An AI recognition-based internet of things device anomaly detection system

Abstract

This invention discloses an anomaly detection system for IoT devices based on AI recognition, comprising: a data acquisition and sequence construction module for constructing an input sequence; a variable sampling downsampling module for feeding the input sequence into the downsampling path of an improved SCINet, introducing Gumbel-Softmax to compute a time sampling mask; a dynamic temporal interactive attention module for outputting intermediate feature maps; an upsampling reconstruction and saliency generation module for generating an anomaly saliency map; an anomaly saliency feature sparsity module for outputting a reconstructed sequence; a decision feature generation module for obtaining decision features; a Deep SVDD training and detection module for calculating anomaly scores and outputting category labels; and a decision fusion and event recording module for outputting the anomaly time location and device identifier. This invention achieves high-precision anomaly detection on multi-channel time-series data of IoT devices.

Description

Technical Field

[0001] This invention relates to the fields of artificial intelligence, the Internet of Things, and anomaly detection technology, and in particular to an anomaly detection system for Internet of Things devices based on AI recognition. Background Technology

[0002] With the rapid development of the Internet of Things (IoT) systems, a large number of industrial equipment, smart terminals, and sensing devices are deployed in key scenarios such as manufacturing, energy management, and smart cities. These devices collect multi-dimensional physical quantities such as temperature, pressure, current, voltage, vibration, rotational speed, and acoustics through multi-channel sensors, enabling real-time perception and data-driven analysis of equipment operating status. As the dimensions and volume of data continue to grow, effectively identifying potential anomalies and providing early warnings of equipment failures from multi-channel time-series data has become one of the core issues in ensuring system security and stability.

[0003] In existing technologies, traditional anomaly detection methods mostly rely on rule-based or statistical modeling for threshold judgment, which cannot adapt to the complex and variable states of devices, strong nonlinearity, and imbalanced samples. In recent years, deep learning-based anomaly detection methods have gradually emerged, with neural structures such as convolutional neural networks (CNNs), recurrent neural networks (RNNs), variational autoencoders (VAEs), generative adversarial networks (GANs), and self-attention mechanisms being widely used to model latent features in time series. However, these methods generally suffer from insufficient information redundancy compression capabilities, inaccurate identification at critical moments, difficulty in extracting anomalous signal features, and limited context-dependent modeling capabilities. Moreover, most model structures are fixed, making it difficult to flexibly adapt to the diverse operating conditions of IoT devices.

[0004] While SCINet, a novel architecture for temporal modeling in recent years, possesses multi-scale processing capabilities, there is still room for improvement in areas such as temporal sampling strategies, key feature modeling, anomaly saliency extraction, and final discrimination mechanisms. For example, traditional downsampling methods lack a dynamic selection mechanism for anomaly-sensitive regions, leading to the dilution of anomaly features; the interaction layer does not adequately model the temporal dependencies between features, limiting the model's ability to express complex relationships; and anomaly detection relies solely on reconstruction errors, failing to jointly utilize the distribution information of the decision feature space, thus affecting detection accuracy and stability.

[0005] Therefore, how to provide an anomaly detection system for IoT devices based on AI recognition is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0006] One objective of this invention is to propose an anomaly detection system for IoT devices based on AI recognition. This invention integrates an improved SCINet structure, a Gumbel-Softmax sampling mechanism, a dynamic temporal interactive attention module, and a Deep SVDD anomaly judgment model to construct an end-to-end intelligent detection method for multi-channel time series. This invention details the complete process from adaptive sampling at key time steps, deep temporal feature modeling, anomaly saliency sparse suppression, to multi-dimensional feature fusion and discrimination, possessing advantages such as high anomaly detection accuracy, strong key feature extraction capability, good discrimination robustness, and strong adaptability.

[0007] An AI-based IoT device anomaly detection system according to an embodiment of the present invention includes: The data acquisition and sequence construction module is used to determine the multi-channel time series data of the target IoT device and construct the input sequence. The variable sampling downsampling module is used to feed the input sequence into the downsampling path of the improved SCINet, introduce Gumbel-Softmax to calculate a continuously differentiable time sampling mask, and perform variable step-size downsampling based on the time mask sequence to obtain the time-compressed feature sequence. The dynamic temporal interactive attention module is used to receive temporally compressed feature sequences. Within the dynamic temporal interactive attention layer, features interact through residual temporal convolutional units, attention gating units, and feature fusion units to output intermediate feature maps. The upsampling reconstruction and saliency generation module is used to perform alignment, deconvolution operations and reconstruction bias calculation on the intermediate feature maps to generate anomaly saliency maps; The anomaly saliency feature sparse module is used to perform deconvolution reconstruction on intermediate feature maps based on the anomaly saliency map as a sparsity control mask, and output the reconstructed sequence. The decision feature generation module is used to align the input sequence and the reconstructed sequence by time step to calculate the reconstruction error sequence and obtain the decision features; The Deep SVDD training and detection module is used to construct a set of normal samples based on the judgment features during the training phase, and to calculate the anomaly score and output the category label during the detection phase. The decision fusion and event logging module is used to align the anomaly scores with the reconstruction error sequence, output the anomaly time location and device identifier, and write them to the event table.

[0008] Optionally, modules can be integrated using the following methods: Step 1: Acquire multi-channel time series data of the target IoT device and construct an input sequence of fixed length; Step 2: Feed the input sequence into the downsampling path of the improved SCINet, use the probability prediction subnetwork to output the sampling probability distribution of the corresponding time step, introduce Gumbel-Softmax to generate a continuously differentiable time sampling mask, and perform variable step-size downsampling based on the time sampling mask to obtain the time-compressed feature sequence. Step 3: Input the time-compressed feature sequence into the SCINet dynamic temporal interactive attention layer, perform residual connections and attention gating, and obtain intermediate feature maps; Step 4: While feeding the intermediate feature map into the SCINet upsampling path for deconvolution reconstruction, an anomaly saliency map is generated based on the deviation between the intermediate feature map and the reconstruction. The anomaly saliency feature sparsity mechanism is used to sparsify the intermediate feature map element by element to obtain the sparsified feature map, and deconvolution reconstruction is completed to obtain the reconstructed sequence. Step 5: Based on the reconstruction error sequence calculated from the input sequence and the reconstruction sequence, extract the intermediate layer feature embedding vector of the improved SCINet as the judgment feature; Step 6: During the training phase of Deep SVDD, the judgment features are input into Deep SVDD to establish the feature boundaries of normal samples. During the detection phase, the judgment features to be tested are input into Deep SVDD to generate the corresponding anomaly scores and category labels. Step 7: Combine the anomaly score with the reconstructed error sequence according to the preset judgment rules, output the anomaly time location and device identifier, and record them in the event table.

[0009] Optionally, step one includes the following specific steps: Determine the set of acquisition channels and sampling parameters for the target IoT device, acquire multi-channel time series data and generate timestamps for each sample; Each time step corresponds to a sample, which consists of measurements of multi-channel time series data at the same time point, along with a corresponding timestamp.

[0010] The multi-channel time series data are multi-dimensional physical quantity data characterizing the operating status of the equipment, including temperature data, pressure data, current data, voltage data, vibration data, rotational speed data, and acoustic data.

[0011] The samples are aligned and sorted according to their timestamps to form a multi-channel sequence arranged chronologically. Set a fixed window length and a fixed step size, and use a sliding method to divide the aligned multi-channel sequence to obtain a continuous window; Create a time step index and channel index for each window and bind the device identifier. Organize each window into an input sequence according to the preset channel order and time order.

[0012] Optionally, step two includes the following specific steps: The input sequence is fed into the probability prediction subnetwork in the downsampling path of the improved SCINet, and the corresponding sampling probability vector is generated according to the time step. Set temperature parameters and inject Gumbel random perturbation at each time step. Use Gumbel-Softmax to combine the sampling probability vector with Gumbel random perturbation to calculate a continuously differentiable time sampling mask. The time sampling mask is normalized and a one-to-one correspondence is established with the time steps of the input sequence to obtain the time mask sequence; The time mask sequence is aligned with the input sequence by time and weighted step-by-step by time to obtain the weighted time series. The sampling position index is determined based on the time mask sequence, and variable step-size downsampling is performed to output the time-compressed feature sequence. The variable step size downsampling is as follows: The step size between adjacent sampling points is determined based on the sampling weight of each time step in the time mask sequence; the time mask sequence is normalized to a preset step size range. Traverse the input sequence in chronological order and calculate the sampling position index based on the corresponding sampling weights; Extract time-step features of the input sequence at each defined sampling location index; The extracted time-step features are arranged in index order to form a time-compressed feature sequence.

[0013] Optionally, step three includes the following specific steps: Input the time-compressed feature sequence into the dynamic temporal interaction attention layer of the improved SCINet; The dynamic temporal interactive attention layer includes a residual temporal convolutional unit, an attention gating unit, and a feature fusion unit; The residual temporal convolutional unit performs multi-scale one-dimensional dilated convolution operations on the temporally compressed feature sequence to extract temporal features at different time scales, establishes residual connections, and outputs a sequence of feature vectors. The attention gating unit receives the residual output feature sequence and performs a linear transformation on the feature vector at each time step to generate a query vector, a key vector, and a value vector. Calculate the correlation coefficient between the query vector and the key vector to obtain the association weights between time steps; normalize the association weights to obtain the attention weights; and combine the attention weights with the corresponding value vectors in a weighted manner to output the weighted features. The feature fusion unit fuses the weighted features with the original feature vector to generate an intermediate feature map.

[0014] Optionally, the step of feeding the intermediate feature map into the SCINet upsampling path for deconvolution reconstruction, while generating an anomaly saliency map based on the deviation between the intermediate feature map and the reconstruction, includes the following specific steps: The intermediate feature map is fed into the SCINet upsampling path, and the corresponding time step weight is determined based on the mask value of each time step in the time mask sequence. Generate a time index vector within the original time step range based on the sampling position index; Based on the time index vector, each feature vector of the intermediate feature map is matched with the corresponding time step position; The matched feature vectors are arranged in time index order to generate aligned feature maps; Initialize the phased reconstructed features and perform deconvolution operation on the aligned feature maps, setting the kernel size and stride parameters in the deconvolution operation; Upsampling is performed on the features at each time step of the aligned feature map to obtain the upsampled feature sequence; The stage-wise reconstructed features output from the previous stage are used as residual features; The upsampled feature sequence is superimposed element by element with the residual features of the previous layer. The superposition result is then subjected to linear transformation and normalization to obtain the staged reconstructed features. The difference between the aligned feature map and the staged reconstructed features at each time step is calculated to obtain the reconstruction deviation sequence; the reconstruction deviation sequence is normalized and the feature response intensity is calculated. The response intensity at each time step is mapped to the saliency space to generate an anomaly saliency map; filtering and dimensionality adjustment are performed on the anomaly saliency map to match the size of the intermediate feature map. Optionally, the step of using an anomaly saliency feature sparsity mechanism to perform element-wise sparsification of the intermediate feature map to obtain a sparsified feature map, and then performing deconvolution reconstruction to obtain a reconstructed sequence, includes the following specific steps: Based on the sparsity mechanism of anomaly saliency features, the anomaly saliency map is used as a sparsification control mask, and element-wise sparsification is performed on the aligned feature map to obtain the sparsity feature map. The sparsification process is as follows: normalization is performed on the anomaly saliency map to obtain a sparsified weight matrix; the sparsified weight matrix and the aligned feature map are multiplied element-wise at corresponding positions to form a weighted feature; threshold filtering and zeroing operations are performed on the low-weight elements in the weighted feature to remove non-critical feature information; the processed weighted feature is output as a sparsified feature map. Perform deconvolution and upsampling operations on the sparse feature map; then, element-wise, overlay the upsampling results of the sparse feature map with the residual features of the corresponding layer. The superimposed feature sequences are subjected to linear transformation and normalization; the processed feature sequences are rearranged in chronological order to form a reconstructed sequence.

[0015] Optionally, step five includes the following specific steps: Align the input sequence with the reconstructed sequence by time step; The difference between the input sequence and the reconstructed sequence is calculated at each time step to form a reconstruction error sequence; Normalization and time window aggregation are performed on the reconstructed error sequence to obtain the error feature sequence, which is then recorded. The activation intensity of the intermediate feature map of the dynamic temporal interaction attention layer output is calculated, and the layer with the highest information density is determined based on the activation intensity distribution and used as the target layer output. The target layer output is selected from the intermediate feature map, and channel normalization, pooling, flattening and linear transformation are performed in sequence to generate intermediate layer feature embedding vectors as the judgment features.

[0016] Optionally, step six includes the following specific steps: A training sample set is constructed based on multi-channel time series data and intermediate layer feature embedding vectors; the training sample set is then labeled to determine the normal sample set. Input the normal sample set into Deep SVDD, and calculate the channel mean and variance of each dimension of the feature based on the feature distribution of the normal sample; The channel mean is used as the feature center vector, and the variance mean is used as the scale parameter. Establish the feature boundary of normal samples with the feature center vector as the center and the scale parameter as the radius; Input the decision features into Deep SVDD in batches and calculate the distance distribution between the decision features and the feature center vector; Update the feature center vector and scale parameters based on the distance distribution until the preset number of iterations or the convergence stopping condition is reached. Fix the trained Deep SVDD parameters; During the Deep SVDD detection phase, the judgment features of the IoT device under test at the corresponding time step are received, the judgment features are input into the trained Deep SVDD model, and the distance between the judgment features and the feature center vector is calculated to obtain the anomaly score. The abnormal scores are compared with preset threshold parameters to generate category labels; Output the anomaly score and category label.

[0017] Optionally, step six includes the following specific steps: Align the anomaly scores with the reconstructed error sequence based on the time step index; The abnormal score and the reconstruction error sequence are compared with the corresponding preset thresholds to generate an abnormal score indicator vector and a reconstruction error indicator vector, respectively. The abnormal score indicator vector and the reconstruction error indicator vector are fused according to the preset judgment rule table to obtain the fused judgment vector; Connectivity segment extraction is performed on the fusion determination vector at time steps to obtain the start and end time step indices of the candidate abnormal segments; The minimum duration constraint and minimum interval constraint are applied to the candidate abnormal segments, and the abnormal segments that satisfy the constraints are retained; Calculate the maximum abnormal score and the corresponding time step within each abnormal segment, and determine the current time step as the peak time step; Generate a fusion category label for each abnormal segment based on a preset label mapping relationship; The start time step, end time step, peak time step, fusion category label, corresponding device identifier, peak anomaly score, and peak reconstruction error of the abnormal segment are organized into an event record; Assign an event number and timestamp to the event record and write it into the event table; Output the time, location, and device identifier of the anomaly.

[0018] The beneficial effects of this invention are: This invention proposes an anomaly detection system for IoT devices based on AI recognition. It achieves significant technological progress and practical results in addressing the shortcomings of existing technologies in terms of anomaly detection accuracy, key feature extraction capability, and model generalization capability.

[0019] By introducing Gumbel-Softmax and a probabilistic prediction mechanism, this invention can perform continuous and differentiable adaptive sampling of important time steps in a time series. Compared with traditional fixed window or uniform sampling strategies, it effectively preserves key information representing changes in device state, improves the quality of time series features after downsampling, and provides a solid foundation for subsequent modeling.

[0020] The dynamic temporal interactive attention layer adopted combines multi-scale residual temporal convolution with attention gating mechanism, which can fully model the complex dependencies between different scales and channels in multi-channel time series, achieve more discriminative intermediate feature extraction, and significantly enhance the sensitivity to minor anomalies and complex change patterns.

[0021] By designing an anomaly saliency map and a sparsity mechanism, this invention can further focus on key anomaly regions during the upsampling reconstruction stage, eliminate redundant and interfering features, and improve the identifiability of anomaly information. Combined with the normal sample feature boundaries constructed using Deep SVDD, it achieves highly robust anomaly detection, adapting to the diversity and uncertainty of equipment operating conditions.

[0022] By employing a fusion judgment strategy of anomaly score and reconstruction error, and by providing time-based location and classification output for anomaly events, this invention achieves high-precision and highly interpretable equipment anomaly detection, demonstrating significant practical deployment value and promising application prospects. Attached Figure Description

[0023] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings: Figure 1 This is a schematic diagram of the structure of an IoT device anomaly detection system based on AI recognition proposed in this invention; Figure 2 This is an overall flowchart of an AI-based IoT device anomaly detection method proposed in this invention; Figure 3 This is a diagram of the improved SCINet network structure of an AI-based IoT device anomaly detection system proposed in this invention. Detailed Implementation

[0024] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0025] refer to Figure 1-3 An AI-based IoT device anomaly detection system includes: The data acquisition and sequence construction module is used to determine the multi-channel time series data of the target IoT device and construct the input sequence. The variable sampling downsampling module is used to feed the input sequence into the downsampling path of the improved SCINet, introduce Gumbel-Softmax to calculate a continuously differentiable time sampling mask, and perform variable step-size downsampling based on the time mask sequence to obtain the time-compressed feature sequence. The dynamic temporal interactive attention module is used to receive temporally compressed feature sequences. Within the dynamic temporal interactive attention layer, features interact through residual temporal convolutional units, attention gating units, and feature fusion units to output intermediate feature maps. The upsampling reconstruction and saliency generation module is used to perform alignment, deconvolution operations and reconstruction bias calculation on the intermediate feature maps to generate anomaly saliency maps; The anomaly saliency feature sparse module is used to perform deconvolution reconstruction on intermediate feature maps based on the anomaly saliency map as a sparsity control mask, and output the reconstructed sequence. The decision feature generation module is used to align the input sequence and the reconstructed sequence by time step to calculate the reconstruction error sequence and obtain the decision features; The Deep SVDD training and detection module is used to construct a set of normal samples based on the judgment features during the training phase, and to calculate the anomaly score and output the category label during the detection phase. The decision fusion and event logging module is used to align the anomaly scores with the reconstruction error sequence, output the anomaly time location and device identifier, and write them to the event table.

[0026] This invention provides an AI-based anomaly detection system for IoT devices, comprising a data acquisition and sequence construction module, a variable sampling downsampling module, a dynamic temporal interaction attention module, an upsampling reconstruction and saliency generation module, an anomaly saliency feature sparsity module, a judgment feature generation module, a Deep SVDD training and detection module, and a decision fusion and event recording module. These modules work collaboratively. First, the system acquires and constructs multi-channel time-series data from IoT devices, utilizing the Gumbel-Softmax mechanism to achieve variable-step temporal feature compression. Then, an improved SCINet is used to complete dynamic temporal feature interaction and anomaly saliency map generation, combined with a sparsity mechanism to achieve high-quality feature reconstruction and anomaly region highlighting. Further, intermediate feature embedding vectors and reconstruction errors are extracted as judgment features, and Deep SVDD is used to construct normal sample boundaries, enabling anomaly detection and classification of unknown data. Finally, multi-source anomaly indicators are fused to identify and record anomaly events, demonstrating good detection accuracy and versatility.

[0027] In this embodiment, the modules are interconnected using the following method: Step 1: Acquire multi-channel time series data of the target IoT device and construct an input sequence of fixed length; Step 2: Feed the input sequence into the downsampling path of the improved SCINet, use the probability prediction subnetwork to output the sampling probability distribution of the corresponding time step, introduce Gumbel-Softmax to generate a continuously differentiable time sampling mask, and perform variable step-size downsampling based on the time sampling mask to obtain the time-compressed feature sequence. Step 3: Input the time-compressed feature sequence into the SCINet dynamic temporal interactive attention layer, perform residual connections and attention gating, and obtain intermediate feature maps; Step 4: While feeding the intermediate feature map into the SCINet upsampling path for deconvolution reconstruction, an anomaly saliency map is generated based on the deviation between the intermediate feature map and the reconstruction. The anomaly saliency feature sparsity mechanism is used to sparsify the intermediate feature map element by element to obtain the sparsified feature map, and deconvolution reconstruction is completed to obtain the reconstructed sequence. Step 5: Based on the reconstruction error sequence calculated from the input sequence and the reconstruction sequence, extract the intermediate layer feature embedding vector of the improved SCINet as the judgment feature; Step 6: During the training phase of Deep SVDD, the judgment features are input into Deep SVDD to establish the feature boundaries of normal samples. During the detection phase, the judgment features to be tested are input into Deep SVDD to generate the corresponding anomaly scores and category labels. Step 7: Combine the anomaly score with the reconstructed error sequence according to the preset judgment rules, output the anomaly time location and device identifier, and record them in the event table.

[0028] This invention proposes an AI-based method for anomaly detection in IoT devices. It achieves intelligent identification and anomaly detection of device operating status through multi-stage deep feature modeling and decision fusion. The method first acquires multi-channel time-series data of the target IoT device and constructs an input sequence. It then adaptively extracts key temporal features using the variable step-size downsampling mechanism of an improved SCINet model and the Gumbel-Softmax temporal sampling strategy. Subsequently, in a dynamic temporal interactive attention layer, multi-scale feature fusion is achieved through residual convolution and attention gating to generate intermediate feature maps with temporal dependencies. During the upsampling reconstruction process, the reconstruction bias is calculated and an anomaly saliency map is generated. An anomaly region expression is strengthened through an anomaly saliency feature sparsity mechanism, and the reconstructed sequence is output. Further, decision features are extracted by combining the reconstruction error and the intermediate layer embedding vectors. Deep SVDD is used to establish normal sample feature boundaries, enabling the determination of anomaly scores and category labels. Finally, the anomaly scores and reconstruction errors are fused to accurately output the anomaly time location and corresponding device identifier, thus achieving high-precision, interpretable, and real-time anomaly detection in IoT devices.

[0029] In this embodiment, step one includes the following specific steps: Determine the set of acquisition channels and sampling parameters for the target IoT device, acquire multi-channel time series data and generate timestamps for each sample; Each time step corresponds to a sample, which consists of measurements of multi-channel time series data at the same time point, along with a corresponding timestamp.

[0030] The multi-channel time series data are multi-dimensional physical quantity data characterizing the operating status of the equipment, including temperature data, pressure data, current data, voltage data, vibration data, rotational speed data, and acoustic data.

[0031] The samples are aligned and sorted according to their timestamps to form a multi-channel sequence arranged chronologically. Set a fixed window length and a fixed step size, and use a sliding method to divide the aligned multi-channel sequence to obtain a continuous window; Create a time step index and channel index for each window and bind the device identifier. Organize each window into an input sequence according to the preset channel order and time order.

[0032] In this embodiment, step two includes the following specific steps: The input sequence is fed into the probability prediction subnetwork in the downsampling path of the improved SCINet, and the corresponding sampling probability vector is generated according to the time step. Set temperature parameters and inject Gumbel random perturbation at each time step. Use Gumbel-Softmax to combine the sampling probability vector with Gumbel random perturbation to calculate a continuously differentiable time sampling mask. The time sampling mask generation process is as follows: inject the corresponding Gumbel random perturbation into the sampling probability vector of each time step; normalize the perturbated sampling probability vector according to the temperature parameter; perform Softmax operation on the normalized result to obtain the continuous sampling weights corresponding to the time step; arrange the continuous sampling weights of each time step in time order to form a continuously differentiable time sampling mask.

[0033] The time sampling mask is normalized and a one-to-one correspondence is established with the time steps of the input sequence to obtain the time mask sequence; The time mask sequence is aligned with the input sequence by time and weighted step-by-step by time to obtain the weighted time series. The sampling position index is determined based on the time mask sequence, and variable step-size downsampling is performed to output the time-compressed feature sequence. The variable step size downsampling is as follows: The step size between adjacent sampling points is determined based on the sampling weight of each time step in the time mask sequence; the time mask sequence is normalized to a preset step size range. Traverse the input sequence in chronological order and calculate the sampling position index based on the corresponding sampling weights; Extract time-step features of the input sequence at each defined sampling location index; The extracted time-step features are arranged in index order to form a time-compressed feature sequence.

[0034] This invention introduces a variable-step downsampling method based on the Gumbel-Softmax mechanism in time series modeling. First, a probabilistic prediction subnetwork in the improved SCINet downsampling path generates a sampling probability vector for each time step, injecting a Gumbel random perturbation. The perturbed probability vector is then normalized and subjected to Softmax operation using a temperature parameter to obtain a time sampling mask with continuous differentiability. Subsequently, the time sampling mask is normalized and aligned with each time step of the input sequence to form a time mask sequence, which is then weighted step-by-step to form a weighted time series. Finally, based on the sampling weights of each time step in the time mask sequence, the sampling position index is calculated, and a variable-step time downsampling operation is performed to extract features from key time steps, forming a compact and information-density time-compressed feature sequence, thereby effectively improving the model's ability to express key time-series information.

[0035] In this embodiment, step three includes the following specific steps: Input the time-compressed feature sequence into the dynamic temporal interaction attention layer of the improved SCINet; The dynamic temporal interactive attention layer includes a residual temporal convolutional unit, an attention gating unit, and a feature fusion unit; The residual temporal convolutional unit performs multi-scale one-dimensional dilated convolution operations on the temporally compressed feature sequence to extract temporal features at different time scales, establishes residual connections, and outputs a sequence of feature vectors. The attention gating unit receives the residual output feature sequence and performs a linear transformation on the feature vector at each time step to generate a query vector, a key vector, and a value vector. Calculate the correlation coefficient between the query vector and the key vector to obtain the association weights between time steps; normalize the association weights to obtain the attention weights; and combine the attention weights with the corresponding value vectors in a weighted manner to output the weighted features. The feature fusion unit fuses the weighted features with the original feature vector to generate an intermediate feature map.

[0036] In this embodiment, while feeding the intermediate feature map into the SCINet upsampling path for deconvolution reconstruction, an anomaly saliency map is generated based on the deviation between the intermediate feature map and the reconstruction. This includes the following specific steps: The intermediate feature map is fed into the SCINet upsampling path, and the corresponding time step weight is determined based on the mask value of each time step in the time mask sequence. Generate a time index vector within the original time step range based on the sampling position index; Based on the time index vector, each feature vector of the intermediate feature map is matched with the corresponding time step position; The matched feature vectors are arranged in time index order to generate aligned feature maps; Initialize the phased reconstructed features and perform deconvolution operation on the aligned feature maps, setting the kernel size and stride parameters in the deconvolution operation; Upsampling is performed on the features at each time step of the aligned feature map to obtain the upsampled feature sequence; The stage-wise reconstructed features output from the previous stage are used as residual features; The upsampled feature sequence is superimposed element by element with the residual features of the previous layer. The superposition result is then subjected to linear transformation and normalization to obtain the staged reconstructed features. The difference between the aligned feature map and the staged reconstructed features at each time step is calculated to obtain the reconstruction deviation sequence; the reconstruction deviation sequence is normalized and the feature response intensity is calculated. The response intensity at each time step is mapped to the saliency space to generate an anomaly saliency map; filtering and dimensionality adjustment are performed on the anomaly saliency map to match the size of the intermediate feature map. This invention proposes a method for generating anomaly saliency maps based on reconstruction bias during the upsampling reconstruction process. The method first aligns intermediate feature maps across time steps using a time mask sequence and sampling position indices, generating aligned feature maps consistent with the original time scale. Then, in the upsampling path, deconvolution is performed by setting the kernel size and stride parameters to upsample the aligned features. These features are then combined with the residual features from the previous layer and subjected to element-wise stacking and normalization to obtain staged reconstruction features. The difference between the aligned feature maps and the staged reconstruction features is further calculated to form a reconstruction bias sequence. Saliency features at each time step are extracted through normalization and response intensity calculation. Finally, the response intensity is mapped to the saliency space to generate an anomaly saliency map, which is then filtered and dimension-matched to achieve adaptive identification and localization of anomalous temporal feature regions.

[0037] In this embodiment, the step of using an abnormal salient feature sparsity mechanism to perform element-wise sparsification of the intermediate feature map to obtain a sparsified feature map, and then performing deconvolution reconstruction to obtain a reconstructed sequence, includes the following specific steps: Based on the sparsity mechanism of anomaly saliency features, the anomaly saliency map is used as a sparsification control mask, and element-wise sparsification is performed on the aligned feature map to obtain the sparsity feature map. The sparsification process is as follows: normalization is performed on the anomaly saliency map to obtain a sparsified weight matrix; the sparsified weight matrix and the aligned feature map are multiplied element-wise at corresponding positions to form a weighted feature; threshold filtering and zeroing operations are performed on the low-weight elements in the weighted feature to remove non-critical feature information; the processed weighted feature is output as a sparsified feature map. Perform deconvolution and upsampling operations on the sparse feature map; then, element-wise, overlay the upsampling results of the sparse feature map with the residual features of the corresponding layer. The superimposed feature sequences are subjected to linear transformation and normalization; the processed feature sequences are rearranged in chronological order to form a reconstructed sequence.

[0038] This invention proposes a sparsification reconstruction method based on an anomaly saliency feature sparsity mechanism. By introducing an anomaly saliency map as a sparsity control mask, element-wise sparsification processing is performed on the aligned feature map. Specifically, the saliency map is normalized to obtain a sparsification weight matrix, which is then multiplied element-wise with the aligned feature map to form a weighted feature. Subsequently, low-weight elements in the weighted feature are thresholded and zeroed to remove non-critical anomaly information, outputting the sparsified feature map. Based on this sparsified feature map, deconvolution and upsampling operations are performed, and the result is element-wise superimposed with the residual features from the previous layer. After linear transformation and normalization, the final sequence is rearranged in chronological order to generate a reconstructed sequence, thereby achieving enhanced preservation and temporal reconstruction of key anomaly features.

[0039] In this embodiment, step five includes the following specific steps: Align the input sequence with the reconstructed sequence by time step; The difference between the input sequence and the reconstructed sequence is calculated at each time step to form a reconstruction error sequence; Normalization and time window aggregation are performed on the reconstructed error sequence to obtain the error feature sequence, which is then recorded. The activation intensity of the intermediate feature map of the dynamic temporal interaction attention layer output is calculated, and the layer with the highest information density is determined based on the activation intensity distribution and used as the target layer output. The target layer output is selected from the intermediate feature map, and channel normalization, pooling, flattening and linear transformation are performed in sequence to generate intermediate layer feature embedding vectors as the judgment features.

[0040] In this embodiment, step six includes the following specific steps: A training sample set is constructed based on multi-channel time series data and intermediate layer feature embedding vectors; the training sample set is then labeled to determine the normal sample set. The label selection process specifically involves: calculating the reconstruction error index, significance index, and feature change rate index for each sample in the training sample set; comparing the index with the corresponding preset threshold; filtering out samples whose index exceeds the threshold; and defining the samples that meet each threshold condition as the normal sample set.

[0041] Input the judgment features into Deep SVDD in batches, calculate the channel mean of the judgment features to initialize the feature center vector of Deep SVDD, update the maximum distance and average distance of the feature center vector to adjust the scale parameters, until the preset number of iterations or the convergence stopping condition is reached. The scaling parameters for adjusting the maximum and average distances of the updated feature center vectors are as follows: Calculate the distance distribution between the batch judgment feature and the current feature center vector, and calculate the batch mean vector based on the distance distribution; The batch mean vector and the current feature center vector are weighted and fused according to a preset learning rate to update the feature center vector; Adjust the scaling parameters based on the maximum and average distances from normal samples to the updated feature center vectors; repeat batch input, center update and scaling operations until the preset number of iterations or the convergence stopping condition is reached. Fix the trained Deep SVDD parameters; During the Deep SVDD detection phase, the judgment features of the IoT device under test at the corresponding time step are received, the judgment features are input into the trained Deep SVDD model, and the distance between the judgment features and the feature center vector is calculated to obtain the anomaly score. The abnormal scores are compared with preset threshold parameters to generate category labels; Output the anomaly score and category label.

[0042] In this embodiment, step six includes the following specific steps: Align the anomaly scores with the reconstructed error sequence based on the time step index; The abnormal score and the reconstruction error sequence are compared with the corresponding preset thresholds to generate an abnormal score indicator vector and a reconstruction error indicator vector, respectively. The comparison of the anomaly score and the reconstruction error sequence with the corresponding preset thresholds is specifically as follows: Read the anomaly score threshold and reconstruction error threshold; traverse the anomaly score sequence by time step to obtain the anomaly score value at the current time step; compare the anomaly score value with the anomaly score threshold; if the anomaly score value is greater than or equal to the anomaly score threshold, set it to 1 at the corresponding time step position of the anomaly score indicator vector, otherwise set it to 0; traverse the reconstruction error sequence by time step to obtain the reconstruction error value at the current time step; compare the reconstruction error value with the reconstruction error threshold; if the reconstruction error value is greater than or equal to the reconstruction error threshold, set it to 1 at the corresponding time step position of the reconstruction error indicator vector, otherwise set it to 0; arrange the set bits of each time step in chronological order to form the anomaly score indicator vector and the reconstruction error indicator vector respectively.

[0043] The abnormal score indicator vector and the reconstruction error indicator vector are fused according to the preset judgment rule table to obtain the fused judgment vector; The preset judgment rule table is a binary logic mapping relationship table established based on the abnormal score indication state and the reconstruction error indication state; the table defines the fusion judgment output corresponding to each combination state, specifically including: when the abnormal score indication vector is 0 at the current time step and the reconstruction error indication vector is 0, the fusion judgment output is 0. When the abnormal score indicator vector is 1 and the reconstruction error indicator vector is 0, the fusion decision output is 1; When the abnormal score indicator vector is 0 and the reconstruction error indicator vector is 1, the fusion decision output is 1. When the value of the anomaly score indicator vector is 1 and the value of the reconstruction error indicator vector is 1, the fusion decision output is 1; Traverse the above logical mapping relationship by time step and output the corresponding fusion judgment vector.

[0044] Connectivity segment extraction is performed on the fusion determination vector at time steps to obtain the start and end time step indices of the candidate abnormal segments; The minimum duration constraint and minimum interval constraint are applied to the candidate abnormal segments, and the abnormal segments that satisfy the constraints are retained; Calculate the maximum abnormal score and the corresponding time step within each abnormal segment, and determine the current time step as the peak time step; Generate a fusion category label for each abnormal segment based on a preset label mapping relationship; The preset label mapping relationship is an interval mapping rule based on the maximum abnormal score and the average reconstruction error; the peak abnormal score and average reconstruction error of each abnormal segment are read; the peak abnormal score and average reconstruction error are compared with the preset threshold interval respectively; If both the peak anomaly score and the average reconstruction error are within the first threshold range, a normal category label is generated. If the peak anomaly score or the average reconstruction error is within the second threshold range, a minor anomaly category label is generated. If both the peak anomaly score and the average reconstruction error exceed the second threshold range, a severe anomaly category label is generated; the category label is then bound to the start time step, end time step, and device identifier of the anomaly segment.

[0045] The start time step, end time step, peak time step, fusion category label, corresponding device identifier, peak anomaly score, and peak reconstruction error of the abnormal segment are organized into an event record; Assign an event number and timestamp to the event record and write it into the event table; Output the time, location, and device identifier of the anomaly.

[0046] Example 1: To verify the feasibility of this invention in practice, it was applied to the task of detecting abnormal operating status of air compressor units in the energy management system of a large industrial park. This park has multiple air compressor units of different models, which operate under high load for extended periods. Failure to detect equipment malfunctions in a timely manner would severely disrupt the entire energy supply system. Existing detection methods based on threshold warnings or single models suffer from low accuracy and high false alarm rates when facing complex environments, nonlinear operating conditions, and multi-factor interference. Therefore, there is an urgent need for an intelligent detection method with high robustness, high real-time performance, and high interpretability.

[0047] In this embodiment, two typical air compressor units (numbered CMA-03 and CMA-09 respectively) in the industrial park were selected as test objects. Operating status data was synchronously collected using multi-channel sensors, including seven types of signals: temperature, voltage, current, vibration, pressure, speed, and noise. The sampling period was set to 100ms, and the continuous acquisition period covered 10 working days of continuous equipment operation. After data cleaning, missing data filling, and timestamp alignment, a multi-channel input sequence of 57,600 data points was constructed using a sliding window mechanism with a window length of 128 and a sliding step size of 32.

[0048] The acquired multi-channel sequences are input into the AI-based IoT device anomaly detection system proposed in this invention. The system's downsampling path integrates an improved SCINet structure and introduces a Gumbel-Softmax differentiable sampling mechanism to achieve dynamic perception of key time steps. In the experiment, the temperature parameter is set to 0.8. A continuous sampling mask is generated by fusing Gumbel perturbation and Softmax, enabling variable-step downsampling of the input sequence and significantly reducing redundant temporal information. After processing by a dynamic temporal interactive attention layer, the system effectively extracts multi-scale temporal features using attention gating and residual temporal convolution. An anomaly saliency map is generated through an upsampling path and an anomaly saliency mechanism to guide subsequent sparse reconstruction.

[0049] During the model training phase, multi-dimensional index label screening (reconstruction error, significance intensity, and feature change rate) is performed on the constructed training samples to ensure the purity of the normal sample set. The Deep SVDD boundary model is trained to learn the distribution of judgment features for the normal state. During the testing phase, the actual running data is input into the system step by step. The system outputs the corresponding reconstruction error sequence and Deep SVDD anomaly score, and generates the final anomaly label according to the fusion judgment rules.

[0050] Compared with traditional methods (such as PCA-LSTM, GRU-AE, etc.), under the same dataset, the system of this invention achieves an average detection accuracy of 96.3% on CMA-03 and CMA-09, with a false alarm rate controlled at 2.1%, which is at least 8.5 percentage points higher than traditional methods. Simultaneously, the system has a second-level response capability, anomaly event localization accuracy of over 95%, and can effectively track the start time period and influencing channels of anomalies.

[0051] Table 1 below shows examples of abnormal detection results for air compressor CMA-03 during 10 consecutive days of operation monitoring, along with a comparison of the corresponding reconstruction error, significance intensity, and SVDD anomaly score.

[0052] Table 1: Comparison of CMA-03 Anomaly Detection Results and Multidimensional Indicators for Air Compressors

[0053] As shown in Table 1, the system of this invention can accurately identify multiple types of abnormal events and effectively focus on key feature regions through saliency maps, improving system response efficiency and decision transparency while maintaining detection accuracy. Overall verification demonstrates that this invention has high feasibility and practicality in monitoring the operational status of IoT devices and is suitable for large-scale intelligent operation and maintenance scenarios.

[0054] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. An anomaly detection system for IoT devices based on AI recognition, characterized in that, include: The data acquisition and sequence construction module is used to determine the multi-channel time series data of the target IoT device and construct the input sequence. The variable sampling downsampling module is used to feed the input sequence into the downsampling path of the improved SCINet, introduce Gumbel-Softmax to calculate a continuously differentiable time sampling mask, and perform variable step-size downsampling based on the time mask sequence to obtain the time-compressed feature sequence. The dynamic temporal interactive attention module is used to receive temporally compressed feature sequences. Within the dynamic temporal interactive attention layer, features interact through residual temporal convolutional units, attention gating units, and feature fusion units to output intermediate feature maps. The upsampling reconstruction and saliency generation module is used to perform alignment, deconvolution operations and reconstruction bias calculation on the intermediate feature maps to generate anomaly saliency maps; The anomaly saliency feature sparse module is used to perform deconvolution reconstruction on intermediate feature maps based on the anomaly saliency map as a sparsity control mask, and output the reconstructed sequence. The decision feature generation module is used to align the input sequence and the reconstructed sequence by time step to calculate the reconstruction error sequence and obtain the decision features; The Deep SVDD training and detection module is used to construct a set of normal samples based on the judgment features during the training phase, and to calculate the anomaly score and output the category label during the detection phase. The decision fusion and event logging module is used to align the anomaly scores with the reconstruction error sequence, output the anomaly time location and device identifier, and write them to the event table.

2. The IoT device anomaly detection system based on AI recognition according to claim 1, characterized in that, The modules are connected in the following way: Step 1: Acquire multi-channel time series data of the target IoT device and construct an input sequence of fixed length; Step 2: Feed the input sequence into the downsampling path of the improved SCINet, use the probability prediction subnetwork to output the sampling probability distribution of the corresponding time step, introduce Gumbel-Softmax to generate a continuously differentiable time sampling mask, and perform variable step-size downsampling based on the time sampling mask to obtain the time-compressed feature sequence. Step 3: Input the time-compressed feature sequence into the SCINet dynamic temporal interactive attention layer, perform residual connections and attention gating, and obtain intermediate feature maps; Step 4: While feeding the intermediate feature map into the SCINet upsampling path for deconvolution reconstruction, an anomaly saliency map is generated based on the deviation between the intermediate feature map and the reconstruction. The anomaly saliency feature sparsity mechanism is used to sparsify the intermediate feature map element by element to obtain the sparsified feature map, and deconvolution reconstruction is completed to obtain the reconstructed sequence. Step 5: Based on the reconstruction error sequence calculated from the input sequence and the reconstruction sequence, extract the intermediate layer feature embedding vector of the improved SCINet as the judgment feature; Step 6: During the training phase of Deep SVDD, the judgment features are input into Deep SVDD to establish the feature boundaries of normal samples. During the detection phase, the judgment features to be tested are input into Deep SVDD to generate the corresponding anomaly scores and category labels. Step 7: Combine the anomaly score with the reconstructed error sequence according to the preset judgment rules, output the anomaly time location and device identifier, and record them in the event table.

3. The IoT device anomaly detection system based on AI recognition according to claim 2, characterized in that, Step one includes the following specific steps: Determine the set of acquisition channels and sampling parameters for the target IoT device, acquire multi-channel time series data and generate timestamps for each sample; Each time step corresponds to a sample, which consists of measurements of multi-channel time series data at the same time point, and is accompanied by a corresponding timestamp; The multi-channel time series data are multi-dimensional physical quantity data characterizing the operating status of the equipment, including temperature data, pressure data, current data, voltage data, vibration data, rotational speed data, and acoustic data; The samples are aligned and sorted according to their timestamps to form a multi-channel sequence arranged chronologically. Set a fixed window length and a fixed step size, and use a sliding method to divide the aligned multi-channel sequence to obtain a continuous window; Create a time step index and channel index for each window and bind the device identifier. Organize each window into an input sequence according to the preset channel order and time order.

4. The IoT device anomaly detection system based on AI recognition according to claim 2, characterized in that, Step two includes the following specific steps: The input sequence is fed into the probability prediction subnetwork in the downsampling path of the improved SCINet, and the corresponding sampling probability vector is generated according to the time step. Set temperature parameters and inject Gumbel random perturbation at each time step. Use Gumbel-Softmax to combine the sampling probability vector with Gumbel random perturbation to calculate a continuously differentiable time sampling mask. The time sampling mask is normalized and a one-to-one correspondence is established with the time steps of the input sequence to obtain the time mask sequence; The time mask sequence is aligned with the input sequence by time and weighted step-by-step by time to obtain the weighted time series. The sampling position index is determined based on the time mask sequence, and variable step-size downsampling is performed to output the time-compressed feature sequence. The variable step size downsampling is as follows: The step size between adjacent sampling points is determined based on the sampling weight of each time step in the time mask sequence; the time mask sequence is normalized to a preset step size range. Traverse the input sequence in chronological order and calculate the sampling position index based on the corresponding sampling weights; Extract time-step features of the input sequence at each defined sampling location index; The extracted time-step features are arranged in index order to form a time-compressed feature sequence.

5. The IoT device anomaly detection system based on AI recognition according to claim 2, characterized in that, Step three includes the following specific steps: Input the time-compressed feature sequence into the dynamic temporal interaction attention layer of the improved SCINet; The dynamic temporal interactive attention layer includes a residual temporal convolutional unit, an attention gating unit, and a feature fusion unit; The residual temporal convolutional unit performs multi-scale one-dimensional dilated convolution operations on the temporally compressed feature sequence to extract temporal features at different time scales, establishes residual connections, and outputs a sequence of feature vectors. The attention gating unit receives the residual output feature sequence and performs a linear transformation on the feature vector at each time step to generate a query vector, a key vector, and a value vector. Calculate the correlation coefficient between the query vector and the key vector to obtain the association weights between time steps; normalize the association weights to obtain the attention weights; and combine the attention weights with the corresponding value vectors in a weighted manner to output the weighted features. The feature fusion unit fuses the weighted features with the original feature vector to generate an intermediate feature map.

6. The IoT device anomaly detection system based on AI recognition according to claim 2, characterized in that, The process of feeding the intermediate feature map into the SCINet upsampling path for deconvolution reconstruction, while simultaneously generating an anomaly saliency map based on the deviation between the intermediate feature map and the reconstruction, includes the following specific steps: The intermediate feature map is fed into the SCINet upsampling path, and the corresponding time step weight is determined based on the mask value of each time step in the time mask sequence. Generate a time index vector within the original time step range based on the sampling position index; Based on the time index vector, each feature vector of the intermediate feature map is matched with the corresponding time step position; The matched feature vectors are arranged in time index order to generate aligned feature maps; Initialize the phased reconstructed features and perform deconvolution operation on the aligned feature maps, setting the kernel size and stride parameters in the deconvolution operation; Upsampling is performed on the features at each time step of the aligned feature map to obtain the upsampled feature sequence; The stage-wise reconstructed features output from the previous stage are used as residual features; The upsampled feature sequence is superimposed element by element with the residual features of the previous layer. The superposition result is then subjected to linear transformation and normalization to obtain the staged reconstructed features. The difference between the aligned feature map and the staged reconstructed features at each time step is calculated to obtain the reconstruction deviation sequence; the reconstruction deviation sequence is normalized and the feature response intensity is calculated. The response intensity at each time step is mapped to the saliency space to generate an anomaly saliency map; filtering and dimensionality adjustment are performed on the anomaly saliency map to match the size of the intermediate feature map.

7. The IoT device anomaly detection system based on AI recognition according to claim 2, characterized in that, The step of using an anomaly salient feature sparsity mechanism to perform element-wise sparsification of the intermediate feature map to obtain a sparsified feature map, and then performing deconvolution reconstruction to obtain a reconstructed sequence, includes the following specific steps: Based on the sparsity mechanism of anomaly saliency features, the anomaly saliency map is used as a sparsification control mask, and element-wise sparsification is performed on the aligned feature map to obtain the sparsity feature map. The sparsification process is as follows: normalization is performed on the anomaly saliency map to obtain a sparsified weight matrix; the sparsified weight matrix and the aligned feature map are multiplied element-wise at the corresponding positions to form a weighted feature. Threshold filtering and zeroing operations are performed on the low-weight elements in the weighted features to remove non-critical feature information; the processed weighted features are output as sparse feature maps. Perform deconvolution and upsampling operations on the sparse feature map; then, element-wise, overlay the upsampling results of the sparse feature map with the residual features of the corresponding layer. The superimposed feature sequences are subjected to linear transformation and normalization; the processed feature sequences are rearranged in chronological order to form a reconstructed sequence.

8. The IoT device anomaly detection system based on AI recognition according to claim 2, characterized in that, Step five includes the following specific steps: Align the input sequence with the reconstructed sequence by time step; The difference between the input sequence and the reconstructed sequence is calculated at each time step to form a reconstruction error sequence; Normalization and time window aggregation are performed on the reconstructed error sequence to obtain the error feature sequence, which is then recorded. The activation intensity of the intermediate feature map of the dynamic temporal interaction attention layer output is calculated, and the layer with the highest information density is determined based on the activation intensity distribution and used as the target layer output. The target layer output is selected from the intermediate feature map, and channel normalization, pooling, flattening and linear transformation are performed in sequence to generate intermediate layer feature embedding vectors as the judgment features.

9. The IoT device anomaly detection system based on AI recognition according to claim 2, characterized in that, Step six includes the following specific steps: A training sample set is constructed based on multi-channel time series data and intermediate layer feature embedding vectors; the training sample set is then labeled to determine the normal sample set. Input the normal sample set into Deep SVDD, and calculate the channel mean and variance of each dimension of the feature based on the feature distribution of the normal sample; The channel mean is used as the feature center vector, and the variance mean is used as the scale parameter. Establish the feature boundary of normal samples with the feature center vector as the center and the scale parameter as the radius; Input the decision features into Deep SVDD in batches and calculate the distance distribution between the decision features and the feature center vector; Update the feature center vector and scale parameters based on the distance distribution until the preset number of iterations or the convergence stopping condition is reached. Fix the trained Deep SVDD parameters; During the Deep SVDD detection phase, the judgment features of the IoT device under test at the corresponding time step are received, the judgment features are input into the trained Deep SVDD model, and the distance between the judgment features and the feature center vector is calculated to obtain the anomaly score. The abnormal scores are compared with preset threshold parameters to generate category labels; Output the anomaly score and category label.

10. The IoT device anomaly detection system based on AI recognition according to claim 2, characterized in that, Step six includes the following specific steps: Align the anomaly scores with the reconstructed error sequence based on the time step index; The abnormal score and the reconstruction error sequence are compared with the corresponding preset thresholds to generate an abnormal score indicator vector and a reconstruction error indicator vector, respectively. The abnormal score indicator vector and the reconstruction error indicator vector are fused according to the preset judgment rule table to obtain the fused judgment vector; Connectivity segment extraction is performed on the fusion determination vector at time steps to obtain the start and end time step indices of the candidate abnormal segments; The minimum duration constraint and minimum interval constraint are applied to the candidate abnormal segments, and the abnormal segments that satisfy the constraints are retained; Calculate the maximum abnormal score and the corresponding time step within each abnormal segment, and determine the current time step as the peak time step; Generate a fusion category label for each abnormal segment based on a preset label mapping relationship; The start time step, end time step, peak time step, fusion category label, corresponding device identifier, peak anomaly score, and peak reconstruction error of the abnormal segment are organized into an event record; Assign an event number and timestamp to the event record and write it into the event table; Output the time, location, and device identifier of the anomaly.

Images