Internet of Things system anomaly diagnosis method applied to large model
By combining self-supervised learning and t-tests with large models, this approach solves the challenges of anomaly detection and root cause analysis in industrial systems. It achieves efficient and accurate anomaly diagnosis and rapid localization, overcomes the shortcomings of unstructured data processing, and provides interpretable diagnostic results.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- HANGZHOU XIXIU UBIQUITOUS COMPUTING TECH CO LTD
- Filing Date
- 2026-01-08
- Publication Date
- 2026-05-12
AI Technical Summary
Existing technologies struggle to efficiently and accurately detect and locate anomalies in industrial systems, particularly due to insufficient processing capabilities for unstructured data, and root cause analysis requires human intervention and domain expert experience.
Anomaly detection is performed using a self-supervised learning LSTM autoencoder, combined with a two-independent-samples t-test to locate abnormal indicators, and anomaly diagnostic prompts are constructed using a large model. The knowledge base of the large model is then used for in-depth diagnosis.
It achieves high-precision anomaly detection and rapid root cause analysis, reduces false alarm rate, provides interpretable anomaly diagnosis results, and improves the stability and efficiency of industrial systems.
Smart Images
Figure CN122027461A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of artificial intelligence technology, specifically to an anomaly diagnosis method for large-scale Internet of Things (IoT) systems. Background Technology
[0002] With the rapid development of the manufacturing industry, the complexity and automation of industrial systems are constantly increasing, placing higher demands on their reliability, stability, and security. Maintaining the stability and reliability of production processes is crucial for ensuring product quality and production efficiency in industrial production and manufacturing. However, due to the complexity and diversity of industrial systems, various anomalies often occur, potentially leading to production interruptions, equipment damage, and resource waste. Therefore, developing a method that can efficiently and accurately detect anomalies in industrial systems and quickly pinpoint their root causes is of paramount importance.
[0003] Currently, unsupervised anomaly detection based on deep learning primarily employs autoencoders as the mainstream model. A typical autoencoder model consists of two key components: an encoder and a decoder. The encoder is responsible for mapping the raw data to a low-dimensional feature space, while the decoder remaps these features back to the original data space. The main goal of these models is to minimize the difference between the original data and the data reconstructed by the decoder, while distinguishing between normal and abnormal data through the distribution of the feature space.
[0004] After an anomaly is detected, rapid root cause anomaly localization plays a crucial role in subsequent troubleshooting and equipment repair. Currently, mainstream root cause localization methods fall into two categories: deep learning-based methods and statistical data-based methods. Deep learning-based methods estimate model behavior through repeated model queries, using local perturbation inputs and observing model outputs to quickly locate root cause features; representative methods include LIME, SHAP, and LEMNA. Statistical data-based methods locate root cause features by calculating the deviation of each feature in the abnormal data from the normal data.
[0005] However, even after identifying the root causes of anomalies in industrial systems, root cause analysis requires manual intervention by experts in the relevant domain, demanding deep domain knowledge and extensive operational experience. Furthermore, industrial systems often contain a large amount of unstructured data in addition to structured sensor data, such as operation logs and fault reports. Large-scale models offer significant advantages in processing unstructured data, allowing it to be effectively utilized and further improving the comprehensiveness and accuracy of root cause analysis.
[0006] To address this, we propose a novel anomaly diagnosis method for large-scale IoT systems. Summary of the Invention
[0007] The purpose of this invention is to provide an anomaly diagnosis method for IoT systems applied to large models. This method first utilizes a self-supervised learning model to address the lack of anomaly sample annotations, achieving high-precision anomaly detection. Then, it uses statistical testing methods to quickly locate key indicators that cause anomalies. Finally, it uses the located anomaly indicator information as clues to construct structured prompt words, guiding the large model to perform in-depth diagnosis using its massive knowledge base, thereby achieving efficient, accurate, and interpretable anomaly diagnosis for IoT systems.
[0008] To achieve the above objectives, the present invention provides the following technical solution: a method for anomaly diagnosis of an IoT system applied to large-scale models, comprising the following steps:
[0009] (1) Anomaly detection in IoT systems: Detecting abnormal samples from the multidimensional time-series data of IoT systems;
[0010] (2) Abnormal indicator localization: Identify the abnormal indicators that cause the abnormal samples and form an abnormal indicator set;
[0011] (3) Anomaly diagnosis: Construct prompt words using the set of anomaly indicators, and obtain anomaly diagnosis results by querying the large model.
[0012] Preferably, step (1) specifically includes:
[0013] (1-1) Obtaining multi-dimensional time-series data from IoT systems , recorded as ,in, For time-series data, this corresponds to the number of sensing and monitoring devices. This refers to the length of the time-series data, corresponding to the acquisition time.
[0014] (1-2) Based on an autoencoder, an anomaly detection model DM is trained using self-supervised learning. The training objective is to minimize the input time series data segment X. t With reconstructing time series data segments Differences;
[0015] (1-3) Input the real-time acquired time series data segment into the anomaly detection model DM, calculate the anomaly score, and if the anomaly score is greater than the preset threshold, then the time series data segment is determined to be an anomaly sample.
[0016] Preferably, in step (1-2), the model architecture of the autoencoder includes:
[0017] Input layer: X is divided into multiple time-series data segments based on a sliding window of preset size. Where W is the size of the sliding window, If the t-th time-series data segment is a time-series data segment, then the data input to the autoencoder is the time-series data segment. =< , ,…, >, among which for The Middle (one feature vector)
[0018] Encoding layer: Uses an LSTM model for X t The processing is performed as shown in the following formula. W encoded hidden state vectors r are obtained. t1 ,r t2 ,...,r tW ;
[0019] Decoding layer: Use another LSTM model to process the encoded hidden state vector r t1 ,r t2 ,...,r tW The processing is performed as shown in the following formula. We obtain W decoded hidden state vectors H t = <h t1 ,h t2 ,...,h tW >;
[0020] Reconstruction layer: Using a multilayer perceptron to reconstruct H t Convert to input timing data segment X t Reconstructing time-series data segments with consistent dimensions .
[0021] Preferably, the real-time anomaly detection steps in steps (1-3) are as follows:
[0022] (1-3-1) Sample reconstruction: Given a time series data segment Input X into the anomaly detection model DM to obtain reconstructed samples. .
[0023] (1-3-2) Anomaly scoring: The anomaly score is calculated based on the following formula; if the score is greater than the specified threshold, then sample X is determined to be an anomaly;
[0024] The formula for calculating the anomaly score is as follows: .
[0025] Preferably, step (2) specifically includes:
[0026] (2-1) Randomly collect multiple normal time series data segments and calculate the average value to obtain normal samples. ;
[0027] (2-2) Targeting abnormal samples and normal samples For the i-th indicator, calculate the correlation coefficient for that indicator, where cov(·) is the covariance function and σ(·) is the standard deviation function. The formula for calculating the correlation coefficient is:
[0028] ;
[0029] (2-3) Using the two independent samples t-test technique, the correlation coefficient is used as the P value to perform hypothesis testing on each indicator. When the P value is less than the preset threshold, the corresponding indicator i is identified as an abnormal indicator, and finally the abnormal indicator set FS is obtained.
[0030] Preferably, in step (2-3), the specific steps for locating abnormal indicators are as follows:
[0031] (2-3-1) Hypothesis: Hypothesis H0 is “X” A and X N The distribution on the i-th index is the same, that is... ]= If H0 is true, then the normal sample index is considered. ] and abnormal sample indicators If they are similar, then the two sample indicators are considered to have significant differences;
[0032] (2-3-2) P-value test: The correlation coefficient calculated in step (2-2) is used as the P-value, which represents the probability of a more extreme outcome than the observed sample results when the null hypothesis is true. The smaller the P-value, the smaller the probability of H0 occurring. When the P-value is less than the predefined threshold α, P Time (α) P If the value is set to 0.05, then the hypothesis H0 is rejected (i.e., it is considered that...). ]and (There are significant differences), and the i-th indicator is identified as an abnormal indicator.
[0033] (2-3-3) Iterative test: Perform a two-independent-samples t-test on each indicator to obtain the set of abnormal indicators, denoted as FS.
[0034] Preferably, step (3) specifically includes:
[0035] (3-1) Generation of abnormal indicator descriptions: retrieve the description information of each abnormal indicator in the abnormal indicator set FS, and organize the description information into an abnormal indicator description text AT;
[0036] (3-2) Anomaly indicator knowledge retrieval: Based on the indicator names in the anomaly indicator set FS, retrieve relevant anomaly knowledge text fragments EK from the external knowledge base;
[0037] (3-3) Anomaly diagnosis prompt word generation: According to the preset prompt word template, the anomaly indicator description text AT and the anomaly knowledge text fragment EK are combined into a complete prompt word APrompt;
[0038] (3-4) Anomaly diagnosis based on large model: Input the prompt word APrompt into the large model, obtain and output the anomaly diagnosis description generated by the large model.
[0039] Preferably, in step (3-1), the descriptive information includes at least one or more of the following: abnormal indicator name, corresponding sensing device or monitoring device, degree of deviation of abnormal data, time of occurrence of abnormality, and operation log.
[0040] Preferably, in step (3-2), the external knowledge base includes one or more of the following: system manual and troubleshooting manual.
[0041] Compared with the prior art, the beneficial effects of the present invention are:
[0042] 1. This invention utilizes a self-supervised learning method based on LSTM autoencoders, requiring only normal data for model training, effectively addressing the challenge of insufficient anomaly sample labeling in IoT scenarios. The model can learn deep temporal dependencies and feature associations in time-series data, achieving higher detection accuracy and lower false alarm rate compared to traditional methods.
[0043] 2. This invention innovatively applies the two independent samples t-test technique to the localization of abnormal indicators. By using statistical testing methods to quantify the significance of differences between abnormal and normal samples on various indicators, it can quickly and accurately screen out the key indicators that cause abnormalities from a large number of indicators, providing clear clues for subsequent diagnosis.
[0044] 3. This invention comprehensively employs anomaly detection and root cause analysis techniques to determine anomaly indicators in IoT systems, and constructs prompt words based on these anomaly indicators. This overcomes the problem that large models cannot process IoT system data, helps large models better understand anomaly scenarios in IoT systems, and thus obtains more accurate anomaly diagnosis. Attached Figure Description
[0045] Figure 1 This is a flowchart illustrating the IoT system anomaly diagnosis method in an embodiment of the present invention;
[0046] Figure 2This is a schematic diagram of the abnormal diagnosis prompt word template in an embodiment of the present invention. Detailed Implementation
[0047] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0048] Example
[0049] Please see Figure 1 - Figure 2 This invention provides a method for anomaly diagnosis in large-scale Internet of Things (IoT) systems, comprising the following steps:
[0050] (1) Anomaly detection in IoT systems: Detecting abnormal samples from the multidimensional time-series data of IoT systems;
[0051] Specifically:
[0052] (1-1) The Internet of Things (IoT) system contains various sensing and monitoring devices that continuously collect data, ultimately forming a multi-dimensional time series data set. This allows for the acquisition of multi-dimensional time series data from the IoT system. , recorded as ,in, For time-series data, this corresponds to the number of sensing and monitoring devices. This refers to the length of the time-series data, corresponding to the acquisition time.
[0053] (1-2) Based on an autoencoder, an anomaly detection model DM is trained using self-supervised learning. The training objective is to minimize the input time series data segment X. t With reconstructing time series data segments Differences;
[0054] The model architecture of the autoencoder includes:
[0055] Input layer: X is divided into multiple time-series data segments based on a sliding window of preset size. Where W is the size of the sliding window, If the t-th time-series data segment is a time-series data segment, then the data input to the autoencoder is the time-series data segment. =< , ,…, >, among which for The Middle (one feature vector)
[0056] Encoding layer: Uses an LSTM model for X t The processing is performed as shown in the following formula. W encoded hidden state vectors r are obtained. t1 ,r t2 ,...,r tW ;
[0057] Decoding layer: Use another LSTM model to process the encoded hidden state vector r t1 ,r t2 ,...,r tW The processing is performed as shown in the following formula. We obtain W decoded hidden state vectors H t = <h t1 ,h t2 ,...,h tW >;
[0058] Reconstruction layer: Using a multilayer perceptron to reconstruct H t Convert to input timing data segment X t Reconstructing time-series data segments with consistent dimensions .
[0059] (1-3) Input the real-time acquired time series data segment into the anomaly detection model DM, calculate the anomaly score, and if the anomaly score is greater than the preset threshold, then the time series data segment is determined to be an anomaly sample.
[0060] The specific steps for real-time anomaly detection are as follows:
[0061] (1-3-1) Sample reconstruction: Given a time series data segment Input X into the anomaly detection model DM to obtain reconstructed samples. .
[0062] (1-3-2) Anomaly scoring: The anomaly score is calculated based on the following formula; if the score is greater than the specified threshold, then sample X is determined to be an anomaly;
[0063] The formula for calculating the anomaly score is as follows: .
[0064] (2) Abnormal indicator localization: Identify the abnormal indicators that cause the abnormal samples and form an abnormal indicator set;
[0065] When given an abnormal sample Step (2) specifically includes:
[0066] (2-1) Randomly collect multiple normal time series data segments and calculate the average value to obtain normal samples. ;
[0067] (2-2) Targeting abnormal samples and normal samples For the i-th indicator, calculate the correlation coefficient for that indicator, where cov(·) is the covariance function and σ(·) is the standard deviation function. The formula for calculating the correlation coefficient is:
[0068]
[0069] (2-3) Using the two independent samples t-test technique, the correlation coefficient is used as the P value to perform hypothesis testing on each indicator. When the P value is less than the preset threshold, the corresponding indicator i is identified as an abnormal indicator, and finally the abnormal indicator set FS is obtained.
[0070] In steps (2-3), the specific steps for locating abnormal indicators are as follows:
[0071] (2-3-1) Hypothesis: Hypothesis H0 is “X” A and X N The distribution on the i-th index is the same, that is... ]= If H0 is true, then the normal sample index is considered. ] and abnormal sample indicators If they are similar, then the two sample indicators are considered to have significant differences;
[0072] (2-3-2) P-value test: The correlation coefficient calculated in step (2-2) is used as the P-value, which represents the probability of a more extreme outcome than the observed sample results when the null hypothesis is true. The smaller the P-value, the smaller the probability of H0 occurring. When the P-value is less than the predefined threshold α, P Time (α) P If the value is set to 0.05, then the hypothesis H0 is rejected (i.e., it is considered that...). ]and (There are significant differences), and the i-th indicator is identified as an abnormal indicator.
[0073] (2-3-3) Iterative test: Perform a two-independent-samples t-test on each indicator to obtain the set of abnormal indicators, denoted as FS.
[0074] (3) Anomaly diagnosis: Construct prompt words using the set of anomaly indicators, and obtain anomaly diagnosis results by querying the large model.
[0075] Step (3) specifically includes:
[0076] (3-1) Generation of abnormal indicator descriptions: retrieve the description information of each abnormal indicator in the abnormal indicator set FS, and organize the description information into an abnormal indicator description text AT;
[0077] The description information includes at least one or more of the following: abnormal indicator name (such as temperature, pressure), corresponding sensing or monitoring device (such as thermometer, humidity sensor), degree of deviation of abnormal data (such as water level exceeding the normal value by 50%), time of occurrence of abnormality, and operation log.
[0078] (3-2) Anomaly indicator knowledge retrieval: Based on the indicator names in the anomaly indicator set FS, retrieve relevant anomaly knowledge text fragments EK from an external knowledge base; wherein, the external knowledge base includes one or more of the system manual and fault handling manual;
[0079] (3-3) Generation of abnormal diagnostic prompts: such as Figure 2 As shown, according to the preset prompt word template, the abnormal indicator description text AT and the abnormal knowledge text fragment EK are combined into a complete prompt word APrompt.
[0080] (3-4) Anomaly diagnosis based on large model: Input the prompt word APrompt into the large model, obtain and output the anomaly diagnosis description generated by the large model.
[0081] In summary, this invention comprehensively employs anomaly detection and root cause analysis techniques to determine anomaly indicators in IoT systems and constructs prompt words based on these indicators. This overcomes the problem that large models cannot process IoT system data, helps large models better understand abnormal scenarios in IoT systems, and thus obtains more accurate anomaly diagnosis.
[0082] Application Examples
[0083] Taking an IoT system for a smart agricultural greenhouse as an example, the system deploys temperature sensors, humidity sensors, light intensity sensors, soil pH sensors, and carbon dioxide concentration sensors to continuously collect environmental data.
[0084] Reference Figure 1 This embodiment provides a method for anomaly diagnosis in a large-scale IoT system, comprising the following steps:
[0085] Step (1): IoT system anomaly detection. The detailed process of this step is as follows:
[0086] (1-1) Data Acquisition: Obtain multi-dimensional time-series data X from the IoT system of the smart agricultural greenhouse. Assuming K is 5 (5 types of sensors) and T is 1000 (1000 time points), then X is a 5x1000 matrix.
[0087] (1-2) Model training:
[0088] (1-2-1) Model architecture: Construct an LSTM autoencoder.
[0089] Input layer: Set the sliding window size W to 60 (i.e., 1 hour of data, assuming data is collected once per minute). Divide X into multiple data segments X of length 60. t .
[0090] Encoding layer: Uses one LSTM unit to encode each X t (Dimension 5x60) Encoded as a hidden state sequence R t .
[0091] Decoding layer: Using another LSTM unit, Rt is decoded into a hidden state sequence H. t .
[0092] Reconstruction layer: Using a multilayer perceptron, Ht is mapped back to a 5x60 reconstructed data segment.
[0093] (1-2-2) Model Training: A large amount of historical normal data segments are used as the training set. The model parameters are optimized through the backpropagation algorithm, with the goal of minimizing the reconstruction error, such as the mean squared error. After training, the anomaly detection model DM is obtained.
[0094] (1-3) Real-time anomaly detection:
[0095] (1-3-1) Sample reconstruction: Input the latest data segment X collected in real time into the model DM to obtain the reconstructed sample.
[0096] (1-3-2) Anomaly Scoring: Calculate the anomaly score. Set a threshold, for example, by selecting a threshold on the validation set that maximizes the F1 score. If the score is greater than the preset threshold, the current data segment X is determined to be an anomaly sample X. A .
[0097] Step (2): Abnormal indicator location. The detailed process for this step is as follows:
[0098] Assume that step (1) detects an anomalous sample X. A .
[0099] (2-1) Normal sample sampling: Randomly select 100 data segments from historical normal data, calculate the average value at each time point, and obtain a representative normal sample X. N .
[0100] (2-2) Calculate the correlation coefficient: For each indicator i (i=1,2,3,4,5), calculate X. A and X NThe correlation coefficient on the index series. For example, calculating the correlation coefficient of a temperature series.
[0101] (2-3) Locating abnormal indicators:
[0102] (2-3-1) Hypothesis: For the temperature index, hypothesize H0: X A Temperature sequence distribution and X N The temperature sequence distributions are the same.
[0103] (2-3-2) P-value test: The temperature correlation coefficient calculated in step (2-2) is used as the P-value. The significance level is set to α = 0.05. If the P-value < 0.05, H0 is rejected, and the temperature index is considered to have a significant difference, and it is marked as an outlier.
[0104] (2-3-3) Iterative verification: Repeat the above process for all 5 indicators. Assuming that the p-values of the two indicators "temperature" and "humidity" are found to be less than 0.05, then the abnormal indicator set FS={temperature, humidity} is obtained.
[0105] Step (3): Abnormal diagnosis. The detailed process for this step is as follows:
[0106] (3-1) Generation of abnormal index descriptions: Retrieve the description information of the abnormal index set FS={temperature, humidity}.
[0107] Temperature: Current value 35°C, normal range 20-25°C, deviates from the upper limit of normal value by 40%. Corresponding device: Zone 3 temperature sensor. Time of occurrence: 14:30.
[0108] Humidity: Current value 30%, normal range 60%-80%, deviates from the lower limit of normal by 50%. Corresponding device: Humidity sensor in zone 3. Time of occurrence: 14:30.
[0109] Operation Log: 14:25, Operator "Zhang San" manually shut down the spray humidification system in Zone 3.
[0110] Organize the above information into a text AT.
[0111] (3-2) Abnormal indicator knowledge retrieval: In the knowledge base of "Smart Agriculture Greenhouse Operation and Maintenance Manual", search for the keywords "temperature too high" and "humidity too low" to obtain knowledge fragment EK, such as: "Temperature too high and humidity too low may cause crop dehydration. Common causes include ventilation system failure, heating system abnormality or humidification system shutdown.
[0112] (3-3) Abnormal diagnosis prompt word generation: Fill AT and EK into the preset prompt word template to generate APrompt.
[0113] (3-4) Anomaly diagnosis based on large models: Input APrompt into large models such as GPT-4. The diagnostic results output by the large model may be as follows:
[0114] 1. Anomaly Summary: At 14:30, an abnormally high temperature (35°C) and an abnormally low humidity (30%) were detected in Zone 3, both exceeding the normal range.
[0115] 2. Possible causes analysis:
[0116] Main reason: According to the operation log, the humidification system was manually turned off at 14:25, which directly led to a sharp drop in humidity. At the same time, turning off the humidification system may have disrupted the original temperature and humidity balance, causing the temperature to rise rapidly under sunlight.
[0117] Secondary cause: It is necessary to check whether the ventilation system is operating normally. If the ventilation is not good, it will aggravate the temperature rise.
[0118] 3. Recommendations:
[0119] Immediate action: Restart the mist humidification system in Zone 3 immediately.
[0120] Follow-up investigation: Check the ventilation system to ensure air circulation. Observe whether the temperature and humidity return to normal after restarting the humidifier system.
[0121] Operating procedures: It is recommended to train operators, emphasizing the assessment of the environmental impact of manual operations.
[0122] Through the above steps, this invention achieves an automated closed loop from detection to diagnosis, providing rapid and accurate decision support for the operation and maintenance of smart agricultural greenhouses.
[0123] The above are merely preferred embodiments of the present invention and are not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.
Claims
1. A method for anomaly diagnosis in large-scale Internet of Things (IoT) systems, characterized in that: Includes the following steps: (1) Anomaly detection in IoT systems: Detecting abnormal samples from the multidimensional time-series data of IoT systems; (2) Abnormal indicator localization: Identify the abnormal indicators that cause the abnormal samples and form an abnormal indicator set; (3) Anomaly diagnosis: Construct prompt words using the set of anomaly indicators, and obtain anomaly diagnosis results by querying the large model.
2. The anomaly diagnosis method for large-scale IoT systems according to claim 1, characterized in that, Step (1) specifically includes: (1-1) Obtaining multi-dimensional time-series data from IoT systems , recorded as ,in, For time-series data, this corresponds to the number of sensing and monitoring devices. This refers to the length of the time-series data, corresponding to the acquisition time. (1-2) Based on an autoencoder, an anomaly detection model DM is trained using self-supervised learning. The training objective is to minimize the input time series data segment X. t With reconstructing time series data segments Differences; (1-3) Input the real-time acquired time series data segment into the anomaly detection model DM, calculate the anomaly score, and if the anomaly score is greater than the preset threshold, then the time series data segment is determined to be an anomaly sample.
3. The anomaly diagnosis method for large-scale IoT systems according to claim 2, characterized in that, In steps (1-2), the model architecture of the autoencoder includes: Input layer: X is divided into multiple time-series data segments based on a sliding window of preset size. Where W is the size of the sliding window, If the t-th time-series data segment is a time-series data segment, then the data input to the autoencoder is the time-series data segment. =< , ,…, >, among which for The Middle (one feature vector) Encoding layer: Uses an LSTM model for X t The processing is performed as shown in the following formula. W encoded hidden state vectors r are obtained. t1 ,r t2 ,...,r tW ; Decoding layer: Use another LSTM model to process the encoded hidden state vector r t1 ,r t2 ,...,r tW The processing is performed as shown in the following formula. We obtain W decoded hidden state vectors H t = <h t1 ,h t2 ,...,h tW >; Reconstruction layer: Using a multilayer perceptron to reconstruct H t Convert to input timing data segment X t Reconstructing time-series data segments with consistent dimensions .
4. The anomaly diagnosis method for large-scale IoT systems according to claim 3, characterized in that, In steps (1-3), the specific steps for real-time anomaly detection are as follows: (1-3-1) Sample reconstruction: Given a time series data segment Input X into the anomaly detection model DM to obtain reconstructed samples. . (1-3-2) Anomaly scoring: The anomaly score is calculated based on the following formula; if the score is greater than the specified threshold, then sample X is determined to be an anomaly; The formula for calculating the anomaly score is as follows: .
5. The anomaly diagnosis method for large-scale IoT systems according to claim 1, characterized in that, Given an anomalous sample Step (2) specifically includes: (2-1) Randomly collect multiple normal time series data segments and calculate the average value to obtain normal samples. ; (2-2) Targeting abnormal samples and normal samples For the i-th indicator, calculate the correlation coefficient for that indicator, where cov(·) is the covariance function and σ(·) is the standard deviation function. The formula for calculating the correlation coefficient is: ; (2-3) Using the two independent samples t-test technique, the correlation coefficient is used as the P value to perform hypothesis testing on each indicator. When the P value is less than the preset threshold, the corresponding indicator i is identified as an abnormal indicator, and finally the abnormal indicator set FS is obtained.
6. The anomaly diagnosis method for large-scale IoT systems according to claim 5, characterized in that, In step (2-3), the specific steps for locating abnormal indicators are as follows: (2-3-1) Hypothesis: Assume H0 is "X A and X N The distribution on the i-th index is the same, that is... ]= If H0 is true, then the normal sample index is considered. ] and abnormal sample indicators If they are similar, then the two sample indicators are considered to have significant differences; (2-3-2) P-value test: The correlation coefficient calculated in step (2-2) is used as the P-value, which represents the probability of a more extreme outcome than the observed sample results when the null hypothesis is true. The smaller the P-value, the smaller the probability of H0 occurring. When the P-value is less than the predefined threshold α, P Time (α) P If the value is set to 0.05, then the hypothesis H0 is rejected (i.e., it is considered that...). ]and (There are significant differences), and the i-th indicator is identified as an abnormal indicator. (2-3-3) Iterative test: Perform a two-independent-samples t-test on each indicator to obtain the set of abnormal indicators, denoted as FS.
7. The anomaly diagnosis method for large-scale IoT systems according to claim 1, characterized in that, Step (3) specifically includes: (3-1) Generation of abnormal indicator descriptions: retrieve the description information of each abnormal indicator in the abnormal indicator set FS, and organize the description information into an abnormal indicator description text AT; (3-2) Anomaly indicator knowledge retrieval: Based on the indicator names in the anomaly indicator set FS, retrieve relevant anomaly knowledge text fragments EK from the external knowledge base; (3-3) Anomaly diagnosis prompt word generation: According to the preset prompt word template, the anomaly indicator description text AT and the anomaly knowledge text fragment EK are combined into a complete prompt word APrompt; (3-4) Anomaly diagnosis based on large model: Input the prompt word APrompt into the large model, obtain and output the anomaly diagnosis description generated by the large model.
8. The anomaly diagnosis method for large-scale IoT systems according to claim 7, characterized in that, In step (3-1), the descriptive information includes at least one or more of the following: abnormal indicator name, corresponding sensing device or monitoring device, degree of deviation of abnormal data, time of occurrence of abnormality, and operation log.
9. The anomaly diagnosis method for large-scale IoT systems according to claim 7, characterized in that, In step (3-2), the external knowledge base includes one or more of the following: system manual and troubleshooting manual.