Industrial internet equipment anomaly detection method and system

Abstract

The invention belongs to the technical field of industrial internet equipment anomaly detection, and particularly relates to an industrial internet equipment anomaly detection method and system, and the method comprises the steps: obtaining equipment data and corresponding power data of a plurality of pieces of industrial internet equipment of the same model in a first field; direct abnormal points in the data points are removed, and outlier data points are found out through an LOF algorithm in combination with a first coefficient; subtracting a first constant from a first coefficient of the industrial internet equipment to which the direct abnormal point and the outlier data point belong; and monitoring the output first coefficients of the plurality of pieces of industrial internet equipment with the same model in real time, and determining that the first industrial internet equipment is abnormal in the first field if the first industrial internet equipment of which the first coefficient is smaller than a first threshold value exists in the plurality of pieces of industrial internet equipment with the same model. The problem that in the prior art, in the time period of collecting the data set of the industrial internet equipment, manual anomaly detection of the industrial internet equipment is needed can be solved.

Description

Technical Field

[0001] This application belongs to the field of industrial internet equipment anomaly detection technology, and in particular relates to a method and system for industrial internet equipment anomaly detection. Background Technology

[0002] With the rapid development of the Industrial Internet, many large-scale factories have adopted Industrial Internet equipment. Compared with ordinary industrial equipment, Industrial Internet equipment has a huge advantage in anomaly detection.

[0003] However, in existing technologies, anomaly detection relies on deep learning models. Training deep learning models requires collecting a large amount of data. Furthermore, because the quality and physical characteristics of each device are different, even for industrial internet devices of the same type, data from the device itself must be collected to train the model. Therefore, for existing technologies, anomaly detection of industrial internet devices needs to be performed manually during the time period of collecting industrial internet device datasets. Summary of the Invention

[0004] This application provides a method and system for detecting anomalies in industrial internet devices, which can solve the problem that in the prior art, manual detection of anomalies in industrial internet devices is required during the time period of collecting industrial internet device datasets.

[0005] In a first aspect, embodiments of this application provide an industrial internet device anomaly detection method, applied during a period when the deep learning model for anomaly detection in the industrial internet is not ready, where there are multiple industrial internet devices of the same model, and the same first coefficient is established for the multiple industrial internet devices of the same model, the method comprising: Acquire device data and corresponding power data of multiple industrial internet devices of the same model in a first field; wherein, a set of corresponding device data and power data constitutes a data point; Remove direct outliers from the data points, and then use the LOF algorithm in conjunction with the first coefficient to find outlier data points; wherein, direct outliers refer to data points that are outside the process target range of the industrial internet equipment; the data points are used as the basic unit when applying the LOF algorithm; outlier data points refer to data points whose outlier degree is greater than a threshold, and the number of outlier data points is directly proportional to the probability that the industrial internet equipment has anomalies; Subtract a first constant from the first coefficient of the industrial internet device to which the direct outlier and the outlier data point belong; output the first coefficient of multiple industrial internet devices of the same model; and without resetting the first coefficient, return to the step of obtaining the device data and corresponding power data of multiple industrial internet devices of the same model in the first field. If the monitoring outputs the first coefficient of multiple industrial internet devices of the same model, and there is a first industrial internet device whose first coefficient is less than the first threshold among the multiple industrial internet devices of the same model, then the first industrial internet device is output as having an anomaly in the first domain, and the repair report of the first industrial internet device is received in real time. After the anomaly is repaired, the first coefficient of the first industrial internet device is initialized.

[0006] The technical solutions described in this application embodiment have at least the following technical effects: The industrial internet device anomaly detection method provided in this application firstly acquires device data and corresponding power data of multiple industrial internet devices of the same model in a first domain. This step, by identifying multiple industrial internet devices of the same model and then acquiring their device data and corresponding power data within the first domain, limits the data collection scope to the same model and domain, facilitating accurate identification of anomalies in the industrial internet devices. Secondly, direct outliers are removed from the data points, and then outlier data points are identified using the LOF algorithm combined with a first coefficient. This step first removes direct outliers and then uses the LOF algorithm to calculate the degree of outlier status for the collected data points, thus identifying outlier data points with significant discrepancies. Then, a first constant is subtracted from the first coefficient of the industrial internet devices to which the direct outliers and outlier data points belong. This step identifies the industrial internet devices to which the direct outliers and outlier data points belong, and subtracts the first constant from the first coefficient of those devices to statistically analyze the frequency of outliers in the industrial internet device data (the more frequent the outliers, the smaller the first coefficient), thereby reflecting the probability of anomalies in the industrial internet device (the more frequent the outliers, the greater the probability of anomalies). Finally, the system monitors the first coefficients of multiple industrial internet devices of the same model in real time until a first industrial internet device with a first coefficient less than a first threshold is identified as having an anomaly in the first domain. The system also receives a repair report from the first industrial internet device in real time. After the anomaly is repaired, the first coefficient of the first industrial internet device is initialized. In this step, the first industrial internet device with a first coefficient less than the first threshold is identified as having an anomaly in the first domain, and the first coefficient of the first industrial internet device is initialized after the anomaly is repaired. This allows for automatic anomaly detection of industrial internet devices during the period when the deep learning model for anomaly detection is not ready.

[0007] Secondly, embodiments of this application provide an industrial internet device anomaly detection system, the system being applied to the industrial internet, comprising: The acquisition unit is used to acquire device data and corresponding power data of multiple industrial internet devices of the same model in a first field; wherein, a set of corresponding device data and power data constitutes a data point; The data point processing unit is used to remove direct outliers from the data points, and then find outlier data points by using the LOF algorithm and combining it with the first coefficient; wherein, the direct outlier refers to the data point that is outside the process target range of the industrial Internet equipment, and the data point is used as the basic unit when applying the LOF algorithm; the outlier refers to the data point whose outlier degree is greater than a threshold. The first coefficient adjustment unit is used to subtract a first constant from the first coefficient of the industrial internet device to which the direct outlier point and the outlier data point belong; output the first coefficient of multiple industrial internet devices of the same model; and, without resetting the first coefficient, return to the step of obtaining the device data and corresponding power data of multiple industrial internet devices of the same model in the first field. An anomaly detection unit is used to monitor the first coefficient of multiple industrial internet devices of the same model. If there is a first industrial internet device whose first coefficient is less than a first threshold among the multiple industrial internet devices of the same model, then the unit outputs that the first industrial internet device has an anomaly in the first domain, and receives the repair report of the first industrial internet device in real time. After the anomaly is repaired, the unit initializes the first coefficient of the first industrial internet device.

[0008] Thirdly, embodiments of this application provide an industrial internet device anomaly detection device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that the processor executes the computer program to implement the method described in any of the first aspects above.

[0009] Fourthly, embodiments of this application provide a computer-readable storage medium storing a computer program that, when executed by a processor, implements the method described in any of the first aspects above.

[0010] Fifthly, embodiments of this application provide a computer program product that, when run on an industrial internet device anomaly detection device, causes the industrial internet device anomaly detection device to execute the industrial internet device anomaly detection method described in any one of the first aspects.

[0011] It is understood that the beneficial effects of the second to fifth aspects mentioned above can be found in the relevant descriptions in the first aspect mentioned above, and will not be repeated here. Attached Figure Description

[0012] To more clearly illustrate the technical solutions in the embodiments of this application, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0013] Figure 1 This is a flowchart illustrating an industrial internet device anomaly detection method provided in an embodiment of this application; Figure 2 This is a schematic diagram of the structure of the industrial internet device anomaly detection system provided in the embodiments of this application; Figure 3 This is a schematic diagram of the structure of the industrial internet device anomaly detection device provided in the embodiments of this application. Detailed Implementation

[0014] In the following description, specific details such as particular system architectures and techniques are set forth for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of this application. However, those skilled in the art will understand that this application may also be implemented in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, apparatuses, circuits, and methods have been omitted so as not to obscure the description of this application with unnecessary detail.

[0015] It should be understood that, when used in this application specification and the appended claims, the term "comprising" indicates the presence of the described features, integrals, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or a collection thereof.

[0016] It should also be understood that the term “and / or” as used in this application specification and the appended claims means any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0017] As used in this application specification and the appended claims, the term "if" may be interpreted, depending on the context, as "when," "once," "in response to determination," or "in response to detection." Similarly, the phrase "if determined" or "if detected [the described condition or event]" may be interpreted, depending on the context, as meaning "once determined," "in response to determination," "once detected [the described condition or event]," or "in response to detection [the described condition or event]."

[0018] Furthermore, in the description of this application and the appended claims, the terms "first," "second," "third," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0019] References to "one embodiment" or "some embodiments" as described in this specification mean that one or more embodiments of this application include a specific feature, structure, or characteristic described in connection with that embodiment. Therefore, the phrases "in one embodiment," "in some embodiments," "in other embodiments," "in still other embodiments," etc., appearing in different parts of this specification do not necessarily refer to the same embodiment, but rather mean "one or more, but not all, embodiments," unless otherwise specifically emphasized. The terms "comprising," "including," "having," and variations thereof mean "including but not limited to," unless otherwise specifically emphasized.

[0020] In related technologies, deep learning models are often used for anomaly detection in industrial internet devices. Before training the model, data collection from industrial internet devices is required. Because each device has different quality and characteristics, even for industrial internet devices of the same type, data from that device must be collected for model training. Moreover, the collected data needs to be labeled, for example, at least as having abnormal data or not having abnormal data. Only in this way can the trained model distinguish whether the device has anomalies. Therefore, during the period of collecting data from industrial internet devices before the model training is completed, manual anomaly detection of industrial internet devices is required.

[0021] To address the aforementioned issues, this application provides a method for detecting anomalies in industrial internet devices. First, the method acquires device data and corresponding power data for multiple industrial internet devices of the same model within a first domain. This step, by identifying multiple industrial internet devices of the same model and then acquiring their device data and corresponding power data within the first domain, limits the data collection scope to the same model and domain, facilitating accurate identification of anomalies in the industrial internet devices. Second, direct outliers are removed from the data points. Then, outlier data points are identified using the LOF algorithm combined with a first coefficient. This step first removes direct outliers and then uses the LOF algorithm to calculate the outlier degree of the collected data points, thus identifying significantly outlier data points. Then, the first coefficient of the industrial internet device to which the direct anomaly and outlier data point belong is subtracted from the first constant. This step identifies the industrial internet device to which the direct anomaly and outlier data point belong, and subtracting the first constant from the first coefficient of that industrial internet device allows for the statistical analysis of the frequency of outliers in the industrial internet device's data (the more frequent the outliers, the smaller the first coefficient), thus reflecting the probability of an anomaly in the industrial internet device (the more frequent the outliers, the greater the probability of an anomaly). Finally, the first coefficients of multiple industrial internet devices of the same model are monitored in real time until a first industrial internet device with a first coefficient less than the first threshold is identified. If so, the first industrial internet device is considered to have an anomaly in the first domain, and a repair report for the first industrial internet device is received in real time. After the anomaly is repaired, the first coefficient of the first industrial internet device is initialized. In this step, the first industrial internet device with a first coefficient less than the first threshold is identified as an anomaly device in the first domain, and the first coefficient of the first industrial internet device is initialized after the anomaly is repaired. This allows for automatic anomaly detection of industrial internet devices during the period when the deep learning model used for anomaly detection is not ready.

[0022] The industrial internet device anomaly detection method provided in this application embodiment can be applied to industrial internet device anomaly detection equipment. In this case, the industrial internet device anomaly detection equipment is the execution subject of the industrial internet device anomaly detection method provided in this application embodiment. This application embodiment does not impose any restrictions on the specific type of industrial internet device anomaly detection equipment.

[0023] For example, an industrial internet device anomaly detection device can include a data acquisition device and a processing device. The data acquisition device can include sensors suitable for the corresponding field and power detection devices inside the industrial internet device. For example, if the first field is temperature, the data acquisition device can include various types of temperature sensors and power detection devices inside the industrial internet device. The processing device can control the data acquisition device to collect device data and power data of the industrial internet device at the same time.

[0024] The processing device can be a microprocessor, a microcontroller, a mobile phone, a tablet computer, a laptop computer, a netbook, a desktop computer, etc.

[0025] To better understand the industrial internet device anomaly detection method provided in this application embodiment, the specific implementation process of the industrial internet device anomaly detection method provided in this application embodiment will be described by way of example below.

[0026] Figure 1 This document illustrates a schematic flowchart of an industrial internet device anomaly detection method provided in an embodiment of this application. The method is applied during a period when the deep learning model for anomaly detection in the industrial internet is not ready. The application involves multiple industrial internet devices of the same model (an industrial internet device is a device that is connected to the industrial internet for communication, collects information, and is remotely controlled by the industrial internet, such as a furnace that uploads internal temperature information to the industrial internet and controls its temperature). The method establishes the same first coefficient for these multiple identical industrial internet devices. The industrial internet device anomaly detection method includes: S100 acquires device data and corresponding power data for multiple industrial internet devices of the same model in the first field. A set of corresponding device data and power data constitutes a data point.

[0027] It is understandable that data can be collected from multiple industrial internet devices of the same model. The collected data consists of device data and corresponding power data of the industrial internet devices in a first domain. The first domain refers to a single domain that can be detected by a single sensor, such as temperature, voltage, vibration, etc. Device data is the specific value detected by the sensor in the first domain, such as temperature, voltage, vibration amplitude, etc. Power data is the power of the industrial internet device, and the power data is collected in correspondence with the device data. The collected data is input into the industrial internet. This method can directly obtain device data and corresponding power data of multiple industrial internet devices of the same model in the first domain from the industrial internet. A set of corresponding device data and power data constitutes a data point. The x and y coordinates of the data point are the device data and power data, respectively. One industrial internet device can collect multiple data points.

[0028] This setup limits the data scope to the same area of ​​industrial internet devices of the same model, which helps to identify anomalies in industrial internet devices.

[0029] S200 removes direct outliers from the data points, and then uses the LOF algorithm combined with the first coefficient to find outlier data points. Direct outliers are data points that are outside the process target range of the industrial internet equipment. When applying the LOF algorithm, the data point is used as the basic unit. Outlier data points are data points whose outlier degree is greater than a threshold. The number of outlier data points is directly proportional to the probability that the industrial internet equipment is abnormal.

[0030] Understandably, the first step is to remove direct outliers from the data points. Direct outliers are data points that are outside the process target range of the industrial internet device. The industrial internet device can output a process target curve to reflect the process target of the industrial internet device in the first domain. When the distance between a data point and the process target curve is greater than the maximum tolerance, it means that this data point is a direct outlier. Then, the remaining data points after removing direct outliers are placed in a two-dimensional coordinate system. The LOF algorithm is used to calculate the LOF score of all data points in the two-dimensional coordinate system. The K value of the LOF algorithm can be 1 / 20 of the number of data points in the two-dimensional coordinate system and rounded down. The LOF score can reflect the degree of outlier of a data point. An LOF score less than 1 means that the data point is in a relatively dense area of ​​data points, while an LOF score much greater than 1 means that the data point is very outlier. Data points with an LOF score greater than 2 can be regarded as outlier data points, or other thresholds greater than 1 can be used.

[0031] This setting allows for the filtering out of direct outliers and isolated data points. S300: Subtract a first constant from the first coefficient of the industrial internet device to which the direct anomaly and outlier data points belong. Output the first coefficients of multiple industrial internet devices of the same model, and without resetting the first coefficients, return to the step of obtaining the device data and corresponding power data of multiple industrial internet devices of the same model in the first domain.

[0032] It is understandable that the appearance of direct anomalies and outliers means that the probability of anomalies in industrial internet devices increases. The S100-S300 steps are continuously iterated, but each iteration outputs the first coefficient of multiple industrial internet devices of the same model. During the iterative process, each time a direct anomaly or outlier appears, the first coefficient of the industrial internet device to which the direct anomaly or outlier belongs is subtracted by the first constant. Furthermore, the first coefficient is not reset during the iterative process (i.e., it is retained for the next iteration). Therefore, the first coefficient can represent the probability that the industrial internet device has anomalies in the first domain. The smaller the first coefficient, the greater the probability that the industrial internet device has anomalies in the first domain.

[0033] With this setting, the first coefficient can effectively reflect the probability of industrial internet devices exhibiting anomalies in the first domain.

[0034] In one possible implementation, in S200, outlier data points are identified using the LOF algorithm combined with the first coefficient, including: S210, assign the first coefficient of the target industrial internet device to each data point belonging to the target industrial internet device. Here, the K value of the LOF algorithm is set to N times the initial first coefficient. Here, N is an integer greater than 1. Assigning coefficient M to a data point means that there are M data points overlapping at the coordinates of that data point.

[0035] It is understandable that the K value of the LOF algorithm is set to N × the initial first coefficient, where N is an integer greater than 1. N can be 1 / 20 of the number of data points in the two-dimensional coordinate system, and then rounded down.

[0036] This setting expands the K value by the initial first coefficient multiple, making it easier to introduce the first coefficient in the LOF algorithm later.

[0037] It can be understood that the first coefficient of an industrial internet device is assigned to each data point belonging to that device, turning one data point into M overlapping data points, where M is the first coefficient of the industrial internet device to which the data point belongs. Combined with step S210 where the K value of the LOF algorithm is N × the initial first coefficient, K must be greater than the first coefficient of any industrial internet device. In the LOF algorithm, the reachable distance = , This refers to the distance between data point m and data point o, where data point m is the k-th data point farthest from data point o. It refers to the distance from data point p to data point o, because It must be greater than 0, so the reachable distance must also be greater than 0, thus preventing the local reachability density from being infinite.

[0038] This configuration introduces a first coefficient into the LOF algorithm. Because this first coefficient changes continuously with the iteration cycle, each data point is no longer considered equivalent when calculating its LOF score. Instead, data points from industrial internet devices with larger first coefficients have higher density weights. Furthermore, since industrial internet devices with larger first coefficients imply lower anomaly probabilities, the LOF scores of other data points near these devices will be even lower. In other words, industrial internet devices close to those with low anomaly probabilities are less likely to be considered anomalous. This modified LOF algorithm thus possesses a degree of adaptive performance, improving the rationality of methods for identifying outlier data points.

[0039] S220: The LOF score of all data points is obtained through the LOF algorithm, and the data points with an LOF score greater than the second threshold are outlier data points.

[0040] It is understandable that after determining the value of k and assigning the first coefficient to the data points, the LOF score of all data points is calculated according to the LOF algorithm. Since the LOF scores of M overlapping data points are the same, the LOF score of overlapping data points is only calculated once. The steps of the LOF algorithm to obtain the LOF score are existing technology and will not be elaborated here. Data points with LOF scores greater than the second threshold are outliers. The second threshold can be 2 or other numbers greater than 1. Since the overlapping data points belong to the same industrial internet devices, the LOF score judgment of overlapping data points is also only calculated once.

[0041] With this setup, overlapping data points are counted only once when calculating the LOF score, and also only once when judging the size of the LOF score. This allows the first coefficient to be introduced into the LOF algorithm without increasing its complexity.

[0042] Furthermore, the methods also include: S230: Obtain second device data and corresponding second power data of multiple industrial internet devices of the same model in the second field, then arrange the second power data in a first sequence, and based on the correspondence between the second device data and the second power data, arrange the second device data into a sequence, and use the arrangement sequence of the second device data as a comparison sequence to obtain multiple comparison sequences.

[0043] It's understandable that some industrial internet devices span multiple domains, and these domains are closely interconnected. For example, a simple camera has two domains: operating temperature and frame rate. Excessive operating temperature can significantly reduce the camera's frame rate. In certain situations, an industrial internet device might exhibit anomalies in one domain but not in the other. However, the anomaly in the first domain affects the LOF score in the second, causing the device's LOF score to be excessively high. This specific case can lead to misjudgments by this method in the second domain of the industrial internet device. Therefore, it's necessary to consider the correlations and influences between different domains of the same industrial internet device.

[0044] Therefore, data on multiple identical industrial internet devices in a second domain and their corresponding power data are obtained from the industrial internet. The second domain is a different domain related to the first domain. The power data is then sampled in the form of a first sequence. The sampled discrete power data are arranged into the first sequence. Because there is a correspondence between the second device data and the power data, the corresponding second device data is also arranged into a specific sequence x1, and len(x1) = len(first sequence), that is, the number of terms in x1 is equal to the number of terms in the first sequence. Thus, N comparison sequences x1, x2, x3...xN are obtained, where N is the number of multiple identical industrial internet devices.

[0045] This setup takes into account the potential for mutual influence between different sectors of the same industrial internet device, thus enhancing the rationality of this approach.

[0046] S240: Select one industrial internet device with anomalies and one without anomalies from multiple industrial internet devices of the same model in the first domain. Then arrange the device data of the industrial internet devices with anomalies and those without anomalies in a first sequence. Based on the correspondence between device data and power data, arrange the device data into a sequence. Use the sequence of device data belonging to the industrial internet devices with anomalies as the first reference sequence and the sequence of device data belonging to the industrial internet devices without anomalies as the second reference sequence.

[0047] It is understandable that after a certain number of iterations, one industrial internet device of the same model can be selected from multiple industrial internet devices that are identified as abnormal in the first domain, and another industrial internet device that is identified as normal in the first domain can be selected. The power data of the industrial internet device with abnormality and the industrial internet device without abnormality can be sampled in the form of a first sequence. The sampled discrete power data are arranged into the first sequence, and the corresponding device data are also arranged into a specific sequence. The sequence of device data of the industrial internet device with abnormality is used as the first reference sequence A1, and the sequence of device data of the industrial internet device without abnormality is used as the second reference sequence A2.

[0048] This setup, which considers both malfunctioning and non-malfunctioning industrial internet devices separately, helps to resolve the problems caused by the specific situations mentioned in step S240.

[0049] S250, find the first correlation between the comparison sequence and the first reference sequence, and find the second correlation between the comparison sequence and the second reference sequence.

[0050] It can be understood that the comparison sequence is x1, x2, x3...xN, the first reference sequence is A1, the second reference sequence is A2, and the number of terms in x1, x2, x3...xN, A1, and A2 are all equal to the number of terms in the first sequence. First, calculate the correlation coefficient between each comparison sequence and the first reference sequence A1, and take A1 as x0 to form the first matrix x1(k)={x0,x1,...,xm}, where k=1,2,...,m is the number of terms in the first sequence. Specifically, the first correlation coefficient sequence is calculated using the following formula (1), which is: Where i = 1, 2, ..., N represents the number of multiple industrial internet devices of the same model. This refers to the minimum difference between the two levels of the first matrix x1(k). This refers to the maximum difference between the two levels of the first matrix x1(k). The resolution coefficient is set to 0.5. After obtaining the first correlation coefficient sequence, the average value of all items in the first correlation coefficient sequence is calculated. The average value is the first correlation degree.

[0051] Next, calculate the correlation coefficient between each comparison sequence and the second reference sequence A2, take A2 as x0, form the second matrix x2(k), similar to the first matrix, calculate the second correlation coefficient sequence by formula (1), and then calculate the average of all items in the second correlation coefficient sequence to obtain the second correlation degree.

[0052] This setup allows us to obtain the correlation between the first and second domains of industrial internet devices under both abnormal and normal conditions, which helps to determine the specific impact of abnormalities in the first domain on the LOF score of the second domain.

[0053] S260, when a target industrial internet device exhibits an anomaly in the first domain, the LOF score of all data points for the target industrial internet device in the second domain is first subtracted from the first score, and then it is determined whether the score exceeds the second threshold. The first score is obtained based on the target industrial internet device's LOF score in the first domain, the first correlation score, and the second correlation score.

[0054] It is understandable that after a certain number of iterations, an industrial internet device is identified as having an anomaly in the first domain. Then, the first score is calculated using the calculation formula (2), which is: First score = LOF score of the industrial internet device in the first domain × (first correlation - second correlation). Then, the LOF score of all data points of the industrial internet device in the second domain is first subtracted from the first score, and then it is determined whether it is greater than the second threshold.

[0055] This setup can eliminate the impact of anomalies in the first domain on the LOF score in the second domain, thus addressing the issues arising from the specific circumstances mentioned in step S240.

[0056] S400 monitors the first coefficient of multiple industrial internet devices of the same model. If there is a first industrial internet device whose first coefficient is less than a first threshold among the multiple industrial internet devices of the same model, it outputs that the first industrial internet device has an anomaly in the first domain and receives the repair report of the first industrial internet device in real time. After the anomaly is repaired, the first coefficient of the first industrial internet device is initialized.

[0057] It is understandable that during the iterative cycle, the first coefficient of multiple industrial internet devices of the same model is monitored in real time. When there is a first industrial internet device among multiple industrial internet devices of the same model whose first coefficient is less than the first threshold, it means that the first coefficient of the first industrial internet device is low enough, and thus it is identified and output that the first industrial internet device has an anomaly in the first domain. For industrial internet devices whose first coefficient is less than the first threshold, shutdown processing can be performed, and the repair report of the first industrial internet device is received in real time. After the anomaly of the first industrial internet device is repaired, the first coefficient of the first industrial internet device is initialized.

[0058] This setup allows for the rapid identification of industrial internet devices with a first coefficient less than a first threshold. Furthermore, the iterative loop and the anomaly identification steps are performed in separate threads, ensuring that a pause or stop in one thread does not affect the operation of the other, thus improving the stability of the method.

[0059] Optionally, the method also includes: S510: At each first time interval, add a second constant to all first coefficients, but the first coefficients cannot exceed the initial first coefficient. The first time interval is less than the time it takes for a purely anomalous industrial internet device to go from its initial state to being identified as anomalous. A purely anomalous industrial internet device is one whose first coefficient decreases in each cycle; the first coefficient cannot exceed the initial first coefficient.

[0060] It is understandable that, due to the influence of errors, even industrial internet devices without anomalies will inevitably have data points that are direct anomalies or outliers. Therefore, if the number of iterations is large enough, the first coefficient of any industrial internet device will eventually be less than the first threshold (i.e., it will be identified as having an anomaly in the first domain). Thus, a compensation mechanism can be established to solve this problem. At each first time interval, a second constant can be added to all the first coefficients, but the first coefficient cannot exceed the initial first coefficient. Furthermore, to ensure that all industrial internet devices are compensated by the compensation mechanism at least once, the first time interval must be less than the time it takes for a purely anomalous industrial internet device to go from its initial state to being identified as having an anomaly. A purely anomalous industrial internet device is one whose first coefficient decreases with each iteration.

[0061] This setup establishes a compensation mechanism that can address the issue of even normal industrial internet devices being identified as abnormal when the number of iterations is sufficiently high, thus improving the rationality of this method.

[0062] Optionally, the method also includes: S520, in multiple iterations, when a data point of a target industrial internet device is identified as a direct anomaly or outlier, and the number of times it has been identified as a direct anomaly or outlier exceeds the third threshold, the first coefficient of the target industrial internet device is reduced by an additional first constant.

[0063] It's understandable that when a data point from an Industrial Internet device is continuously identified as a direct anomaly or outlier, it means the probability of that device being abnormal is very high (higher than the probability of an Industrial Internet device belonging to a data point occasionally identified as a direct anomaly or outlier). In such cases, the first coefficient for that Industrial Internet device can be further reduced. Therefore, a "winning streak mechanism" is established for this method. When a data point from an Industrial Internet device is continuously identified as a direct anomaly or outlier, and the number of consecutive identifications exceeds a third threshold, when performing the step of subtracting the first constant from the first coefficient, an additional first constant is subtracted—that is, twice the first constant. Alternatively, the value subtracted from the first coefficient can be increased as the number of consecutive identifications increases.

[0064] This setup adds a "winning streak mechanism" to address situations where data points are consecutively identified as direct outliers or isolated data points, thus increasing the applicability of this method.

[0065] Optionally, the method also includes: S530 generates an alarm based on the abnormal detection results.

[0066] It is understandable that the anomaly detection result of this method is to detect an anomaly in a certain industrial Internet device in a certain field. Therefore, the anomaly alarm should at least include the unique number of the industrial Internet device that has an anomaly and the field in which the anomaly has occurred. It can also include the curve of the first coefficient of this industrial Internet device changing over time, so that users know the maximum possible time period during which the industrial Internet device has an anomaly (i.e., the time period during which the first coefficient decreases the fastest).

[0067] This setup helps maintenance personnel quickly locate the abnormality and understand its basic information.

[0068] Optionally, the method also includes: S540, after the number of iterations reaches the fourth threshold, the historical equipment data and historical power data of the industrial Internet devices identified as having no anomalies are used as the first dataset, and the historical equipment data and historical power data of the industrial Internet devices identified as having anomalies are used as the second dataset. Based on the first dataset and the second dataset, the device anomaly detection model is trained. The input of the device anomaly detection model is the data points of the industrial Internet devices, and the output is whether the industrial Internet devices have anomalies.

[0069] It is understandable that the fourth threshold is directly proportional to the confidence of the first and second datasets. The larger the value of the fourth threshold, the greater the confidence of the first and second datasets, but the longer it takes to obtain the first and second datasets. Therefore, the value of the fourth threshold can be determined according to the user's needs.

[0070] The equipment anomaly detection model can use a CNN convolutional neural network. Randomly select 3 / 4 of each of the first and second datasets as the training set, and the remaining 1 / 4 as the test set. Input the training set to train the equipment anomaly detection model. The input is the historical equipment data and historical power data of the industrial Internet devices in the training set, i.e., historical data points. The output is whether the industrial Internet device is abnormal. Test the trained model on the test set. If the accuracy is not up to standard, retrain. When the accuracy is up to standard, the model training is complete. The trained equipment anomaly detection model can determine whether the industrial Internet device is abnormal.

[0071] This setup eliminates the need for manual differentiation between industrial internet devices with and without anomalies, thus accelerating the training speed of the device anomaly detection model.

[0072] Optionally, the method also includes: S550 normalizes device data and power data.

[0073] It is understandable that a baseline value is set for the device data and power data, and the collected device data and power data are divided by the baseline value to normalize the device data and power data. The baseline value can be the device data and power data collected for the first time.

[0074] This setting can speed up the calculation of LOF scores.

[0075] Optionally, the method also includes: The S560 acquires steady-state device data and power data when industrial internet devices are in a steady state.

[0076] It's understandable that during the power fluctuations of industrial internet devices, both device data and power data will change and oscillate irregularly. Therefore, to improve the accuracy of the acquired device and power data, steady-state device and power data can be acquired only when the industrial internet device is in a steady state. A threshold time and threshold power can be set. If the difference between the peak and trough power values ​​of the industrial internet device does not exceed the threshold power within this threshold time, the industrial internet device is considered to be in a steady state.

[0077] This setting can improve the accuracy of the acquired device and power data.

[0078] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0079] Corresponding to the industrial internet device anomaly detection method described in the above embodiments, this application also provides an industrial internet device anomaly detection system, wherein each unit of the system can implement each step of the industrial internet device anomaly detection method. Figure 2 The diagram shows a structural block diagram of an industrial internet device anomaly detection system provided in an embodiment of this application. For ease of explanation, only the parts related to the embodiments of this application are shown.

[0080] Reference Figure 2 The system includes: The acquisition unit is used to acquire device data and corresponding power data of multiple industrial internet devices of the same model in the first field; wherein, a set of corresponding device data and power data constitutes a data point; The data point processing unit is used to remove direct outliers from the data points, and then find outlier data points by using the LOF algorithm and combining it with the first coefficient. Direct outliers refer to data points that are outside the process target range of the industrial Internet equipment. When using the LOF algorithm, the data point is used as the basic unit. Outlier data points refer to data points whose outlier degree is greater than the threshold. The first coefficient adjustment unit is used to subtract a first constant from the first coefficient of the industrial internet device to which the direct anomaly and outlier data point belong; output the first coefficient of multiple industrial internet devices of the same model; and, without resetting the first coefficient, return to the step of obtaining the device data and corresponding power data of multiple industrial internet devices of the same model in the first field. The anomaly identification unit is used to monitor the first coefficient of multiple industrial internet devices of the same model. If there is a first industrial internet device with a first coefficient less than a first threshold among the multiple industrial internet devices of the same model, the unit will output that the first industrial internet device has an anomaly in the first domain and receive the repair report of the first industrial internet device in real time. After the anomaly is repaired, the first coefficient of the first industrial internet device will be initialized.

[0081] It should be noted that the information interaction and execution process between the above-mentioned units are based on the same concept as the method embodiments of this application. For details on their specific functions and technical effects, please refer to the method embodiments section, which will not be repeated here.

[0082] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units is merely an example. In practical applications, the above functions can be assigned to different functional units as needed, that is, the internal structure of the system can be divided into different functional units to complete all or part of the functions described above. The functional units in the embodiments can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit. Furthermore, the specific names of the functional units are only for easy differentiation and are not intended to limit the scope of protection of this application. The specific working process of the units in the above system can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0083] This application also provides an industrial internet device anomaly detection device. Figure 3 This is a schematic diagram of the structure of an industrial internet device anomaly detection device provided in one embodiment of this application. Figure 3 As shown, the processing device 4 of the industrial internet device anomaly detection device in this embodiment includes: at least one processor 40 ( Figure 3 Only one is shown in the image), at least one memory 41 ( Figure 3(Only one is shown in the image) and a computer program 42 stored in the at least one memory 41 and executable on the at least one processor 40. When the processor 40 executes the computer program 42, it causes the processing device 4 of the industrial internet device anomaly detection device to implement the steps in any of the above-described embodiments of the industrial internet device anomaly detection method, or causes the processing device 4 of the industrial internet device anomaly detection device to implement the functions of each unit in the above-described device embodiments.

[0084] For example, the computer program 42 may be divided into one or more units, which are stored in the memory 41 and executed by the processor 40 to complete this application. The one or more units may be a series of computer program instruction segments capable of performing specific functions, which describe the execution process of the computer program 42 in the processing device 4 of the industrial internet device anomaly detection device.

[0085] The processing device 4 of the industrial internet device anomaly detection device can be a microcontroller, microprocessor, mobile phone, tablet computer, wearable device, vehicle-mounted device, laptop computer, ultra-mobile personal computer (UMPC), netbook, personal digital assistant (PDA), desktop computer, smart screen, smart TV, or handheld device with wireless communication function. The processing device 4 of the industrial internet device anomaly detection device may include, but is not limited to, a processor 40 and a memory 41. Those skilled in the art will understand that... Figure 3 This is merely an example of the processing device 4 for an industrial internet device anomaly detection equipment, and does not constitute a limitation on the processing device 4 for an industrial internet device anomaly detection equipment. It may include more or fewer components than shown in the figure, or combine certain components, or different components, such as input / output devices, network access devices, buses, etc.

[0086] The processor 40 can be a Central Processing Unit (CPU), but it can also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor.

[0087] In some embodiments, the memory 41 may be an internal storage unit of the processing device 4 of the industrial internet device anomaly detection device, such as a hard disk or memory of the processing device 4. In other embodiments, the memory 41 may be an external storage device of the processing device 4, such as a plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, etc., equipped on the processing device 4. Further, the memory 41 may include both internal and external storage units of the processing device 4. The memory 41 is used to store the operating system, applications, bootloader, data, and other programs, such as the program code of the computer program. The memory 41 can also be used to temporarily store data that has been output or will be output.

[0088] This application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps in any of the above method embodiments.

[0089] This application provides a computer program product that, when run on an industrial internet device anomaly detection device, enables the industrial internet device anomaly detection device to implement the steps in any of the above method embodiments.

[0090] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments of this application can be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include at least: any entity or device capable of carrying the computer program code to an industrial internet device anomaly detection device, a recording medium, a computer memory, a read-only memory (ROM), a random access memory (RAM), an electrical carrier signal, a telecommunication signal, and a software distribution medium, such as a USB flash drive, a portable hard drive, a magnetic disk, or an optical disk.

[0091] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail or recorded in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0092] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0093] In the embodiments provided in this application, it should be understood that the disclosed industrial internet device anomaly detection method, system, and device can be implemented in other ways. For example, the embodiments of the industrial internet device anomaly detection method, system, and device described above are merely illustrative. For instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling or direct coupling or communication connection may be an indirect coupling or communication connection through some interfaces, devices, or units, and may be electrical, mechanical, or other forms.

[0094] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0095] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be included within the protection scope of this application.

Claims

1. A method for detecting anomalies in industrial internet devices, characterized in that, During the period when a deep learning model for anomaly detection applied to the Industrial Internet is not ready, and there are multiple Industrial Internet devices of the same model in the Industrial Internet, the method includes setting the same first coefficient for multiple Industrial Internet devices of the same model: Acquire device data and corresponding power data of multiple industrial internet devices of the same model in a first field; wherein, a set of corresponding device data and power data constitutes a data point; Remove direct outliers from the data points, and then use the LOF algorithm in conjunction with the first coefficient to find outlier data points; wherein, direct outliers refer to data points that are outside the process target range of the industrial internet equipment; the data points are used as the basic unit when applying the LOF algorithm; outlier data points refer to data points whose outlier degree is greater than a threshold, and the number of outlier data points is directly proportional to the probability that the industrial internet equipment has anomalies; Subtract a first constant from the first coefficient of the industrial internet device to which the direct outlier and the outlier data point belong; output the first coefficient of multiple industrial internet devices of the same model; and without resetting the first coefficient, return to the step of obtaining the device data and corresponding power data of multiple industrial internet devices of the same model in the first field. If the monitoring outputs the first coefficient of multiple industrial internet devices of the same model, and there is a first industrial internet device whose first coefficient is less than the first threshold among the multiple industrial internet devices of the same model, then the first industrial internet device is output as having an anomaly in the first domain, and the repair report of the first industrial internet device is received in real time. After the anomaly is repaired, the first coefficient of the first industrial internet device is initialized.

2. The industrial internet device anomaly detection method as described in claim 1, characterized in that, The step of finding outlier data points using the LOF algorithm and in combination with the first coefficient includes: The first coefficient of the target industrial internet device is assigned to each of the data points belonging to the target industrial internet device; wherein, the K value of the LOF algorithm is set to N times the initial first coefficient, and N is an integer greater than 1; after assigning the coefficient M to the data point, there are M data points overlapping on the coordinates of the data point; The LOF score of all the data points is obtained by using the LOF algorithm; wherein the data points whose LOF score is greater than the second threshold are the outlier data points.

3. The industrial internet device anomaly detection method as described in claim 2, characterized in that, The method further includes: Acquire second device data and corresponding second power data of multiple industrial internet devices of the same model in a second field, then arrange the second power data in a first sequence, and based on the correspondence between the second device data and the second power data, arrange the second device data into a sequence, and use the arrangement sequence of the second device data as a comparison sequence to obtain multiple comparison sequences; From multiple industrial internet devices of the same model, select one industrial internet device with abnormality and one without abnormality in the first field. Then, arrange the device data of the industrial internet device with abnormality and the industrial internet device without abnormality in the first number sequence. Based on the correspondence between the device data and the power data, arrange the device data into a sequence. The arrangement sequence of the device data belonging to the industrial internet device with abnormality is used as the first reference number sequence, and the arrangement sequence of the device data belonging to the industrial internet device without abnormality is used as the second reference number sequence. Calculate the first correlation degree between the comparison sequence and the first reference sequence, and calculate the second correlation degree between the comparison sequence and the second reference sequence; When a target industrial internet device has an anomaly in the first domain, the LOF score of all data points of the target industrial internet device in the second domain is first subtracted from the first score, and then it is determined whether it is greater than the second threshold; wherein, the first score is obtained based on the LOF score of the target industrial internet device in the first domain, the first correlation degree and the second correlation degree.

4. The industrial internet device anomaly detection method as described in any one of claims 1 to 3, characterized in that, The method further includes: At each first time interval, add a second constant to all the first coefficients; wherein, the first time is less than the time from the initial state to the identification of an abnormality for a purely abnormal industrial internet device, the purely abnormal industrial internet device refers to an industrial internet device whose first coefficient decreases in each cycle; the first coefficient cannot exceed the initial first coefficient.

5. The industrial internet device anomaly detection method as described in any one of claims 1 to 3, characterized in that, The method further includes: In multiple iterations, when a data point of a target industrial internet device is identified as a direct anomaly or an outlier, and the number of times it has been continuously identified as a direct anomaly or an outlier exceeds a third threshold, the first coefficient of the target industrial internet device is reduced by an additional first constant.

6. The industrial internet device anomaly detection method as described in any one of claims 1 to 3, characterized in that, The method further includes: When the number of iterations reaches the fourth threshold, the historical device data and historical power data of the industrial internet devices identified as having no anomalies are used as the first dataset, and the historical device data and historical power data of the industrial internet devices identified as having anomalies are used as the second dataset. Based on the first dataset and the second dataset, a device anomaly detection model is trained. The input of the device anomaly detection model is the data points of the industrial internet devices, and the output is whether the industrial internet devices have anomalies.

7. The industrial internet device anomaly detection method as described in any one of claims 1 to 3, characterized in that, The method further includes: The device data and the power data are normalized.

8. The industrial internet device anomaly detection method as described in any one of claims 1 to 3, characterized in that, The method further includes: When the industrial internet device is in a steady state, acquire the steady-state device data and the power data.

9. An industrial internet device anomaly detection system, characterized in that, The system is applied to the Industrial Internet and includes: The acquisition unit is used to acquire device data and corresponding power data of multiple industrial internet devices of the same model in a first field; wherein, a set of corresponding device data and power data constitutes a data point; The data point processing unit is used to remove direct outliers from the data points, and then find outlier data points by using the LOF algorithm and combining it with the first coefficient; wherein, the direct outlier refers to the data point that is outside the process target range of the industrial Internet equipment, and the data point is used as the basic unit when applying the LOF algorithm; the outlier refers to the data point whose outlier degree is greater than a threshold. The first coefficient adjustment unit is used to subtract a first constant from the first coefficient of the industrial internet device to which the direct outlier point and the outlier data point belong; output the first coefficient of multiple industrial internet devices of the same model; and, without resetting the first coefficient, return to the step of obtaining the device data and corresponding power data of multiple industrial internet devices of the same model in the first field. An anomaly detection unit is used to monitor the first coefficient of multiple industrial internet devices of the same model. If there is a first industrial internet device whose first coefficient is less than a first threshold among the multiple industrial internet devices of the same model, then the unit outputs that the first industrial internet device has an anomaly in the first domain, and receives the repair report of the first industrial internet device in real time. After the anomaly is repaired, the unit initializes the first coefficient of the first industrial internet device.

Images