Industrial Internet of Things equipment anomaly detection system and method based on edge intelligence

Abstract

The invention discloses an industrial Internet of Things equipment anomaly detection system and method based on edge intelligence, relates to the technical field of Internet of Things and artificial intelligence, and aims to solve the problems of large bandwidth consumption, poor real-time performance and privacy disclosure in industrial Internet of Things anomaly detection. The system is composed of a physical sensing layer, an edge intelligent layer and a cloud collaboration layer. The edge intelligent layer adopts depth separable convolution to extract features, and performs local anomaly judgment and multi-level decision making in combination with an auto-encoder reconstruction error; and the cloud collaboration layer utilizes a knowledge distillation technology to migrate the global model capability to an edge end. By adopting the above technical scheme, the detection capability depth subsidence and millisecond-level real-time response are realized, the uplink data volume is significantly reduced, and the system robustness is improved through continuous evolution of the cloud edge cooperative driving model while the data privacy security is ensured.

Description

Technical Field

[0001] This invention relates to the fields of Internet of Things (IoT) and artificial intelligence (AI), and in particular to an industrial IoT device anomaly detection system and method based on edge intelligence. Background Technology

[0002] As global manufacturing evolves towards digitalization, networking, and intelligence, the Industrial Internet of Things (IIoT) has become a core infrastructure driving the transformation of modern production systems. By deploying massive numbers of sensors and sensing terminals on production lines, large rotating machinery, and precision machining equipment, the IIoT enables real-time monitoring and data collection of the production environment, equipment operating status, and process parameters. In this context, equipment anomaly detection, as a crucial link in ensuring industrial production safety and improving predictive maintenance efficiency, directly impacts the continuity of production and the security of core assets for enterprises.

[0003] Traditional industrial equipment anomaly detection solutions primarily rely on centralized cloud computing architectures. In this model, various IoT terminals distributed across the industrial site collect high-frequency, multi-dimensional raw data, which is then transmitted via industrial gateways and backhaul networks to remote cloud servers or data centers. The cloud platform, with its near-unlimited computing resources and storage space, uses pre-defined statistical threshold algorithms or deep learning models to uniformly process and extract features from the massive amounts of data, thereby identifying potential anomalies in the equipment. In the early stages of industrial IoT development, this architecture effectively addressed the bottlenecks of insufficient computing power in individual sensing devices and limited historical data storage, laying the foundation for cross-regional and cross-factory collaborative equipment monitoring and macro-level energy efficiency management.

[0004] However, with the acceleration of Industry 4.0, the scale of equipment in industrial settings is growing exponentially, and the sampling frequency and data dimensions are constantly increasing. This centralized detection paradigm, which heavily relies on the cloud, is gradually revealing inherent contradictions at the principle level. Specifically, industrial sites generate massive amounts of time-series data with extremely high real-time requirements and redundancy. If all raw sampled data is uploaded to the cloud without filtering, it will not only consume extremely valuable uplink network bandwidth, causing frequent communication link congestion, but also generate huge data transmission costs and cloud storage overhead. More seriously, anomaly detection is essentially a race against the "window" of failure occurrence. Under a centralized architecture, the multi-level flow of data between the perception layer, network transmission layer, and cloud processing layer inevitably introduces significant network latency and protocol conversion losses. For critical application scenarios with millisecond-level response time requirements, such as flashovers in high-voltage power facilities and spindle instability in precision machine tools, the lag in cloud decision-making often means that the detection results have missed the optimal processing opportunity by the time they are fed back to the execution end, thus failing to form effective closed-loop control and even inducing serious equipment damage or production accidents.

[0005] Furthermore, industrial production data often contains core process parameters, production cycles, and company secrets. The process of migrating all data to the cloud objectively increases the security risk of data interception or tampering during transmission, creating a natural obstacle in heavy industry and defense sectors where data sovereignty and privacy protection are paramount. Although the industry has attempted to deploy simple logical judgment rules at the edge to alleviate cloud pressure, traditional edge nodes, limited by hardware resources, struggle to support complex deep learning models. This results in generally insufficient detection accuracy and generalization ability when facing nonlinear, strongly coupled, and complex industrial conditions, easily leading to false positives or false negatives. This trade-off between "real-time performance / privacy at the edge" and "high accuracy / heavy load of intelligent algorithms" constitutes a deep-seated technical bottleneck in the current industrial IoT field.

[0006] The reason for this lies in the fact that existing technical solutions have not yet achieved deep semantic decoupling and collaborative optimization of computing load between the edge and cloud sides. They lack an intelligent anomaly detection mechanism that can adapt to the limited computing power at the edge while maintaining high-dimensional feature extraction capabilities. Therefore, how to move intelligent analysis capabilities closer to the data source while ensuring detection accuracy, achieving real-time local decision-making responses, significantly reducing dependence on core network resources, and protecting data privacy has become a key challenge and an urgent technical problem for those skilled in the art. Summary of the Invention

[0007] This invention aims to address the technical problems in existing industrial IoT anomaly detection technologies, such as the huge communication bandwidth consumption, delayed real-time response, and data privacy leakage risks caused by the heavy reliance on cloud computing. It proposes an industrial IoT device anomaly detection system and method based on edge intelligence. By constructing a lightweight deep perception model and semantic decoupling mechanism at the edge, this invention achieves dynamic collaborative optimization of the computing load between the edge and the cloud, significantly improving the real-time performance of anomaly response in industrial settings while ensuring detection accuracy.

[0008] To achieve the above objectives, this invention provides an industrial IoT device anomaly detection system based on edge intelligence. The system comprises, from bottom to top, a physical sensing layer, an edge intelligence layer, and a cloud collaboration layer. The physical sensing layer collects real-time operating status parameters of industrial equipment through multiple sensor terminals deployed at the industrial site. These operating status parameters include vibration signals, acoustic emission signals, current signals, and temperature signals. The edge intelligence layer is deployed at edge computing nodes close to the industrial site and includes a data preprocessing module, a lightweight feature extraction module, a local anomaly detection module, and a semantic feature compression module. The cloud collaboration layer is deployed on a remote server and includes a global model training module, a knowledge distillation optimization module, and a long-term trend analysis module.

[0009] The data preprocessing module of the edge intelligence layer is configured to perform denoising and normalization processing on the raw time-series signal uploaded by the physical perception layer. Specifically, the data preprocessing module uses an adaptive median filtering algorithm to filter out random impulse interference in the raw signal and uses a sliding window technique to divide the continuous time-series data stream into data frames with a predetermined overlap rate. For each frame of data, the data preprocessing module performs a normalization operation, the calculation formula of which is as follows:

[0010]

[0011] in, , representing the normalized data sequence, Represents the original sampled data sequence. This represents the average value of all sampled points within the data frame. This represents the standard deviation of the sampled points within the data frame.

[0012] The lightweight feature extraction module is built on a depthwise separable convolutional architecture and is used to extract multi-dimensional spatial features from normalized data frames. By decomposing standard convolution into depthwise convolution and pointwise convolution, the module maintains its ability to capture nonlinear features in the operating state of industrial equipment while reducing the number of computational parameters. Furthermore, the output of the lightweight feature extraction module is connected to a local anomaly detection module.

[0013] The local anomaly detection module integrates a reconstruction error evaluation unit based on an autoencoder structure. This unit maps the extracted feature vectors to a low-dimensional latent space and attempts to reconstruct them back to the original feature dimensions. The local anomaly detection module measures the degree of device anomaly by calculating the Euclidean distance between the original features and the reconstructed features, and the anomaly score is... The calculation formula is as follows:

[0014]

[0015] in, This represents the original feature vector output by the lightweight feature extraction module. This represents the feature vector reconstructed by the reconstruction error evaluation unit. When the anomaly score... When the preset local alarm threshold is exceeded, the edge intelligent layer immediately triggers a local alarm signal and executes predetermined security protection logic.

[0016] In a preferred embodiment of the present invention, the edge intelligence layer further includes a semantic feature compression module. The semantic feature compression module is configured to compress anomaly scores... When the uncertainty range is preset, key semantic components are extracted from the feature vector and subjected to dimensionality reduction and compression. The compressed semantic features are then uploaded to the cloud collaboration layer. The semantic feature compression combines principal component analysis with importance sampling to ensure that sufficient discriminative information to support deep inference in the cloud is retained under predetermined low bandwidth usage.

[0017] The global model training module of the cloud collaboration layer is responsible for receiving compressed semantic features and corresponding anomaly labels from multiple edge intelligent nodes to construct a large-scale heterogeneous dataset. The global model training module employs a residual network or attention mechanism network with a deep network structure to perform high-precision modeling of the global device state and generate globally optimal model parameters.

[0018] Furthermore, the knowledge distillation optimization module of the cloud-based collaborative layer is used to migrate cloud-based intelligence to the edge. This module uses the deep network generated by the global model training module as the teacher model and the lightweight feature extraction module of the edge intelligence layer as the student model. By minimizing the divergence in the output probability distribution between the teacher and student models, it guides the student model to learn the complex feature representation capabilities of the teacher model. The loss function of the distillation process... The definition is as follows:

[0019]

[0020] in, This represents the cross-entropy loss between the student model output and the true label. Represents the probability distribution of the teacher model output. With the student model output probability distribution The divergence between them This indicates the preset distillation temperature parameter. This represents the preset balance weight coefficient. Indicates the true label, This represents the predicted output of the student model.

[0021] In one embodiment of the present invention, the long-term trend analysis module predicts the degradation trend of device performance by performing time-series modeling on historical anomaly data aggregated in the cloud. This module utilizes a Long Short-Term Memory (LSTM) network to extract long-range dependencies in the data and calculates the predicted remaining useful life of the device.

[0022] This invention also provides a method for anomaly detection in industrial IoT devices based on edge intelligence, the method comprising the following steps:

[0023] Step 1, Data Acquisition and Preprocessing: Real-time time-series data on equipment operating status is acquired through sensors distributed across the industrial site, and adaptive denoising and normalization are performed at the edge to form standardized input data frames.

[0024] Step 2, Lightweight Inference on the Edge Side: The standardized input data frame is input into the lightweight feature extraction module in the edge computing node, features are extracted using depthwise separable convolution, and the reconstruction error anomaly score is calculated through the local anomaly detection module.

[0025] Step 3, Multi-level Decision Response:

[0026] If the abnormal score exceeds the first preset threshold, the edge side will directly determine it as a serious fault, immediately trigger a local emergency shutdown signal, and upload a fault snapshot to the cloud for evidence storage.

[0027] If the abnormal score is between the first preset threshold and the second preset threshold, it is judged as a suspected abnormality, and the semantic feature compression module is activated to upload the key feature vector to the cloud collaboration layer for in-depth review.

[0028] If the abnormal score is lower than the second preset threshold, it is determined to be operating normally, and only heartbeat signals and status summaries are sent to the cloud periodically.

[0029] Step 4, Cloud-based Deep Review and Global Optimization: After receiving a suspected abnormal compressed feature, the cloud-based collaborative layer uses a high-performance global model to make a secondary judgment and feeds the judgment result back to the edge side, while updating the local knowledge base.

[0030] Step 5, Dynamic Model Evolution: The cloud-based collaborative layer periodically retrains the model using accumulated global data and generates optimized, lightweight model parameters through knowledge distillation. These optimized model parameters are pushed to the edge intelligence layer via the downlink, enabling online updates and accuracy iterations of the edge detection algorithm.

[0031] Furthermore, in the first step, the adaptive noise reduction process specifically includes:

[0032] First, calculate the statistical characteristics of the data within the current sliding window to determine the noise intensity estimate;

[0033] Secondly, the window width of the median filter is dynamically adjusted based on the noise intensity estimate to preserve the steep edge features of the signal while filtering out impulse noise.

[0034] Furthermore, in the second step, the lightweight feature extraction module introduces a spatial attention mechanism when extracting features. This spatial attention mechanism enhances features in key areas by calculating the importance weights of each pixel in the feature map. Its weight coefficients... The calculation method is as follows:

[0035]

[0036] in, Represents the activation function. This indicates the preset convolution operation. and These represent the feature maps respectively. The results after performing global average pooling and global max pooling.

[0037] Furthermore, in the third step, the semantic feature compression module employs a feature selection mechanism based on entropy weighting. This mechanism evaluates the information entropy of features in each dimension and prioritizes retaining feature components with higher information entropy, thereby minimizing the loss of useful information during the compression process.

[0038] Furthermore, in the fifth step, the model parameter push process adopts an incremental update strategy. The cloud collaboration layer only calculates the difference matrix between the old and new model parameters, and then compresses and encodes the difference matrix before sending it down to further reduce the downlink bandwidth usage in the industrial field.

[0039] The beneficial effects of this invention are:

[0040] First, it achieves deep penetration of detection capabilities and real-time response. By deploying a lightweight model based on depthwise separable convolution and autoencoder reconstruction error at the edge, this invention can directly determine most common anomalies at nodes close to the data source, significantly reducing response latency and meeting the stringent real-time requirements of scenarios such as precision machining and high-voltage power.

[0041] Secondly, it significantly alleviates network bandwidth pressure. By introducing semantic feature compression technology and a multi-level decision-making mechanism, this invention only transmits high-value feature data to the cloud when encountering suspected anomalies or necessary status reports, rather than transmitting the full amount of raw data. While maintaining high detection accuracy, this invention can significantly reduce the amount of uplink data, effectively avoiding communication link congestion in the complex electromagnetic environment of industrial sites.

[0042] Third, it enhances data privacy and security. Since core production data is transformed from raw signals to abstract features at the edge, sensitive process parameters no longer need to be transmitted in plaintext or raw waveforms over public networks. This physically isolates the risk of data leakage, meeting the protection requirements for production safety and data sovereignty in heavy industry.

[0043] Fourth, continuous algorithm evolution is achieved through cloud-edge collaboration. By utilizing the powerful computing resources of the cloud for global model training and knowledge distillation, and combining an incremental update strategy to push the optimized model parameters down to the edge, this invention solves the problems of poor model generalization and low accuracy caused by the limited computing power of traditional edge nodes, enabling the entire detection system to have the ability to learn and evolve on its own.

[0044] Fifth, it improves the system's reliability and robustness. The multi-level decision-making mechanism ensures that even in extreme situations such as network fluctuations or cloud failures, the edge side can still maintain basic anomaly detection and security protection functions with local computing power, avoiding blind spots in production monitoring caused by single points of failure.

[0045] Furthermore, the edge intelligence layer also includes a hardware resource monitoring unit. This unit monitors the computational occupancy, available memory, and current power consumption of the edge computing nodes in real time. When hardware resource occupancy exceeds a preset load threshold, the hardware resource monitoring unit dynamically adjusts the computational depth of the lightweight feature extraction module, reducing computational overhead by skipping some non-core convolutional layers to ensure the continuity of the anomaly detection task.

[0046] Furthermore, the cloud-based collaboration layer also integrates a multi-source data fusion engine. This engine can access heterogeneous monitoring data from different factories and different models of equipment. Through cross-domain feature mapping technology, the engine projects feature vectors from different sources onto a unified metric space, thereby utilizing transfer learning technology to improve the anomaly detection accuracy of newly deployed equipment in small sample situations.

[0047] Furthermore, the communication between the physical sensing layer and the edge intelligence layer employs an encrypted industrial real-time Ethernet protocol. Each uploaded data frame contains a digital signature generated by a hardware security module to prevent data tampering during local transmission.

[0048] Furthermore, the local anomaly detection module incorporates a dynamic environmental compensation factor when calculating the anomaly score. This compensation factor adjusts the reconstruction error threshold in real time based on the current environmental parameters collected at the edge, thereby eliminating false alarms caused by environmental fluctuations.

[0049] In summary, this invention, through innovation in system architecture and optimization of algorithm flow, successfully overcomes the contradiction between real-time performance, accuracy, and resource consumption in the field of Industrial Internet of Things, providing an efficient, safe, and scalable technical solution for realizing intelligent predictive maintenance of industrial equipment.

[0050] Furthermore, the lightweight feature extraction module of the edge intelligence layer employs a spatiotemporally decoupled convolution strategy when processing multidimensional sensor signals. Specifically, this module first extracts independent temporal features of each sensor channel along the time axis through depthwise convolution in a specific dimension, and then performs feature fusion along the channel dimension through point-to-point convolution. This decoupling strategy further reduces the number of computations in the model, making it adaptable to low-power embedded processors.

[0051] Furthermore, the semantic feature compression module employs a latent space mapping technique based on a variational autoencoder when performing feature dimensionality reduction. This technique maps high-dimensional feature vectors to low-dimensional probability distribution parameters that satisfy a specific distribution, namely the mean vector and the variance vector. After receiving these parameters, the cloud collaboration layer can recover highly representative feature vectors through sampling operations, thereby achieving a predetermined compression ratio while maintaining semantic integrity.

[0052] Furthermore, the global model training module of the cloud-based collaborative layer employs a loss function based on hard sample mining during the training process. This function automatically increases the weight of samples with large prediction errors in the loss function, forcing the model to focus on rare but highly hazardous extreme failure conditions in industrial settings, significantly improving the system's ability to capture long-tailed abnormal events.

[0053] Furthermore, the local anomaly detection module also includes a short-term memory buffer. This buffer stores the anomaly score sequence for the most recent predetermined number of periods. By analyzing the evolution trend of the score sequence, the local anomaly detection module can identify slowly occurring performance degradation faults, rather than just sudden, instantaneous anomalies. When the score sequence exhibits a monotonically increasing trend and the slope exceeds a preset rate of change threshold, the system will issue an early warning even if the current score has not yet reached the alarm threshold.

[0054] Furthermore, the cloud-based collaboration layer also includes a digital twin mirror library. This library maintains a virtual digital model of each monitored physical device in real time based on the feature data uploaded from the edge side. By running high-fidelity physical simulation algorithms on the virtual models, the cloud-based collaboration layer can verify suspected anomalies reported by the edge side at the physical mechanism level, further eliminating non-realistic anomalies caused by sensor drift or electromagnetic interference.

[0055] Furthermore, before distributing parameters, the knowledge distillation optimization module performs quantization and compression processing on the student model. This quantization and compression process converts floating-point parameters to fixed-point parameters and further compresses the model file size using a specific encoding method. Upon receiving the model update package, the edge intelligence layer seamlessly switches models through its built-in lightweight runtime environment, ensuring uninterrupted anomaly detection during the update process.

[0056] Furthermore, the physical sensing layer of the system supports the automatic identification and conversion of various industrial communication protocols. Through a preset protocol parsing template, the physical sensing layer uniformly converts heterogeneous protocol data output from sensors from different manufacturers into a standard format that meets the processing requirements of the edge intelligence layer, thereby ensuring the system's versatility and compatibility.

[0057] Furthermore, the edge intelligence layer also possesses self-diagnostic capabilities. This self-diagnostic function periodically checks the integrity of the sensor network, the accuracy of the data acquisition hardware, and the operational status of the edge computing core. If any sensor anomaly, drift, or edge-side computing power anomaly is detected, the system will immediately generate a device self-check report and notify maintenance personnel via the cloud-based collaborative layer.

[0058] In one specific embodiment of the present invention, when the industrial IoT device is a large rotating machine, the vibration signal collected by the physical sensing layer is converted into frequency domain features through a preset transformation method. The lightweight feature extraction module then performs convolution calculations on the feature frequency components in the frequency domain to identify typical mechanical faults.

[0059] In another specific embodiment of the present invention, when the system is applied to a precision machining center, the edge intelligent layer identifies abnormal tool wear by monitoring the coupling relationship between spindle current and cutting force in real time and using a local anomaly detection module. When an abnormal spike is detected in the cutting force waveform and its duration exceeds a preset pulse period, the system directly sends a deceleration or tool retraction command to the machine tool controller through the real-time control interface on the edge side, realizing closed-loop control within a predetermined response range from detection to execution.

[0060] Furthermore, the cloud-based collaboration layer also provides a multi-dimensional visual monitoring interface. This interface not only displays a real-time map of the anomaly distribution of each edge node, but also shows the global device health distribution through a multi-dimensional heatmap. Maintenance personnel can remotely retrieve the feature evolution trajectory of any edge node through this interface and perform online optimization of the global alarm strategy.

[0061] Furthermore, the system's method also includes an online annotation mechanism based on feedback incentives during execution. When the cloud-based collaborative layer determines that a suspected anomaly reported by the edge side is a false alarm, this determination result is fed back to the edge side as a negative sample. The edge intelligent layer uses this feedback sample to locally adjust the decision boundary of its reconstruction error evaluation unit, thereby achieving targeted suppression of false alarms under specific operating conditions.

[0062] Furthermore, the edge intelligence layer employs a dual-buffer asynchronous processing architecture. The first buffer receives high-frequency sampled data from the physical perception layer, while the second buffer stores standardized data frames to be processed. The lightweight inference engine reads data from the second buffer for analysis, while the data preprocessing module writes the processed data back to the first buffer. This architecture ensures parallel operation of data acquisition and intelligent analysis, eliminating the risk of sample frame loss due to computational time consumption.

[0063] Furthermore, the semantic feature compression module dynamically adjusts the compression ratio based on the quality of the current network link when uploading data. When network bandwidth is limited, the module further compresses the data by increasing the quantization step size; when the network condition is good, a lower compression ratio is used to transmit more detailed features, achieving a flexible balance between communication overhead and diagnostic accuracy.

[0064] Furthermore, the global model training of the cloud-based collaborative layer employs a federated learning framework. When updating the model across multiple factories, only model gradient information is exchanged, without exchanging the original feature data. This allows for the aggregation of industry knowledge on a larger scale while strictly protecting the production privacy of each enterprise.

[0065] Furthermore, the lightweight feature extraction module integrates a residual connection structure. This residual connection, by directly accumulating the input signal to the output of the convolutional layer, solves the gradient vanishing problem that may occur when deep networks are deployed at the edge, thus enhancing the model's learning stability for complex working conditions.

[0066] Furthermore, the local anomaly detection module also considers the operating context of the equipment during the detection process. This operating context includes the equipment's current rotational speed, load rate, and process stage. By querying a preset operating condition-threshold mapping table, the system automatically assigns the most suitable detection parameters for different operating conditions, effectively avoiding false alarms caused by operating condition switching.

[0067] Furthermore, the long-term trend analysis module of the cloud-based collaboration layer can also generate equipment maintenance recommendations. By comprehensively evaluating the frequency, intensity, and evolution rate of anomalies, this module can calculate the optimal maintenance time window and automatically generate a list of spare parts requirements, thus achieving a leap from reactive maintenance to proactive maintenance.

[0068] In summary, this invention constructs a multi-layered, fully collaborative industrial IoT anomaly detection system. By achieving high-precision real-time perception and decision-making at the edge and realizing global knowledge aggregation and model evolution in the cloud, this invention fundamentally solves the problem of the trade-off between real-time performance and accuracy in traditional solutions. Its lightweight architecture, semantic compression, and knowledge distillation techniques not only improve the system's engineering feasibility but also lay a solid technical foundation for the deeper intelligent evolution of the industrial internet.

[0069] Furthermore, the edge intelligence layer adopts a containerized deployment approach in its software architecture. By encapsulating the feature extraction module, decision-making module, and communication module within independent lightweight containers, the algorithm components are decoupled from the underlying hardware platform. This enables the system to quickly adapt to edge computing gateways with various instruction set architectures, greatly improving the system's deployment flexibility and maintainability.

[0070] Furthermore, the physical sensing layer possesses time-sensitive network characteristics. Through a global clock synchronization protocol, it ensures that data collected by sensors distributed across different geographical locations have highly consistent timestamp accuracy. This provides the necessary prerequisite for the edge intelligence layer to perform spatiotemporal correlation analysis of multi-source signals, enabling the system to identify cross-device collaborative anomaly patterns.

[0071] Furthermore, the edge intelligence layer also includes an anomaly pattern matching unit. This unit stores a set of predefined typical fault feature fingerprints. When the local anomaly detection module detects an increase in anomaly score, the matching unit attempts to compare the current feature vector with known fault fingerprints for similarity. If the match is successful, the system will directly output the specific fault type code, thereby providing more targeted guidance information for on-site maintenance personnel.

[0072] Furthermore, the cloud-based collaborative layer possesses automated hyperparameter optimization capabilities. During model training, the system utilizes optimization algorithms to automatically search for optimal learning rates, network depths, distillation temperatures, and other key parameters, reducing manual tuning intervention and improving the scientific rigor and efficiency of model generation.

[0073] Furthermore, the system integrates a blockchain-based audit trail module. All critical anomaly alarm records, model update instructions, and maintenance operation records are encrypted and stored in a distributed ledger. This ensures the immutability of the equipment's operational history, providing credible original evidence for tracing the responsibility for production accidents and for insurance claims.

[0074] Through the comprehensive application of the above technical solutions, this invention not only achieves cost reduction and efficiency improvement in the detection of abnormalities in industrial IoT devices at the technical level, but also meets the predetermined technical indicators in terms of data security, system reliability and intelligence level, and has extremely high practical application value and broad market prospects. Attached Figure Description

[0075] Figure 1 : A schematic diagram of the structure of the industrial IoT device anomaly detection system based on edge intelligence provided in this embodiment of the invention;

[0076] Figure 2 The following is a flowchart illustrating the edge intelligence-based industrial IoT device anomaly detection method provided in this embodiment of the invention.

[0077] The attached diagram is labeled as follows: 1. Physical perception layer; 2. Edge intelligence layer; 3. Cloud collaboration layer; 4. Data preprocessing module; 5. Lightweight feature extraction module; 6. Local anomaly detection module; 7. Semantic feature compression module; 8. Global model training module; 9. Knowledge distillation optimization module; 10. Long-term trend analysis module; 11. Hardware resource monitoring unit; 12. Multi-source data fusion engine; 13. Anomaly pattern matching unit; 14. Short-term memory buffer; 15. Digital twin mirror library; 16. Audit trail module. Detailed Implementation

[0078] The present invention will be further described below with reference to the accompanying drawings and specific embodiments. The illustrative embodiments and descriptions herein are used to explain the present invention, but are not intended to limit the present invention.

[0079] like Figure 1 , 2 As shown, the edge intelligence-based industrial IoT device anomaly detection system provided by this invention adopts a vertically layered and horizontally collaborative design concept in its overall architecture. This aims to resolve the contradiction between real-time performance and accuracy in the industrial big data environment through the rational distribution of computing power. The system's physical architecture is constructed from the bottom to the top as a physical sensing layer 1, an edge intelligence layer 2, and a cloud collaboration layer 3. The physical sensing layer 1, as the data source of the entire system, uses multiple sensor terminals deployed in industrial production lines, key rotating machinery, and precision machining units to achieve all-weather, high-frequency real-time acquisition of industrial equipment operating status parameters. These operating status parameters cover vibration signals reflecting mechanical wear, acoustic emission signals reflecting structural damage, current signals reflecting electrical characteristics, and temperature signals reflecting thermal equilibrium. The physical sensing layer 1 possesses Time-Sensitive Network (TSN) characteristics, ensuring nanosecond-level consistency in timestamp accuracy for data collected by sensors distributed across different geographical locations and access points through a global clock synchronization protocol (such as IEEE 802.1AS). This provides a highly reliable raw data foundation for the subsequent spatiotemporal correlation analysis of multi-source signals by the edge intelligence layer 2. Meanwhile, the physical sensing layer 1 supports automatic identification and conversion of various communication protocols, including OPC-UA, Modbus-TCP, MQTT, and various industrial real-time Ethernet protocols. It uses preset protocol parsing templates to uniformly convert heterogeneous protocol data into a standard streaming format that meets the processing requirements of the edge side.

[0080] Edge intelligence layer 2 is deployed at edge computing nodes close to the industrial site, such as industrial gateways, edge servers, or embedded computing modules. This layer is the core for achieving real-time response to anomaly detection. It integrates a complete lightweight processing and decision-making system, specifically including a data preprocessing module 4, a lightweight feature extraction module 5, a local anomaly judgment module 6, and a semantic feature compression module 7. The data preprocessing module 4 is configured to denoise and normalize the raw high-frequency time-series signal uploaded from the physical sensing layer 1. In actual industrial environments, sensor signals are often mixed with a large amount of electromagnetic interference and random impulse noise. The data preprocessing module 4 first uses an adaptive median filtering algorithm for processing. This algorithm dynamically determines the noise intensity estimate in the current environment by calculating the statistical characteristics of the data within the current sliding window, such as the mean, variance, and kurtosis coefficient. Based on this estimate, the algorithm automatically adjusts the window width of the median filter. When the noise intensity is high, the window width is increased to enhance the smoothing effect; at signal abrupt changes, the window is reduced to retain the steep edge features reflecting the transient impact of the equipment. Subsequently, data preprocessing module 4 uses a sliding window technique to divide the continuous time-series data stream into data frames with a predetermined overlap rate (e.g., 25% or 50%). For each frame of data, a normalization operation is performed to eliminate the influence of different units on subsequent model inference. The specific calculation formula is as follows:

[0081]

[0082] In the above formula, This represents a normalized data sequence, whose numerical range is typically mapped to a standard normal distribution or a specific interval. Represents the first in the original sampled data sequence One sampling point; This represents the arithmetic mean of all sampled points within the data frame; This represents the standard deviation of the sampled points within the data frame. Through this step, the original signal is transformed into a statistically consistent normalized input frame.

[0083] The lightweight feature extraction module 5 is the core computing unit of the edge intelligent layer 2, built on a depthwise separable convolution architecture. Unlike traditional standard convolution, this module decomposes the convolution process into two independent steps: depthwise convolution and pointwise convolution. Specifically, the depthwise convolution layer independently performs convolution kernel operations on each channel of the input, extracting local features in the spatial or temporal dimensions; the pointwise convolution layer uses a 1×1 convolution kernel to fuse the output of the depthwise convolution across channels. This architecture maintains the ability to capture complex nonlinear features in the operating state of industrial equipment while reducing the number of computational parameters and computational complexity to one-eighth or even lower than standard convolution. To further enhance the sensitivity to key fault information, the lightweight feature extraction module 5 integrates a spatial attention mechanism. This mechanism enhances the features of key fault representation areas by calculating the importance weights of each pixel in the feature map. Its weight coefficients... The calculation follows the following logic:

[0084]

[0085] In this formula, This represents the Sigmoid activation function, used to map weights to the range of 0 to 1; This indicates a preset 7×7 or 3×3 convolution operation used to capture spatial correlations after pooling; Indicates the feature map Perform global average pooling to extract background features; Indicates the feature map Global max pooling is performed to extract salient features. The two are then concatenated via channels and convolved to generate a weight matrix. Multiplying with the original feature map reshapes the effective information. Furthermore, for multi-dimensional sensor signals, this module employs a spatiotemporal decoupling strategy. First, it extracts independent temporal features from each channel along the time axis, then performs logical fusion along the channel dimension, ensuring efficient operation on low-power embedded processors.

[0086] The local anomaly detection module 6 integrates a reconstruction error evaluation unit based on an autoencoder structure. This unit maps the high-dimensional feature vector output by the lightweight feature extraction module 5 to an extremely low-dimensional latent space, and then attempts to reconstruct it back to the original feature dimension through a decoder. Since the autoencoder has only been exposed to data from normal operating conditions during training, its reconstruction accuracy for normal operating conditions is extremely high, but it will produce significant reconstruction bias for feature vectors containing abnormal components. The local anomaly detection module 6 measures the degree of anomaly of the device by calculating the Euclidean distance between the original features and the reconstructed features; this anomaly score... The calculation formula is as follows:

[0087]

[0088] in, This represents the original feature vector output by the lightweight feature extraction module, which represents the observation value of the current device operating status; This represents the feature vector reconstructed by the reconstruction error evaluation unit, which represents the "normal standard value" as perceived by the model under this operating condition. When anomalies occur... When the preset local alarm threshold is exceeded, the edge intelligence layer 2 immediately triggers a local alarm signal and executes safety protection logic. To improve the robustness of the judgment, the local anomaly judgment module 6 also includes a short-term memory buffer 14 to store the anomaly score sequence of the most recent 32 or 64 periods. By analyzing the evolution trend of the score sequence, if the score shows a monotonically increasing trend and the slope exceeds the preset rate of change threshold, the system will issue a preventive warning in advance even if the current instantaneous score does not reach the threshold. At the same time, the module introduces a dynamic environmental compensation factor during the judgment process, and corrects the reconstruction error threshold online based on the real-time collected ambient temperature, humidity and equipment load rate to eliminate false alarms caused by fluctuations in normal operating conditions.

[0089] The semantic feature compression module 7 acts as a data scheduler in the system. When the local anomaly detection module 6 provides the anomaly score... This module activates when the data falls within a preset uncertainty range (i.e., between the normal threshold and the diagnostic abnormality threshold). The semantic feature compression module 7 employs a latent space mapping technique based on a variational autoencoder (VAE) to compress high-dimensional feature vectors into mean and variance vectors that satisfy a specific Gaussian distribution. This semantic-level compression is not simply downsampling; rather, it combines principal component analysis with importance sampling to ensure sufficient discriminative information to support deep inference in the cloud with extremely low bandwidth consumption (e.g., less than 1% of the original data). During data upload, this module also dynamically adjusts the compression ratio based on the current network link quality feedback from the hardware resource monitoring unit 11, achieving a flexible balance between communication overhead and diagnostic accuracy.

[0090] The cloud-based collaboration layer 3 is deployed on a remote high-performance server or cloud platform. Its main tasks are to perform global complex inference, model evolution, and long-term asset management. The global model training module 8 is responsible for receiving compressed semantic features and corresponding anomaly labels uploaded from multiple edge intelligent nodes across the network. Leveraging the near-unlimited computing power of the cloud, this module employs a Residual Network (ResNet) with a deep network structure or a Transformer network incorporating multi-head attention to perform high-precision modeling of the global device state. During training, this module introduces a hard sample mining mechanism, automatically increasing the weight of samples with large prediction errors through the loss function, forcing the model to learn rare fault conditions.

[0091] The knowledge distillation optimization module 9 is a key link in achieving cloud-edge co-evolution. This module uses a high-precision deep network trained in the cloud as the teacher model and a lightweight model on the edge as the student model. By minimizing the divergence in their output probability distributions, it guides the edge model to acquire the complex feature representation capabilities of the cloud model. The loss function for the distillation process... The definition is as follows:

[0092]

[0093] In the above formula, This represents the cross-entropy loss between the student model output and the true label, ensuring basic classification accuracy. Represents the probability distribution of the teacher model output. With the student model output probability distribution Kullback-Leibler Divergence; This represents the distillation temperature parameter, used to smooth the probability distribution to reveal structural information between categories; This represents a weighting coefficient that balances the learning ratio of hard labels and soft knowledge. For real labels, The model parameters, after distillation, undergo quantization and compression, converting from floating-point to fixed-point, and are pushed to the edge intelligent layer 2 via an incremental update strategy, enabling seamless online upgrades of the algorithm.

[0094] The cloud-based collaboration layer 3 also includes a long-term trend analysis module 10, a multi-source data fusion engine 12, a digital twin mirror library 15, and an audit trail module 16. The long-term trend analysis module 10 uses a Long Short-Term Memory (LSTM) network to perform time-series modeling of historical anomaly data and calculate the remaining useful life (RUL) of the equipment. The multi-source data fusion engine 12 uses cross-domain feature mapping technology to project heterogeneous data from different factories and different models of equipment into a unified space, improving detection accuracy in small sample situations. The digital twin mirror library 15 maintains a virtual model of the physical equipment in real time based on uploaded features and runs high-fidelity physical simulations to verify the authenticity of anomalies. The audit trail module 16, based on blockchain technology, encrypts and stores all alarm records, model updates, and maintenance operations in a distributed ledger, ensuring that the data is tamper-proof and traceable.

[0095] This invention also provides an anomaly detection method for industrial IoT devices based on edge intelligence. Its execution logic is as follows: First, data acquisition and preprocessing are performed, acquiring time-series data through sensors and performing denoising and normalization at the edge. Then, a lightweight inference stage is entered at the edge, using depthwise separable convolution to extract features and calculate the reconstruction error score. Next, a multi-level decision-response logic is executed: if the score is extremely high, a local emergency shutdown is immediately triggered and a fault snapshot is uploaded; if the score is in an ambiguous range, semantic compression is initiated and uploaded to the cloud for review; if the score is normal, only a heartbeat signal is sent. Finally, the cloud collaboration layer performs global optimization based on the review results and achieves dynamic evolution of the edge-side model through knowledge distillation and incremental update strategies.

[0096] To further demonstrate the technical superiority of this invention, a specific application example is provided in this embodiment. In a large wind power plant, for the abnormal detection of the main bearing of the wind turbine, the system and method of this invention are communicatively connected to a management platform and a sensor network platform. The sensor network platform serves as the data transmission hub between the system of this invention and the management platform, responsible for high-speed, low-latency data transmission between the system of this invention and the management platform, including control, input, management, and route entry, as well as displaying task status, results, data display, and retrieval. The system of this invention (example) is compared with a traditional full-data cloud detection scheme (Comparative Example 1) and a simple edge-side threshold detection scheme (Comparative Example 2). The experimental environment uses a vibration sensor with a sampling frequency of 20kHz, and the edge-side computing node is an embedded AI module with 4TOPS computing power.

[0097] In this embodiment, the data preprocessing module 4 of the edge intelligent layer 2 divides 2048 sampling points into a data frame with an overlap rate of 50%. The lightweight feature extraction module 5 adopts a three-layer depthwise separable convolutional structure with 32, 64, and 128 channels respectively. The autoencoder latent space dimension of the local anomaly detection module 6 is set to 16. When the bearing experiences early spalling failure, a weak impact component appears in the vibration signal, and the local anomaly score rapidly rises from the normal 0.02 to 0.15, triggering the semantic feature compression module 7. The cloud collaboration layer 3 verifies the feature through a high-precision model and determines it to be inner ring pitting, and incorporates this feature into the global training set.

[0098] The table below shows a quantitative comparison of the three solutions in terms of detection performance, real-time performance, and resource consumption over a continuous 720-hour test period:

[0099] Table 1: Comparison of Anomaly Detection Performance of Industrial IoT Devices

[0100] Evaluation indicators Comparative Example 1 (Full Cloud Migration) Comparative Example 2 (Simple Edge Threshold) Embodiments of the present invention Anomaly detection accuracy 94.20% 81.50% 98.70% False Alarm Rate (FPR) 5.80% 12.40% 1.20% False negative rate (FNR) 4.10% 15.60% 0.80% Average response latency (Latency) 850ms 15ms 22ms Uplink bandwidth usage (Avg. Bandwidth) 12.5 Mbps 0.05 Mbps 0.18 Mbps Model update cycle 30 days (manual) No automatic updates 7 days (automatic incremental update) System stability (MTBF) 1200h 2500h 4800h

[0101] As can be seen from the data in the table above, the embodiments of the present invention maintain an extremely low response latency (22ms) close to local processing while achieving a detection accuracy of 98.7%, significantly higher than Comparative Example 1 and Comparative Example 2. Regarding bandwidth usage, the present invention reduces uplink bandwidth from 12.5 Mbps to 0.18 Mbps through semantic feature compression and a multi-level decision-making mechanism, a reduction of over 98%, greatly alleviating network pressure in industrial settings. Simultaneously, thanks to the cloud-edge collaborative knowledge distillation mechanism, the system's false alarm rate and false negative rate are both controlled at extremely low levels, verifying the superior performance of the present invention in handling complex industrial anomalies.

[0102] Furthermore, this system adopts a containerized deployment approach in its software architecture, encapsulating modules such as feature extraction, judgment, and communication within independent lightweight containers, thus decoupling the algorithm components from the underlying hardware platform. Edge Intelligence Layer 2 also possesses self-diagnostic capabilities, periodically inspecting the integrity of the sensor link, the accuracy of the data acquisition hardware, and the operational status of the edge computing core. Upon detecting sensor drift or computing power anomalies, the system immediately generates a self-check report. In precision machining scenarios, Edge Intelligence Layer 2 identifies tool wear by real-time monitoring of the coupling relationship between spindle current and cutting force, utilizing the local anomaly judgment module 6. When an abnormal spike is detected and its duration exceeds a preset pulse cycle, a deceleration command is directly sent to the machine tool controller via the edge-side real-time control interface, achieving closed-loop control within a predetermined response range.

[0103] In summary, this invention constructs an industrial IoT anomaly detection system with deep perception, real-time decision-making, and self-evolution capabilities by organically combining a physical perception layer, an edge intelligence layer, and a cloud collaboration layer. Utilizing core technologies such as depthwise separable convolution, autoencoder reconstruction error, semantic feature compression, and knowledge distillation, it significantly reduces communication bandwidth requirements and response latency while ensuring high reliability and accuracy of detection results. This provides a highly valuable engineering solution for intelligent predictive maintenance of industrial equipment. The modules of this invention are logically rigorous and work collaboratively, forming a closed loop from raw signal acquisition to global knowledge aggregation, effectively supporting the stringent requirements of modern industry for production safety and efficiency.

[0104] The technical solutions of the present invention are not limited to the specific embodiments described above. Any technical modifications made in accordance with the technical solutions of the present invention fall within the protection scope of the present invention.

Claims

1. An industrial IoT device anomaly detection system based on edge intelligence, characterized in that, The system, from bottom to top, includes: The physical sensing layer (1) is used to collect the operating status parameters of industrial equipment in real time through multiple sensor terminals deployed in the industrial site. The operating status parameters include vibration signals, acoustic emission signals, current signals and temperature signals. The physical sensing layer (1) has time-sensitive network characteristics and ensures that the data collected by sensors distributed in different geographical locations have consistent timestamp accuracy through a global clock synchronization protocol. The physical sensing layer (1) also supports the automatic identification and conversion of multiple industrial communication protocols. The edge intelligence layer (2) is deployed at edge computing nodes close to the industrial site. The edge intelligence layer (2) includes a data preprocessing module (4), a lightweight feature extraction module (5), a local anomaly determination module (6), and a semantic feature compression module (7). The data preprocessing module (4) performs noise reduction and normalization on the original signal. The lightweight feature extraction module (5) extracts multi-dimensional spatial features. The local anomaly determination module (6) calculates the anomaly score and executes a local alarm through the reconstruction error evaluation unit. The semantic feature compression module (7) extracts key semantic components when the anomaly score is in the uncertainty range. The cloud collaboration layer (3) is deployed on a remote server. The cloud collaboration layer (3) includes a global model training module (8), a knowledge distillation optimization module (9), and a long-term trend analysis module (10). The global model training module (8) constructs the global optimal model, the knowledge distillation optimization module (9) guides the edge intelligence layer (2) to learn the cloud feature expression capability, and the long-term trend analysis module (10) predicts the degradation trend of device performance.

2. The industrial IoT device anomaly detection system based on edge intelligence according to claim 1, characterized in that, The data preprocessing module (4) of the edge intelligent layer (2) uses an adaptive median filtering algorithm to filter out random pulse interference in the original signal, determines the noise intensity estimate by calculating the statistical characteristics of the data within the sliding window, and dynamically adjusts the window width of the median filter; the data preprocessing module (4) uses the sliding window technique to divide the time-series data stream into data frames with a predetermined overlap rate, and performs a normalization operation on each frame of data, the calculation formula of which is as follows: In the above formula: This represents the first element in the normalized data sequence. One element; Represents the first in the original sampled data sequence One sampling point; This represents the arithmetic mean of all sampled points within the data frame; This represents the standard deviation of the sampled points within the data frame.

3. The industrial IoT device anomaly detection system based on edge intelligence according to claim 1, characterized in that, The lightweight feature extraction module (5) is built on a depthwise separable convolutional architecture. It reduces the number of computational parameters by decomposing the standard convolution into depthwise convolution and pointwise convolution. When processing multidimensional sensor signals, it adopts a spatiotemporal decoupling strategy, first extracting independent temporal features of each channel on the time axis, and then performing feature fusion on the channel dimension. The lightweight feature extraction module (5) integrates a spatial attention mechanism, which enhances features by calculating the importance weights of each pixel in the feature map. The calculation method is as follows: In the above formula: This represents the generated spatial attention weight matrix; This represents the activation function, used to map weights to a predetermined interval; This indicates a predefined convolution operation used to capture spatial correlations after pooling; Indicates the feature map The result after global average pooling; Indicates the feature map The result after performing global max pooling.

4. The industrial IoT device anomaly detection system based on edge intelligence according to claim 1, characterized in that, The local anomaly determination module (6) integrates a reconstruction error evaluation unit based on an autoencoder structure. The reconstruction error evaluation unit maps feature vectors to a low-dimensional latent space and performs reconstruction. The local anomaly determination module (6) measures the degree of anomaly of the device by calculating the Euclidean distance between the original features and the reconstructed features. The anomaly score is... The calculation formula is as follows: In the above formula: This represents the calculated equipment anomaly score; This represents the original feature vector output by the lightweight feature extraction module (5); This represents the feature vector after reconstruction by the reconstruction error evaluation unit; The local anomaly determination module (6) also includes a short-term memory buffer (14) for storing the anomaly score sequence of the most recent predetermined number of periods, and identifying performance degradation type faults by analyzing the evolution trend of the score sequence; The local anomaly determination module (6) introduces a dynamic environmental compensation factor during the determination process, and corrects the determination threshold of the reconstruction error online based on the environmental parameters collected in real time.

5. The industrial IoT device anomaly detection system based on edge intelligence according to claim 1, characterized in that, The semantic feature compression module (7) applies a latent space mapping technique based on variational autoencoder to map high-dimensional feature vectors into low-dimensional probability distribution parameters that satisfy a specific distribution, including mean vector and variance vector; the edge intelligent layer (2) also includes a hardware resource monitoring unit (11), which monitors the computing occupancy rate, available memory space and power consumption status of edge computing nodes in real time, and dynamically adjusts the computing depth of the lightweight feature extraction module (5) when the hardware resource occupancy exceeds the preset load threshold; when uploading data, the semantic feature compression module (7) dynamically adjusts the compression ratio according to the network link quality fed back by the hardware resource monitoring unit (11), and achieves an elastic balance between communication overhead and diagnostic accuracy while maintaining semantic integrity.

6. The industrial IoT device anomaly detection system based on edge intelligence according to claim 1, characterized in that, The global model training module (8) of the cloud collaboration layer (3) adopts a residual network or attention mechanism network with a deep network structure, and uses a loss function based on hard sample mining during the training process. It improves the ability to capture long-tailed distribution anomalies by automatically increasing the weight of samples with large prediction errors in the loss function. The knowledge distillation optimization module (9) uses the deep network generated by the global model training module (8) as the teacher model and the lightweight feature extraction module (5) of the edge intelligence layer (2) as the student model. The loss function of its distillation process is... The definition is as follows: In the above formula: This represents the total loss value in the knowledge distillation process; This represents the cross-entropy loss between the student model output and the true label; Represents the probability distribution of the teacher model output. With the student model output probability distribution The divergence between them; This indicates the preset distillation temperature parameter; This represents the preset balance weight coefficient; Indicates the true label, This represents the predicted output of the student model; The knowledge distillation optimization module (9) performs quantization compression on the student model before distributing the parameters, and uses an incremental update strategy to calculate the difference matrix between the parameters of the new and old models before distributing them.

7. The industrial IoT device anomaly detection system based on edge intelligence according to claim 1, characterized in that, The cloud collaboration layer (3) also includes a multi-source data fusion engine (12), a digital twin mirror library (15), and an audit trail module (16). The multi-source data fusion engine (12) projects feature vectors from different sources to a unified metric space through cross-domain feature mapping technology and uses transfer learning technology to improve the detection accuracy in small sample cases. The digital twin mirror library (15) maintains a virtual digital model of physical equipment based on feature data uploaded from the edge side and verifies suspected anomalies by running physical simulation algorithms. The audit trail module (16) encrypts and stores abnormal alarm records, model update instructions, and operation and maintenance records in a distributed ledger based on blockchain technology. The edge intelligence layer (2) also includes an abnormal pattern matching unit (13), which compares the current feature vector with the predefined typical fault feature fingerprint and outputs the fault type code.

8. A method for anomaly detection in industrial IoT devices based on edge intelligence, characterized in that, The method, when applied to the system according to any one of claims 1-7, includes the following steps: Step 1, Data Acquisition and Preprocessing: Real-time time-series data of equipment operating status is acquired through sensors distributed across the industrial site, and adaptive denoising and normalization processing is performed at the edge to form standardized input data frames; Step 2, Lightweight Inference on the Edge Side: The standardized input data frame is input into the lightweight feature extraction module (5) in the edge computing node, features are extracted using depthwise separable convolution, and the reconstruction error anomaly score is calculated through the local anomaly judgment module (6); Step 3, multi-level decision response: If the abnormal score exceeds the first preset threshold, the edge side directly determines it as a serious fault, immediately triggers a local emergency shutdown signal, and uploads a fault snapshot to the cloud for evidence storage; If the abnormal score is between the first preset threshold and the second preset threshold, it is judged as a suspected abnormality, and the semantic feature compression module (7) is started to upload the key feature vector to the cloud collaboration layer (3) for in-depth review; If the abnormal score is lower than the second preset threshold, it is determined to be operating normally, and only heartbeat signals and status summaries are sent to the cloud periodically. Step 4, cloud-based deep verification and global optimization: After receiving the suspected abnormal compressed features, the cloud collaboration layer (3) uses a high-performance global model to make a secondary judgment and feeds the judgment result back to the edge side, while updating the local knowledge base; Step 5, Dynamic Model Evolution: The cloud collaboration layer (3) periodically uses the accumulated global data to retrain the model and generates optimized lightweight model parameters through knowledge distillation technology. These parameters are then pushed to the edge intelligence layer (2) via the downlink to achieve online updates of the edge detection algorithm.

9. The method for anomaly detection of industrial IoT devices based on edge intelligence according to claim 8, characterized in that: The edge intelligence layer (2) adopts a dual-buffer asynchronous processing architecture. The first buffer is used to receive high-frequency sampled data, and the second buffer is used to store standardized data frames to be processed, so as to ensure the parallel operation of data acquisition and intelligent analysis. The method also includes an online annotation mechanism based on feedback incentives. When the cloud collaboration layer (3) determines that the suspected anomaly reported by the edge side is a false alarm, the determination result is fed back to the edge side as a negative sample. The edge intelligent layer (2) uses the feedback sample to locally adjust the decision boundary of its reconstruction error evaluation unit. The determination process in step three also considers the operating context of the equipment, including the current speed, load rate and process stage of the equipment. By querying the preset operating condition-threshold mapping table, appropriate determination parameters are automatically assigned to different operating conditions.

Images