainstream deep learning methods based on contrast learning and reconstruction model are unified, which covers feature extraction module under multi-scale, negative sample perception bidirectional attention reconstruction module under multi-mode, constructs local-global multi-scale contrast learning process, designs negative sample perception bidirectional fusion local-global attention mechanism to construct reconstruction process, realizes bidirectional association of contrast process and reconstruction process. The advantages of contrast model and reconstruction model are effectively combined, the problems of excessive dependence on data enhancement strategy of traditional contrast learning model and insufficient consistency of local and global information are overcome, and the overfitting phenomenon of reconstruction model based on micro abnormal area is inhibited.

[0140] Optionally, the training of the bidirectional attention reconstruction model based on the local feature sample, the global feature sample, the local feature negative sample and the global feature negative sample comprises:

[0141] The local feature sample, the global feature sample, the local feature negative sample and the global feature negative sample are taken as each other as query and key by the negative sample perception bidirectional attention mechanism, the attention weight is calculated, and the local feature sample and the global feature sample are reconstructed according to the attention weight to obtain the reconstructed local feature sample and the reconstructed global feature sample;

[0142] According to the reconstructed local feature sample and the reconstructed global feature sample, and the original local feature sample, the global feature sample, the local feature negative sample and the global feature negative sample, a regularization loss is calculated,

[0143] According to the regularization loss, the bidirectional attention reconstruction model is optimized until the second preset training condition is met, and the trained bidirectional attention reconstruction model is obtained.

[0144] In the present application, the local feature sample, the global feature sample and the corresponding negative sample feature are taken as each other as query and key by the negative sample perception bidirectional attention mechanism during the training of the model, the attention weight is calculated, and the reconstruction process is guided.

[0145] This attention-based reconstruction method enables the model to learn the feature mode of the normal sample more specifically according to the mutual relationship between the positive and negative sample features, ensures that the reconstructed local feature sample and the global feature sample are as close as possible to the original normal sample features, and at the same time maintain the difference with the negative sample features, which helps the model to accurately capture the feature difference between the normal and abnormal samples.

[0146] When calculating the regularization loss, the model compares the reconstructed features with the original positive and negative sample features, which prompts the model to continuously correct its reconstruction results during the training process, so that the reconstruction error of the normal sample is as small as possible, and the reconstruction error of the negative sample is as large as possible.

[0147] After such training, the model can better distinguish between normal samples and abnormal samples, improve the sensitivity to abnormal patterns, reduce the occurrence of false negatives and false positives, and enhance the effective identification ability of various anomalies in practical applications.

[0148] In the present application, the bidirectional attention reconstruction model is optimized according to the regularization loss, which can provide a clear direction and goal for model training.

[0149] The optimization process will continuously adjust the model parameters to gradually reduce the loss until the second preset training condition is met, such as reaching a certain number of iterations or the loss being lower than the set threshold. This helps to ensure the stability and effectiveness of model training, so that the model eventually converges to a better parameter state, providing reliable feature reconstruction and discrimination ability for subsequent anomaly detection tasks.

[0150] More specifically, the present application designs a reconstruction technology of negative sample-aware bidirectional attention mechanism, which makes and each other as query (query) and key (key), and gets the updated reconstruction sequence and . The schematic diagram is as follows:

[0151] ;

[0152] ;

[0153] wherein and are the first updated reconstruction sequence, and are the local-global features at the th update, and are the attention matrices between local and global, and is the projection matrix of the "value" vector (value).

[0154] If the original sequence is , the result of local and global guided reconstruction should maintain a high degree of similarity with . The mean square error is used to measure:

[0155] ;

[0156] wherein is the mean square error of the reconstruction process, denotes the total length of the sequence, denotes the true value of the input sequence at time , and respectively, are the outputs of the local / global reconstruction at time .

[0157] To prevent the model from over-reconstructing abnormal regions, the application designs a negative sample-aware reconstruction module, which uses a contrastive loss as a regularization term:

[0158] ;

[0159] wherein is the regularization loss of the reconstruction link, is the batch sample set, and denote the reconstruction results obtained after data augmentation or abnormal simulation.

[0160] is the comprehensive reconstruction loss, is a hyperparameter used to balance the reconstruction error and the regularization loss , and is represented as:

[0161] ;

[0162] In the application, an optimization algorithm (such as Adam or stochastic gradient descent) is used to minimize the regularization loss. In each iteration, the regularization loss value under the current model parameters is calculated, and then the model parameters are adjusted according to the loss value.

[0163] The purpose of updating the model parameters is to make the reconstructed local and global feature samples closer to the original local and global feature samples, while making the reconstruction error of negative samples larger, thereby enhancing the model's ability to distinguish between normal and abnormal patterns.

[0164] After continuous optimization, the model gradually learns how to more accurately reconstruct the local and global features of normal samples, and can effectively distinguish between normal samples and negative samples (abnormal patterns).

[0165] Finally, when the optimization process meets the second preset training condition (such as reaching a predetermined number of training rounds, the loss value stabilizes, or the validation set performance reaches a satisfactory level), the training is complete, and a trained bidirectional attention reconstruction model is obtained.

[0166] In the present application, a bidirectional fusion local-global attention mechanism with negative sample awareness is designed and implemented, which promotes the information interaction between the contrast learning process and the reconstruction process, and combines the contrast loss as a regularization term, so that the normal samples can be accurately reconstructed, while the abnormal samples are difficult to reconstruct. The sufficient utilization and coordination of local and global information in normal regions are realized, which effectively improves the model's ability to capture abnormal features and overcomes the model's strong robustness that leads to the reconstruction of small abnormal regions.

[0167] In an optional embodiment, the present application also includes event-level evaluation and segmentation-level evaluation. For event-level evaluation, the abnormal position at the event level is expected. If the deviation of the detected position from the true position is within the range of plus or minus 100 data points, it is considered accurate (score 1.0); otherwise, it is considered inaccurate (score 0.0), and the accuracy of all abnormal events is averaged to obtain the final accuracy score. The original F1 and F1 under PA%K are used to evaluate the segmentation ability of the model.

[0168] For segmentation-level evaluation, standard F1 and F1 under Affiliation are used for evaluation. Specifically, the standard F1 score: a strict point-by-point metric that calculates precision and recall without time tolerance; F1 under PA%K: a robust metric that balances point-by-point precision and event-level recall. The predicted value at time step n is

[0169] ;

[0170] where is the abnormal score, is the detection threshold, is the true abnormal segment, belongs to , and controls the minimum detection ratio in . This metric calculates the area under the precision-recall curve within different ranges of K.

[0171] F1 under Affiliation is a time proximity-aware metric with probability matching, denoted as F1-Aff. It evaluates detection performance by weighting precision based on predicted relevance and weighting recall based on true coverage, emphasizing alignment rather than precise boundaries.

[0172] Figure 2 The detection process provided by the present application is shown in the schematic diagram as Figure 2 , which includes:

[0173] ​Step S1, input time series + pre-processing + sliding window division: The original IoT sensor time series data is pre-processed (such as missing value completion, noise suppression, normalization, etc.), and then divided into sliding windows to generate sequence data of multiple time windows.

[0174] Step S2, generate negative samples (training phase) + instance normalization: In the training phase, data augmentation is performed on the pre-processed data to generate negative samples, and the instances are normalized.

[0175] Step S3, multi-scale contrast process (Process 1):

[0176] Multi-scale adaptive patch: Multi-scale adaptive patch processing is performed on the data.

[0177] Local feature representation contrast network: Extract local features and perform contrast.

[0178] Global feature representation contrast network: Extract global features and perform contrast. Local and global feature contrast networks share weights.

[0179] This step captures feature representations at different scales through contrast learning.

[0180] Step S4, reconstruction process under multi-mode (Process 2):

[0181] Reconstruction network with negative sample-aware bidirectional attention mechanism: Use the negative sample-aware bidirectional attention mechanism to reconstruct features, sharing weights.

[0182] This step aims to learn more robust feature representations through the reconstruction network for subsequent anomaly detection.

[0183] Step S5, consistent discovery algorithm under multi-process (Process 1, 2): Combine the results of steps S3 and S4, and use the consistent discovery algorithm for anomaly detection.

[0184] Abnormal window voting under multi-mode: Determine the abnormal window through the multi-mode abnormal window voting mechanism.

[0185] Step S6, event-level and segmentation-level evaluation system: Evaluate the detection results, including event-level and segmentation-level evaluation, to verify the performance of the model.

[0186] The entire process starts with data preprocessing, followed by feature extraction, contrast learning, feature reconstruction, anomaly detection, and finally evaluates the performance of the entire anomaly detection system through the evaluation system. This multi-step, multi-module processing approach aims to improve the accuracy and efficiency of anomaly detection in IoT time series data.

[0187] Figure 3The contrast process diagram under multi-scale provided by the present application is shown in Figure 3 As shown, after data preprocessing and negative sample generation, the original time series data is input, a sliding window operation is performed, and a long sequence is divided into multiple short sequence segments to adapt to the batch processing requirements of the model. Instance normalization is performed on each short sequence segment to make its mean value 0 and standard deviation 1, eliminate the dimensional difference and statistical characteristic difference between different sensor data, and accelerate the model convergence speed. The original sequence is disturbed through data enhancement technology to generate negative samples, including random selection of regions and enhancement methods such as Scaling (random scaling), Permutation (random permutation), Warping (time warping), Jittering (adding noise), etc.

[0188] Adaptive multi-scale Patch, calculate the maximum period length by power spectral density, and perform adaptive multi-scale Patch operation according to the length to divide the time series into segments of different lengths to adapt to feature extraction of different scales.

[0189] Local feature extraction network and global feature extraction network, the two networks share weights and are responsible for extracting local features and global features respectively, the local features reflect the changes of the time series in the short-term time scale, and the global features reflect the change trend and pattern of the time series in the long-term time scale.

[0190] Transformer block, the extracted local and global features are processed through the Transformer block, the Transformer block uses the self-attention mechanism to capture the long-term dependence relationship in the feature sequence, and transforms and fuses the features to enhance the expression ability of the features.

[0191] Multi-patch renormalization, the features output by the Transformer block are subjected to multi-patch renormalization operation, and the features are normalized to have more stable statistical characteristics, which is convenient for subsequent contrast learning.

[0192] Intra-domain consistency contrast representation, in the same scale, the similarity between different samples is calculated to obtain the intra-domain consistency contrast representation, which measures the feature similarity of different samples in the same scale.

[0193] Inter-domain consistency contrast representation, in different scales, the similarity between local features and global features is calculated to obtain the inter-domain consistency contrast representation, which measures the consistency between local features and global features.

[0194] Positive sample and negative sample contrast, in the same scale and different scales, the similarity between positive samples and negative samples is calculated respectively.

[0195] Intra-domain contrast loss and inter-domain contrast loss: Based on the similarity calculation results, intra-domain contrast loss and inter-domain contrast loss are obtained.

[0196] Learnable parameters: The model contains learnable parameters, which are continuously adjusted during the training process through optimization algorithms to minimize the contrast loss function.

[0197] Optimization process: During the training process, the model updates the learnable parameters using optimization algorithms (such as stochastic gradient descent or Adam optimizer) based on the value of the contrast loss function, thereby optimizing the performance of the model.

[0198] Figure 4 The reconstruction process diagram provided by the present application in multiple modes is shown in Figure 4 As shown, the reconstruction of the positive sample starts from the original sequence. After pre-processing operations such as feature extraction, the original sequence is input into the local-global fusion bidirectional attention network. This network fuses local and global feature information, outputting a local-guided reconstruction vector and a global-guided reconstruction vector. These two vectors are spliced together to form the reconstruction vector of the positive sample. The reconstruction vector of the positive sample is used to reconstruct the original sequence, with the goal of minimizing the reconstruction loss, i.e., the reconstructed sequence should be as close to the original sequence as possible.

[0199] The reconstruction process of the negative sample perception also starts from the original sequence. The original sequence is input into the negative sample perception network, which also outputs a local-guided negative sample reconstruction vector and a global-guided negative sample reconstruction vector. These two vectors are spliced to form the reconstruction vector of the negative sample perception. The reconstruction vector of the negative sample perception is used to distinguish between positive and negative samples, with the goal of maximizing the difference between the positive and negative sample reconstruction losses, i.e., the reconstructed sequence of the negative sample should be significantly different from the original sequence.

[0200] During the training process, the model calculates the positive sample reconstruction loss and the positive-negative sample reconstruction difference loss. The positive sample reconstruction loss measures the difference between the reconstructed sequence and the original sequence, and the smaller the loss, the better the model's reconstruction effect on the positive sample. The positive-negative sample reconstruction difference loss ensures that the positive and negative samples have a clear distinction in the reconstruction space, preventing the model from overfitting to the abnormal features of the negative sample. By optimizing these two loss functions, the model can learn more robust feature representations and improve the accuracy of anomaly detection.

[0201] The Internet of Things anomaly data detection device provided by the present application is described below. The Internet of Things anomaly data detection device described below can be referred to in conjunction with the Internet of Things anomaly data detection method described above.

[0202] Figure 5 The structure diagram of the Internet of Things anomaly data detection device provided by the present application is shown in Figure 5 As shown, it includes:

[0203] The preprocessing module 510 is configured to perform data preprocessing on sensor raw time series data collected by each Internet of Things sensor to obtain preprocessed sensor time series data of each sensor; each sensor time series data includes sensor time series window data of multiple time windows;

[0204] The first input module 520 is configured to input the sensor time series window data into a multi-scale feature extraction model to obtain local features and global features of the sensor time series window data;

[0205] The second input module 530 is configured to input the local features and global features of the sensor time series window data into a bidirectional attention reconstruction model to output reconstructed local features and reconstructed global features;

[0206] The detection module 540 is configured to perform similarity analysis and inharmonious discovery analysis based on the local features, global features, reconstructed local features and reconstructed global features of the sensor time series window data to determine abnormal sensor time series window data.

[0207] In the present application, by carrying out data preprocessing operation on the original time series data collected by each Internet of Things sensor, including missing value completion, noise suppression and normalization, etc., a unified format multivariate time series is generated as the input of subsequent modeling. This step solves the problem of uneven quality of sensor data, ensures the accuracy and consistency of the data input into the model, and lays a foundation for further feature extraction and analysis. The preprocessed sensor time series window data is input into a multi-scale feature extraction model, which can capture both short-term and long-range dependencies in the time series, obtaining local features and global features of the data. This step can more comprehensively characterize the features of the time series through multi-scale analysis, focusing on both local subtle changes and overall trends, effectively improving the model's ability to detect different types of anomalies. The extracted local features and global features are input into a bidirectional attention reconstruction model, which outputs reconstructed local features and reconstructed global features. The design of the bidirectional attention reconstruction model enables the model to fully utilize the information interaction between local and global features, and more accurately restore the feature patterns of normal samples during the reconstruction process. In this way, the model can learn the feature representation of normal samples and compare it with the original features in subsequent analysis, thereby discovering potential anomalies. Based on the local features, global features, reconstructed local features and reconstructed global features of the sensor time series window data, similarity analysis and disharmony discovery analysis are performed. Similarity analysis is used to measure the difference between the original features and the reconstructed features, while disharmony discovery analysis further identifies abnormal parts that deviate significantly from the normal pattern. Through these two aspects of analysis, it can accurately determine which sensor time series window data is abnormal, thereby achieving precise detection and segmentation of anomalies.

[0208] Figure 6 is a structural schematic diagram of an electronic device provided by the present application, as shown in Figure 6 The electronic device can include a processor 610, a communications interface 620, a memory 630, and a communications bus 640, wherein the processor 610, the communications interface 620, and the memory 630 communicate with each other through the communications bus 640. The processor 610 can invoke the logic instructions in the memory 630 to execute an Internet of Things anomaly data detection method, which includes: performing data preprocessing on sensor original time series data collected by each Internet of Things sensor to obtain preprocessed sensor time series data; wherein each sensor time series data includes sensor time series window data of multiple time windows;

[0209] input the sensor time series window data into a multi-scale feature extraction model to obtain local features and global features of the sensor time series window data;

[0210] input the local features and the global features of the sensor time series window data into a bidirectional attention reconstruction model to output reconstructed local features and reconstructed global features;

[0211] perform similarity analysis and inharmonious discovery analysis based on the local features, the global features, the reconstructed local features and the reconstructed global features of the sensor time series window data to determine abnormal sensor time series window data.

[0212] In addition, the logic instructions in the memory 630 described above can be implemented in the form of a software function unit and sold or used as an independent product, and can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application essentially or the part that contributes to the prior art or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in the embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various media that can store program codes.

[0213] On the other hand, the present application also provides a computer program product, which comprises a computer program, the computer program can be stored on a non-transitory computer readable storage medium, and the computer program can be executed by a processor to enable a computer to execute the Internet of Things abnormal data detection method provided by the above-mentioned method. The method comprises: performing data preprocessing on sensor original time series data collected by each Internet of Things sensor to obtain preprocessed sensor time series data of each sensor;

[0214] input the sensor time series window data into a multi-scale feature extraction model to obtain local features and global features of the sensor time series window data;

[0215] input the local features and the global features of the sensor time series window data into a bidirectional attention reconstruction model to output reconstructed local features and reconstructed global features;

[0216] Based on the local features, global features, and reconstructed local features and reconstructed global features of the sensor time window data, similarity analysis and disharmony discovery analysis are performed to determine abnormal sensor time window data.

[0217] In another aspect, the present application also provides a non-transitory computer readable storage medium having stored thereon a computer program, which, when executed by a processor, implements the Internet of Things anomaly data detection method provided by the above method, the method comprising: performing data preprocessing on sensor raw time series data collected by each Internet of Things sensor to obtain preprocessed sensor time series data of each sensor;

[0218] The sensor time window data is input into a multi-scale feature extraction model to obtain local features and global features of the sensor time window data.

[0219] The local features and global features of the sensor time window data are input into a bidirectional attention reconstruction model to output reconstructed local features and reconstructed global features.

[0220] Based on the local features, global features, and reconstructed local features and reconstructed global features of the sensor time window data, similarity analysis and disharmony discovery analysis are performed to determine abnormal sensor time window data.

[0221] The device embodiments described above are only schematic, wherein the units shown as separate components can or can not be physically separate, and the components shown as units can or can not be physical units, i.e., can be located in one place, or can be distributed on multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the present embodiment. Those skilled in the art can understand and implement without creative labor.

[0222] From the above description of the embodiments, those skilled in the art can clearly understand that the embodiments can be implemented by means of software plus necessary general hardware platforms, and of course can also be implemented by hardware. Based on such understanding, the above technical solutions, essentially or in terms of the contribution to the prior art, can be embodied in the form of a software product, which can be stored in a computer readable storage medium, such as a ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute the methods described in each embodiment or some parts of the embodiments.

[0223] It should be pointed out finally that the above embodiments are only used to illustrate the technical solutions of the present application, but not to limit the same; and although the present application has been described in detail with reference to the foregoing embodiments, it should be appreciated by those skilled in the art that the technical solutions recorded in the foregoing embodiments can be modified, or some technical features thereof can be replaced equivalently; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for detecting abnormal data in the Internet of Things, characterized in that: include: Preprocessing the original sensor time series data collected by each IoT sensor to obtain preprocessed sensor time series data; wherein each of the sensor time series data includes sensor time series window data of multiple time windows; Inputting the sensor time series window data into a multi-scale feature extraction model to obtain local features and global features of the sensor time series window data; Inputting the local features and global features of the sensor time series window data into a bidirectional attention reconstruction model, and outputting reconstructed local features and reconstructed global features; Based on the local features, global features, and reconstructed local features and global features of the sensor time series window data, similarity analysis and discordance discovery analysis are performed to determine abnormal sensor time series window data; The method of performing similarity analysis and discordance discovery analysis based on the local features, global features, and reconstructed local features and global features of the sensor time series window data to determine abnormal sensor time series window data includes: Determine the contrast loss corresponding to each sensor time series window data based on the local features and global features of each sensor time series window data, so as to determine the first suspicious sensor time series window data in each of the sensor time series window data according to the contrast loss; Determine, based on the reconstructed local features and the reconstructed global features corresponding to each sensor time series window data, a reconstruction error corresponding to each sensor time series window data, and determine second suspicious sensor time series window data in each of the sensor time series window data; By using a discordance discovery algorithm, abnormal section analysis is performed on the first suspicious sensor time series window data and the second suspicious sensor time series window data to obtain abnormal sensor time series window data.

2. The method for detecting abnormal data in the Internet of Things according to claim 1, characterized in that: Before the step of inputting the sensor time series window data into a multi-scale feature extraction model to obtain local features and global features of the sensor time series window data, the method further includes: Preprocessing the sensor sample time series data of each IoT sensor to obtain preprocessed sensor sample time series data; Performing random data enhancement on the sensor sample time series data to obtain a negative sample of the sensor sample time series data; Based on the sensor sample time series data and the negative samples of the sensor sample time series data, a multi-scale feature extraction model is trained to output corresponding local feature samples, global feature samples, local feature negative samples, and global feature negative samples; wherein the multi-scale feature extraction model includes a local convolutional network and a global convolutional network with shared weights; Based on the local feature samples, global feature samples, local feature negative samples, and global feature negative samples, a bidirectional attention reconstruction model is trained to output corresponding reconstructed local feature samples and reconstructed global feature samples.

3. The method for detecting abnormal data in the Internet of Things according to claim 2, characterized in that: Training a multi-scale feature extraction model based on the sensor sample time series data and the negative sample of the sensor sample time series data includes: Perform cross-scale contrast loss calculation and intra-scale contrast loss calculation based on the local feature samples, the global feature samples, the local feature negative samples, the global feature negative samples, the sensor sample time series data, and the sensor sample time series data negative samples; Calculating a multi-scale contrast total loss based on the cross-scale contrast loss and the intra-scale contrast loss; The multi-scale feature extraction model is optimized according to the multi-scale contrast total loss until a first preset condition is met, thereby obtaining a trained multi-scale feature extraction model.

4. The method for detecting abnormal data in the Internet of Things according to claim 2, characterized in that: The bidirectional attention reconstruction model is trained based on the local feature samples, the global feature samples, the local feature negative samples, and the global feature negative samples, including: Through the negative sample-aware bidirectional attention mechanism, the local feature sample, the global feature sample, the local feature negative sample, and the global feature negative sample are used as queries and keys, and attention weights are calculated to reconstruct the local feature sample and the global feature sample according to the attention weights to obtain reconstructed local feature samples and reconstructed global feature samples; Calculating a regularization loss based on the reconstructed local feature samples and the reconstructed global feature samples, as well as the original local feature samples, the global feature samples, the local feature negative samples, and the global feature negative samples; According to the regularization loss, the bidirectional attention reconstruction model is optimized until the second preset training condition is met to obtain a trained bidirectional attention reconstruction model.

5. The method for detecting abnormal data in the Internet of Things according to claim 2, characterized in that: The data preprocessing method includes at least one of the following: Introducing random noise, applying random scaling factors, adjusting the signal amplitude according to a smooth curve, and rearranging parts of the time series.

6. An abnormal data detection device for the Internet of Things, characterized in that: include: A preprocessing module is used to preprocess the original sensor time series data collected by each IoT sensor to obtain preprocessed sensor time series data; wherein each of the sensor time series data includes sensor time series window data of multiple time windows; A first input module is used to input the sensor time series window data into a multi-scale feature extraction model to obtain local features and global features of the sensor time series window data; A second input module is used to input the local features and global features of the sensor time series window data into the bidirectional attention reconstruction model, and output the reconstructed local features and the reconstructed global features; A detection module, configured to perform similarity analysis and discordance detection analysis based on the local features, global features, and reconstructed local features and global features of the sensor time series window data, and determine abnormal sensor time series window data; Wherein, the device is also used for: Determine the contrast loss corresponding to each sensor time series window data based on the local features and global features of each sensor time series window data, so as to determine the first suspicious sensor time series window data in each of the sensor time series window data according to the contrast loss; Determine, based on the reconstructed local features and the reconstructed global features corresponding to each sensor time series window data, a reconstruction error corresponding to each sensor time series window data, and determine second suspicious sensor time series window data in each of the sensor time series window data; By using a discordance discovery algorithm, abnormal section analysis is performed on the first suspicious sensor time series window data and the second suspicious sensor time series window data to obtain abnormal sensor time series window data.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the method for detecting abnormal data in the Internet of Things as described in any one of claims 1 to 5 is implemented.

8. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method for detecting abnormal data in the Internet of Things as claimed in any one of claims 1 to 5 is implemented.

9. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the method for detecting abnormal data in the Internet of Things as claimed in any one of claims 1 to 5 is implemented.

Images