An anomaly detection method for industrial IoT time-series data based on concept drift recognition

Abstract

This invention discloses an anomaly detection method for industrial IoT time-series data based on concept drift identification, belonging to the field of time-series anomaly detection technology. The method includes: performing multi-scale concept drift detection on industrial IoT time-series data to obtain concept drift detection results; updating an adaptive ensemble model based on the concept drift detection results to obtain an optimal anomaly detection model; and using the optimal anomaly detection model to perform anomaly detection on the industrial IoT time-series data to obtain anomaly detection results. This invention, through an innovative multi-scale window analysis mechanism, can identify data distribution changes earlier, effectively shortening the concept drift detection delay; and by combining model pool management and dynamic ensemble learning methods, it optimizes computational efficiency while ensuring detection accuracy, achieving a smooth transition between old and new data distributions.

Description

Technical Field

[0001] This invention relates to the field of time series anomaly detection technology, and in particular to an industrial Internet of Things time series data anomaly detection method based on concept drift recognition. Background Technology

[0002] Uncertainty is an unavoidable inherent characteristic of industrial production and management. Enterprises and systems continuously strive to understand, identify, and cope with these uncertainties in complex and ever-changing environments. With the rapid development of the Industrial Internet of Things (IIoT), massive amounts of time-series data are continuously generated, recording the dynamic changes in key aspects such as equipment operating status, production process parameters, and environmental monitoring indicators. Time-series data, as the "pulse" of industrial system operation, carries crucial information reflecting equipment health and production anomalies. Therefore, timely and accurate detection of anomalies in time series data not only helps to identify potential faults early and reduce maintenance costs but also ensures production safety and improves overall operational efficiency. Especially in applications such as intelligent manufacturing, energy management, and smart factories, time-series anomaly detection has become one of the core technologies for achieving predictive maintenance, quality control, and decision support. Thus, research on time-series anomaly detection technology in the IIoT environment is not only a key link in promoting the intelligent transformation of industry but also a fundamental guarantee for addressing the challenges of uncertainty in complex industrial systems.

[0003] Existing anomaly detection methods are mainly divided into offline anomaly detection and online anomaly detection, depending on the scenario. In offline anomaly detection, it is assumed that the data follows a stationary distribution, maintaining a consistent distribution on both the training and test sets, and the model does not make any adjustments during the detection process on the test set. In online anomaly detection, the data belongs to a non-stationary distribution, and the data distribution changes over time. This means that the statistical characteristics of the data change continuously over time, and this distribution change over time is called concept drift.

[0004] Considering that data distribution in actual industrial IoT often changes due to external factors or changes in process flow, online anomaly detection methods are typically chosen. For example... Figure 1As shown, to effectively adapt to constantly changing data distributions, existing online anomaly detection typically involves two steps: first, detecting whether the data has changed—a process known as concept drift detection; then, based on the detection results, deciding whether to continue using the existing model or update the model to adapt to the new data distribution; and finally, after a suitable anomaly detection model is determined, the anomaly detection task is executed. However, in practice, existing concept drift detection methods have significant drawbacks. These methods usually require collecting a large number of samples with different data distributions before they can detect concept drift, resulting in a delay between the actual occurrence of concept drift and the actual detection of a distribution change. This prolonged delay in concept drift detection prevents the anomaly detection model from being updated to adapt to the new data distribution in a timely manner, leaving the model still using an unsuitable historical model for a considerable period after the data distribution changes, thus affecting the overall anomaly detection performance.

[0005] Therefore, there is an urgent need for an industrial IoT time-series data anomaly detection method based on concept drift recognition to solve the problem of long concept drift detection delay in existing online anomaly detection methods. Summary of the Invention

[0006] The purpose of this invention is to propose an anomaly detection method for time-series data in the Industrial Internet of Things based on concept drift identification. By using an early concept drift identification mechanism to perceive changes in data distribution in real time, an adaptive model update strategy is adopted to adjust the anomaly detection model, thereby improving the accuracy and timeliness of anomaly detection, while reducing the concept drift detection delay and ensuring the robustness and adaptability of the model in complex industrial environments.

[0007] To achieve the above objectives, this invention provides a method for detecting anomalies in industrial IoT time-series data based on concept drift recognition, comprising the following steps:

[0008] S1. Perform multi-scale concept drift detection on industrial IoT time series data and obtain the concept drift detection results of industrial IoT time series data;

[0009] S2. Based on the concept drift detection results of the industrial IoT time series data, perform adaptive ensemble model updates to obtain the optimal anomaly detection model;

[0010] S3. Use the optimal anomaly detection model to perform anomaly detection on the industrial IoT time series data and obtain the anomaly detection results of the industrial IoT time series data.

[0011] Optionally, S1, perform multi-scale concept drift detection on the industrial IoT time-series data to obtain the concept drift detection results of the industrial IoT time-series data, including:

[0012] Preprocessing of industrial IoT time-series data to obtain sub-window distribution characteristics;

[0013] Multi-scale concept drift detection is performed based on the distribution characteristics of the sub-windows to obtain the concept drift detection results of industrial IoT time-series data.

[0014] Optionally, the industrial IoT time-series data can be preprocessed to obtain sub-window distribution characteristics, including:

[0015] A sliding window mechanism is used to window industrial IoT time-series data to generate a continuous window sequence.

[0016] The continuous window sequence is divided to obtain non-overlapping sub-windows;

[0017] The non-overlapping sub-windows are mapped using a pre-trained deep encoder to obtain the sub-window distribution features.

[0018] Optionally, multi-scale concept drift detection is performed based on the distribution characteristics of the sub-windows to obtain the concept drift detection results of the industrial IoT time-series data, including:

[0019] Fine-grained analysis is performed based on the distribution characteristics of the sub-windows to obtain the average distribution difference between sub-windows as the result of mutation-type concept drift detection;

[0020] A coarse-grained analysis is performed on the distribution characteristics of the sub-windows to obtain the cumulative distribution differences between the sub-windows as the result of persistent concept drift detection;

[0021] The mutation-type concept drift detection results and the persistent concept drift detection results are obtained as the concept drift detection results of industrial Internet of Things time series data.

[0022] Optionally, S2, based on the concept drift detection results of the industrial IoT time-series data, an adaptive ensemble model update is performed to obtain the optimal anomaly detection model, including:

[0023] Using the concept drift detection results of the industrial IoT time series data, a threshold for the concept drift detection results of the industrial IoT time series data is set. The threshold for the concept drift detection results of the industrial IoT time series data includes a threshold for abrupt concept drift detection results and a threshold for persistent concept drift detection results.

[0024] Determine whether the mutation concept drift detection result exceeds the mutation concept drift detection result threshold. If yes, perform the first operation; otherwise, perform the second operation.

[0025] The first operation is: to perform adaptive ensemble model updates through a model pool to obtain the optimal anomaly detection model, wherein the model pool includes historical anomaly detection models and corresponding feature indices;

[0026] The second operation is as follows: determine whether the persistent concept drift detection result exceeds the threshold of the persistent concept drift detection result. If so, execute the first operation; otherwise, obtain the current anomaly detection model as the optimal anomaly detection model and directly execute S3.

[0027] Optionally, adaptive ensemble model updates can be performed through a model pool to obtain the optimal anomaly detection model, including:

[0028] Based on the distribution characteristics of the sub-windows, the similarity of the feature indices is obtained;

[0029] A similarity threshold is set using the similarity of the feature indexes;

[0030] Determine whether the similarity of the feature indexes exceeds the similarity threshold. If so, obtain the optimal anomaly detection model based on the similarity of the feature indexes in the model pool. Otherwise, perform the third operation.

[0031] The third operation is as follows: based on the concept drift detection results of the industrial IoT time series data, the optimal anomaly detection model is obtained using the non-overlapping sub-window.

[0032] Optionally, based on the concept drift detection results of the industrial IoT time-series data, the optimal anomaly detection model is obtained using the non-overlapping sub-window, including:

[0033] Based on the concept drift detection results of the aforementioned industrial IoT time-series data, the concept drift location is determined;

[0034] The non-overlapping sub-windows are divided according to the concept drift position to obtain a historical data subset and a current data subset. The historical data subset is the window data before the concept drift occurred, and the current data subset is the window data after the concept drift occurred.

[0035] A historical sub-model is trained using the historical data subset, and a current sub-model is trained using the current data subset. Both the historical sub-model and the current sub-model employ an autoencoder structure.

[0036] The residual autocorrelation between the historical sub-model and the current sub-model is dynamically evaluated using the Durbin-Watson statistic to obtain the adaptive weights of the historical sub-model and the current sub-model.

[0037] Based on the adaptive weights of the historical sub-model and the current sub-model, parameters are fused to obtain an integrated model as a candidate optimal anomaly detection model;

[0038] Based on the candidate optimal anomaly detection models, the optimal anomaly detection model is obtained.

[0039] Optionally, S2, after performing adaptive ensemble model updates based on the concept drift detection results of the industrial IoT time-series data to obtain the optimal anomaly detection model, further includes:

[0040] The model pool is updated using the optimal anomaly detection model and its corresponding feature index.

[0041] Optionally, S3, using the optimal anomaly detection model to perform anomaly detection on the industrial IoT time-series data, and obtaining the industrial IoT time-series data anomaly detection results, including:

[0042] The industrial IoT time series data is input into the optimal anomaly detection model and anomaly detection is performed using reconstruction error detection to obtain the industrial IoT time series data anomaly detection results.

[0043] The optimal anomaly detection model consists of an encoder and a decoder, and the calculation formula for the reconstruction error detection is as follows:

[0044] C t =|B t -K t (Z t )| 2

[0045] Among them, C t For the reconstructed anomaly score sequence, B t For a continuous window sequence, K t Z is the neural network function of the encoder. t This represents the latent space encoding.

[0046] Compared with the closest existing technology, the present invention has the following advantages:

[0047] This invention, through an innovative multi-scale window analysis mechanism, can identify data distribution changes earlier, effectively shortening the concept drift detection delay and solving the key problem of traditional methods requiring a large number of new data samples to detect distribution changes, thus significantly improving anomaly detection performance. This invention proposes an intelligent progressive model update strategy, combining model pool management and dynamic ensemble learning methods to optimize computational efficiency while ensuring detection accuracy, achieving a smooth transition between old and new data distributions, making it particularly suitable for resource-constrained industrial IoT environments. This invention has high compatibility and scalability, adapting to various basic anomaly detection algorithms and supporting industrial equipment with different computing capabilities, making it widely applicable in various industrial scenarios such as intelligent manufacturing and equipment monitoring. Attached Figure Description

[0048] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0049] Figure 1 This is a flowchart illustrating online anomaly detection in existing industrial IoT scenarios as proposed in this embodiment of the invention;

[0050] Figure 2 This is a schematic diagram illustrating the classification of typical concept drift types in industrial scenarios proposed in this embodiment of the invention;

[0051] Figure 3 This is a flowchart of an industrial IoT time-series data anomaly detection method based on concept drift recognition, according to an embodiment of the present invention.

[0052] Figure 4 This is a schematic diagram of the online anomaly detection framework architecture based on early concept drift recognition proposed in an embodiment of the present invention. Detailed Implementation

[0053] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions in the embodiments of this invention will be clearly and completely described below with reference to specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this invention, and not all of them. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0054] The terminology used in the embodiments section of this invention is for the purpose of explaining specific embodiments of the invention only, and is not intended to limit the invention.

[0055] like Figure 2 As shown, concept drift in industrial scenarios mainly presents two forms based on its evolutionary characteristics: (1) abrupt concept drift, which is triggered by discrete events such as equipment failure switching or production plan adjustment, and is characterized by a step change in data distribution; (2) persistent concept drift, which originates from continuous processes such as equipment aging or environmental changes, and is characterized by a gradual migration of data features. This invention proposes an industrial IoT time-series data anomaly detection method based on concept drift identification for online anomaly detection tasks in the industrial IoT environment. It mainly consists of three aspects: multi-scale concept drift detection, model adaptive update, and anomaly detection.

[0056] like Figure 3-4As shown, this embodiment of the invention provides a method for detecting anomalies in industrial IoT time-series data based on concept drift recognition, including:

[0057] S1. Perform multi-scale concept drift detection on industrial IoT time series data and obtain the concept drift detection results of industrial IoT time series data;

[0058] In multi-scale concept drift detection, this step employs a hierarchical windowing mechanism: first, the input data stream is divided into continuous sliding windows, and then each sliding window is further subdivided into several non-overlapping sub-windows. This dual-window design enables multi-scale perception of concept drift. By analyzing the changes in data distribution between adjacent sub-windows, it can keenly capture abrupt concept drift; simultaneously, by calculating the cumulative statistics of the differences in distribution between multiple historical windows and the current window, it can reliably identify persistent concept drift.

[0059] S2. Based on the concept drift detection results of the industrial IoT time series data, perform adaptive ensemble model updates to obtain the optimal anomaly detection model;

[0060] Upon detecting concept drift, an efficient model update strategy is employed. To avoid the computational overhead of repeated training, this step maintains an intelligent model pool, storing historical anomaly detection models and their corresponding feature indices. The update process employs a two-stage decision-making mechanism: first, a similarity search is performed in the model pool based on the current data distribution characteristics; if a matching historical model is found, it is directly reused; otherwise, the training process for a new model is triggered. This mechanism ensures timely adaptation of the model to the data distribution while minimizing the consumption of computational resources.

[0061] To address the issue of insufficient new distribution data in the early stages of concept drift during the model update phase, a progressive ensemble learning mechanism was designed. Upon detecting a previously unseen data distribution, the framework simultaneously maintains two sub-models: one based on limited new distribution data (the current sub-model) and the other based on historical distribution data (the historical sub-model), merging them into an ensemble model based on their weights. Through a dynamic ensemble strategy, the weights of these two sub-models are automatically adjusted based on their stability on their respective datasets. Initially, the historical sub-model dominates due to ample data; as new data accumulates, the stability of the current sub-model gradually increases, and its weight naturally increases accordingly. The entire process employs continuous online learning updates. Once the current sub-model reaches stability within a continuous time window, the framework automatically completes the transition to the dominant model, achieving a seamless transition from the old to the new distribution. Simultaneously, the features of the current ensemble model and the current data segment are used as indexes to update the model pool. This design preserves the reliable information of the historical model while progressively adapting to the new distribution, ultimately ensuring that the model always maintains an optimal match with the current data environment.

[0062] S3. Use the optimal anomaly detection model to perform anomaly detection on the industrial IoT time series data and obtain the anomaly detection results of the industrial IoT time series data.

[0063] In anomaly detection, a reconstruction error detection method based on an autoencoder is employed. The encoder, after the aforementioned adaptive training process, can accurately capture the feature patterns of normal data, maintaining a low reconstruction error for normal data during reconstruction, while exhibiting a significantly increased reconstruction error for anomalous data. Specifically, the framework uses a dynamic threshold mechanism; when the reconstruction error exceeds an adaptive threshold obtained through sliding window statistics, the current data point is determined to be an anomaly. This detection mechanism, together with the aforementioned concept drift detection and model update modules, forms an organic whole, constituting a complete adaptive anomaly detection framework. It is worth noting that the anomaly determination threshold is also dynamically adjusted according to changes in data distribution, ensuring that detection performance remains stable under different data distributions.

[0064] In summary, steps S1 to S3, through a multi-scale perception mechanism, not only improve the accuracy of anomaly detection in industrial IoT time-series data, but also identify these two typical data distribution changes in real time, significantly shortening the concept drift detection delay and ensuring that the model can quickly adapt to the dynamically changing industrial environment. Furthermore, through an intelligent progressive model update strategy, combined with model pool management and dynamic ensemble learning methods, the model can not only improve the accuracy of anomaly detection in industrial IoT time-series data, but also identify changes in data distribution in real time, significantly shortening the concept drift detection delay and ensuring that the model can quickly adapt to the dynamically changing industrial environment.

[0065] As one possible implementation, in the above embodiments, step S1 may specifically include the following steps:

[0066] S1-1. Preprocess the industrial IoT time-series data to obtain the sub-window distribution characteristics;

[0067] S1-2. Perform multi-scale concept drift detection based on the distribution characteristics of the sub-window to obtain the concept drift detection results of industrial IoT time series data.

[0068] As one possible implementation, in the above embodiments, step S1-1 may specifically include the following steps:

[0069] S1-1-1. A sliding window mechanism is used to perform windowing processing on industrial IoT time-series data to generate a continuous window sequence.

[0070] First, the input industrial IoT time-series data is processed. Windowing is performed using a sliding window mechanism with a window size of W and a sliding step size of S to generate a continuous window sequence. , where xt x represents the industrial IoT time-series data collected at time t, where t is the time index and x is the time index. t-i t represents the industrial IoT time-series data collected at time ti, where i is the sub-window index.

[0071] S1-1-2. Divide the continuous window sequence to obtain non-overlapping sub-windows;

[0072] Each window B t Further divided into N non-overlapping sub-windows of length S ,in, Let be the i-th sub-window at time t, and N be the total number of non-overlapping sub-windows.

[0073] S1-1-3. The non-overlapping sub-windows are mapped using a pre-trained deep encoder to obtain the sub-window distribution features;

[0074] Each sub-window is processed by a pre-trained deep encoder f. The data in the dataset is mapped to the latent feature space to obtain the corresponding probability distribution. The calculation formula is as follows:

[0075] (1)

[0076] Where j is the index of the data point within the sub-window, and x j child window The j-th industrial IoT time-series data.

[0077] As one possible implementation, in the above embodiments, step S1-2 may specifically include the following steps:

[0078] S1-2-1. Based on the distribution characteristics of the sub-windows, perform fine-grained analysis to obtain the average distribution difference between sub-windows as the result of mutation-type concept drift detection.

[0079] S1-2-2, Perform coarse-grained analysis on the distribution characteristics of the sub-windows, and obtain the cumulative distribution difference between the sub-windows as the result of persistent concept drift detection;

[0080] S1-2-3. Obtain the mutation-type concept drift detection result and the persistent-type concept drift detection result as the concept drift detection result of the industrial Internet of Things time series data.

[0081] in accordance with probability distribution By calculating the relationship between two data segments (e.g.) and The difference in probability distribution of the two data segments is shown in Formula (2) to measure whether the two data segments follow the same distribution.

[0082] (2)

[0083] in, Let i be the (i-1)th sub-window at time t. for and Differences in probability distribution, for The probability distribution.

[0084] A multi-scale concept drift detection mechanism is adopted to achieve early identification of data distribution changes through two-level analysis. At the fine-grained level, the average distribution difference between the new sub-window and the current window is calculated using equation (3). This enables real-time detection of mutational concept drift; at a coarse-grained level, the cumulative distribution deviation between windows is calculated using equation (4). To capture early trends in persistent concept drift.

[0085] (3)

[0086] (4)

[0087] in, for and Differences in probability distribution, Let N be the N sub-windows corresponding to time t, l be the number of intervals between the current window and the previous concept drift window (rounded down), and k be a variable used to calculate the cumulative error by iterating from 1 to k. for and The difference in probability distribution, B t-d This represents the d-th historical window preceding the current window, from which S data points are randomly sampled to form a subset. Furthermore, an exponential weighting coefficient α is used to adjust the influence of time distance, giving greater weight to the recent window (which reflects the latest drift characteristics).

[0088] As one possible implementation, in the above embodiments, step S2 may specifically include the following steps:

[0089] S2-1. Using the concept drift detection results of the industrial IoT time series data, set a threshold for the concept drift detection results of the industrial IoT time series data. The threshold for the concept drift detection results of the industrial IoT time series data includes a threshold for abrupt concept drift detection results and a threshold for persistent concept drift detection results.

[0090] S2-2. Determine whether the mutation concept drift detection result exceeds the mutation concept drift detection result threshold. If yes, execute S2-3; otherwise, execute S2-4 directly.

[0091] S2-3. Adaptive ensemble model update is performed through the model pool to obtain the optimal anomaly detection model. The model pool includes historical anomaly detection models and corresponding feature indices.

[0092] S2-4. Determine whether the persistent concept drift detection result exceeds the persistent concept drift detection result threshold. If yes, return to S2-3. Otherwise, obtain the current anomaly detection model as the optimal anomaly detection model and directly execute S3.

[0093] In the concept drift detection results, when any detection index exceeds the adaptive threshold, it is determined that concept drift has occurred and the anomaly detection model update process is triggered; otherwise, the existing model continues to be used.

[0094] As one possible implementation, in the above embodiments, step S2-3 may specifically include the following steps:

[0095] S2-3-1. Based on the distribution characteristics of the sub-windows, obtain the similarity of the feature indices;

[0096] S2-3-2. Using the similarity of the feature indexes, set a similarity threshold;

[0097] S2-3-3: Determine whether the similarity of the feature indexes exceeds the similarity threshold. If so, obtain the optimal anomaly detection model based on the similarity of the feature indexes in the model pool. Otherwise, execute S2-3-4.

[0098] S2-3-4. Based on the concept drift detection results of the industrial IoT time series data, the optimal anomaly detection model is obtained using the non-overlapping sub-window.

[0099] If a model update is required, it is calculated using equation (5). With model pool M={M1,M2,…,M n Any model M in} j Corresponding feature index m j similarity :

[0100] (5)

[0101] in, The probability distribution characteristics of the latest sub-window at time t.

[0102] Based on this calculation result, an automatic decision is made: if there are candidate models with a similarity exceeding the threshold τ, then the model M with the highest similarity is selected. * As a new anomaly detection model; if no matching model is available, the new model training process is triggered.

[0103] As one possible implementation, in the above embodiments, step S2-3-4 may specifically include the following steps:

[0104] S2-3-4-1. Based on the concept drift detection results of the aforementioned industrial IoT time-series data, determine the concept drift location;

[0105] S2-3-4-2. Divide the non-overlapping sub-windows according to the concept drift position to obtain historical data subsets and current data subsets;

[0106] S2-3-4-3. Train a historical sub-model using the historical data subset and train a current sub-model using the current data subset. Both the historical sub-model and the current sub-model adopt an autoencoder structure.

[0107] S2-3-4-4. The autocorrelation of the residuals between the historical sub-model and the current sub-model is dynamically evaluated using the Durbin-Watson statistic to obtain the adaptive weights of the historical sub-model and the current sub-model.

[0108] S2-3-4-5. Based on the adaptive weights of the historical sub-model and the current sub-model, perform parameter fusion to obtain the integrated model as a candidate optimal anomaly detection model;

[0109] S2-3-4-6. Based on the candidate optimal anomaly detection models, obtain the optimal anomaly detection model.

[0110] When none of the existing models in the model pool can effectively represent the new data distribution, a new ensemble model M is trained. e Based on the known drift position Non-overlapping child windows Divided into historical data subset D h and the current data subset D c Train the historical sub-model M separately h and the current sub-model M c The historical data subset represents the window data before concept drift occurred, while the current data subset represents the window data after concept drift occurred. The residual autocorrelation of each sub-model is dynamically evaluated using the Durbin-Watson (DW) statistic, and adaptive weights w are calculated accordingly. h (t) and w c(t), and finally, the parameters are fused using equation (6) to generate an integrated model as a candidate optimal model. During the continuous update process, the current sub-model M c The ensemble model is gradually stabilized and eventually becomes dominant, achieving a smooth adaptation to new data distributions. Finally, the detection accuracy (e.g., F1 score) of the candidate optimal models is compared on the validation set, and the model with the highest accuracy is selected as the optimal anomaly detection model M. * .

[0111] θ e( t)=w h (t)θ h (t)+w c (t)θ c (t)(6)

[0112] Where, θ h (t), θ c (t), θ e( t) represent the parameters of the historical sub-model, the current sub-model, and the fusion model, respectively.

[0113] As one possible implementation, in the above embodiment, step S2 further includes the following step:

[0114] The model pool is updated using the optimal anomaly detection model and its corresponding feature index.

[0115] Once the model is stable, the framework will calculate its feature representation m using equation (7). e And the optimized M e Together with its feature index, it is updated to the model pool, providing an adapted model for subsequent possible recurring concepts.

[0116] (7)

[0117] in, This represents the latest sub-window probability distribution characteristics at time t+n. This is the latest sub-window at time t+n.

[0118] As one possible implementation, in the above embodiment, step S3 further includes the following step:

[0119] The industrial IoT time series data is input into the optimal anomaly detection model, and anomaly detection is performed using reconstruction error detection to obtain the industrial IoT time series data anomaly detection results.

[0120] Anomaly detection based on autoencoder reconstruction error is used. The optimal anomaly detection model consists of an encoder and a decoder, and its reconstruction error detection calculation formula is as follows:

[0121] C t =|Bt -K t (Z t )| 2 (8)

[0122] (9)

[0123] Z t =Q t (B t (10)

[0124] (11)

[0125] Among them, C t For the reconstructed anomaly score sequence, B t For a continuous window sequence, K t Z is the neural network function of the decoder. t K represents the latent space encoding. t (z) is the reconstructed vector, which has the same dimension as the input, i.e., K. t (z)∈R n z is a latent vector from the encoder output, z∈R d , These are the weights of the second layer of the decoder (recovering to the input dimension n). d 1_dec Hiding dimensions for the decoder, ReLU is the activation function for the hidden layer of the decoder (the final layer is linear). These are the weights of the first layer of the decoder. , For the first layer bias of the decoder, , For the second layer bias of the decoder, Q t Q is the neural network function of the encoder. t (x) is the latent representation vector, Q t (x)∈R d Let x be the input vector, x∈R n W (rsr) The projection matrix (trainable) is the projection of a D-dimensional representation onto a d-dimensional representation, W. (rsr) ∈R D×d T is the transpose. For the encoder's second layer weights, σ1 and σ2 are ReLU activation functions. These are the weights of the encoder's first layer. , For the encoder's first layer bias, , For the second layer bias of the encoder, d, n, d1, and D are dimensions. This method leverages the high accuracy of autoencoders in reconstructing normal data but the large error in reconstructing abnormal data, using the reconstruction error as an anomaly score. To ensure that the detection results reflect the latest data features, this framework pays particular attention to the latest sub-window. Corresponding reconstruction error When the error exceeds a predetermined threshold, it is considered abnormal.

[0126] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0127] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0128] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0129] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0130] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of the present invention. Any modifications or equivalent substitutions that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. An industrial internet of things time series data anomaly detection method based on concept drift recognition, characterized in that, The method comprises the following steps: S1, multi-scale concept drift detection is performed on the industrial Internet of Things time series data to obtain concept drift detection results of the industrial Internet of Things time series data, comprising: The industrial Internet of Things time series data is preprocessed to obtain sub-window distribution features, comprising: The industrial Internet of Things time series data is windowed using a sliding window mechanism to generate a continuous window sequence, the industrial Internet of Things time series data comprising dynamic changes in device operating status, production process parameters, and environmental monitoring indicators; The continuous window sequence is divided to obtain non-overlapping sub-windows; The non-overlapping sub-windows are mapped using a pre-trained deep encoder to obtain sub-window distribution features; Multi-scale concept drift detection is performed based on the sub-window distribution features to obtain concept drift detection results of the industrial Internet of Things time series data, comprising: Based on the sub-window distribution features, fine-grained analysis is performed to obtain the average distribution difference between sub-windows as a sudden concept drift detection result; Coarse-grained analysis is performed on the sub-window distribution features to obtain the cumulative distribution difference between sub-windows as a continuous concept drift detection result; The sudden concept drift detection result and the continuous concept drift detection result are obtained as the concept drift detection results of the industrial Internet of Things time series data; S2, based on the concept drift detection results of the industrial Internet of Things time series data, an adaptive integrated model is updated to obtain an optimal anomaly detection model, comprising: Using the concept drift detection results of the industrial Internet of Things time series data, a concept drift detection result threshold of the industrial Internet of Things time series data is set, the concept drift detection result threshold of the industrial Internet of Things time series data comprising a sudden concept drift detection result threshold and a continuous concept drift detection result threshold; Determine whether the sudden concept drift detection result exceeds the sudden concept drift detection result threshold, if yes, perform the first operation, otherwise, perform the second operation; Wherein, the first operation is: through the model pool, the adaptive integrated model is updated to obtain the optimal anomaly detection model, comprising: According to the sub-window distribution features, the similarity of the feature index is obtained; Using the similarity of the feature index, a similarity threshold is set; Determine whether the similarity of the feature index exceeds the similarity threshold, if yes, based on the model pool, the similarity of the feature index is used to obtain the optimal anomaly detection model, otherwise, perform the third operation; Wherein, the third operation is: based on the concept drift detection results of the industrial Internet of Things time series data, the non-overlapping sub-windows are used to obtain the optimal anomaly detection model, comprising: Based on the concept drift detection results of the industrial Internet of Things time series data, the concept drift position is determined; According to the concept drift position, the non-overlapping sub-windows are divided to obtain a historical data subset and a current data subset, the historical data subset being the window data before the concept drift occurs, and the current data subset being the window data after the concept drift occurs; training a historical sub-model using the historical data subset and training a current sub-model using the current data subset, the historical sub-model and the current sub-model both adopting an auto-encoder structure; dynamically evaluating residual autocorrelation of the historical sub-model and the current sub-model by a Durbin-Watson statistic, and obtaining adaptive weights of the historical sub-model and the current sub-model; performing parameter fusion based on the adaptive weights of the historical sub-model and the current sub-model, and obtaining an integrated model as a candidate optimal anomaly detection model; obtaining an optimal anomaly detection model according to the candidate optimal anomaly detection model; the model pool comprises historical anomaly detection models and corresponding feature indexes; the second operation is: judging whether the sustained concept drift detection result exceeds the sustained concept drift detection result threshold, if yes, performing the first operation, otherwise, obtaining a current anomaly detection model as an optimal anomaly detection model, and directly performing S3; S3, using the optimal anomaly detection model to perform anomaly detection on the industrial Internet of Things time series data, and obtaining an industrial Internet of Things time series data anomaly detection result.

2. The concept-drift-identification-based industrial IoT time series data anomaly detection method according to claim 1, characterized in that, S2, based on the concept drift detection result of the industrial Internet of Things time series data, performing adaptive integrated model updating, and obtaining an optimal anomaly detection model further comprises: updating the model pool using the optimal anomaly detection model and the corresponding feature index. 3.The concept-drift-identification-based industrial IoT time series data anomaly detection method of claim 1, wherein, S3, using the optimal anomaly detection model to perform anomaly detection on the industrial Internet of Things time series data, and obtaining an industrial Internet of Things time series data anomaly detection result, comprising: inputting the industrial Internet of Things time series data into the optimal anomaly detection model to perform anomaly detection using reconstruction error detection, and obtaining an industrial Internet of Things time series data anomaly detection result; wherein the optimal anomaly detection model is composed of an encoder and a decoder, and the calculation formula of the reconstruction error detection is as follows: C t =| B t - K t ( Z t )| 2 wherein, C t is a sequence of reconstruction-based anomaly scores, B t is a sequence of consecutive windows, K t is a neural network function of the encoder, Z t denotes the latent space encoding.

Images