An internet of things cluster data analysis method based on big data and artificial intelligence

Abstract

The application discloses a kind of based on big data and artificial intelligence's internet of things cluster data analysis method, it is related to data analysis technical field, including, using space-time graph sequence to edge side feature coding submodel and cloud space-time deep model are initialized and parameter synchronous processing, obtain collaborative modeling parameter set, based on collaborative modeling parameter set to cloud space-time deep model executes self-supervision reconstruction and prediction task training, obtains depth representation model, uses depth representation model to learn abnormal mode parameter and constructs abnormal score function, obtains abnormal detection model, after receiving real-time multi-source heterogeneous data in edge node, using abnormal detection model carries out state prediction and abnormal score calculation, obtains real-time abnormal score result;The application improves the accuracy, real-time performance and interpretability of internet of things cluster data analysis by intelligent data analysis method.

Description

Technical Field

[0001] This invention relates to the field of data analysis technology, and in particular to a method for analyzing IoT cluster data based on big data and artificial intelligence. Background Technology

[0002] With the continuous evolution and widespread application of the Internet of Things (IoT), complex IoT clusters composed of tens of thousands of heterogeneous device nodes have been gradually built in fields such as industrial automation, smart grids, smart transportation, and urban infrastructure. These clusters collect and interact with multimodal, high-dimensional, and highly time-series operational data in real time through widely deployed sensors, actuators, controllers, and communication units, forming typical big data scenarios. To address the processing challenges brought by massive heterogeneous data, in recent years, academia and industry have deeply integrated big data processing architectures and artificial intelligence algorithms, promoting the development of edge computing, distributed learning, and deep spatiotemporal modeling methods. In particular, the introduction of graph neural networks, self-supervised learning, and cloud-edge collaborative inference frameworks has enhanced the ability to model the complex dependencies and dynamic behavior patterns between devices in IoT clusters. This not only improves the efficiency and accuracy of data analysis but also lays a solid foundation for realizing intelligent state perception, predictive maintenance, and autonomous decision-making.

[0003] Nevertheless, existing data analysis methods still have room for improvement. First, using static topological structures to describe the relationships between devices cannot dynamically reflect the coupling effect of physical proximity and operational status correlation over time, leading to distorted graph structure representation. Second, in anomaly detection tasks, previous methods rely on supervised labels or preset thresholds, which are difficult to adapt to the generalization of unknown anomaly patterns under complex working conditions. Furthermore, they do not effectively integrate multi-dimensional criteria such as reconstruction error, prediction bias, and classification confidence, resulting in insufficient accuracy of the scoring mechanism. Summary of the Invention

[0004] In view of the aforementioned existing problems, the present invention is proposed.

[0005] Therefore, this invention provides an IoT cluster data analysis method based on big data and artificial intelligence to solve the problems of insufficient scoring accuracy and graph structure distortion.

[0006] To solve the above-mentioned technical problems, the present invention provides the following technical solution:

[0007] This invention provides a method for analyzing IoT cluster data based on big data and artificial intelligence, comprising:

[0008] Collect multi-source heterogeneous data from each device node in the IoT cluster, preprocess the data, and then arrange and combine the preprocessed multi-source heterogeneous data to form a time-series structured feature sequence.

[0009] Based on temporal structured feature sequences, a spatiotemporal graph sequence is constructed;

[0010] The spatiotemporal graph sequence is used to initialize and synchronize the parameters of the edge-side feature encoding sub-model and the cloud-based spatiotemporal depth model to obtain a collaborative modeling parameter set.

[0011] Based on the collaborative modeling parameter set, a self-supervised reconstruction and prediction task is performed on the cloud-based spatiotemporal depth model to obtain a depth representation model;

[0012] The anomaly detection model is obtained by learning anomaly pattern parameters and constructing an anomaly scoring function using a deep representation model.

[0013] After receiving real-time multi-source heterogeneous data at the edge node, the anomaly detection model is used to perform state prediction and anomaly scoring calculation to obtain real-time anomaly scoring results.

[0014] As a preferred embodiment of the IoT cluster data analysis method based on big data and artificial intelligence described in this invention, the multi-source heterogeneous data includes sensor data, actuator data, control device data, and communication device data;

[0015] The preprocessing includes time synchronization and feature normalization.

[0016] As a preferred embodiment of the IoT cluster data analysis method based on big data and artificial intelligence described in this invention, the step of arranging and combining the preprocessed multi-source heterogeneous data refers to arranging the preprocessed multi-source heterogeneous data of each device node in the IoT cluster according to time order and feature structure to form a time-series structured feature sequence.

[0017] As a preferred embodiment of the IoT cluster data analysis method based on big data and artificial intelligence described in this invention, the construction of the spatiotemporal graph sequence specifically includes:

[0018] Based on the physical proximity between the device nodes in the IoT cluster, an initial topology is established between the device nodes.

[0019] The initial topological structure is associated one by one with the feature data in the temporal structured feature sequence to form N spatiotemporal graphs;

[0020] Calculate the correlation values ​​between device nodes in the IoT cluster based on the changes of the temporally structured feature sequence at different time steps;

[0021] Based on the correlation values ​​between each device node, the initial topology connection weights in the N spatiotemporal graphs are updated, and then the N spatiotemporal graphs are arranged in chronological order to obtain the spatiotemporal graph sequence.

[0022] As a preferred embodiment of the IoT cluster data analysis method based on big data and artificial intelligence described in this invention, the step of initializing and synchronizing the edge-side feature encoding sub-model and the cloud-based spatiotemporal depth model using a spatiotemporal graph sequence to obtain a collaborative modeling parameter set specifically involves:

[0023] After initializing the edge-side feature encoding sub-model and the cloud-based spatiotemporal depth model, the trainable parameters of the edge-side feature encoding sub-model and the cloud-based spatiotemporal depth model are updated using spatiotemporal graph sequences;

[0024] The updated cloud-based spatiotemporal depth model trainable parameters are copied to the edge-side feature encoding sub-model, and all trainable parameters are extracted from the edge-side feature encoding sub-model as a co-modeling parameter set.

[0025] As a preferred embodiment of the IoT cluster data analysis method based on big data and artificial intelligence described in this invention, the step of training a cloud-based spatiotemporal depth model using a collaborative modeling parameter set to perform self-supervised reconstruction and prediction tasks to obtain a depth representation model specifically involves:

[0026] The spatiotemporal graph sequence is input into the cloud-based spatiotemporal depth model, which performs spatiotemporal feature extraction on the spatiotemporal graph sequence based on the collaborative modeling parameter set to obtain spatiotemporal feature representations.

[0027] Using spatiotemporal feature representation, the feature data in the spatiotemporal graph sequence is reconstructed and the reconstruction error is calculated. Based on the reconstruction error, the parameters of the cloud spatiotemporal depth model are updated.

[0028] After reconstruction, the spatiotemporal feature representation is used to predict the feature data in the spatiotemporal graph sequence and calculate the prediction error. Based on the prediction error, the trainable parameters in the cloud spatiotemporal depth model are updated.

[0029] Reconstruction, prediction, and parameter updates are repeated according to the preset training rounds. After all training rounds are completed, the cloud-based spatiotemporal depth model is used as the depth representation model.

[0030] As a preferred embodiment of the IoT cluster data analysis method based on big data and artificial intelligence described in this invention, the calculated reconstruction error specifically refers to:

[0031] The spatiotemporal feature representation is input into the cloud-based spatiotemporal depth model, which performs a reverse mapping operation on the spatiotemporal feature representation to obtain the reconstructed data.

[0032] The reconstructed data is compared and calculated element by element with the feature data in the spatiotemporal graph sequence to form the reconstruction error.

[0033] As a preferred embodiment of the IoT cluster data analysis method based on big data and artificial intelligence described in this invention, wherein: the step of using a deep representation model to learn anomaly pattern parameters specifically involves:

[0034] Use a random number generation algorithm to assign initial values ​​to the abnormal mode parameters and obtain the initial abnormal mode parameters;

[0035] Normal operating condition data of the IoT cluster is collected as normal samples, and abnormal operating condition data is collected as abnormal samples. The spatiotemporal graph sequences corresponding to the normal samples and abnormal samples are input into the depth representation model to perform forward calculation and obtain the depth representation vector.

[0036] The initial anomaly mode parameters are used to perform a linear transformation and nonlinear activation on the depth representation vector to obtain the output vector.

[0037] Calculate the difference between the output vector and normal and abnormal samples, and calculate the gradient information based on the difference using the backpropagation algorithm. Use the gradient information to update the initial abnormal mode parameters and obtain the final abnormal mode parameters.

[0038] The final anomaly mode parameter is used to perform forward computation on the feature vector to obtain the classification result.

[0039] As a preferred embodiment of the IoT cluster data analysis method based on big data and artificial intelligence described in this invention, the step of constructing an anomaly scoring function and obtaining an anomaly detection model specifically includes:

[0040] Calculate the distance quantization value based on the depth representation vector output by the normal sample and the depth representation model;

[0041] An anomaly scoring function is constructed using distance quantization, classification results, reconstruction error, and prediction error;

[0042] The depth representation model, the final anomaly pattern parameters, and the anomaly scoring function are combined to form an anomaly detection model.

[0043] As a preferred embodiment of the IoT cluster data analysis method based on big data and artificial intelligence described in this invention, the step of receiving real-time multi-source heterogeneous data at the edge node and then using an anomaly detection model to perform state prediction and anomaly scoring calculation to obtain real-time anomaly scoring results specifically includes:

[0044] After receiving real-time multi-source heterogeneous data at the edge node, the data is input into the depth representation model. The depth representation model performs forward propagation calculation on the real-time multi-source heterogeneous data to obtain real-time feature vectors.

[0045] The final anomaly mode parameters are used to perform linear transformations and nonlinear activations on the real-time feature vectors to generate real-time classification results.

[0046] The anomaly scoring function is used to weight the real-time feature vector and the real-time classification result to obtain the real-time anomaly score.

[0047] The beneficial effects of this invention are as follows: By constructing a dynamically updated spatiotemporal graph sequence and integrating the physical proximity of devices with the correlation of operating status, high-fidelity modeling of the complex spatiotemporal dependencies of IoT clusters is achieved. Combined with the parameter synchronization mechanism of cloud-edge collaboration, the edge side can efficiently inherit the deep representation capabilities of the cloud under resource-constrained conditions. Utilizing the dual tasks of self-supervised reconstruction and prediction, normal behavior patterns with generalization capabilities can be learned without manual annotation. At the same time, a learnable anomaly scoring function is constructed by integrating multi-dimensional criteria such as classification confidence, reconstruction error, and prediction bias, enabling accurate quantitative detection of unknown anomalies. Overall, this improves the accuracy, real-time performance, and interpretability of IoT cluster data analysis, effectively overcoming the shortcomings of existing methods such as static graph structure, reliance on labels, single criteria, and cloud-edge fragmentation. Attached Figure Description

[0048] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0049] Figure 1 This is a flowchart of a data analysis method for IoT clusters based on big data and artificial intelligence.

[0050] Figure 2 A flowchart for obtaining a spatiotemporal graph sequence.

[0051] Figure 3 A flowchart for obtaining a depth representation model.

[0052] Figure 4 A flowchart for obtaining real-time anomaly scoring results. Detailed Implementation

[0053] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0054] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0055] Secondly, the term "an embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in different places in this specification does not necessarily refer to the same embodiment, nor is it a single or selective embodiment that is mutually exclusive with other embodiments.

[0056] Reference Figures 1-4 This is one embodiment of the present invention, which provides a method for analyzing IoT cluster data based on big data and artificial intelligence, including the following steps:

[0057] S1. Collect multi-source heterogeneous data from each device node in the IoT cluster, preprocess the data, and arrange and combine the preprocessed multi-source heterogeneous data to form a time-series structured feature sequence.

[0058] S1.1 It should be noted that a unique node identifier is assigned to each device node in the IoT cluster, ensuring that the node identifier remains unchanged throughout the IoT cluster's operational cycle. The node identifier can be generated based on any one of the device node's physical address identifier, device serial number identifier, or network communication address identifier, enabling accurate mapping of multi-source heterogeneous data at different time steps according to the node identifier. Through the data acquisition interfaces deployed on each device node of the IoT cluster, sensor data (including temperature, humidity, pressure, and vibration amplitude values) is periodically or triggered by events; actuator data (including motor speed, valve opening, and relay operation status) is read from actuators; control device data (including control commands output by the programmable logic controller and device operating status identifiers) is read from devices such as programmable logic controllers; and communication device data (including network latency, packet loss rate, and connection quality indicators) is read from network switching and transmission units. The collected sensor data, actuator data, control device data, and communication device data are temporarily stored in the device node's local buffer and appended with precise timestamps, forming the raw multi-source heterogeneous data to be processed.

[0059] Based on a unified clock source to align the timestamps of sensor data, actuator data, control device data, and communication device data, during time synchronization processing, when there are deviations in the local clocks of each device node in the IoT cluster or time delays in the transmission of multi-source heterogeneous data, time correction can be performed on the arrival time of each device node after timestamping, based on the unified clock source. Time correction can include offset compensation for the timestamps recorded by different device nodes according to the maximum permissible deviation threshold, so that the compensated timestamps are consistent with the reference of the unified clock source. Specifically, the local timestamps recorded by each device node are compared with the reference timestamps recorded by the unified clock source, and the time difference between the local timestamps and the reference timestamps of each device node is calculated. The time difference is used as the offset of the device node. When the absolute value of the offset does not exceed the maximum permissible deviation threshold, the timestamps are numerically compensated according to the offset, so that the compensated timestamps are consistent with the unified clock source. When the absolute value of the offset exceeds the maximum permissible deviation threshold, the corresponding timestamps are truncated according to the maximum permissible deviation threshold, so that the compensated timestamps are aligned with the reference time within the allowable range.

[0060] After time correction is completed, sensor data, actuator data, control device data, and communication device data can be aligned in the time dimension according to a unified time reference, thereby ensuring the consistency of multi-source heterogeneous data of each device node in the structured feature vector between the same time steps.

[0061] The maximum permissible deviation threshold can be set according to a certain proportion of the sampling period length of multi-source heterogeneous data. For example, 20% to 50% of the sampling period length can be selected as the maximum permissible deviation threshold. The value is based on the state change rate of the device node and the time sensitivity of multi-source heterogeneous data.

[0062] After time synchronization, feature normalization is performed on the multi-source heterogeneous data. Specifically, for each feature value in the multi-source heterogeneous data, the global minimum and maximum values ​​are calculated, and then the max-min normalization method is used to convert each type of feature value in the multi-source heterogeneous data into a normalized value that satisfies a uniform scale. The formula is as follows:

[0063] ;

[0064] in, Represents eigenvalues. Represents the normalized eigenvalues. This represents the minimum value of the feature value within the sampling period. This indicates the maximum value of the feature within the sampling period.

[0065] The preprocessed multi-source heterogeneous data is arranged and combined according to the topological and temporal order of each device node, so that the preprocessed multi-source heterogeneous data corresponding to each device node at the same time step constitute a structured feature vector.

[0066] When performing feature normalization, if a new device node is added to the IoT cluster or the feature dimensions of existing device nodes change, the normalization calculation process is adjusted according to the dimension expansion rules. For new device nodes, the feature values ​​of the new device node are converted according to the normalization formula; the new device node is inserted into the corresponding position in the structured feature vector according to the node arrangement order; when the feature values ​​of the new device node exceed the feature values ​​of the existing device nodes, the normalization interval is updated by statistically analyzing the global minimum and global maximum values ​​from historical operating data, ensuring that the normalized values ​​still meet the uniform scale requirements. For cases where the feature dimensions change, a new feature dimension position can be assigned to the new feature in the structured feature vector, and normalization processing is performed on the new feature values.

[0067] S1.2 It should be noted that the structured feature vectors corresponding to each time step are sorted from early to late according to the timestamp, and the sorted structured feature vectors are connected and arranged in ascending order of timestamp, so that the arranged structured feature vectors form a temporal structured feature sequence arranged in chronological order.

[0068] It should also be noted that when sorting the structured feature vectors according to timestamps and constructing a time-series structured feature sequence, if a device node has missing features or its feature values ​​deviate significantly from the historical feature distribution at a certain time step, the missing or outlier values ​​are processed. Specifically, missing values ​​can be filled in using the mean to ensure the continuity of the corresponding feature dimension in the time-series structured feature sequence; outliers can be detected based on the statistical distribution of feature values ​​at each time step. When a feature value exceeds the range of the mean plus or minus several times the standard deviation, this feature value can be replaced with the mean or median to ensure that the time-series structured feature sequence maintains a stable trend over time.

[0069] S2. Construct a spatiotemporal graph sequence based on temporal structured feature sequences;

[0070] S2.1. Based on the physical proximity relationship between each device node in the IoT cluster, establish an initial topology between each device node;

[0071] It should be noted that, based on the physical proximity relationships between the device nodes in the IoT cluster, after collecting the geographical locations of each device node, the proximity relationship value between each pair of device nodes is calculated according to the spatial distance between them. The formula is as follows:

[0072] ;

[0073] ;

[0074] in, Represents device nodes in an IoT cluster With device nodes Spatial distance, Represents device node In geographical location axis coordinate values, Represents device node In geographical location axis coordinate values, Represents device node In geographical location axis coordinate values, Represents device node In geographical location axis coordinate values, Represents device node In geographical location axis coordinate values, Represents device node In geographical location axis coordinate values, Represents device node With device nodes The proximity relationship value, Represents device nodes in an IoT cluster With device nodes Spatial distance.

[0075] By comparing the proximity relationship value with a preset proximity threshold, it is determined whether a connection exists between each device node. Specifically, when the proximity relationship value is greater than the proximity threshold, it indicates that the spatial distance between the two device nodes is within the connectable range, and a connection can be established between the two device nodes; when the proximity relationship value is less than the proximity threshold, it indicates that the spatial distance between the two device nodes exceeds the connectable range, and a connection is not established between the two device nodes. Connections are established between device nodes that meet the connection conditions, and the device node numbers are recorded sequentially as an edge set, and the device nodes are recorded as a node set. The node set and the edge set together constitute the initial topology of the IoT cluster.

[0076] The proximity threshold is a non-negative real number, set according to the spatial distribution of each device node in the IoT cluster. It is determined based on the statistical characteristics of the spatial distance between each device node in the IoT cluster. Specifically, when the spatial distribution of device nodes is relatively sparse, a higher proportion can be selected as the proximity threshold, such as 70% to 80% of the average spatial distance, to make the determination of proximity more stringent and avoid establishing too many long-distance connections between device nodes. When the spatial distribution of device nodes is relatively dense, a lower proportion can be selected as the proximity threshold, such as 40% to 50% of the average spatial distance, to make the determination of proximity more lenient and establish more sufficient connections in local areas to reflect the spatial aggregation characteristics of device nodes.

[0077] S2.2. Associate the initial topological structure with the feature data in the temporal structured feature sequence one by one to form N spatiotemporal graphs.

[0078] It should be noted that the node set and edge set in the initial topology are fixed according to the numbering order of each device node in the IoT cluster. The structured feature vector corresponding to each time step is read sequentially from the temporal structured feature sequence. The multi-source heterogeneous data in the structured feature vector are matched one by one with the node set in the initial topology according to the arrangement order of each device node in the initial topology. The matched structured feature vector is used as the node feature of the initial topology at the current time step. A spatiotemporal graph is constructed by the node set, edge set and node feature of the current time step. By constructing the spatiotemporal graph by sequentially processing the structured feature vector in the temporal structured feature sequence, N (e.g., 100) spatiotemporal graphs with consistent structure but changing node features over time are obtained.

[0079] S2.3 Calculate the correlation values ​​between device nodes in the IoT cluster based on the changes in the time-series structured feature sequence at different time steps.

[0080] It should be noted that the structured feature vector corresponding to each time step in the time-series structured feature sequence is split according to the numbering order of each device node. The feature value sequence of each device node in all time steps is extracted. At the same time, according to the correspondence between device nodes, paired feature value sequences are formed. The correlation index between device nodes in the IoT cluster is obtained by calculating the correlation index of each pair of paired feature value sequences in all time steps. The formula is as follows:

[0081] ;

[0082] in, Represents device node With device nodes The correlation value, Represents device node At time step eigenvalues, Represents device node At time step eigenvalues, Represents device node The characteristic mean across all time steps, Represents device node The characteristic mean across all time steps, This represents the number of time steps in the temporal structured feature sequence.

[0083] The correlation values ​​of each pair of device nodes are associated with the connection relationships in the initial topology, and the connection weights in the initial topology are updated using a weight update formula, which is:

[0084] ;

[0085] in, Represents the device nodes in the initial topology. With device nodes Updated connection weights Represents the device nodes in the initial topology. With device nodes The initial connection weights, Represents device node With device nodes The correlation value, This represents the balance coefficient.

[0086] The updated weights are assigned to the corresponding connection edges in the N spatiotemporal graphs, and the N spatiotemporal graphs are sorted in sequence according to the temporal arrangement order of the temporal structured feature sequence, so that the sorted N spatiotemporal graphs form a spatiotemporal graph sequence.

[0087] The initial connection weights between device nodes in the initial topology can be set based on the spatial proximity between the device nodes, and can also be taken from the proximity values ​​between the device nodes. That is, the initial connection weights can be directly taken from the proximity values.

[0088] The balance coefficient is set based on the standard deviation of the correlation values ​​between device nodes in the time-series structured feature sequence. The value is between zero and one, and the value is based on the fluctuation range of the correlation values ​​in the time-series structured feature sequence.

[0089] S3. Initialize and synchronize parameters of the edge-side feature encoding sub-model and the cloud-based spatiotemporal depth model using spatiotemporal graph sequences to obtain a collaborative modeling parameter set.

[0090] After initializing the edge-side feature encoding sub-model and the cloud-based spatiotemporal depth model, the trainable parameters of the edge-side feature encoding sub-model and the cloud-based spatiotemporal depth model are updated using spatiotemporal graph sequences.

[0091] It should be noted that random initialization is used to generate random values. These random values ​​are then written into the corresponding trainable parameters according to the structural order of the edge-side feature encoding sub-model and the cloud-based spatiotemporal depth model. This ensures that all trainable parameters of the edge-side feature encoding sub-model and the cloud-based spatiotemporal depth model are initialized before the spatiotemporal graph sequence operation is performed. The structure of the edge-side feature encoding sub-model includes graph convolutional layers, temporal encoding layers, and fully connected layers; the structure of the cloud-based spatiotemporal depth model includes multiple graph convolutional layers, multi-head self-attention layers, temporal convolutional layers, and non-linear activation layers.

[0092] The temporal coding layer is used to numerically represent the sequential information of structured feature vectors in the time dimension. The temporal coding layer can adopt a temporal position coding method based on a fixed function or a time series coding method based on trainable parameters.

[0093] The spatiotemporal graph sequence is input into the edge-side feature encoding sub-model and the cloud-based spatiotemporal depth model in chronological order. The graph convolutional layer in the edge-side feature encoding sub-model performs feature aggregation on the node features in the spatiotemporal graph according to the updated connection weights, as shown in the formula:

[0094] ;

[0095] in, Represents device node Aggregated node features Represents a non-linear activation function. This represents the trainable weight matrix in the graph convolutional layer (trainable parameters of the graph convolutional layer in the edge-side feature encoding sub-model). Indicates the relationship with device nodes Adjacent device node sets Represents the device nodes in the initial topology. With device nodes Updated connection weights Represents device node The node characteristics.

[0096] The temporal coding layer performs temporal feature encoding on the aggregated node features in the order of time steps. Specifically, the temporal coding layer generates a corresponding temporal coding vector for each time step of the aggregated node features according to the time step index, and combines the temporal coding vector with the aggregated node features by vector addition to form the temporal feature encoding result.

[0097] The fully connected layer maps the temporal feature encoding results to a low-dimensional feature representation. The difference between the low-dimensional feature representation and the target feature is calculated as error information. Using this error information, partial derivatives are taken with respect to the trainable parameters of each layer in the edge-side feature encoding sub-model to obtain the gradient information corresponding to the trainable parameters. The formula is as follows:

[0098] ;

[0099] in, This represents the gradient information corresponding to the trainable parameters. This represents the partial derivative operator. Represents the loss function (e.g., MSE). This represents the output (usually a feature representation or predicted value) after processing by the current layer (such as a graph convolutional layer, a temporal coding layer, and a fully connected layer). This represents the trainable parameters of the edge-side feature encoding sub-model.

[0100] After obtaining the gradient information corresponding to the trainable parameters, each gradient information is numerically scaled according to the learning rate (e.g., 0.005) to form the update amount of the trainable parameters. The trainable parameters of the edge-side feature encoding sub-model are weighted and combined with the corresponding update amount to obtain the updated trainable parameters. The updated trainable parameters are written back to the corresponding positions in the edge-side feature encoding sub-model. After traversing the current batch of spatiotemporal graph sequences, the error information calculation, gradient information calculation, and trainable parameter update are repeated to ensure that the trainable parameters in the edge-side feature encoding sub-model are numerically adjusted in multiple iterations.

[0101] The number of iterations can be set according to the number of time steps in the spatiotemporal graph sequence, the size of the edge-side feature encoding sub-model, and the convergence speed of the loss function. For example, the number of iterations can be set to ten to fifty rounds, depending on the complexity of the spatiotemporal graph sequence, the size of the feature dimension, and the training stability of the edge-side feature encoding sub-model.

[0102] In the cloud-based spatiotemporal depth model, the graph convolutional layer performs weighted aggregation on the node features in the spatiotemporal graph. The temporal convolutional layer then performs sliding window convolution on the weighted aggregated node features along the time dimension. By weighted summing of the node features over multiple consecutive time steps, the weighted aggregated node features are integrated with historical information from previous and subsequent time steps in the current time step to obtain sequence features. The self-attention layer (which uses an attention mechanism consistent with the standard self-attention calculation method) receives the sequence features output by the temporal convolutional layer and performs matrix multiplication with the trainable weight matrix in the self-attention layer, so that the sequence features form query vector, key vector, and value vector in three different projection spaces.

[0103] Specifically, when initializing the cloud-based spatiotemporal depth model, the trainable parameters (three trainable weight matrices for the query vector, key vector, and value vector, as well as a trainable weight matrix and trainable bias vector for performing linear transformations on the weighted feature combination) generated for the self-attention layer are generated using a random initialization method and are updated during the training process of the self-supervised task.

[0104] The attention energy value is obtained by performing element-wise multiplication and summing the query vector and key vector. This attention energy value is normalized to attention weights, which are then element-wise multiplied and summed with the value vectors at their corresponding time points to form a weighted feature combination, thus modeling the temporal correlation of sequence features. The weighted feature combination undergoes linear transformation and nonlinear activation to obtain the output vector. Specifically, matrix multiplication is performed on the trainable weight matrix of the weighted feature combination according to the linear transformation, and a trainable bias vector is added after the matrix multiplication to obtain the linear transformation result. This linear transformation result is then input into a nonlinear activation function (ReLU). The nonlinear activation function performs a nonlinear mapping on each value in the linear transformation result according to a preset input-output relationship, giving the transformed values ​​nonlinear expressive power. The result generated by the combination of linear transformation and nonlinear activation serves as the output vector, which is the spatiotemporal feature representation.

[0105] Element-wise difference calculations are performed between the spatiotemporal feature representation and the target spatiotemporal feature. The element-wise differences are then squared and summed along the feature and time dimensions to obtain the overall difference between the spatiotemporal feature representation and the target spatiotemporal feature. This overall difference is then used as the spatiotemporal feature error information. Based on this error information, the partial derivatives of the trainable parameters of the cloud-based spatiotemporal depth model are calculated (using the same formula as above). The learning rate is then used to update the values ​​of each trainable parameter, as shown in the formula:

[0106] );

[0107] in, This represents the updated values ​​of the trainable parameters of the cloud-based spatiotemporal depth model. This represents the current value (i.e., the value before the update) of the trainable parameters of the spatiotemporal depth model in the cloud. Indicates the learning rate. This represents the partial derivatives of the trainable parameters of the spatiotemporal depth model in the cloud.

[0108] The learning rate is set based on the update requirements of the trainable parameters, and its value ranges from [value range missing]. to The positive real numbers between these values ​​depend on the complexity of the spatiotemporal graph sequence features.

[0109] By repeatedly performing partial derivative calculations and numerical adjustments at multiple time steps of the spatiotemporal graph sequence, the trainable parameters in the cloud-based spatiotemporal depth model are gradually optimized and updated.

[0110] The updated cloud-based spatiotemporal depth model trainable parameters are copied to the edge-side feature encoding sub-model, and all trainable parameters are extracted from the edge-side feature encoding sub-model as a co-modeling parameter set.

[0111] The target spatiotemporal features can be calculated based on the operational characteristics of each device node in the IoT cluster. The statistics of the time-series structured feature sequence within the sampling period, such as mean, variance, or median, are calculated. The statistics are arranged in spatial topological order as a reference feature vector, and the reference feature vector is used as the target spatiotemporal features.

[0112] S4. Based on the collaborative modeling parameter set, perform self-supervised reconstruction and prediction training on the cloud-based spatiotemporal depth model to obtain a depth representation model.

[0113] It should be noted that, based on the collaborative modeling parameter set, a copy of the cloud-based spatiotemporal depth model is initialized. The spatiotemporal graph sequence is input into the initialized copy of the cloud-based spatiotemporal depth model, and the initial spatiotemporal feature representation is obtained by following the forward propagation process of the cloud-based spatiotemporal depth model in step S3 above. The initial spatiotemporal feature representation is then input into the back-mapping and forward-mapping structures of the cloud-based spatiotemporal depth model. Linear transformations and nonlinear activations are sequentially performed on the initial spatiotemporal feature representation in the back-mapping and forward-mapping structures, restoring the initial spatiotemporal feature representation to reconstructed and predicted data. Element-wise differences are calculated between the reconstructed and predicted data and the feature data in the spatiotemporal graph sequence, and all element-wise differences are summed to obtain the reconstruction error and prediction error. After obtaining the reconstruction error and prediction error, the partial derivatives of the trainable parameters of the cloud-based spatiotemporal depth model are calculated, and gradient descent is performed to update the trainable parameters. Reconstruction, prediction, and parameter updates are repeated according to a preset training epoch (e.g., 100 times).

[0114] The reverse mapping structure and the forward mapping structure consist of a set of fully connected layers stacked in sequence, each of which includes a trainable linear transformation weight matrix and a trainable bias vector.

[0115] The preset training rounds are set based on the convergence speed of the reconstruction error and prediction error of the cloud-based spatiotemporal depth model during the training process. The values ​​are positive integers between 10 and 500, and are determined based on the feature complexity and noise scale of the spatiotemporal graph sequence.

[0116] After completing the training of the self-supervised reconstruction and prediction tasks, the parameters of the cloud-based spatiotemporal depth model have been updated to meet the preset training conditions, enabling the updated cloud-based spatiotemporal depth model to be used as a depth representation model. The depth representation model and the cloud-based spatiotemporal depth model are structurally consistent, differing only in their parameter update status after training.

[0117] S5. Use a deep representation model to learn the anomaly pattern parameters and construct an anomaly scoring function to obtain an anomaly detection model.

[0118] It should be noted that the random number generation algorithm uses a uniform distribution initialization method to randomly sample values ​​within a preset interval as initial anomaly mode parameters; the preset interval is set according to the stability requirements of the initial anomaly mode parameters during gradient propagation, for example... The value is determined based on the fact that the initial abnormal mode parameters have fully converged during the subsequent gradient update process.

[0119] During the continuous operation of the IoT cluster, multi-source heterogeneous data is recorded for each device node in the IoT cluster when the operating status is stable, the device operates normally, and the sensor values ​​are within the set range. The recorded multi-source heterogeneous data is then organized into normal samples in chronological order. When the IoT cluster experiences operational fluctuations, performance degradation, device failure, or abnormal sensor readings, multi-source heterogeneous data for each device node in the IoT cluster is recorded, and the data corresponding to the abnormal states is organized into abnormal samples in chronological order. The sensor value set range is determined by: determining it according to the technical specifications provided by the device manufacturer, or collecting a period of continuously stable historical data during the initial deployment phase of the IoT cluster, using the mean of each sensor reading in the historical data plus or minus three standard deviations as the set range.

[0120] The spatiotemporal graph sequences corresponding to normal and abnormal samples are input into the depth representation model, which generates a depth representation vector according to the aforementioned graph convolution operation, temporal convolution operation, and self-attention calculation. The depth representation vector is then multiplied by the linear weight matrix in the initial abnormal pattern parameters, and the result of the matrix multiplication is added element-wise to the bias vector in the initial abnormal pattern parameters to generate a linear transformation output. This linear transformation output is then input into a nonlinear activation function, where each element is numerically mapped according to the input-output relationship of the activation function to obtain an activation vector. The difference between the activation vector and the normal and abnormal samples is calculated, and the partial derivatives of the initial abnormal pattern parameters are calculated based on these differences. The partial derivatives are then used to update the initial abnormal pattern parameters (using the numerical update formula in step S3.1) to obtain the final abnormal pattern parameters.

[0121] The deep representation vector is multiplied by the linear weight matrix in the final anomaly pattern parameters, and then element-wise added to the bias vector in the final anomaly pattern parameters to generate a classification score vector. The classification score vector is input into a non-linear activation function, and numerical mapping is performed on each element of the classification score vector to obtain a probability value between 0 and 1. The category label corresponding to the deep representation vector is determined according to the position of the maximum value in the probability value, and the category label is output as the classification result.

[0122] The Euclidean distance between the depth representation vector and the feature vector of the normal sample is calculated as the distance quantization value, using the following formula:

[0123] ;

[0124] in, Represents the distance quantization value. The depth representation vector is in the th order. The values ​​in each feature dimension This represents the feature vector of a normal sample at the th... The values ​​in each feature dimension This represents the number of feature dimensions of the depth representation vector.

[0125] The distance quantization value, classification result, reconstruction error, and prediction error are combined into an anomaly scoring function using a weighted approach, expressed by the formula:

[0126] ;

[0127] in, This represents the value of the anomaly scoring function. Indicates the reconstruction error. Indicates the prediction error. This represents the probability value of the normal category in the classification results. Represents the distance quantization value. Represents the reconstruction error weights. Indicates the prediction error weight. The weights represent the probability values ​​of the normal category in the classification results. This represents the weight of the distance quantization value.

[0128] The weights for reconstruction error, prediction error, probability of the normal category in the classification result, and distance quantization are all real numbers between 0 and 1, and the sum of the four weights is 1. Specific values ​​can be set according to the operational stability requirements of the IoT cluster and the need for sensitivity to abnormal features. For example, when the reconstruction and prediction errors of the IoT cluster fluctuate little under normal operating conditions, but increase under abnormal conditions, larger weights can be assigned to the reconstruction and prediction error weights, such as 0.35 for both. When the classification result has a clear probability distinction between normal and abnormal samples, a medium-sized value can be assigned to the probability of the normal category in the classification result, such as 0.2. When the distance change between the depth representation vector and the reference feature vector increases significantly in some abnormal scenarios, a smaller but non-zero value can be assigned to the distance quantization weight, such as 0.1, to supplement the sensitivity of the abnormal scoring function to feature shift.

[0129] Probability discrimination is used to characterize the ability of classification results to distinguish between normal samples and abnormal samples. Specifically, it is the degree of numerical difference between the normal class probability value corresponding to normal samples and the normal class probability value corresponding to abnormal samples.

[0130] The deep representation model, the final anomaly pattern parameters, and the anomaly scoring function work together in the same anomaly detection process to form an anomaly detection model.

[0131] S6. After receiving real-time multi-source heterogeneous data at the edge node, use the anomaly detection model to perform state prediction and anomaly score calculation to obtain real-time anomaly score results.

[0132] It should be noted that after the edge node receives real-time multi-source heterogeneous data (including real-time sensor data, real-time actuator data, real-time control device data, and real-time communication device data), the real-time multi-source heterogeneous data undergoes time synchronization and feature normalization processing. The pre-processed real-time multi-source heterogeneous data is then combined into a real-time structured feature vector corresponding to the current time step according to the topological order of the device nodes in the IoT cluster. This real-time structured feature vector is mapped to the spatiotemporal graph corresponding to the current time step according to the node arrangement used when constructing the dynamically updated spatiotemporal graph sequence. The spatiotemporal graph of the current time step is then input into the depth representation model part of the anomaly detection model. The model performs graph convolution, temporal convolution, and self-attention operations on the spatiotemporal graph at the current time step based on trainable parameters to generate real-time feature vectors (depth represents that the model simultaneously performs reconstruction and prediction paths during real-time inference, thus obtaining real-time reconstruction error and real-time prediction error); forward computation is performed on the real-time feature vectors using the final anomaly mode parameters to obtain real-time classification results; anomaly scoring functions are used to weight the real-time feature vectors, real-time classification results, real-time reconstruction errors, and real-time prediction errors, so that the feature offset degree of the real-time feature vectors and the anomaly tendency degree of the real-time classification results jointly participate in the anomaly scoring calculation to obtain real-time anomaly scoring results.

[0133] This embodiment also provides a computer device applicable to the IoT cluster data analysis method based on big data and artificial intelligence, comprising: a memory and a processor; the memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions to implement the IoT cluster data analysis method based on big data and artificial intelligence as proposed in the above embodiment.

[0134] The computer device can be a terminal, comprising a processor, memory, communication interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, carrier networks, NFC (Near Field Communication), or other technologies. The display screen can be an LCD screen or an e-ink screen. The input devices can be a touch layer covering the display screen, buttons, a trackball, or a touchpad on the computer device's casing, or an external keyboard, touchpad, or mouse.

[0135] This embodiment also provides a storage medium storing a computer program. When executed by a processor, the program implements the IoT cluster data analysis method based on big data and artificial intelligence as proposed in the above embodiments. The storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random Access Memory (SRAM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read Only Memory (EPROM), Programmable Red-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0136] In summary, this invention achieves high-fidelity modeling of the complex spatiotemporal dependencies of IoT clusters by constructing a dynamically updated spatiotemporal graph sequence and integrating the correlation between device physical proximity and operational status. Combined with a cloud-edge collaborative parameter synchronization mechanism, it enables the edge side to efficiently inherit the deep representation capabilities of the cloud under resource-constrained conditions. Utilizing self-supervised reconstruction and prediction tasks, it learns normal behavior patterns with generalization capabilities without manual annotation. Furthermore, it integrates multi-dimensional criteria such as classification confidence, reconstruction error, and prediction bias to construct a learnable anomaly scoring function, achieving accurate quantitative detection of unknown anomalies. Overall, this invention improves the accuracy, real-time performance, and interpretability of IoT cluster data analysis, effectively overcoming the shortcomings of existing methods such as static graph structure, reliance on labels, single criteria, and cloud-edge fragmentation.

[0137] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A data analysis method for IoT clusters based on big data and artificial intelligence, characterized in that: include, Collect multi-source heterogeneous data from each device node in the IoT cluster, preprocess the data, and then arrange and combine the preprocessed multi-source heterogeneous data to form a time-series structured feature sequence. Based on temporal structured feature sequences, a spatiotemporal graph sequence is constructed; The spatiotemporal graph sequence is used to initialize and synchronize the parameters of the edge-side feature encoding sub-model and the cloud-based spatiotemporal depth model to obtain a collaborative modeling parameter set. The structure of the edge-side feature encoding sub-model includes a graph convolutional layer, a temporal encoding layer, and a fully connected layer; The structure of the cloud-based spatiotemporal depth model includes multiple graph convolutional layers, multi-head self-attention layers, temporal convolutional layers, and nonlinear activation layers; Based on the collaborative modeling parameter set, a self-supervised reconstruction and prediction task is performed on the cloud-based spatiotemporal depth model to obtain a depth representation model; The anomaly detection model is obtained by learning anomaly pattern parameters using a deep representation model and constructing an anomaly scoring function. Specifically: Use a random number generation algorithm to assign initial values ​​to the abnormal mode parameters and obtain the initial abnormal mode parameters; Normal operating condition data of the IoT cluster is collected as normal samples, and abnormal operating condition data is collected as abnormal samples. The spatiotemporal graph sequences corresponding to the normal samples and abnormal samples are input into the depth representation model to perform forward calculation and obtain the depth representation vector. The initial anomaly mode parameters are used to perform a linear transformation and nonlinear activation on the depth representation vector to obtain the output vector. Calculate the difference between the output vector and normal and abnormal samples, and calculate the gradient information based on the difference using the backpropagation algorithm. Use the gradient information to update the initial abnormal mode parameters and obtain the final abnormal mode parameters. The final anomaly mode parameter is used to perform forward computation on the feature vector to obtain the classification result; Calculate the distance quantization value based on the depth representation vector output by the normal sample and the depth representation model; An anomaly scoring function is constructed using distance quantization, classification results, reconstruction error, and prediction error; The depth representation model, the final anomaly pattern parameters, and the anomaly scoring function are combined into an anomaly detection model. After receiving real-time multi-source heterogeneous data at the edge node, the anomaly detection model is used to perform state prediction and anomaly scoring calculation to obtain real-time anomaly scoring results.

2. The IoT cluster data analysis method based on big data and artificial intelligence as described in claim 1, characterized in that: The multi-source heterogeneous data includes sensor data, actuator data, control device data, and communication device data; The preprocessing includes time synchronization and feature normalization.

3. The IoT cluster data analysis method based on big data and artificial intelligence as described in claim 2, characterized in that: The arrangement and combination of preprocessed multi-source heterogeneous data refers to arranging the preprocessed multi-source heterogeneous data of each device node in the Internet of Things cluster according to time order and feature structure to form a time-series structured feature sequence.

4. The IoT cluster data analysis method based on big data and artificial intelligence as described in claim 3, characterized in that: The construction of the spatiotemporal graph sequence is specifically as follows: Based on the physical proximity between the device nodes in the IoT cluster, an initial topology is established between the device nodes. The initial topological structure is associated one by one with the feature data in the temporal structured feature sequence to form N spatiotemporal graphs; Calculate the correlation values ​​between device nodes in the IoT cluster based on the changes of the temporally structured feature sequence at different time steps; Based on the correlation values ​​between each device node, the initial topology connection weights in the N spatiotemporal graphs are updated, and then the N spatiotemporal graphs are arranged in chronological order to obtain the spatiotemporal graph sequence.

5. The IoT cluster data analysis method based on big data and artificial intelligence as described in claim 4, characterized in that: The process of initializing and synchronizing the edge-side feature encoding sub-model and the cloud-based spatiotemporal depth model using spatiotemporal graph sequences to obtain a collaborative modeling parameter set is as follows: After initializing the edge-side feature encoding sub-model and the cloud-based spatiotemporal depth model, the trainable parameters of the edge-side feature encoding sub-model and the cloud-based spatiotemporal depth model are updated using spatiotemporal graph sequences; The updated cloud-based spatiotemporal depth model trainable parameters are copied to the edge-side feature encoding sub-model, and all trainable parameters are extracted from the edge-side feature encoding sub-model as a co-modeling parameter set.

6. The IoT cluster data analysis method based on big data and artificial intelligence as described in claim 5, characterized in that: The process of training a cloud-based spatiotemporal depth model using a collaborative modeling parameter set through self-supervised reconstruction and prediction tasks to obtain a depth representation model is as follows: The spatiotemporal graph sequence is input into the cloud-based spatiotemporal depth model, which performs spatiotemporal feature extraction on the spatiotemporal graph sequence based on the collaborative modeling parameter set to obtain spatiotemporal feature representations. Using spatiotemporal feature representation, the feature data in the spatiotemporal graph sequence is reconstructed and the reconstruction error is calculated. Based on the reconstruction error, the parameters of the cloud spatiotemporal depth model are updated. After reconstruction, the spatiotemporal feature representation is used to predict the feature data in the spatiotemporal graph sequence and calculate the prediction error. Based on the prediction error, the trainable parameters in the cloud spatiotemporal depth model are updated. Reconstruction, prediction, and parameter updates are repeated according to the preset training rounds. After all training rounds are completed, the cloud-based spatiotemporal depth model is used as the depth representation model.

7. The IoT cluster data analysis method based on big data and artificial intelligence as described in claim 6, characterized in that: The calculated reconstruction error is specifically as follows: The spatiotemporal feature representation is input into the cloud-based spatiotemporal depth model, which performs a reverse mapping operation on the spatiotemporal feature representation to obtain the reconstructed data. The reconstructed data is compared and calculated element by element with the feature data in the spatiotemporal graph sequence to form the reconstruction error.

8. The IoT cluster data analysis method based on big data and artificial intelligence as described in claim 7, characterized in that: After receiving real-time multi-source heterogeneous data at the edge node, the anomaly detection model is used to perform state prediction and anomaly score calculation to obtain real-time anomaly score results, specifically as follows: After receiving real-time multi-source heterogeneous data at the edge node, the data is input into the depth representation model. The depth representation model performs forward propagation calculation on the real-time multi-source heterogeneous data to obtain real-time feature vectors. The final anomaly mode parameters are used to perform linear transformations and nonlinear activations on the real-time feature vectors to generate real-time classification results. The anomaly scoring function is used to weight the real-time feature vector and the real-time classification result to obtain the real-time anomaly score.

Images