A method, system, device, and medium for sensor intelligent anomaly detection

Abstract

The application provides a sensor intelligent anomaly detection method, system, device and medium, relates to the field of industrial automation and intelligent operation and maintenance, and comprises the following steps: collecting real-time data of a plurality of industrial sensors at an edge device end and preprocessing, predicting each kind of real-time data through a corresponding prediction model, and calculating a residual; calculating a dynamic threshold value in a preset sliding window, performing health evaluation on the residual and the dynamic threshold value, and obtaining a state label; in response to detecting a distribution change of the real-time data, performing online learning and adaptive updating on the prediction model in the cloud, calculating a new residual, updating the state label based on the new residual; and performing early warning according to the state label. Through the introduction of the sliding window residual statistics, the adaptive threshold value determination and the online learning and updating mechanism, the application realizes dynamic identification and predictive maintenance of sensor anomalies. Meanwhile, combined with edge computing, low-delay real-time detection can be realized in an industrial field.

Description

Technical Field

[0001] This invention relates to the field of industrial automation and intelligent operation and maintenance technology, specifically to a method, system, device and medium for intelligent anomaly detection of sensors. Background Technology

[0002] In modern industrial production systems, sensors for temperature, pressure, current, voltage, flow, vibration, and other parameters form the neural network of the production process. The accuracy of the data they collect directly affects equipment control and safe operation. However, during long-term operation, sensors are often affected by environmental interference, device aging, and circuit losses, leading to signal drift, accumulated deviations, or failure, which can pose hidden dangers to the system.

[0003] Existing anomaly detection methods mainly fall into the following categories:

[0004] Fixed threshold method: Upper and lower limits are set based on experience, and the output is judged as abnormal when it exceeds the limit. This method is simple, but it is not sensitive to environmental changes and is prone to false alarms or false negatives.

[0005] Statistical analysis: Based on the characteristics of data distribution (such as mean and variance), outliers are identified. It is suitable for stable operating conditions, but performs poorly in dynamic and multivariate environments.

[0006] Machine learning methods, such as SVM, PCA, and random forest, identify anomalies by learning the features of normal samples, but the models are static and rely on offline training, lacking adaptability.

[0007] Deep learning methods: These methods utilize prediction models such as LSTM, GRU, and Transformer to model time-series data and identify anomalies through prediction errors, achieving high detection accuracy. However, most of these approaches suffer from two major drawbacks:

[0008] The threshold setting remains static, making it difficult to adapt to changes in system state.

[0009] The model parameters are fixed and it is difficult to update them automatically as the equipment ages or the operating conditions change.

[0010] Sensor data often contains a large amount of redundant information, and noise interference makes it difficult to distinguish between normal and abnormal data. The monitored physical processes change over time, and normal data patterns also need to be dynamically updated. High false alarm rates increase the system burden, while high false negative rates lead to anomalies not being handled in a timely manner. Industrial production has extremely high requirements for detection speed, requiring millisecond-level response to avoid losses. Traditional algorithms may not be able to meet real-time requirements due to computational complexity, while lightweight models sacrifice accuracy. When there are differences between training data and actual application scenarios, model performance degrades, making it difficult to trigger preventative maintenance quickly and easily. Summary of the Invention

[0011] This invention addresses the problems existing in the prior art by providing a method, system, device, and medium for intelligent anomaly detection using sensors. It enables intelligent anomaly detection that combines prediction and residual analysis, dynamically adjusts thresholds, learns and updates online, and can be deployed in real time at the edge.

[0012] To achieve the above objectives, the technical solution adopted by the present invention is as follows:

[0013] Real-time data from several industrial sensors is collected and preprocessed at the edge device. Each type of real-time data is then predicted using the corresponding prediction model, and the residual is calculated.

[0014] Calculate a dynamic threshold within a preset sliding window, and perform a health assessment on the residual and the dynamic threshold to obtain a status label;

[0015] In response to the detection of changes in the distribution of real-time data, the prediction model is learned and adaptively updated online in the cloud to calculate new residuals and update the state labels based on the new residuals.

[0016] Warnings are issued based on status labels.

[0017] In some embodiments, the step of calculating the dynamic threshold within a preset sliding window includes:

[0018] Obtain the historical residual mean distribution;

[0019] Calculate the mean of the residuals and the current variance within a preset sliding window;

[0020] The dynamic adjustment factor is calculated based on the rate of change of the system's operating status.

[0021] The dynamic threshold is obtained based on the historical residual mean distribution, the dynamic adjustment factor, and the current variance.

[0022] In some embodiments, the step of performing a health assessment on the residual and the dynamic threshold to obtain a status label includes:

[0023] Calculate the number of times the residual mean exceeds the dynamic threshold, and assign risk weights to the residual mean and rate of change;

[0024] By reasoning through a Bayesian network, the posterior probability of the state is calculated, and the highest probability is selected as the initial state label.

[0025] The initial state labels are smoothed and optimized to obtain the final state labels.

[0026] In some embodiments, the dynamic threshold The formula is:

[0027]

[0028] in, The historical residual mean; The current sliding window residual standard deviation; k is the sensitivity adjustment coefficient; This is a dynamically adjusted factor.

[0029] In some embodiments, the step of performing online learning and adaptive updates of the prediction model in the cloud in response to detecting a change in the distribution of real-time data includes:

[0030] In response to the detection of changes in the distribution of real-time data, the prediction model is trained online in the cloud through small-batch incremental training to update the prediction model parameters;

[0031] Verify performance before and after the update. If performance degrades after the update, generate a rollback flag and roll back to the old version.

[0032] In some embodiments, the step of acquiring and preprocessing real-time data from several industrial sensors at the edge device includes:

[0033] At the edge nodes of the edge devices, real-time data is collected from several industrial sensors every second.

[0034] Remove invalid and outlier values ​​from real-time data and repair missing data;

[0035] Normalization and feature extraction are performed to obtain the time series training dataset.

[0036] In some embodiments, the step of predicting each type of real-time data using a corresponding prediction model and calculating the residual includes:

[0037] Select the appropriate time series prediction model based on the data characteristics of different sensors;

[0038] The predicted value corresponding to the real-time data is calculated by the model, and the residual is obtained by comparing it with the actual value.

[0039] This invention proposes a sensor-based intelligent anomaly detection system, comprising:

[0040] The acquisition unit is configured to acquire and preprocess real-time data from several industrial sensors at the edge device, and to predict and calculate the residual for each type of real-time data using the corresponding prediction model.

[0041] The evaluation unit is configured to calculate a dynamic threshold within a preset sliding window, perform a health assessment on the residual and the dynamic threshold, and obtain a status label.

[0042] The update unit is configured to perform online learning and adaptive updates on the prediction model in the cloud in response to the detection of changes in the distribution of real-time data, calculate new residuals, and update the state labels based on the new residuals.

[0043] The early warning unit is configured to issue early warnings based on status tags.

[0044] This invention proposes a computer device, comprising:

[0045] At least one processor; and a memory storing a computer program executable on the processor, wherein the processor, when executing the program, performs the steps of the method for intelligent anomaly detection of a sensor.

[0046] The present invention proposes a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the steps of the method for intelligent anomaly detection of a sensor.

[0047] Compared with the prior art, the present invention has the following beneficial effects:

[0048] This invention proposes a method, system, device, and medium for intelligent anomaly detection of sensors. The method includes: collecting and preprocessing real-time data from several industrial sensors at an edge device; predicting each type of real-time data using a corresponding prediction model and calculating residuals; calculating a dynamic threshold within a preset sliding window; performing a health assessment on the residuals and the dynamic thresholds to obtain a status label; responding to the detection of changes in the distribution of real-time data, performing online learning and adaptive updates of the prediction model in the cloud to calculate new residuals; updating the status label based on the new residuals; and issuing an early warning based on the status label.

[0049] This invention achieves dynamic identification and predictive maintenance of sensor anomalies by introducing sliding window residual statistics, adaptive threshold determination, and an online learning update mechanism. Simultaneously, combined with edge computing, it enables low-latency real-time detection in industrial settings. The combination of sliding window and dynamic threshold significantly reduces false alarms and missed alarms; the fusion of predictive models and residual analysis enables multi-level health status identification; the online learning mechanism allows the model to automatically evolve with the operating state; and edge computing deployment ensures low-latency fault response; it is compatible with multiple models and sensor types and is easily expandable. The dynamic threshold calculation method comprehensively considers historical statistical characteristics and system operating status, achieving an intelligent evolution from static thresholds to data-driven thresholds to state-adaptive thresholds, significantly improving detection stability and environmental adaptability. Attached Figure Description

[0050] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other embodiments can be obtained based on these drawings without creative effort.

[0051] Figure 1 The present invention provides a flowchart of a method for intelligent anomaly detection using sensors.

[0052] Figure 2 This invention provides a system module diagram for intelligent anomaly detection using sensors.

[0053] Figure 3 A schematic diagram of the structure of an embodiment of the computer device provided by the present invention.

[0054] Figure 4 This is a schematic diagram of an embodiment of the computer-readable storage medium provided by the present invention. Detailed Implementation

[0055] The present invention will be further described below with reference to the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solutions of the present invention and should not be construed as limiting the scope of protection of the present invention. It should be noted that the following detailed descriptions are exemplary and intended to provide further explanation of this application.

[0056] It should be noted that all uses of "first" and "second" in the embodiments of the present invention are for the purpose of distinguishing two entities with the same name but different names or different parameters. It is clear that "first" and "second" are only for the convenience of description and should not be construed as limiting the embodiments of the present invention. Subsequent embodiments will not explain this in detail.

[0057] This invention proposes a method for intelligent anomaly detection using sensors. Please refer to [link / reference]. Figure 1 ,include:

[0058] S1. Collect and preprocess real-time data from several industrial sensors at the edge device, and predict and calculate the residual for each type of real-time data using the corresponding prediction model.

[0059] S2. Calculate the dynamic threshold within a preset sliding window, and perform a health assessment on the residual and the dynamic threshold to obtain a status label;

[0060] S3. In response to the detection of changes in the distribution of real-time data, the prediction model is learned and updated online in the cloud to calculate new residuals and update the state labels based on the new residuals.

[0061] S4. Issue warnings based on status labels.

[0062] Data acquisition, preprocessing, and preliminary prediction are completed at the edge devices, avoiding the transmission of massive amounts of raw data to the cloud and reducing network bandwidth consumption and transmission latency. Sensor data on the factory production line can be processed locally in real time without waiting for a response from the cloud.

[0063] Calculating dynamic thresholds using a sliding window, rather than relying on fixed thresholds, allows for adaptation to the time-varying characteristics of industrial data. The normal range of the temperature sensor changes with ambient temperature, and the dynamic threshold automatically adjusts, reducing false alarms. Using the residual between predicted and actual values ​​as an anomaly indicator provides more sensitive detection of subtle anomalies compared to directly analyzing raw data. Combined with dynamic thresholds, it accurately distinguishes between normal fluctuations and genuine faults.

[0064] When a change in data distribution is detected, the cloud automatically triggers online learning of the prediction model without human intervention, and the model performance improves over time.

[0065] In some embodiments, please refer to Figure 1 The step of calculating the dynamic threshold within a preset sliding window includes:

[0066] Obtain the historical residual mean distribution;

[0067] Calculate the mean of the residuals and the current variance within a preset sliding window;

[0068] The dynamic adjustment factor is calculated based on the rate of change of the system's operating status.

[0069] The dynamic threshold is obtained based on the historical residual mean distribution, the dynamic adjustment factor, and the current variance.

[0070] The historical residual mean distribution reflects the normal fluctuation range of the system during long-term operation, providing a basic reference for setting dynamic thresholds. Calculating the mean and variance of the current residuals using a sliding window allows for real-time reflection of the system's short-term operating status. When equipment load suddenly increases, the residual variance expands; sliding window statistics can quickly capture this change, avoiding misjudgments caused by the lag in global historical data. Through local averaging and variance calculations, the sliding window can smooth out short-term noise while retaining sensitivity to genuine anomalies.

[0071] The dynamic adjustment factor is calculated based on the rate of change of the system's operating status, so that the threshold can actively adapt to sudden changes in operating conditions.

[0072] In some embodiments, please refer to Figure 1 The step of performing a health assessment on the residual and the dynamic threshold to obtain a status label includes:

[0073] Calculate the number of times the residual mean exceeds the dynamic threshold, and assign risk weights to the residual mean and rate of change;

[0074] By reasoning through a Bayesian network, the posterior probability of the state is calculated, and the highest probability is selected as the initial state label.

[0075] The initial state labels are smoothed and optimized to obtain the final state labels.

[0076] The residual mean, rate of change, and number of consecutive exceedances are comprehensively input into the health assessment module, which outputs a status label.

[0077] Normal; Warning; Fault.

[0078] It can be combined with fuzzy logic or Bayesian networks to achieve multi-level state reasoning and support predictive maintenance decisions.

[0079] The frequency with which the mean of the statistical residual exceeds the dynamic threshold quantifies the persistence and severity of the anomaly. Brief exceedances are caused by noise, while multiple consecutive exceedances correspond to real faults.

[0080] Bayesian networks quantify the association between various indicators and states using conditional probability tables (CPTs), enabling them to handle uncertainties in industrial scenarios. When the residual mean slightly exceeds limits, if the rate of change is low and the number of exceedances is infrequent, the Bayesian network can infer a higher probability of a potential anomaly rather than directly classifying it as a fault. This multi-level state division from normal to fault triggers preventative maintenance, rather than waiting for a fault to occur.

[0081] By analyzing the time series of initial status tags, tag jumps caused by transient interference are filtered out. Brief sensor noise may trigger a single warning tag; after smoothing, the tag can maintain a normal state, avoiding false alarms.

[0082] In some embodiments, please refer to Figure 1 The dynamic threshold The formula is:

[0083]

[0084] in, The historical residual mean; The current sliding window residual standard deviation; k is the sensitivity adjustment coefficient; This is a dynamically adjusted factor.

[0085] Set the sliding window length N, and calculate the mean and variance of the residuals within the window in real time:

[0086]

[0087]

[0088] The historical residual mean is the average value of the residuals during the long-term stable operation of the system. It reflects the baseline deviation under normal operating conditions and distinguishes between real anomalies and short-term fluctuations.

[0089] The standard deviation of the current residual distribution, calculated using a sliding window, reflects short-term data volatility. It captures the impact of sudden changes in operating conditions on residual volatility. As a quantitative indicator of volatility, it provides a statistical basis for dynamic thresholds. When the standard deviation is large, the threshold needs to be more lenient to accommodate normal fluctuations.

[0090] The sensitivity adjustment coefficient is a constant set manually or automatically, used to adjust the sensitivity of the dynamic threshold to residual fluctuations.

[0091] The dynamic adjustment factor is a real-time adjustment coefficient calculated based on the rate of change of system operating conditions (such as speed and temperature gradient). It reflects the impact of operating conditions on the threshold and dynamically amplifies or narrows the threshold range. Traditional fixed thresholds may fail when operating conditions change, but by sensing the system status in real time, it ensures that the threshold always matches the current operating conditions.

[0092] In some embodiments, please refer to Figure 1 The step of online learning and adaptive updating of the prediction model in the cloud in response to the detection of changes in the distribution of real-time data includes:

[0093] In response to the detection of changes in the distribution of real-time data, the prediction model is trained online in the cloud through small-batch incremental training to update the prediction model parameters;

[0094] Verify performance before and after the update. If performance degrades after the update, generate a rollback flag and roll back to the old version.

[0095] When the system detects changes in data distribution and a long-term shift in the residual mean, it automatically triggers the online learning module. Through mini-batch incremental training or transfer learning methods, the model parameters θ are updated using new data to ensure that prediction accuracy remains stable over time.

[0096] This module supports lightweight implementation, making it suitable for embedding in edge devices. Parameters are dynamically adjusted according to data distribution, eliminating the need for manual model retraining. The system automatically adapts to new operating conditions, reducing operational costs.

[0097] In some embodiments, please refer to Figure 1 The step of collecting and preprocessing real-time data from several industrial sensors at the edge device includes:

[0098] At the edge nodes of the edge devices, real-time data is collected from several industrial sensors every second.

[0099] Remove invalid and outlier values ​​from real-time data and repair missing data;

[0100] Normalization and feature extraction are performed to obtain the time series training dataset.

[0101] Historical and real-time data from various types of sensors in industrial automation control systems are collected, including temperature, pressure, current, voltage, flow rate, and vibration. Data cleaning and outlier handling are performed, including:

[0102] Invalid records and null values ​​were removed; missing data were repaired using moving average, linear interpolation, or K-nearest neighbor interpolation; obvious outliers were removed using box plots or Z-scores; after preprocessing, a time series training dataset D was generated. train .

[0103] To avoid numerical bias between different units, normalization or standardization methods are used to map the data to a unified interval, such as min-max standardization.

[0104]

[0105] Features are constructed based on sensor type, such as moving average, rate of change, first-order difference, and periodic features, to enhance the model's ability to capture temporal dynamics.

[0106] Edge devices collect data every second from industrial sensors such as temperature, pressure, current, and vibration, supporting multi-type, high-frequency real-time sensing. Edge nodes process data locally, avoiding cloud transmission delays and meeting the real-time requirements of industrial control.

[0107] In some embodiments, please refer to Figure 1 The step of predicting each type of real-time data using the corresponding prediction model and calculating the residual includes:

[0108] Select the appropriate time series prediction model based on the data characteristics of different sensors;

[0109] The predicted value corresponding to the real-time data is calculated by the model, and the residual is obtained by comparing it with the actual value.

[0110] Choose an appropriate time series forecasting model based on the data characteristics of different sensors. The model could be:

[0111] Deep learning models: LSTM, GRU, Transformer, etc.;

[0112] Traditional machine learning models include XGBoost, SVR, and random forests.

[0113] The model is obtained through training. Enter historical window data X t Output predicted value :

[0114]

[0115] Model training can employ a sliding window strategy and cross-validation to improve generalization ability.

[0116] Real-time input of current sensor data X t Calculate the predicted value through the model and the actual value The residuals are obtained by comparison:

[0117]

[0118] Residual sequence r t As a basic indicator for anomaly analysis.

[0119] This invention proposes a system for intelligent anomaly detection using sensors. Please refer to [link / reference]. Figure 2 ,include:

[0120] The acquisition unit 100 is configured to acquire and preprocess real-time data from several industrial sensors at the edge device, and to predict and calculate the residual for each type of real-time data using the corresponding prediction model.

[0121] The evaluation unit 200 is configured to calculate a dynamic threshold within a preset sliding window, perform a health assessment on the residual and the dynamic threshold, and obtain a status label.

[0122] The update unit 300 is configured to perform online learning and adaptive updates on the prediction model in the cloud in response to the detection of changes in the distribution of real-time data, calculate new residuals, and update the state labels based on the new residuals.

[0123] The early warning unit 400 is configured to issue early warnings based on status labels.

[0124] Integrate data acquisition, predictive inference, residual analysis and judgment modules into industrial edge computing nodes (such as industrial gateways and embedded hosts).

[0125] The edge is responsible for data preprocessing, real-time detection, and anomaly alerts; the cloud is responsible for long-term storage, model retraining, and policy updates.

[0126] The two communicate via message queue (MQTT) or OPC UA protocol to achieve cloud-edge collaboration.

[0127] This design significantly reduces network latency and improves the real-time performance of on-site detection and system reliability.

[0128] The system consists of three layers:

[0129] Sensing layer: Various types of sensors (temperature, pressure, current, voltage, flow, vibration, etc.) are deployed on-site in the park, with sampling periods ranging from 1s to 60s.

[0130] Edge computing layer: Located at the edge computing nodes of the main control station in the factory area, it has data acquisition, caching, model inference and alarm functions.

[0131] Cloud service layer: used for global data aggregation, long-term model retraining, and policy updates.

[0132] The system achieves highly reliable data exchange through the MQTT protocol and the OPC UA communication standard at each layer.

[0133] System Overall Structure

[0134] The system consists of three layers:

[0135] The perception layer is deployed across various types of sensors (temperature, pressure, current, voltage, flow, vibration, etc.) in the industrial park, with sampling periods ranging from 1 second to 60 seconds. The edge computing layer is located at the edge computing nodes of the main control station in the plant area, providing data acquisition, caching, model inference, and alarm functions. The cloud service layer is used for global data aggregation, long-term model retraining, and policy updates. All layers of the system achieve highly reliable data interaction through the MQTT protocol and the OPC UA communication standard.

[0136] At the edge nodes, the system acquires raw data streams from multiple sensors every second. The data undergoes the following preprocessing:

[0137] Savitzky-Golay filtering was used to remove high-frequency noise, and sliding weighted interpolation was used to repair missing points. Points deviating from the mean by more than three times the standard deviation within three consecutive sampling periods were removed. Min-max normalization was used to unify signals of different dimensions into the [0,1] interval. The mean, variance, gradient, and periodicity were extracted as input feature vectors within the sliding window. Finally, training sample pairs (X) were formed. t ,y t+1 ), where X t It is a multidimensional feature sequence of the past 60 time steps.

[0138] A Transformer encoder model was selected as the time series predictor on the cloud server. The model structure includes:

[0139] The input layer has 8 sensors × 60 time steps; the multi-head attention layer has 4 heads and 128 hidden dimensions; the feedforward layer consists of two fully connected layers with GELU activation function; the output layer is the vector of sensor values ​​predicted for the next time step. .

[0140] The model uses the Adam optimizer with an initial learning rate of 0.001, 100 training epochs, and the loss function is mean squared error (MSE).

[0141] During the training phase, the optimal model parameters are determined through cross-validation. .

[0142] Edge nodes input the latest sensor values ​​into the model every second. In the middle, the prediction results are generated:

[0143]

[0144] Then calculate the residuals:

[0145]

[0146] The residual sequence is cached in real time in a circular buffer for dynamic detection.

[0147] Set the sliding window length N = 30, and update the mean and variance of the window residuals once per second:

[0148]

[0149]

[0150] The dynamic threshold is automatically adjusted based on historical fluctuation characteristics and the current operating status:

[0151]

[0152] in:

[0153] k=2.0, indicating the baseline sensitivity;

[0154] α t It is calculated in real time from system operating status indicators (such as load change rate, ambient temperature fluctuation coefficient, sensor signal-to-noise ratio, etc.);

[0155] When the equipment is in a stable operating phase, α t ≈0; if the load fluctuates frequently, the threshold will be automatically increased to avoid false alarms.

[0156] When the average residual exceeds T within three consecutive time windows t When the sensor is in an abnormal state, the system determines that the sensor is in an abnormal state; if the sensor continues to exceed the threshold for a period of time τ=60s, it is determined to be a fault and an edge alarm is triggered.

[0157] The edge nodes classify the sensor status into three levels based on the residual analysis results:

[0158]

[0159] All state change events are automatically uploaded to the cloud for model retraining and fault log archiving.

[0160] When the system detects data distribution drift, persistently high residuals, or a steadily increasing prediction error, it triggers the online learning mechanism.

[0161] Data filtering extracts valid data from the most recent hour as fine-tuning samples; parameter fine-tuning freezes the first half of the Transformer layers, updating only the output layer weights; learning rate decays, setting the local fine-tuning learning rate to 0.1 times the original; model hot update replaces the model at edge nodes after training is complete, without requiring a system restart. Through this mechanism, the model can continuously adapt to the effects of sensor aging, environmental changes, etc.

[0162] The edge node hardware configuration is as follows:

[0163] CPU: Intel i5 quad-core 3.0GHz;

[0164] Memory: 4GB;

[0165] System: Ubuntu 22.04 + Docker deployment;

[0166] Based on the same inventive concept, according to another aspect of the present invention, such as Figure 3 As shown, an embodiment of the present invention also provides a computer device 30, which includes a processor 310 and a memory 320. The memory 320 stores a computer program 321 that can be run on the processor. When the processor 310 executes the program, it performs the steps of the method described above.

[0167] Based on the same inventive concept, according to another aspect of the present invention, such as Figure 4 As shown, embodiments of the present invention also provide a computer-readable storage medium 40, which stores a computer program 410 that, when executed by a processor, performs the methods described above.

[0168] Embodiments of the present invention may also include a corresponding computer device. The computer device includes a memory, at least one processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes any of the methods described above when executing the program.

[0169] The memory, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer-executable programs, and modules, such as program instructions / modules in the embodiments of this application. The processor executes various functional applications and data processing of the device by running the non-volatile software programs, instructions, and modules stored in the memory, thereby implementing the above-described method.

[0170] The memory may include a program storage area and a data storage area. The program storage area may store the operating system and applications required for at least one function; the data storage area may store data created based on the use of the device. Furthermore, the memory may include high-speed random access memory and non-volatile memory, such as at least one disk storage device, flash memory device, or other non-volatile solid-state storage device. In embodiments, the memory may optionally include memory remotely located relative to the processor, which can be connected to the local module via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0171] Finally, it should be noted that those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the methods described above. The storage medium for the program can be a magnetic disk, optical disk, read-only memory (ROM), or random access memory (RAM), etc. The above computer program embodiments can achieve the same or similar effects as any of the corresponding foregoing method embodiments.

[0172] Those skilled in the art will also understand that the various exemplary logic blocks, modules, circuits, and algorithm steps described in conjunction with the disclosure herein can be implemented as electronic hardware, computer software, or a combination of both. To clearly illustrate this interchangeability between hardware and software, the functionality of various illustrative components, blocks, modules, circuits, and steps has been generally described. Whether this functionality is implemented as software or as hardware depends on the specific application and the design constraints imposed on the system as a whole. Those skilled in the art can implement the functionality in various ways for each specific application, but such implementation decisions should not be construed as departing from the scope of the embodiments disclosed herein.

[0173] The above are exemplary embodiments disclosed in this invention. However, it should be noted that various changes and modifications can be made without departing from the scope of the embodiments of this invention as defined by the claims. The functions, steps, and / or actions of the methods according to the disclosed embodiments described herein do not need to be performed in any particular order. The sequence numbers of the disclosed embodiments of this invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments. Furthermore, although the elements disclosed in the embodiments of this invention may be described or claimed individually, they may be understood as multiple unless explicitly limited to a singular number.

[0174] It should be understood that, as used herein, the singular form "one" is intended to include the plural form as well, unless the context clearly supports an exception. It should also be understood that, as used herein, "and / or" refers to any and all possible combinations of one or more of the associated listed items.

[0175] Those skilled in the art should understand that the discussion of any of the above embodiments is merely exemplary and is not intended to imply that the scope of the invention (including the claims) is limited to these examples. Within the framework of the invention, technical features of the above embodiments or different embodiments can be combined, and many other variations of different aspects of the invention exist, which are not provided in the details for the sake of brevity. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the invention should be included within the protection scope of the invention.

Claims

1. A method for intelligent anomaly detection using sensors, characterized in that, include: Real-time data from several industrial sensors is collected and preprocessed at the edge device. Each type of real-time data is then predicted using the corresponding prediction model, and the residual is calculated. A dynamic threshold is calculated within a preset sliding window. The residuals and the dynamic threshold are then used for a health assessment to obtain a state label. This process includes: obtaining the historical residual mean distribution; calculating the residual mean and current variance within the preset sliding window; calculating a dynamic adjustment factor based on the rate of change of the system's operating state; obtaining the dynamic threshold based on the historical residual mean distribution, the dynamic adjustment factor, and the current variance; calculating the number of times the residual mean exceeds the dynamic threshold; assigning risk weights to the residual mean and the rate of change; calculating the posterior probability of the state through Bayesian network inference; selecting the highest probability as the initial state label; and smoothing and optimizing the initial state label to obtain the final state label. The dynamic threshold... The formula is ;in, The historical residual mean; The current sliding window residual standard deviation; k is the sensitivity adjustment coefficient; For dynamic adjustment factors; In response to the detection of changes in the distribution of real-time data, the prediction model is trained and updated online in the cloud to calculate new residuals and update the state labels based on the new residuals. In addition, in response to the detection of changes in the distribution of real-time data, the prediction model is trained online in the cloud through small-batch incremental training to update the prediction model parameters. The performance before and after the update is verified. If the performance degrades after the update, a rollback flag is generated and the old version is rolled back. Warnings are issued based on status labels.

2. The method for intelligent anomaly detection using a sensor according to claim 1, characterized in that, The steps of collecting and preprocessing real-time data from several industrial sensors at the edge device include: At the edge nodes of the edge devices, real-time data is collected from several industrial sensors every second. Remove invalid and outlier values ​​from real-time data and repair missing data; Normalization and feature extraction are performed to obtain the time series training dataset.

3. The method for intelligent anomaly detection of a sensor according to claim 1, characterized in that, The step of predicting each type of real-time data using the corresponding prediction model and calculating the residual includes: Select the appropriate time series prediction model based on the data characteristics of different sensors; The predicted value corresponding to the real-time data is calculated by the model, and the residual is obtained by comparing it with the actual value.

4. A sensor-based intelligent anomaly detection system, characterized in that, include: The acquisition unit is configured to acquire and preprocess real-time data from several industrial sensors at the edge device, and to predict and calculate the residual for each type of real-time data using the corresponding prediction model. The evaluation unit is configured to calculate a dynamic threshold within a preset sliding window, perform a health assessment on the residuals and the dynamic threshold to obtain a state label, wherein: the historical residual mean distribution is obtained; the residual mean and current variance are calculated within the preset sliding window; a dynamic adjustment factor is calculated based on the rate of change of the system operating state; a dynamic threshold is obtained based on the historical residual mean distribution, the dynamic adjustment factor, and the current variance; the number of times the residual mean exceeds the dynamic threshold is calculated, and risk weights are assigned to the residual mean and the rate of change; the posterior probability of the state is calculated through Bayesian network inference, and the highest probability is selected as the initial state label; the initial state label is smoothed and optimized to obtain the final state label; the dynamic threshold... The formula is ;in, The historical residual mean; The current sliding window residual standard deviation; k is the sensitivity adjustment coefficient; For dynamic adjustment factors; The update unit is configured to, in response to the detection of a change in the distribution of real-time data, perform online learning and adaptive updates on the prediction model in the cloud, calculate a new residual, and update the state label based on the new residual; wherein, in response to the detection of a change in the distribution of real-time data, the prediction model is trained online in the cloud through mini-batch incremental training to update the prediction model parameters; the performance before and after the update is verified, and if the performance degrades after the update, a rollback flag is generated to roll back the old version; The early warning unit is configured to issue early warnings based on status tags.

5. A computer device, comprising: At least one processor; The processor also includes a memory storing a computer program that can run on the processor, characterized in that the processor executes the program to perform the steps of a method for intelligent anomaly detection of a sensor as described in any one of claims 1 to 3.

6. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it performs the steps of the method for intelligent anomaly detection of a sensor as described in any one of claims 1 to 3.

Images