Industrial Internet of Things equipment behavior pattern anomaly detection method

Abstract

The invention relates to the technical field of anomaly detection, in particular to an industrial Internet of Things equipment behavior pattern anomaly detection method. Clustering the data points according to the time domain features and the frequency domain features of the data points in the local time period, and obtaining an outlier degree and a target data point according to the number features of the data points in the data cluster and the distance features between the data points and the maximum data cluster; obtaining a first confidence coefficient according to the data difference of the target data point in other data points in a preset neighborhood range in the clustering space, the number ratio of other data clusters to which the other data points belong, and the discrete feature of the target data point; obtaining a second confidence coefficient according to the data difference between the target data point and the same historical moment, the trend difference between the target data point and the same local time period corresponding to the same historical moment, and the data fluctuation in the local time period of the target data point; and obtaining the abnormal degree of the target data point according to the comprehensive confidence coefficient and the outlier degree, and detecting the behavior state of the equipment, thereby improving the accuracy of anomaly detection.

Description

Technical Field

[0001] This invention relates to the field of anomaly detection technology, and specifically to a method for detecting anomalies in the behavior patterns of industrial Internet of Things (IoT) devices. Background Technology

[0002] Industrial equipment, interconnected through sensors, actuators, and networks, forms an intelligent production and management system. The application of Industrial Internet of Things (IIoT) devices is widespread in manufacturing, logistics, energy, and chemical industries, significantly improving production efficiency and reducing energy consumption and operating costs. As equipment scales up and system complexity increases, the likelihood of equipment failure rises. Therefore, it is necessary to monitor the operating status of equipment to ensure normal production. IIoT enables remote monitoring of equipment operating data and rapid detection of abnormal equipment behavior patterns.

[0003] Since abnormal states only occur for a small portion of the equipment's operation, the existing DBSCAN density clustering algorithm can be used to cluster the operational data over a period of time. Clusters with fewer data points are considered to correspond to the time of abnormal operation. This method can filter abnormal data without setting a monitoring threshold. However, the clustering effect of this algorithm depends on the setting of two hyperparameters: the scan radius and the minimum number of points contained. If the hyperparameters are not selected appropriately, the algorithm may mistakenly identify some non-genuine abnormal operational data as abnormal data, thus reducing the accuracy of abnormal behavior pattern detection for the industrial IoT equipment. Summary of the Invention

[0004] To address the aforementioned technical problems, the present invention aims to provide a method for detecting abnormal behavior patterns in industrial Internet of Things (IoT) devices. The specific technical solution adopted is as follows: Acquire monitoring time-series data of industrial IoT devices; The data points are clustered based on the time-domain and frequency-domain characteristics of local time periods in the monitoring time series data to obtain different data clusters; the outlier degree is obtained based on the number of data points in the data cluster and the distance between the data point and the largest data cluster; and the target data point is obtained based on the outlier degree. A first confidence level is obtained based on the data difference characteristics of other data points within a preset neighborhood of the target data point in the clustering space, the proportion of other data clusters to which the other data points belong, and the discrete characteristics of the target data point; a second confidence level is obtained based on the data difference characteristics of the target data point compared to the same historical moment, the trend difference characteristics of the target data point compared to the same historical moment in the same local time period, and the data fluctuation characteristics of the target data point within the local time period. The overall confidence level of the target data point is obtained based on the first confidence level and the second confidence level; the anomaly level of the target data point is obtained based on the overall confidence level and the outlier level; and the device behavior status is detected based on the anomaly level of the target data point.

[0005] Furthermore, the step of clustering data points based on the time-domain and frequency-domain characteristics of local time periods in the monitoring time-series data to obtain different data clusters includes: The mean, standard deviation, and dominant frequency after Fourier transform of the data points within a preset local time range are used as clustering feature values ​​of different dimensions of the data points. Based on the clustering feature values, the DBSCAN clustering algorithm is used to cluster all data points to obtain different clusters and outliers. All clusters and outliers are used as different data clusters.

[0006] Furthermore, the step of obtaining the outlier degree based on the quantity characteristics of data points in the data cluster and the distance characteristics between the data points and the largest data cluster includes: Calculate the Euclidean distance between the data point and the cluster center of the largest data cluster to obtain the discrete distance; calculate the product of the inverse of the number of data points in the data cluster to which the data point belongs and the discrete distance, and normalize it to obtain the outlier degree of the data point.

[0007] Furthermore, the step of obtaining the target data point based on the outlier degree includes: Data points whose outlier degree exceeds a preset outlier threshold are designated as target data points.

[0008] Further, the step of obtaining the first confidence level based on the data difference characteristics of other data points within a preset neighborhood of the target data point in the clustering space, the proportion of other data clusters to which the other data points belong, and the discrete characteristics of the target data point includes: Calculate the average standard deviation of the cluster feature values ​​of each dimension of other data points within a preset neighborhood to obtain the neighborhood feature difference value; calculate the reciprocal of the maximum percentage of the number of other data points belonging to the same other data cluster to obtain the distribution feature value; calculate the minimum Euclidean distance between the target data point and the nearest other data cluster to obtain the first distance; calculate the average Euclidean distance from the boundary point to the cluster center in all data clusters to obtain the boundary distance; calculate and normalize the difference between the first distance and the boundary distance to obtain the difference distance; calculate and normalize the product of the reciprocal of the neighborhood feature difference value, the distribution feature value, and the boundary distance to obtain the first confidence level of the target data point.

[0009] Further, the step of obtaining the second confidence level based on the data difference characteristics between the target data point and historical data at the same time, the trend difference characteristics of the target data point and the corresponding local time period of the same historical data time, and the data fluctuation characteristics of the target data point within the local time period includes: The target data point is fitted to the values ​​at the same historical time to obtain the fitted slope and the fitted value of the target data point; the absolute value of the difference between the value of the target data point and the fitted value is calculated to obtain the fitted difference value; the product of the fitted difference value and the absolute value of the fitted slope is calculated to obtain a first value; the average value of the Pearson correlation coefficient between the target data point and the same preset local time period corresponding to the same historical time period is calculated and negatively correlated to obtain the degree of change difference; the difference between the mean peak and the mean trough in the preset local time period of the target data point is calculated to obtain the peak-trough difference value; the product of the number of peaks in the preset local time period of the target data point and the peak-trough difference value is calculated to obtain a third value; the product of the third value, the degree of change difference value and the first value is calculated and normalized to obtain the second confidence level of the target data point.

[0010] Further, the step of obtaining the comprehensive confidence level of the target data point based on the first confidence level and the second confidence level includes: Calculate the average of the first confidence level and the second confidence level to obtain the overall confidence level of the target data point.

[0011] Further, the step of obtaining the anomaly degree of the target data point based on the comprehensive confidence level and the outlier degree includes: The product of the overall confidence level and the outlier level is calculated to obtain the anomaly level of the target data point.

[0012] Furthermore, the step of detecting the device behavior state based on the degree of anomaly of the target data point includes: The time when the anomaly level of the target data point exceeds the preset anomaly threshold is defined as the anomaly time. The proportion of the anomaly times in all times is proportional to the degree of anomaly in the behavior pattern of the industrial IoT device.

[0013] The present invention has the following beneficial effects: In this invention, acquiring data clusters can determine the distribution of data points representing different operating state characteristics in the monitoring time series data, thereby filtering target data points that may represent equipment anomalies; acquiring outlier degree can characterize the outlier characteristics of data points in the clustering space, and acquiring target data points can preliminarily determine the range of data points that may represent equipment anomalies. Acquiring first confidence level can analyze the probability that the target data point represents a real equipment anomaly based on the distribution characteristics of data points in the clustering space; acquiring second confidence level can analyze the probability that the target data point represents a real equipment anomaly based on the time series characteristics of equipment operation data. Acquiring comprehensive confidence level can accurately characterize whether the target data point can characterize equipment operation anomalies. Acquiring the anomaly degree of the target data point can reflect the anomaly degree of the equipment at the time of the target data point, and finally detect the equipment behavior state based on the anomaly degree of the target data point, improving the accuracy of equipment behavior pattern anomaly detection. Attached Figure Description

[0014] To more clearly illustrate the technical solutions and advantages in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0015] Figure 1 The flowchart illustrates an abnormal behavior pattern detection method for industrial Internet of Things (IoT) devices, as provided in one embodiment of the present invention. Detailed Implementation

[0016] To further illustrate the technical means and effects adopted by the present invention to achieve its intended purpose, the following, in conjunction with the accompanying drawings and preferred embodiments, details the specific implementation, structure, features, and effects of a method for detecting abnormal behavior patterns of industrial IoT devices according to the present invention. In the following description, different "one embodiment" or "another embodiment" do not necessarily refer to the same embodiment. Furthermore, specific features, structures, or characteristics in one or more embodiments can be combined in any suitable form.

[0017] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0018] The following description, in conjunction with the accompanying drawings, details a specific scheme for an abnormal behavior pattern detection method for industrial Internet of Things (IoT) devices provided by this invention.

[0019] Please see Figure 1The diagram illustrates a flowchart of an abnormal behavior pattern detection method for industrial IoT devices according to an embodiment of the present invention. The method includes the following steps: Step S1: Obtain monitoring time-series data of industrial IoT devices.

[0020] In this embodiment of the invention, the implementation scenario is to detect abnormal behavior patterns of industrial IoT devices to improve detection accuracy. First, monitoring time-series data of the industrial IoT devices is acquired, including data such as device temperature, vibration intensity, current, rotational speed, and power. In this embodiment, the industrial IoT devices are monitored once daily, and the monitoring time-series data duration is one day. The implementer can determine the data collection objects and duration according to the implementation scenario. To avoid differences in units during analysis, the raw data is linearly normalized to obtain the monitoring time-series data.

[0021] Step S2: Cluster the data points according to the time domain and frequency domain characteristics of the data points in the monitoring time series data to obtain different data clusters; obtain the outlier degree according to the number of data points in the data cluster and the distance between the data point and the largest data cluster; obtain the target data point according to the outlier degree.

[0022] The duration of abnormal states during equipment operation is relatively short, and the proportion of abnormal data is small, while the proportion of data during normal operation is large. Therefore, the operational data can be clustered, and the clustering results can be analyzed to determine whether the equipment's operating status is abnormal. Thus, data points are clustered based on the time-domain and frequency-domain characteristics of local time periods in the monitoring time-series data to obtain different data clusters. Preferably, in this embodiment of the invention, the step of obtaining data clusters includes: using the data mean, data standard deviation, and Fourier transform-derived dominant frequency of the data point within a preset local time range as clustering feature values ​​of different dimensions for that data point. In this embodiment of the invention, the preset local time range is a 5-minute range before and after the data point. Clustering feature values ​​of different dimensions can reflect the operating status characteristics of the data point within a local time period, and thus, data points can be clustered based on these feature values. Based on the clustering feature values, all data points are clustered using the DBSCAN clustering algorithm to obtain different clusters and outliers; all clusters and outliers are treated as different data clusters; it should be noted that the DBSCAN density clustering algorithm is an existing technology, and the specific clustering steps will not be described in detail. Outliers refer to data points that are not clustered into any cluster.

[0023] Furthermore, after obtaining different data clusters, filtering can be performed based on the clustering characteristics corresponding to abnormal data. Therefore, the outlier degree is obtained based on the number of data points in the data cluster and the distance between the data point and the largest data cluster. Preferably, in this embodiment of the invention, the step of obtaining the outlier degree includes: calculating the Euclidean distance between the data point and the cluster center of the largest data cluster to obtain the discrete distance; the largest data cluster refers to the cluster with the most data points. The data points in this cluster represent the operating data characteristics of the equipment during long-term normal operation. Therefore, the farther away from the largest data cluster in the clustering space, the more abnormal the operating data characteristics represented by the data point are, and the more likely the data point is to reflect equipment abnormality. The outlier degree of the data point is obtained by calculating the product of the reciprocal of the number of data points in the data cluster to which the data point belongs and the discrete distance and normalizing it; since the duration of the abnormal state of the equipment is relatively short, the fewer the number of data points in the data cluster, the more likely the data cluster is to represent the abnormal state of the equipment; therefore, the greater the outlier degree of the data point, the more likely the data point is to reflect the abnormal state of the equipment. Furthermore, target data points can be obtained based on the degree of outlier. Preferably, in this embodiment of the invention, the step of obtaining target data points includes: taking data points whose outlier degree exceeds a preset outlier threshold as target data points. Target data points are data points that are more likely to reflect abnormal device conditions. In this embodiment of the invention, the preset outlier threshold is 0.5, which can be determined by the implementer according to the implementation scenario.

[0024] Step S3: Obtain a first confidence level based on the data difference characteristics of other data points within the preset neighborhood of the target data point in the clustering space, the proportion of other data clusters to which other data points belong, and the discrete characteristics of the target data point; obtain a second confidence level based on the data difference characteristics of the target data point and the same historical time, the trend difference characteristics of the target data point and the same local time corresponding to the same historical time, and the data fluctuation characteristics of the target data point within the local time.

[0025] Since the settings of the two hyperparameters, scan radius and minimum number of contained points, in the DBSCAN density clustering algorithm affect the clustering results, inappropriate hyperparameter settings can lead to non-genuine anomaly data points being identified as target data points, thus affecting the accuracy of anomaly detection. Therefore, further analysis is needed to determine whether the target data points truly reflect an abnormal state. Since genuine anomaly target data points are often located in consistent anomaly regions within the cluster space, their neighboring data points should also contain similar target data points. If the distribution characteristics of neighboring data points within the cluster are similar, it means that the target data points in that local area can represent similar abnormal behavior patterns. If the scan radius in the algorithm is set too small, data points located at the boundaries of normal data clusters will be identified as target data points. Therefore, the more data points belonging to other data clusters within the neighboring region of a target data point in the cluster space, the less likely that target data point is to reflect a genuine device anomaly. Furthermore, the boundary distance between the boundary point of the normal data cluster and the cluster center is within a certain range. If the distance from the target data point to the nearest data cluster is greater than the boundary distance of the data cluster, then the target data point is more likely to reflect the real device anomaly. Therefore, the first confidence level is obtained based on the data difference characteristics of other data points in the preset neighborhood of the target data point in the cluster space, the proportion of other data clusters to which other data points belong, and the discrete characteristics of the target data point.

[0026] Preferably, in this embodiment of the invention, the step of obtaining the first confidence level includes: calculating the average of the standard deviations of the clustering feature values ​​of each dimension of other data points within a preset neighborhood range to obtain the neighborhood feature difference value; in this embodiment of the invention, the radius of the preset neighborhood range is twice the length of the scanning radius, which can be determined by the implementer according to the implementation scenario; the smaller the neighborhood feature difference value, the smaller the standard deviation of the distance feature values ​​of all dimensions of the data points within that range, the more similar the device operation characteristics represented by the data points, the greater the possibility of reflecting similar abnormal behavior patterns, and the more likely the target data point is to represent a device abnormal state that lasts for a period of time. The reciprocal of the maximum percentage of other data points belonging to the same other data cluster is calculated to obtain the distribution feature value; other data clusters refer to data clusters that do not contain the target data point. The smaller the distribution characteristic value, the more data points belonging to the same data cluster within the preset neighborhood, indicating a higher likelihood of unreasonable clustering due to inappropriate algorithm hyperparameter settings. Therefore, the target data point is less likely to reflect an abnormal device state. Conversely, the larger the distribution characteristic value, the fewer data points belonging to the same data cluster within the preset neighborhood, making the target data point more likely to be a genuine anomaly. The minimum Euclidean distance between the target data point and the nearest other data cluster is calculated to obtain the first distance. The minimum Euclidean distance is the distance between the target data point and the nearest data point in the other data clusters. A larger first distance indicates a greater distance between the target data point and other data clusters. The average Euclidean distance from the boundary points of all data clusters to the cluster centers is calculated to obtain the boundary distance. Boundary points refer to the data points in a data cluster farthest from the cluster centers. The difference between the first distance and the boundary distance is calculated and normalized to obtain the difference distance. A larger difference distance indicates a greater distance between the target data point and other data clusters, making the target data point more likely to reflect a device anomaly. Calculate the product of the reciprocal of the neighborhood feature difference value, the distribution feature value, and the boundary distance, and normalize it to obtain the first confidence level of the target data point. A higher first confidence level indicates that the target data point is more likely to represent a true anomaly in the device. The formula for obtaining the first confidence level includes: In the formula, R represents the first confidence level of the target data point. This indicates normalization, and N represents the number of dimensions of the clustering feature values ​​of the data points during the clustering process. This represents the standard deviation of the distance feature values ​​in the nth dimension. This represents the difference in neighborhood features, where K represents the maximum percentage of other data points belonging to the same other data cluster. Let L represent the distribution characteristic value, D represent the first distance, and D represent the boundary distance. The difference distance is indicated. In this embodiment of the invention, when the denominator is zero, it is replaced by a preset minimum positive number, which is 0.1. The implementer can determine the minimum positive number according to the implementation scenario.

[0027] The data from process IoT devices also possess time-series characteristics. To further analyze the accuracy of the target data points in representing anomalies, it is necessary to assess the anomaly confidence level of the target data points from a time dimension. Since the operating status of equipment often follows specific patterns over time, if the trend of the target data point's time period deviates from the expected trend of historical data, the target data point is more likely to reflect a genuine anomaly. Typically, the fluctuation of equipment operating data is within a certain range; if the fluctuation of the target data point's time period is excessively high, it also implies a higher probability of an anomaly. Therefore, a second confidence level is obtained based on the differences between the target data point and historical data at the same time, the trend differences between the target data point and the corresponding local time period at the same historical time, and the data fluctuation characteristics within the local time period of the target data point.

[0028] Preferably, in this embodiment of the invention, the step of obtaining the second confidence level includes: fitting the target data point and the values ​​at the same historical moment to obtain the fitting slope and the fitting value of the target data point; in this embodiment of the invention, the number of similar historical moments is 5, which can be determined by the implementer according to the implementation scenario. The fitting slope reflects the changing trend of the data at the same moment. When the absolute value of the fitting slope is larger, it means that the data changing trend is more obvious, and the operating data of the target data point is more likely to characterize the equipment abnormality. Calculate the absolute value of the difference between the value of the target data point and the fitting value to obtain the fitting difference value; when the fitting difference value is larger, it means that the difference between the real data and the fitted data is larger, and the target data point is more likely to reflect the real abnormality. Calculate the product of the fitting difference value and the absolute value of the fitting slope to obtain the first value; when the first value is larger, it means that the target data point is more likely to characterize the abnormal state of the equipment. The average Pearson correlation coefficient of the target data point and the corresponding preset local time period at the same historical moment is calculated and negatively correlated to obtain the degree of variation. It should be noted that the Pearson correlation coefficient is existing technology, and the specific calculation steps will not be elaborated further. A larger Pearson correlation coefficient means that the change trends between the two sequences are more similar. In this embodiment, the duration of the preset local time period is a 10-minute range before and after the target data point. The implementer can determine this according to the implementation scenario. A greater degree of variation means that the data difference between the preset local time period where the target data point is located and multiple historical identical time periods is greater, and the target data point is more likely to reflect equipment anomalies. The difference between the average peak and the average trough within the preset local time period of the target data point is calculated to obtain the peak-trough difference. A larger peak-trough difference means that the fluctuation of the time period where the target data point is located is more obvious. The product of the number of peaks and the peak-trough difference within the preset local time period of the target data point is calculated to obtain a third value. A larger third value means that the data fluctuation of the local time period of the target data point is more obvious, and the target data point is more likely to reflect real equipment anomalies. Calculate the product of the third value, the degree of variation, and the first value, and normalize it to obtain the second confidence level of the target data point. A higher second confidence level indicates that the target data point is more likely to reflect a true equipment anomaly. The formula for obtaining the second confidence level includes: In the formula, W represents the second confidence level of the target data point. H represents normalization, H represents the fit difference value, and M represents the absolute value of the fit slope. Indicates the first value. This represents the average Pearson correlation coefficient between the target data point and the same preset local time period corresponding to the same historical moment. This represents an exponential function with the natural constant as its base. This indicates the degree of variation, and F represents the third value.

[0029] Step S4: Obtain the comprehensive confidence level of the target data point based on the first confidence level and the second confidence level; obtain the anomaly level of the target data point based on the comprehensive confidence level and the outlier level; detect the device behavior status based on the anomaly level of the target data point.

[0030] After obtaining the first and second confidence levels of all target data points, the overall confidence level of the target data points can be obtained based on the first and second confidence levels. Preferably, in this embodiment of the invention, the step of obtaining the overall confidence level includes: calculating the average of the first and second confidence levels to obtain the overall confidence level of the target data point; the higher the overall confidence level, the more accurately the target data point can characterize the true anomaly of the device. Further, the degree of anomaly of the target data point can be obtained based on the overall confidence level and the outlier level; preferably, in this embodiment of the invention, the step of obtaining the degree of anomaly includes: calculating the product of the overall confidence level and the outlier level to obtain the degree of anomaly of the target data point; the higher the degree of anomaly, the more abnormal the behavior pattern of the device at the time of the target data point. Finally, the device behavior status can be detected based on the degree of anomaly of the target data point; preferably, in this embodiment of the invention, the time when the degree of anomaly of the target data point exceeds a preset anomaly threshold is taken as the anomaly time, and the proportion of anomaly times in all times is proportional to the degree of anomaly in the behavior pattern of the industrial IoT device. A higher percentage of abnormal moments indicates a greater degree of abnormality in the behavior of the industrial IoT device, necessitating more timely warnings and maintenance. Therefore, different anomaly levels can be set based on the percentage of abnormal moments, allowing relevant personnel to understand the severity of equipment anomalies. Implementers can determine their own preset anomaly thresholds and methods for judging the severity of anomalies based on the implementation scenario; no restrictions are imposed here. Thus, by analyzing the comprehensive confidence and outlier levels of the target data points, the accuracy of anomaly detection in the device behavior model is improved.

[0031] In summary, this invention provides a method for detecting abnormal behavior patterns in industrial IoT devices. It clusters data points based on their temporal and frequency domain characteristics within a local time period. The outlier degree and target data point are obtained based on the number of data points within each cluster and the distance between each data point and the largest cluster. A first confidence level is obtained based on the data differences between the target data point and other data points within a preset neighborhood in the clustering space, the proportion of other data points belonging to other data clusters, and the discrete characteristics of the target data point. A second confidence level is obtained based on the data differences between the target data point and historical data points at the same time, the trend differences between the target data point and historical data points at the same local time period, and the data fluctuations within the target data point's local time period. The method combines the combined confidence level and the outlier degree to determine the degree of abnormality of the target data point and detect the device's behavior status, thus improving the accuracy of anomaly detection.

[0032] It should be noted that the order of the above embodiments of the present invention is merely for descriptive purposes and does not represent the superiority or inferiority of the embodiments. The processes depicted in the accompanying drawings do not necessarily require a specific or sequential order to achieve the desired result. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0033] The various embodiments in this specification are described in a progressive manner. The same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on describing the differences from other embodiments.

Claims

1. A method for detecting abnormal behavior patterns of industrial Internet of Things (IoT) devices, characterized in that, The method includes the following steps: Acquire monitoring time-series data of industrial IoT devices; The data points are clustered based on the time-domain and frequency-domain characteristics of local time periods in the monitoring time series data to obtain different data clusters; the outlier degree is obtained based on the number of data points in the data cluster and the distance between the data point and the largest data cluster; and the target data point is obtained based on the outlier degree. A first confidence level is obtained based on the data difference characteristics of other data points within a preset neighborhood of the target data point in the clustering space, the proportion of other data clusters to which the other data points belong, and the discrete characteristics of the target data point; a second confidence level is obtained based on the data difference characteristics of the target data point compared to the same historical moment, the trend difference characteristics of the target data point compared to the same historical moment in the same local time period, and the data fluctuation characteristics of the target data point within the local time period. The overall confidence level of the target data point is obtained based on the first confidence level and the second confidence level; the anomaly level of the target data point is obtained based on the overall confidence level and the outlier level; and the device behavior status is detected based on the anomaly level of the target data point.

2. The method for detecting abnormal behavior patterns of industrial IoT devices according to claim 1, characterized in that, The step of clustering data points based on the time-domain and frequency-domain characteristics of local time periods in the monitoring time-series data to obtain different data clusters includes: The mean, standard deviation, and dominant frequency after Fourier transform of the data points within a preset local time range are used as clustering feature values ​​of different dimensions of the data points. Based on the clustering feature values, the DBSCAN clustering algorithm is used to cluster all data points to obtain different clusters and outliers. All clusters and outliers are used as different data clusters.

3. The method for detecting abnormal behavior patterns of industrial IoT devices according to claim 1, characterized in that, The step of obtaining the outlier degree based on the quantity characteristics of data points in the data cluster and the distance characteristics between the data points and the largest data cluster includes: Calculate the Euclidean distance between the data point and the cluster center of the largest data cluster to obtain the discrete distance; calculate the product of the inverse of the number of data points in the data cluster to which the data point belongs and the discrete distance, and normalize it to obtain the outlier degree of the data point.

4. The method for detecting abnormal behavior patterns of industrial IoT devices according to claim 1, characterized in that, The step of obtaining the target data point based on the outlier degree includes: Data points whose outlier degree exceeds a preset outlier threshold are designated as target data points.

5. The method for detecting abnormal behavior patterns of industrial IoT devices according to claim 3, characterized in that, The step of obtaining the first confidence level based on the data difference characteristics of other data points within a preset neighborhood of the target data point in the clustering space, the proportion of other data clusters to which the other data points belong, and the discrete characteristics of the target data point includes: Calculate the average standard deviation of the cluster feature values ​​of each dimension of other data points within a preset neighborhood to obtain the neighborhood feature difference value; calculate the reciprocal of the maximum percentage of the number of other data points belonging to the same other data cluster to obtain the distribution feature value; calculate the minimum Euclidean distance between the target data point and the nearest other data cluster to obtain the first distance; calculate the average Euclidean distance from the boundary point to the cluster center in all data clusters to obtain the boundary distance; calculate and normalize the difference between the first distance and the boundary distance to obtain the difference distance; calculate and normalize the product of the reciprocal of the neighborhood feature difference value, the distribution feature value, and the boundary distance to obtain the first confidence level of the target data point.

6. The method for detecting abnormal behavior patterns of industrial IoT devices according to claim 1, characterized in that, The step of obtaining the second confidence level based on the data difference characteristics between the target data point and historical data at the same time, the trend difference characteristics of the target data point and the corresponding local time period, and the data fluctuation characteristics of the target data point within the local time period includes: The target data point is fitted to the values ​​at the same historical time to obtain the fitted slope and the fitted value of the target data point; the absolute value of the difference between the value of the target data point and the fitted value is calculated to obtain the fitted difference value; the product of the fitted difference value and the absolute value of the fitted slope is calculated to obtain a first value; the average value of the Pearson correlation coefficient between the target data point and the same preset local time period corresponding to the same historical time period is calculated and negatively correlated to obtain the degree of change difference; the difference between the mean peak and the mean trough in the preset local time period of the target data point is calculated to obtain the peak-trough difference value; the product of the number of peaks in the preset local time period of the target data point and the peak-trough difference value is calculated to obtain a third value; the product of the third value, the degree of change difference value and the first value is calculated and normalized to obtain the second confidence level of the target data point.

7. The method for detecting abnormal behavior patterns of industrial IoT devices according to claim 1, characterized in that, The step of obtaining the comprehensive confidence level of the target data point based on the first confidence level and the second confidence level includes: Calculate the average of the first confidence level and the second confidence level to obtain the overall confidence level of the target data point.

8. The method for detecting abnormal behavior patterns of industrial IoT devices according to claim 1, characterized in that, The step of obtaining the anomaly degree of the target data point based on the comprehensive confidence level and the outlier degree includes: The product of the overall confidence level and the outlier level is calculated to obtain the anomaly level of the target data point.

9. The method for detecting abnormal behavior patterns of industrial IoT devices according to claim 1, characterized in that, The step of detecting the device behavior status based on the degree of anomaly of the target data points includes: The time when the anomaly level of the target data point exceeds the preset anomaly threshold is defined as the anomaly time. The proportion of the anomaly times in all times is proportional to the degree of anomaly in the behavior pattern of the industrial IoT device.

Images