A core set selection based operation and maintenance anomaly detection method and system

Abstract

The application provides an operation and maintenance anomaly detection method and system based on core set selection, the method comprising: collecting a plurality of operation and maintenance time sequence samples, taking each operation and maintenance time sequence sample as a spatial domain representation and respectively performing fast Fourier transform to obtain a corresponding frequency domain representation, inputting the frequency domain representation and the spatial domain representation into a teacher model and a student model to obtain an anomaly prediction distribution of the frequency domain and the spatial domain; calculating the JS divergence between the anomaly prediction distributions of the frequency domain and the spatial domain and weighting fusion as a dual-domain collaborative distillation score; selecting operation and maintenance time sequence samples with a dual-domain collaborative distillation score higher than a dynamic sparse gating threshold as a candidate set, constructing a diversity constraint, and selecting the first S operation and maintenance time sequence samples from the candidate samples satisfying the diversity constraint to form a core set; taking the core set as training data and the teacher model as a distillation source to train the student model, and deploying the trained student model to an edge device to perform local anomaly detection on input operation and maintenance time sequence data.

Description

Technical Field

[0001] This invention belongs to the field of operation and maintenance anomaly detection, specifically relating to an operation and maintenance anomaly detection method and system based on core set selection. Background Technology

[0002] With the continuous expansion of infrastructure such as data centers, power systems, and communication networks, anomaly detection in operations and maintenance (O&M) has become a crucial link in ensuring stable system operation. In practical applications, O&M data often contains a large amount of sensitive information, such as device operation logs and user access records. If this data is directly transmitted to the cloud, it not only poses a risk of privacy leakage but also leads to high network latency and bandwidth consumption. Therefore, deploying O&M anomaly detection models to edge devices to achieve localized real-time detection has become an important research direction.

[0003] When deploying an operation and maintenance anomaly detection models in edge computing environments, some studies have attempted to compress the models using methods such as core set selection and knowledge distillation to adapt to the resource constraints of edge devices.

[0004] While these existing technologies have addressed the resource adaptation issues for model deployment on edge devices to some extent, they still face multiple bottlenecks in practical applications. Edge devices are generally limited by computing and storage resources, making it difficult to support the traditional full-data + full-precision model training mode. This results in real-time performance and energy consumption failing to meet the stringent requirements of on-site operations and maintenance. Secondly, operational logs, monitoring metrics, alarm information, and other data often contain sensitive business details or user privacy. Directly uploading them to the cloud not only violates data compliance policies but may also introduce additional network latency and bandwidth pressure. Therefore, closed-loop processing must be completed locally. Existing core set selection and knowledge distillation methods mostly focus on static loss contribution or layer-by-layer alignment, neglecting the complementarity of time-series data in frequency and spatial domain representations, and failing to fully explore the adaptive suppression effect of sparse gating on quantization errors. Therefore, there is an urgent need for a lightweight training framework for operational and maintenance scenarios that balances privacy protection, computational efficiency, and detection accuracy while utilizing local data and local computation. Summary of the Invention

[0005] This invention proposes a method and system for detecting operational anomalies based on core set selection, which solves the problem of low computational efficiency and detection accuracy when deploying existing operational anomaly detection models in an edge computing environment.

[0006] To address the aforementioned technical problems, this invention provides a method for detecting operational anomalies based on core set selection, comprising the following steps:

[0007] Step S1: Collect operation and maintenance data of each device at fixed time intervals to form multiple operation and maintenance time series samples. Use each operation and maintenance time series sample as the original spatial domain representation and perform fast Fourier transform on each to obtain the corresponding frequency domain representation. Input the frequency domain representation and the original spatial domain representation into the full-precision dual-stream teacher model and the quantized dual-stream student model at the same time to obtain the anomaly prediction distribution in the frequency domain and spatial domain.

[0008] Step S2: Calculate the JS divergence between the anomaly prediction distributions in the frequency and spatial domains of the full-precision dual-stream teacher model and the quantized dual-stream student model, and then perform weighted fusion to obtain the dual-domain co-distillation score for the corresponding operation and maintenance time series sample. Sort all operation and maintenance time series samples in descending order of their dual-domain co-distillation scores.

[0009] Step S3: Introduce a dynamic sparse gating threshold, select operation and maintenance time series samples with dual-domain collaborative distillation scores higher than the dynamic sparse gating threshold as candidate sets, construct diversity constraints with the goal of uniform coverage of operation and maintenance time series samples in the three-dimensional space of time series shape, spectral energy and anomaly category, and select the first S operation and maintenance time series samples from the candidate samples that satisfy the diversity constraints to form the core set.

[0010] Step S4: Using the core set as training data and the full-precision dual-stream teacher model as the distillation source, train the quantized dual-stream student model, deploy the trained quantized dual-stream student model to the edge device, and perform local anomaly detection on the input operation and maintenance time series data.

[0011] Preferably, the expression for the dual-domain synergistic distillation score in step S2 is:

[0012] ;

[0013] In the formula, Scoring for dual-domain co-distillation; , For adaptive weights, ; , These represent the anomalous prediction distributions of the full-precision dual-stream teacher model in the frequency and spatial domains, respectively. , These represent the abnormal prediction distributions of the quantized dual-stream student model in the frequency and spatial domains, respectively. This indicates the calculation of JS divergence.

[0014] Preferably, the dynamic sparse gating threshold in step S3 is expressed as follows:

[0015] ;

[0016] In the formula, The threshold value is for dynamic sparse gating. This is the initial sparse gating threshold; This is the current training round; This refers to the total number of training rounds.

[0017] Preferably, the construction of diversity constraints in step S3 includes the following steps:

[0018] Step S31: Use a family of random projection functions based on cosine similarity as the locality-sensitive hash family:

[0019] ;

[0020] In the formula, For the first The hash value of sample x using a hash function; A random vector sampled from a standard Gaussian distribution; This indicates the calculation of cosine similarity;

[0021] Step S32: Allocate the operation and maintenance time series samples to different hash buckets according to the hash code. Each hash bucket represents a set of locally similar samples.

[0022] Step S33: Select one or more samples from each non-empty hash bucket according to the dual-domain collaborative distillation scoring priority principle.

[0023] Preferably, training the quantized dual-stream student model in step S4 includes the following steps:

[0024] Step S41: Introduce a learnable sparse gating factor into each convolutional or attention module of the quantized dual-stream student model;

[0025] Step S42: Induce the sparse gating factor using a pseudo-norm regularization term, and construct the total loss function based on the dual-domain cooperative distillation loss and the dynamic sparse regularization loss;

[0026] Step S43: Optimize the total loss function jointly using the gradient descent algorithm to achieve layer-by-layer adaptive channel-time axis sparsity control.

[0027] Preferably, the expression for the sparse gating factor in step S41 is:

[0028] ;

[0029] In the formula, It is a sparse gating factor; For the first Layer The scalar gating coefficients corresponding to each channel; express Pseudonorm.

[0030] Preferably, the expression for the total loss function in step S43 is:

[0031] ;

[0032] In the formula, This is the total loss function; Losses due to anomaly detection tasks; To balance the hyperparameters; Let l be the sparse gating factor vector of the l-th layer; express Pseudonorm.

[0033] Preferably, in step S4, after the trained quantized dual-stream student model is deployed to the edge device, the real-time resource budget of the edge device is monitored during runtime. Based on the comparison result between the real-time resource budget and a preset threshold, the threshold of the sparse gating factor is recalibrated online: when the real-time resource budget is greater than the preset threshold, the threshold of the sparse gating factor is increased to enhance sparsity; when the real-time resource budget is less than the preset threshold, the threshold of the sparse gating factor is decreased to recover more channels.

[0034] Preferably, the real-time resource budget is obtained by comprehensively evaluating the device's real-time CPU / GPU utilization, memory usage, and remaining power.

[0035] This invention also provides an operation and maintenance anomaly detection system based on core set selection, which is implemented based on the above-mentioned operation and maintenance anomaly detection method based on core set selection, including: an operation and maintenance time series sample acquisition module, a dual-domain collaborative distillation scoring module, a dynamic sparse core set construction module, a dynamic sparse gating training module, and an edge deployment module;

[0036] The operation and maintenance time series sample acquisition module: collects operation and maintenance data of each device at fixed time intervals to form multiple operation and maintenance time series samples;

[0037] The dual-domain collaborative distillation scoring module maps operation and maintenance time series samples to the frequency domain through fast Fourier transform while retaining the original spatial domain sequence, forming a frequency-space dual-domain parallel representation. It uses a full-precision dual-stream teacher model and a quantized dual-stream student model to predict the anomaly probability of the two representations respectively, calculates the JS divergence between the anomaly prediction distributions of the teacher-student model output in the frequency domain and the spatial domain, and performs weighted fusion according to adaptive weights to generate a dual-domain collaborative distillation score.

[0038] The dynamic sparse core set construction module introduces a dynamic sparse gating threshold, selects operation and maintenance time series samples with dual-domain collaborative distillation scores higher than the dynamic sparse gating threshold as candidate sets, constructs diversity constraints with the goal of uniform coverage of operation and maintenance time series samples in the three-dimensional space of time series shape, spectral energy and anomaly category, and selects the first S samples from the candidate samples that satisfy the diversity constraints to form the core set.

[0039] The dynamic sparse gating training module: uses the core set as training data and the full-precision dual-stream teacher model as the distillation source to train the quantized dual-stream student model;

[0040] The edge deployment module deploys the trained quantized dual-stream student model to edge devices and performs local anomaly detection on the input operation and maintenance time series data.

[0041] The beneficial effects of the present invention include at least the following:

[0042] 1. By processing operation and maintenance time series data in the frequency domain and spatial domain respectively, it is possible to capture the abnormal characteristics of the data more comprehensively. By using a full-precision dual-stream teacher model and a quantitative dual-stream student model to process frequency domain and spatial domain data simultaneously, the abnormal prediction distribution in the frequency domain and spatial domain can be obtained. This multi-domain fusion approach helps to locate anomalies more accurately and reduce misjudgments and missed judgments.

[0043] 2. Calculate the JS divergence in the frequency domain and spatial domain and weightedly fuse it as a dual-domain collaborative distillation score. Based on this score, select operation and maintenance time series samples, which can improve the quality of core set samples, so that the training process can focus more on representative and key samples, improve training efficiency, and avoid over-processing of redundant or low-value samples.

[0044] 3. By introducing a dynamic sparse gating threshold, appropriate operation and maintenance time series samples can be dynamically selected as candidate sets. Compared with fixed screening criteria, the dynamic sparse gating threshold can better adapt to different operation and maintenance scenarios and changes in data distribution. At the same time, the core set is selected from the candidate samples based on the uniform coverage target in three-dimensional space to ensure that the core set has good representativeness in multiple dimensions such as time series shape, spectral energy and anomaly category. This helps to improve the generalization ability of the model and avoid the model overfitting to specific types of samples. Attached Figure Description

[0045] Figure 1 This is a schematic diagram of the method flow according to an embodiment of the present invention;

[0046] Figure 2 This is a schematic diagram illustrating the dual-domain synergistic distillation and dynamic sparse gating principle of an embodiment of the present invention;

[0047] Figure 3 This is a schematic diagram of the system structure according to an embodiment of the present invention. Detailed Implementation

[0048] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the protection scope of the present invention.

[0049] like Figure 1 As shown, this embodiment of the invention provides a method for detecting operational anomalies based on core set selection, including the following steps:

[0050] Step S1: Collect operation and maintenance data from each device at fixed time intervals to form multiple operation and maintenance time series samples. Use each operation and maintenance time series sample as the original spatial domain representation and perform a Fast Fourier Transform to obtain the corresponding frequency domain representation. Input the frequency domain representation and the original spatial domain representation into the full-precision dual-stream teacher model and the quantized dual-stream student model simultaneously to obtain the anomaly prediction distribution in the frequency domain and spatial domain. This includes the following steps:

[0051] Step S11: Collect operation and maintenance data of each device at fixed time intervals to form multiple operation and maintenance time series samples. The operation and maintenance data includes time series data such as device operation logs, monitoring indicators and alarm information, forming the original spatial domain representation.

[0052] Step S12: Perform a Fast Fourier Transform (FFT) on the input operation and maintenance time series samples to map them to the frequency domain and form a frequency domain representation;

[0053] Step S13: Input the frequency domain representation and the original spatial domain representation into the full-precision two-stream teacher model and the quantized two-stream student model, respectively. The full-precision two-stream teacher model uses uncompressed high-precision parameters, while the quantized two-stream student model undergoes low-bit quantization to reduce computational overhead. The full-precision two-stream teacher model outputs the frequency domain anomaly prediction distribution. and spatial anomaly prediction distribution Quantize the frequency domain anomaly prediction distribution corresponding to the output of the dual-stream student model. and spatial anomaly prediction distribution .

[0054] Step S2: Calculate and weight the JS divergence between the anomaly prediction distributions in the frequency and spatial domains of the full-precision dual-stream teacher model and the quantized dual-stream student model, and fuse them as the dual-domain co-distillation score for the corresponding operation and maintenance time series sample. Sort all operation and maintenance time series samples in descending order of dual-domain co-distillation score, including the following steps:

[0055] Step S21: Calculate the Jensen–Shannon divergence in the frequency domain Jensen–Shannon divergence in the spatial domain JS divergence is used to measure the difference between the model predictions of teachers and students.

[0056] Step S22: Weight the two divergences using adaptive weights α and β to obtain the dual-domain collaborative distillation score:

[0057] ;

[0058] In the formula, Scoring for dual-domain co-distillation; In the initial stage, initial values ​​are determined through grid search or meta-learning strategies. During training, α and β are dynamically updated according to the relative gradient changes of the distillation loss in the frequency domain and spatial domain, so as to balance the contribution of the features in the two domains to the distillation target. This indicates the calculation of JS divergence.

[0059] Step S23: Establish an operation and maintenance time series sample-dual domain collaborative distillation score mapping relationship for each operation and maintenance time series sample. High-scoring samples indicate that the student model is difficult to fit the teacher's prediction and has a high information contribution.

[0060] Step S24: Based on the dual-domain collaborative distillation score, sort all operation and maintenance time series samples in descending order of score to form an ordered sample list. The sorting process can use the quicksort algorithm to ensure efficiency.

[0061] Step S3: Introduce a dynamic sparse gating threshold. Select operation and maintenance time series samples with a dual-domain collaborative distillation score higher than the dynamic sparse gating threshold as the candidate set. Construct diversity constraints with the goal of uniform coverage of operation and maintenance time series samples in the three-dimensional space of time series shape, spectral energy, and anomaly category. Select the top S samples from the candidate samples that meet the diversity constraints to form the core set. This includes the following steps:

[0062] Step S31: Introduce a dynamic sparse gating threshold The threshold decreases linearly with each training epoch. Initially, a high threshold is maintained to filter out challenging samples and avoid overfitting. Later, the threshold is lowered to increase sample diversity. The dynamic sparse gating threshold is calculated. The expression is:

[0063] ;

[0064] In the formula, For dynamic sparse gating threshold; This is the initial sparse gating threshold; This is the current training round; This refers to the total number of training rounds.

[0065] Step S32: Select samples with scores higher than the ordered sample list. The samples are used as a candidate set, the size of which can be dynamically adjusted, while a preset upper limit is set to avoid resource overflow.

[0066] Step S33: Introduce Locality Sensitive Hash (LSH) driven diversity constraints to the candidate set to ensure uniform coverage of samples in the three-dimensional space of temporal shape, spectral energy, and anomaly category.

[0067] The LSH hash family employs a family of random projection functions based on cosine similarity:

[0068] ;

[0069] In the formula, For the first The hash value of sample x using a hash function; A random vector sampled from a standard Gaussian distribution; This indicates the calculation of cosine similarity.

[0070] After the samples are mapped, the operation and maintenance time series samples are allocated to different buckets according to the hash code. Each bucket represents a type of locally similar samples. The system selects one or more samples from each non-empty bucket according to the scoring priority principle to ensure that the core set has a balanced distribution of spectral energy, time series shape and anomaly category globally, and to prevent excessive concentration of similar samples.

[0071] Step S34: Select the top S samples from the candidate samples that meet the diversity constraints, where S is the preset core set size, to form the core set. The core set needs to be updated regularly to adapt to changes in data distribution.

[0072] Step S4: Using the core set as training data and the full-precision dual-stream teacher model as the distillation source, train the quantized dual-stream student model. Deploy the trained quantized dual-stream student model to edge devices and perform local anomaly detection on the input operation and maintenance time-series data. The specific implementation includes the following sub-steps:

[0073] Step S41: Using the constructed core set as training data, load the full-precision dual-stream teacher model as the distillation source, initialize the quantized dual-stream student model, with its parameters represented using low-bit representation, and introduce a learnable sparse gating factor for each convolutional layer or attention module. , where C is the number of channels.

[0074] Step S42: Use The pseudo-norm regularization term induces a sparse gating factor, and the total loss function is constructed based on the bi-domain cooperative distillation loss and the dynamic sparse regularization loss.

[0075] The expression for the total loss function is:

[0076] ;

[0077] ;

[0078] In the formula, This is the total loss function; Losses due to anomaly detection tasks; To balance the hyperparameters; Let l be the sparse gating factor vector of the l-th layer; For the first Layer The scalar gating coefficients corresponding to each channel; express Pseudonorm.

[0079] Compared to the conventional norm or Norm, In gradient optimization, pseudonorms can produce a stronger sparsity-induced effect and have a higher penalty for channels with small activations, thereby prompting unimportant channels to approach zero faster during training, achieving sparsity adaptive convergence and dynamic compression of model structure.

[0080] Step S43: The total loss function is jointly optimized using the gradient descent algorithm. During training, the sparse gating factor is dynamically adjusted to make the activation of unimportant channels approach zero, thereby achieving channel-time axis sparse control. The number of optimization rounds can be set according to the convergence situation, and the learning rate adopts an exponential decay strategy.

[0081] Step S44: The quantized dual-stream student model and its sparse gating parameters are encapsulated into a lightweight inference engine and serialized using formats such as ONNX or TensorRT. The model structure and sparse gating parameters are exported together as a unified inference file, which can be directly loaded and executed on edge devices through a lightweight inference framework. The encapsulation process includes model structure solidification, parameter quantization verification, and inference code generation, ensuring that the engine can run efficiently on resource-constrained devices.

[0082] Step S45: Deploy the packaged model to the edge device. During deployment, the device hardware needs to be adapted, and environmental isolation is achieved through a lightweight container.

[0083] Step S46: During runtime, monitor the real-time resource budget of the edge device. Based on real-time resource budget With preset threshold The comparison results show that the threshold for online recalibration of the sparse gating factor is:

[0084] When the real-time resource budget exceeds the preset threshold When the real-time resource budget is less than a preset threshold, the threshold of the sparsity gating factor is increased to enhance sparsity; when the real-time resource budget is less than a preset threshold, the threshold of the sparsity gating factor is increased. At this time, the threshold of the sparse gating factor is lowered to recover more channels.

[0085] The real-time resource budget is obtained by comprehensively evaluating the device's real-time CPU / GPU utilization, memory usage, and remaining power.

[0086] Step S47: Perform local anomaly detection on the input operation and maintenance time series data. All processing is completed on the edge device without data upload. The detection results can be output as alarms or logs in real time, supporting closed-loop operation and maintenance management.

[0087] like Figure 2 As shown, co-distillation of frequency and spatial domain two-stream networks can improve the quality of the core set, and the dynamic sparse gating factor can suppress the propagation of quantization error by adjusting the channel-time axis activation in real time. Specifically, the Jensen-Shannon divergence calculated during the two-domain co-distillation process reflects the learning difficulty of the student network on different samples. The larger the divergence, the more significant the differences in knowledge transfer between samples and the higher the information content. In the core set selection stage, samples are ranked according to this distillation score, and high-divergence samples are preferentially selected into the core set, thus making the core set more concentrated on samples with significant differences in teacher-student model predictions and the greatest contribution to model generalization.

[0088] like Figure 3 As shown, this embodiment of the invention also provides an operation and maintenance anomaly detection system based on core set selection, which is implemented based on the above-mentioned operation and maintenance anomaly detection method based on core set selection, including: operation and maintenance time series sample collection module, dual-domain collaborative distillation scoring module, dynamic sparse core set construction module, dynamic sparse gating training module and edge deployment module;

[0089] Operation and maintenance time series sample collection module: Collects operation and maintenance data of each device at fixed time intervals to form multiple operation and maintenance time series samples.

[0090] Dual-domain collaborative distillation scoring module: The operation and maintenance time series samples are mapped to the frequency domain through Fast Fourier Transform, while the original spatial domain sequence is preserved, forming a frequency-space dual-domain parallel representation. The anomaly probability is predicted for the two representations by a full-precision dual-stream teacher model and a quantized dual-stream student model, respectively. The JS divergence between the anomaly prediction distributions of the teacher-student model output in the frequency domain and the spatial domain is calculated, and the results are weighted and fused according to adaptive weights to generate a dual-domain collaborative distillation score.

[0091] Dynamic Sparse Core Set Construction Module: After obtaining the dual-domain collaborative distillation score, this module first sorts all operation and maintenance time series samples in descending order of score, introduces a dynamic sparse gating threshold that decays dynamically with the training round t, and gradually relaxes the selection criteria to avoid early overfitting and ensure diversity in the later stages. Furthermore, it introduces diversity constraints driven by locality-sensitive hashing to ensure uniform coverage of the core set in the three-dimensional space of time series shape, spectral energy, and anomaly category. Operation and maintenance time series samples with dual-domain collaborative distillation scores higher than the dynamic sparse gating threshold are selected as candidate sets. Diversity constraints are constructed with the goal of uniform coverage of operation and maintenance time series samples in the three-dimensional space of time series shape, spectral energy, and anomaly category. The top S samples that meet the diversity constraints are selected to form the core set.

[0092] Dynamic sparse gating training module: Using the core set as training data and the full-precision dual-stream teacher model as the distillation source, it introduces a learnable sparse gating factor into each convolutional kernel or multi-head attention head of the quantized dual-stream student model. Its value is from The pseudo-norm regularization term is adaptively driven, which can remove channel-time axis activations that contribute little to the anomaly detection task in real time during training. Through dual Jensen-Shannon distillation loss in the frequency and spatial domains, the feature distribution of the teacher-student model output is aligned layer by layer.

[0093] Edge Deployment Module: Encapsulates the quantized dual-stream student model and its sparse gating parameters into a lightweight inference engine that can run on resource-constrained devices. The engine supports runtime recalibration: It calculates comprehensive resource metrics in real time based on runtime resource budgets such as current CPU / GPU utilization, memory usage, and remaining device power. and with preset threshold Compare.

[0094] when At that time, the system automatically increases the sparse gating factor. The threshold is used to increase sparsity and reduce computational cost; when When this happens, the system lowers the threshold to restore more channel activation, thereby improving detection accuracy. This adjustment process can be performed once every fixed period by a lightweight monitoring module to achieve a dynamic balance between latency and accuracy.

[0095] In summary, the embodiments of the present invention fully exploit the complementary information of time series data in terms of periodic global features and transient local features through frequency-spatial dual-domain collaborative distillation, so that the core set has high representativeness and high discriminative power in the three-dimensional space of anomaly category, time domain shape and spectral energy.

[0096] Dynamic sparse gating mechanisms learnable gating factors and... Pseudo-norm regularization enables adaptive and structured suppression of quantization errors; during the inference phase, runtime recalibration provides edge devices with latency-precision elastic adjustment capabilities.

[0097] The end-to-end local design ensures that everything from core set selection and model retraining to final inference is completed locally on the edge nodes. Sensitive data such as original operation and maintenance logs, monitoring metrics, and alarm information do not need to be uploaded to the cloud or third-party servers, completely eliminating data leakage and compliance risks.

[0098] The technical features of the above embodiments can be combined arbitrarily. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described; only preferred embodiments of the present invention are illustrated. The descriptions are relatively specific and detailed, but they should not be construed as limiting the scope of the present invention. As long as the combination of these technical features does not contradict each other, it should be considered within the scope of this specification.

[0099] It should be noted that those skilled in the art can make various modifications and improvements without departing from the inventive concept, and these all fall within the scope of protection of this invention. Therefore, the scope of protection of this invention should be determined by the appended claims.

Claims

1. A method for detecting operational anomalies based on core set selection, characterized in that: Includes the following steps: Step S1: Collect operation and maintenance data of each device at fixed time intervals to form multiple operation and maintenance time series samples. Use each operation and maintenance time series sample as the original spatial domain representation and perform fast Fourier transform to obtain the corresponding frequency domain representation. Input the frequency domain representation and the original spatial domain representation into the full-precision dual-stream teacher model and the quantized dual-stream student model respectively to obtain the anomaly prediction distribution in the frequency domain and spatial domain. Step S2: Calculate and weight the JS divergence between the anomaly prediction distributions of the full-precision dual-stream teacher model and the quantized dual-stream student model in the frequency and spatial domains, and fuse them as the dual-domain collaborative distillation score for the corresponding operation and maintenance time series sample. Sort all operation and maintenance time series samples in descending order of the dual-domain collaborative distillation score; the expression for the dual-domain collaborative distillation score is: ； In the formula, Scoring for dual-domain co-distillation; , For adaptive weights, During training, α and β are dynamically updated based on the relative gradient changes of the distillation loss in the frequency domain and the spatial domain. , These represent the anomalous prediction distributions of the full-precision dual-stream teacher model in the frequency and spatial domains, respectively. , These represent the abnormal prediction distributions of the quantized dual-stream student model in the frequency and spatial domains, respectively. This indicates the calculation of JS divergence; Step S3: Introduce a dynamic sparse gating threshold. Select operation and maintenance time series samples with dual-domain collaborative distillation scores higher than the dynamic sparse gating threshold as a candidate set. Construct diversity constraints with the goal of uniform coverage of operation and maintenance time series samples in the three-dimensional space of time series shape, spectral energy, and anomaly category. Select the top S operation and maintenance time series samples that satisfy the diversity constraints to form a core set. The dynamic sparse gating threshold is expressed as: ； In the formula, For dynamic sparse gating threshold; This is the initial sparse gating threshold; This is the current training round; Total number of training rounds; Constructing diversity constraints includes the following steps: Step S31: Use a family of random projection functions based on cosine similarity as the locality-sensitive hash family: ； In the formula, For the first The hash value of sample x using a hash function; A random vector sampled from a standard Gaussian distribution; This indicates the calculation of cosine similarity; Step S32: Allocate the operation and maintenance time series samples to different hash buckets according to the hash code. Each hash bucket represents a set of locally similar samples. Step S33: Select one or more samples from each non-empty hash bucket according to the scoring priority principle of dual-domain collaborative distillation; Step S4: Using the core set as training data and the full-precision dual-stream teacher model as the distillation source, train the quantized dual-stream student model, deploy the trained quantized dual-stream student model to the edge device, and perform local anomaly detection on the input operation and maintenance time series data.

2. The method for detecting operational anomalies based on core set selection according to claim 1, characterized in that: Step S4 involves training the quantized dual-stream student model, including the following steps: Step S41: Introduce a learnable sparse gating factor into each convolutional or attention module of the quantized dual-stream student model; Step S42: Induce the sparse gating factor using a pseudo-norm regularization term, and construct the total loss function based on the dual-domain cooperative distillation loss and the dynamic sparse regularization loss; Step S43: Optimize the total loss function jointly using the gradient descent algorithm to achieve layer-by-layer adaptive channel-time axis sparsity control.

3. The method for detecting operational anomalies based on core set selection according to claim 2, characterized in that: The expression for the sparse gating factor in step S41 is: ； In the formula, It is a sparse gating factor; For the first Layer The scalar gating coefficients corresponding to each channel; express Pseudonorm.

4. The operation and maintenance anomaly detection method based on core set selection according to claim 2, characterized in that: The expression for the total loss function mentioned in step S43 is: ； In the formula, This is the total loss function; Losses due to anomaly detection tasks; To balance the hyperparameters; Let l be the sparse gating factor vector of the l-th layer; express Pseudonorm.

5. The operation and maintenance anomaly detection method based on core set selection according to claim 2, characterized in that: In step S4, after the trained quantized dual-stream student model is deployed to the edge device, the real-time resource budget of the edge device is monitored during runtime. Based on the comparison result between the real-time resource budget and the preset threshold, the threshold of the sparse gating factor is recalibrated online: when the real-time resource budget is greater than the preset threshold, the threshold of the sparse gating factor is increased to enhance sparsity. When the real-time resource budget is less than a preset threshold, the threshold of the sparse gating factor is reduced to restore more channels.

6. The operation and maintenance anomaly detection method based on core set selection according to claim 5, characterized in that: The real-time resource budget is obtained by comprehensively evaluating the device's real-time CPU / GPU utilization, memory usage, and remaining power.

7. A system for detecting operational anomalies based on core set selection, implemented based on the operational anomaly detection method based on core set selection as described in any one of claims 1-6, characterized in that, include: The module includes an operation and maintenance time series sample acquisition module, a dual-domain collaborative distillation scoring module, a dynamic sparse core set construction module, a dynamic sparse gating training module, and an edge deployment module. The operation and maintenance time series sample acquisition module: collects operation and maintenance data of each device at fixed time intervals to form multiple operation and maintenance time series samples; The dual-domain collaborative distillation scoring module maps operation and maintenance time series samples to the frequency domain through fast Fourier transform while retaining the original spatial domain sequence, forming a frequency-space dual-domain parallel representation. It uses a full-precision dual-stream teacher model and a quantized dual-stream student model to predict the anomaly probability of the two representations respectively, calculates the JS divergence between the anomaly prediction distributions of the teacher-student model output in the frequency domain and the spatial domain, and performs weighted fusion according to adaptive weights to generate a dual-domain collaborative distillation score. The dynamic sparse core set construction module introduces a dynamic sparse gating threshold, selects operation and maintenance time series samples with dual-domain collaborative distillation scores higher than the dynamic sparse gating threshold as candidate sets, constructs diversity constraints with the goal of uniform coverage of operation and maintenance time series samples in the three-dimensional space of time series shape, spectral energy and anomaly category, and selects the first S samples from the candidate samples that satisfy the diversity constraints to form the core set. The dynamic sparse gating training module: uses the core set as training data and the full-precision dual-stream teacher model as the distillation source to train the quantized dual-stream student model; The edge deployment module deploys the trained quantized dual-stream student model to edge devices and performs local anomaly detection on the input operation and maintenance time series data.

Images