Time series data anomaly detection method and system based on industrial edge equipment

Abstract

The invention belongs to the technical field of industrial equipment operation and maintenance, and discloses a time series data anomaly detection method and system based on industrial edge equipment, and the method comprises the steps: firstly generating adaptive directional noise, and diffusing a normal window signal and a to-be-detected window signal; secondly, reconstructing a non-abnormal normal window signal through a teacher model; normal window signals after abnormal stripping are reconstructed through a student model; constructing a multi-view fusion anomaly score according to the reconstructed normal window signal without anomaly and the normal window signal after abnormal stripping; and then, according to the multi-view fusion anomaly score, time series data anomaly is detected. According to the method, direction self-adaption of noise can be achieved, noise-denoising-scoring closed-loop consistency is constructed, abnormal amplification is enhanced, high-quality detection is provided for the industrial edge equipment, and safety maintenance of the industrial edge equipment is facilitated.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of industrial equipment operation and maintenance, and relates to a time series data anomaly detection method and system based on an industrial edge device. BACKGROUND

[0002] The multi-channel sensor data of industrial sites, such as vibration, temperature, current, pressure, rotating speed, energy consumption, valve position and flow, has the following characteristics: multi-scale period (shift / day / week), slow aging drift, sudden pulse impact, composite structure superposition (trend + high-frequency disturbance + periodic distortion), and non-stationary noise fluctuating with working conditions. Industrial edge devices need to output preliminary alarms and available repair values within seconds or even milliseconds to ensure that the control, scheduling and back-end analysis pipeline are not interrupted. However, industrial edge devices are subject to the following limitations: a) limited computing and memory budget (common on ARM / x86 low-power platforms); b) insufficient network bandwidth and stability (unable to continuously upload raw high-frequency multi-channel data); c) privacy and compliance requirements (involving sensitive process parameters and geographically distributed devices); d) long-term unattended (thresholds and models need to adapt to drift); e) repair closed loop real-time (if abnormal data is not timely supplemented, it will lead to distortion of subsequent prediction / statistics / quality tracking).

[0003] Compared with general cloud detection, the industrial edge scene requires "detection + repair + resource constraint awareness + security governance" coordination: (1) the algorithm not only needs to improve the discrimination between abnormal and normal under similar variance, but also needs to maintain accuracy under the conditions of step number and quantization inference; (2) it needs to reduce false positives to avoid frequent manual intervention, and output high-reliability repair values to reduce cloud secondary cleaning and playback calculation; (3) it also needs to realize cloud cross-site aggregation and retraining and version iteration through summary statistics of the minimum upload. The general goal of time series anomaly detection is to identify the time or subsequence that deviates from the normal mode, and the industrial device scene further emphasizes: unified detection of multiple types of anomalies (point / segment / trend / period / complex), low-delay coupling of detection and repair, robustness to concept drift and noise disturbance, and avoidance of anomalies being "incorrectly reconstructed" by the model to hide.

[0004] The current time series data anomaly detection methods applied in industrial equipment scenarios can be roughly divided into: reconstruction, prediction, filling / interpolation, diffusion model, and multi-score fusion and integration: (1) Reconstruction methods (autoencoders, VAEs, Seq2Seq, attention, etc.) use reconstruction error as the score, but anomalies are often reconstructed and confused with normal, especially with the decrease in discrimination under similar variance; (2) Prediction methods predict the future through history, but are prone to mismatch when concept drift, period superposition or structural mutation, and short-term local anomalies are often smoothed; (3) Filling / interpolation methods fill in by masking, and it is difficult to distinguish if the local statistics of anomalies are close to the normal neighborhood; (4) Diffusion model methods are based on stepwise noise addition / denoising, but isotropic Gaussian noise indiscriminately erodes normal and anomalies, lacks local-global statistical coordination, and mostly rely on the final residual single-view score, lacking teacher-student coordination mechanism; (5) Although multi-score fusion / integration methods can alleviate the failure of single indicators, there are problems such as inconsistent scale, difficulty in adaptive weight, and limited gain of redundant related perspectives.

[0005] Furthermore, instances with similar variances but different states are prevalent in industrial and operational datasets: for example, when the normalized variance difference threshold is 0.1, over 50% of normal windows contain at least one anomalous window in their most similar set. Reasons include: gradual rise / fall anomalies disguised as trends, magnitude differences masked by principal variances, trends and periods overlapping leading to hidden anomalies, and multivariate collaborative compensation diluting univariate statistical differences. Relying solely on variance, mean, or single-scale trends is highly prone to misjudgment.

[0006] Therefore, common shortcomings of existing methods include: (1) confusion of similar variance instances; (2) overfitting of anomalies due to reconstruction or prediction alone; (3) isotropic noise diffusion without explicit contraction of anomaly directions and lack of directional adaptation; (4) single-view anomaly scoring, which is prone to failure under gradual anomaly or noise interference; (5) static threshold setting or reliance on fixed distribution assumptions, leading to increased false alarms / false negatives during drift; (6) lack of native repair closed-loop collaboration between noise-denoising-scoring, relying on additional interpolation or manual recording; (7) lack of unified discrimination preservation strategy for step pruning, distillation and quantization; and (8) lack of hierarchical (teacher anchoring) supervision in the denoising process.

[0007] Furthermore, deploying "edge gateways" in industrial settings presents additional engineering challenges: a) Limited computational / memory budgets mean that complete high-step diffusion and full-scale feature extraction can lead to latency exceeding limits; b) Insufficient uplink bandwidth and network stability make it difficult to transmit raw, high-frequency, multi-channel data back in real time; c) Data involves sensitive process or commercial information, requiring a reduction in the outgoing raw sequences to meet privacy / compliance requirements; d) Long-term equipment operation leads to concept drift and noise accumulation, making static thresholds and fixed distribution assumptions prone to failure; e) After anomaly detection, usable "repair values" need to be generated immediately to ensure uninterrupted control, scheduling, and subsequent analysis; f) The system needs to support online hot updates / signature verification / fast rollback, as well as security degradation strategies under anomaly storms (frequent outbreaks of anomalies). Existing solutions based solely on cloud-based reconstruction, single-view residuals, or lacking a repair loop and version governance are insufficient to simultaneously meet these multidimensional constraints.

[0008] Therefore, there is an urgent need in this field to develop a time-series data anomaly detection technology that meets the needs of industrial edge devices: i) explicitly utilizing a diffusion stripping framework where "anomalies can be viewed as removable noise"; ii) possessing adaptive directional noise control, balancing the erosion of anomalies with the preservation of normal structures; iii) introducing teacher-student collaborative distillation to enhance discriminative power under similar variance conditions; iv) multi-view hierarchical scoring covering diffusion stages and amplitude levels; v) maintaining controllable computational overhead under changes in step number T, window length, and variable dimensionality; vi) being robust to drift and noise perturbations and reducing the overall risk of false positives / false negatives. Summary of the Invention

[0009] The purpose of this invention is to address the problems existing in the prior art by providing a method and system for anomaly detection in time-series data of industrial edge devices. This method is capable of adaptive noise control and constructing a consistent noise-denoising-scoring closed loop, enhancing anomaly amplification and thus providing high-quality detection for industrial edge devices, contributing to their safe maintenance. Specifically, through directional contraction perturbation, step-by-step anomaly stripping, and multi-layer difference fusion, it achieves unified and efficient detection of multiple types of anomalies (point anomalies, segment anomalies, trend superposition anomalies, periodic distortion anomalies, composite structural anomalies, etc.). Furthermore, it utilizes the inverse diffusion reconstruction results combined with statistical consistency and similar fragment retrieval to achieve reliable filling / repair of anomaly regions, achieving comprehensive improvements in robustness, discriminability, interpretability, and data usability.

[0010] This invention constructs a noise-denoising-scoring closed-loop consistency mechanism to strengthen the anomaly amplification mechanism. It utilizes local-global statistics and sign parameters to construct directional noise with anisotropic perturbations, shrinking potentially anomalous data points towards the normal statistical manifold and minimizing perturbations to the normal structure. A dual-track denoising process (teacher-student) is employed: the teacher model learns a stable normal denoising mapping, while the student model simultaneously learns to remove "noise + anomalous sub-components" on sequences containing anomalies. Anomaly differences (frequency band / scale) are progressively extracted during the multi-step reverse denoising process. High signal-to-noise ratio evidence is obtained by fusing anomaly scores from three approximately orthogonal perspectives: the final reconstruction difference between teacher and student, the difference in the intermediate diffusion layer, and the student residual, thus improving robustness. After detection, preliminary repair is generated based on the student's inverse diffusion reconstruction results, followed by statistical consistency and weighted correction using historical normal segment similarity retrieval, achieving low-latency, high-reliability automatic repair and ensuring data continuity and privacy compliance for subsequent analysis and training. An adaptive or robust threshold strategy is employed to reduce the impact of concept drift.

[0011] The second stage of "statistical consistency" is described as follows: The preliminary repair values ​​obtained in the first stage (reverse diffusion) are first centered and scaled using the old local mean and standard deviation (i.e., subtracting the old mean and dividing by the old standard deviation). Then, the latest local standard deviation is used for scaling and shifted to the latest local mean, resulting in repair values ​​whose mean and fluctuation amplitude closely match the current operating conditions (equivalent to an affine transformation of "old statistical standardization + new statistical destandardization"). This step ensures that the morphological structure originates from the generative model, and the numerical level and amplitude match the latest on-site conditions, thus forming a closed-loop repair logic of "reverse diffusion reconstruction → statistical consistency → similar fragment retrieval and correction" in advance.

[0012] Based on the above analysis, the present invention provides a method for detecting time-series data anomalies based on industrial edge devices, comprising the following steps: S1 generates adaptive directional noise and diffuses it between the normal window signal and the signal to be detected window; S2 reconstructs normal window signals without abnormalities using the teacher model; and reconstructs normal window signals after abnormality removal using the student model. S3. Based on the reconstructed normal window signal without anomalies and the normal window signal after anomaly removal, a multi-view fusion anomaly score is constructed. S4 detects anomalies in time-series data based on multi-perspective fusion anomaly scoring.

[0013] In step S1 above, directional noise generation can solve the problem of difficulty in distinguishing anomalies under similar variance and provide high-contrast input for denoising with fewer steps after pruning.

[0014] Specifically, step S1 includes the following sub-steps: S11, Based on the local statistics of the signal in the window to be detected and the global statistics of the original signal, obtain the mixed statistics of the signal in the window to be detected; S12, construct intermediate variables based on the mixed statistics of the signals in the window to be detected, and generate directional noise based on the intermediate variables; S13, based on the directional noise, obtain the forward diffusion signal corresponding to the signal of the window to be detected; S14: Based on the isotropic noise, obtain the diffusion signal corresponding to the reference normal window.

[0015] In step S2 above, by collaborating with the teacher and student models and combining the stripping of distributional anomaly sub-components, the discriminative power for conforming / gradual anomalies can be maintained with a low computational budget. Both the teacher and student models adopt a U-net structure based on LDM (Latent Diffusion Model).

[0016] Specifically, step S2 includes the following sub-steps: S21, Based on the normal window signal diffusion results, the normal window signal without abnormalities is reconstructed using the teacher model; S22, based on the signal diffusion results of the window to be detected, the normal window signal after abnormal stripping is reconstructed using the student model.

[0017] In step S3 above, the risk of single residual failure is reduced by multi-perspective scoring fusion, and the scores can be reduced according to the importance of the perspective when resources are scarce.

[0018] In this invention, the multi-view fusion anomaly score includes the teacher-student final reconstruction difference, the teacher-student intermediate step feature difference, and the student residual.

[0019] In step S4 above, a scoring threshold and drift metric are set to meet the needs of long-term unattended scenarios and ensure stable recall and accurate balance. When the drift metric exceeds the set metric, the scoring threshold is adaptively fine-tuned; otherwise, the scoring threshold remains unchanged. Then, the multi-view fusion anomaly score is compared with the scoring threshold. When the multi-view fusion anomaly score exceeds the scoring threshold, it is determined to be a window anomaly.

[0020] The aforementioned method for detecting anomalies in time-series data based on industrial edge devices also includes:

[0021] S5 repairs window signals that are determined to be abnormal.

[0022] In step S5 above, a reliable alternative value that can be directly used to control / predict the link is provided through a three-stage repair process (reverse diffusion reconstruction / statistical uniformity / similar segment correction).

[0023] Specifically, step S5 includes the following sub-steps: S51, using the student model back-diffusion reconstruction signal as the stage 1 repair signal; S52, perform statistical uniformity processing on the Stage 1 repair signal, adjust its mean and standard deviation to be consistent with the statistical characteristics of the current window signal, and obtain the Stage 2 repair signal; S53. Search for the most similar set of reference segments in the historical normal segment library, perform a weighted average on each reference segment, and then fuse it with the Stage 2 repair signal in proportion to obtain the Stage 3 repair signal. The Stage 3 repair signal is then used as the repaired window signal.

[0024] In step S5 above, the abnormal points in the window are first located by the point-level contribution rate, and then the abnormal points are repaired according to steps S51-S53 above.

[0025] The present invention also provides a time-series data anomaly detection system based on industrial edge devices, comprising: The directional noise generation and diffusion module is used to generate adaptive directional noise and diffuse the normal window signal and the signal to be detected window. The signal reconstruction module is used to reconstruct normal window signals without abnormalities using the teacher model, and to reconstruct normal window signals after abnormality removal using the student model. The multi-view anomaly scoring fusion module constructs a multi-view fused anomaly score based on the reconstructed normal window signal without anomalies and the normal window signal after anomaly removal. The anomaly detection module is used to detect anomalies in time-series data based on multi-perspective fusion anomaly scores.

[0026] The directional noise generation and diffusion module described above operates according to step S1 given earlier. The signal reconstruction module described above operates according to step S2 given earlier. The multi-view anomaly scoring and fusion module described above operates according to step S3 given earlier. The anomaly detection module described above operates according to step S4 given earlier.

[0027] In one possible implementation, the aforementioned time-series data anomaly detection system based on industrial edge devices further includes: The signal repair module is used to repair window signals that are determined to be abnormal.

[0028] The signal repair module is used to perform the operation according to step S5.

[0029] Compared with the prior art, the present invention has the following beneficial effects: 1) This invention significantly reduces the confusion of windows with similar variance but different states by generating directional adaptive noise, and improves the discrimination interval between anomalies and normal states compared with traditional isotropic diffusion or pure reconstruction / prediction methods; 2) This invention achieves explicit modeling of “abnormalities as removable noise” through collaboration between teacher and student models and a step-by-step abnormal sub-component stripping framework. Compared with single-network reconstruction or pure prediction methods, it maintains higher stability in compound / gradual / periodic superposition abnormality scenarios. 3) This invention obtains anomaly scores through multi-view fusion, which achieves higher robustness and interpretability than single reconstruction residual or single-scale feature difference strategies under noise perturbation, concept drift and local sparse anomaly conditions. 4) This invention, through rolling updates of scoring thresholds and modular component design (noise strategies, frequency band operators, and fusion weights are replaceable), makes it easier to deploy online, expand, and quickly customize for industry-specific anomaly types compared to traditional static thresholds and coupled end-to-end models. 5) This invention is based on normalization reconstruction generated by backdiffusion and statistical / similar segment fusion correction to achieve rapid and reliable filling of outliers and reduce the negative impact of missing / abnormal contamination on subsequent prediction, control and training data pipelines. Attached Figure Description

[0030] Figure 1 A schematic diagram illustrating the principle of the time-series data anomaly detection method based on industrial edge devices provided in this embodiment of the invention; Figure 2 This is a schematic diagram of the time-series data anomaly detection method based on industrial edge devices provided in an embodiment of the present invention; Figure 3 This is a schematic diagram of the adaptive directional noise generation and diffusion process provided in an embodiment of the present invention; Figure 4 This is a schematic diagram of the signal reconstruction process; Figure 5 This is a schematic diagram of the signal repair process.

[0031] Terminology Explanation

[0032] 1. Diffusion Model: This refers to a generative framework that learns the data distribution through a process of "progressive noise addition in the forward direction + progressive denoising in the reverse direction." The forward diffusion process uses a noise scheduling sequence to progressively perturb the original structure, while the reverse process uses a parameterized network to predict noise (or noise-free samples) and gradually restore the normal form. This invention uses it to establish a teacher / student dual-track denoising foundation; its theoretical basis can be found in the reference [J. Ho, A. Jain, P. Abbeel. Denoising diffusion probabilisticmodels. In NeurIPS, 2020.].

[0033] 2. Teacher-Student Collaborative Diffusion: This refers to the introduction of a dual-network collaboration of "teacher (normal anchoring) + student (including anomaly stripping)" in diffusion modeling. The teacher learns a stable normal denoising mapping, while the student simultaneously learns the removal of directional noise and anomaly components and aligns with the teacher's feature distillation. The final / intermediate differences between the two form multi-perspective anomaly evidence.

[0034] 3. Directional Adaptive Noise: By using the fusion of local and global statistics and the sign function, each dimension is assigned a direction "towards the normal statistical manifold", which enhances the tendency of potential outliers to be pulled towards the normal distribution in the positive phase, thereby amplifying the differences in subsequent reconstruction.

[0035] 4. Multi-View Anomaly Scoring: This refers to the integration of three complementary scoring methods: teacher-student final reconstruction difference, diffusion intermediate layer feature difference, and student residual. By combining amplitude, structure, and stage information, it reduces the risk of misjudgment caused by the failure of a single residual or single-scale feature, and improves robustness to composite, gradual, and similar anomalies. The theoretical basis can be found in the references.

[0036] 5. Three-Stage Repair Loop: This refers to the pipeline of "preliminary reconstruction by reverse diffusion → statistical consistency (old statistical standardization + new statistical destandardization) → weighted correction by retrieval of similar normal fragments". This closed loop takes into account structure generation, numerical scale alignment and consistency with historical patterns, and outputs a highly reliable repair value that can be used immediately for subsequent control / prediction links, reducing data interruption caused by anomalies and the accumulation of downstream chain errors. Detailed Implementation

[0037] The technical solutions of various embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0038] Example 1

[0039] This embodiment integrates diffusion generation models and adaptive statistical modeling, addressing engineering constraints such as limited on-site computing power, low-latency early warning, narrowband or intermittent uplink, data privacy compliance, long-term unattended operation, and verifiable hot updates. It proposes an integrated mechanism of "tailorable diffusion steps + distillation alignment + threshold drift adaptation + lightweight three-stage repair closed loop + statistical summary reporting," achieving low-overhead, highly robust anomaly identification and data continuity assurance at the edge, while supporting periodic retraining and multi-gateway collaboration in the cloud. This technical approach can be extended to other local real-time multivariate time-series scenarios limited by privacy and bandwidth, without altering its core application focus on industrial edge devices.

[0040] This embodiment provides a method for detecting anomalies in time-series data based on industrial edge devices, such as... Figures 1-2 As shown, it includes the following steps: S1 generates adaptive directional noise and diffuses it between the normal window signal and the signal to be detected window; S2 reconstructs normal window signals without abnormalities using the teacher model; and reconstructs normal window signals after abnormality removal using the student model. S3. Based on the reconstructed normal window signal without anomalies and the normal window signal after anomaly removal, a multi-view fusion anomaly score is constructed. S4 detects anomalies in time-series data based on multi-perspective fusion anomaly scoring.

[0041] In step S1 above, directional noise generation can solve the problem of difficulty in distinguishing anomalies under similar variance and provide high-contrast input for denoising with fewer steps after pruning.

[0042] like Figure 3 As shown, step S1 includes the following sub-steps:

[0043] S11, based on the local statistics of the signal in the window to be detected and the global statistics of the original signal, obtain the mixed statistics of the signal in the window to be detected.

[0044] For example, the The statistical representation of the mixed signals of the window is as follows: ; ; in, , They represent the first Estimate the mean and standard deviation of the diffusion at the q-th window and the q-th step; , They represent the first Local mean and local standard deviation of the signal in each window; , These represent the global mean and global standard deviation of the original signal, respectively. Denotes the weighted scheduling function for the q-th diffusion step. , Controlling kurtosis, Indicates the relative proportion of the center, controlling the center position of the S-shaped curve. This represents the total number of diffusion steps.

[0045] S12, construct intermediate variables based on the mixed statistics of the signals in the window to be detected, and generate directional noise based on the intermediate variables.

[0046] Sampling standard Gaussian noise Building intermediate variables : ; Using symbolic functions Element-wise direction is given, resulting in directional noise: ; in, Represents the absolute value of each element; This represents Hadamard multiplication; Indicates the first The window may initially contain anomalous signals, where d represents the number of channels and m represents the window length. This design "pulls back" outliers that deviate from the global statistical center while minimizing disturbances to normal values.

[0047] S13, based on the directional noise, obtain the forward diffusion signal corresponding to the signal of the window to be detected.

[0048] To be applicable to the student model, the forward diffusion signal corresponding to the window signal is obtained. Represented as: ; in, This represents the cumulative retention coefficient during the diffusion process. ;in, This represents the noise scheduling parameter for the u-th diffusion step.

[0049] S14: Based on the isotropic noise, obtain the diffusion signal corresponding to the reference normal window.

[0050] To be applicable to the teacher model, the diffusion signal corresponding to the reference normal window is obtained. Represented as: ; in, Indicates isotropic noise; Indicates the first A normal reference window.

[0051] In step S2 above, by collaborating with the teacher and student models and combining the stripping of distributional anomaly sub-components, the discriminative power for conforming / gradual anomalies can be maintained with a low computational budget. The teacher and student models use the same network structure, both selected from the U-Net structure based on LDM (Latent Diffusion Model).

[0052] like Figure 4 As shown, step S2 includes the following sub-steps:

[0053] S21. Based on the normal window signal diffusion results, the normal window signal without abnormalities is reconstructed using the teacher model.

[0054] Teacher Model by Input and output noise estimation ,Right now .

[0055] The normal window signal without anomalies (i.e., without noise) is then estimated using the teacher model as follows: ; in, This indicates that the teacher model directly estimates the signal shape of the window without abnormalities based on the diffusion signal corresponding to the normal window in step q, and uses it as the anchor point for subsequent multi-view scoring.

[0056] S22, based on the signal diffusion results of the window to be detected, the normal window signal after abnormal stripping is reconstructed using the student model.

[0057] The normal window signal after anomaly stripping is estimated using the student model as follows: .

[0058] in, It should be close to the normal window after abnormal stripping; The student model is represented by This is used for noise and anomaly estimation of the input.

[0059] In this embodiment, the teacher model and the student model are jointly optimized, and the joint optimization loss is: ; in, Indicates non-negative weighting coefficients; This indicates the teacher model's estimated loss; This indicates that the student model estimates the loss; This represents the distillation loss generated by the teacher model and the student model; where the mean squared error (MSE) is used to estimate the loss of both the teacher model and the student model.

[0060] (1) The teacher model estimated loss is expressed as: .

[0061] (2) Because the student model is in state Simultaneously estimate directional noise and current step anomaly sub-components: ; Therefore, the student model's estimated loss is expressed as: .

[0062] The step-by-step abnormal sub-component stripping process is as follows:

[0063] Define the pairwise difference (element-by-element difference between the window to be detected and the corresponding normal reference window): ;

[0064] Construct a set of operators (This uses a learnable convolution kernel; alternatively, you can choose a fixed bandpass filter, wavelet subband, attention mask, or sparse selector, etc.) The frequency components of the differences are extracted progressively: ; here, Let q represent the "candidate anomalous subcomponent" at step q, whose shape matches the window for subsequent element-by-element recombination. The overall difference between the decomposition and approximate reconstruction must satisfy: .

[0065] If strict control of energy conservation is required, then define... And constraints: ; in, This indicates the energy constraint tolerance (e.g., 0.05).

[0066] The significance of this stepwise stripping mechanism is that it decomposes complex anomalies into a series of interpretable, energy-controlled small blocks, reducing the difficulty of modeling strong nonlinearities and large biases in a single step, and facilitating the handling of directional noise in subsequent student networks. Collaborative estimation improves robustness and traceability.

[0067] (3) The distillation losses generated by the teacher model and the student model are expressed as: ; in, For cosine phase, ; This represents the set of layers in the student and teacher models; This represents the output of the j-th layer of the teacher model; This represents the output of the j-th layer of the student model.

[0068] In step S3 above, the risk of single residual failure is reduced by multi-perspective scoring fusion, and the scores can be reduced according to the importance of the perspective when resources are scarce.

[0069] In this embodiment, the multi-view fusion anomaly score includes the teacher-student final reconstruction difference, the teacher-student intermediate step feature difference, and the student residual.

[0070] Specifically, the teacher-student final reconstruction difference is expressed as: ; The above , This is obtained through the preceding steps S21 and S22.

[0071] Teacher-student intermediate step characteristic differences (selection of step set) Weight ) is represented as: .

[0072] Student residuals are represented as follows: .

[0073] The multi-view fusion anomaly score is represented as follows: ; in, , represents the weight parameter, The teacher-student final reconstruction difference, the teacher-student intermediate step feature difference, and the student residual can be normalized by z-score before being weighted to reduce scale differences.

[0074] In step S4 above, a scoring threshold and a drift metric are set to meet the needs of long-term unattended scenarios and ensure stable recall and accurate balance. When the drift metric exceeds the set metric, the scoring threshold is automatically adjusted; otherwise, the scoring threshold remains unchanged. The abnormal multi-view fusion score is compared with the scoring threshold. When the abnormal multi-view fusion score exceeds the scoring threshold, it is determined to be a window anomaly.

[0075] Estimate the mean of the multi-view fusion anomaly score on the calibration set (composed of normal signals). With variance Set an initial threshold. : ; in, This indicates the control alert level.

[0076] Define drift index : ; in, For numerical stability constants (e.g.) ); The mean and variance of the multi-view fusion anomaly score are obtained by statistically analyzing the recent "candidate normal" buffer (achieved by maintaining a window buffer that only contains recently judged normal scores). As a historical baseline; To set the indicator, it can be fixed at 2.0, set according to robust quantiles, or a certain number of standard deviations; if If the scoring threshold is re-estimated, a small incremental adjustment to the student model's normalization layer can be made simultaneously, and the new version number can be recorded; otherwise, the scoring threshold remains unchanged.

[0077] Under normal circumstances, the threshold is updated slowly in an exponential or linear smoothing manner to avoid drastic jumps. Specifically, in the online phase, a smoothing coefficient is used. Update the rating threshold: ; in, , Let represent the scoring thresholds for the t-th window and the (t+1)-th window, respectively.

[0078] The multi-view fusion anomaly score is compared with the score threshold. When the multi-view fusion anomaly score is greater than the score threshold, it is judged as a window anomaly.

[0079] If confidence mapping is required, temperature can be used. : .

[0080] Based on steps S1-S4 above, this embodiment can be further improved. The above-mentioned time-series data anomaly detection method based on industrial edge devices further includes:

[0081] S5, repair the window signal that is determined to be abnormal; reacquire the multi-view fusion anomaly score for the repaired window signal, and re-detect the window anomaly.

[0082] A three-stage repair process (reverse diffusion reconstruction / statistical uniformity / similar fragment correction) is used to provide reliable alternative values ​​that can be directly used to control / predict links.

[0083] In this embodiment, firstly, in step S4, frequency band re-examination or neighborhood consistency filtering can be performed on the high-confidence window to suppress isolated noise. Specifically, outliers in the window can be located using point-level contribution rates.

[0084] Point-level contribution rate is expressed as: ; in, , Let i and j represent the student residuals of the i-th and j-th data points in the t-th window, respectively. This represents the numerical stability constant.

[0085] Based on the calculated point-level contribution rate in descending order, a heat map list of "significant contribution points" is constructed. The top percentages of the heat map rankings are selected as candidates (Top-K selection). Then, the points are filtered through cross-channel consistency and constraints of being greater than the minimum duration to obtain the mask of the point locations that need to be repaired.

[0086] Then, follow steps S51-S53 to repair the abnormal points.

[0087] S51 uses the student model back-diffusion reconstructed signal as the stage 1 repair signal.

[0088] Specifically, in stage 1, the inverse process in the form of DDPM is used for any current state x. q (This can be a teacher or student chain) Iterative backdiffusion reconstruction: ; in, This represents the proportion of forward noise at step q. This indicates the estimation of prediction noise (or student residuals) in this step. This represents the posterior sampling standard deviation (which can be taken as...). ( (This represents the variance of the posterior probability distribution during reverse denoising from step q to step q-1; alternatively, it can be set to 0 for deterministic reverse diffusion). This represents a standard normal Gaussian distribution.

[0089] Therefore, the Stage 1 repair signal can be represented as: ;

[0090] in, This represents the t-th window signal reconstructed through Q-step iterative backdiffusion.

[0091] S52, perform statistical uniformity processing on the Stage 1 repair signal, adjust its mean and standard deviation to be consistent with the statistical characteristics of the current window signal, and obtain the Stage 2 repair signal.

[0092] Phase 2 uses the "old local mean and standard deviation" to standardize the signal repaired in Phase 1, and then uses the "current latest local mean and standard deviation" to destandardize it, so as to align the amplitude and center of the signal with the current window signal and achieve statistical consistency.

[0093] Phase 2 repair signals are represented as follows: ; Among them, the old local mean and standard deviation Represents the mean and standard deviation of the original data of the t-th window signal; the current new local mean. with standard deviation This represents the mean and standard deviation of the repaired data in the t-th window phase 1; This represents the numerical stability constant.

[0094] S53. Search for the most similar set of reference segments in the historical normal segment library, perform a weighted average on each reference segment, and then fuse it with the Stage 2 repair signal in proportion to obtain the Stage 3 repair signal. The Stage 3 repair signal is then used as the repaired window signal.

[0095] In stage 3, correction is performed through similar normal segment retrieval. The stage 2 repair signal is used as the query vector to retrieve the closest set of reference segments from the historical normal segment database. Here, the cosine similarity between the query vector and each set of reference segments is calculated, and a set similarity threshold is used to determine the closest set of reference segments.

[0096] Then, a weighted average is calculated for the values ​​corresponding to the anomalies in each reference segment. The weight of each reference segment is obtained by normalizing the distance or similarity. In this embodiment, the weight of each reference segment is represented as follows: ; in, This represents the weight of the k-th reference segment. This represents the distance (e.g., Mahalanobis distance) between the stage 2 repair signal and the k-th reference fragment, where K represents the size of the selected similar reference fragment library. This represents the signal of the k-th reference segment. This represents the temperature coefficient.

[0097] Therefore, the Stage 3 repair signal is represented as: ; in, The trade-off between generation repair and retrieval correction is controlled.

[0098] The repair confidence level is expressed as: ; in, Represents the numerical stability constant; The actual value of the t-th window.

[0099] Then, the multi-view fusion anomaly score is re-acquired for the repaired window signal, the window anomalies are re-detected, and the final abnormal window is determined.

[0100] To achieve edge-cloud collaboration and version management: a minimum summary (time interval, channel list, score distribution statistics, repair quantity percentage, drift signal, and current model version) is periodically reported to the cloud; the cloud aggregates multi-node data for offline retraining to obtain a new model and step / quantization strategy, packages and signs it before distribution; the edge gateway verifies the signature before hot-replacing, while retaining at least one old version for quick rollback.

[0101] To ensure performance, reliability, and security degradation: Integer or half-precision quantization, batch noise operations, and circular buffers are used to reduce latency and memory fragmentation; background monitoring of inference time, memory usage, and anomaly trigger frequency—if limits are continuously exceeded, automatic degradation to the minimum perspective (only retaining the final reconstruction difference between teacher and student) is implemented; if the denoising process is abnormal (such as the appearance of invalid values), it immediately reverts to the "replay of the most recent normal segment + simple statistical interpolation" strategy; at the same time, the input range and rate are limited to avoid resource exhaustion caused by abnormal sensors or attacks, and detailed repair and degradation logs are recorded for auditing.

[0102] Example 2

[0103] This embodiment provides a system for implementing the time-series data anomaly detection method based on industrial edge devices provided in Embodiment 1.

[0104] The time-series data anomaly detection system based on industrial edge devices provided in this embodiment includes: The directional noise generation and diffusion module is used to generate adaptive directional noise and diffuse the normal window signal and the signal to be detected window. The signal reconstruction module is used to reconstruct normal window signals without abnormalities using the teacher model, and to reconstruct normal window signals after abnormality removal using the student model. The multi-view anomaly scoring fusion module constructs a multi-view fused anomaly score based on the reconstructed normal window signal without anomalies and the normal window signal after anomaly removal. The anomaly detection module is used to detect anomalies in time-series data based on multi-perspective fusion anomaly scores.

[0105] The directional noise generation and diffusion module described above operates according to step S1 given earlier. The signal reconstruction module described above operates according to step S2 given earlier. The multi-view anomaly scoring and fusion module described above operates according to step S3 given earlier. The anomaly detection module described above operates according to step S4 given earlier.

[0106] In one possible implementation, the aforementioned time-series data anomaly detection system based on industrial edge devices further includes: The signal repair module is used to repair window signals that are determined to be abnormal; the repaired window signals are re-acquired with multi-view fusion anomaly scores, and window anomalies are re-detected.

[0107] The signal repair module is used to perform the operation according to step S5.

[0108] The aforementioned time-series data anomaly detection system based on industrial edge devices can be deployed on any industrial edge device that involves time-series data.

[0109] Key hyperparameter recommendations: number of diffusion steps Take 10-100; Control the switching between local and global weights; The initial ratio is 1:2:0.5; Equal weighting or verified optimization; Take a value of 1.0–2.5; Use a value between 0.01 and 0.1; select the window length based on the data periodicity (64 / 128 / 256); normalization is recommended to be z-score or MAD; if necessary, truncate the gradient to prevent diffusion and instability in the early stages of training.

[0110] When training the student model and the teacher model, the parameters of the student model and the teacher model are optimized separately by the Adam optimizer according to the joint optimization loss until the corresponding model converges (such as when it is less than the set loss threshold or when the number of training iterations is reached).

[0111] Experimental Example

[0112] To verify the effectiveness of the method of the present invention in the detection and repair of anomalies in equipment timing data, the following provides a comparative experimental design, index definition, result summary and analysis on typical public and industrial datasets.

[0113] (I) Dataset Description

[0114] Data sets from different fields, dimensions, and abnormal forms were selected for comprehensive evaluation: (1) PSM (Server Pool Metric, multi-host resource utilization); (2) SMD (Server Machine Dataset, multi-node multi-dimensional resource sequence); (3) MSL (NASA Mars Lab telemetry, including multiple types of sensors); (4) MIT-B (Electrocardiogram signal, including multiple types of heartbeat patterns); (5) SWaT (High-dimensional SCADA sensor data of industrial water treatment process). Data statistics examples are shown in Table 1.

[0115] Table 1. Dataset Statistics Overview

[0116]

[0117] (II) Definition of Evaluation Indicators

[0118] This experiment uses only the F1 score as the evaluation metric. F1 is the harmonic mean of precision and recall: F1 = 2PR / (P+R). In various anomaly patterns and class imbalance (anomaly sparsity) scenarios, F1 can comprehensively reflect the balance between detection rate and false alarm control. To avoid interference from complex metrics, this specification concisely lists only the F1 results of each method on different datasets.

[0119] (III) Test performance results

[0120] Table 2. F1 scores of each method on different datasets

[0121]

[0122] The term "unsupervised" in this invention refers to the fact that tags are not used in the method of this invention.

[0123] The supervision in this invention refers to the use of tags in the method of this invention.

[0124] As shown in Table 2, the method of this invention achieves the best or second-best F1 score in this column on five heterogeneous datasets (server resources, cross-machine multidimensional indicators, aerospace telemetry, physiological ECG, and industrial process SCADA). The average F1 scores of the supervised (Ours-Super) and unsupervised (Ours-Unsup) versions of this invention are 78.91 and 78.73, respectively, representing an overall improvement of approximately 2.6 to 2.8 percentage points compared to the current best baseline D3R (76.29). The improvement is not concentrated on a single dataset, but maintains consistency across high-dimensional complexity (SWaT), multi-sensor noise (MSL), periodic and morphological mixtures (PSM, SMD), and low-dimensional physiological patterns (MIT-BIH). The difference between the two versions is <0.2. Further, even in the absence of labels, the architecture of this invention can create discriminative representations that approach the performance of supervised optimization, providing a directly usable unsupervised path for industrial and operational scenarios where labels are scarce.

[0125] In summary, the performance advantages of this invention stem from three types of collaborative mechanisms: (1) Directional contraction noise weakens the overlap between anomalies and normals under similar variance conditions in the early stage of positive diffusion, alleviating the missed detection of "smoothly gradual anomalies" and "periodic distortions" by traditional isotropic noise or reconstruction models; (2) Teacher-student dual-track and step-by-step anomaly sub-component stripping allows the anomaly energy to be extracted layer by layer, and finally the reconstruction difference + intermediate layer difference + student residual provide complementary evidence from three perspectives, reducing the risk of single-perspective failure; (3) Feature distillation and intermediate step selection suppress overfitting and drift amplification, so that it can maintain a stable lead in scenarios where prediction methods are prone to fluctuations with concept drift and pure reconstruction methods have insufficient anomaly discrimination. Especially on datasets containing multiple types of composite perturbations such as MSL and SWAT, this invention achieves higher and smoother F1 performance through explicit modeling of "anomalies as removable noise". The results show that the present invention achieves cross-domain generalization and robust gain through a noise-denoising-scoring closed-loop design without the need to introduce an additional complex multi-task discriminator, and provides a high-quality detection prerequisite for edge clipping and subsequent online repair closed loop.

[0126] A brief description of the comparative experimental methods in the table is as follows:

[0127] LSTM prediction baseline: Based on a Long Short-Term Memory (LSTM) network, predictions are made for several subsequent time steps within a window, and the prediction residuals (or the cumulative residual statistics across multiple steps) are used as anomaly scores. This approach is simple and intuitive, and can capture some sequential dependencies; however, its drawbacks include the potential for confusion between prediction errors and anomalous residuals when dealing with concept drift, non-stationary periodic overlap, and complex multivariate interactions, and insufficient sensitivity to slowly evolving anomalies. The implementation process is referenced in the following literature: [Hundman K. et al. Detecting Spacecraft Anomalies Using LSTMs and Nonparametric Dynamic Thresholding. KDD, 2018] and [Malhotra P. et al. LSTM-based Encoder-Decoder for Multi-Sensor Anomaly Detection. CoRR, 2016].

[0128] The Timer model is a prediction baseline based on time structure modeling (representing a class of time series predictors utilizing convolutional / attention or decomposition structures). It estimates future steps by separating trend, seasonal / periodic, and residual structures, mapping prediction errors to anomaly scores. Its advantage lies in integrating multiple frequency components into the model; its disadvantage is decreased discriminative power when encountering complex anomalies (trend abrupt changes + high-frequency perturbations) or when anomalies can be absorbed by smoothing predictors. Its implementation process is referenced in [Liu Y. et al. TiMER: Generative Pre-trained Transformers Are Large Time Series Models. ICML, 2024].

[0129] The OmniAnomaly model is a sequence reconstruction probabilistic model that incorporates stochastic variational inference (VAE) and stochastic layers (such as channel attention or random masks) to enhance the representation of diversity, scoring the reconstruction probability (or ELBO correlation components). It exhibits some robustness to irregular patterns, but has limited differences in reconstruction probability across similarity variance / gradual anomalies. Its implementation can be found in the reference [Su Y. et al. Robust Anomaly Detection for Multivariate TimeSeries through Stochastic RNN. KDD, 2019].

[0130] The ATransformer (Anomaly Transformer) model: This method uses "Association Discrepancy" to measure the deviation between the attention dependency and prior dependency patterns at the current time point, thus serving as evidence of anomalies; it can highlight anomalies that disrupt the temporal association structure. It is sensitive to local structural abrupt changes, but has limited gain on amplitude-type or slowly drifting anomalies. Its implementation process is described in the reference [Xu M. et al. Anomaly Transformer: TimeSeries Anomaly Detection with Association Discrepancy. ICLR, 2022].

[0131] The TADNet model is a multi-scale temporal convolutional / attention fusion reconstruction or prediction hybrid network (a concept similar to Time-series Anomaly Detection Networks). It captures different receptive field structures through parallel or hierarchical convolutions and combines residual reconstruction or prediction residuals to determine anomalies. It is more robust to multi-scale composite anomalies than single-scale methods, but may still be affected by anomaly "reconstruction" due to isotropic modeling. Its implementation process is referenced in [Tuli S. et al. TranAD: Deep Transformer Networks for Anomaly Detection in Multivariate TimeSeries. VLDB J., 2022].

[0132] The D3R model is a representative diffusion / reconstruction enhancement framework (which can be understood as diffusion-based reconstruction & refinement). It utilizes standard isotropic diffusion noise and inverse denoising to reconstruct normal morphology, and then uses the reconstruction residuals or multi-step residual aggregation for scoring. Compared with traditional reconstruction, it improves the simulation of complex distributions, but isotropic noise does not explicitly distinguish the direction of anomalies, resulting in insufficient contrast of anomaly residuals. Its implementation process is referenced in [Wang C. et al. Drift Doesn't Matter: Dynamic Decomposition with Diffusion Reconstruction for Unstable MTS Anomaly Detection. NeurIPS, 2023].

[0133] The ImDiffusion model is an anomaly detection baseline based on the "masking-diffusion-inpainting" approach. It estimates normal values ​​through random masking and diffusion-based denoising inpainting, then compares the inpainted values ​​with the original values. It emphasizes local loss recovery and is effective when anomalies are presented as short local fragments; however, it is weaker for global variability or statistically drifting anomalies. Its implementation can be found in the reference [Chen Y. et al. ImDiffusion: Imputed Diffusion Models for MultivariateTime Series Anomaly Detection. PVLDB, 2023].

[0134] The DiffAD model is a diffusion-generative anomaly detection method that uses an isotropic Gaussian noise addition / denoising strategy to learn the normal data distribution and uses the deviation of the denoised reconstruction or noise estimation as the anomaly score. Compared with GAN / VAE, it has more stable training characteristics, but is still limited by the lack of directionality of noise and single-view residuals. Its implementation process is referenced in [Pintilie I. et al. Time Series Anomaly Detection Using Diffusion-based Models. ICDM, 2023].

[0135] In summary, the "adaptive directional noise + teacher-student collaborative diffusion + multi-view fusion scoring" method proposed in this invention provides a systematic solution to the above-mentioned needs. Furthermore, by combining the needs of industrial edge and cloud collaboration, it can further achieve: vii) diffusion step reduction and distillation to maintain discriminative power; viii) local threshold and drift adaptive monitoring; ix) rapid closed loop and minimum upload for anomaly detection-masking-repair, while taking into account privacy protection; x) security degradation and version management to ensure continuous system operation.

[0136] Those skilled in the art will recognize that the embodiments described herein are intended to help the reader understand the principles of the invention, and should be understood that the scope of protection of the invention is not limited to such specific statements and embodiments. Those skilled in the art can make various other specific modifications and combinations based on the technical teachings disclosed in this invention without departing from the spirit of the invention, and these modifications and combinations are still within the scope of protection of this invention.

Claims

1. A method for detecting anomalies in time-series data based on industrial edge devices, characterized in that, Includes the following steps: S1 generates adaptive directional noise and diffuses the normal window signal and the signal to be detected window; S2 reconstructs the normal window signal without abnormalities using the teacher model; and reconstructs the normal window signal after abnormality removal using the student model. S3. Based on the reconstructed normal window signal without anomalies and the normal window signal after anomaly stripping, a multi-view fusion anomaly score is constructed. S4 detects anomalies in time-series data based on multi-perspective fusion anomaly scoring.

2. The method for detecting time-series data anomalies based on industrial edge devices according to claim 1, characterized in that, Step S1 includes the following sub-steps: S11, Based on the local statistics of the signal in the window to be detected and the global statistics of the original signal, obtain the mixed statistics of the signal in the window to be detected; S12, construct intermediate variables based on the mixed statistics of the signals in the window to be detected, and generate directional noise based on the intermediate variables; S13, based on the directional noise, obtain the forward diffusion signal corresponding to the signal of the window to be detected; S14: Based on the isotropic noise, obtain the diffusion signal corresponding to the reference normal window.

3. The method for detecting time-series data anomalies based on industrial edge devices according to claim 2, characterized in that, In step S11, the first The statistical representation of the mixed signals of the window is as follows: ； ； in, , They represent the first Estimate the mean and standard deviation of the diffusion at the q-th window and the q-th step; , They represent the first Local mean and local standard deviation of the signal in each window; , These represent the global mean and global standard deviation of the original signal, respectively. This represents the weighted scheduling function for the q-th diffusion step. , Controlling kurtosis, Indicates the relative proportion at the center. Indicates the total number of diffusion steps; In step S12, standard Gaussian noise is sampled. Building intermediate variables : ； Using symbolic functions Element-wise direction is given, resulting in directional noise: ； in, Represents the absolute value of each element; This represents Hadamard multiplication; Indicates the first The original signal of the window, where d represents the number of channels and m represents the window length; In step S13, to be applicable to the student model, the forward diffusion signal corresponding to the window signal is obtained. Represented as: ； in, This represents the cumulative retention coefficient during the diffusion process. ;in, Represents the noise scheduling parameters for the u-th diffusion step; In step S14, in order to be applicable to the teacher model, the diffusion signal corresponding to the reference normal window is obtained. Represented as: ； in, Indicates isotropic noise; Indicates the first A normal reference window.

4. The method for detecting time-series data anomalies based on industrial edge devices according to claim 2, characterized in that, Step S2 includes the following sub-steps: S21, Based on the normal window signal diffusion results, the normal window signal without abnormalities is reconstructed using the teacher model; S22, based on the signal diffusion results of the window to be detected, the normal window signal after abnormal stripping is reconstructed using the student model.

5. The method for detecting time-series data anomalies based on industrial edge devices according to claim 4, characterized in that, In step S21, the teacher model by Input and output noise estimation ,Right now ; The normal window signal without abnormalities is then estimated using the teacher model as follows: ； in, This indicates that the teacher model directly estimates the signal morphology of the window without anomalies based on the diffusion signal corresponding to the normal window in step q. In step S22, the normal window signal after anomaly stripping is estimated using the student model as follows: ； in, The student model is represented by This is used for noise and anomaly estimation of the input.

6. The method for detecting time-series data anomalies based on industrial edge devices according to claim 3, characterized in that, In step S3, the multi-view fusion anomaly score includes the teacher-student final reconstruction difference, the teacher-student intermediate step feature difference, and the student residual.

7. The method for detecting time-series data anomalies based on industrial edge devices according to claim 6, characterized in that, The final reconstruction difference between teachers and students is expressed as: ； in, , These represent the estimation of the normal window signal without abnormalities and the normal window signal after abnormality removal, respectively. Differences in step characteristics between teachers and students, and selection of step set Weight , is represented as: ； Student residuals are represented as follows: ； The multi-view fusion anomaly score is represented as follows: ； in, , represents the weight parameter, .

8. The method for detecting time-series data anomalies based on industrial edge devices according to claim 1, characterized in that, In step S4, a scoring threshold and a drift index are set. When the drift index is greater than the set index, the scoring threshold is automatically adjusted. Otherwise, the scoring threshold remains unchanged. Then, the multi-view fusion abnormal score is compared with the scoring threshold. When the multi-view fusion abnormal score is greater than the scoring threshold, it is determined to be a window abnormality.

9. The method for detecting time-series data anomalies based on industrial edge devices according to claim 8, characterized in that, Estimating the mean of multi-view fusion anomaly scores on the calibration set With variance Set an initial threshold. : ； in, Indicates the control alert level; Define drift index : ； in, It is the numerical stability constant; The mean and variance of the multi-view fusion anomaly scores obtained from recent "candidate normal" buffer statistics are as follows. As a historical baseline; To set indicators; if If the threshold is not re-estimated, the scoring threshold will be re-estimated; otherwise, the scoring threshold will remain unchanged. During the online phase, use a smoothing coefficient. Update the rating threshold: ； in, , Let represent the scoring thresholds for the t-th window and the (t+1)-th window, respectively.

10. The method for detecting time-series data anomalies based on industrial edge devices according to any one of claims 1 to 9, characterized in that, Also includes: S5 repairs window signals that are determined to be abnormal.

11. The method for detecting time-series data anomalies based on industrial edge devices according to claim 10, characterized in that, Step S5 includes the following sub-steps: S51, using the student model back-diffusion reconstruction signal as the stage 1 repair signal; S52, Perform statistical uniformization processing on the Stage 1 repair signal to obtain the Stage 2 repair signal; S53. Search for the most similar set of reference segments in the historical normal segment library, perform a weighted average on each reference segment, and then fuse it with the Stage 2 repair signal in proportion to obtain the Stage 3 repair signal. The Stage 3 repair signal is then used as the repaired window signal.

12. A time-series data anomaly detection system based on industrial edge devices, characterized in that, For implementing the method of any one of claims 1 to 11, the system comprises: The directional noise generation and diffusion module is used to generate adaptive directional noise and diffuse the normal window signal and the signal to be detected window. The signal reconstruction module is used to reconstruct normal window signals without abnormalities using the teacher model, and to reconstruct normal window signals after abnormality removal using the student model. The multi-view anomaly scoring fusion module constructs a multi-view fused anomaly score based on the reconstructed normal window signal without anomalies and the normal window signal after anomaly removal. The anomaly detection module is used to detect anomalies in time-series data based on multi-perspective fusion anomaly scores.

13. The time-series data anomaly detection system based on industrial edge devices according to claim 12, characterized in that, Also includes: The signal repair module is used to repair window signals that are determined to be abnormal.

Images