An abnormal data analysis method based on industrial internet of things

Abstract

The application belongs to the technical field of industrial Internet of Things, and specifically discloses an abnormal data analysis method based on industrial Internet of Things, which comprises the following steps: in the alarm distribution path, forward error correction coding is used to compress alarm data to generate fault-tolerant transmission data packets; if a micro-service node fault is detected, a preset backup routing table is used to recalculate the distribution path to obtain an updated alarm distribution path; the fault-tolerant transmission data packets are transmitted to target nodes according to the updated alarm distribution path to complete alarm distribution; and alarm processing feedback is obtained from the target nodes. The application aims to solve the technical problem that in the prior art, in the industrial Internet of Things, when facing large-scale equipment concurrent scenes with abnormal data surges, key alarms are ignored, and distribution is not timely due to problems such as uneven resource allocation, processing delay, lack of dynamic adjustment capability and node faults, thereby affecting alarm response efficiency and system stability.

Description

Technical Field

[0001] This invention relates to the field of industrial Internet of Things (IoT) technology, and more specifically to an anomaly data analysis method based on industrial IoT. Background Technology

[0002] The Industrial Internet of Things (IIoT) is crucial in modern industry, ensuring stable equipment operation through real-time monitoring and data analysis. Especially in complex scenarios such as petrochemicals and power plants, operation and maintenance alarm systems play a decisive role in safe production and efficiency improvement. Currently, most solutions rely on simple rules to trigger alarms, making them ill-suited for large-scale concurrent equipment scenarios. Particularly when abnormal data surges, systems are prone to overlooking critical alarms due to uneven resource allocation or processing delays. For example, in petrochemical plants, sensor false alarms caused by environmental interference consume system resources, potentially leading to delayed responses to pressure valve failure alarms and increasing safety risks. Existing methods exhibit significant limitations in high-concurrency scenarios. Many systems lack the ability to dynamically adjust alarm priorities, making it difficult to intelligently classify alarms based on the urgency and scope of impact. Static processing logic cannot cope with communication congestion caused by a surge in the number of devices or faulty nodes, thus affecting the real-time nature of alarm distribution. Furthermore, fault tolerance mechanisms often neglect the overhead of compression encoding, resulting in low data transmission efficiency, especially when bandwidth is limited, making it difficult to guarantee the timeliness of alarm aggregation and command issuance. The core challenge lies in achieving a balance between intelligent alarm classification and rapid distribution. Intelligent tiering relies on performance metrics analysis of anomaly detection algorithms, such as decreased accuracy or increased false alarm rate. However, under high concurrency, resource contention in microservice modules can lead to delays in tiering decisions. Tiered alerts need to be quickly distributed to processing nodes via dynamic routing, but node failures or inefficient routing algorithms can cause alert backlogs. For example, in a petrochemical plant, emergency alerts for critical equipment may remain in the system due to routing node failures, while low-priority alerts consume bandwidth, affecting the real-time performance of command issuance. Therefore, optimizing the real-time performance of intelligent tiering algorithms under high-concurrency scenarios and designing efficient dynamic routing strategies to ensure priority distribution of critical alerts have become critical issues that industrial IoT operation and maintenance alert systems urgently need to address. Summary of the Invention

[0003] This invention provides an anomaly data analysis method based on the Industrial Internet of Things (IIoT). The purpose is to solve the technical problems in the existing technology of the IIoT when facing a surge of anomaly data in a large-scale concurrent device scenario. These problems include uneven resource allocation, processing delays, lack of dynamic adjustment capabilities, and node failures, which lead to the neglect of key alarms and untimely distribution, thereby affecting alarm response efficiency and system stability.

[0004] To solve the above-mentioned technical problems, the technical solution adopted by the present invention is as follows:

[0005] An anomaly data analysis method based on the Industrial Internet of Things (IIoT) involves: calculating anomaly scores using an anomaly detection algorithm based on data acquired from sensor data streams; initially classifying alarms according to preset thresholds to obtain an initial alarm priority sequence; adjusting the alarm processing order using a weighted priority scheduling algorithm based on the initial alarm priority sequence to obtain a high-priority alarm processing queue; allocating alarm processing queues to microservice nodes using a consistent hashing algorithm to obtain a load-balanced alarm distribution path; compressing alarm data using forward error correction coding within the alarm distribution path to generate fault-tolerant transmission data packets; recalculating the distribution path using a preset backup routing table if a microservice node failure is detected to obtain an updated alarm distribution path; transmitting the fault-tolerant transmission data packets to the target node according to the updated alarm distribution path to complete alarm distribution; obtaining alarm processing feedback from the target node and batch processing the feedback data using a time window aggregation algorithm to generate alarm processing results; optimizing the data transmission path using a bandwidth adaptive allocation algorithm for the alarm processing results to obtain a final maintenance instruction distribution sequence; and transmitting instructions to the device terminal according to the final maintenance instruction distribution sequence to complete the alarm response.

[0006] In one aspect of this disclosure, the step of calculating anomaly scores using an anomaly detection algorithm based on data acquired from sensor data streams, and performing preliminary alarm classification according to preset thresholds to obtain an initial alarm priority sequence includes:

[0007] Real-time data is obtained from the sensor data stream, and the anomaly score of each data point is calculated using the isolated forest algorithm to obtain the anomaly score set.

[0008] If the abnormal score exceeds the preset threshold, it is marked as a potential anomaly, and a preliminary anomaly list containing anomaly identifiers is generated.

[0009] Based on the outliers in the preliminary outlier list, a clustering algorithm is used to group the outliers and obtain an outlier group set.

[0010] Based on the grouping set of outliers, calculate the average outlier score for each group to obtain the outlier intensity index for each group.

[0011] If the abnormal intensity index is higher than the preset intensity threshold, a high-priority alarm is generated, resulting in a high-priority alarm sequence.

[0012] Based on the high-priority alarm sequence and combined with the timestamp information of the anomaly points, a time-ordered alarm priority sequence is generated;

[0013] Based on the alarm priority sequence ordered by time, a sliding window analysis is used to analyze the temporal distribution characteristics of anomalies and obtain the final alarm priority sequence.

[0014] In one aspect of this disclosure, the step of adjusting the alarm processing order according to the initial alarm priority sequence using a weighted priority scheduling algorithm to obtain a high-priority alarm processing queue includes:

[0015] By parsing the initial alarm sequence, the priority attributes and timestamps of the alarms are obtained, and the alarm classification is determined.

[0016] Based on alarm classification and priority weight, a weighted priority scheduling algorithm is used to calculate the comprehensive priority score of each alarm, resulting in a sorted alarm sequence.

[0017] If the overall priority score is higher than the preset threshold, the corresponding alarm will be marked as high priority, and a set of high priority alarms will be generated.

[0018] Based on the real-time scheduling mechanism, obtain the set of high-priority alarms, dynamically adjust the processing order, and determine the alarm processing queue;

[0019] Based on the alarm processing queue, system resources are allocated, queue execution efficiency is optimized, and a real-time updated processing sequence is obtained; if the alarm triggering status in the processing sequence changes, the priority weight is recalculated and the alarm processing queue is updated.

[0020] Based on the optimization results of the monitoring queue, obtain processing efficiency data, adjust the weight allocation strategy, and determine the final alarm handling plan.

[0021] In one aspect of this disclosure, the step of allocating alarms to microservice nodes using a consistent hashing algorithm based on the high-priority alarm processing queue to obtain a load-balanced alarm distribution path includes:

[0022] The hash value of high-priority alerts is calculated using a consistent hashing algorithm to determine the target microservice node and obtain the alert distribution path;

[0023] The target node is determined by finding the first node in the clockwise direction that is greater than or equal to the alarm hash value. If the microservice node pointed to by the hash value has a load exceeding a preset threshold, the neighboring nodes are found through a consistent hash ring to redetermine the distribution path.

[0024] Based on the priority queue and distribution path, the data is transmitted to the target service node to obtain high-priority alerts and alert processing tasks.

[0025] Based on the service node's processing of alarm tasks, the processing results are obtained, and it is determined whether the results meet the preset response time requirements. If the processing results do not meet the response time requirements, the microservice node allocation is adjusted through the load balancing algorithm to obtain a new distribution path.

[0026] Based on the adjusted distribution path, incomplete alerts will be reassigned to new service nodes to obtain updated processing tasks;

[0027] Based on the updated processing task, obtain the final processing result and determine the alarm processing completion status.

[0028] In one aspect of this disclosure, the step of compressing the alarm data using forward error correction coding in the alarm distribution path to generate a fault-tolerant transmission data packet includes:

[0029] Acquire alarm data streams and extract raw alarm data from the source system through a preset acquisition interface to obtain an unprocessed alarm dataset;

[0030] Based on forward error correction coding, the unprocessed alarm dataset is encoded. The Reed-Solomon coding algorithm is used to generate an encoded dataset containing redundancy checks. The Reed-Solomon coding algorithm achieves error detection and correction by adding redundant bits.

[0031] The compressed coded dataset is processed using a lossless compression algorithm to generate a compressed dataset. The lossless compression algorithm is Huffman coding, and the coding length is allocated according to the data frequency to obtain the compressed data structure.

[0032] Based on the fault-tolerant transmission data packets, a compressed dataset is obtained, and the compressed dataset is divided into fixed-size data units. Packet headers and check bits are added to obtain a set of fault-tolerant transmission data packets. If packet loss occurs in the transmission path, the lost data units are recovered by applying the Reed-Solomon decoding algorithm through the redundant check bits in the set of fault-tolerant transmission data packets, and a complete set of transmission data packets is obtained.

[0033] The integrity of the transmitted data packet set is verified by calculating the checksum of the received data packet. The data packet is then compared with the checksum of the sending end. If the checksums match, the data integrity is confirmed, and a set of data packets that have passed the verification is obtained.

[0034] Once the distributed and verified data packet set is sent to the target system via a preset transmission protocol, a multi-path transmission mechanism is employed to select the optimal path based on network conditions, resulting in a distributed data stream.

[0035] In one aspect of this disclosure, the step of recalculating the distribution path using a preset backup routing table to obtain an updated alarm distribution path if a microservice node failure is detected includes:

[0036] Based on the detection of microservice node failures, and by obtaining node status information through the status monitoring module, the faulty node identifier is determined.

[0037] Based on the fault node identifier, obtain the available route configuration from the preset backup routing table and determine the candidate distribution path;

[0038] The candidate distribution paths are evaluated based on the path calculation algorithm to obtain the preferred distribution path;

[0039] The alarm distribution configuration is updated based on the preferred distribution path to obtain the updated alarm distribution path. If the updated alarm distribution path fails to transmit, the current service status is obtained through the service status check module to determine the reason for the transmission failure.

[0040] Based on the reason for the transmission failure, a suboptimal distribution path is reselected from the backup routing table to obtain a new alarm distribution path;

[0041] The alarm data is sent to a new distribution path via the alarm transmission module, thus completing the alarm distribution.

[0042] In one aspect of this disclosure, the step of transmitting the fault-tolerant transmission data packet to the target node according to the updated alarm distribution path to complete the alarm distribution includes:

[0043] The alarm distribution path is obtained based on the network topology, and a path update scheme is obtained based on the pre-established topology model.

[0044] If there are disconnections in the path update scheme, the reachable path is recalculated using the node connection algorithm to obtain the available distribution path;

[0045] Based on the available distribution paths, fault-tolerant data packets are generated using data fragmentation technology to ensure data integrity.

[0046] If the loss rate of fault-tolerant data packets exceeds a preset threshold through transmission reliability assessment, the distribution path is adjusted to obtain an optimized path.

[0047] The target node is obtained based on the optimized path, and the data transmission task is allocated using load balancing technology to determine the distribution efficiency.

[0048] Based on the distribution efficiency, a dynamic routing algorithm is used to adjust the data transmission priority to obtain the transmission sequence of the target node;

[0049] Based on the transmission sequence of the target node, data verification technology is used to verify the alarm distribution status and determine that the distribution is complete.

[0050] In one aspect of this disclosure, the step of obtaining alarm processing feedback from the target node, batch processing the feedback data using a time window aggregation algorithm, and generating alarm processing results includes:

[0051] Based on the target node, alarm processing feedback data is obtained, and a preset threshold is used to determine the integrity of the data to obtain a valid feedback dataset.

[0052] A time window aggregation algorithm is used to batch process the effective feedback dataset to generate time series analysis results.

[0053] Based on the time series analysis results, key feature vectors are extracted to obtain the feature set of alarm events;

[0054] If the alarm event feature set meets the preset event triggering conditions, a classification algorithm is used to classify the feature set and determine the alarm priority.

[0055] The classified alarm events are scheduled and processed by prioritizing them to generate a scheduling task sequence.

[0056] Based on the scheduling task sequence, a stream processing algorithm is used to distribute tasks in real time to obtain alarm processing results;

[0057] Based on the alarm processing results, execute the data verification process to confirm the accuracy of the results and generate the final processing output.

[0058] In one aspect of this disclosure, the step of optimizing the data transmission path using a bandwidth adaptive allocation algorithm to obtain the final operation and maintenance instruction distribution sequence based on the alarm processing result includes:

[0059] By collecting network status information through real-time monitoring data and analyzing data flow characteristics, bandwidth utilization evaluation results are obtained.

[0060] Based on the bandwidth utilization assessment results, the minimum cost maximum flow algorithm is used to optimize network resource allocation and determine data transmission paths.

[0061] If the bandwidth utilization of the data transmission path is lower than the preset threshold, the path is adjusted through a bandwidth adaptive algorithm to generate an optimized data transmission path.

[0062] Based on the optimized data transmission path, the priority of alarm processing results is analyzed to obtain the operation and maintenance instruction sequence;

[0063] The operation and maintenance instruction sequence is sent to network nodes through the instruction distribution mechanism, and distribution confirmation information is obtained.

[0064] Based on the distribution confirmation information and real-time monitoring data, assess the network load balancing status and determine the effectiveness of command execution.

[0065] If the execution effect of the command does not reach the preset threshold, the network resource allocation will be readjusted through data flow analysis to generate a new sequence of operation and maintenance commands.

[0066] In one aspect of this disclosure, the step of transmitting instructions to the device terminal according to the final maintenance instruction distribution sequence to complete the alarm response includes:

[0067] Obtain the instruction distribution sequence, extract sequence data from a pre-established instruction library, and use a sequence generation algorithm to determine the instruction distribution sequence;

[0068] If the sequence generation algorithm outputs a command distribution sequence, then the integrity of the sequence is verified through the command verification mechanism to obtain a sequence that passes the verification.

[0069] According to the real-time transmission protocol, the verified sequence is transmitted to the device terminal to obtain a confirmation signal of successful transmission;

[0070] Based on the terminal feedback data obtained from the device terminal, the response status in the feedback data is analyzed to determine the execution status of the alarm response;

[0071] If the alarm response is executed normally, the response efficiency is recorded through the system scheduling mechanism, and response efficiency data is generated.

[0072] Based on the response efficiency data, an anomaly detection algorithm is used to analyze potential anomalies and obtain anomaly detection results.

[0073] Based on the anomaly detection results, the generation parameters of the instruction dispatch sequence are adjusted to obtain an optimized instruction sequence.

[0074] Compared with the prior art, the present invention has the following beneficial effects:

[0075] This invention achieves initial alarm classification through anomaly detection algorithms, obtains high-priority queues through weighted priority scheduling algorithms, implements load-balanced alarm distribution paths using consistent hashing algorithms, generates fault-tolerant transmission data packets using forward error correction coding, updates paths through backup routing tables when microservice nodes fail, processes feedback data using time window aggregation algorithms, optimizes transmission paths and generates operation and maintenance instruction distribution sequences using bandwidth adaptive allocation algorithms, and finally completes alarm response. This effectively solves the problems of uneven resource allocation, processing delays, easy neglect of critical alarms, insufficient dynamic adaptability, and poor system stability in existing technologies under large-scale device concurrency scenarios. It improves the real-time performance, accuracy, and reliability of anomaly data processing, ensures the efficiency of alarm distribution and response in the Industrial Internet of Things, and reduces security risks caused by alarm delays or omissions. Attached Figure Description

[0076] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained from these drawings without creative effort.

[0077] Figure 1 This is a schematic diagram illustrating the steps of the industrial Internet of Things-based abnormal data analysis method of the present invention;

[0078] Figure 2 This is a schematic diagram of step S1 in the industrial Internet of Things anomaly data analysis method of the present invention;

[0079] Figure 3 This is a schematic diagram illustrating the composition of the optimized Industrial Internet of Things (IIoT) involved in this invention.

[0080] Figure 4 This is a block diagram illustrating an electronic device according to an embodiment of the present invention.

[0081] In the diagram, 700 is an electronic device, 701 is a processor, 702 is a memory, 703 is a multimedia component, 704 is an I / O interface, and 705 is a communication component. Detailed Implementation

[0082] The present invention will be further described below with reference to embodiments. These embodiments are merely some, not all, of the embodiments described. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without inventive effort are within the protection scope of the present invention.

[0083] Example 1

[0084] Please see Figure 1 - As shown in Figure 4, this embodiment discloses an anomaly data analysis method based on the Industrial Internet of Things (IIoT). The method includes: calculating anomaly scores based on data acquired from sensor data streams using an anomaly detection algorithm; initially classifying alarms according to preset thresholds to obtain an initial alarm priority sequence; adjusting the alarm processing order using a weighted priority scheduling algorithm based on the initial alarm priority sequence to obtain a high-priority alarm processing queue; allocating high-priority alarm processing queues to microservice nodes using a consistent hashing algorithm to obtain a load-balanced alarm distribution path; and compressing alarm data using forward error correction coding within the alarm distribution path. The system generates fault-tolerant transmission data packets. If a microservice node failure is detected, the distribution path is recalculated using a preset backup routing table to obtain an updated alarm distribution path. Based on the updated alarm distribution path, the fault-tolerant transmission data packets are transmitted to the target node to complete alarm distribution. Alarm processing feedback is obtained from the target node, and the feedback data is batch-processed using a time window aggregation algorithm to generate alarm processing results. For the alarm processing results, the data transmission path is optimized using a bandwidth adaptive allocation algorithm to obtain the final operation and maintenance instruction distribution sequence. Based on the final operation and maintenance instruction distribution sequence, the instructions are transmitted to the device terminal to complete the alarm response.

[0085] In practical use, this embodiment acquires data from sensor data streams, calculates anomaly scores using an anomaly detection algorithm, and initially classifies them to obtain an initial alarm priority sequence. The processing order is adjusted using a weighted priority scheduling algorithm to obtain a high-priority queue, which is then distributed to microservice nodes using a consistent hashing algorithm to obtain a load-balanced distribution path. Forward error correction coding is used to generate fault-tolerant transmission data packets. When a node fails, the path is updated through a backup routing table. After transmitting the data packets, the feedback data is processed using a time window aggregation algorithm. The path is optimized using a bandwidth adaptive allocation algorithm to obtain a sequence of operation and maintenance instructions. Finally, the instructions are transmitted to the device terminal to complete the response.

[0086] This invention achieves initial alarm classification through anomaly detection algorithms, obtains high-priority queues through weighted priority scheduling algorithms, implements load-balanced alarm distribution paths using consistent hashing algorithms, generates fault-tolerant transmission data packets using forward error correction coding, updates paths through backup routing tables when microservice nodes fail, processes feedback data using time window aggregation algorithms, optimizes transmission paths and generates operation and maintenance instruction distribution sequences using bandwidth adaptive allocation algorithms, and finally completes alarm response. This effectively solves the problems of uneven resource allocation, processing delays, easy neglect of critical alarms, insufficient dynamic adaptability, and poor system stability in existing technologies under large-scale device concurrency scenarios. It improves the real-time performance, accuracy, and reliability of anomaly data processing, ensures the efficiency of alarm distribution and response in the Industrial Internet of Things, and reduces security risks caused by alarm delays or omissions.

[0087] Example 2

[0088] Please see Figure 1 - As shown in Figure 4, this embodiment is a further optimization based on Embodiment 1. In this embodiment, the steps of calculating anomaly scores using an anomaly detection algorithm based on data acquired from the sensor data stream, and initially classifying alarms according to preset thresholds to obtain an initial alarm priority sequence include:

[0089] Real-time data is obtained from the sensor data stream, and the anomaly score of each data point is calculated using the isolated forest algorithm to obtain the anomaly score set.

[0090] The Isolation Forest algorithm is configured as follows:

[0091]

[0092] in, Showing includes The normalization constant for the average path length of the binary search tree for each sample. This represents the harmonic number, which is the sum of 1 + 1 / 2 + 1 / 3 + ... + 1 / n. This indicates the number of samples used to construct the isolation tree;

[0093] The formula is used to standardize the path length under different sample sizes, making anomaly scores comparable.

[0094] If the abnormal score exceeds the preset threshold, it is marked as a potential anomaly, and a preliminary anomaly list containing anomaly identifiers is generated.

[0095] Based on the outliers in the preliminary outlier list, a clustering algorithm is used to group the outliers and obtain an outlier group set.

[0096] Based on the grouping set of outliers, calculate the average outlier score for each group to obtain the outlier intensity index for each group.

[0097] If the abnormal intensity index is higher than the preset intensity threshold, a high-priority alarm is generated, resulting in a high-priority alarm sequence.

[0098] Based on the high-priority alarm sequence and combined with the timestamp information of the anomaly points, a time-ordered alarm priority sequence is generated;

[0099] Based on the alarm priority sequence ordered by time, a sliding window analysis is used to analyze the temporal distribution characteristics of anomalies and obtain the final alarm priority sequence.

[0100] In practical use, this embodiment acquires real-time data from sensor data streams, uses the isolated forest algorithm to calculate anomaly scores for each data point, marks those exceeding thresholds as potential anomalies and generates a preliminary anomaly list, groups the anomalies using a clustering algorithm, calculates the average anomaly score for each group to obtain an anomaly intensity index, and generates a high-priority alarm sequence based on this. Combining timestamps and sliding window analysis of time distribution characteristics, a final priority sequence is obtained. Technical problem solved: Existing anomaly detection algorithms lack precision and scientific grading of anomaly data, making it difficult to accurately distinguish alarm priorities based on anomaly intensity and time distribution, resulting in critical anomaly alarms being overwhelmed by low-priority alarms. Beneficial effects: Improves the accuracy of anomaly detection, achieves precise alarm grading through anomaly intensity and time distribution characteristics, ensures that high-priority anomaly alarms are identified and processed first, laying the foundation for efficient subsequent response.

[0101] In some embodiments, the step of adjusting the alarm processing order according to the initial alarm priority sequence using a weighted priority scheduling algorithm to obtain a high-priority alarm processing queue includes:

[0102] By parsing the initial alarm sequence, the priority attributes and timestamps of the alarms are obtained, and the alarm classification is determined.

[0103] Based on alarm classification and priority weight, a weighted priority scheduling algorithm is used to calculate the comprehensive priority score of each alarm, resulting in a sorted alarm sequence.

[0104] The weighted priority scheduling algorithm is configured as follows:

[0105]

[0106] in, Indicates the first The overall priority score of each alarm;

[0107] Indicates the first Weighting coefficients for each evaluation dimension;

[0108] Indicates the first The alarm was in the first Scores on each dimension Indicates the total number of evaluation dimensions;

[0109] The above formula calculates the final priority of the alert by weighted summation of the scores of each dimension;

[0110] If the overall priority score is higher than the preset threshold, the corresponding alarm will be marked as high priority, and a set of high priority alarms will be generated.

[0111] Based on the real-time scheduling mechanism, obtain the set of high-priority alarms, dynamically adjust the processing order, and determine the alarm processing queue;

[0112] Based on the alarm processing queue, system resources are allocated, queue execution efficiency is optimized, and a real-time updated processing sequence is obtained; if the alarm triggering status in the processing sequence changes, the priority weight is recalculated and the alarm processing queue is updated.

[0113] Based on the optimization results of the monitoring queue, obtain processing efficiency data, adjust the weight allocation strategy, and determine the final alarm handling plan.

[0114] In practical use, this embodiment parses the initial alarm sequence to obtain priority attributes and timestamps and determines the classification. Combining alarm classification and priority weights, a weighted priority scheduling algorithm is used to calculate and sort the comprehensive priority score. Alarms exceeding the threshold are marked as high priority. Then, the processing order is dynamically adjusted according to the real-time scheduling mechanism, system resources are allocated, and the queue is updated according to status changes to finally determine the processing solution. Technical problem solved: Existing technologies lack a mechanism for dynamically adjusting the alarm processing order. Static processing logic cannot flexibly allocate resources according to the real-time status and priority of alarms, resulting in delays in processing high-priority alarms and low system execution efficiency. Beneficial effects: Dynamic optimization of the alarm processing order is achieved. The weighted algorithm accurately evaluates alarm priorities and adjusts resource allocation according to real-time status, improving the processing efficiency of high-priority alarms and optimizing system resource utilization.

[0115] In some embodiments, the step of allocating alarms to microservice nodes using a consistent hashing algorithm based on the high-priority alarm processing queue to obtain a load-balanced alarm distribution path includes:

[0116] The hash value of high-priority alerts is calculated using a consistent hashing algorithm to determine the target microservice node and obtain the alert distribution path;

[0117]

[0118] in, Indicates the target microservice node;

[0119] Represents the first on the hash ring One node;

[0120] Represents a node The hash value;

[0121] The hash value representing the alert;

[0122] This represents the set of all nodes on the hash ring;

[0123] The target node is determined by finding the first node in the clockwise direction that is greater than or equal to the alarm hash value. If the microservice node pointed to by the hash value has a load exceeding a preset threshold, the neighboring nodes are found through a consistent hash ring to redetermine the distribution path.

[0124] Based on the priority queue and distribution path, the data is transmitted to the target service node to obtain high-priority alerts and alert processing tasks.

[0125] Based on the service node's processing of alarm tasks, the processing results are obtained, and it is determined whether the results meet the preset response time requirements. If the processing results do not meet the response time requirements, the microservice node allocation is adjusted through the load balancing algorithm to obtain a new distribution path.

[0126] Based on the adjusted distribution path, incomplete alerts will be reassigned to new service nodes to obtain updated processing tasks;

[0127] Based on the updated processing task, obtain the final processing result and determine the alarm processing completion status.

[0128] In practical use, this embodiment calculates the hash value of high-priority alarms using a consistent hashing algorithm, finds the first clockwise microservice node with a hash value not less than this value as the target node to determine the distribution path. If the target node's load exceeds a threshold, a hash ring is used to find neighboring nodes for reallocation. After task transmission, the processing result is used to determine whether the response time requirement is met. If not, the allocation is adjusted and the task is updated until completion. Technical problem solved: In existing technologies, uneven load distribution among microservice nodes can easily lead to some nodes being overloaded and others idle in high-concurrency scenarios, resulting in alarm processing delays and affecting overall distribution efficiency. Beneficial effects: The consistent hashing algorithm achieves load balancing among microservice nodes, dynamically avoiding overloaded nodes, ensuring reasonable distribution of alarm tasks among nodes, improving the efficiency of alarm distribution and processing, and guaranteeing system stability.

[0129] In some embodiments, the step of compressing alarm data using forward error correction coding in the alarm distribution path to generate fault-tolerant transmission data packets includes:

[0130] Acquire alarm data streams and extract raw alarm data from the source system through a preset acquisition interface to obtain an unprocessed alarm dataset;

[0131] Based on forward error correction coding, the unprocessed alarm dataset is encoded. The Reed-Solomon coding algorithm is used to generate an encoded dataset containing redundancy checks. The Reed-Solomon coding algorithm achieves error detection and correction by adding redundant bits.

[0132] The compressed coded dataset is processed using a lossless compression algorithm to generate a compressed dataset. The lossless compression algorithm is Huffman coding, and the coding length is allocated according to the data frequency to obtain the compressed data structure.

[0133] Based on the fault-tolerant transmission data packets, a compressed dataset is obtained, and the compressed dataset is divided into fixed-size data units. Packet headers and check bits are added to obtain a set of fault-tolerant transmission data packets. If packet loss occurs in the transmission path, the lost data units are recovered by applying the Reed-Solomon decoding algorithm through the redundant check bits in the set of fault-tolerant transmission data packets, and a complete set of transmission data packets is obtained.

[0134] The integrity of the transmitted data packet set is verified by calculating the checksum of the received data packet. The data packet is then compared with the checksum of the sending end. If the checksums match, the data integrity is confirmed, and a set of data packets that have passed the verification is obtained.

[0135] Once the distributed and verified data packet set is sent to the target system via a preset transmission protocol, a multi-path transmission mechanism is employed to select the optimal path based on network conditions, resulting in a distributed data stream.

[0136] In practical use, this embodiment extracts raw alarm data from the source system, generates a coded dataset with redundant checksums using the Reed-Solomon algorithm based on forward error correction coding, and then processes it using the Huffman lossless compression algorithm to obtain a compressed dataset. This compressed dataset is then divided into fixed-size units, and packet headers and checksums are added to generate fault-tolerant transmission data packets. If packets are lost during transmission, they are recovered through decoding using the redundant checksums. Finally, after verifying data integrity, distribution is completed. Technical problem solved: Existing technologies for alarm data transmission are prone to incomplete information due to packet loss, and do not balance compression efficiency and fault tolerance. In bandwidth-constrained scenarios, transmission efficiency is low, affecting the timeliness of alarms. Beneficial effects: By combining forward error correction coding and lossless compression, efficient data compression is achieved to save bandwidth, while redundant checksums ensure transmission fault tolerance, automatically recovering lost data and guaranteeing the integrity and efficiency of alarm data transmission.

[0137] In some embodiments, the step of recalculating the distribution path using a preset backup routing table to obtain an updated alarm distribution path if a microservice node failure is detected includes:

[0138] Based on the detection of microservice node failures, and by obtaining node status information through the status monitoring module, the faulty node identifier is determined.

[0139] Based on the fault node identifier, obtain the available route configuration from the preset backup routing table and determine the candidate distribution path;

[0140] The candidate distribution paths are evaluated based on the path calculation algorithm to obtain the preferred distribution path;

[0141] The alarm distribution configuration is updated based on the preferred distribution path to obtain the updated alarm distribution path. If the updated alarm distribution path fails to transmit, the current service status is obtained through the service status check module to determine the reason for the transmission failure.

[0142] Based on the reason for the transmission failure, a suboptimal distribution path is reselected from the backup routing table to obtain a new alarm distribution path;

[0143] The alarm data is sent to a new distribution path via the alarm transmission module, thus completing the alarm distribution.

[0144] In practical use, after detecting a microservice node failure, this embodiment obtains the failure node identifier through the status monitoring module, extracts available route configurations from the preset backup routing table as candidate distribution paths, evaluates the path using a path calculation algorithm to obtain the preferred path, and updates the distribution configuration. If transmission fails, the service status is checked and a suboptimal path is selected, ultimately completing the alarm distribution. Technical problem solved: Existing technologies lack an effective mechanism to handle microservice node failures. Node failures can easily lead to interruptions in alarm distribution paths, preventing timely transmission of critical alarms and affecting system reliability. Beneficial effects: This implementation achieves dynamic path switching in the event of node failure, quickly recalculating the distribution path through the backup routing table, ensuring uninterrupted alarm distribution, improving the system's fault tolerance and stability, and guaranteeing the continuous transmission of critical alarms.

[0145] In some embodiments, the step of transmitting the fault-tolerant transmission data packet to the target node according to the updated alarm distribution path to complete the alarm distribution includes:

[0146] The alarm distribution path is obtained based on the network topology, and a path update scheme is obtained based on the pre-established topology model.

[0147] If there are disconnections in the path update scheme, the reachable path is recalculated using the node connection algorithm to obtain the available distribution path;

[0148] Based on the available distribution paths, fault-tolerant data packets are generated using data fragmentation technology to ensure data integrity.

[0149] If the loss rate of fault-tolerant data packets exceeds a preset threshold through transmission reliability assessment, the distribution path is adjusted to obtain an optimized path.

[0150] The target node is obtained based on the optimized path, and the data transmission task is allocated using load balancing technology to determine the distribution efficiency.

[0151] Based on the distribution efficiency, a dynamic routing algorithm is used to adjust the data transmission priority to obtain the transmission sequence of the target node;

[0152] Based on the transmission sequence of the target node, data verification technology is used to verify the alarm distribution status and determine that the distribution is complete.

[0153] In practical use, this embodiment obtains the alarm distribution path and update scheme based on the network topology model. If the path is disconnected, the reachable path is recalculated using a node connection algorithm. Data fragmentation technology is used to generate fault-tolerant data packets and assess transmission reliability. If the packet loss rate exceeds the threshold, the path is adjusted. Load balancing technology is used to allocate transmission tasks and dynamically adjust priorities. Finally, the distribution status is verified to confirm completion. Technical problem solved: In existing technologies, alarm transmission paths are easily affected by changes in network topology, resulting in problems such as path disconnection and low transmission reliability. This leads to fault-tolerant data packets failing to reach the target node efficiently, affecting distribution efficiency. Beneficial effects: It can dynamically adapt to changes in network topology, ensuring reliable data packet transmission by recalculating paths and optimizing transmission strategies. Combined with load balancing and dynamic routing, it improves distribution efficiency and ensures that alarm data arrives at the target node accurately and in a timely manner.

[0154] In some embodiments, the step of obtaining alarm processing feedback from the target node, batch processing the feedback data using a time window aggregation algorithm, and generating alarm processing results includes:

[0155] Based on the target node, alarm processing feedback data is obtained, and a preset threshold is used to determine the integrity of the data to obtain a valid feedback dataset.

[0156] A time window aggregation algorithm is used to batch process the effective feedback dataset to generate time series analysis results.

[0157] Based on the time series analysis results, key feature vectors are extracted to obtain the feature set of alarm events;

[0158] If the alarm event feature set meets the preset event triggering conditions, a classification algorithm is used to classify the feature set and determine the alarm priority.

[0159] The classified alarm events are scheduled and processed by prioritizing them to generate a scheduling task sequence.

[0160] Based on the scheduling task sequence, a stream processing algorithm is used to distribute tasks in real time to obtain alarm processing results;

[0161] Based on the alarm processing results, execute the data verification process to confirm the accuracy of the results and generate the final processing output.

[0162] This embodiment obtains alarm processing feedback data from the target node, determines the completeness of the dataset after passing a preset threshold, and uses a time window aggregation algorithm to batch process and generate time series analysis results. Key feature vectors are extracted to form an alarm event feature set. When triggering conditions are met, the data is categorized, prioritized, and scheduled for processing. After generating a task sequence, the processing results are distributed in real-time using a stream processing algorithm. Finally, the accuracy is verified to generate the output. Technical problem solved: Existing technologies handle alarm processing feedback data in a fragmented manner and lack a batch analysis mechanism, making it difficult to extract effective information from the feedback and quickly generate processing results, affecting the timeliness and accuracy of alarm response. Beneficial effects: Time window aggregation enables efficient batch processing of feedback data, accurately extracting event features and classifying and scheduling them, improving the efficiency and accuracy of alarm processing result generation, and providing a reliable basis for subsequent operation and maintenance instruction generation.

[0163] In some embodiments, the step of optimizing the data transmission path using a bandwidth adaptive allocation algorithm to obtain the final operation and maintenance instruction distribution sequence based on the alarm processing result includes:

[0164] By collecting network status information through real-time monitoring data and analyzing data flow characteristics, bandwidth utilization evaluation results are obtained.

[0165] Based on the bandwidth utilization assessment results, the minimum cost maximum flow algorithm is used to optimize network resource allocation and determine data transmission paths.

[0166] If the bandwidth utilization of the data transmission path is lower than the preset threshold, the path is adjusted through a bandwidth adaptive algorithm to generate an optimized data transmission path.

[0167] Based on the optimized data transmission path, the priority of alarm processing results is analyzed to obtain the operation and maintenance instruction sequence;

[0168] The operation and maintenance instruction sequence is sent to network nodes through the instruction distribution mechanism, and distribution confirmation information is obtained.

[0169] Based on the distribution confirmation information and real-time monitoring data, assess the network load balancing status and determine the effectiveness of command execution.

[0170] If the execution effect of the command does not reach the preset threshold, the network resource allocation will be readjusted through data flow analysis to generate a new sequence of operation and maintenance commands.

[0171] In practical use, this embodiment collects network status information in real time and analyzes data flow characteristics to obtain bandwidth utilization evaluation results. It uses a minimum cost maximum flow algorithm to optimize network resource allocation and determine transmission paths. If bandwidth utilization is below a threshold, a bandwidth adaptive algorithm adjusts the path. A sequence of operation and maintenance instructions is generated based on the priority of alarm processing results. After issuance, the execution effect is evaluated; if it does not meet expectations, resource allocation is readjusted to generate a new sequence. Technical problem solved: Existing technologies lack adaptability in bandwidth allocation for data transmission paths, failing to dynamically optimize based on network status and alarm priority, leading to delays in issuing operation and maintenance instructions and affecting alarm response efficiency. Beneficial effects: It achieves dynamic optimization of transmission paths, adaptively allocating network resources based on bandwidth utilization and alarm priority, ensuring efficient issuance of operation and maintenance instructions, improving the timeliness and rationality of instruction distribution, and optimizing the overall alarm response process.

[0172] In some embodiments, the step of transmitting instructions to the device terminal according to the final maintenance instruction distribution sequence to complete the alarm response includes:

[0173] Obtain the instruction distribution sequence, extract sequence data from a pre-established instruction library, and use a sequence generation algorithm to determine the instruction distribution sequence;

[0174] If the sequence generation algorithm outputs a command distribution sequence, then the integrity of the sequence is verified through the command verification mechanism to obtain a sequence that passes the verification.

[0175] According to the real-time transmission protocol, the verified sequence is transmitted to the device terminal to obtain a confirmation signal of successful transmission;

[0176] Based on the terminal feedback data obtained from the device terminal, the response status in the feedback data is analyzed to determine the execution status of the alarm response;

[0177] If the alarm response is executed normally, the response efficiency is recorded through the system scheduling mechanism, and response efficiency data is generated.

[0178] Based on the response efficiency data, an anomaly detection algorithm is used to analyze potential anomalies and obtain anomaly detection results.

[0179] Based on the anomaly detection results, the generation parameters of the instruction dispatch sequence are adjusted to obtain an optimized instruction sequence.

[0180] In practical use, this embodiment extracts data from the instruction library, uses a sequence generation algorithm to determine the operation and maintenance instruction distribution sequence, verifies its integrity through an instruction verification mechanism, transmits it to the device terminal via a real-time transmission protocol and obtains an acknowledgment signal, analyzes the response status in the terminal feedback data to determine the execution status, records the response efficiency if normal, and detects potential anomalies, adjusting the sequence generation parameters accordingly to obtain an optimized instruction sequence. Technical problem solved: In existing technologies, the transmission of operation and maintenance instructions to the device terminal suffers from insufficient instruction integrity, untimely response status feedback, and a lack of dynamic optimization mechanisms for the instruction sequence, leading to inadequate alarm response execution. Beneficial effects: It ensures the integrity and accuracy of operation and maintenance instruction transmission, enables real-time tracking of terminal response status and optimization of the instruction sequence, improves the execution effect and reliability of alarm responses, and forms a closed-loop optimization of instruction distribution and response.

[0181] As an optional implementation method, taking a petrochemical plant industrial IoT system as an example, this system collects equipment data in real time through sensors such as pressure, temperature, and flow rate. Its workflow is as follows:

[0182] First, real-time data is obtained from the sensor data stream, and the isolated forest algorithm is used to calculate the anomaly score for each data point;

[0183] Assuming the number of samples used to construct the isolation tree is n=1000, according to the isolation forest algorithm formula:

[0184]

[0185] Among them, harmonic number =1 + 1 / 2 + 1 / 3 + ... + 1 / 999 ≈ 7.485, then the normalization constant is... =2×7.485 ≈14.97 1.998 = 12.972.

[0186] The path length of each data point is standardized by this constant to obtain an anomaly score (e.g., the anomaly score of the pressure sensor data point is calculated to be 85, which exceeds the preset threshold of 70). These points are marked as potential anomalies and clustered into groups. The average anomaly score of this group is calculated to be 82 (which is higher than the preset intensity threshold of 60). A high-priority alarm is generated, and the initial alarm priority sequence is obtained by combining the timestamp and sliding window analysis.

[0187] Next, the sequence is parsed to obtain its priority attribute, and a comprehensive score is calculated using a weighted priority scheduling algorithm.

[0188] Through the formula:

[0189]

[0190] The overall score is calculated as follows:

[0191] Set evaluation dimensions =3 (Abnormal intensity, time urgency, scope of impact), with weights as follows: =0.5、 =0.3、 =0.2; the scores for this pressure anomaly alarm in each dimension are as follows: =90、 =85、 =92, then the overall priority score =0.5×90+0.3×85+0.2×92=45+25.5+18.4=88.9, which is higher than the preset threshold of 80, so it is marked as high priority and a processing queue is formed.

[0192] Subsequently, the alarm hash value is calculated using a consistent hashing algorithm and distributed to the load-balanced microservice nodes.

[0193] The calculation process is as follows:

[0194]

[0195] Calculate the hash value of this high-priority alarm. =5000, the hash values ​​of the nodes on the hash ring are respectively =4800、 =5200、 =5500, then the first clockwise condition is met. Nodes with ≥5000 are This node is identified as the target node. If detected... If the load exceeds the threshold, then search for neighboring nodes. Reassign.

[0196] The system determines the distribution path and uses Reed-Solomon coding and Huffman compression to generate fault-tolerant transmission data packets. If a target microservice node failure is detected, the system immediately calls the backup routing table to recalculate the path and transmits the fault-tolerant data packets to the updated target node. After the target node processes the data, the system uses a time window aggregation algorithm to batch process the feedback data, extract features, classify and prioritize them, and generate alarm processing results. Based on these results, the system monitors network bandwidth in real time and optimizes the path using a bandwidth adaptive allocation algorithm to obtain a sequence of operation and maintenance instructions to "immediately adjust pressure valve parameters." Finally, the instructions are transmitted to the pressure valve terminal, which executes them and provides feedback on the response status, completing the alarm response. This process solves the problems of uneven resource allocation, critical alarm delays, transmission interruptions due to node failures, and poor data transmission fault tolerance in traditional systems under concurrent device scenarios. It achieves rapid identification, dynamic distribution, and reliable response to high-priority alarms, reduces the security risks caused by untimely handling of pressure valve failures, and improves system operation and maintenance efficiency and stability.

[0197] It should also be noted that the entire data protocol conversion system based on the Industrial Internet of Things (IIoT) can be applied to the optimized IIoT, such as... Figure 4 As shown, the optimized Industrial Internet of Things (IIoT) includes a user platform, a service platform, a management platform, a sensor network platform, and an object platform that establish communication in sequence.

[0198] The user platform is configured to provide front-end services to users; users obtain the necessary perception service information through the user platform, process the perception service information, and transform it into user perception information; users analyze the user perception information and make corresponding decisions based on their own wishes, and transform the user perception information into user control information through the corresponding information system and send it to the service platform, thereby demonstrating the user's corresponding service needs and wishes.

[0199] The physical entities of the user platform include various user terminals, such as mobile phones, computers, and dedicated terminals, which provide user services through integration with user information system software.

[0200] The service platform is configured as an API server or other server used to establish communication between the management platform and the user platform to achieve corresponding functions; the physical entity of the service platform includes various servers.

[0201] The management platform is configured to perform at least one of the following: device operation status monitoring and management, data monitoring and management, device parameter management, and lifecycle management; the management platform is an IoT data classification platform, which may include various management sub-platforms, with different management sub-platforms performing different management functions; the physical entities of the management platform include various servers.

[0202] The sensor network platform is configured to perform at least one of the following functions: network management, command management, device status management, data protocol management, data parsing, data classification, data transmission monitoring, and data transmission security management. The sensor network platform provides functions such as data communication, transmission, parsing, identification, and classification, avoiding the direct aggregation of data from various object platforms onto the management platform, which would otherwise result in data redundancy and low data processing efficiency. The physical entities of the object platforms include various gateways, edge computing devices, etc.

[0203] The object platform is configured to perform specific production control, detection, measurement and other production tasks; the physical entities of the production objects include various production equipment, sensors and so on.

[0204] Figure 4 This is a block diagram of an electronic device illustrating an anomaly data analysis method based on the Industrial Internet of Things (IIoT) according to an exemplary embodiment. Figure 4 As shown, the electronic device 700 may include: a processor 701 and a memory 702. The electronic device 700 may also include one or more of a multimedia component 703, an I / O interface 704 (input / output interface), and a communication component 705.

[0205] The processor 701 controls the overall operation of the electronic device 700 to complete all or part of the steps in the above-mentioned industrial IoT-based anomaly data analysis method. The memory 702 stores various types of data to support the operation of the electronic device 700. This data may include, for example, instructions for any application or method operating on the electronic device 700, and application-related data such as contact data, sent and received messages, images, audio, video, etc. The memory 702 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random Access Memory (SRAM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read-Only Memory (EPROM), Programmable Read-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, disk, or optical disk. The multimedia component 703 may include a screen and audio components. The screen may be, for example, a touchscreen, and the audio component is used to output and / or input audio signals. For example, the audio component may include a microphone for receiving external audio signals. The received audio signals may be further stored in memory 702 or transmitted via communication component 705. The audio component also includes at least one speaker for outputting audio signals. I / O interface 704 provides an interface between processor 701 and other interface modules, such as a keyboard, mouse, buttons, etc. These buttons may be virtual or physical buttons. Communication component 705 is used for wired or wireless communication between the electronic device 700 and other devices. Wireless communication, such as Wi-Fi, Bluetooth, Near Field Communication (NFC), 2G, 3G, 4G, NB-IoT, eMTC, or other 5G technologies, or a combination thereof, is not limited here. Therefore, the corresponding communication component 705 may include: a Wi-Fi module, a Bluetooth module, an NFC module, etc.

[0206] In an exemplary embodiment, the electronic device 700 may be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to perform the above-described industrial Internet of Things-based anomaly data analysis method.

[0207] In another exemplary embodiment, a computer-readable storage medium including program instructions is also provided, which, when executed by a processor, implement the steps of the above-described industrial IoT-based anomaly data analysis method. For example, the computer-readable storage medium may be the memory 702 including the program instructions, which may be executed by the processor 701 of the electronic device 700 to complete the above-described industrial IoT-based anomaly data analysis method.

[0208] In another exemplary embodiment, a computer program product is also provided, the computer program product comprising a computer program executable by a programmable device, the computer program having a code portion for performing the above-described industrial Internet of Things-based anomaly data analysis method when executed by the programmable device.

[0209] In the description of this invention, it should be understood that the terms "coaxial," "bottom," "one end," "top," "middle," "other end," "upper," "side," "top," "inner," "front," "center," "both ends," etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are only for the convenience of describing this invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this invention.

[0210] Furthermore, the terms “first,” “second,” “third,” and “fourth” are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as “first,” “second,” “third,” or “fourth” may explicitly or implicitly include at least one of those features.

[0211] In this invention, unless otherwise explicitly specified and limited, the terms "installation," "setting," "connection," "fixing," "screw connection," etc., should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral part; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; they can refer to the internal connection of two components or the interaction between two components. Unless otherwise explicitly limited, those skilled in the art can understand the specific meaning of the above terms in this invention according to the specific circumstances.

[0212] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A method for analyzing abnormal data based on the Industrial Internet of Things, characterized in that: Based on the data acquired from the sensor data stream, anomaly scores are calculated using anomaly detection algorithms. Alarms are then initially classified according to preset thresholds to obtain an initial alarm priority sequence. Based on the initial alarm priority sequence, a weighted priority scheduling algorithm is used to adjust the alarm processing order and obtain a high-priority alarm processing queue; The step of adjusting the alarm processing order according to the initial alarm priority sequence using a weighted priority scheduling algorithm to obtain a high-priority alarm processing queue includes: By parsing the initial alarm sequence, the priority attributes and timestamps of the alarms are obtained, and the alarm classification is determined. Based on alarm classification and priority weight, a weighted priority scheduling algorithm is used to calculate the comprehensive priority score of each alarm, resulting in a sorted alarm sequence. If the overall priority score is higher than the preset threshold, the corresponding alarm will be marked as high priority, and a set of high priority alarms will be generated. Based on the real-time scheduling mechanism, obtain the set of high-priority alarms, dynamically adjust the processing order, and determine the alarm processing queue; Based on the alarm processing queue, system resources are allocated, queue execution efficiency is optimized, and a real-time updated processing sequence is obtained; if the alarm triggering status in the processing sequence changes, the priority weight is recalculated and the alarm processing queue is updated. Based on the monitoring queue optimization results, obtain processing efficiency data, adjust the weight allocation strategy, and determine the final alarm handling plan; Based on the high-priority alarm processing queue, alarms are distributed to microservice nodes using a consistent hashing algorithm to obtain a load-balanced alarm distribution path. The step of allocating high-priority alarm processing queues to microservice nodes using a consistent hashing algorithm to obtain load-balanced alarm distribution paths includes: Calculate the hash value of high-priority alerts using the consistent hashing algorithm, obtain the target microservice node, and get the alert distribution path; The target node is obtained by finding the first node in the clockwise direction that is greater than or equal to the alarm hash value. If the microservice node pointed to by the hash value has a load exceeding a preset threshold, the neighboring nodes are searched through a consistent hash ring to redetermine the distribution path. Based on the priority queue and distribution path, the data is transmitted to the target service node to obtain high-priority alerts and alert processing tasks. Based on the service node's processing of alarm tasks, the processing results are obtained, and it is determined whether the results meet the preset response time requirements. If the processing results do not meet the response time requirements, the microservice node allocation is adjusted through the load balancing algorithm to obtain a new distribution path. Based on the adjusted distribution path, incomplete alerts will be reassigned to new service nodes to obtain updated processing tasks; Based on the updated processing task, obtain the final processing result and determine the alarm processing completion status; In the alarm distribution path, forward error correction coding is used to compress the alarm data to generate fault-tolerant transmission data packets; If a microservice node failure is detected, the distribution path is recalculated using a preset backup routing table to obtain the updated alarm distribution path. According to the updated alarm distribution path, the fault-tolerant transmission data packet is transmitted to the target node to complete the alarm distribution; Alarm processing feedback is obtained from the target node, and the feedback data is processed in batches using a time window aggregation algorithm to generate alarm processing results; Based on the alarm processing results, the data transmission path is optimized using a bandwidth adaptive allocation algorithm to obtain the final operation and maintenance instruction distribution sequence; According to the final operation and maintenance instruction distribution sequence, the instructions are transmitted to the device terminal to complete the alarm response.

2. The method for analyzing abnormal data based on the Industrial Internet of Things according to claim 1, characterized in that: The steps of calculating anomaly scores using an anomaly detection algorithm based on data acquired from sensor data streams, and initially classifying alarms according to preset thresholds to obtain an initial alarm priority sequence include: Real-time data is obtained from the sensor data stream, and the anomaly score of each data point is calculated using the isolated forest algorithm to obtain the anomaly score set. If the abnormal score exceeds the preset threshold, it is marked as a potential anomaly, and a preliminary anomaly list containing anomaly identifiers is generated. Based on the outliers in the preliminary outlier list, a clustering algorithm is used to group the outliers and obtain an outlier group set. Based on the grouping set of outliers, calculate the average outlier score for each group to obtain the outlier intensity index for each group. If the abnormal intensity index is higher than the preset intensity threshold, a high-priority alarm is generated, resulting in a high-priority alarm sequence. Based on the high-priority alarm sequence and combined with the timestamp information of the anomaly points, a time-ordered alarm priority sequence is generated; Based on the alarm priority sequence ordered by time, a sliding window analysis is used to analyze the temporal distribution characteristics of anomalies and obtain the final alarm priority sequence.

3. The method for analyzing abnormal data based on the Industrial Internet of Things according to claim 1, characterized in that: The step of compressing alarm data using forward error correction coding in the alarm distribution path to generate fault-tolerant transmission data packets includes: Acquire alarm data streams and extract raw alarm data from the source system through a preset acquisition interface to obtain an unprocessed alarm dataset; Based on forward error correction coding, the unprocessed alarm dataset is encoded. The Reed-Solomon coding algorithm is used to generate an encoded dataset containing redundancy checks. The Reed-Solomon coding algorithm achieves error detection and correction by adding redundant bits. The compressed coded dataset is processed using a lossless compression algorithm to generate a compressed dataset. The lossless compression algorithm is Huffman coding, and the coding length is allocated according to the data frequency to obtain the compressed data structure. Based on the fault-tolerant transmission data packets, a compressed dataset is obtained, and the compressed dataset is divided into fixed-size data units. Packet headers and check bits are added to obtain a set of fault-tolerant transmission data packets. If packet loss occurs in the transmission path, the lost data units are recovered by applying the Reed-Solomon decoding algorithm through the redundant check bits in the set of fault-tolerant transmission data packets, and a complete set of transmission data packets is obtained. The integrity of the transmitted data packet set is verified by calculating the checksum of the received data packet. The data packet is then compared with the checksum of the sending end. If the checksums match, the data integrity is confirmed, and a set of data packets that have passed the verification is obtained. Once the distributed and verified data packet set is sent to the target system via a preset transmission protocol, a multi-path transmission mechanism is employed to select the optimal path based on network conditions, resulting in a distributed data stream.

4. The method for analyzing abnormal data based on the Industrial Internet of Things according to claim 1, characterized in that: The step of recalculating the distribution path and obtaining the updated alarm distribution path by using a preset backup routing table if a microservice node failure is detected includes: Based on the detection of microservice node failures, and by obtaining node status information through the status monitoring module, the faulty node identifier is determined. Based on the fault node identifier, obtain the available route configuration from the preset backup routing table and determine the candidate distribution path; The candidate distribution paths are evaluated based on the path calculation algorithm to obtain the preferred distribution path; The alarm distribution configuration is updated based on the preferred distribution path to obtain the updated alarm distribution path. If the updated alarm distribution path fails to transmit, the current service status is obtained through the service status check module to determine the reason for the transmission failure. Based on the reason for the transmission failure, a suboptimal distribution path is reselected from the backup routing table to obtain a new alarm distribution path; The alarm data is sent to a new distribution path via the alarm transmission module, thus completing the alarm distribution.

5. The method for analyzing abnormal data based on the Industrial Internet of Things according to claim 1, characterized in that: The step of transmitting the fault-tolerant transmission data packet to the target node according to the updated alarm distribution path to complete the alarm distribution includes: The alarm distribution path is obtained based on the network topology, and a path update scheme is obtained based on the pre-established topology model. If there are disconnections in the path update scheme, the reachable path is recalculated using the node connection algorithm to obtain the available distribution path; Based on the available distribution paths, fault-tolerant data packets are generated using data fragmentation technology to ensure data integrity. If the loss rate of fault-tolerant data packets exceeds a preset threshold through transmission reliability assessment, the distribution path is adjusted to obtain an optimized path. The target node is obtained based on the optimized path, and the data transmission task is allocated using load balancing technology to determine the distribution efficiency. Based on the distribution efficiency, a dynamic routing algorithm is used to adjust the data transmission priority to obtain the transmission sequence of the target node; Based on the transmission sequence of the target node, data verification technology is used to verify the alarm distribution status and determine that the distribution is complete.

6. The method for analyzing abnormal data based on the Industrial Internet of Things according to claim 1, characterized in that: The steps of obtaining alarm processing feedback from the target node, batch processing the feedback data using a time window aggregation algorithm, and generating alarm processing results include: Based on the target node, alarm processing feedback data is obtained, and a preset threshold is used to determine the integrity of the data to obtain a valid feedback dataset. A time window aggregation algorithm is used to batch process the effective feedback dataset to generate time series analysis results. Based on the time series analysis results, key feature vectors are extracted to obtain the feature set of alarm events; If the alarm event feature set meets the preset event triggering conditions, a classification algorithm is used to classify the feature set and determine the alarm priority. The classified alarm events are scheduled and processed by prioritizing them to generate a scheduling task sequence. Based on the scheduling task sequence, a stream processing algorithm is used to distribute tasks in real time to obtain alarm processing results; Based on the alarm processing results, execute the data verification process to confirm the accuracy of the results and generate the final processing output.

7. The method for analyzing abnormal data based on the Industrial Internet of Things according to claim 1, characterized in that: The step of optimizing the data transmission path using a bandwidth adaptive allocation algorithm to obtain the final operation and maintenance instruction distribution sequence based on the alarm processing result includes: By collecting network status information through real-time monitoring data and analyzing data flow characteristics, bandwidth utilization evaluation results are obtained. Based on the bandwidth utilization assessment results, the minimum cost maximum flow algorithm is used to optimize network resource allocation and determine data transmission paths. If the bandwidth utilization of the data transmission path is lower than the preset threshold, the path is adjusted through a bandwidth adaptive algorithm to generate an optimized data transmission path. Based on the optimized data transmission path, the priority of alarm processing results is analyzed to obtain the operation and maintenance instruction sequence; The operation and maintenance instruction sequence is sent to network nodes through the instruction distribution mechanism, and distribution confirmation information is obtained; Based on the distribution confirmation information and real-time monitoring data, assess the network load balancing status and determine the effectiveness of command execution. If the execution effect of the command does not reach the preset threshold, the network resource allocation will be readjusted through data flow analysis to generate a new sequence of operation and maintenance commands.

8. The method for analyzing abnormal data based on the Industrial Internet of Things according to claim 1, characterized in that: The step of transmitting instructions to the device terminal according to the final maintenance instruction distribution sequence to complete the alarm response includes: Obtain the instruction distribution sequence, extract sequence data from a pre-established instruction library, and use a sequence generation algorithm to determine the instruction distribution sequence; If the sequence generation algorithm outputs a command distribution sequence, then the integrity of the sequence is verified through the command verification mechanism to obtain a sequence that passes the verification. According to the real-time transmission protocol, the verified sequence is transmitted to the device terminal to obtain a confirmation signal of successful transmission; Based on the terminal feedback data obtained from the device terminal, the response status in the feedback data is analyzed to determine the execution status of the alarm response; If the alarm response is executed normally, the response efficiency is recorded through the system scheduling mechanism, and response efficiency data is generated. Based on the response efficiency data, an anomaly detection algorithm is used to analyze potential anomalies and obtain anomaly detection results. Based on the anomaly detection results, the generation parameters of the instruction distribution sequence are adjusted to obtain an optimized instruction sequence.

Images