Lightweight time series data anomaly detection method and system based on edge collaboration

Abstract

The invention discloses an edge-collaborative lightweight time series data anomaly detection method and system, and belongs to the technical field of data processing, and the method comprises the steps: obtaining a network parameter, transmitting the network parameter to an edge device, carrying out the fine adjustment of the network parameter, generating a lightweight localized feature extractor, carrying out the dynamic feature calibration, obtaining a weight matrix, and carrying out the dynamic feature calibration. Transmitting the plurality of weight matrixes to a central server, aggregating the plurality of weight matrixes to obtain an aggregated matrix, and updating the lightweight general feature extraction network; and processing the real-time time sequence data to obtain a real-time feature vector, calibrating the real-time feature vector based on the aggregation matrix to obtain a calibrated feature vector, performing anomaly diagnosis, and generating an anomaly detection result. According to the method, a collaborative mechanism that local data are processed at an edge device end, a weight matrix is uploaded, global knowledge is aggregated, and then the aggregated global knowledge is fed back to an edge for calibration is adopted, so that efficient and accurate time sequence anomaly detection can be realized on the basis of ensuring data privacy security.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data processing, and in particular to an edge collaborative lightweight time series data anomaly detection method and system. BACKGROUND

[0002] Time series data anomaly detection is a core technology for ensuring the safe and stable operation of industrial Internet of Things, intelligent manufacturing, critical infrastructure and other fields. It identifies occasional events that deviate from normal behavior patterns by analyzing continuous data streams generated by sensors and other devices. With the rise of edge computing, it is an important development direction to sink intelligent analysis capabilities to edge devices at the data source to achieve low-latency, high-reliability real-time detection. However, it is crucial to ensure the security and privacy of device data during this process.

[0003] In related technologies, the Chinese invention patent with publication number CN119577841A discloses a medical data privacy protection method and system based on artificial intelligence, which includes feature analysis of medical data, establishment of a scoring matrix, generation of a privacy risk assessment result, division of a security domain, and establishment of a distributed collaboration mechanism using federated learning. The data is preprocessed at the local node, a deep neural network model is constructed, gradient information is encrypted using a dynamic key matrix, and distributed aggregation operations and verification are performed. A data privacy protection scheme is formed. Identity verification and anomaly detection are performed on access requests, and access granularity is dynamically adjusted.

[0004] For the related technologies in the above, the inventors believe that although the above-mentioned scheme uses federated learning and encryption technology, it lacks optimization processing for specific data types such as high-frequency time series data generated by industrial devices, and does not deeply explore its efficient analysis. It also does not fully consider the lightweight requirements of edge computing, such as model parameter transmission bandwidth and edge device computing burden, which may lead to insufficient efficiency. At the same time, it mainly focuses on data privacy and access control, rather than real-time intelligent anomaly analysis of the data itself, and anomaly detection focuses more on access behavior rather than data state. SUMMARY

[0005] To solve the above problems, the present application provides an edge collaborative lightweight time series data anomaly detection method and system, which adopts a collaborative mechanism of processing local data at the edge device end and uploading only an abstract weight matrix, and then feeding back to the edge after the central server aggregates global knowledge for calibration. This can achieve efficient and accurate time series anomaly detection while ensuring that the original data does not leave the local area and protecting data privacy and security.

[0006] The above-mentioned object can be achieved by the following scheme: An edge collaborative lightweight time series data anomaly detection method and system, comprising: obtaining network parameters of a lightweight general feature extraction network in a central server, and distributing the network parameters to edge devices; fine-tuning the received network parameters using local time series data on the edge devices, generating a lightweight localized feature extractor, and dynamically calibrating the local time series data to obtain a weight matrix; uploading the weight matrix to the central server, the central server aggregating the weight matrices from multiple edge devices to obtain an aggregated matrix, and updating the lightweight general feature extraction network using the aggregated matrix; obtaining real-time time series data, processing the real-time time series data using the lightweight localized feature extractor on the edge devices to obtain a real-time feature vector, and calibrating the real-time feature vector based on the aggregated matrix to obtain a calibrated feature vector; performing anomaly diagnosis based on the calibrated feature vector to generate an anomaly detection result.

[0007] Optionally, the obtaining network parameters of a lightweight general feature extraction network in a central server comprises: constructing a lightweight general feature extraction network in a central server, jointly training the lightweight general feature extraction network based on local time series data of multiple edge devices to obtain initial network parameters containing low-level parameters and high-level parameters; performing hierarchical compression and encoding on the initial network parameters according to real-time communication quality and load of each edge device to generate a lightweight parameter set; distributing the lightweight parameter set to each edge device through an encrypted link, and performing parameter decoding and structure recovery to generate network parameters.

[0008] Optionally, the performing hierarchical compression and encoding on the initial network parameters to generate a lightweight parameter set comprises: constructing a dynamic compression strategy table based on real-time communication quality and load of each edge device; performing differential compression on the initial network parameters according to the dynamic compression strategy table, including using sparsification pruning on the low-level parameters and using low-rank decomposition and quantization encoding on the high-level parameters to obtain compressed parameters; performing entropy encoding and difference encoding on the compressed parameters to generate a lightweight parameter set.

[0009] Optionally, the generating a lightweight localized feature extractor comprises: extracting common features of the local time series data using the lightweight general feature extraction network to obtain an initial feature representation; adjusting the network parameters based on the initial feature representation and the local time series data to generate a lightweight localized feature extractor.

[0010] Optionally, the obtaining the weight matrix comprises: inputting the local time series data into the lightweight local feature extractor to extract a plurality of groups of feature maps; for each group of the feature maps, calculating a change gradient and an information entropy on a time series; and fusing and normalizing the change gradient and the information entropy through an unsupervised attention generation process to obtain the weight matrix.

[0011] Optionally, the fusing and normalizing the change gradient and the information entropy through the unsupervised attention generation process to obtain the weight matrix comprises: for each group of the feature maps, constructing a two-dimensional dynamic importance space with the change gradient on the time series as a first dimension and the information entropy as a second dimension; in the dynamic importance space, calculating a vector distance from a coordinate point corresponding to each of the feature maps to a space origin as an initial attention value; and performing exponential processing and global normalization on the initial attention values of all the feature maps to generate attention scores and combine and arrange the attention scores to form the weight matrix.

[0012] Optionally, the updating the lightweight general feature extraction network using the aggregation matrix comprises: evaluating an information amount and a discrete degree of each of the weight matrices to obtain a set of credibility scores; based on the set of credibility scores, performing similarity calculation and clustering integration analysis between the weight matrices to obtain an aggregation matrix; performing element-by-element interaction between the aggregation matrix and output features of the lightweight general feature extraction network to generate feature enhancement representations; and based on the feature enhancement representations, iteratively optimizing connection weights in the lightweight general feature extraction network to realize global adjustment of network parameters.

[0013] Optionally, the obtaining the calibrated feature vector comprises: performing noise suppression and length regularization processing on the real-time time series data to obtain regularized time series data; inputting the regularized time series data into the lightweight local feature extractor to extract a feature representation with time series dependence and generate a real-time feature vector; according to importance of each dimension feature in the real-time feature vector, selecting a corresponding weight distribution from the aggregation matrix, and performing dimension-by-dimension weighting adjustment on the real-time feature vector to obtain a weighted feature representation; and performing distribution alignment and stability enhancement processing on the weighted feature representation to obtain a calibrated feature vector.

[0014] The generating the anomaly detection result comprises: maintaining a dynamically updated normal behavior feature summary on the edge device, the normal behavior feature summary being composed of a sliding centroid of recent calibrated feature vectors; calculating a Mahalanobis distance between the current calibrated feature vector and the dynamic normal behavior summary; and when the Mahalanobis distance exceeds a preset adaptive quantile, determining that an abnormal event occurs and generating an anomaly detection result.

[0015] Based on the same inventive concept, the application also provides an edge-coordinated lightweight time series data anomaly detection system, comprising: a parameter issuing module, configured to obtain network parameters of a lightweight general feature extraction network in a central server and issue the network parameters to an edge device; a local fine-tuning module, configured to fine-tune the received network parameters using local time series data on the edge device, generate a lightweight localized feature extractor, and dynamically calibrate features of the local time series data to obtain a weight matrix; a weight aggregation module, configured to upload the weight matrix to the central server, aggregate the weight matrices from multiple edge devices to obtain an aggregated matrix, and update the lightweight general feature extraction network using the aggregated matrix; a feature calibration module, configured to obtain real-time time series data, process the real-time time series data using the lightweight localized feature extractor on the edge device to obtain a real-time feature vector, and calibrate the real-time feature vector based on the aggregated matrix to obtain a calibrated feature vector; and an anomaly diagnosis module, configured to perform anomaly diagnosis based on the calibrated feature vector to generate an anomaly detection result.

[0016] Compared with the prior art, the application has the following advantages: 1. The application realizes efficient and accurate anomaly detection while ensuring data privacy and security. First, feature extraction and model fine-tuning of local data are completed on the edge device, and only abstract weight matrices are uploaded to the central server, reducing the transmission and centralized storage of raw sensitive time series data, and fundamentally reducing the risk of data leakage in the transmission link and the cloud, effectively protecting the data privacy and security of users.

[0017] 2. The application improves the adaptability and accuracy of the anomaly detection model. After fine-tuning of the general model on the edge device, it can better adapt to the unique operating conditions and environmental characteristics of each device. At the same time, the aggregation matrix that integrates global knowledge is used to calibrate local real-time features, so that the detection decision takes into account both local specificity and global universality, effectively suppressing the interference of local noise and improving the recognition ability of complex abnormal patterns.

[0018] 3. The application constructs a lightweight and efficient collaborative intelligent system. Layered compression coding technology reduces the communication overhead of model issuing, and the design of uploading only lightweight weight matrices also saves uplink bandwidth. This two-way lightweight interaction enables the system to be quickly deployed and iterated in resource-constrained edge networks, achieving low-cost, efficient system operation and performance upgrade.

[0019] Other features and advantages of the present application will be set forth in the descriptions that follow, and in part will be apparent from the description, or can be learned by practice of the application. The purposes and other advantages of the present application will be realized and attained by the structures particularly pointed out in the written description and claims hereof as well as the appended drawings. BRIEF DESCRIPTION OF DRAWINGS

[0020] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or the prior art description. Obviously, the drawings described below are only some embodiments of the present application, and the person skilled in the art can obtain other drawings according to these drawings without any creative effort.

[0021] Figure 1 is a flow diagram of an edge collaborative lightweight time series data anomaly detection method according to an embodiment of the present application.

[0022] Figure 2 is a model lightweight and distribution efficiency data comparison diagram according to an embodiment of the present application.

[0023] Figure 3 is a lightweight localization feature extractor fine-tuning process diagram according to an embodiment of the present application.

[0024] Figure 4 is a Mahalanobis distance anomaly diagnosis diagram according to an embodiment of the present application.

[0025] Figure 5 is a structure diagram of an edge collaborative lightweight time series data anomaly detection system according to an embodiment of the present application. DETAILED DESCRIPTION

[0026] In order to make the purposes, technical solutions and advantages of the embodiments of the present application clearer, the following will combine the drawings in the embodiments of the present application to make a clear and complete description of the technical solutions in the embodiments of the present application. Obviously, the described embodiments are some of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by the person skilled in the art without any creative effort are within the protection scope of the present application.

[0027] With reference to Figure 1 , one embodiment of the present application proposes an edge collaborative lightweight time series data anomaly detection method, which adopts a collaborative mechanism of processing local data at the edge device end and uploading only an abstract weight matrix, and then feeding back to the edge after the central server aggregates global knowledge for calibration, so as to realize efficient and accurate time series anomaly detection on the basis of ensuring that the original data does not leave the local and guaranteeing data privacy and security.

[0028] The method of the embodiment specifically comprises: Obtaining network parameters of the lightweight general feature extraction network in the central server and distributing to the edge devices; Optionally, the obtaining network parameters of the lightweight general feature extraction network in the central server comprises: Constructing a lightweight general feature extraction network in the central server, jointly training the lightweight general feature extraction network based on local time series data of multiple edge devices to obtain initial network parameters containing low-level parameters and high-level parameters; According to the real-time communication quality and load of each edge device, performing layered compression and encoding on the initial network parameters to generate a lightweight parameter set; Distributing the lightweight parameter set to each edge device through an encrypted link and performing parameter decoding and structure recovery to generate network parameters.

[0029] Specifically, the process first constructs a lightweight general feature extraction network in the central server. The lightweight general feature extraction network can use a deep learning architecture that integrates one-dimensional convolution and long short-term memory units to effectively capture local patterns and long-term dependencies in time series data, and is optimized for high-frequency time series data types. Subsequently, the central server collects local time series data from multiple edge devices, which cover normal operating states under different working conditions. Using these diverse data, the lightweight general feature extraction network is jointly trained to minimize prediction error or reconstruction error, so that the lightweight general feature extraction network can learn cross-device universal features. After training, the obtained initial network parameters are logically divided into low-level parameters and high-level parameters. The low-level parameters correspond to the layers close to the input end of the network, responsible for efficiently extracting basic time series patterns; while the high-level parameters correspond to the deep layers of the network, used to combine low-level features to form more abstract and complex representations, realizing deep analysis of time series data. Then, in order to adapt to the heterogeneous computing and communication environment of the edge, the initial network parameters need to be lightweight. The central server will monitor the communication quality of each edge device, such as bandwidth and delay, as well as the computing load of the device itself. Based on these dynamic information, layered compression and encoding are performed on the initial network parameters. This strategy is not a one-size-fits-all approach, but rather a differentiated approach to handling parameters at different levels to maximize model performance. Finally, the generated lightweight parameter set is securely distributed to each edge device through an encrypted link, such as a channel that deploys the Transport Layer Security protocol. After receiving the lightweight parameter set, the edge device performs corresponding parameter decoding and structure recovery operations to obtain network parameters that can be directly used locally.

[0030] Exemplarily, a company has a central server and three CNC machine edge devices A, B and C located in different factories, which are used to obtain network parameters of a lightweight general feature extraction network in the central server. First, a lightweight general feature extraction network is constructed in the central server, which has a structure of a deep learning architecture including two one-dimensional convolution layers and a long short-term memory unit (LSTM) layer. The architecture is specially designed for processing high-frequency time series data and can efficiently extract dynamic features thereof. The central server collects vibration, current and temperature three-axis local time series data from devices A, B and C during normal operation in the past three months, totaling about 500 GB. The lightweight general feature extraction network is jointly trained using these local time series data, and the training target is to minimize the reconstruction error of an autoencoder. After 50 cycles of iterative training, an initial network parameter set containing 6.5M parameters is obtained. In the initial network parameter set, the weights of the two one-dimensional convolution layers are defined as low-level parameters, which are responsible for capturing high-frequency and local patterns in the time series data; and the weights of the LSTM layer and the subsequent fully connected layer are defined as high-level parameters, which are responsible for capturing long-term dependencies. Subsequently, the central server monitors that the network environment of device A is high bandwidth and low delay, and the computing load is only 30%, while the network of device B is a mobile data network with limited bandwidth and a high computing load of 85%. Based on this, the parameters distributed to device A are only slightly compressed, while the parameters distributed to device B are subjected to high-intensity hierarchical compression and encoding to generate two different lightweight parameter sets. Finally, the two lightweight parameter sets are distributed to devices A and B through encrypted links deployed with the Transport Layer Security 1.3 protocol. After receiving, the devices perform decompression and decoding operations to restore the complete network structure and obtain the network parameters adapted to their own environments. Compared with the traditional technology which does not fully consider the lightweight requirements of edge computing such as model parameter transmission bandwidth and edge device computing burden, the joint training enables the initial model to have a cross-device general knowledge base. The hierarchical compression and encoding reduce the model parameter transmission bandwidth and the edge device computing burden, enabling resource-constrained devices to quickly and successfully deploy the model and improving the applicability, deployment efficiency and robustness of the entire system.

[0031] Optionally, the hierarchical compression and encoding of the initial network parameters to generate a lightweight parameter set comprises: constructing a dynamic compression strategy table based on the real-time communication quality and load of each edge device; differentially compressing the initial network parameters according to the dynamic compression strategy table, including sparsifying and pruning the low-level parameters and using low-rank decomposition and quantization encoding for the high-level parameters to obtain compressed parameters; performing entropy encoding and difference encoding on the compressed parameters to generate a lightweight parameter set.

[0032] Specifically, first, a dynamic compression strategy table is constructed according to the real-time communication quality and load state of each edge device. The dynamic compression strategy table is a mapping relationship, which maps different state combinations of edge devices, such as high bandwidth and low load, low bandwidth and high load, etc., to a specific set of compression hyperparameters, such as sparsity, decomposition rank, and quantization bit number, respectively. Subsequently, according to the compression strategy for a specific edge device queried from the dynamic compression strategy table, the initial network parameters trained by the central server are compressed in a hierarchical and differentiated manner. For the low-level parameters in the network responsible for extracting basic time series patterns, the sparse pruning technique is mainly used. This technique sets a pruning threshold to set the weights of the parameter matrix whose absolute value is lower than the pruning threshold to zero, thereby significantly increasing the sparsity of the parameters without significantly affecting the model's ability to extract basic features. The height of the pruning threshold is dynamically determined by the sparsity index in the strategy table. For the high-level parameters in the network responsible for high-level semantic abstraction, the strategy of combining low-rank decomposition and quantization encoding is used. Low-rank decomposition approximates a large high-level parameter matrix as the product of two or more small matrices, thereby reducing the total number of parameters, and the target rank of decomposition is specified by the strategy table. Then, the parameter values in the small matrices after decomposition are quantized and encoded, i.e., from high-precision floating-point numbers to low-precision fixed-point numbers or integers, such as from 32-bit floating-point numbers to 8-bit integers, thereby further compressing the storage space, and the number of quantization bits is also provided by the strategy table. After completing the differentiated compression, the compressed parameters need to be further encoded to maximize the compression ratio. At this time, the entropy encoding and difference encoding techniques are comprehensively used. Entropy encoding, such as Huffman encoding, assigns shorter code words to values with high frequency of occurrence, especially the large number of zeros generated after sparsification. Difference encoding takes advantage of the correlation between adjacent parameter values by storing the difference between them rather than the original value to reduce information redundancy. After these two encoding processes, a lightweight parameter set with small volume and easy transmission is finally formed. As shown in FIG. 1, by using model lightweight technology and an efficient parameter distribution mechanism, the optimization of transmission bandwidth, deployment speed, edge computing load, and power consumption is realized under the premise of ensuring model accuracy. Figure 2

[0033] ​Exemplarily, to perform hierarchical compression and encoding on the 6.5M initial network parameters generated in the last link, the central server first constructs a dynamic compression strategy table. The dynamic compression strategy table stipulates that for the "high bandwidth and low load" device A, the sparsification pruning threshold of the low-layer parameters is 0.001, the target rank of the low-rank decomposition of the high-layer parameters is 80% of the original rank, and the quantization scheme is 16-bit floating point number. For the "low bandwidth and high load" device B, the pruning threshold is 0.05, the target rank is 30% of the original rank, and the quantization scheme is 8-bit integer. According to the dynamic compression strategy table, for the parameters to be sent to device B, the low-layer parameters, i.e. the weight matrices of the two convolutional layers, are subjected to sparsification pruning. That is, if a weight value is 0.048, its absolute value is less than 0.05, and it is directly set to 0. For high-layer parameters, such as a 512x512 LSTM layer weight matrix, low-rank decomposition is used to approximately decompose it into the product of two 512x153 and 153x512 matrices, 153 is about 30% of 512, and the parameter quantity is greatly reduced. Then, the values in the small matrix after decomposition, such as a 16-bit floating point number 2.3456, are quantized to 8-bit integers 60 through linear mapping and rounding. After completing the differential compression, the compressed parameters containing a large number of zero values and low-precision values are obtained. Finally, the parameters are encoded. Using Huffman coding, the value 0, which appears frequently, is assigned a very short code word; at the same time, for the adjacent weight values in the small matrix after low-rank decomposition, such as [60, 62, 63], difference encoding is used to store them as [60, 2, 1], further reducing data redundancy. Finally, a lightweight parameter set is generated for device B. Compared with the traditional technology, the present application uses dynamic strategy table and hierarchical differential compression, adopts pruning for low-layer parameters to retain the basic pattern extraction capability, adopts low-rank decomposition and quantization for high-layer parameters to balance model complexity and prediction accuracy, reduces model parameter transmission bandwidth, and reduces the computational burden of the edge device end, improves efficiency, and fully meets the lightweight demand of the edge computing environment.

[0034] In the edge device, the network parameters received are fine-tuned using local time series data to generate a lightweight localized feature extractor, and the local time series data is dynamically calibrated to obtain a weight matrix. Optionally, the generating a lightweight localized feature extractor comprises: using the lightweight general feature extraction network to extract common features of the local time series data to obtain an initial feature representation; adjusting the network parameters based on the initial feature representation and the local time series data to generate a lightweight localized feature extractor.

[0035] Specifically, the local time series data is first inputted into the received and recovered lightweight universal feature extractor network in batches. The lightweight universal feature extractor network performs a forward propagation calculation to process the input data and extract the common time series features contained therein, thereby generating an initial feature representation. This initial feature representation reflects the preliminary and generalized understanding of the local data by the universal model. The key adjustment step then unfolds, aiming to make the network parameters better fit the unique distribution of the local data. This is a self-supervised learning process, usually based on the principle of minimizing reconstruction error. Specifically, the process adjusts the network parameters by optimizing the following loss function. For the loss function , ; wherein, is the total number of sampled data segments; is the time series data segment in the th input local time series data, which is a matrix, such as 100x3, indicating that each data segment contains 100 time points, each with 3 measurements; is the reconstructed sequence generated by the decoder for ; represents the sum of squares of the difference between all corresponding elements of the two matrices. By employing gradient descent optimization algorithms such as Adam, the gradient of the loss function with respect to the network parameters is repeatedly calculated, and the network parameters are fine-tuned in the opposite direction of the gradient. This iterative process continues until the reconstruction error converges to a lower level, and the lightweight localized feature extractor is obtained. As shown in Figure 3 , with the increase of the fine-tuning period, the reconstruction error of the model, i.e. the loss function value, rapidly decreases and stabilizes; this indicates that the network parameters are gradually adjusted from a universal state to a personalized state that can accurately express and reconstruct the specific patterns of the local data, and finally completes the generation of the lightweight localized feature extractor.

[0036] Exemplarily, the edge device A receives the decoded and recovered network parameters and starts to generate the lightweight localized feature extractor. Device A first obtains about 100GB of its own local time series data from the local storage in the past month, which contains the unique operating conditions and vibration patterns of the device. These local time series data are inputted into the recovered lightweight universal feature extractor network in batches, with each segment containing 1024 time points and 3 sensor measurements, i.e. a 1024x3 matrix. The lightweight universal feature extractor network performs forward propagation on a batch of input data to obtain a batch of initial feature representations. Subsequently, the network parameter fine-tuning stage begins, and the self-supervised learning method is adopted to optimize the loss function ​To adjust the network parameters. The total number of data segments at this point is 32. Suppose that in a certain iteration, we focus on the [number]th segment within the batch. Data segments If the measured value at a specific time point is [0.52, 1.13, -0.45], and the corresponding time point element value reconstructed by the network is [0.48, 1.18, -0.41], then the squared error of this element is... .one Contains 1024 time points Each time point is an element containing 3 measurements, so the above operation needs to be repeated and all results added together to obtain the result. The result is rounded to two decimal places, and the same applies below. Then, the sum of errors for all data segments within the batch is calculated to be 168.50. The average error of all data segments within the batch is then calculated, yielding a loss function value of 5.27. Next, the Adam optimizer is used to calculate the gradient of this loss value with respect to all network parameters, and the parameters are updated based on the gradient. This process is repeated for 20 cycles until the reconstruction error converges. At this point, the network parameters have fully learned and adapted to the unique data distribution of device A, and the generated network is a lightweight localized feature extractor for device A. Compared to traditional technologies that primarily focus on data privacy and access control rather than real-time intelligent anomaly analysis of the data content itself, this invention, through targeted fine-tuning on local data, enables the lightweight localized feature extractor to deeply understand and fit the subtle operational characteristics of a specific device, rather than remaining at a general common level. This optimizes the analysis efficiency and accuracy of high-frequency time-series data, achieving real-time intelligent analysis capabilities of the data content itself.

[0037] Optionally, the obtained weight matrix includes: The local time-series data is input into the lightweight local feature extractor to extract multiple sets of feature maps; For each set of feature maps, calculate the gradient of change and information entropy over the time series; The weight matrix is ​​obtained by fusing and normalizing the changing gradient and information entropy through an unsupervised attention generation process.

[0038] Specifically, first, the local time series data of the edge device is input to the lightweight localization feature extractor. The lightweight localization feature extractor is a deep network model. During its forward propagation process, different network layers generate a series of intermediate results, which are called feature maps. Each feature map can be regarded as a quantitative response to a certain specific pattern or dynamic in the input time series data, and it is also a time series itself. The purpose of this step is to extract quantitative indicators from these multiple sets of feature maps that can represent their importance. For each set of extracted feature maps, two core dynamic attributes are calculated. The first attribute is the change gradient in the time series, which measures the activity or change intensity of the pattern represented by the feature map in the time dimension. The change gradient can be obtained by calculating the L2 norm of the first-order difference of the feature map time series. A higher change gradient value means that the feature pattern is very dynamic in the local data. The second attribute is the information entropy, which quantifies the uncertainty and complexity of the numerical distribution of the feature map. To calculate it, first, the continuous numerical range of the feature map is discretized into several intervals, then the frequency of the numerical values falling into each interval is counted to construct a probability distribution, and finally the Shannon entropy is calculated based on the distribution. A higher information entropy value indicates that the response of the feature pattern is complex and variable, rather than simple or constant. After obtaining the change gradient and information entropy of each set of feature maps, an unsupervised attention generation process is used to fuse and normalize these two heterogeneous indicators to generate the final weight matrix. For each feature map, its change gradient and information entropy together define the importance of the feature as a two-dimensional coordinate. The importance of a feature map is positively correlated with its dynamicity and complexity. By calculating the Euclidean distance from the coordinate point to the origin, an initial attention value is obtained, which integrates information from both the gradient and entropy dimensions. Subsequently, to highlight important features and suppress less important features, the initial attention values of all feature maps are exponentiated. Finally, all exponentiated values are globally normalized, for example, using the normalized exponential function Softmax, so that the sum of the attention scores of all feature maps is one. These scores constitute the weights that reflect the relative importance of each feature map. The weights of all feature maps are combined and arranged to form the weight matrix.

[0039] For example, to obtain the weight matrix, the edge device A first inputs the local historical normal operation time series data into the trained lightweight localization feature extractor. If the first convolutional layer of the lightweight localization feature extractor outputs 16 sets of feature maps , the 3rd set of feature maps is a time series with a length of 1024. The change gradient of its time series is calculated by calculating the L2 norm of its first-order difference, such as the difference sequence , then the change gradient The value of these difference values is the square root of the sum of squares, which is calculated to be 8.20. This indicates that the pattern represented by the feature map is quite active in the local data. Next, the information entropy of the feature map is calculated. The system will calculate the information entropy of each feature map The numerical range of the feature map, i.e. -1.0 to 1.5, is divided into 32 equal intervals, and the frequency of 1024 numerical points falling into each interval is counted to obtain the probability distribution According to the Shannon entropy formula, the information entropy (bit) is calculated, indicating that the response pattern of the feature is complex and varied. This operation is performed on all 16 groups of feature maps to obtain 16 pairs of values. Subsequently, an initial attention value is obtained by fusing the change gradient and information entropy value of each pair through an unsupervised attention generation process. For example, for the 3rd group of feature maps, the initial attention value is a certain combination function value of and Finally, the 16 initial attention values are exponentiated and globally normalized, for example, using the Softmax function, to obtain 16 attention scores between 0 and 1 and with a total sum of 1. These scores accurately reflect the relative importance of the 16 feature maps, and their arrangement and combination form the final weight matrix. In view of the problem that the optimization processing for specific data types such as high-frequency time series data is lacking, the present application considers the dynamics and complexity of high-frequency time series features at the same time, and the important features mined are those patterns that are both active and information-rich, which is more comprehensive and profound than single-dimensional evaluation, which directly reflects the efficient analysis and deep understanding of the content of high-frequency time series data.

[0040] Optionally, the fusion and normalization of the change gradient and the information entropy through the unsupervised attention generation process to obtain the weight matrix comprises: For each group of feature maps, the change gradient in the time series is taken as the first dimension, and the information entropy is taken as the second dimension, to construct a two-dimensional dynamic importance space; In the dynamic importance space, the vector distance from each coordinate point corresponding to the feature map to the origin of the space is calculated as the initial attention value; The initial attention values of all the feature maps are exponentiated and globally normalized to generate attention scores and arrange them to form the weight matrix.

[0041] Specifically, the weight matrix is constructed through an unsupervised attention generation process. The process first constructs a two-dimensional dynamic importance space for each group of feature maps produced by the lightweight local feature extractor. In this space, the x-axis represents the change gradient of the feature map in the time series, and the y-axis represents the information entropy. Therefore, each group of feature maps can be mapped to a unique coordinate point in this space, and the position of the coordinate point intuitively reflects the dynamics and complexity of the pattern captured by the feature. Then, in order to quantify the overall importance of each feature map, the vector distance from the corresponding coordinate point to the origin of the space is calculated, and this distance is defined as the initial attention value. For the initial attention value of the first group of feature maps , there is ; wherein is the time series change gradient of the first group of feature maps, which is obtained by calculating the first-order difference norm of the feature map over time, reflecting its dynamic activity; is the information entropy of the first group of feature maps, which is calculated by probabilizing the numerical distribution of the feature map and applying the Shannon entropy formula, reflecting its information complexity. Since both the change gradient and the information entropy are dimensionless scalars that quantify the dynamic properties of the feature, it is logical to calculate the distance in the constructed two-dimensional importance space. After obtaining the initial attention values of all feature maps, the initial attention values are exponentially processed, i.e. taking the power of e for each. The purpose of this operation is to non-linearly amplify the differences between the values, so that the feature maps with high importance obtain values far exceeding the feature maps with low importance, thereby enhancing the discriminability of the attention mechanism. Finally, in order to make these values have relative significance and be easy to use subsequently, all the exponentially processed values are globally normalized, usually using the Softmax function, to generate the final attention scores. The attention scores of all feature maps are combined and arranged to form the final weight matrix.

[0042] Exemplarily, the weight matrix is constructed on the edge device A through an unsupervised attention generation process. The lightweight local feature extractor produces 16 groups of feature maps, and a two-dimensional dynamic importance space is constructed for each group of feature maps, in which the x-axis represents the change gradient G and the y-axis represents the information entropy H. After calculation, the coordinates of the third group of feature maps are , and the coordinates of the eighth group of inactive and simple feature maps are . The initial attention value of each feature map is calculated as the vector distance from the coordinate point to the origin (0, 0) in the space. In this verification example, the gradient of change is a scalar obtained by calculating the difference norm, and the information entropy is a scalar obtained by calculating the Shannon formula. Both are dimensionless or normalized scalars that quantify the dynamic properties of features, so distance calculation in the constructed two-dimensional space is consistent with physical and logical laws. For the third group of feature maps, the initial attention value is, For the eighth group of feature maps, the initial attention value is 1.75. After obtaining the initial attention values of all 16 feature maps, they are processed by exponentiation, such as is about 9602 and is about 5.75. This operation significantly amplifies the gap between important and unimportant features. Finally, assuming that the sum of the exponential values of the 16 feature maps is 12500, the final attention score is generated using global normalization. The score of the third group of feature maps is 9602 / 12500, while the score of the eighth group of feature maps is 5.75 / 12500. Arranging these 16 scores in order forms a 1x16 weight matrix, clearly indicating the relative importance of each feature. For the optimization of high-frequency time series data, by constructing a dynamic importance space and calculating vector distances, the dynamic nature and information complexity of time series are reasonably integrated, improving the quality and usability of attention signals and laying a foundation for efficient and accurate analysis of high-frequency time series data.

[0043] uploading the weight matrix to the central server, the central server aggregating the weight matrices from multiple edge devices to obtain an aggregated matrix, and updating the lightweight general feature extraction network using the aggregated matrix; Optionally, the updating the lightweight general feature extraction network using the aggregated matrix comprises: evaluating the amount of information and the degree of dispersion contained in each weight matrix to obtain a set of credibility scores; based on the set of credibility scores, performing similarity calculation and cluster integration analysis between the weight matrices to obtain an aggregated matrix; interacting the aggregated matrix with the output features of the lightweight general feature extraction network element by element to generate a feature enhancement representation; based on the feature enhancement representation, iteratively optimizing the connection weights in the lightweight general feature extraction network to achieve global adjustment of the network parameters.

[0044] Specifically, the first step is to assess the quality of the weight matrices uploaded from each edge device. For each weight matrix, two key metrics are calculated to quantify the quality of its information: information content, measured by the Shannon entropy of the elements in the weight matrix, reflecting the complexity of the feature importance distribution of that edge device; and dispersion, measured by the variance or standard deviation of the weight values, reflecting the significance of importance distinctions. These two metrics are combined to generate a credibility score for each weight matrix. Matrixes with higher scores are considered to provide clearer and more valuable local insights, thus forming a credibility score set. Next, the central server performs weighted aggregation based on this credibility score set. To more finely integrate knowledge, the similarity between the weight matrices is first calculated, for example using cosine similarity or KL divergence. Then, cluster integration analysis is performed, such as using the K-means algorithm to group edge devices with similar feature importance distributions (i.e., devices with similar weight matrices) into the same cluster. Within each cluster, a weighted average is calculated based on the credibility scores of the matrices within the cluster to obtain a representative weight matrix at the cluster level. Finally, these cluster-level representative matrices are globally weighted and averaged to obtain the final aggregate matrix. This process effectively suppresses the adverse effects of anomalous or noisy edge devices and extracts universally applicable feature importance patterns. After obtaining the aggregate matrix, the lightweight general-purpose feature extraction network is updated. The central server inputs a benchmark time-series dataset into the current lightweight general-purpose feature extraction network to obtain the network's output features. Subsequently, the aggregate matrix is ​​multiplied element-wise with the output features. This operation is equivalent to a global attention mechanism, using the knowledge of aggregation to adjust and enhance the original features, highlighting those feature dimensions that are considered important by most devices and suppressing secondary dimensions, thereby generating a feature-enhanced representation. Finally, an optimization objective is constructed based on this feature-enhanced representation, such as defining a contrast function aimed at maximizing the compactness of normal patterns. The gradient of the loss with respect to all connection weights in the lightweight general-purpose feature extraction network is calculated using the backpropagation algorithm, and then gradient descent is used to iteratively optimize the network parameters to achieve global adjustment.

[0045] Exemplarily, after receiving the weight matrices uploaded from devices A, B, and C, the central server updates the lightweight universal feature extractor network using the aggregated matrix. The server first evaluates the credibility of each weight matrix. For the weight matrix of device A, the variance of the element values is extremely large, and the information entropy is moderate, indicating that the importance distinction is very significant, and the credibility score is 0.95. Device B may be in the switching stage, and the element value distribution of its weight matrix is relatively uniform, with small variance, and the credibility score is only 0.6. The score of device C is 0.9. Thus, a credibility score set {0.95, 0.6, 0.9} is formed. Next, clustering and integration analysis is performed. The server calculates and finds that the cosine similarity of the weight matrices of devices A and C is high, and they are clustered together, and device B is clustered alone. In the A and C cluster, a cluster representative matrix is obtained by weighted average according to the credibility. Then, the representative matrix is again globally weighted averaged with the matrix of device B according to the overall credibility of the cluster to obtain the final aggregated matrix. This can effectively fuse the knowledge of similar devices and suppress low-quality information. After obtaining the aggregated matrix, the server inputs a standard benchmark time series dataset into the current lightweight universal feature extractor network to obtain a batch of output features. Then, the aggregated matrix is multiplied element by element with the output features to generate a feature enhancement representation. This process enhances the feature dimensions that are considered important by most high-credibility devices. Finally, based on the feature enhancement representation, a contrast function is defined to pull normal samples of the same class closer together and push normal samples of different classes farther apart. The gradient is calculated by back propagation, and all connection weights in the lightweight universal feature extractor network are iteratively optimized using the Adam optimizer to complete the global adjustment of the network parameters. Through credibility evaluation and clustering integration of the uploaded weight matrices, the central server can intelligently and robustly fuse distributed knowledge from different edge devices, effectively reducing the misleading of low-quality or abnormal data.

[0046] obtaining real-time time series data, processing the real-time time series data using the lightweight localized feature extractor to obtain a real-time feature vector, and calibrating the real-time feature vector based on the aggregated matrix to obtain a calibrated feature vector; Optionally, the obtaining the calibrated feature vector comprises: performing noise suppression and length regularization processing on the real-time time series data to obtain regularized time series data; inputting the regularized time series data into the lightweight localized feature extractor to extract a feature representation with time-dependent relationship, and generating a real-time feature vector; selecting a corresponding weight distribution from the aggregated matrix according to the importance of each dimension feature in the real-time feature vector, and performing weighted adjustment on the real-time feature vector dimension by dimension to obtain a weighted feature representation; The weighted feature representation is subjected to distribution alignment and stability enhancement processing to obtain a calibrated feature vector.

[0047] Specifically, first, the real-time time series data collected by the edge device is preprocessed. This step includes noise suppression and length normalization. Noise suppression can smooth the data by applying a moving average or Kalman filter, remove high-frequency burrs and sensor noise, and enhance the effective signal. Length normalization is to intercept the data stream through a fixed-size sliding window to ensure that the data segment input to the model each time has a uniform length, and the insufficient part can be filled with zero padding or other methods to obtain the normalized time series data. Subsequently, the normalized time series data is input to the lightweight localized feature extractor that has been fine-tuned locally. The lightweight localized feature extractor performs a forward propagation, captures the time-dependent relationship and local patterns in the data using its deep learning structure such as a recurrent neural network or a convolutional network, and encodes them into a high-dimensional feature representation. This initial feature representation is the real-time feature vector. The next step is the key calibration step. The real-time feature vector is weighted and adjusted using the aggregation matrix that is downloaded from the central server and incorporates global knowledge. This process is performed dimension by dimension, meaning that each dimension of the real-time feature vector corresponds to a specific weight value in the aggregation matrix. This weight value represents the universal importance of the feature dimension in the entire system. The calibration operation is achieved through the element-wise product, i.e., the Hadamard product, of the real-time feature vector and the corresponding weight distribution in the aggregation matrix, resulting in a weighted feature representation. For the calculation of the weighted feature representation , there is: ; wherein, is the original real-time feature vector; is the weight vector extracted from the aggregation matrix, which is consistent with the dimension of ; the symbol represents element-wise multiplication. This operation can amplify the feature dimensions that are important in global consensus while suppressing those that may only be significant locally but have little global significance. Finally, in order to improve the stability and consistency of the features, the weighted feature representation is subjected to distribution alignment and stability enhancement processing. Distribution alignment can adjust the numerical values of the feature vector to a standard statistical distribution by applying layer normalization or other techniques, eliminating the scale drift that may be introduced by the weighting operation. Stability enhancement can smooth the short-term fluctuations of the features by applying an exponential moving average to the feature vectors at consecutive time steps. After this series of processing, the final calibrated feature vector is obtained, which is robust and information-rich.

[0048] Exemplarily, to obtain a calibration feature vector, the edge device A of the industrial field first collects a piece of real-time time series data through a sensor. The real-time time series data contains some high-frequency noise, and a moving average filter with a window size of 5 is applied to smooth the data and effectively suppress the noise. Then, the regularized time series data is intercepted through a sliding window with a length of 1024 steps to ensure the uniformity of the input length. Subsequently, the 1024x3 regularized time series data is input into the lightweight localized feature extractor of the device A, and a 16-dimensional real-time feature vector is output through the forward propagation calculation of the network, with the values being At this time, the aggregation matrix issued from the central server and stored locally is called. From the aggregation matrix, a weight vector corresponding to the 16-dimensional feature vector is extracted, with the values being These weights represent the feature importance under global consensus. The calibration operation is performed by element-wise multiplication to obtain the weighted feature representation The calculation process is The first element is , the second element is , and so on to obtain This operation amplifies the globally important feature dimensions, such as the first dimension weight 1.2>1, and suppresses the globally secondary feature dimensions, such as the second dimension weight 0.5<1. Finally, to eliminate the numerical scale changes that may be introduced by the weighting operation, the layer normalization processing is applied to , and an exponential moving average is performed on it and the calibration feature vector of the previous time to finally obtain a smooth, stable, and globally knowledgeable calibration feature vector. Compared with the lack of optimization processing for specific data types and the main focus on data privacy and access control in traditional technologies, the present application can effectively correct features that may only appear important due to local special conditions but have no universality in the global perspective, while enhancing features that have been widely verified as key, thereby realizing in-depth and efficient real-time analysis of high-frequency time series data and improving the accuracy of anomaly detection.

[0049] Based on the calibration feature vector, an abnormal diagnosis is performed to generate an anomaly detection result.

[0050] Optionally, the generation of the anomaly detection result includes: maintaining a dynamically updated normal behavior feature summary on the edge device, the normal behavior feature summary being composed of a sliding centroid of the calibration feature vector in the recent period; calculating the Mahalanobis distance between the current calibration feature vector and the dynamic normal behavior summary; When the Mahalanobis distance exceeds a preset adaptive quantile, an abnormal event is determined, and an anomaly detection result is generated.

[0051] Specifically, first, the edge device will maintain a dynamically updated normal behavior feature profile. The normal behavior feature profile is not a static model, but a dynamic and statistical description of the recent normal running state. Specifically, a fixed-size first-in-first-out queue or sliding window is maintained to store the latest batch of calibration feature vectors that are determined to be normal. The core of the normal behavior feature profile is the sliding centroid of all calibration feature vectors in the window, that is, their mean vector. As new calibration feature vectors are continuously generated and enter the window, the oldest vectors are removed, and the centroid is recalculated in real time, so that the normal behavior feature profile can smoothly track and adapt to the slow drift or change of normal behavior. After obtaining the calibration feature vector at the current time, the deviation between the vector and the dynamic normal behavior profile is calculated, and this deviation is the anomaly score. The Mahalanobis distance is preferred. The Mahalanobis distance not only considers the Euclidean distance between the current vector and the centroid, but more importantly, it also considers the correlation and variance of each dimension of the normal data in the feature space. Specifically, the calculation of the Mahalanobis distance is a multi-step process. First, the deviation vector between the calibration feature vector at the current time and the sliding centroid is calculated. Then, the inverse matrix of the covariance matrix of all normal calibration feature vectors in the sliding window is used to perform a linear transformation on the deviation vector. The core role of this transformation is to adjust the components of the deviation vector in different dimensions according to the distribution characteristics of the normal data: in dimensions with large normal data fluctuations, i.e., large variance, the corresponding deviation weight is reduced; conversely, in dimensions with small normal data fluctuations, i.e., small variance, the deviation weight is amplified. At the same time, this transformation also eliminates the influence of the correlation between feature dimensions. Finally, by performing an operation similar to calculating the "length" or "norm" of the transformed vector, a comprehensive scalar value is obtained, which is the Mahalanobis distance. This result directly represents the statistical distance of the current state from the center of the normal behavior distribution, and its numerical size is not affected by the data scale. The last step is to make an abnormality determination. Instead of using a fixed absolute threshold, this method uses an adaptive quantile threshold. The Mahalanobis distances calculated during normal operation are continuously monitored, and the historical distribution of these distances is maintained. The quantile threshold is set to a high quantile of the distribution, such as 99.5%. This means that only when the calculated Mahalanobis distance exceeds the distance value of 99.5% of the normal case, it will be determined as an abnormal event. For example Figure 4As shown, the curve in the figure represents the Mahalanobis distance calculated in real time over time; when the Mahalanobis distance exceeds the quantile threshold, i.e. the dashed line in the figure, it is determined that an abnormal event occurs, and the triangular marker point in the figure. This quantile threshold will also be slowly adjusted as the normal distance distribution changes, thereby having adaptive ability. Once an abnormal event is determined, a corresponding abnormality detection result, such as an alarm signal, is generated.

[0052] Exemplarily, the abnormality detection module on the edge device A generates an abnormality detection result, first maintains a first-in-first-out queue with a size of 2000 in the device, for storing the last 2000 calibration feature vectors determined to be normal These calibration feature vectors collectively constitute a dynamic sample set of normal behavior. The normal behavior feature summary is composed of the sliding centroid of the 2000 vectors, i.e. the mean vector μ and the covariance matrix S, and μ and S are recalculated every time a new normal vector enters the queue. The calculation obtains , and , and ; the diagonal elements 4.0 and 0.25 are the variances of features 1 and 2, respectively, and the non-diagonal elements 0.5 and 0.5 are the covariances between features 1 and 2, indicating that there is a positive correlation between them. At a certain moment, a new 2-dimensional calibration feature vector is obtained. Then, the Mahalanobis distance between the calibration feature vector and the normal behavior summary is calculated. Specifically, the deviation vector is first calculated as . Then, the inverse matrix of the pre-calculated covariance matrix is used to calculate the square of the Mahalanobis distance , and the Mahalanobis distance is about 3.21 after taking the square root, with the result rounded to two decimal places. This calculation process takes into account the fluctuation size and correlation between different feature dimensions of normal data. For example, if the component of the deviation vector in a certain feature dimension is large, but the normal data itself fluctuates greatly in that dimension, the contribution of the deviation to the final distance will be suppressed. Conversely, a small deviation in a very stable dimension will also cause the Mahalanobis distance to increase significantly. Finally, abnormality is determined. The device maintains the distribution of the Mahalanobis distance values calculated during normal operation over a period of time, and the adaptive quantile threshold of 99.5% is 2.8. Since the currently calculated Mahalanobis distance 3.21 exceeds the quantile threshold 2.8, it is determined that an abnormal event has occurred at this moment, and an abnormality detection result of "main shaft bearing suspected wear" is immediately generated and reported to the monitoring center. By using the Mahalanobis distance as the abnormality measure, compared with the simple Euclidean distance, the data distribution in the feature space can be better understood, and the "direction" and "magnitude" of deviation from the normal pattern can be more reasonably evaluated, thereby improving the sensitivity and accuracy of detection.

[0053] Based on the same inventive concept, as shown in Figure 5 The application also provides an edge-coordinated lightweight time series data anomaly detection system, which comprises: A parameter issuing module is configured to acquire network parameters of a lightweight general feature extraction network in a central server and issue the network parameters to an edge device. A local fine-tuning module is configured to fine-tune the received network parameters using local time series data on the edge device, generate a lightweight localized feature extractor, and dynamically calibrate features of the local time series data to obtain a weight matrix. A weight aggregation module is configured to upload the weight matrix to the central server, aggregate the weight matrices from multiple edge devices to obtain an aggregated matrix, and update the lightweight general feature extraction network using the aggregated matrix. A feature calibration module is configured to acquire real-time time series data, process the real-time time series data using the lightweight localized feature extractor on the edge device to obtain a real-time feature vector, and calibrate the real-time feature vector based on the aggregated matrix to obtain a calibrated feature vector. An anomaly diagnosis module is configured to perform anomaly diagnosis based on the calibrated feature vector to generate an anomaly detection result.

[0054] It should be noted that the electrical connection between the above-mentioned units does not necessarily represent the direct connection of the line, and the indirect connection mode can also be applied to the embodiments of the application as long as the purpose of the application is achieved. The above-mentioned is only an exemplary embodiment of the application, and cannot limit the scope of the application.

[0055] That is, any equivalent changes and modifications made according to the teachings of the present application are still within the scope of the present application. Other embodiments of the present application will be readily apparent to those skilled in the art upon considering the specification and practice of the true principles disclosed herein. The present application is intended to cover any variations, uses or adaptive changes of the present application that follow the general principles of the present application and include common knowledge or conventional technical means in the art that are not described in the present application.

Claims

1. An edge-coordinated lightweight time-series data anomaly detection method, characterized in that, The method comprises: obtaining network parameters of a lightweight general feature extraction network in a central server, and distributing the network parameters to edge devices; using local time series data to fine-tune the received network parameters on the edge devices, generating a lightweight localized feature extractor, and dynamically calibrating the local time series data to obtain a weight matrix; uploading the weight matrix to the central server, aggregating the weight matrix from multiple edge devices to obtain an aggregated matrix, and updating the lightweight general feature extraction network using the aggregated matrix; obtaining real-time time series data, processing the real-time time series data using the lightweight localized feature extractor on the edge devices to obtain a real-time feature vector, and calibrating the real-time feature vector based on the aggregated matrix to obtain a calibrated feature vector; based on the calibrated feature vector, performing anomaly diagnosis to generate an anomaly detection result.

2. The edge-coordinated lightweight time-series data anomaly detection method of claim 1, wherein, The method comprises: constructing a lightweight general feature extraction network in a central server, jointly training the lightweight general feature extraction network based on local time series data of multiple edge devices to obtain initial network parameters including low-level parameters and high-level parameters; performing hierarchical compression and encoding on the initial network parameters according to the real-time communication quality and load of each edge device to generate a lightweight parameter set; distributing the lightweight parameter set to each edge device through an encrypted link, and performing parameter decoding and structure recovery to generate network parameters.

3. The edge-coordinated lightweight time-series data anomaly detection method of claim 2, wherein, The method comprises: based on the real-time communication quality and load of each edge device, constructing a dynamic compression strategy table; performing differential compression on the initial network parameters according to the dynamic compression strategy table, including using sparsification pruning on the low-level parameters and using low-rank decomposition and quantization encoding on the high-level parameters to obtain compressed parameters; performing entropy encoding and difference encoding on the compressed parameters to generate a lightweight parameter set.

4. The edge-coordinated lightweight time-series data anomaly detection method of claim 1, wherein, The method comprises: extracting common features of the local time series data using the lightweight general feature extraction network to obtain initial feature representations; adjusting the network parameters based on the initial feature representations and the local time series data to generate a lightweight localized feature extractor.

5. The edge-coordinated lightweight time-series data anomaly detection method of claim 1, wherein, The method comprises: inputting the local time series data into the lightweight localized feature extractor to extract multiple groups of feature maps; calculating the change gradient and information entropy in the time series for each group of feature maps; fusing and normalizing the change gradient and information entropy through an unsupervised attention generation process to obtain a weight matrix.

6. The edge-coordinated lightweight time-series data anomaly detection method of claim 5, wherein, The method comprises: for each group of feature maps, constructing a two-dimensional dynamic importance space with the change gradient in the time series as the first dimension and the information entropy as the second dimension; In the dynamic importance space, a vector distance from each coordinate point corresponding to the feature map to the space origin is calculated as an initial attention value; The initial attention values of all the feature maps are exponentially processed and globally normalized to generate attention scores and combined arrangement, forming the weight matrix.

7. The edge-coordinated lightweight time-series data anomaly detection method of claim 1, wherein, The updating of the lightweight general feature extraction network using the aggregation matrix includes: The information amount and discrete degree of each weight matrix are evaluated to obtain a credibility score set; Based on the credibility score set, similarity calculation and clustering integration analysis are performed between the weight matrices to obtain an aggregation matrix; The aggregation matrix and the output features of the lightweight general feature extraction network are interacted element by element to generate feature enhancement representation; Based on the feature enhancement representation, the connection weights in the lightweight general feature extraction network are iteratively optimized to realize global adjustment of the network parameters.

8. The edge-coordinated lightweight time-series data anomaly detection method of claim 1, wherein, The obtaining of the calibrated feature vector includes: The real-time time series data is subjected to noise suppression and length regularization processing to obtain regularized time series data; The regularized time series data is input into the lightweight localized feature extractor to extract feature representation with time series dependence, generating a real-time feature vector; According to the importance of each dimension feature in the real-time feature vector, the corresponding weight distribution is selected from the aggregation matrix, and the real-time feature vector is adjusted dimension by dimension, obtaining a weighted feature representation; The weighted feature representation is subjected to distribution alignment and stability enhancement processing to obtain a calibrated feature vector.

9. The edge-coordinated lightweight time-series data anomaly detection method of claim 1, wherein, The generation of the anomaly detection result includes: A dynamically updated normal behavior feature profile is maintained on the edge device, which is composed of the sliding centroid of the recent calibrated feature vector; The Mahalanobis distance between the current calibrated feature vector and the dynamic normal behavior profile is calculated; When the Mahalanobis distance exceeds the preset adaptive quantile, it is determined as an abnormal event, and an anomaly detection result is generated.

10. An edge-coordinated lightweight time series data anomaly detection system, applied to the edge-coordinated lightweight time series data anomaly detection method of any one of claims 1-9, characterized in that, The system includes: A parameter issuing module for obtaining network parameters of a lightweight general feature extraction network in a central server and issuing them to an edge device; A local fine-tuning module for fine-tuning the received network parameters using local time series data on the edge device to generate a lightweight localized feature extractor, and dynamically calibrating features of the local time series data to obtain a weight matrix; A weight aggregation module for uploading the weight matrix to the central server, the central server aggregates the weight matrices from multiple edge devices to obtain an aggregation matrix, and updates the lightweight general feature extraction network using the aggregation matrix; A feature calibration module for obtaining real-time time series data, processing the real-time time series data using the lightweight localized feature extractor on the edge device to obtain a real-time feature vector, and calibrating the real-time feature vector based on the aggregation matrix to obtain a calibrated feature vector; An anomaly diagnosis module for anomaly diagnosis based on the calibrated feature vector to generate an anomaly detection result.

Images