Multi-device cooperative anomaly detection and early warning method, system, device and medium

Abstract

The invention provides a multi-device cooperative anomaly detection and early warning method, system, device and medium, and belongs to the technical field of industrial Internet of Things. The method comprises the following steps: firstly, collecting multi-source equipment data on an industrial site, and converting and uniformly modeling through an industrial protocol analysis adapter; converting, caching data and unifying timestamps by means of edge computing nodes or gateways to realize synchronization, and preprocessing and extracting features at an edge end; processing the data by using a data processing engine to obtain target data and storing the target data in a database; then, data are split according to equipment, a training single-equipment detection model and an inter-equipment state dependency graph are constructed, abnormity is predicted, analyzed and judged in real time, and classification and evaluation are completed; and finally, according to a detection result, judging whether to send early warning information or not according to an event triggering mechanism. According to the invention, real-time cooperative monitoring and intelligent early warning of operation states of various heterogeneous devices in a complex industrial field are realized.

Description

Technical Field

[0001] This invention belongs to the field of industrial Internet of Things (IoT) technology, and more specifically relates to a method, system, device and medium for multi-device collaborative anomaly detection and early warning. Background Technology

[0002] With the rapid evolution of the Industrial Internet of Things (IIoT) and smart manufacturing technologies, industrial sites are undergoing a transformation from traditional manual inspection to intelligent monitoring. Through the large-scale deployment of sensors, edge computing nodes, and control systems, industrial enterprises have achieved real-time perception of the operating status of production equipment, providing massive data support for equipment health management, production process optimization, and early warning of faults. However, the complexity of the industrial environment and the high degree of correlation among equipment clusters mean that multi-device collaborative monitoring and anomaly detection still face multiple technical bottlenecks, hindering further improvements in intelligent operation and maintenance. The heterogeneity of equipment and the fragmentation of protocols are particularly prominent issues in current industrial settings. Because different manufacturers use different communication standards, their data structures, transmission rates, and interaction methods vary significantly, making cross-device data fusion extremely difficult. Traditional systems often interconnect a limited number of devices through customized interfaces, which is not only costly to develop but also difficult to adapt to the needs of new device access or protocol upgrades, creating "data silos." This fragmented landscape makes collaborative diagnostics between devices impossible and severely hinders the early identification of system-level anomalies. The isolation and static nature of existing anomaly detection methods further exacerbate technical pain points. Most monitoring systems adopt a single-point independent detection mode, judging whether a single device is abnormal only by preset thresholds or simple rules, completely ignoring the coupling relationship and behavioral linkage between devices in the production chain. At the same time, traditional models rely on static thresholds and fixed logic, making it difficult to adapt to dynamic scenarios such as operating condition switching and equipment aging. In highly variable industrial environments, false alarms and false negatives occur frequently, seriously affecting the reliability of operation and maintenance decisions. The lack of time synchronization and the lag in early warning mechanisms further diminish the practicality of anomaly detection. Multi-device collaborative analysis requires a high-precision time base, but existing systems generally lack a unified clock synchronization scheme, resulting in millisecond-level or even second-level deviations in data timestamps across different devices. This time inconsistency renders the analysis of behavioral correlations between devices inaccurate, making it difficult to determine the path of anomaly propagation. Furthermore, current early warning mechanisms largely rely on manual interpretation of alarm records, lacking automatic linkage strategies based on anomaly levels, and notification channels are limited to single terminals, leading to delayed anomaly response, low handling efficiency, and an inability to meet the requirements of rapid fault isolation in industrial production. Summary of the Invention

[0003] To address the above problems, the present invention aims to provide a method, system, device, and medium for multi-device collaborative anomaly detection and early warning. By integrating multi-protocol adaptation, time synchronization mechanism, multi-source data fusion, intelligent anomaly identification model, and multi-channel early warning mechanism, it achieves real-time collaborative monitoring and intelligent early warning of the operating status of various heterogeneous devices in complex industrial sites.

[0004] To achieve the above objectives, the present invention employs the following technical solution: In a first aspect, embodiments of this application provide a multi-device collaborative anomaly detection and early warning method, including: Data from multiple sources is collected by sensing layer devices deployed in industrial sites, and the data is converted and unified modeled through an industrial protocol parsing adapter module. Industrial edge computing nodes or IoT gateway devices are used to perform protocol data conversion and caching on multi-source device data; unified timestamp labeling is applied to multi-source device data to achieve time synchronization; local preprocessing and lightweight modeling are performed at the edge to extract preliminary features and form preprocessed data; The data processing engine is invoked to perform outlier removal, missing value completion, multi-source fusion and alignment, and feature construction operations on the preprocessed data to obtain the target data and store it in the corresponding database. The target data is split according to the device dimension. A single device detection model is built and trained for each device, and a state dependency graph between devices is constructed. The single device detection model is used to obtain the corresponding target data and make real-time predictions. The collaborative anomaly judgment mechanism is used to analyze the relationship between single device anomaly information and device, determine whether there are complex anomalies, and complete the classification of anomaly events and confidence assessment to form detection results. Based on the detection results, the system determines whether the warning conditions are met according to the event triggering mechanism. If they are met, a warning message is sent.

[0005] In an optional implementation, the step of collecting multi-source device data through sensing layer devices deployed in the industrial field, and performing data conversion and unified modeling through an industrial protocol parsing adapter module includes: Data is collected from sensor data, control system data, logs and event streams, and other sources by sensing layer devices deployed in industrial sites; The adapter module uses industrial protocol parsing to abstract and structure data from multiple devices using a unified modeling language. The industrial protocol parsing adapter module supports OPC UA, Modbus RTU / TCP, PROFINET, CAN, and EtherCAT communication protocols.

[0006] In one optional implementation, the process of uniformly timestamping multi-source device data to achieve time synchronization; and performing local preprocessing and lightweight modeling at the edge to extract preliminary features and form preprocessed data, includes: Based on the IEEE 1588 PTP or edge synchronization algorithm, data from multiple sources are tagged with a unified timestamp. At the edge, data from multiple devices is cleaned and aggregated, and lightweight modeling algorithms are used to perform preliminary modeling and analysis of the data, extracting key feature data to form preprocessed data.

[0007] In an optional implementation, the step of calling the data processing engine to perform outlier removal, missing value completion, multi-source fusion and alignment, and feature construction operations on the preprocessed data to obtain the target data and store it in the corresponding database includes: The data processing engine is invoked to receive the preprocessed data and identify its data type. For Gaussian distributed data, the Z-score method is used for outlier removal; for asymmetric distributed data, the IQR method is used for outlier removal; and missing data is filled in after outlier removal. The preprocessed data is fused and aligned, data of different frequencies are resampled to a unified time frequency, and different types of data are converted into a unified data structure format; After fusion and alignment are completed, key features are extracted and combined with the energy efficiency calculation model to generate energy efficiency feature data. The energy efficiency feature data and multi-source device data are stored together in the time series database and feature database.

[0008] In an optional implementation, the step of splitting the target data according to the device dimension, building and training a single-device detection model for each device, and constructing a state dependency graph between devices includes: The energy efficiency characteristic data is split according to the device dimension, and a single device detection model is built for each device based on the device dimension using LSTM, GRU or AutoEncoder time series models. Acquire historical normal operation data of the device, expand the training dataset using data augmentation techniques, train the model using the training dataset, and build a normal behavior pattern model of the device. Based on multivariate Bayesian networks, graph neural networks, or attention mechanisms, the relationships between various devices are analyzed, and a state dependency graph between devices is constructed. The physical connection relationships, process flow sequence relationships, and data correlation relationships between devices are transformed into nodes and edges in the graph structure, and the weights of the edges are set according to the tightness of the relationship between devices and the direction of influence.

[0009] In an optional implementation, the step of acquiring corresponding target data using a single-device detection model and performing real-time prediction, analyzing the correlation between single-device anomaly information and devices through a collaborative anomaly judgment mechanism, determining whether complex anomalies exist, and completing anomaly event classification and confidence assessment to form detection results includes: The corresponding energy efficiency characteristic data is obtained by using a single device detection model and real-time prediction is performed. The residual between the predicted data and the actual data is calculated. When the residual exceeds the preset single device anomaly threshold, it is determined that the device may be abnormal and anomaly information is generated. Based on the relationships in the state dependency graph between devices, abnormal information from multiple single device models is analyzed. The graph structure propagation analysis algorithm is used to simulate the propagation process of abnormalities between devices. At the same time, the causal reasoning algorithm is combined to explore the root cause of abnormalities and the interaction mechanism between related devices, and to determine whether there are complex abnormal situations caused by the mutual coupling of multiple devices, so as to identify abnormal events. Abnormal events are classified into minor, severe, and fault levels based on their severity, scope of impact, and duration. A confidence score is calculated for each abnormal event using a model uncertainty quantification method, and the abnormal classification results and confidence scores are recorded.

[0010] In an optional implementation, the step of determining whether the early warning conditions are met based on the detection results and according to the event triggering mechanism, and sending early warning information if the conditions are met, includes: The system determines whether the warning conditions are met based on preset event triggering rules; the triggering rules include anomaly type, anomaly indicator, and / or multi-device joint alarm rules. When the warning conditions are met, the following warning process will be initiated according to the level and type of the abnormal event and the hierarchical linkage warning strategy. For minor abnormal events, operators can be alerted via web interface pop-up notifications, industrial HMI screen flashing prompts, and mobile APP push notifications to monitor changes in equipment status. For severe abnormal events, in addition to the early warning process for minor abnormal events, an email notification is sent to the equipment maintenance supervisor, and the automated control system is triggered to adjust the operating parameters of the relevant equipment. In response to fault-level abnormal events, the system immediately triggers an audible and visual alarm and sends a text message to the management mobile terminal. At the same time, it sends a command to stop the automated control system and lock the equipment operation permissions.

[0011] Secondly, embodiments of this application also provide a multi-device collaborative anomaly detection and early warning system, including: The perception layer is used to collect data from multiple sources of equipment through perception layer devices deployed in the industrial field, and to perform data conversion and unified modeling through the industrial protocol parsing adapter module; The network layer is used to perform protocol data conversion and caching of multi-source device data using industrial edge computing nodes or IoT gateway devices; to uniformly timestamp and label multi-source device data to achieve time synchronization; and to perform local preprocessing and lightweight modeling at the edge to extract preliminary features and form preprocessed data. The platform layer is used to call the data processing engine to perform outlier removal, missing value completion, multi-source fusion and alignment, and feature construction operations on the preprocessed data, so as to obtain the target data and store it in the corresponding database. The model layer is used to split the target data according to the device dimension, build and train a single device detection model for each device, and construct a state dependency graph between devices; use the single device detection model to obtain the corresponding target data and make real-time predictions; analyze the relationship between single device anomaly information and devices through a collaborative anomaly judgment mechanism, determine whether there are complex anomalies, complete the classification of anomaly events and confidence assessment to form detection results; The application layer is used to determine whether the early warning conditions are met based on the detection results and the event triggering mechanism. If the conditions are met, an early warning message is sent.

[0012] Thirdly, embodiments of this application also provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of the multi-device collaborative anomaly detection and early warning method described in any of the above descriptions.

[0013] Fourthly, embodiments of this application also provide a storage medium storing a computer program thereon, which, when executed by a processor, implements the steps of the multi-device collaborative anomaly detection and early warning method described in any of the above claims.

[0014] As can be seen from the above technical solutions, the present invention has the following advantages: The multi-device collaborative anomaly detection and early warning method provided in this application achieves multi-protocol compatibility and unified data modeling through an industrial protocol parsing adapter, solving the data fusion problem caused by device heterogeneity and protocol differences. It improves data consistency and processing efficiency through time synchronization and local preprocessing of edge computing nodes. Data quality and availability are ensured through outlier removal, missing value completion, and feature construction by the data processing engine. The collaborative analysis of single-device detection models and inter-device state dependency graphs overcomes the limitations of traditional isolated detection, effectively identifying complex anomalies caused by multi-device coupling. Combined with dynamic confidence assessment and a hierarchical linkage early warning mechanism, it significantly reduces false alarms and false negatives, achieving rapid response and precise handling of anomalies. Ultimately, it comprehensively improves the accuracy, timeliness, and intelligence of anomaly detection in industrial settings, enhancing the system's operational security, stability, and maintenance efficiency.

[0015] This application introduces a multimodal modeling and collaborative detection mechanism, which can not only identify isolated anomalies in a single device, but also discover chain-like anomalies caused by causal relationships or coupling between multiple devices. Compared with traditional single-point threshold monitoring methods, collaborative detection has a higher overall judgment accuracy and can identify sudden failures and slow degradation earlier, effectively shortening the average early warning time and buying valuable time for fault handling.

[0016] This application constructs a dynamic correlation map between devices by fusing time series models (such as LSTM and AutoEncoder) with graph neural networks (GNN), giving the system strong generalization ability and robustness. Even if a certain type of device experiences data drift or a change in operating conditions, the overall system can still maintain stable predictive performance and adapt to device heterogeneity and fluctuations in on-site operating conditions.

[0017] This application employs a residual dynamic threshold method, a confidence scoring mechanism, and a collaborative anomaly consensus judgment strategy to effectively reduce false alarms caused by single-point fluctuations. Simultaneously, a multi-source data cross-validation mechanism enhances detection reliability, effectively reducing the overall false alarm rate and false negative rate, and improving the usability and reliability of early warning information.

[0018] This application utilizes graph structure or Bayesian network modeling to achieve state dependency analysis between devices, automatically identifying anomaly propagation paths and root cause devices. For example, a fan malfunction might be caused by reduced efficiency of an upstream heat exchanger. Causal path reasoning enables system-level intelligent localization, assisting maintenance personnel in making quick decisions and avoiding misjudgments and redundant repairs.

[0019] This application supports displaying anomaly detection results through various formats such as web platforms, mobile devices, and HMI terminals, and integrates with enterprise MES and CMMS systems to achieve remote decision support capabilities such as automatically generating maintenance work orders, dispatching maintenance personnel, and coordinating shutdowns, which helps to build an intelligent and automated industrial operation and maintenance system.

[0020] This application adopts a modular design, which can be deployed on edge computing nodes to achieve rapid early warning at the device level with high real-time requirements, or it can run on industrial private cloud or hybrid cloud platforms to achieve centralized intelligent analysis of multiple factories and multiple work sections, adapting to different scale needs from small workshops to large groups.

[0021] This application supports online model updates and a self-learning mechanism, which can continuously optimize model parameters and judgment logic based on the latest monitoring data, adapt to equipment aging, process adjustments, and the introduction of new equipment, and ensure long-term stable and effective operation of the model, significantly improving the life cycle value of the intelligent operation and maintenance system. Attached Figure Description

[0022] To more clearly illustrate the technical solution of the present invention, the accompanying drawings used in the description will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0023] Figure 1 This is a flowchart illustrating the multi-device collaborative anomaly detection and early warning method provided in this application.

[0024] Figure 2 This is a schematic diagram of the structure of the multi-device collaborative anomaly detection and early warning system provided in this application.

[0025] Figure 3 A schematic diagram of the structure of the electronic device provided in this application. Detailed Implementation

[0026] The various embodiments of this disclosure will be described more fully in the detailed steps of the multi-device collaborative anomaly detection and early warning method described below. This disclosure may have various embodiments, and adjustments and changes may be made therein. However, it should be understood that there is no intention to limit the various embodiments of this disclosure to the specific embodiments disclosed herein, but rather this disclosure should be understood to cover all adjustments, equivalents, and / or alternatives falling within the spirit and scope of the various embodiments of this disclosure.

[0027] In the following, the terms “comprising” or “may include”, which may be used in various embodiments of this disclosure, indicate the presence of the disclosed functions, operations, or elements, and do not limit the addition of one or more functions, operations, or elements. Furthermore, as used in various embodiments of this disclosure, the terms “comprising,” “having,” and their cognates are intended only to indicate a particular feature, number, step, operation, element, component, or combination of the foregoing, and should not be construed as primarily excluding the presence of one or more other features, numbers, steps, operations, elements, components, or combinations of the foregoing, or the possibility of adding one or more combinations of the foregoing.

[0028] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0029] Please see Figure 1 The diagram shows a flowchart of a multi-device collaborative anomaly detection and early warning method in a specific embodiment. The method includes: S1: Collect multi-source device data through sensing layer devices deployed in industrial sites, and perform data conversion and unified modeling through industrial protocol parsing adapter modules.

[0030] In a specific implementation, a sensing layer device is deployed in the industrial site, encompassing various sensors, control system interfaces, log acquisition modules, and other data acquisition equipment. Sensors are responsible for collecting data such as temperature, pressure, vibration, current, oil level, and rotational speed; by interfacing with PLC, DCS, and SCADA systems, they collect key variables as control system data; they collect equipment operation logs, control commands, alarm records, etc., in real time to form logs and event streams; and they also access data from visual inspection systems, energy consumption systems, and other sources such as manual inspection data.

[0031] Next, the industrial protocol parsing adapter module is activated. This module supports mainstream communication protocols such as OPCUA, ModbusRTU / TCP, PROFINET, CAN, and EtherCAT. For multi-source device data with different protocols, it uses unified modeling languages ​​such as OPC information model and EDDL to perform abstraction and structuring processing, converting heterogeneous data into a unified format, and completing data conversion and unified modeling.

[0032] S2: Utilize industrial edge computing nodes or IoT gateway devices to perform protocol data conversion and caching on multi-source device data; perform unified timestamp labeling on multi-source device data to achieve time synchronization; perform local preprocessing and lightweight modeling at the edge to extract preliminary features and form preprocessed data.

[0033] In a specific implementation, the industrial edge computing node or IoT gateway device receives and processes multi-source device data, first performs protocol data conversion, converts data of different protocol formats into a unified format that the system can recognize, and then caches it.

[0034] Subsequently, based on the IEEE1588PTP or edge synchronization algorithm, data from multiple sources are uniformly timestamped to achieve sub-millisecond time synchronization and ensure data time consistency.

[0035] At the edge, data from multiple devices is cleaned to remove obvious noise and invalid data before aggregation. At the same time, lightweight modeling algorithms are used to perform preliminary modeling and analysis on the data, extract key feature data, and form preprocessed data, thereby reducing the processing pressure on the cloud.

[0036] S3: Call the data processing engine to perform outlier removal, missing value completion, multi-source fusion and alignment, and feature construction operations on the preprocessed data to obtain the target data and store it in the corresponding database.

[0037] In a specific implementation, the data processing engine deployed on the platform is invoked to receive the preprocessed data and identify the data type.

[0038] For Gaussian distributed data, the Z-score method is used to remove outliers; for asymmetric distributed data, the IQR method is used. Simultaneously, the data characteristics and contextual information of the removed outliers are recorded for subsequent analysis of the causes of the anomalies. For data with missing values ​​after outlier removal, interpolation, KNN imputation, or time series forecasting methods are used for missing data completion, depending on the nature of the missing data. For example, in time series data, if the missing data is short-term and continuous with short missing segments, linear or polynomial interpolation is used for imputation; if the missing data is long-term, intermittent, or has complex patterns, KNN imputation or time series forecasting models (such as the ARIMA model predicting missing values ​​based on historical data) are used to ensure data integrity and usability.

[0039] Next, the preprocessed data is fused and aligned, resampling data from different frequencies to a unified time frequency and converting different types of data into a unified data structure format. For example, high-frequency vibration data and low-frequency temperature data are both resampled to one data point per minute, and different types of data (numerical, text, image, etc.) are converted into a unified data structure format, such as quantizing image feature data into vector form to facilitate subsequent fusion processing.

[0040] After fusion and alignment, key features such as state trends, operating cycles, and coefficients of variation are extracted and combined with the energy efficiency calculation model to generate energy efficiency feature data. Finally, the energy efficiency feature data and multi-source device data are stored together in the time series database and feature database.

[0041] For example, based on the physical characteristics of the equipment, the characteristics of the process flow, and historical operating data experience, key features such as the trend characteristics of the equipment's operating status (calculating the slope change rate of the data through a sliding window), periodic characteristics (analyzing the main frequency period of the data using fast Fourier transform), and coefficient of variation (the ratio of standard deviation to mean to measure the relative magnitude of data fluctuation) are extracted. These features are then combined with an energy efficiency calculation model (calculating energy efficiency indicators based on parameters such as equipment power, production output, and operating time) to generate energy efficiency feature data. The extracted feature data and the original data are stored together in a time series database and a feature database, organized and managed in the form of structured data tables, providing standardized and high-quality data input for the training and inference of the model layer.

[0042] S4: Split the target data according to the device dimension, build and train a single device detection model for each device, and construct a state dependency graph between devices; use the single device detection model to obtain the corresponding target data and make real-time predictions; analyze the relationship between single device anomaly information and devices through a collaborative anomaly judgment mechanism, determine whether there are complex anomalies, complete the anomaly event classification and confidence assessment to form the detection results.

[0043] In a specific implementation, the energy efficiency characteristic data is split according to the device dimension. Based on the device dimension, a single device detection model is built for each device using time series models such as LSTM, GRU, or AutoEncoder.

[0044] Then, historical normal operation data of the equipment is acquired, and data augmentation techniques (such as adding random noise and recombining time series slices) are used to expand the training dataset, improve the model's generalization ability, and avoid overfitting. This training dataset is then used to train a single-equipment detection model, constructing a normal behavior pattern model for the equipment. Simultaneously, based on multivariate Bayesian networks, graph neural networks, or attention mechanisms, the relationships between the equipment are analyzed, and a state dependency graph between equipment is constructed. The physical connections between equipment (such as pipe connections, mechanical transmission connections, etc.), process flow sequences (such as material transport relationships between upstream and downstream equipment), and data correlations (such as a positive correlation between changes in the operating parameters of equipment A and changes in the energy consumption of equipment B) are transformed into nodes and edges in a graph structure. The weight of the edge represents the tightness of the relationship between the equipment and the direction of influence.

[0045] During real-time detection, the corresponding energy efficiency characteristic data is acquired using a single-device detection model and real-time prediction is performed. The residual between the predicted data and the actual data is calculated. When the residual exceeds a preset single-device anomaly threshold, the device is determined to be potentially abnormal, and anomaly information is generated. Based on the relationships in the state dependency graph between devices, the anomaly information from multiple single-device models is analyzed. Graph structure propagation analysis algorithms (such as message passing mechanisms based on graph neural networks to propagate abnormal state information in the device association graph and analyze the propagation path and affected scope of the anomaly) are used to simulate the propagation process of the anomaly between devices. Combined with causal reasoning algorithms (such as causal inference methods based on Bayesian networks to explore the causal relationship chain between device state changes), the root cause of the anomaly and the interaction mechanism between related devices are explored to determine whether there are complex anomalies caused by the mutual coupling of multiple devices and to identify the anomaly event.

[0046] Finally, the abnormal events are classified according to their severity, scope of impact, and duration into minor, severe, and fault levels. Model uncertainty quantification methods (such as Monte Carlo dropout technique to estimate the uncertainty of model predictions, combined with residual statistical characteristics to calculate anomaly confidence scores) are used to calculate a confidence score for each abnormal event. The anomaly classification results and confidence scores are recorded to form detection results, providing a precise basis for the formulation of early warning strategies.

[0047] S5: Based on the detection results, determine whether the early warning conditions are met according to the event triggering mechanism. If they are met, send an early warning message.

[0048] In a specific implementation, based on the detection results, it is determined whether the early warning conditions are met according to preset event triggering rules. The triggering rules include anomaly type, anomaly indicators, and / or multi-device joint alarm rules. Specifically, the triggering rules can be composed of a combination of conditions such as anomaly type (e.g., specific type of equipment failure, critical process parameter severely exceeding limits, etc.), threshold level (e.g., the percentage of anomaly indicators exceeding the normal range reaches a certain threshold), and multi-device joint alarm rules (e.g., two adjacent critical devices simultaneously exhibit anomalies and the duration of the anomalies exceeds a set value).

[0049] When the warning conditions are met, the corresponding warning process is initiated according to the level and type of the abnormal event, following a tiered linkage warning strategy. For minor abnormal events, operators are notified to pay attention to changes in equipment status through web interface pop-up reminders, industrial HMI screen flashing prompts, and mobile APP push notifications. For severe abnormal events, in addition to the warning process for minor abnormal events, an email notification is sent to the equipment maintenance supervisor, and the automated control system is triggered to adjust the operating parameters of relevant equipment (such as reducing equipment load, adjusting process parameter setpoints, etc.) to alleviate equipment operating pressure and prevent further deterioration of the abnormality. For fault-level abnormal events, an audible and visual alarm device is immediately triggered, an SMS is sent to the management mobile terminal, and a command is sent to shut down the automated control system and lock equipment operation permissions.

[0050] During the early warning information push process, the multi-terminal push mechanism selects appropriate push channels and display methods based on the terminal device type and preference settings of the recipient. For example, the web interface displays detailed real-time data, historical trend comparison charts, and anomaly diagnosis information of abnormal devices; the industrial HMI interface presents the abnormal status indication and key parameters of the equipment in a simple and intuitive graphical way; the mobile APP pushes brief anomaly reminder messages and quick handling guide links; and emails and SMS send text notifications containing key information such as anomaly time, device, type, and level.

[0051] Furthermore, through visualization modules such as digital twins or 2D graphical interfaces, data and information from various layers are received and processed. Within the digital twin or 2D graphical interface, real-time data updates show equipment status (e.g., equipment icon color changes with operating status, and real-time numerical displays of parameters such as temperature and pressure). Historical trend curves are plotted (allowing users to customize time ranges and parameter combinations to view historical data trends), warning records are recorded and displayed (details of each warning are listed in chronological order, expandable to view details and processing progress), and equipment association path diagrams are generated (graphically presenting the connection paths between devices based on their relationships, highlighting affected paths when an anomaly occurs). Simultaneously, operators can interact with the interface, such as clicking on equipment to view detailed operating parameters, dragging the timeline to rewind historical states, and zooming in and out to view details in specific areas. This enables comprehensive, intuitive, and dynamic monitoring and visualization management of industrial equipment operation status, assisting maintenance personnel in quickly locating faults, analyzing causes, and developing maintenance strategies. Remote maintenance intervention is also supported, such as remotely starting and stopping equipment, adjusting parameter settings, and obtaining remote control permissions for equipment, achieving intelligent and efficient operation and maintenance management of industrial equipment.

[0052] In this embodiment, multi-protocol adaptation and unified modeling break down the barriers of heterogeneous devices, time synchronization and preprocessing ensure data consistency and reduce cloud pressure, refined data processing improves data quality, and single-device detection and inter-device correlation modeling achieve accurate identification of complex anomalies. Combined with hierarchical early warning and multi-terminal push mechanisms, it accelerates anomaly response and effectively solves the problems of difficult device collaboration, isolated anomaly detection, high false alarm and false negative rates, and delayed early warning in traditional methods. It significantly improves the accuracy, timeliness, and intelligence of anomaly detection in industrial sites and enhances the security, stability, and maintenance efficiency of system operation.

[0053] like Figure 2 As shown, the following are embodiments of the multi-device collaborative anomaly detection and early warning system provided in this disclosure. This system and the multi-device collaborative anomaly detection and early warning methods in the above embodiments belong to the same inventive concept. For details not described in detail in the embodiments of the multi-device collaborative anomaly detection and early warning system, please refer to the embodiments of the above multi-device collaborative anomaly detection and early warning methods.

[0054] A multi-device collaborative anomaly detection and early warning system includes: The perception layer is used to collect data from multiple sources through perception layer devices deployed in the industrial field, and to perform data conversion and unified modeling through the industrial protocol parsing adapter module. The network layer is used to perform protocol data conversion and caching on multi-source device data using industrial edge computing nodes or IoT gateway devices; to perform unified timestamp labeling on multi-source device data to achieve time synchronization; and to perform local preprocessing and lightweight modeling at the edge to extract preliminary features and form preprocessed data.

[0055] The platform layer is used to call the data processing engine to perform outlier removal, missing value completion, multi-source fusion and alignment, and feature construction operations on the preprocessed data, so as to obtain the target data and store it in the corresponding database.

[0056] The model layer is used to split the target data according to the device dimension, build and train a single device detection model for each device, and construct a state dependency graph between devices. The single device detection model is used to obtain the corresponding target data and make real-time predictions. The collaborative anomaly judgment mechanism is used to analyze the relationship between single device anomaly information and devices, determine whether there are complex anomalies, and complete the classification of anomaly events and confidence assessment to form detection results.

[0057] The application layer is used to determine whether the early warning conditions are met based on the detection results and the event triggering mechanism. If the conditions are met, an early warning message is sent.

[0058] The multi-device collaborative anomaly detection and early warning system provided in this embodiment solves problems such as device heterogeneity, data inconsistency, and isolated detection by using an industrial protocol parsing adapter, edge time synchronization, data processing engine, single-device and collaborative detection models, and hierarchical early warning mechanism. This improves the accuracy, timeliness, and intelligence of anomaly detection, and enhances the system's security, stability, and maintenance efficiency.

[0059] Figure 3 A schematic diagram of the hardware structure of an electronic device for implementing various embodiments of the present invention.

[0060] The multi-device collaborative anomaly detection and early warning method provided in this application can be applied to electronic devices. Those skilled in the art will understand that the electronic device structure involved in the embodiments of this invention does not constitute a limitation on the electronic device. An electronic device may include more or fewer components than illustrated, or combine certain components, or have different component arrangements. In the embodiments of this invention, electronic devices include, but are not limited to, laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. Electronic devices may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the embodiments of this application described and / or claimed herein.

[0061] Electronic devices may include processors, external memory interfaces, internal memory, universal serial bus (USB) interfaces, charging management modules, power management modules, batteries, wireless communication modules, audio modules, speakers, microphones, sensor modules, buttons, cameras, displays, and SIM card interfaces, etc.

[0062] A processor may include one or more processing units, such as: a central processing unit (CPU), an application processor (AP), a modem processor, a graphics processing unit (GPU), an image signal processor (ISP), a controller, memory, a video codec, a digital signal processor (DSP), a baseband processor, and / or a neural network processing unit (NPU). Different processing units may be independent devices or integrated into one or more processors.

[0063] The processor can serve as the nerve center and command center of an electronic device. The controller can generate operation control signals based on the instruction opcode and timing signals to control the fetching and execution of instructions.

[0064] The processor may also include memory for storing instructions and data. In some embodiments, the memory in the processor is a cache memory. This memory can store instructions or data that the processor has just used or that are used repeatedly. If the processor needs to use the instruction or data again, it can retrieve it directly from this memory. This avoids repeated accesses, reduces processor latency, and thus improves system efficiency.

[0065] An external storage interface (ESI) can be used to connect external memory cards, such as microSD cards, to expand the storage capacity of electronic devices. The external memory card communicates with the processor through the ESI to perform data storage functions, such as saving music and video files on the external memory card.

[0066] Internal memory can be used to store computer executable program code, which includes instructions. The processor executes various functional applications and data processing of electronic devices by running the instructions stored in internal memory. Internal memory can include a program storage area and a data storage area. Internal memory can include high-speed random access memory, and can also include non-volatile memory, such as at least one disk storage device, flash memory device, universal flash storage (UFS), etc.

[0067] Wireless communication functionality in electronic devices can be achieved through antennas, wireless communication modules, modem processors, and baseband processors.

[0068] Wireless communication modules can provide solutions for wireless communication applications in electronic devices, including wireless local area networks (WLANs) (such as wireless fidelity (Wi-Fi) networks), Bluetooth (BT), global navigation satellite system (GNSS), frequency modulation (FM), near field communication (NFC), and infrared (IR) technologies.

[0069] Electronic devices can implement audio functions through audio modules, speakers, receivers, microphones, headphone jacks, and application processors.

[0070] Electronic devices can achieve shooting functions through ISPs, cameras, video codecs, GPUs, displays, and application processors.

[0071] Electronic devices can achieve display functions through GPUs, displays, and application processors.

[0072] A GPU is a microprocessor for image processing, connected to the display screen and application processor. GPUs are used to perform mathematical and geometric calculations for graphics rendering. A processor may include one or more GPUs, which execute program instructions to generate or modify display information.

[0073] A display screen is used to display images, videos, etc. A display screen includes a display panel.

[0074] The aforementioned electronic device implements the multi-device collaborative anomaly detection and early warning method of this application through an industrial protocol parsing adapter, edge time synchronization, data processing engine, single-device and collaborative detection model, and hierarchical early warning mechanism. It solves problems such as device heterogeneity, data inconsistency, and isolated detection, and achieves the beneficial effects of improving the accuracy, timeliness, and intelligence level of anomaly detection, and enhancing system security, stability, and maintenance efficiency.

[0075] The storage medium provided in this application stores a program product capable of implementing a multi-device collaborative anomaly detection and early warning method.

[0076] Multi-device collaborative anomaly detection and early warning methods include: By deploying sensing layer devices in industrial sites, data from multiple sources is collected, and the data is converted and uniformly modeled through an industrial protocol parsing adapter module; Industrial edge computing nodes or IoT gateway devices are used to perform protocol data conversion and caching on multi-source device data; unified timestamp labeling is applied to multi-source device data to achieve time synchronization; local preprocessing and lightweight modeling are performed at the edge to extract preliminary features and form preprocessed data; The data processing engine is invoked to perform outlier removal, missing value completion, multi-source fusion and alignment, and feature construction operations on the preprocessed data to obtain the target data and store it in the corresponding database. The target data is split according to the device dimension. A single device detection model is built and trained for each device, and a state dependency graph between devices is constructed. The single device detection model is used to obtain the corresponding target data and make real-time predictions. The collaborative anomaly judgment mechanism is used to analyze the relationship between single device anomaly information and device, determine whether there are complex anomalies, and complete the classification of anomaly events and confidence assessment to form detection results. Based on the detection results, the system determines whether the warning conditions are met according to the event triggering mechanism. If they are met, a warning message is sent.

[0077] In some possible implementations, the multi-device collaborative anomaly detection and early warning method of this disclosure can be implemented as a program product, which includes program code. When the program product is run on a terminal device, the program code is used to cause the terminal device to perform the steps described in the "Exemplary Methods" section above according to various exemplary embodiments of this disclosure.

[0078] The storage medium disclosed herein may be any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples (a non-exhaustive list) of readable storage media include: an electrical connection having one or more wires, a portable disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof.

[0079] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A multi-device collaborative anomaly detection and early warning method, characterized in that, include: Data from multiple sources is collected by sensing layer devices deployed in industrial sites, and the data is converted and unified modeled through an industrial protocol parsing adapter module. Utilize industrial edge computing nodes or IoT gateway devices to perform protocol data conversion and caching of data from multiple sources; Data from multiple devices is uniformly timestamped to achieve time synchronization; Local preprocessing and lightweight modeling are performed at the edge to extract preliminary features and form preprocessed data. The data processing engine is invoked to perform outlier removal, missing value completion, multi-source fusion and alignment, and feature construction operations on the preprocessed data to obtain the target data and store it in the corresponding database. The target data is split according to the device dimension. A single device detection model is built and trained for each device, and a state dependency graph between devices is constructed. The single device detection model is used to obtain the corresponding target data and make real-time predictions. The collaborative anomaly judgment mechanism is used to analyze the relationship between single device anomaly information and device, determine whether there are complex anomalies, and complete the classification of anomaly events and confidence assessment to form detection results. Based on the detection results, the system determines whether the warning conditions are met according to the event triggering mechanism. If they are met, a warning message is sent.

2. The multi-device collaborative anomaly detection and early warning method according to claim 1, characterized in that, The process involves collecting multi-source device data through sensing layer devices deployed in the industrial field, and then performing data conversion and unified modeling through an industrial protocol parsing adapter module, including: Data is collected from sensor data, control system data, logs and event streams, and other sources by sensing layer devices deployed in industrial sites; The adapter module uses industrial protocol parsing to abstract and structure data from multiple devices using a unified modeling language. The industrial protocol parsing adapter module supports OPC UA, Modbus RTU / TCP, PROFINET, CAN, and EtherCAT communication protocols.

3. The multi-device collaborative anomaly detection and early warning method according to claim 1, characterized in that, The method involves uniformly timestamping data from multiple sources to achieve time synchronization. Local preprocessing and lightweight modeling are performed at the edge to extract preliminary features, forming preprocessed data, including: Based on the IEEE 1588 PTP or edge synchronization algorithm, data from multiple sources are tagged with a unified timestamp. At the edge, data from multiple devices is cleaned and aggregated, and lightweight modeling algorithms are used to perform preliminary modeling and analysis of the data, extracting key feature data to form preprocessed data.

4. The multi-device collaborative anomaly detection and early warning method according to claim 3, characterized in that, The process involves calling the data processing engine to perform outlier removal, missing value completion, multi-source fusion and alignment, and feature construction operations on the preprocessed data to obtain the target data and store it in the corresponding database, including: The data processing engine is invoked to receive the preprocessed data and identify its data type. For Gaussian distributed data, the Z-score method is used for outlier removal; for asymmetric distributed data, the IQR method is used for outlier removal; and missing data is filled in after outlier removal. The preprocessed data is fused and aligned, data of different frequencies are resampled to a unified time frequency, and different types of data are converted into a unified data structure format; After fusion and alignment are completed, key features are extracted and combined with the energy efficiency calculation model to generate energy efficiency feature data. The energy efficiency feature data and multi-source device data are stored together in the time series database and feature database.

5. The multi-device collaborative anomaly detection and early warning method according to claim 4, characterized in that, The step of splitting the target data according to the device dimension, building and training a single-device detection model for each device, and constructing a state dependency graph between devices includes: The energy efficiency characteristic data is split according to the device dimension, and a single device detection model is built for each device based on the device dimension using LSTM, GRU or AutoEncoder time series models. Acquire historical normal operation data of the device, expand the training dataset using data augmentation techniques, train the model using the training dataset, and build a normal behavior pattern model of the device. Based on multivariate Bayesian networks, graph neural networks, or attention mechanisms, the relationships between various devices are analyzed, and a state dependency graph between devices is constructed. The physical connection relationships, process flow sequence relationships, and data correlation relationships between devices are transformed into nodes and edges in the graph structure, and the weights of the edges are set according to the tightness of the relationship between devices and the direction of influence.

6. The multi-device collaborative anomaly detection and early warning method according to claim 5, characterized in that, The process involves using a single-device detection model to acquire relevant target data and perform real-time predictions. A collaborative anomaly detection mechanism is then used to analyze the correlation between single-device anomaly information and the device, determining whether complex anomalies exist. This process categorizes anomaly events and assesses confidence levels to generate detection results, including: The corresponding energy efficiency characteristic data is obtained by using a single device detection model and real-time prediction is performed. The residual between the predicted data and the actual data is calculated. When the residual exceeds the preset single device anomaly threshold, it is determined that the device may be abnormal and anomaly information is generated. Based on the relationships in the state dependency graph between devices, abnormal information from multiple single device models is analyzed. The graph structure propagation analysis algorithm is used to simulate the propagation process of abnormalities between devices. At the same time, the causal reasoning algorithm is combined to explore the root cause of abnormalities and the interaction mechanism between related devices, and to determine whether there are complex abnormal situations caused by the mutual coupling of multiple devices, so as to identify abnormal events. Abnormal events are classified into minor, severe, and fault levels based on their severity, scope of impact, and duration. A confidence score is calculated for each abnormal event using a model uncertainty quantification method, and the abnormal classification results and confidence scores are recorded.

7. The multi-device collaborative anomaly detection and early warning method according to claim 6, characterized in that, Based on the detection results, the system determines whether the early warning conditions are met according to the event triggering mechanism. If the conditions are met, an early warning message is sent, including: The system determines whether the warning conditions are met based on preset event triggering rules; the triggering rules include anomaly type, anomaly indicator, and / or multi-device joint alarm rules. When the warning conditions are met, the following warning process will be initiated according to the level and type of the abnormal event and the hierarchical linkage warning strategy. For minor abnormal events, operators can pay attention to changes in equipment status through web interface pop-up alerts, industrial HMI screen flashing prompts, and mobile APP push notifications. For severe abnormal events, in addition to the early warning process for minor abnormal events, an email notification is sent to the equipment maintenance supervisor, and the automated control system is triggered to adjust the operating parameters of the relevant equipment. In response to fault-level abnormal events, the system immediately triggers an audible and visual alarm and sends a text message to the management mobile terminal. At the same time, it sends a command to stop the automated control system and lock the equipment operation permissions.

8. A multi-device collaborative anomaly detection and early warning system, characterized in that, The system employs the multi-device collaborative anomaly detection and early warning method as described in any one of claims 1 to 7; The system includes: The perception layer is used to collect data from multiple sources through perception layer devices deployed in the industrial field, and to perform data conversion and unified modeling through the industrial protocol parsing adapter module; The network layer is used to perform protocol data conversion and caching of multi-source device data using industrial edge computing nodes or IoT gateway devices; to uniformly timestamp and label multi-source device data to achieve time synchronization; and to perform local preprocessing and lightweight modeling at the edge to extract preliminary features and form preprocessed data. The platform layer is used to call the data processing engine to perform outlier removal, missing value completion, multi-source fusion and alignment, and feature construction operations on the preprocessed data, so as to obtain the target data and store it in the corresponding database. The model layer is used to split the target data according to the device dimension, build and train a single device detection model for each device, and construct a state dependency graph between devices; use the single device detection model to obtain the corresponding target data and make real-time predictions; analyze the relationship between single device anomaly information and devices through a collaborative anomaly judgment mechanism, determine whether there are complex anomalies, complete the classification of anomaly events and confidence assessment to form detection results; The application layer is used to determine whether the early warning conditions are met based on the detection results and the event triggering mechanism. If the conditions are met, an early warning message is sent.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the multi-device collaborative anomaly detection and early warning method as described in any one of claims 1 to 7.

10. A storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the multi-device collaborative anomaly detection and early warning method as described in any one of claims 1 to 7.

Images