Internet of Things equipment intelligent detection method and system based on neural network

Abstract

The invention relates to the technical field of home Internet of Things monitoring and control, in particular to an Internet of Things equipment intelligent detection method and system based on a neural network, and the method comprises the steps: synchronously collecting a user control instruction, an equipment response signal, network delay, feedback time consumption and energy consumption change data through a home equipment gateway; an interaction behavior chain data set is constructed based on timestamp alignment, duration normalization is carried out on behavior chains according to control instruction triggering time and equipment state change time, and local time sequence features representing delay fluctuation and power consumption mutation are extracted through a one-dimensional convolutional neural network; time sequence modeling and anomaly scoring are carried out in combination with a gating circulation unit network and an attention mechanism, an anomaly detection result and a corresponding anomaly behavior subchain are output, and multi-dimensional complex anomaly detection is achieved. And finally, associating the exception occurrence frequency with an equipment maintenance record, carrying out validity verification on the exception behavior sub-chain, and executing incremental training updating, thereby effectively reducing the false report rate and the missing report rate, and improving the accuracy and robustness of exception detection.

Description

Technical Field

[0001] This invention relates to the field of home IoT monitoring and control technology, and more particularly to an intelligent detection method and system for IoT devices based on neural networks. Background Technology

[0002] In smart home and smart building scenarios, a large number of lighting, electrical appliances, security, and environmental control devices are connected to home or building networks via the Internet of Things (IoT). Users can control these devices through various means such as mobile applications, voice assistants, and automated scenarios. To ensure the long-term stable operation of these devices, the industry has widely introduced functions such as equipment status monitoring, fault alarms, and remote maintenance.

[0003] However, most existing monitoring methods are based on the online status of a single device, simple operating parameters, or alarm codes, and make judgments based on fixed thresholds or rules. This makes it difficult to identify anomalies hidden in complex interaction processes in a timely and accurate manner. For example, a user may repeatedly click the switch button on a mobile device, but the lighting device may only respond intermittently; a smart lock may report that the instruction was executed successfully, but the lock body may not actually move; the performance of the terminal device may degrade, resulting in high delays in user instruction scheduling; or some devices may not execute in the expected order after the scene linkage script is triggered. Summary of the Invention

[0004] To address the above problems, this invention provides a method and system for intelligent detection of Internet of Things (IoT) devices based on neural networks.

[0005] To achieve the above objectives, the technical solution adopted by the present invention is as follows: A neural network-based intelligent detection method for IoT devices includes the following steps: S1. Collect user control commands, device response signals, network latency, feedback time and energy consumption change data through the home device gateway, and perform time-series alignment of the data according to the timestamp to obtain the interaction behavior chain dataset. S2. Based on the control command trigger time and the device state change time, the duration of the interaction behavior chain is normalized, and based on the preset state transition rules and energy consumption change threshold, each duration-normalized interaction behavior chain sequence is divided into a start segment, an execution segment, and a feedback segment to obtain a segmented behavior chain sequence. S3. Input the segmented behavior chain sequence into a one-dimensional convolutional neural network according to the time window, perform convolution and pooling operations, extract local temporal features that characterize delay fluctuations and power consumption changes, and obtain convolutional feature vectors. S4. Input the convolutional feature sequence into the gated recurrent unit network for temporal modeling, calculate the attention weight and anomaly score at each time step through the attention mechanism, and filter and output the anomaly detection results and corresponding abnormal behavior subchains according to the preset threshold. S5. Based on the frequency of anomalies and corresponding equipment maintenance records obtained during subsequent operation, the validity of the abnormal behavior subchain is verified. Based on the abnormal behavior subchains that have been verified as real anomalies, incremental training samples are constructed. Based on the incremental training samples, the parameters of the one-dimensional convolutional neural network are incrementally trained and updated.

[0006] Furthermore, the process of collecting user control commands, device response signals, network latency, feedback time, and energy consumption change data through the home device gateway includes the following steps: The system parses the original messages reported by the control terminal connected to the home device gateway, extracts the initiation time of the control command, the target device identifier and control parameters, and generates the corresponding user control command according to the control session. Monitor the status messages reported by the target device through the home device gateway, extract the device switch status, working mode and fault flag fields, and generate the device response signal associated with the user control command; Network latency is calculated based on the timestamp of the control message sent by the home device gateway and the timestamp of the response message received by the device. Feedback time is calculated based on the time difference between the control command initiation time and the device state stabilization time. The power consumption readings before and after the operation are obtained through the power metering module corresponding to the target device, and the energy consumption change data within the unit operation window is calculated.

[0007] Furthermore, the step of aligning the data according to timestamps to obtain the interaction behavior chain dataset includes the following steps: The user control commands, device response signals, network latency, feedback time, and energy consumption change data are sorted in ascending order by timestamp, and several interactive session windows are divided based on the control command initiation time and the preset session timeout time. Within each interactive session window, a unified timeline is constructed at preset time intervals, mapping user control commands, device response signals, network latency, feedback time, and energy consumption changes falling within the same time interval to action values, response values, latency values, and energy consumption status values ​​for the corresponding time steps. For missing action values, response values, delay values, and energy consumption status values ​​in each time step, interpolation filling or the preservation of the most recent valid value is performed, and the processed data of each time step are concatenated in chronological order to generate an interactive behavior chain.

[0008] Furthermore, the step of normalizing and aligning the interaction behavior chain based on the control command trigger time and device state change time includes the following steps: The initiation time of the control command in each interaction chain is used as the start timestamp, and the device state stabilization time or feedback completion time is used as the end timestamp. The duration of the entire control process is calculated, and the duration of the entire control process is scaled proportionally according to the preset standard duration to obtain the duration normalization coefficient. Based on the duration normalization coefficient, a linear transformation is performed on the timestamps of each time step in the interaction behavior chain to map the entire control process to a unified normalized time interval, resulting in a duration-normalized interaction behavior chain sequence.

[0009] Furthermore, the one-dimensional convolutional neural network is trained through the following steps: Based on historical interaction behavior chain data and corresponding anomaly markers, the interaction behavior chain data is normalized in duration, segmented semantically, and divided into time windows. The action values, response values, delay values, and energy consumption status values ​​within each time window are concatenated in chronological order to construct a one-dimensional time-series training sample set. The one-dimensional time-series training sample set is input into a one-dimensional convolutional neural network, and convolution and pooling operations are performed to extract local time-series features that characterize user action patterns, device response changes and the coupling relationship between latency fluctuations and power consumption mutations, and obtain the corresponding convolutional feature vectors. The loss value is calculated based on the convolutional feature vector and the corresponding real anomaly marker. The gradient descent algorithm is used to backpropagate and update the convolutional kernel weights and bias parameters until the loss value meets the preset convergence condition.

[0010] Furthermore, the loss value calculated based on the convolutional feature vector and the corresponding true anomaly label is calculated using the following loss function: ; in, This is the loss value; The number of samples; Label the i-th sample as a true anomaly; Let be the anomaly prediction probability corresponding to the i-th sample.

[0011] Further, S4 includes the following steps: The convolutional feature vector is used as a time series input to the gated recurrent unit network, and state updates are performed sequentially at each time step to obtain the corresponding temporal hidden state sequence. Attention scores are calculated based on the hidden state vectors and trainable context vectors at each time step in the time-series hidden state sequence, and attention weights at each time step are obtained through Softmax normalization. The attention weights are used to perform a weighted summation of the temporal hidden state sequence to obtain an anomaly discrimination vector that represents the global features of the entire interaction behavior chain. Based on the anomaly discrimination vector, the output layer calculates the anomaly score for each time step, and determines the anomaly detection result and the corresponding abnormal behavior sub-chain according to a preset threshold.

[0012] Furthermore, the validity verification of the abnormal behavior subchain based on the frequency of anomalies and corresponding equipment maintenance records obtained during subsequent operation includes the following steps: Extract the device identifier, anomaly type, and anomaly occurrence time corresponding to each abnormal behavior subchain output by the gated loop unit network, classify and statistically analyze the abnormal behavior subchains according to the device identifier and anomaly type, and calculate the anomaly occurrence frequency of each type of abnormal behavior subchain within a preset statistical period. Obtain equipment maintenance records containing equipment identifier, maintenance time, fault type, and handling measures; match the equipment maintenance records with the corresponding abnormal behavior subchain based on the equipment identifier and time window; and determine the consistency between the fault type and the abnormal detection result. Subchains of abnormal behaviors whose frequency of occurrence exceeds a preset frequency threshold and whose abnormal detection results are consistent with the fault type are marked as real abnormalities, thus obtaining subchains of abnormal behaviors that have been verified as real abnormalities.

[0013] Furthermore, the incremental training samples constructed from the sub-chains of anomalous behaviors verified as genuine anomalies, and the incremental training and updating of the parameters of the one-dimensional convolutional neural network based on these incremental training samples, include: Using the real-time parameters of the one-dimensional convolutional neural network as initial parameters, the incremental training sample set is input into the one-dimensional convolutional neural network in batches. The incremental loss value is calculated based on the loss function and gradient descent is performed to update the convolutional kernel weights and bias parameters.

[0014] A neural network-based intelligent detection system for IoT devices, applied to any of the aforementioned neural network-based intelligent detection methods for IoT devices, includes: The data acquisition module is used to collect user control commands, device response signals, network latency, feedback time and energy consumption change data through the home device gateway, and to perform time-series alignment of the data according to the timestamp to obtain the interaction behavior chain dataset. The normalization processing module is used to normalize the duration of the interaction behavior chain according to the control command trigger time and the device state change time, and divide each time-normalized interaction behavior chain sequence into a start segment, an execution segment and a feedback segment based on preset state transition rules and energy consumption change thresholds to obtain a segmented behavior chain sequence. The anomaly extraction module is used to input the segmented behavior chain sequence into a one-dimensional convolutional neural network according to a time window, perform convolution and pooling operations, extract local temporal features that characterize delay fluctuations and power consumption abrupt changes, and obtain convolutional feature vectors. The anomaly detection module is used to input the convolutional feature sequence into the gated recurrent unit network for temporal modeling, calculate the attention weight and anomaly score at each time step through the attention mechanism, and filter and output the anomaly detection results and corresponding abnormal behavior subchains according to the preset threshold. The incremental learning module is used to verify the effectiveness of the abnormal behavior subchain based on the frequency of anomalies and corresponding equipment maintenance records obtained during subsequent operation. Based on the abnormal behavior subchains that have been verified as real anomalies, incremental training samples are constructed, and the parameters of the one-dimensional convolutional neural network are incrementally trained and updated based on the incremental training samples.

[0015] The beneficial effects of this invention are as follows: This invention synchronously collects user control commands, device response signals, network latency, feedback time, and energy consumption change data through a home device gateway, and performs timestamp alignment to construct an interactive behavior chain dataset, achieving unified data modeling for each link in the control link; based on the control command trigger time and device state change time, the interactive behavior chain is normalized in duration, and combined with preset state transition rules and energy consumption change thresholds, the entire process is divided into a startup segment, an execution segment, and a feedback segment, making the control processes of different devices and different scenarios comparable under a unified time scale and stage division, which is beneficial for distinguishing features such as startup lag, abnormal power consumption in the execution stage, and abnormal response in the feedback stage; furthermore, the segmented behavior chain is input into a one-dimensional convolutional neural network according to a time window to extract local temporal features representing delay fluctuations and power consumption mutations, enhancing the ability to represent implicit abnormal patterns such as intermittent command response and short-term power consumption spikes without state change. This paper describes a method for temporal modeling of convolutional feature sequences using a gated recurrent unit network (GRN), and introduces an attention mechanism to calculate attention weights and anomaly scores at each time step. Under global temporal dependencies, it outputs anomaly detection results and corresponding anomalous behavior subchains, enabling precise localization of complex anomalies such as linked misordering and continuous performance degradation. Furthermore, it correlates the anomaly occurrence frequency obtained from subsequent operations with equipment maintenance records to validate the effectiveness of the anomalous behavior subchains. Incremental training samples are constructed using these validated anomalous behavior subchains, and incremental training updates are performed on the parameters of the one-dimensional convolutional neural network. This forms an adaptive optimization mechanism based on actual fault feedback, improving the accuracy and robustness of anomaly detection in IoT devices. It reduces false positives and false negatives caused by reliance on fixed thresholds and single model training, and can continuously adaptively optimize detection in response to environmental changes, equipment aging, and the emergence of new anomaly patterns. Attached Figure Description

[0016] Figure 1This is a flowchart of the steps of an intelligent detection method for Internet of Things devices based on neural networks in this invention.

[0017] Figure 2 This is a flowchart of step S4 in this invention. Detailed Implementation

[0018] Please see Figures 1-2 As shown, this invention relates to an intelligent detection method for IoT devices based on neural networks, comprising the following steps: S1. Collect user control commands, device response signals, network latency, feedback time and energy consumption change data through the home device gateway, and perform time-series alignment of the data according to the timestamp to obtain the interaction behavior chain dataset. S2. Based on the control command trigger time and the device state change time, the duration of the interaction behavior chain is normalized, and based on the preset state transition rules and energy consumption change threshold, each duration-normalized interaction behavior chain sequence is divided into a start segment, an execution segment, and a feedback segment to obtain a segmented behavior chain sequence. S3. Input the segmented behavior chain sequence into a one-dimensional convolutional neural network according to the time window, perform convolution and pooling operations, extract local temporal features that characterize delay fluctuations and power consumption changes, and obtain convolutional feature vectors. S4. Input the convolutional feature sequence into the gated recurrent unit network for temporal modeling, calculate the attention weight and anomaly score at each time step through the attention mechanism, and filter and output the anomaly detection results and corresponding abnormal behavior subchains according to the preset threshold. S5. Based on the frequency of anomalies and corresponding equipment maintenance records obtained during subsequent operation, the validity of the abnormal behavior subchain is verified. Based on the abnormal behavior subchains that have been verified as real anomalies, incremental training samples are constructed. Based on the incremental training samples, the parameters of the one-dimensional convolutional neural network are incrementally trained and updated.

[0019] In some embodiments, the method of the present invention is deployed in a smart home system that includes multiple types of devices such as lighting circuits, air conditioning units, smart locks, and curtain motors. All devices are connected to the local Internet of Things (IoT) through a home device gateway. The home device gateway uniformly accesses and parses control commands from mobile terminals, voice gateways, and automation scene engines, while simultaneously collecting device status reports, energy metering module data, and network communication timestamp information. In step S1, when a user issues a linkage scenario of "turning on the living room lights, opening the curtains, and starting the air conditioner" through a mobile application, the gateway records the initiation time, target device identifier, and control parameters of each control command, and simultaneously acquires the status message of the corresponding device, network round-trip time, feedback time from command issuance to status stabilization, and active energy readings before and after the operation. By sorting and aligning the above multi-source data by timestamp, a linkage process is organized into a multi-dimensional time series containing action values, response values, delay values, and energy consumption status values, thereby forming an interactive behavior chain dataset for subsequent modeling. This differs from the existing technology that only performs threshold monitoring on a single current or a single state quantity, achieving unified data abstraction for each link in the control link. In step S2, the control command initiation time is used as the starting point of the interaction behavior chain, and the device state stabilization time or scene feedback completion time is used as the ending point. The actual duration of each interaction process is calculated, and the duration normalization coefficient is obtained by comparing it with the preset standard duration. The system performs linear mapping on the timestamps of each time step in the behavior chain, compressing or stretching the original unequal-length processes onto a normalized time axis of fixed length. Subsequently, combining preset state transition rules (such as state transitions from "off" to "on", compressor start-stop characteristics in cooling mode, etc.) and energy consumption change thresholds, the normalized time axis is divided into a start-up segment, an execution segment, and a feedback segment. For example, in the air conditioning unit scenario, the stage from compressor to stable operation is classified as the start-up segment, the stage of continuous cooling with power consumption and fan speed maintained within a stable range is classified as the execution segment, and the power consumption decline process after reaching the set temperature or receiving a user termination command is classified as the feedback segment. In the smart lock scenario, short-term motor drive and bolt position changes are identified as the start-up segment, the state maintenance and security detection stage is classified as the execution segment, and the final locking status confirmation and reporting stage is classified as the feedback segment. Through this normalization and segmentation processing, this embodiment aligns and compares the control processes of different types of devices on a unified time scale and structured stages, overcoming the shortcomings of existing technologies that cannot distinguish between stage-specific abnormal modes such as "slow start-up", "abnormal power consumption during execution", and "delayed feedback confirmation". In step S3, the segmented behavior chain is sliced ​​according to a fixed time window to construct a one-dimensional time-series sample with multi-channel input of action value, response value, delay value, and energy consumption state value. This sample is then input into a one-dimensional convolutional neural network to perform convolution and pooling operations. As the convolutional kernel slides along the time dimension, it can simultaneously perceive the fluctuation pattern of network latency and the abrupt change in energy consumption within a local window.For example, when the lighting device repeatedly shows "delayed time periodic jitter but finally responds successfully" or "short-time power consumption spike followed by recovery to stability" within a short period of time, the one-dimensional convolutional kernel can extract the corresponding peak, trough, and transition features, and compress them on the time scale through the pooling layer to form local temporal feature vectors representing the delay fluctuation frequency, amplitude, power consumption sudden increase, and abnormal energy consumption jitter. Compared with the existing technologies that only judge based on single-point delay threshold or average power consumption index, in this embodiment, the convolutional operator is used to jointly model the multi-channel local morphology, and typical hidden abnormal patterns such as "instruction intermittent response" and "short-time power consumption spike but no state change" can be captured. In step S4, the convolutional feature vector sequence output by the one-dimensional convolutional neural network is input into the gated recurrent unit network to perform temporal modeling on the dependency relationship between each time step in the sequence. The gated recurrent unit selectively retains or forgets the historical state through the update gate and the reset gate, enabling the model to focus on the long-term dependencies across time steps, such as the air conditioner continuously consuming high power but having slow cooling effect within several execution cycles, or a certain device in a linkage scenario always lagging behind other devices by several time windows. On this basis, an attention mechanism is introduced to construct a trainable context vector, calculate the similarity between the hidden state vector of each time step and this context vector to obtain the corresponding attention weights, and form an abnormal discrimination vector representing the global characteristics of the entire interaction behavior chain through weighted summation. The system then outputs the abnormal score of each time step according to this vector, screens out the segments with significantly high abnormal scores through a preset threshold and traces back to the original behavior chain to obtain the abnormal detection result and the corresponding abnormal behavior sub-chain. Thus, this embodiment can not only give an overall judgment of "whether the current linkage is abnormal", but also accurately locate the local interval where the abnormality occurs in the time dimension, so as to achieve refined recognition of complex abnormalities such as disordered linkage sequence, long-cycle performance degradation, and local-stage response stagnation.

[0020] Further, the steps of collecting user control instructions, device response signals, network delay, feedback delay, and energy consumption change data through the home device gateway include the following: Parse the original message reported by the control terminal accessing the home device gateway, extract the initiation time of the control instruction, the target device identifier, and the control parameters, and generate the corresponding user control instruction according to the control session; Monitor the status message reported by the target device through the home device gateway, extract the device switch status, working mode, and fault flag fields, and generate a device response signal associated with the user control instruction; Calculate the network delay based on the timestamp of the control message sent by the home device gateway and the timestamp of the received device response message, and calculate the feedback delay based on the time difference between the initiation time of the control instruction and the stable time of the device status; The power consumption readings before and after the operation are obtained through the power metering module corresponding to the target device, and the energy consumption change data within the unit operation window is calculated.

[0021] It should be noted that the home device gateway, acting as a unified data acquisition entry point, performs protocol parsing on the raw control messages reported by connected mobile terminals, voice control terminals, and automation scene engines. It extracts the control command initiation timestamp, target device identifier, and control parameters such as on / off status, mode setting value, target temperature, and brightness level from the message header and payload fields. It then groups consecutive control messages based on session identifier, user identifier, or automation scene number, generating a structured user control command record. Simultaneously, the gateway listens for periodic or event-triggered status messages reported by the target devices, parsing fields such as device on / off status, operating mode enumeration value, and fault flag bits. This generates device response signal records that are uniquely associated with the aforementioned user control commands through device identifiers and session identifiers. For each control session, the gateway records the timestamp of the sent control message and the timestamp of the first valid response message received, calculating the network latency of the control link based on the difference between the two. When the device's operating state reaches a stable condition (e.g., the state no longer changes within several consecutive sampling periods, power consumption fluctuation is below a threshold), the gateway extracts the corresponding timestamp and differs it from the control command initiation time to obtain the feedback latency indicator. In addition, the gateway reads the active energy metering value before and after the control action through the communication interface with the target device's energy metering module, calculates the energy consumption change data in the unit operation window through differential calculation, and stores the energy consumption change together with the corresponding user control command, device response signal, network latency and feedback time as a multi-dimensional observation of the same control session.

[0022] Furthermore, the step of aligning the data according to timestamps to obtain the interaction behavior chain dataset includes the following steps: The user control commands, device response signals, network latency, feedback time, and energy consumption change data are sorted in ascending order by timestamp, and several interactive session windows are divided based on the control command initiation time and the preset session timeout time. Within each interactive session window, a unified timeline is constructed at preset time intervals, mapping user control commands, device response signals, network latency, feedback time, and energy consumption changes falling within the same time interval to action values, response values, latency values, and energy consumption status values ​​for the corresponding time steps. For missing action values, response values, delay values, and energy consumption status values ​​in each time step, interpolation filling or the preservation of the most recent valid value is performed, and the processed data of each time step are concatenated in chronological order to generate an interactive behavior chain.

[0023] In some embodiments, the collected user control commands, device response signals, network latency, feedback time, and energy consumption change data are first sorted in ascending order by timestamp, and the initiation time of each control command is used as the starting point of a candidate session. When the time interval between two adjacent commands exceeds a preset session timeout (e.g., 30 seconds or 60 seconds), they are divided into different interactive session windows. Within the same window, the system records the start time t0 and end time t0 of that window. e And set a fixed time interval Δt (e.g., 200ms or 500ms) according to the target modeling granularity, thus in [t0, t e A unified discrete time axis is constructed on the interval, with the time interval corresponding to time step index k being [t0 + k·Δt, t0 + (k+1)·Δt). Subsequently, in each session window, the system traverses all event data, mapping user control commands whose timestamps fall within the same time interval to the action value vector a_k for that time step, mapping the switch status, working mode, and fault flag obtained from parsing device status messages to the response value vector r_k, mapping the network latency and feedback time statistics corresponding to the current control link to the latency value d_k, and mapping the instantaneous power or energy consumption per unit time obtained from energy metering differentials to the energy consumption status value e_k. If multiple event records exist within the same time step, numerical features can be aggregated using average, maximum, or weighted statistics, and discrete status features can be normalized using priority rules (e.g., based on the most recent event or with faults taking precedence over normal events). For cases where incomplete observations are not collected at certain time steps, the system performs missing value processing on action values, response values, delay values, and energy consumption status values ​​respectively: For continuous numerical features (such as delay value d_k and energy consumption status e_k), linear interpolation between adjacent time steps or sliding window mean interpolation can be used to keep them changing smoothly on the time axis; for status features (such as on / off status and working mode), a strategy of preserving the most recent valid value is adopted, extending the most recently observed state to the current time step to avoid generating invalid empty states. Through the above feature filling and correction for each time step within each session window, [a_k, r_k, d_k, e_k] are finally concatenated in ascending order of time step index k to form a complete, uniformly long, and multi-dimensional feature-aligned interactive behavior chain sequence; repeating the above process for all session windows can construct an interactive behavior chain dataset containing a large number of samples.

[0024] Furthermore, the step of normalizing and aligning the interaction behavior chain based on the control command trigger time and device state change time includes the following steps: The initiation time of the control command in each interaction chain is used as the start timestamp, and the device state stabilization time or feedback completion time is used as the end timestamp. The duration of the entire control process is calculated, and the duration of the entire control process is scaled proportionally according to the preset standard duration to obtain the duration normalization coefficient. Based on the duration normalization coefficient, a linear transformation is performed on the timestamps of each time step in the interaction behavior chain to map the entire control process to a unified normalized time interval, resulting in a duration-normalized interaction behavior chain sequence.

[0025] In some embodiments, the initiation time of the control instruction in each interaction behavior chain is first read and used as the start time of the interaction process. Then, the end time of the entire control process is determined based on the time points in the device state sequence that meet the preset stability judgment conditions (e.g., the device state remains unchanged for several consecutive sampling periods, power consumption fluctuation is below a threshold, or the time is explicitly marked as "execution completed" by the business layer), thereby obtaining the actual duration of the interaction process. Subsequently, the duration is compared with the system's preset standard duration to obtain a duration normalization coefficient for compressing or stretching the time axis. Based on this coefficient, a linear time transformation is performed on the original timestamps corresponding to each time step in the behavior chain, mapping the entire control process to a unified normalized time interval with the standard duration as the boundary, so that all behavior chains start from the same relative starting point and end at the same relative ending point after normalization. To achieve strict alignment of different interaction behavior chains across discrete time steps, a unified time grid of fixed length is constructed over the normalized time interval. Normalized time points are mapped to the nearest grid position, and the action values, response values, delay values, and energy consumption state values ​​corresponding to multiple original time steps falling into the same grid are aggregated according to a preset strategy: numerical features can be merged using methods such as mean or maximum value, while state features can be merged according to rules prioritizing the most recent event or fault. Through this processing, each interaction behavior chain is ultimately resampled into a temporal feature sequence of equal length with one-to-one time step correspondence. The control processes of different devices and scenarios are aligned in relative time positions such as "start-up—execution—feedback," thus providing structured input for subsequent learning of temporal patterns by one-dimensional convolutional neural networks and gated recurrent unit networks on a unified time scale.

[0026] Furthermore, the one-dimensional convolutional neural network is trained through the following steps: Based on historical interaction behavior chain data and corresponding anomaly markers, the interaction behavior chain data is normalized in duration, segmented semantically, and divided into time windows. The action values, response values, delay values, and energy consumption status values ​​within each time window are concatenated in chronological order to construct a one-dimensional time-series training sample set. The one-dimensional time-series training sample set is input into a one-dimensional convolutional neural network, and convolution and pooling operations are performed to extract local time-series features that characterize user action patterns, device response changes and the coupling relationship between latency fluctuations and power consumption mutations, and obtain the corresponding convolutional feature vectors. The loss value is calculated based on the convolutional feature vector and the corresponding real anomaly marker. The gradient descent algorithm is used to backpropagate and update the convolutional kernel weights and bias parameters until the loss value meets the preset convergence condition.

[0027] In some embodiments, first, for multiple smart home scenarios (such as lighting linkage, air conditioner startup and shutdown, smart lock opening and closing, curtain opening and closing, etc.), the interaction behavior chains that have completed time series alignment and duration normalization are summarized. The semantic segmentation results of each behavior chain in the form of "start - execution - feedback" are used as structural constraints. Within each segment, time windows are divided according to a fixed time window length and a sliding step. For example, several sampling points are selected to form a window, and the entire behavior chain is covered in a partially overlapping sliding manner. For a specific window, the system constructs a one-dimensional multi-channel time series vector by concatenating in chronological order the action values (such as instruction type, control parameter change), response values (such as switch state, working mode, fault flag), delay values (such as round-trip delay, feedback time consumption), and energy consumption status values (such as instantaneous power, energy consumption per unit time) within its time span, thereby forming a one-dimensional time series sample set for training. Each sample has a one-to-one mapping relationship with the corresponding anomaly label. For example, it is marked that the air conditioner has continuously high power consumption during the execution stage but abnormal temperature control effect, the lighting only partially responds under multiple instruction issuances, the execution result feedback of the smart lock is inconsistent with the actual mechanical action, etc. Subsequently, this one-dimensional time series training sample set is input into a one-dimensional convolutional neural network with a preset structure. In the first few layers of the network, convolutional kernels of different lengths and appropriate strides are used to simultaneously perceive the morphological features of the action sequence, response sequence, delay sequence, and energy consumption curve within the local window in a manner of sliding along the time axis. Through multiple groups of convolutional kernels, local time series patterns such as the delay jitter period, the position and amplitude of the power consumption spike, the characteristic waveform before and after the state transition, and the coupling mode between network delay and energy consumption mutation are captured. After the convolutional output, max pooling or average pooling operations are introduced to perform downsampling and feature compression on the time dimension. On the one hand, it enhances the robustness of the model to local deformation and noise, and on the other hand, it reduces the computational burden of the subsequent network layers. Finally, a convolutional feature vector of a fixed length is formed at the end of the network to represent the comprehensive features of the user action pattern, device response change, and the coupling relationship between delay fluctuation and power consumption mutation within this time window. During the training process, the convolutional feature vector is input into a fully connected layer or a simple classification head to generate anomaly prediction results, which are compared with the corresponding true anomaly labels. Based on a preset loss function (such as binary cross-entropy or multi-class cross-entropy), the loss value of the current batch is calculated. Then, gradient descent and its variant optimization algorithms are used to perform backpropagation updates on the convolutional kernel weights and bias parameters in the network. Through multiple rounds of iteration, the receptive field and feature selection preference of the convolutional kernel on the time axis are continuously adjusted, enabling it to gradually strengthen the response to key anomaly patterns (such as "significant delay amplification but unchanged state", "short-term sudden increase in power consumption followed by a rapid decline", "a certain device always lags in startup during multi-device linkage", etc.), while weakening the sensitivity to normal fluctuations and random noise. When the decline amplitude of the loss value on the validation set is lower than the preset threshold or no obvious improvement is achieved in several consecutive rounds of training, it is determined that the network has reached the preset convergence condition and the training is stopped.

[0028] Furthermore, the loss value calculated based on the convolutional feature vector and the corresponding true anomaly label is calculated using the following loss function: ; in, This is the loss value; The number of samples; Label the i-th sample as a true anomaly; Let be the anomaly prediction probability corresponding to the i-th sample.

[0029] It should be noted that when the interaction behavior chain corresponding to the sample is identified as a real anomaly, The value is 1, and the value is 0 when the sample corresponds to the normal behavior chain; The anomaly prediction probability of the one-dimensional convolutional neural network on the i-th sample is calculated from the convolutional feature vector through a fully connected layer and a sigmoid activation function. It is used to characterize the confidence that the sample belongs to the "anomaly" category. During training, the system first inputs time-normalized and time-aligned one-dimensional time-series samples into the one-dimensional convolutional neural network to obtain the corresponding convolutional feature vectors, and then obtains the anomaly prediction probability of each sample through the output layer. The network quantifies the deviation between the predicted results and the true labels of all samples in the current batch based on the aforementioned loss function. The resulting loss value is used as the gradient driving signal for backpropagation, and gradient descent or its adaptive variant is used to iteratively update the convolutional kernel weights and bias parameters. By continuously minimizing this binary cross-entropy loss function, the network gradually widens the discrimination boundary between abnormal and normal behavior chains in the feature space, improving its ability to distinguish between latency fluctuation anomalies, power consumption mutation anomalies, and their coupling modes.

[0030] Further, S4 includes the following steps: The convolutional feature vector is used as a time series input to the gated recurrent unit network, and state updates are performed sequentially at each time step to obtain the corresponding temporal hidden state sequence. Attention scores are calculated based on the hidden state vectors and trainable context vectors at each time step in the time-series hidden state sequence, and attention weights at each time step are obtained through Softmax normalization. The attention weights are used to perform a weighted summation of the temporal hidden state sequence to obtain an anomaly discrimination vector that represents the global features of the entire interaction behavior chain. Based on the anomaly discrimination vector, the output layer calculates the anomaly score for each time step, and determines the anomaly detection result and the corresponding abnormal behavior sub-chain according to a preset threshold.

[0031] In some embodiments, a sequence of convolutional feature vectors arranged chronologically is used as input. The convolutional feature vector at each time step is considered as a high-dimensional observation at that time step and is sequentially fed into a gate-controlled recurrent unit (GRU) network. The GRU fuses and filters the hidden state of the previous time step with the current input features through update and reset gates, thereby gradually forming a temporal hidden state sequence during sequence unfolding. This hidden state sequence not only encodes the local convolutional features of the current time step but also explicitly preserves the behavioral patterns and contextual information of previous time steps. For example, in an air conditioning operation scenario, the GRU can capture the time-dependent pattern of "gradually increasing network latency - persistently high power consumption - lagging device response" over several time steps. Based on this, an attention mechanism is introduced to enhance the model's attention to key time segments: the system configures a trainable context vector for the entire sequence, performs a similarity measurement between the hidden state vector of each time step and this context vector (e.g., calculates a matching score after affine transformation), obtains the attention score for each time step, and then performs a Softmax normalization operation on the score sequence, mapping it to an attention weight sequence with a sum of 1. Attention weights numerically reflect the importance of each time step in the entire interaction behavior chain. When feature coupling patterns such as "abnormally amplified delay," "sudden increase in power consumption without state switching," and "significant shift in the startup order of linked devices" occur within a certain time period, the hidden state of the corresponding time step will receive a higher attention weight. Subsequently, the system uses this attention weight to perform a weighted summation of the hidden states of the entire sequence to obtain a fixed-dimensional anomaly discrimination vector. This vector semantically characterizes the global anomaly features of the entire interaction behavior chain, which can be understood as a comprehensive encoding of the temporal dependencies and key time segments of the entire sequence. To achieve both global judgment and local localization, this anomaly discrimination vector is input into an anomaly discrimination output layer to calculate the overall anomaly confidence of the link. Furthermore, this anomaly discrimination vector is fused with the hidden state vectors corresponding to each time step through feature concatenation or linear transformation, and then fed into a time step-level scoring sub-network to output an anomaly score for each time step. This allows for fine-grained measurement of the anomaly degree of local time segments while maintaining global contextual consistency. When the abnormal score of a certain time step or multiple consecutive time steps exceeds the preset threshold, the system marks the time step or the corresponding time interval as an abnormal segment and traces back to the original interaction behavior chain in the time dimension to extract the corresponding abnormal behavior sub-chain.

[0032] Furthermore, the validity verification of the abnormal behavior subchain based on the frequency of anomalies and corresponding equipment maintenance records obtained during subsequent operation includes the following steps: Extract the device identifier, anomaly type, and anomaly occurrence time corresponding to each abnormal behavior subchain output by the gated loop unit network, classify and statistically analyze the abnormal behavior subchains according to the device identifier and anomaly type, and calculate the anomaly occurrence frequency of each type of abnormal behavior subchain within a preset statistical period. Obtain equipment maintenance records containing equipment identifier, maintenance time, fault type, and handling measures; match the equipment maintenance records with the corresponding abnormal behavior subchain based on the equipment identifier and time window; and determine the consistency between the fault type and the abnormal detection result. Subchains of abnormal behaviors whose frequency of occurrence exceeds a preset frequency threshold and whose abnormal detection results are consistent with the fault type are marked as real abnormalities, thus obtaining subchains of abnormal behaviors that have been verified as real abnormalities.

[0033] It should be noted that during the online detection phase, the gated recurrent unit network and attention mechanism output anomaly detection results for each interaction behavior chain, while simultaneously generating structured descriptive information for each behavior sub-chain judged as abnormal. This information includes at least the target device identifier, anomaly type label, and anomaly occurrence time interval. The anomaly type label can be mapped to a predefined anomaly category based on the anomaly score distribution and feature contribution of the network output, such as "delay anomaly type," "power consumption surge type," and "interlocking disorder type." The system maintains statistical tables in the background, categorized by device identifier and anomaly type, incrementally classifying all abnormal behavior sub-chains. Samples of the same device, the same anomaly type, and falling within the same statistical period are aggregated, and the occurrence frequency of each type of abnormal behavior sub-chain is calculated within each sliding statistical period. For example, the system calculates the ratio of the number of times an outdoor unit of an air conditioner was judged as "execution phase power consumption anomaly type" in the last 30 days to the total number of control operations. Simultaneously, maintenance record data is periodically retrieved from the equipment operation and maintenance management platform or maintenance work order system. The maintenance records include fields such as device identifier, maintenance timestamp, fault type code, and corresponding handling measures. The algorithm module first performs coarse-grained association between maintenance records and abnormal behavior subchains based on device identifiers. Then, it performs fine-grained matching based on the time window constraint between the anomaly occurrence time and the maintenance time. For example, if a device is repeatedly identified as having "abnormal compressor power consumption" within a certain period, and subsequently, fault types such as "compressor failure" or "insufficient cooling" appear in the device's maintenance records, then it is determined that the maintenance event has a causal relationship with the previously output abnormal behavior subchain. To ensure the reliability of the labeling, the system introduces a consistency judgment rule between fault type and anomaly type during the matching process. Through a pre-built mapping table, detection results such as "long-term high power consumption but temperature not meeting standards" are mapped to "cooling performance degradation" faults, and "multiple unlocking commands but abnormal lock tongue position" are mapped to "mechanical jamming" or "lock body failure" faults. When the anomaly type does not match the corresponding fault category in the maintenance record, the abnormal behavior subchain is not included in the real anomaly sample. After completing the frequency statistics and fault matching, the system marks aberrant behavior subchains whose anomaly frequency exceeds a preset threshold and has been confirmed as precursors to actual faults in at least one or more maintenance records. These subchains are then identified as genuine anomalies verified by both operational and maintenance data. The preset frequency threshold can be configured differently based on equipment type, business importance, and acceptable false alarm rate. For example, a lower threshold can be used for safety-sensitive equipment such as smart locks and gas water heaters, while a relatively higher threshold can be used for general lighting equipment. Through this verification process, a small subset of statistically significant aberrant behavior subchains that are highly consistent with actual faults are selected from a large number of model outputs, forming a high-quality set of genuine anomaly samples, providing reliable supervision signals for subsequent incremental training phases.

[0034] Furthermore, the incremental training samples constructed from the sub-chains of anomalous behaviors verified as genuine anomalies, and the incremental training and updating of the parameters of the one-dimensional convolutional neural network based on these incremental training samples, include: Using the real-time parameters of the one-dimensional convolutional neural network as initial parameters, the incremental training sample set is input into the one-dimensional convolutional neural network in batches. The incremental loss value is calculated based on the loss function and gradient descent is performed to update the convolutional kernel weights and bias parameters.

[0035] Specifically, the one-dimensional time-series input vector (i.e., the sequence containing action values, response values, delay values, and energy consumption state values) within the corresponding time window is first organized into an incremental training sample set according to the same preprocessing process as the initial training stage. All convolutional kernel weights and bias parameters of the one-dimensional convolutional neural network in the current online running state are retained and used as the initial parameters for incremental training to ensure that the model is fine-tuned based on the existing detection capabilities rather than retrained when updating. During incremental training, the system inputs incremental training samples into a one-dimensional convolutional neural network in a mini-batch manner. After each batch of samples is processed by convolutional and pooling layers to extract the corresponding convolutional feature vectors, the anomaly prediction probability is obtained through the output layer, and the incremental loss value is calculated based on the binary cross-entropy loss function corresponding to the true anomaly label of that batch. On this basis, gradient descent or its adaptive variant optimization algorithm (such as Adam) is used to perform backpropagation updates on the weights and bias parameters of each convolutional kernel in the network. Through multiple rounds of iteration, the response mode of the convolutional kernel on the time axis is gradually adjusted to make it more sensitive to newly emerging and verified time-series patterns of true anomalies (such as the compressor failure power consumption curve unique to a certain model of air conditioner, or the mechanical lag delay pattern unique to a certain batch of smart locks). At the same time, constraints are imposed on hyperparameters such as learning rate, training rounds, and batch size to avoid excessive parameter changes that would cause serious disturbances to the existing normal pattern recognition capabilities. Through the incremental training and update mechanism described above, which uses real-time parameters as initial values ​​and real abnormal behavior subchains as supervision signals, the one-dimensional convolutional neural network can continuously absorb newly exposed abnormal features in the field operation while maintaining historical knowledge, thereby achieving continuous optimization for the dynamic evolution of the operating environment of IoT devices.

[0036] The present invention also includes a neural network-based intelligent detection system for Internet of Things (IoT) devices, comprising: The data acquisition module is used to collect user control commands, device response signals, network latency, feedback time and energy consumption change data through the home device gateway, and to perform time-series alignment of the data according to the timestamp to obtain the interaction behavior chain dataset. The normalization processing module is used to normalize the duration of the interaction behavior chain according to the control command trigger time and the device state change time, and divide each time-normalized interaction behavior chain sequence into a start segment, an execution segment and a feedback segment based on preset state transition rules and energy consumption change thresholds to obtain a segmented behavior chain sequence. The anomaly extraction module is used to input the segmented behavior chain sequence into a one-dimensional convolutional neural network according to a time window, perform convolution and pooling operations, extract local temporal features that characterize delay fluctuations and power consumption abrupt changes, and obtain convolutional feature vectors. The anomaly detection module is used to input the convolutional feature sequence into the gated recurrent unit network for temporal modeling, calculate the attention weight and anomaly score at each time step through the attention mechanism, and filter and output the anomaly detection results and corresponding abnormal behavior subchains according to the preset threshold. The incremental learning module is used to verify the effectiveness of the abnormal behavior subchain based on the frequency of anomalies and corresponding equipment maintenance records obtained during subsequent operation. Based on the abnormal behavior subchains that have been verified as real anomalies, incremental training samples are constructed, and the parameters of the one-dimensional convolutional neural network are incrementally trained and updated based on the incremental training samples.

[0037] The above embodiments are merely descriptions of preferred embodiments of the present invention and are not intended to limit the scope of the present invention. Various modifications and improvements made by those skilled in the art to the technical solutions of the present invention without departing from the spirit of the present invention should fall within the protection scope defined by the claims of the present invention.

Claims

1. A method for intelligent detection of Internet of Things (IoT) devices based on neural networks, characterized in that, Includes the following steps: S1. Collect user control commands, device response signals, network latency, feedback time and energy consumption change data through the home device gateway, and perform time-series alignment of the data according to the timestamp to obtain the interaction behavior chain dataset. S2. Based on the control command trigger time and the device state change time, the duration of the interaction behavior chain is normalized, and based on the preset state transition rules and energy consumption change threshold, each duration-normalized interaction behavior chain sequence is divided into a start segment, an execution segment, and a feedback segment to obtain a segmented behavior chain sequence. S3. Input the segmented behavior chain sequence into a one-dimensional convolutional neural network according to the time window, perform convolution and pooling operations, extract local temporal features that characterize delay fluctuations and power consumption changes, and obtain convolutional feature vectors. S4. Input the convolutional feature sequence into the gated recurrent unit network for temporal modeling, calculate the attention weight and anomaly score at each time step through the attention mechanism, and filter and output the anomaly detection results and corresponding abnormal behavior subchains according to the preset threshold. S5. Based on the frequency of anomalies and corresponding equipment maintenance records obtained during subsequent operation, the validity of the abnormal behavior subchain is verified. Based on the abnormal behavior subchains that have been verified as real anomalies, incremental training samples are constructed. Based on the incremental training samples, the parameters of the one-dimensional convolutional neural network are incrementally trained and updated.

2. The intelligent detection method for IoT devices based on neural networks according to claim 1, characterized in that, The process of collecting user control commands, device response signals, network latency, feedback time, and energy consumption change data through the home device gateway includes the following steps: The system parses the original messages reported by the control terminal connected to the home device gateway, extracts the initiation time of the control command, the target device identifier and control parameters, and generates the corresponding user control command according to the control session. Monitor the status messages reported by the target device through the home device gateway, extract the device switch status, working mode and fault flag fields, and generate the device response signal associated with the user control command; Network latency is calculated based on the timestamp of the control message sent by the home device gateway and the timestamp of the response message received by the device. Feedback time is calculated based on the time difference between the control command initiation time and the device state stabilization time. The power consumption readings before and after the operation are obtained through the power metering module corresponding to the target device, and the energy consumption change data within the unit operation window is calculated.

3. The intelligent detection method for IoT devices based on neural networks according to claim 1, characterized in that, The step of aligning the data according to timestamps to obtain the interaction behavior chain dataset includes the following steps: The user control commands, device response signals, network latency, feedback time, and energy consumption change data are sorted in ascending order by timestamp, and several interactive session windows are divided based on the control command initiation time and the preset session timeout time. Within each interactive session window, a unified timeline is constructed at preset time intervals, mapping user control commands, device response signals, network latency, feedback time, and energy consumption changes falling within the same time interval to action values, response values, latency values, and energy consumption status values ​​for the corresponding time steps. For missing action values, response values, delay values, and energy consumption status values ​​in each time step, interpolation filling or the preservation of the most recent valid value is performed, and the processed data of each time step are concatenated in chronological order to generate an interactive behavior chain.

4. The intelligent detection method for IoT devices based on neural networks according to claim 1, characterized in that, The step of normalizing and aligning the interaction behavior chain based on the control command trigger time and device state change time includes the following steps: The initiation time of the control command in each interaction chain is used as the start timestamp, and the device state stabilization time or feedback completion time is used as the end timestamp. The duration of the entire control process is calculated, and the duration of the entire control process is scaled proportionally according to the preset standard duration to obtain the duration normalization coefficient. Based on the duration normalization coefficient, a linear transformation is performed on the timestamps of each time step in the interaction behavior chain to map the entire control process to a unified normalized time interval, resulting in a duration-normalized interaction behavior chain sequence.

5. The intelligent detection method for IoT devices based on neural networks according to claim 1, characterized in that, The one-dimensional convolutional neural network is trained through the following steps: Based on historical interaction behavior chain data and corresponding anomaly markers, the interaction behavior chain data is normalized in duration, segmented semantically, and divided into time windows. The action values, response values, delay values, and energy consumption status values ​​within each time window are concatenated in chronological order to construct a one-dimensional time-series training sample set. The one-dimensional time-series training sample set is input into a one-dimensional convolutional neural network, and convolution and pooling operations are performed to extract local time-series features that characterize user action patterns, device response changes and the coupling relationship between latency fluctuations and power consumption mutations, and obtain the corresponding convolutional feature vectors. The loss value is calculated based on the convolutional feature vector and the corresponding real anomaly marker. The gradient descent algorithm is used to backpropagate and update the convolutional kernel weights and bias parameters until the loss value meets the preset convergence condition.

6. The intelligent detection method for IoT devices based on neural networks according to claim 5, characterized in that, The loss value calculated based on the convolutional feature vector and the corresponding true anomaly marker is calculated using the following loss function: ； in, This is the loss value; The number of samples; Label the i-th sample as a true anomaly; Let be the anomaly prediction probability corresponding to the i-th sample.

7. The intelligent detection method for IoT devices based on neural networks according to claim 5, characterized in that, S4 includes the following steps: The convolutional feature vector is used as a time series input to the gated recurrent unit network, and state updates are performed sequentially at each time step to obtain the corresponding temporal hidden state sequence. Attention scores are calculated based on the hidden state vectors and trainable context vectors at each time step in the time-series hidden state sequence, and attention weights at each time step are obtained through Softmax normalization. The attention weights are used to perform a weighted summation of the temporal hidden state sequence to obtain an anomaly discrimination vector that represents the global features of the entire interaction behavior chain. Based on the anomaly discrimination vector, the output layer calculates the anomaly score for each time step, and determines the anomaly detection result and the corresponding abnormal behavior sub-chain according to a preset threshold.

8. The intelligent detection method for IoT devices based on neural networks according to claim 1, characterized in that, The validity verification of the abnormal behavior subchain based on the frequency of anomalies and corresponding equipment maintenance records obtained during subsequent operation includes the following steps: Extract the device identifier, anomaly type, and anomaly occurrence time corresponding to each abnormal behavior subchain output by the gated loop unit network, classify and statistically analyze the abnormal behavior subchains according to the device identifier and anomaly type, and calculate the anomaly occurrence frequency of each type of abnormal behavior subchain within a preset statistical period. Obtain equipment maintenance records containing equipment identifier, maintenance time, fault type, and handling measures; match the equipment maintenance records with the corresponding abnormal behavior subchain based on the equipment identifier and time window; and determine the consistency between the fault type and the abnormal detection result. Subchains of abnormal behaviors whose frequency of occurrence exceeds a preset frequency threshold and whose abnormal detection results are consistent with the fault type are marked as real abnormalities, thus obtaining subchains of abnormal behaviors that have been verified as real abnormalities.

9. The intelligent detection method for IoT devices based on neural networks according to claim 5, characterized in that, The incremental training samples are constructed based on the abnormal behavior subchains verified as genuine anomalies. The incremental training and updating of the parameters of the one-dimensional convolutional neural network based on the incremental training samples includes: Using the real-time parameters of the one-dimensional convolutional neural network as initial parameters, the incremental training sample set is input into the one-dimensional convolutional neural network in batches. The incremental loss value is calculated based on the loss function and gradient descent is performed to update the convolutional kernel weights and bias parameters.

10. A neural network-based intelligent detection system for Internet of Things (IoT) devices, applied to the neural network-based intelligent detection method for IoT devices as described in any one of claims 1-9, characterized in that, include: The data acquisition module is used to collect user control commands, device response signals, network latency, feedback time and energy consumption change data through the home device gateway, and to perform time-series alignment of the data according to the timestamp to obtain the interaction behavior chain dataset. The normalization processing module is used to normalize the duration of the interaction behavior chain according to the control command trigger time and the device state change time, and divide each time-normalized interaction behavior chain sequence into a start segment, an execution segment and a feedback segment based on preset state transition rules and energy consumption change thresholds to obtain a segmented behavior chain sequence. The anomaly extraction module is used to input the segmented behavior chain sequence into a one-dimensional convolutional neural network according to a time window, perform convolution and pooling operations, extract local temporal features that characterize delay fluctuations and power consumption abrupt changes, and obtain convolutional feature vectors. The anomaly detection module is used to input the convolutional feature sequence into the gated recurrent unit network for temporal modeling, calculate the attention weight and anomaly score at each time step through the attention mechanism, and filter and output the anomaly detection results and corresponding abnormal behavior subchains according to the preset threshold. The incremental learning module is used to verify the effectiveness of the abnormal behavior subchain based on the frequency of anomalies and corresponding equipment maintenance records obtained during subsequent operation. Based on the abnormal behavior subchains that have been verified as real anomalies, incremental training samples are constructed, and the parameters of the one-dimensional convolutional neural network are incrementally trained and updated based on the incremental training samples.

Images