Edge computing-based end-side AI agent abnormal data detection method and device

Abstract

This invention provides a method and device for anomaly data detection using an edge-computing-based AI agent, relating to the field of data processing technology. The method includes: real-time data acquisition by an AI agent to obtain multiple time-series data streams; dynamic parsing of the multiple time-series data streams using a built-in time-series-spectrum adaptive joint feature extraction module of the AI ​​agent; anomaly analysis and identification of the joint feature vectors using edge computing; generation of an initial warning signal; inversion; cyclical verification of the inversion results; feedback to the AI ​​agent for updating and optimization; and construction of an anomaly data detection report. This invention solves the technical problems of low reliability and slow response speed in existing technologies, which make it difficult to efficiently and accurately identify real-time anomaly data. It achieves the technical effect of efficient and accurate detection and identification of anomaly data in a real-time environment.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and more specifically to an edge computing-based method and device for detecting abnormal data in edge-side AI agents. Background Technology

[0002] With the rapid development of the Internet of Things, the Industrial Internet, and smart devices, more and more devices and sensors are being widely deployed in various real-time monitoring systems. These devices are able to collect a large amount of time-series data and identify potential faults and safety risks through anomaly detection systems.

[0003] However, traditional anomaly detection methods typically rely on centralized computing frameworks, transmitting all collected data to a centralized server or cloud for processing. While this approach is suitable for scenarios with small data volumes and low real-time requirements, it suffers from high data transmission latency when dealing with large amounts of real-time data. This is particularly problematic in fields like industrial monitoring and smart manufacturing, where devices and sensors are widely distributed and data volumes are massive. Centralized computing leads to slower system response times, hindering rapid real-time detection. Furthermore, traditional anomaly detection methods often employ fixed detection models, lacking adaptability to real-time data. As the data environment changes, anomaly patterns may also change, but traditional models often rely on static rules and preset thresholds, failing to dynamically adjust and thus limiting detection accuracy.

[0004] Existing technologies suffer from low reliability in anomaly detection and slow response speed, making it difficult to efficiently and accurately identify real-time anomaly data. Summary of the Invention

[0005] The purpose of this application is to provide an edge computing-based method and device for detecting abnormal data in edge AI agents, in order to solve the technical problems of low reliability and slow response speed in existing technologies, which make it difficult to efficiently and accurately identify real-time abnormal data.

[0006] In view of the above problems, this application provides a method and device for detecting abnormal data of edge AI agents based on edge computing.

[0007] The first aspect of this application provides an edge computing-based method for detecting abnormal data in edge-side AI agents. This method includes: real-time data acquisition from the edge using an AI agent to obtain multiple time-series data streams; dynamic analysis of the multiple time-series data streams using a time-series-spectrum adaptive joint feature extraction module built into the AI ​​agent to construct a joint feature vector; anomaly analysis and identification of the joint feature vector using edge computing; generation of an initial warning signal based on the anomaly identification result; backtracking the initial warning signal to the AI ​​agent for inversion, generating inversion results for iterative verification, feeding back the iterative verification results to the AI ​​agent for updating and optimization, and constructing an abnormal data detection report.

[0008] Optionally, the AI ​​agent is activated to broadcast to the edge to obtain network request information; response monitoring is performed based on the network request information to locate the requesting device, and device identification information and basic device capability information are extracted based on the requesting device; multiple physical sensors are identified according to the device identification information and the basic device capability information, and these multiple physical sensors are connected to the AI ​​agent; data collection and analysis are performed based on the multiple physical sensors to set data collection task requirements; multi-source collaborative data collection and analysis is performed on the edge according to the data collection task requirements to construct a data collection scheduling strategy; the data collection scheduling strategy is executed to read data from the multiple physical sensors to obtain multiple raw data streams; the multiple raw data streams are aligned and encapsulated according to time-series data segments by the AI ​​agent to obtain multiple time-series data streams.

[0009] Optionally, a global soft clock for the AI ​​agent is introduced, which contains multiple timestamps; the multiple timestamps are used as a reference for time-series segmentation to obtain time-series data segments; timestamp overlap analysis is performed based on the time-series data segments to construct a time alignment window; the multiple original data streams are mapped to the time alignment window for alignment to generate multiple parallel data segments; the multiple parallel data segments are encapsulated to obtain the multiple time-series data streams.

[0010] Optionally, the multiple time-series data streams are synchronized to the time-series-spectrum adaptive joint feature extraction module for parallel analysis. The time-series-spectrum adaptive joint feature extraction module built into the AI ​​agent includes a time-series feature extraction branch and a spectrum feature extraction branch. The time-series feature extraction branch captures the time-series features of the multiple time-series data streams in the time dimension. The spectrum feature extraction branch captures the spectrum features of the multiple time-series data streams in the frequency dimension. Based on the multiple parallel data segments, stationarity calculation is performed to construct a stationarity index. Based on the stationarity index, instantaneous data analysis is performed to construct instantaneous characteristic analysis results. Based on the instantaneous characteristic analysis results, the time-series features and the spectrum features are fused and a fusion ratio is set. The time-series features and the spectrum features are fused according to the fusion ratio to generate a primary fused feature vector. The primary fused feature vector is cross-source associated and concatenated to construct the joint feature vector.

[0011] Optionally, based on the multiple time-series data streams, a sensing topology analysis is performed to draw a topology graph; the primary fusion feature vector is mapped to the topology graph and similarity is calculated with the multiple time-series data streams to construct an association strength feature; the primary fusion feature vector is then used for adjacency calculation according to the association strength feature to obtain multiple enhanced feature vectors; the multiple enhanced feature vectors are then concatenated to generate the joint feature vector.

[0012] Optionally, an anomaly analysis model cluster is constructed to perform parallel multi-dimensional analysis on the joint feature vector to generate heterogeneous anomaly scores; the heterogeneous anomaly scores are dynamically weighted and fused to construct a comprehensive anomaly index; a dynamic anomaly threshold is set, and the comprehensive anomaly index is compared with the dynamic anomaly threshold; when the comprehensive anomaly index is higher than the dynamic anomaly threshold, it is determined to be an anomaly; context analysis is performed based on the joint feature vector and the heterogeneous anomaly scores to determine the anomaly time; key dimension values ​​of the joint feature vector are extracted according to the anomaly time for data retrieval to construct an anomaly index trend; anomaly classification is performed based on the key dimension values ​​and the anomaly index trend to determine potential anomaly type information; and the potential anomaly type is added to the anomaly identification result.

[0013] Optionally, a historical time window is constructed centered on the abnormal moment. Based on the historical time window, comprehensive abnormal indicators and key dimension values ​​are retrieved to draw an abnormal fluctuation map. Data mutation analysis is performed based on the key dimension values ​​to determine key data mutation patterns. The abnormal identification results are comprehensively evaluated according to the potential abnormal type, the abnormal fluctuation map, and the key data mutation patterns to generate a comprehensive evaluation result. The comprehensive evaluation result includes an abnormal urgency score and an abnormal impact assessment range. Multi-level analysis is performed on the end side based on the abnormal urgency score and the abnormal impact assessment range to construct an early warning information body. Based on the early warning information body, deduplication and aggregation are performed to construct the initial early warning signal.

[0014] Optionally, the initial warning signal is transmitted in reverse to the AI ​​agent for simulation reconstruction to construct multiple simulation data sequences; feature analysis is performed based on the multiple simulation data sequences to extract multiple simulation data features; edge-side anomaly analysis is performed based on the multiple simulation data sequences to obtain multiple simulation anomaly features; virtual deduction is performed based on the multiple simulation data features and the multiple simulation anomaly features to generate an anomaly score to be verified; a comprehensive anomaly index is extracted based on the initial warning signal, and the anomaly score to be verified is compared with the comprehensive anomaly index for cyclic verification to generate the cyclic verification result.

[0015] Optionally, the cyclic verification result is used as a supervisory signal, and feedback is generated based on the supervisory signal to generate early warning source data; the early warning source data is fed back to the AI ​​agent for memory reinforcement learning to generate feedback learning results; edge adjustment is performed based on the edge computing nodes extracted by the AI ​​agent and combined with the cyclic verification result to generate the first optimization parameter; the initial early warning signal, the cyclic verification result, the feedback learning result, and the first optimization parameter are integrated to construct an optimization log; the AI ​​agent is traced throughout its entire lifecycle according to the optimization log to construct the abnormal data detection report.

[0016] A second aspect of this application provides an edge computing-based edge AI agent anomaly data detection device, comprising: a data acquisition component for real-time acquisition of multiple time-series data streams via an AI agent; a data parsing component for dynamically parsing the multiple time-series data streams using a time-series-spectrum adaptive joint feature extraction module built into the AI ​​agent to construct a joint feature vector; an anomaly identification component for performing anomaly analysis and identification on the joint feature vector using edge computing, and generating an initial warning signal based on the anomaly identification result; and a detection report construction component for backtracking the initial warning signal to the AI ​​agent for inversion, generating inversion results for cyclic verification, feeding back the cyclic verification results to the AI ​​agent for updating and optimization, and constructing an anomaly data detection report.

[0017] One or more technical solutions provided in this application have at least the following technical effects or advantages:

[0018] The method provided in this application embodiment acquires multiple time-series data streams in real time at the edge using an AI agent; it dynamically analyzes these data streams using a time-series-spectrum adaptive joint feature extraction module built into the AI ​​agent to construct a joint feature vector; it then uses edge computing to perform anomaly analysis and identification on the joint feature vector, generating an initial warning signal based on the anomaly identification results; the initial warning signal is then traced back to the AI ​​agent for inversion, generating inversion results for iterative verification, and the iterative verification results are fed back to the AI ​​agent for updating and optimization, constructing an anomaly data detection report. By combining edge computing and an AI agent, real-time data acquisition, analysis, and anomaly identification are performed at the edge, reducing data transmission latency, and the dynamically optimized model achieves the technical effect of efficient and accurate detection and identification of anomaly data in a real-time environment.

[0019] The above description is merely an overview of the technical solution of this application. To better understand the technical means of this application and to facilitate its implementation according to the description, and to make the above and other objects, features, and advantages of this application more apparent, specific embodiments of this application are described below. It should be understood that the content described in this section is not intended to identify key or important features of the embodiments of this application, nor is it intended to limit the scope of this application. Other features of this application will become readily apparent through the following description. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are merely exemplary. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0021] Figure 1 This is a flowchart illustrating the edge computing-based abnormal data detection method for edge AI agents provided in this application.

[0022] Figure 2 A schematic diagram of the edge computing-based edge AI agent abnormal data detection device provided in this application.

[0023] Figure labeling: Data acquisition component 11, data parsing component 12, anomaly identification component 13, detection report construction component 14. Detailed Implementation

[0024] This application provides a method and device for anomaly detection using edge computing-based edge AI agents, addressing the technical problems of low reliability and slow response speed in existing anomaly detection technologies, which make it difficult to efficiently and accurately identify real-time anomaly data. By combining edge computing and AI agents, real-time data acquisition, analysis, and anomaly identification are performed at the edge, reducing data transmission latency. Furthermore, through dynamic model optimization, the method achieves efficient and accurate detection and identification of anomaly data in a real-time environment.

[0025] The technical solutions of the present invention will now be clearly and completely described with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. It should be understood that the present invention is not limited to the exemplary embodiments described herein. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention. It should also be noted that, for ease of description, only the parts related to the present invention are shown in the accompanying drawings, not all of them.

[0026] Example 1, as Figure 1 As shown, this application provides a method for detecting abnormal data of edge-computing-based edge-side AI agents. The method includes:

[0027] The AI ​​agent collects data in real time from the edge, obtaining multiple time-series data streams.

[0028] Furthermore, the AI ​​agent performs real-time data acquisition on the edge to obtain multiple time-series data streams. The method includes: activating the AI ​​agent to broadcast to the edge to obtain network request information; monitoring the response based on the network request information to locate the requesting device; extracting device identification information and basic device capability information based on the requesting device; querying according to the device identification information and basic device capability information to identify multiple physical sensors, which are connected to the AI ​​agent; performing data acquisition and analysis based on the multiple physical sensors to set data acquisition task requirements; performing multi-source collaborative data acquisition and analysis on the edge based on the data acquisition task requirements to construct a data acquisition scheduling strategy; executing the data acquisition scheduling strategy to read data from the multiple physical sensors to obtain multiple raw data streams; and aligning and encapsulating the multiple raw data streams according to time-series data segments using the AI ​​agent to obtain the multiple time-series data streams.

[0029] Specifically, an AI agent refers to an intelligent device with self-learning, real-time data acquisition, and analysis capabilities, which processes data through an edge computing platform. The AI ​​agent sends broadcast information via specified communication protocols, such as Wi-Fi, Bluetooth, and Zigbee. Broadcasting is a message transmission method that does not require specifying a target device; all devices within the broadcast range can receive the message. When an edge device receives the broadcast information, it sends a network request to the AI ​​agent to obtain network request information. This network request information includes device identification information, device type information, and basic device capability information. Device identification information is a unique identifier for each device, used to distinguish different devices, such as device ID and MAC address. Device type information includes the device type and supported functions, such as sensor type and controller type. Basic device capability information includes the device's hardware capabilities, communication protocols, and processing capabilities, such as supported protocols, data acquisition frequency, and data transmission capabilities. By broadcasting to the edge, the AI ​​agent can proactively discover and locate devices in the network, obtain real-time device capability and status information, and thus perform flexible data acquisition scheduling based on device functionality and resource availability. For example, in an industrial IoT scenario, an AI agent sends broadcast signals to various devices in the workshop, and the devices generate corresponding network request information feedback after receiving the signals.

[0030] When a device responds to a broadcast message, the AI ​​agent performs response monitoring based on the acquired network request information. Response monitoring utilizes monitoring mechanisms within network communication protocols to continuously monitor the responses of devices in the network to broadcast signals, enabling precise location of the requesting device. Once the requesting device is located, the AI ​​agent further extracts its device identification information and basic capabilities using standard device management protocols such as Z-Wave and MQTT. Based on this information, the AI ​​agent queries the device's protocol stack to obtain the relationship between the requesting device and its physical sensors, as well as the types of multiple physical sensors. This determines the sensor types the requesting device possesses and the specific functions of each sensor. Multiple physical sensors are connected to the AI ​​agent through protocols such as Modbus, BACnet, and OPC. For example, if a requested device is identified as a temperature sensor, its device identification information is a specific serial number A-001, and its basic device capability information shows that it can collect temperatures ranging from -20℃ to 100℃ with a collection accuracy of 0.1℃, then based on this temperature sensor information, the corresponding physical sensor is found to be a temperature acquisition probe installed near the device in the workshop.

[0031] After identifying multiple physical sensors, data is collected and analyzed based on these sensors. Real-time requirements are considered to define the required data for each data acquisition task, including key parameters such as data type, acquisition frequency, and acquisition duration. Based on this task requirement data, an optimized scheduling algorithm is used to formulate a data acquisition scheduling strategy. For example, a shortest job first (SJF) algorithm is employed. The AI ​​agent prioritizes acquisition tasks based on sensor acquisition frequency and task execution time. In SJF, sensors with lower acquisition frequencies are allocated longer acquisition times, while sensors with higher acquisition frequencies are allocated shorter time slices. This approach maximizes resource utilization and prevents high-frequency acquisition tasks from consuming excessive computing resources and impacting the execution of other tasks. Simultaneously, priority rules are used to prioritize tasks. For instance, sensors with frequent data changes, such as vibration sensors, have higher priority and are acquired and processed first. For sensors with low-frequency changes, such as temperature sensors, longer acquisition cycles are scheduled to conserve computing resources. Assuming the temperature sensor collects data once every 10 seconds, while the vibration sensor collects data once per second, during each time slot scheduling, the vibration sensor's data acquisition task is performed first to ensure real-time data. Then, the remaining time is allocated to the temperature sensor to ensure a reasonable allocation of time and resources for the data acquisition task.

[0032] Based on the data acquisition task requirements, multi-source collaborative acquisition and analysis is performed on the edge side. This multi-source collaborative acquisition comprehensively analyzes the characteristics of data collected by different physical sensors and the correlation between data. A reasonable acquisition scheduling strategy is formulated through algorithms and rules. This strategy coordinates the data acquisition by each physical sensor according to a predetermined time and order, ensuring efficient and orderly acquisition and avoiding data conflicts and omissions. After the acquisition scheduling strategy is determined, it is executed to read data from multiple physical sensors, obtaining multiple raw data streams. These raw data streams are unprocessed sets of data directly acquired from the sensors, identified by time sequence markers and sensor information.

[0033] The AI ​​agent aligns raw data streams collected from multiple physical sensors according to time-series data segments to ensure time consistency between data. Time-series data segments are obtained by dividing continuous raw data streams into segments at certain time intervals. Alignment and encapsulation are achieved by introducing the AI ​​agent's global soft clock technology. The global soft clock contains multiple timestamps. Using the timestamps as a reference, time-series data segments in different raw data streams are aligned in time and then encapsulated according to a unified data format to obtain multiple time-series data streams. Common synchronization technologies include NTP and PTP.

[0034] By using AI agents to collect comprehensive and efficient real-time data from edge devices, accurate time-series data streams are generated, providing a consistent data foundation for subsequent anomaly detection, thereby improving the timeliness of data and the accuracy of anomaly analysis.

[0035] Furthermore, based on the AI ​​agent, the multiple raw data streams are aligned and encapsulated according to time-series data segments to obtain the multiple time-series data streams. The method includes: introducing a global soft clock of the AI ​​agent, the global soft clock containing multiple timestamps; using the multiple timestamps as a reference for time-series segmentation to obtain time-series data segments; performing timestamp overlap analysis based on the time-series data segments to construct a time alignment window; mapping the multiple raw data streams to the time alignment window for alignment to generate multiple parallel data segments; and encapsulating the multiple parallel data segments to obtain the multiple time-series data streams.

[0036] Specifically, a global soft clock for the AI ​​agent is introduced. This global soft clock provides a unified time reference for all acquired raw data streams, ensuring time consistency between devices and preventing misalignment caused by time deviations in data from different sensors. The global soft clock ensures time synchronization across multiple devices through distributed time synchronization protocols such as NTP and PTP. It contains multiple timestamps, each representing a specific acquisition time point. Based on the timestamps generated by the global soft clock, multiple raw data streams are sequentially segmented according to their timestamps. Each data stream is divided into several time-series data segments, each contained within a specific time range, such as 1 second or 5 seconds. This ensures that raw data from different sources can be organized chronologically, forming a unified time frame.

[0037] Timestamp overlap analysis is performed on time-series data segments. This analysis checks whether there are overlapping portions (i.e., points of intersection) on the time axis between time-series data segments from different raw data streams. Based on the analysis results, a time alignment window is constructed. This window is a time interval used to accommodate time-series data segments from multiple raw data streams, allowing for accurate time alignment of data from different streams. For example, if timestamp overlap analysis reveals overlap between time-series data segments from temperature and pressure raw data streams within a 1-second time range, this 1-second time range is used as the time alignment window. Time-series data segments from each raw data stream corresponding to the time alignment window's time range are extracted and arranged chronologically within the window. This aligns data from the same time range across different raw data streams, forming multiple parallel data segments. These parallel data segments represent the parallel state of time-series data from different sensors within a unified time frame. All parallel data segments are encapsulated, forming multiple time-series data streams. Data encapsulation packages the parallel data segments according to a specific data format and structure, transforming them into time-series data streams with unified specifications that are easy to store and transmit. Metadata information, such as data source, acquisition time, and data type, can be added during the encapsulation process to facilitate the management and identification of the time-series data streams. For example, parallel data segments containing temperature and pressure data can be encapsulated into JSON-formatted time-series data streams, which include key information such as data values, timestamps, and sensor identifiers. Each time-series data stream contains time-series data from different sensors, and all data is aligned, enabling subsequent analysis within a unified time frame.

[0038] By aligning and encapsulating the data, the consistency of data from different physical sensors in time is ensured, and all raw data collected can be analyzed in parallel on the same time base. This not only eliminates data deviations caused by time discrepancies, but also provides a reliable data foundation for subsequent feature extraction and anomaly detection, improving the reliability and accuracy of anomaly detection.

[0039] The AI ​​agent utilizes its built-in time-spectrum adaptive joint feature extraction module to dynamically parse the multiple time-series data streams and construct a joint feature vector.

[0040] Furthermore, the AI ​​agent utilizes its built-in time-series-spectrum adaptive joint feature extraction module to dynamically parse the multiple time-series data streams and construct a joint feature vector. The method includes: synchronizing the multiple time-series data streams to the time-series-spectrum adaptive joint feature extraction module for parallel analysis; the AI ​​agent's built-in time-series-spectrum adaptive joint feature extraction module includes a time-series feature extraction branch and a spectrum feature extraction branch; capturing the time-series features of the multiple time-series data streams in the time dimension through the time-series feature extraction branch; capturing the spectrum features of the multiple time-series data streams in the frequency dimension through the spectrum feature extraction branch; performing stationarity calculations based on the multiple parallel data segments to construct a stationarity index; performing instantaneous data analysis based on the stationarity index to construct an instantaneous characteristic analysis result; performing a fusion analysis on the time-series features and the spectrum features based on the instantaneous characteristic analysis result, and setting a fusion ratio; fusing the time-series features and the spectrum features according to the fusion ratio to generate a primary fusion feature vector; and concatenating the primary fusion feature vector across sources to construct the joint feature vector.

[0041] Specifically, multiple time-series data streams are synchronized to the time-series-spectrum adaptive joint feature extraction module built into the AI ​​agent for parallel analysis. This module includes parallel time-series feature extraction branches and spectrum feature extraction branches. The time-series feature extraction branch employs time-series analysis algorithms to extract time-dimensional features from multiple time-series data streams, primarily including time-series features such as trends, fluctuations, and periodicity. Time-series analysis algorithms include sliding window statistics and moving average methods. For example, a fixed-size sliding window is set; for the time-series data stream, the window size is set to 10 data points. The sliding window is moved sequentially across the data stream, calculating the mean, variance, and other statistics of the data within the window each time it slides. The trend of the mean reflects the overall direction of the data; if the mean gradually increases over time, it indicates an upward trend. The variance reflects the degree of data fluctuation; the larger the variance, the more drastic the data fluctuation. By analyzing whether the mean exhibits periodic repetition at different window positions, it can be determined whether the data is periodic. The moving average method smooths the data by averaging the data over a certain period to obtain the value at the current moment, thus removing short-term fluctuations and highlighting long-term trends.

[0042] The spectral feature extraction branch transforms time-series data into frequency-domain data. Through spectral analysis methods, such as the Fast Fourier Transform (FFT), the time-domain signal is decomposed into a superposition of sine and cosine waves of different frequencies, thus obtaining the spectrum of the signal in multiple time-series data streams. This captures the frequency-dimensional characteristics of the data. The specific implementation process is as follows: The input time-series data stream is sampled, ensuring the sampling frequency satisfies the Nyquist sampling theorem (i.e., the sampling frequency is at least twice the highest frequency of the signal) to avoid aliasing. The sampled discrete time-series data is segmented into segments of a certain length, each segment being a power of 2. The FFT algorithm is applied to each segment to obtain its spectrum. The spectrum contains the amplitude and phase information of different frequency components. Amplitude represents the intensity of that frequency component in the signal. By analyzing the amplitude spectrum, the main frequency components of the signal can be obtained. For example, taking a vibration time-series data stream as an example, the average vibration amplitude of the equipment in different time periods is calculated using the sliding window statistical method in the time-series feature extraction branch, thus revealing the trend of vibration amplitude change over time. After using the FFT in the spectral feature extraction branch, the energy distribution of the equipment vibration at different frequencies is obtained.

[0043] After extracting time-series and spectral features, the AI ​​agent performs stationarity calculations based on multiple parallel data segments. Stationarity refers to the statistical characteristics of data, such as whether the mean and variance change over time. Stationarity calculations can employ unit root tests, such as the ADF test, to determine data stability by calculating a stationarity index value. The closer the stationarity index value is to 0, the more stationary the data. Instantaneous data analysis is then performed based on the stationarity index, calculating the p-value of the ADF test to determine if the data is stationary. If the p-value is less than a set significance level (e.g., 0.05), the data is considered stationary; conversely, if the p-value is greater than the significance level, the data is considered non-stationary. The data is then compared with a set threshold, which can be determined based on the actual application scenario and historical data experience. For example, by performing stationarity calculations on a large amount of equipment time-series data under normal conditions, the distribution range of the stationarity index value can be obtained. The upper limit of this distribution range or a specific quantile can be used as the threshold. When the change in the stationarity index exceeds this threshold, it is determined that an instantaneous characteristic has occurred, and the instantaneous characteristic analysis results are constructed.

[0044] Based on instantaneous characteristic analysis, time-series and spectral features are fused. A fusion ratio is set; for example, the initial fusion ratios for time-series and spectral features are set to 0.5 and 0.5, respectively. If the instantaneous characteristic analysis results show significant instantaneous changes in the data, the proportion of time-series features in the fusion can be appropriately increased, as time-series features can better capture such instantaneous changes. The proportion of time-series features is increased to 0.6, and the proportion of spectral features is decreased to 0.4. Conversely, if the data has significant characteristics in the frequency domain, such as the presence of a specific fault frequency, the proportion of spectral features is increased. Then, the time-series and spectral features are fused according to the set fusion ratios. The fusion process uses a weighted summation method, multiplying the time-series and spectral features by their respective fusion ratios and then summing them to obtain the primary fused feature vector. For example, if the time-series feature value is 0.5, the spectral feature value is 0.8, and the fusion ratios are 0.4 and 0.6, respectively, then the primary fused feature vector is 0.5 × 0.4 + 0.8 × 0.6 = 0.68. The primary fusion feature vectors are cross-source correlated and spliced. Cross-source correlated splicing refers to splicing primary fusion feature vectors from different data sources, such as vibration, temperature, and pressure, according to certain rules to form a more comprehensive and integrated feature vector as a joint feature vector. The joint feature vector contains all the key information of the time-series data stream and the spectrum data stream, which can more accurately reflect the operating status of the equipment.

[0045] Through the time-spectrum adaptive joint feature extraction module, the AI ​​agent deeply fuses the time-series and spectral features of different sensors, fully utilizing the information in both time and frequency dimensions to more comprehensively and accurately describe the characteristics of the data. Compared to using only time-series or spectral features, the joint feature vector can improve the ability to identify device status, abnormal conditions, etc., thereby improving the overall detection performance of the edge AI agent in detecting abnormal data.

[0046] Furthermore, the primary fusion feature vectors are cross-source correlated and concatenated to construct the joint feature vector. The method includes: performing sensor topology analysis based on the multiple time-series data streams to draw a topology graph; mapping the primary fusion feature vectors to the topology graph and performing similarity calculation with the multiple time-series data streams to construct correlation strength features; performing adjacency calculation on the primary fusion feature vectors according to the correlation strength features to obtain multiple enhanced feature vectors; and concatenating the multiple enhanced feature vectors to generate the joint feature vector.

[0047] Specifically, the AI ​​agent performs sensor topology analysis based on multiple collected time-series data streams. Topology analysis refers to analyzing the connections, data transmission paths, and dependencies between various physical sensors, drawing a topology graph based on the spatial distribution and interactions of the physical sensors. Specifically, the topology graph is constructed through the sensor installation locations, data interaction methods, and physical connections. In the topology graph, each node represents a physical sensor, and node attributes can include sensor type, location, and acquisition frequency. By analyzing the relationships between sensors, edges are drawn between nodes. The presence or absence of edges reflects whether there is direct data transmission or functional dependency between sensors. The edge weight, representing the degree of correlation between sensors, is obtained by calculating the similarity or correlation of the sensor data streams. For example, based on data stream correlation analysis, such as Pearson correlation coefficient or mutual information, the similarity and dependency of the data streams between two sensors are quantitatively assessed, and then weights are assigned to the edges. Higher correlation or similarity leads to stronger edge weights, while lower correlation leads to weaker edge weights. The topology graph not only shows the physical connections between sensors but also reflects the strength of their correlation in data transmission and function. Topology analysis can be based on graph theory and network analysis algorithms, such as using Kruskal's algorithm or Prim's algorithm to construct minimum spanning trees, ensuring that the topology graph reflects the true sensor relationships.

[0048] The primary fusion feature vector corresponding to each sensor is mapped to each node in the topology graph. Algorithms such as cosine similarity are used to measure the similarity between the primary fusion feature vector and the feature vector of each time series data stream by calculating the cosine value of the angle between them. The higher the similarity, the stronger the association between the primary fusion feature vector and the time series data stream. In this way, multiple association strength features are obtained, which reflect the degree of association between different primary fusion feature vectors based on data stream similarity.

[0049] Based on the correlation strength feature, each pair of similar sensor data is subjected to adjacency calculation. Adjacency calculation refers to feature weighting based on the similarity between sensors, that is, weighting the primary fusion feature vector according to the correlation strength feature. This allows closely correlated feature vectors to mutually enhance each other's information representation, resulting in multiple enhanced feature vectors, where the enhanced feature vector = correlation strength feature × primary fusion feature vector. These multiple enhanced feature vectors are then concatenated to generate a joint feature vector. This joint feature vector contains data features from different sensors, integrating time series, spectrum, and inter-sensor correlation information, enabling a comprehensive and accurate description of the device's operating status, further improving the accuracy and reliability of abnormal data detection.

[0050] For example, in industrial equipment monitoring, there are three time-series data streams from a vibration sensor, a temperature sensor, and a pressure sensor, respectively. After the preceding steps, three primary fusion feature vectors are obtained: vibration primary fusion feature vector V=(0.3,0.5,0.2), temperature primary fusion feature vector T=(0.4,0.3,0.3), and pressure primary fusion feature vector P=(0.2,0.4,0.4). After drawing a topology diagram through sensor topology analysis, the correlation strength between the vibration and temperature primary fusion feature vectors is calculated to be 0.7, the correlation strength between vibration and pressure is 0.5, and the correlation strength between temperature and pressure is 0.6. After adjacent calculations based on the correlation strength, the vibration enhancement feature vector V′=(0.35,0.45,0.2), the temperature enhancement feature vector T′=(0.38,0.32,0.3), and the pressure enhancement feature vector P′=(0.22,0.38,0.4) are obtained. After concatenating these three enhanced feature vectors, a joint feature vector J=(0.35,0.45,0.2,0.38,0.32,0.3,0.22,0.38,0.4) is obtained. This joint feature vector integrates information from three data sources, which can more comprehensively reflect the operating status of the equipment and further improve the accuracy and reliability of abnormal data detection.

[0051] Edge computing is used to perform anomaly analysis and identification on the joint feature vector, and an initial warning signal is generated based on the anomaly identification results.

[0052] Furthermore, edge computing is used to perform anomaly analysis and identification on the joint feature vector. The method includes: constructing an anomaly analysis model cluster to perform parallel multi-dimensional analysis on the joint feature vector and generate heterogeneous anomaly scores; dynamically weighting and fusing the heterogeneous anomaly scores to construct a comprehensive anomaly index; setting a dynamic anomaly threshold and comparing the comprehensive anomaly index with the dynamic anomaly threshold; when the comprehensive anomaly index is higher than the dynamic anomaly threshold, it is determined to be an anomaly; contextual analysis is performed based on the joint feature vector and the heterogeneous anomaly scores to determine the anomaly time; extracting key dimension values ​​of the joint feature vector according to the anomaly time for data retrieval and constructing anomaly index trends; performing anomaly classification based on the key dimension values ​​and the anomaly index trends to determine potential anomaly type information; and adding the potential anomaly types to the anomaly identification results.

[0053] Specifically, edge computing nodes are responsible for allocating data preprocessing, feature extraction, and preliminary anomaly analysis tasks to data processing units closer to the sensors, thereby reducing data transmission latency and bandwidth pressure. An anomaly analysis model cluster is constructed, deployed on each edge node. Through multi-dimensional parallel analysis, multiple independent analysis models are comprehensively utilized to improve the accuracy and robustness of anomaly identification. The anomaly analysis model cluster includes multiple analysis models, each performing parallel multi-dimensional analysis on the joint feature vector. Different analysis models perform different analyses on the joint feature vector. Due to the differences in analysis dimensions and methods, multiple heterogeneous anomaly scores are generated, each reflecting the anomaly intensity under that dimension. The goal of the anomaly analysis model cluster is for each analysis model to analyze the joint feature vector according to its specific analysis dimensions, such as time-series features, statistical characteristics, and spectral features, and output the corresponding anomaly score. The time-series model can employ Long Short-Term Memory (LSTM) networks, a special type of recurrent neural network primarily used for processing and predicting sequential data. LSTM networks can capture long-term dependencies. An LSTM network consists of an input layer, an LSTM layer, a fully connected layer, and an output layer. The input layer receives time-series data collected by sensors; each input data point is a joint feature vector containing data from multiple sensors. The LSTM layer contains multiple LSTM units, each learning the long-term and short-term dependencies of the time-series data through its gating mechanism. The LSTM layer can capture trends, periodicities, and sudden changes based on historical data sequences. The gating mechanism includes a forget gate, an input gate, and an output gate. The forget gate determines which information to discard, the input gate determines which new information to remember, and the output gate determines the state of the output based on the current input. The LSTM output passes through a fully connected layer, outputting the predicted value of the time-series data. The output layer outputs anomaly scores. A joint feature vector sample is constructed using historical data, containing data from both normal and anomalous scenarios, arranged chronologically. The weight matrix of the LSTM network, including the connection weights and bias vectors between the input layer and the LSTM layer, between units within the LSTM layer, and between the LSTM layer and the fully connected layer, is initialized using a random initialization method, such as using a Gaussian distribution or a uniform distribution. For example, a Gaussian distribution with a mean of 0 and a standard deviation of 0.01 is used to initialize the weight matrix.In each training batch, the input layer receives time-series data collected by sensors. The input data at each time step is a joint feature vector containing data from multiple sensors. The LSTM layer's forget gate calculates a value between 0 and 1 using the sigmoid function based on the current input and the previous hidden state, determining which information from the previous cell state needs to be discarded. Similarly, the input gate calculates a value using the sigmoid function based on the current input and the previous hidden state, determining which new information needs to be remembered. Simultaneously, a new candidate cell state is generated using the tanh function. The current cell state is updated based on the outputs of the forget and input gates. The output gate calculates a value using the sigmoid function based on the current input and the previous hidden state, determining the output state based on the current input. The current cell state is then processed using the tanh function to obtain the current hidden state. The output of the LSTM layer undergoes a linear transformation through a fully connected layer to obtain the anomaly prediction value for the time-series data. The output layer outputs a heterogeneous anomaly score based on the anomaly prediction value. Based on the anomaly scores and true labels of the output layer, the mean squared error of the loss function is calculated. Starting from the output layer, the gradient of the loss function is backpropagated to the LSTM layer and the input layer according to the chain rule. The gradient of each weight matrix and bias vector is calculated to determine its contribution to the loss function. Based on the calculated gradients, the Adam optimization algorithm is used to adaptively adjust the learning rate of each parameter according to the first and second moment estimates of the gradient, updating the network weights and biases to accelerate network convergence. The above process of forward propagation, backpropagation, and parameter update is repeated until the stopping condition is met, such as reaching a preset number of training epochs (100 times) or the loss function value converges to a small range (less than 0.01). The trained LSTM anomaly analysis model is then obtained. The LSTM anomaly analysis model analyzes the joint feature vector of new inputs based on the learned characteristics and patterns of time-series data, improving its ability to identify anomalies. Statistical models identify anomalies by evaluating the statistical properties of data. Statistical anomaly detection utilizes box plot analysis, which identifies outliers based on the quartiles (Q1, Q3) and their inner and outer limits. Data points below Q1−1.5×IQR or above Q3+1.5×IQR, where IQR = Q3−Q1 is the interquartile range, are considered outliers, generating a heterogeneous anomaly score. Spectral models extract frequency components from the signal through spectral analysis, detecting anomalous patterns in the frequency domain. By extracting features such as frequency peaks, energy spectrum, and frequency distribution, heterogeneous anomaly scores are generated.

[0054] A dynamic weighted fusion method is used to fuse heterogeneous anomaly scores. Weighted fusion assigns different weights to each model's output based on its accuracy, historical performance, or other evaluation criteria. For example, it assigns an evaluation score to each model based on its test accuracy on different datasets and its historical performance data, such as success rate, false positive rate, and false negative rate in various scenarios during actual operation. These evaluation scores are then normalized to a unified numerical range, eliminating the influence of differences in the units and numerical ranges of different evaluation criteria. Based on the normalized score, corresponding weights are assigned to the output of each model; a higher score indicates better model performance. A comprehensive anomaly index is obtained by multiplying the corresponding heterogeneous anomaly scores by different weights and then summing them. This comprehensive anomaly index can more comprehensively and accurately reflect the degree of anomaly in the equipment's status. A sliding window algorithm is used to automatically adjust the dynamic anomaly threshold based on historical data. By statistically analyzing the mean and standard deviation of historical data, the dynamic anomaly threshold is set to the mean ± 3 times the standard deviation. The comprehensive anomaly index is compared with the dynamic anomaly threshold. When the comprehensive anomaly index is greater than or equal to the dynamic anomaly threshold, an anomaly is determined to exist in the current equipment. Contextual analysis is then performed based on the joint feature vector and heterogeneous anomaly scores. By comprehensively analyzing the data changes in each dimension of the joint feature vector and the changing trends of the heterogeneous anomaly scores, the continuity and correlation of the data on the time axis are analyzed to accurately determine the specific time when the anomaly occurred. Key dimension values ​​are extracted from the joint feature vector based on the anomaly time. These key dimension values ​​refer to dimensions in the joint feature vector that have a significant impact on anomaly judgment. For example, in equipment monitoring, vibration frequency and temperature change rate are key dimensions.

[0055] Data retrieval is performed based on the extracted key dimension values ​​to obtain data on these values ​​before and after the anomaly, and trend charts are plotted to construct anomaly indicator trends. These trends visually reflect the changes in anomaly indicators. By analyzing the key dimension values ​​and anomaly indicator trends, they are matched with known anomaly types to determine potential anomaly types. For example, abnormal vibration may indicate mechanical failure, while abnormal changes in temperature and pressure may suggest equipment overheating or pressure overload. Potential anomaly types are determined by comparing the key dimension values ​​and anomaly indicators with pre-defined anomaly types, and these are added to the final anomaly identification result. This result includes information such as the time of anomaly occurrence, comprehensive anomaly indicators, heterogeneous anomaly scores, and potential anomaly types.

[0056] For example, the joint feature vector contains data from three dimensions: vibration, temperature, and pressure. Through cluster analysis using an anomaly analysis model, heterogeneous anomaly scores were obtained: S1=0.7, S2=0.6, and S3=0.8. The weights were 0.3, 0.3, and 0.4, respectively. After dynamic weighted fusion, the comprehensive anomaly index S=0.7×0.3+0.6×0.3+0.8×0.4=0.71. A dynamic anomaly threshold of 0.65 was set; since S>0.65, it was determined to be an anomaly. Through contextual analysis, the anomaly time was determined to be t=10. Key dimension values ​​were extracted, and vibration and temperature data from t=8 to t=12 were used to construct an anomaly index trend chart. It was found that the vibration frequency gradually increased from t=9, and the temperature also began to rise from t=9. Combined with historical data, the potential anomaly type was determined to be a loose mechanical component failure. This type was added to the anomaly identification results, providing a clear direction for subsequent anomaly analysis and processing, further improving the accuracy and reliability of anomaly identification.

[0057] By employing multi-dimensional analysis, dynamic threshold setting, contextual analysis, and anomaly classification, the limitations of single features or models are effectively avoided, enabling accurate anomaly detection of joint feature vectors and improving the accuracy and reliability of anomaly identification.

[0058] Furthermore, the method for generating an initial warning signal based on the anomaly identification results includes: constructing a historical time window centered on the anomaly moment; retrieving comprehensive anomaly indicators and key dimension values ​​based on the historical time window to draw an anomaly fluctuation graph; performing data mutation analysis based on the key dimension values ​​to determine key data mutation patterns; comprehensively evaluating the anomaly identification results based on the potential anomaly type, the anomaly fluctuation graph, and the key data mutation patterns to generate a comprehensive evaluation result, which includes an anomaly urgency score and an anomaly impact assessment range; performing multi-level analysis on the endpoint based on the anomaly urgency score and the anomaly impact assessment range to construct a warning information body; and deduplicating and aggregating the warning information body to construct the initial warning signal.

[0059] Specifically, a historical time window is constructed centered on the anomaly moment. This historical time window extends forward and backward by a fixed time period, which can be flexibly set according to actual business needs and data characteristics, such as 10 minutes, several hours, or several days. Within the historical time window, comprehensive anomaly indicators and key dimension values ​​are retrieved. Based on the retrieved comprehensive anomaly indicators and key dimension values, an anomaly fluctuation chart is plotted in chronological order. The horizontal axis of the anomaly fluctuation chart represents time, and the vertical axis represents the comprehensive anomaly indicators and key dimension values, visually displaying the changing trends of the comprehensive anomaly indicators and key dimension values ​​within the historical time window.

[0060] Data mutation analysis based on key dimension values ​​assesses whether there are drastic fluctuations or jumps before or after an anomaly occurs. For example, by using a sliding window algorithm, the statistical characteristics of key dimension values, such as mean and variance, are calculated within a fixed time window. When the statistical characteristics change significantly, it is determined to be a data mutation, and the key data mutation pattern is identified. Key data mutation patterns include sudden jumps, mutation increases, or mutation decreases. The anomaly identification results are comprehensively evaluated based on the potential anomaly type, anomaly fluctuation graph, and key data mutation patterns to generate a comprehensive evaluation result. This result includes an anomaly urgency score and anomaly impact assessment range. The anomaly urgency score can be calculated using a weighted summation method, expressed as: Anomaly Urgency Score = w1 × Potential Type Score + w2 × Fluctuation Graph Score + w3 × Mutation Pattern Score, where w1, w2, and w3 are weighting coefficients reflecting the importance of each factor in the evaluation process and are set according to actual needs. The specific potential type score, fluctuation graph score, and mutation pattern score can be set based on historical data or empirical rules. The anomaly urgency score indicates the urgency level of the anomaly; a higher score indicates a more urgent anomaly. The anomaly impact assessment range indicates the scope of the anomaly's impact, such as whether it is a local equipment failure or a system-wide failure.

[0061] A multi-level analysis is conducted on the endpoint based on the anomaly urgency score and the anomaly impact assessment scope. The endpoint refers to the source device generating the anomaly data. This multi-level analysis includes analyzing the devices and areas affected by the anomaly and the degree of its impact. Based on the analysis results, an early warning information body is constructed. This body includes basic information about the anomaly, its urgency level, impact scope, possible causes, and recommended handling measures. A deduplication and aggregation operation is then performed on the early warning information body. Since multiple related anomalies may generate similar early warning messages, the deduplication and aggregation operation compares key fields in the early warning information body, such as anomaly type and impact scope, merging similar early warning messages, removing duplicate information, and constructing the final initial early warning signal. This signal includes the anomaly type, urgency level, impact scope, and recommended response measures.

[0062] By constructing historical time windows, drawing abnormal fluctuation charts, and performing data mutation analysis, we can gain a comprehensive and in-depth understanding of the characteristics and dynamic changes of anomalies. The comprehensive evaluation results of the anomaly urgency score and the scope of anomaly impact assessment provide a clear direction and focus for end-side analysis. The construction of early warning information bodies and the deduplication and aggregation ensure the accuracy and simplicity of early warning information, avoid information redundancy and misleading information, and improve the efficiency and reliability of early warning.

[0063] The initial warning signal is traced back to the AI ​​agent for inversion, the inversion result is generated for cyclic verification, the cyclic verification result is fed back to the AI ​​agent for updating and optimization, and an abnormal data detection report is constructed.

[0064] Furthermore, the initial warning signal is traced back to the AI ​​agent for inversion, and the inversion result is generated for iterative verification. The method includes: transmitting the initial warning signal backward to the AI ​​agent for simulation reconstruction to construct multiple simulation data sequences; performing feature analysis based on the multiple simulation data sequences to extract multiple simulation data features; performing edge-side anomaly analysis based on the multiple simulation data sequences to obtain multiple simulation anomaly features; performing virtual deduction based on the multiple simulation data features and the multiple simulation anomaly features to generate an anomaly score to be verified; extracting a comprehensive anomaly index based on the initial warning signal, comparing the anomaly score to be verified with the comprehensive anomaly index for iterative verification, and generating the iterative verification result.

[0065] Specifically, after constructing the initial warning signal, to further improve the accuracy and reliability of anomaly detection, a data reverse transmission technique is employed. This technique transmits the initial warning signal back to the AI ​​agent, where simulation algorithms reconstruct the anomaly. Reverse transmission involves replaying the detected signal to regenerate the possible anomaly occurrence process. During the simulation reconstruction phase, the AI ​​agent constructs multiple simulation data sequences based on historical data and the temporal characteristics of the warning signal to simulate the evolution of the anomaly. For example, if the initial warning signal originates from a vibration sensor and warns that the device's vibration amplitude exceeds the normal range, the AI ​​agent will construct a vibration simulation data sequence based on this signal, simulating the device's vibration modes under different conditions and analyzing the possible causes of the anomaly.

[0066] Principal component analysis (PCA) is used to perform feature analysis on multiple constructed simulation data sequences, extracting multiple simulation data features from each sequence. These features reflect the variation patterns and inherent structure of the data across different dimensions. Edge-side anomaly analysis is then performed on these multiple simulation data sequences. Edge-side anomaly analysis utilizes edge computing technology to perform anomaly analysis at edge computing nodes, analyzing each simulation data sequence to obtain multiple simulation anomaly features. These features reflect anomaly patterns in the simulation data, helping the AI ​​agent identify whether the simulation data matches actual monitored anomalies. For example, if the vibration amplitude in the simulation data changes drastically, and this change is inconsistent with the equipment's load or operating state, the AI ​​agent extracts this anomaly feature and compares it with historical data for judgment.

[0067] After acquiring multiple simulation data features and multiple simulation anomaly features, a comprehensive analysis is performed using virtual inference technology. Based on a classifier of historical data and expert knowledge, the virtual inference can simulate the development process and impact of anomalies according to the extracted features, generating an anomaly score to be verified. This score is a quantitative indicator used to measure the severity of anomalies in the current data sequence. A comprehensive anomaly index is extracted from the initial warning signal. The anomaly score to be verified is compared with the comprehensive anomaly index for iterative verification. If the anomaly score to be verified differs significantly from the comprehensive anomaly index, it indicates a potential problem in the inversion process or an error in the initial warning signal, requiring further adjustment. If the two are relatively close, it indicates that the inversion result has a certain degree of reliability. Through this comparison process, iterative verification is continuously performed to optimize the inversion result, ultimately generating a cyclical verification result. This cyclical verification result is fed back to the AI ​​agent for further updates and optimizations.

[0068] By retrospectively verifying the initial warning signal to the AI ​​agent, potential errors and deficiencies in the initial warning signal can be identified in a timely manner. Simulation data and various analytical methods can then be used to conduct a more comprehensive and in-depth assessment of anomalies. Feeding the verification results back to the AI ​​agent for updates and optimization allows the AI ​​agent to continuously learn and improve, enhancing its ability and accuracy in detecting anomalies, thereby constructing more reliable and valuable anomaly detection reports.

[0069] Furthermore, the cyclic verification results are fed back to the AI ​​agent for updating and optimization, and an abnormal data detection report is constructed. The method includes: using the cyclic verification results as a supervision signal, and generating early warning source data based on the supervision signal; feeding back the early warning source data to the AI ​​agent for memory reinforcement learning to generate feedback learning results; performing edge adjustment based on the edge computing nodes extracted by the AI ​​agent and the cyclic verification results to generate first optimization parameters; integrating the initial early warning signal, the cyclic verification results, the feedback learning results, and the first optimization parameters to construct an optimization log; and performing full lifecycle tracing of the AI ​​agent according to the optimization log to construct the abnormal data detection report.

[0070] Specifically, the results of cyclic validation are fed back to the AI ​​agent as supervisory signals. Supervisory signals refer to the process of correcting model predictions through annotation or feedback. The results of cyclic validation provide true labels for anomaly predictions; that is, after inversion and validation, the AI ​​agent can know which warning signals are genuine anomalies and which are false alarms or irrelevant. Through the feedback mechanism, the AI ​​agent can obtain more labeled data to further correct and improve its predictive capabilities. Based on the feedback cyclic validation results, warning source data is extracted, including historical anomaly data, verified anomaly moments, and key dimensions of relevant sensors.

[0071] The early warning source data is fed back to the AI ​​agent. Upon receiving the feedback signal, the AI ​​agent uses memory reinforcement learning techniques for online learning, such as Q-learning in reinforcement learning or experience replay-based techniques, to generate feedback learning results. These results reflect the AI ​​agent's knowledge updates and strategy adjustments during the learning process. Memory reinforcement learning allows the AI ​​agent to retain previous learning experience when encountering new data and continuously adjust the model in new environments to improve the accuracy of anomaly detection. Based on the cyclic verification results, the AI ​​agent performs edge adjustments using edge computing nodes deployed at the data acquisition source. These edge computing nodes handle some data analysis tasks, reducing data transmission latency. Based on the data analysis results from the edge computing nodes, the AI ​​agent adjusts the anomaly detection model parameters on those nodes, generating first optimized parameters. These first optimized parameters enable the edge computing nodes to be more accurate and efficient in subsequent anomaly detection.

[0072] The initial warning signal, cyclic verification results, feedback learning results, and the first optimization parameters are integrated to generate an optimization log. This log records the processing of each anomaly detection, optimization details, learned knowledge, and model adjustment results. By constructing the optimization log, subsequent anomaly detections can refer to historical adjustment strategies, avoiding repeated errors and enabling rapid responses to new problems based on past experience. The AI ​​agent is traced throughout its entire lifecycle according to the optimization log. This lifecycle traceability covers the entire process from the initial state to the current optimization state, including data input, processing, output, and model training and adjustment. Through comprehensive tracing, the performance changes and optimization effects of the AI ​​agent can be obtained, thus constructing an anomaly data detection report. This report not only includes detailed information about the anomaly data, such as anomaly type, occurrence time, and impact scope, but also records the AI ​​agent's optimization process and final performance evaluation.

[0073] By feeding back the cyclical verification results to the AI ​​agent for updates and optimization, the accuracy and reliability of the AI ​​agent in detecting abnormal data can be continuously improved, enabling it to better adapt to constantly changing data environments and anomalies. Constructing an anomaly detection report provides a comprehensive summary and record of the entire anomaly detection process, allowing the AI ​​agent to continuously optimize itself and ensure efficient and accurate anomaly identification and early warning in complex and dynamic environments, reducing false alarms and improving response speed.

[0074] Example 2, based on the same inventive concept as the edge computing-based abnormal data detection method for edge-side AI agents in the previous examples, such as... Figure 2As shown, this application provides an edge computing-based edge AI agent abnormal data detection device, wherein the edge computing-based edge AI agent abnormal data detection device includes:

[0075] The data acquisition component 11 is used to collect data from the edge in real time through the AI ​​agent to obtain multiple time-series data streams; the data parsing component 12 is used to dynamically parse the multiple time-series data streams using the time-series-spectrum adaptive joint feature extraction module built into the AI ​​agent to construct a joint feature vector; the anomaly identification component 13 is used to perform anomaly analysis and identification on the joint feature vector using edge computing, and generate an initial warning signal based on the anomaly identification result; the detection report construction component 14 is used to trace back the initial warning signal to the AI ​​agent for inversion, generate inversion results for cyclic verification, feed back the cyclic verification results to the AI ​​agent for updating and optimization, and construct an anomaly data detection report.

[0076] Furthermore, the data acquisition component 11 is also used for: initiating an AI agent to broadcast to the end side to obtain network request information; performing response monitoring based on the network request information to locate the requesting device, and extracting device identification information and basic device capability information based on the requesting device; querying according to the device identification information and the basic device capability information to identify multiple physical sensors, wherein the multiple physical sensors are connected to the AI ​​agent; performing data acquisition and analysis based on the multiple physical sensors to set data acquisition task requirements; performing multi-source collaborative data acquisition and analysis on the end side according to the data acquisition task requirements to construct a data acquisition scheduling strategy; executing the data acquisition scheduling strategy to read data from the multiple physical sensors to obtain multiple raw data streams; and aligning and encapsulating the multiple raw data streams according to time-series data segments based on the AI ​​agent to obtain the multiple time-series data streams.

[0077] Furthermore, the data acquisition component 11 is also used to: introduce a global soft clock for the AI ​​agent, the global soft clock containing multiple timestamps; perform time-series segmentation using the multiple timestamps as a reference to obtain time-series data segments; perform timestamp overlap analysis based on the time-series data segments to construct a time alignment window; map the multiple original data streams to the time alignment window for alignment to generate multiple parallel data segments; and encapsulate the multiple parallel data segments to obtain the multiple time-series data streams.

[0078] Furthermore, the data parsing component 12 is also used for: synchronizing the multiple time-series data streams to the time-series-spectrum adaptive joint feature extraction module for parallel analysis; the time-series-spectrum adaptive joint feature extraction module built into the AI ​​agent includes a time-series feature extraction branch and a spectrum feature extraction branch; capturing the time-series features of the multiple time-series data streams in the time dimension through the time-series feature extraction branch; capturing the spectrum features of the multiple time-series data streams in the frequency dimension through the spectrum feature extraction branch; performing stationarity calculation based on the multiple parallel data segments to construct a stationarity index; performing instantaneous data analysis based on the stationarity index to construct an instantaneous characteristic analysis result; performing fusion analysis on the time-series features and the spectrum features based on the instantaneous characteristic analysis result, and setting a fusion ratio; fusing the time-series features and the spectrum features according to the fusion ratio to generate a primary fusion feature vector; and performing cross-source association and splicing on the primary fusion feature vector to construct the joint feature vector.

[0079] Furthermore, the data parsing component 12 is also used for: performing sensor topology analysis based on the multiple time-series data streams and drawing a topology graph; mapping the primary fusion feature vector to the topology graph and performing similarity calculation with the multiple time-series data streams to construct association strength features; performing adjacency calculation on the primary fusion feature vector according to the association strength features to obtain multiple enhanced feature vectors; and concatenating the multiple enhanced feature vectors to generate the joint feature vector.

[0080] Furthermore, the anomaly identification component 13 is also used for: constructing an anomaly analysis model cluster to perform parallel multi-dimensional analysis on the joint feature vector, generating heterogeneous anomaly scores; dynamically weighting and fusing the heterogeneous anomaly scores to construct a comprehensive anomaly index; setting a dynamic anomaly threshold, and comparing the comprehensive anomaly index with the dynamic anomaly threshold; when the comprehensive anomaly index is higher than the dynamic anomaly threshold, it is determined to be an anomaly; performing contextual analysis based on the joint feature vector and the heterogeneous anomaly scores to determine the anomaly time; extracting key dimension values ​​of the joint feature vector according to the anomaly time for data retrieval, and constructing anomaly index trends; classifying anomalies based on the key dimension values ​​and the anomaly index trends to determine potential anomaly type information; and adding the potential anomaly type to the anomaly identification result.

[0081] Furthermore, the anomaly identification component 13 is also used to: construct a historical time window centered on the anomaly moment; retrieve comprehensive anomaly indicators and key dimension values ​​based on the historical time window to draw an anomaly fluctuation diagram; perform data mutation analysis based on the key dimension values ​​to determine key data mutation patterns; comprehensively evaluate the anomaly identification results according to the potential anomaly type, the anomaly fluctuation diagram, and the key data mutation patterns to generate a comprehensive evaluation result, the comprehensive evaluation result including an anomaly urgency score and anomaly impact assessment range; perform multi-level analysis on the end side according to the anomaly urgency score and the anomaly impact assessment range to construct an early warning information body; and perform deduplication and aggregation based on the early warning information body to construct the initial early warning signal.

[0082] Furthermore, the detection report construction component 14 is also used for: transmitting the initial warning signal in reverse to the AI ​​agent for simulation reconstruction to construct multiple simulation data sequences; performing feature analysis based on the multiple simulation data sequences to extract multiple simulation data features; performing edge-side anomaly analysis based on the multiple simulation data sequences to obtain multiple simulation anomaly features; performing virtual deduction based on the multiple simulation data features and the multiple simulation anomaly features to generate an anomaly score to be verified; extracting a comprehensive anomaly index based on the initial warning signal, comparing the anomaly score to be verified with the comprehensive anomaly index for cyclic verification, and generating the cyclic verification result.

[0083] Furthermore, the detection report construction component 14 is also used to: use the cyclic verification result as a supervision signal, and generate early warning source data based on the supervision signal; feed the early warning source data back to the AI ​​agent for memory reinforcement learning to generate feedback learning results; perform edge adjustment based on the edge computing nodes extracted by the AI ​​agent and the cyclic verification result to generate first optimization parameters; integrate the initial early warning signal, the cyclic verification result, the feedback learning result, and the first optimization parameters to construct an optimization log; and perform full lifecycle tracing of the AI ​​agent according to the optimization log to construct the abnormal data detection report.

[0084] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The edge computing-based edge AI agent abnormal data detection method and specific examples in the aforementioned embodiment one are also applicable to the edge computing-based edge AI agent abnormal data detection device of this embodiment. Through the foregoing detailed description of the edge computing-based edge AI agent abnormal data detection method, those skilled in the art can clearly understand the edge computing-based edge AI agent abnormal data detection device of this embodiment. Therefore, for the sake of brevity, it will not be described in detail here.

[0085] The above description of the disclosed embodiments enables those skilled in the art to make or use this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

[0086] Obviously, those skilled in the art can make several improvements and modifications to this application without departing from the principles of this application, and these improvements and modifications also fall within the protection scope of this application.

Claims

1. An edge computing-based method for detecting abnormal data in edge-side AI agents, characterized in that, The method includes: Multiple time-series data streams are obtained by real-time data collection at the edge using an AI agent; The AI ​​agent utilizes its built-in time-spectrum adaptive joint feature extraction module to dynamically parse the multiple time-series data streams and construct a joint feature vector. Edge computing is used to perform anomaly analysis and identification on the joint feature vector, and an initial warning signal is generated based on the anomaly identification results. The initial warning signal is traced back to the AI ​​agent for inversion, the inversion result is generated for cyclic verification, the cyclic verification result is fed back to the AI ​​agent for updating and optimization, and an abnormal data detection report is constructed. The AI ​​agent utilizes a built-in time-spectrum adaptive joint feature extraction module to dynamically parse the multiple time-series data streams and construct a joint feature vector. The method includes: The multiple time-series data streams are synchronized to the time-series-spectrum adaptive joint feature extraction module for parallel analysis. The AI ​​agent's built-in time-spectrum adaptive joint feature extraction module includes a time-series feature extraction branch and a spectrum feature extraction branch; The temporal features of the multiple temporal data streams in the time dimension are captured through the temporal feature extraction branch; The frequency-dimensional spectral features of the multiple time-series data streams are captured through the spectral feature extraction branch. The stationarity is calculated based on multiple parallel data segments, a stationarity index is constructed, and instantaneous data analysis is performed based on the stationarity index to construct instantaneous characteristic analysis results. Based on the instantaneous characteristic analysis results, the time-series characteristics and the spectral characteristics are fused and analyzed, and a fusion ratio is set; The temporal features and the spectral features are fused according to the fusion ratio to generate a primary fused feature vector; The primary fused feature vectors are concatenated across sources to construct the joint feature vector; Anomaly analysis and identification of the joint feature vector using edge computing is performed, the method including: An anomaly analysis model cluster is constructed to perform parallel multi-dimensional analysis on the joint feature vector, generating heterogeneous anomaly scores; The heterogeneous anomaly scores are dynamically weighted and fused to construct a comprehensive anomaly index; Set a dynamic anomaly threshold and compare the comprehensive anomaly index with the dynamic anomaly threshold; When the comprehensive anomaly index is higher than the dynamic anomaly threshold, it is determined to be an anomaly. Contextual analysis is performed based on the joint feature vector and the heterogeneous anomaly score to determine the time of the anomaly. Data retrieval is performed by extracting key dimension values ​​of the joint feature vector at abnormal moments to construct anomaly indicator trends; Based on the key dimension values ​​and the anomaly indicator trends, anomalies are classified to determine potential anomaly types. Add the potential anomaly types to the anomaly identification results.

2. The edge computing-based abnormal data detection method for edge-side AI agents as described in claim 1, characterized in that, Multiple time-series data streams are obtained by real-time data collection from the edge using an AI agent. The methods include: The AI ​​agent is activated to broadcast to the endpoint to obtain network request information; Based on the network request information, response monitoring is performed to locate the requesting device, and device identification information and basic device capability information are extracted based on the requesting device. By querying the device identification information and the device basic capability information, multiple physical sensors are identified, and these multiple physical sensors are connected to the AI ​​agent. Based on the data collected and analyzed from the multiple physical sensors, the required data for the data collection task is defined. Based on the data required for the data collection task, multi-source collaborative data collection and analysis are performed on the terminal side to construct a data collection scheduling strategy; The acquisition scheduling strategy is executed to read data from the multiple physical sensors, obtaining multiple raw data streams; The AI ​​agent aligns and encapsulates the multiple raw data streams according to time-series data segments to obtain the multiple time-series data streams.

3. The edge computing-based method for detecting abnormal data in edge-side AI agents as described in claim 2, characterized in that, The method involves aligning and encapsulating the multiple raw data streams according to time-series data segments using an AI agent to obtain the multiple time-series data streams. A global soft clock for the AI ​​agent is introduced, which contains multiple timestamps; The multiple timestamps are used as a reference for time-series segmentation to obtain time-series data fragments; Based on the time series data segments, timestamp overlap analysis is performed to construct a time alignment window; The multiple raw data streams are mapped to the time alignment window for alignment, generating multiple parallel data segments; The multiple parallel data segments are encapsulated to obtain the multiple time-series data streams.

4. The edge computing-based abnormal data detection method for edge-side AI agents as described in claim 1, characterized in that, The method for constructing the joint feature vector by cross-source association and concatenation of the primary fused feature vector includes: Based on the multiple time-series data streams, perform sensor topology analysis and draw a topology diagram; The primary fusion feature vector is mapped to a topological relationship graph and similarity is calculated with the multiple time-series data streams to construct association strength features; The primary fusion feature vectors are adjacent to each other according to the correlation strength features to obtain multiple enhanced feature vectors; The multiple enhanced feature vectors are concatenated to generate the joint feature vector.

5. The edge computing-based abnormal data detection method for edge-side AI agents as described in claim 1, characterized in that, The method for generating an initial warning signal based on the anomaly identification results includes: A historical time window is constructed with the abnormal moment as the center. Based on the historical time window, comprehensive abnormal indicators and key dimension values ​​are retrieved, and an abnormal fluctuation chart is drawn. Data mutation analysis is performed based on the key dimension values ​​to determine key data mutation patterns; The anomaly identification results are comprehensively evaluated based on the potential anomaly type, the anomaly fluctuation graph, and the key data mutation pattern to generate a comprehensive evaluation result, which includes an anomaly urgency score and an anomaly impact assessment range. Based on the abnormal emergency score and the abnormal impact assessment range, a multi-level analysis is performed on the end side to construct an early warning information system; Based on the aforementioned warning information body, duplicates are deduplicated and aggregated to construct the initial warning signal.

6. The edge computing-based abnormal data detection method for edge-side AI agents as described in claim 5, characterized in that, The initial warning signal is traced back to the AI ​​agent for inversion, and the inversion results are generated for iterative verification. The method includes: The initial warning signal is transmitted in reverse to the AI ​​agent for simulation reconstruction, and multiple simulation data sequences are constructed. Feature analysis is performed on the multiple simulation data sequences to extract multiple simulation data features; Edge-side anomaly analysis is performed based on the multiple simulation data sequences to obtain multiple simulation anomaly features; Based on the multiple simulation data features and the multiple simulation anomaly features, a virtual simulation is performed to generate an anomaly score to be verified. Based on the initial warning signal, a comprehensive anomaly index is extracted, and the anomaly score to be verified is compared with the comprehensive anomaly index for iterative verification to generate the iterative verification result.

7. The edge computing-based abnormal data detection method for edge-side AI agents as described in claim 1, characterized in that, The cyclical validation results are fed back to the AI ​​agent for updating and optimization, and an anomaly data detection report is constructed. Methods include: The cyclic verification results are used as a monitoring signal, and feedback is generated based on the monitoring signal to generate early warning source data; The early warning source data is fed back to the AI ​​agent for memory enhancement learning, generating feedback learning results; The edge computing nodes on the edge are extracted based on the AI ​​agent and the results of iterative verification are combined to adjust the edge and generate the first optimization parameters. The initial warning signal, the cyclic verification result, the feedback learning result, and the first optimization parameter are integrated to construct an optimization log; The AI ​​agent is traced throughout its entire lifecycle based on the optimization logs, and the abnormal data detection report is constructed.

8. An edge computing-based device for detecting abnormal data in edge-side AI agents, characterized in that: The step of implementing the edge computing-based edge AI agent anomaly data detection method according to any one of claims 1 to 7, wherein the edge computing-based edge AI agent anomaly data detection device comprises: The data acquisition component is used to collect data from the edge in real time through an AI agent, obtaining multiple time-series data streams. The data parsing component is used to dynamically parse the multiple time-series data streams using the time-series-spectrum adaptive joint feature extraction module built into the AI ​​agent, and construct a joint feature vector; An anomaly detection component is used to perform anomaly analysis and identification on the joint feature vector using edge computing, and to generate an initial warning signal based on the anomaly detection result; The detection report building component is used to trace back the initial warning signal to the AI ​​agent for inversion, generate inversion results for cyclic verification, feed back the cyclic verification results to the AI ​​agent for updating and optimization, and build an abnormal data detection report.

Images