An Information Fusion-Driven Anomaly Detection and Localization Method for Industrial Manufacturing

Abstract

This invention discloses an information fusion-driven anomaly detection and localization method for industrial manufacturing, comprising: acquiring indicators, logs, call chain modal data, and a prior service dependency graph; preprocessing to obtain window-level multimodal samples; inputting these samples into a multimodal spatiotemporal model, generating a dynamic edge weight matrix based on the implicit representations of indicators and logs within the effective edge range defined by the prior service dependency graph, and reweighting the call chain edge features; outputting node-level anomaly scores and diagnostic feature representations through spatial dependency modeling, temporal dependency modeling, and gated cross-modal fusion; constructing root cause scores based on anomaly scores, diagnostic features, and dynamic edge weight changes to obtain a root cause candidate set; generating anomaly type recommendations or unknown type results based on a preset anomaly type set, and outputting structured diagnostic data. This invention can dynamically sense changes in the dependency strength between nodes and adaptively fuse multimodal data, providing structured diagnostic support for anomaly detection and root cause localization.

Description

Technical Field

[0001] This invention relates to the field of industrial manufacturing operation monitoring and intelligent diagnosis technology, and more specifically to an information fusion-driven anomaly detection and localization method for industrial manufacturing. Background Technology

[0002] As industrial manufacturing evolves towards digitalization, networking, and intelligence, a continuous digital support chain is gradually forming in production sites, encompassing equipment access, data acquisition, production collaboration, process orchestration, quality traceability, warehousing and logistics, energy management, and operation and maintenance scheduling. In scenarios of multi-variety, small-batch, and flexible production, the connections between production tasks, manufacturing resources, on-site conditions, and quality feedback are becoming increasingly close, placing higher demands on anomaly detection, status diagnosis, and rapid response capabilities. If critical links supporting production operations experience response delays, dependency blockages, resource competition, configuration anomalies, or data access anomalies, it can lead to untimely production data acquisition, abnormal production instruction transmission, delayed quality analysis, or unstable on-site scheduling responses, thereby affecting the continuity and reliability of the industrial manufacturing process.

[0003] In real-world industrial manufacturing scenarios, anomalies often manifest not just as fluctuations in a single metric, but simultaneously in various observational data, including operational metrics, log events, and call chains. For example, resource contention at a critical node may lead to increased response latency, call failures at dependent nodes may cause a concentrated occurrence of log events, and localized link blockages may propagate along upstream and downstream relationships, creating anomalies that cross nodes and time windows. Because the contribution of various observational data varies across different anomaly scenarios, relying solely on metrics, logs, or link data for judgment can easily result in insufficient anomaly identification, incomplete characterization of propagation relationships, or inaccurate root cause localization.

[0004] Existing anomaly monitoring methods in industrial manufacturing scenarios typically employ single-modal data for anomaly identification or use fixed topological relationships and fixed fusion strategies to analyze multimodal observation data. These methods still suffer from the following shortcomings in complex manufacturing environments: First, static dependencies are insufficient to characterize the dynamic changes in node interaction intensity and anomaly propagation relationships within different time windows; second, the importance of multimodal data such as indicators, logs, and call chains varies under different anomaly scenarios, and fixed fusion methods struggle to adapt to contextual changes in observation data; third, the connection between anomaly detection results and subsequent root cause localization is insufficient, making it difficult to form structured diagnostic results geared towards anomaly handling; fourth, under complex noise and operational fluctuations, multimodal representations lack stable constraints, easily affecting the reliability of anomaly detection and root cause localization results.

[0005] Therefore, how to dynamically perceive changes in the strength of dependencies between nodes under the constraints of prior dependencies by utilizing multimodal observation data such as indicators, logs, and call chains in industrial manufacturing scenarios, and further transform anomaly detection results into root cause candidates, anomaly type judgments, and structured diagnostic data, has become an urgent technical problem to be solved. Summary of the Invention

[0006] In view of the above problems, the present invention is proposed to provide an information fusion-driven anomaly detection and localization method for industrial manufacturing that overcomes or at least partially solves the above problems.

[0007] To achieve the above objectives, the present invention adopts the following technical solution:

[0008] S1. Obtain multimodal observation data and prior service dependency graph. The multimodal observation data includes indicator modal data, log modal data, and call chain modal data. The prior service dependency graph is used to characterize the inter-node call relationship between service nodes. S2. Preprocess the multimodal observation data to obtain window-level multimodal samples; S3. Input the window-level multimodal samples into the pre-trained multimodal spatiotemporal model to extract the indicator modal latent representation, log modal latent representation and call chain modal edge features of each service node in the current window; S4. The multimodal spatiotemporal model generates a dynamic edge weight matrix based on the effective edge range defined by the prior service dependency graph, using the indicator modal implicit representation and the log modal implicit representation, and reweights the call chain modal edge features using the dynamic edge weight matrix to obtain the reweighted call chain modal representation. S5. The multimodal spatiotemporal model uses the indicator modal implicit representation, the log modal implicit representation, and the reweighted call chain modal representation to extract the structural dependency relationships and their temporal evolution features between service nodes, dynamically weighted and fused them into a joint spatiotemporal representation, and outputs the node-level anomaly score and diagnostic feature representation of each service node based on the joint spatiotemporal representation; S6. Construct a root cause score based on the node-level anomaly score, the diagnostic feature representation, and the change in the dynamic edge weight matrix to obtain a root cause candidate set; generate anomaly type recommendation results or unknown type results based on the root cause candidate set, the diagnostic feature representation, and a preset anomaly type set, and generate structured diagnostic data based on the node-level anomaly score, the root cause candidate set, and the anomaly type recommendation results or unknown type results.

[0009] Preferably, the preprocessing includes time alignment, missing data completion, normalization, log template statistics, call chain aggregation, and sliding window construction.

[0010] Preferably, the generation of the dynamic edge weight matrix includes: for each valid edge in the prior service dependency graph, concatenating or combining the index modal implicit representation and log modal implicit representation of the service nodes at both ends of the valid edge to obtain an edge state vector; inputting the edge state vector into an edge weight generation network or a nonlinear mapping function to output the dynamic edge weight of the valid edge; wherein, no edge weight is generated for edges that do not exist in the prior service dependency graph.

[0011] Preferably, the reweighting specifically involves multiplying the dynamic edge weight of each valid edge with the edge feature vector of that edge in the call chain modal data edge by edge to obtain the reweighted call chain edge features; the reweighted features of all valid edges constitute the reweighted call chain modal representation.

[0012] Preferably, the extraction of structural dependencies between service nodes, the extraction of temporal evolution features, and the multimodal dynamic weighted fusion are achieved through an end-to-end trained multimodal spatiotemporal model; The multimodal spatiotemporal model sequentially includes a feature mapping layer, a dynamic edge weight generation layer, a call chain edge reweighting layer, a graph attention spatial dependency modeling layer, a multi-head temporal attention layer, a gated cross-modal fusion layer, a decoding and reconstruction layer, and an anomaly scoring layer. The feature mapping layer performs nonlinear mapping on window-level multimodal samples to obtain the indicator modal implicit representation, log modal implicit representation, and call chain modal edge features of each service node; the dynamic edge weight generation layer generates a dynamic edge weight matrix based on the indicator modal implicit representation and log modal implicit representation within the effective edge range of the prior service dependency graph; the call chain edge-by-edge reweighting layer uses the dynamic edge weight matrix to weight the call chain modal edge features edge by edge to obtain the reweighted call chain modal representation; and the graph attention space dependency modeling layer uses the indicator modal implicit representation and log modal implicit representation as input. The input and weighted call chain modal representation is used as the edge feature input to extract the spatial structural dependencies between service nodes; the multi-head temporal attention layer performs temporal modeling on the spatial dependency representation to extract the temporal evolution features of the service node state; the gated cross-modal fusion layer generates adaptive gating weights based on the contribution of each modality and fuses the spatial structural dependencies and temporal evolution features into a joint spatiotemporal representation; the decoding and reconstruction layer completes the multimodal data reconstruction based on the joint spatiotemporal representation; and the anomaly scoring layer outputs the node-level anomaly score and diagnostic feature representation of the service nodes based on the joint spatiotemporal representation.

[0013] Preferably, the root cause score is constructed for each service node in the following manner: obtaining the node-level anomaly score, the submodal reconstruction bias in the diagnostic feature representation, the node-level latent representation, and the dynamic edge weight change associated with the incoming edge and the dynamic edge weight change associated with the outgoing edge of the service node; after normalizing the above items, a weighted sum is performed using preset weights, or the root cause score of the node is obtained by mapping through a learned scoring network; the top K nodes are selected as the root cause candidate set according to the root cause scores from high to low.

[0014] Preferably, the change in the dynamic edge weight matrix refers to the difference between the dynamic edge weight matrix of the current window and the historical baseline edge weight matrix, the dynamic edge weight matrix of the previous time window, or the reference edge weight matrix in the prior service dependency graph.

[0015] Preferably, the preset set of anomaly types includes one or more of resource contention, dependency blocking, configuration anomaly, service instance anomaly, and data access anomaly; generating anomaly type recommendation results or unknown type results includes: calculating the confidence level corresponding to each candidate anomaly type; if there is an anomaly type with a confidence level not lower than the rejection threshold, then output the recommendation result; otherwise, output the unknown type.

[0016] Preferably, the structured diagnostic data includes at least: anomaly detection results, root cause localization results, anomaly type results, dominant modality information, and key change edge information; the anomaly detection results include a list of node-level anomaly scores, the root cause localization results include a root cause candidate set and its ranking, and the anomaly type results include anomaly type recommendation identifiers or unknown type identifiers; the dominant modality information is determined based on the contribution or deviation of each modality in the diagnostic feature representation, and the key change edge information is determined based on the dynamic edge weight change amount; the structured diagnostic data is output in the form of tables, alarm messages, or visualization panels.

[0017] Preferably, the training process of the multimodal spatiotemporal model uses a joint optimization objective for parameter updates. The joint optimization objective includes: reconstruction loss for each modality, node-level anomaly classification or regression loss, encoding / decoding consistency constraint loss, and a sparse regularization term on the graph structure.

[0018] in, This represents the node-level anomaly classification or regression loss. This represents the reconstruction loss for the metric modality, log modality, and call chain modality. This represents the encoding / decoding consistency constraint loss between the encoded and decoded representations. This represents the regularization loss for dynamic graph structures. Indicates the reconstruction loss weights. This represents the weight of the consistency constraint loss.

[0019] The beneficial effects of the above-described technical solutions provided in the embodiments of the present invention include at least the following: 1. This invention generates dynamic edge weights within the effective edge range defined by the prior service dependency graph, which can characterize the changes in the node dependency strength within the current window while preserving the existing node dependency priors; 2. This invention generates a dynamic edge weight matrix based on the implicit representation of the indicator modality and the implicit representation of the log modality, and uses the dynamic edge weight matrix to reweight the edge features of the call chain modality, thereby improving the ability of the call chain modality to express the anomaly propagation relationship. 3. This invention performs joint analysis of metrics, logs, and call chain modalities through spatial dependency modeling, temporal dependency modeling, and gated cross-modal fusion, and can adaptively fuse multimodal observation data according to the current window context; 4. This invention constructs a root cause score based on node-level anomaly scores, diagnostic feature representations, and dynamic edge weight changes. It also generates structured diagnostic data by combining anomaly type recommendation and unknown type rejection, which can provide diagnostic basis for anomaly perception, root cause localization, and operation and maintenance in industrial manufacturing scenarios. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0021] Figure 1 This is a flowchart of an information fusion-driven anomaly detection and localization method for industrial manufacturing provided in an embodiment of the present invention; Figure 2 This is a schematic diagram of the dynamic edge weight generation and call chain modal reweighting process provided in this embodiment of the invention; Figure 3 This is a schematic diagram of the multimodal spatiotemporal modeling and gated cross-modal fusion process provided in an embodiment of the present invention; Figure 4 This is a schematic diagram of the root cause scoring, anomaly type recommendation, and unknown type rejection process provided in an embodiment of the present invention. Detailed Implementation

[0022] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0023] like Figure 1 As shown in the figure, this invention discloses an information fusion-driven anomaly detection and localization method for industrial manufacturing, including: S1. Obtain multimodal observation data and prior service dependency graph. Multimodal observation data includes indicator modal data, log modal data, and call chain modal data. The prior service dependency graph is used to represent the call relationship between service nodes. S2. Preprocess the multimodal observation data to obtain window-level multimodal samples; S3. Input the window-level multimodal samples into the pre-trained multimodal spatiotemporal model to extract the indicator modal latent representation, log modal latent representation and call chain modal edge features of each service node in the current window; S4. The multimodal spatiotemporal model uses the implicit representation of the index modality and the implicit representation of the log modality to generate a dynamic edge weight matrix based on the effective edge range defined by the prior service dependency graph. The dynamic edge weight matrix is ​​then used to reweight the edge features of the call chain modality to obtain the reweighted call chain modality representation. S5, the multimodal spatiotemporal model utilizes the implicit representation of the indicator modality, the implicit representation of the log modality, and the reweighted call chain modality to extract the structural dependencies between service nodes and their temporal evolution features, dynamically weighted and fused into a joint spatiotemporal representation, and outputs the node-level anomaly score and diagnostic feature representation of each service node based on the joint spatiotemporal representation; S6. Construct root cause scores based on node-level anomaly scores, diagnostic feature representations, and changes in the dynamic edge weight matrix to obtain a root cause candidate set; generate recommended anomaly types or unknown types based on the root cause candidate set, diagnostic feature representations, and a preset anomaly type set, and generate structured diagnostic data based on the node-level anomaly scores, the root cause candidate set, and the recommended anomaly types or unknown types.

[0024] The following is a detailed explanation of steps S1-S6: S1. Obtain multimodal observation data and prior service dependency graph. The multimodal observation data includes indicator modal data, log modal data, and call chain modal data. The prior service dependency graph is used to characterize the inter-node call relationship between service nodes. Among them, the indicator modal data is used to characterize the operating status of service nodes supporting production operations, and may include one or more of the following: CPU utilization, memory utilization, network throughput, request response latency, error rate, queue length, or disk read / write status; the log modal data is used to characterize the operating events of service nodes, and may include one or more of the following: log template identifier, log level, number of log occurrences, abnormal keyword statistics, or event category statistics; the call chain modal data is used to characterize the call relationship and link status between service nodes, and may include one or more of the following: source service node, target service node, call direction, number of calls, call latency, call success rate, call failure rate, or call status.

[0025] A prior service dependency graph is used to represent the call relationships between nodes in an industrial manufacturing scenario. Let the prior service dependency graph be... ,in, Represents a set of service nodes. Represents the set of service dependency edges. This represents the baseline adjacency matrix or baseline edge weight matrix corresponding to the service-dependent edges. For any service node... This can correspond to one or more of the following: device access node, data acquisition node, process orchestration node, quality traceability node, warehousing and logistics node, energy management node, data storage node, log processing node, cache node, analysis node, front-end gateway node, or operation and maintenance scheduling node. In this embodiment, the diagnostic object is the service node supporting the operation of the industrial manufacturing process and its calling relationships.

[0026] S2. Preprocess the multimodal observation data to obtain window-level multimodal samples.

[0027] In one embodiment, the multimodal observation data is preprocessed to obtain window-level multimodal samples. Preprocessing includes time alignment, missing data completion, normalization, log template statistics, call chain aggregation, and sliding window construction.

[0028] Specifically, the indicator modal data, log modal data, and call chain modal data are time-aligned according to a unified sampling period; the indicator modal data is processed for missing data completion and normalization to obtain an indicator modal sequence organized by service nodes and time steps; the log modal data is statistically analyzed according to service nodes and time windows to obtain a log modal sequence organized by service nodes and time steps; and the call chain modal data is aggregated according to source service nodes, target service nodes, and time windows to obtain a call chain modal sequence organized by service dependency edges and time steps.

[0029] Let the length of the sliding time window be... The sliding step size is Then for the first A sliding window is used to construct window-level multimodal samples:

[0030] in , representing the index mode sequence, Represents a log modal sequence. This indicates a call chain modal sequence. Represents a prior service dependency graph. Window-level multimodal samples include... The metrics modal characteristics, log modal characteristics, call chain modal characteristics of each effective service dependency edge, and prior service dependency graph of each service node within each time step.

[0031] S3. Input the window-level multimodal samples into the pre-trained multimodal spatiotemporal model to extract the indicator modal latent representation, log modal latent representation and call chain modal edge features of each service node in the current window.

[0032] In one embodiment, window-level multimodal samples are input into a pre-trained multimodal spatiotemporal model. The multimodal spatiotemporal model includes a feature mapping layer, a dynamic edge weight generation layer, a call chain edge reweighting layer, a graph attention spatial dependency modeling layer, a multi-head temporal attention layer, a gated cross-modal fusion layer, a decoding and reconstruction layer, and an anomaly scoring layer.

[0033] The feature mapping layer performs feature mapping on the indicator modal sequence, log modal sequence, and call chain modal sequence, respectively. Specifically, for service nodes... At time step Indicator modal characteristics The implicit representation of the index mode is obtained through an index mode linear mapping layer and a nonlinear activation function:

[0034] For service nodes At time step Log modal features The log modality latent representation is obtained through a log modality linear mapping layer and a nonlinear activation function:

[0035] For valid edges At time step Call chain modal edge features The call chain mode edge features are obtained by calling the chain mode linear mapping layer and the nonlinear activation function:

[0036] in, , , These represent the learnable mapping matrices for the metric modality, log modality, and call chain modality, respectively. , , These represent the corresponding bias terms. This is the LeakyReLU activation function.

[0037] Furthermore, to characterize the time sequence within the sliding time window, the time position encoding can be added to the above implicit representation to obtain the indicator modal implicit representation, log modal implicit representation, and call chain modal edge features of each service node in the current window.

[0038] S4. The multimodal spatiotemporal model uses the implicit representation of the index modality and the implicit representation of the log modality to generate a dynamic edge weight matrix based on the effective edge range defined by the prior service dependency graph. The dynamic edge weight matrix is ​​then used to reweight the edge features of the call chain modality to obtain the reweighted call chain modality representation.

[0039] Combination Figure 2 As shown, in one embodiment, the dynamic edge weight generation layer generates a dynamic edge weight matrix within the scope of valid edges defined by the prior service dependency graph. For any valid edge... Obtain the source service node corresponding to the valid edge. and target service node And construct edge state vectors based on the implicit representations of the indicator modal and the implicit representations of the log modal of the source service node and the target service node.

[0040] Specifically, the implicit representations of metrics and logs of the same service node can be concatenated or weighted to obtain the node status representation:

[0041]

[0042] in, This represents a vector concatenation operation. Further, the source and target service node state representations are input into the edge weight generation network to obtain the effective edges. At time step Edge relevance score:

[0043]

[0044]

[0045] in ,and Let these represent the source node projection matrix and the target node projection matrix, respectively. Indicates the hidden dimension. Indicates temperature parameter, Indicates the valid edges in the prior service dependency graph. The baseline edge weight, This indicates the learnable fusion coefficient or the preset fusion coefficient. Indicates a valid edge In time The dynamic edge weights of each step. For edges that do not exist in the prior service dependency graph. No valid dynamic edge weights are generated.

[0046] Construct the dynamic edge weight matrix for the current window based on the dynamic edge weights corresponding to each time step and each valid edge:

[0047] After obtaining the dynamic edge weight matrix, the call chain edge reweighting layer reweights the call chain modal edge features edge by edge using the dynamic edge weight matrix. Specifically, the dynamic edge weight corresponding to each valid edge in the dynamic edge weight matrix is ​​multiplied edge by edge by edge by the call chain modal edge feature corresponding to the same valid edge:

[0048] in, Indicates a valid edge At time step The modal edge features of the call chain, This represents the reweighted call chain modal edge representation. All valid edges within the current window constitute the reweighted call chain modal representation.

[0049] Through the above processing, the call chain modal representation not only includes side features such as the original number of calls, call latency, or call status, but also includes the dynamic dependency strength perceived by the current metric status and log events.

[0050] S5, the multimodal spatiotemporal model utilizes the implicit representation of the indicator modality, the implicit representation of the log modality, and the reweighted call chain modality to extract the structural dependencies and their temporal evolution features between service nodes, dynamically weighted and fused into a joint spatiotemporal representation, and outputs the node-level anomaly score and diagnostic feature representation of each service node based on the joint spatiotemporal representation.

[0051] Combination Figure 3 As shown, in one embodiment, the multimodal spatiotemporal model extracts the structural dependencies and their temporal evolution features between service nodes through a graph attention spatial dependency modeling layer, a multi-head temporal attention layer, and a gated cross-modal fusion layer, and dynamically weights and fuses them into a joint spatiotemporal representation.

[0052] Specifically, spatial dependency modeling is performed based on the structural dependencies between service nodes, employing a graph attention network based on prior service dependency graphs and dynamic edge weights. For time steps... Service nodes under Using the implicit representations of the service node's metrics and logs as node-side inputs, and the reweighted call chain edge representation associated with the service node as edge-side inputs, message passing is performed within the range of adjacent nodes defined by the prior service dependency graph. For nodes... Adjacent nodes Its spatial attention coefficient can be expressed as:

[0053] in, Indicates service node The set of adjacent nodes in the prior service dependency graph This represents the node implicit representation obtained by combining the indicator modal implicit representation and the log modal implicit representation. and Represents the learnable mapping matrix. Represents a learnable attention vector. Represents a node To the node Spatial attention coefficient when transmitting messages.

[0054] Update node spatial representation based on spatial attention coefficient:

[0055] in, Indicates service node At time step Spatial dependency representation. The graph attention spatial dependency modeling layer can adopt a multi-head attention structure, which concatenates or averages the representations obtained from multiple attention heads to improve the expressive power of structural dependencies.

[0056] In one embodiment, time dependency modeling employs a multi-head temporal attention layer. For service nodes... Represent its spatial dependency sequence within the sliding time window. Inputting the multi-head temporal attention layer yields the temporal evolution representation of the service node. The multi-head temporal attention layer calculates the dependencies between different time steps using the query matrix, key matrix, and value matrix.

[0057] in, , , These represent the query matrix, key matrix, and value matrix, respectively. Represents the dimension of the key vector. This represents the temporal attention mask. During the encoding phase, It can be used to limit the effective time step; in the decoding stage, This is a causal mask to prevent the decoding phase from using information from after the current time step.

[0058] A feedforward network layer is set after the multi-head temporal attention layer. The feedforward network layer includes linear transformation, LeakyReLU or GELU activation function, residual connection, LayerNorm normalization, and Dropout regularization. This yields the metric modal attention representation, log modal attention representation, and call chain modal attention representation.

[0059] In one embodiment, the dynamic weighted fusion employs a gated cross-modal fusion network. The gated cross-modal fusion network generates gate weights for each modality based on the attention representations of the metric modality, log modality, and call chain modality within the current window, and then performs dynamic weighted fusion of the multimodal representations according to the gate weights.

[0060] For the The gating fusion process for each modality can be represented as follows:

[0061]

[0062] in, Indicates the first Self-attention representation of each modality This represents the cross-modal context representation obtained by aggregating other modalities. and This represents the learnable parameters of the gated network. Indicates the first Modal gating weights for each modality This represents the fused modal representation.

[0063] Furthermore, the fused representations of each modality are concatenated or weighted and summed to obtain a joint spatiotemporal representation:

[0064] in, Indicates service node The corresponding union representation, , , Representing service nodes The corresponding metric modal fusion representation, log modal fusion representation, and call chain modal fusion representation, and This indicates the output mapping parameters.

[0065] The multimodal spatiotemporal model outputs node-level anomaly scores and diagnostic feature representations for each service node based on a joint representation. Specifically, the anomaly scoring layer can use a multilayer perceptron or a linear classifier to map the joint representation:

[0066] in, Indicates service node Node-level anomaly scores, and This represents the parameters of the anomaly scoring layer.

[0067] Diagnostic feature representations include one or more of the following: node-level implicit representation, graph-level implicit representation, submodal reconstruction bias, modality-gated weights, window-level anomaly scores, and dynamic edge weight matrices. Specifically, node-level implicit representation characterizes the overall operational status of service nodes within the current window; graph-level implicit representation characterizes the overall operational status of the current window; submodal reconstruction bias characterizes the contribution of different modalities to anomalies; and modality-gated weights characterize the importance of different modalities within the current window.

[0068] S6. Construct root cause scores based on node-level anomaly scores, diagnostic feature representations, and changes in the dynamic edge weight matrix to obtain a root cause candidate set; generate recommended anomaly types or unknown types based on the root cause candidate set, diagnostic feature representations, and a preset anomaly type set, and generate structured diagnostic data based on the node-level anomaly scores, the root cause candidate set, and the recommended anomaly types or unknown types.

[0069] Combination Figure 4 As shown, in one embodiment, a root cause score is constructed based on node-level anomaly scores, diagnostic feature representations, and changes in the dynamic edge weight matrix. The change in the dynamic edge weight matrix is ​​the deviation of the current window's dynamic edge weight matrix from the baseline edge weight, historical baseline edge weight, or previous window's dynamic edge weight in the prior service dependency graph.

[0070] For any valid edge The change in its dynamic edge weight can be expressed as:

[0071] in, Indicates the valid edges in the current window Dynamic edge weights This indicates the historical baseline edge weight, the dynamic edge weight of the previous window, or the baseline edge weight in the prior service dependency graph corresponding to the valid edge.

[0072] For any service node Construct node-level edge weight changes based on the dynamic edge weight changes associated with the incoming and outgoing edges of the service node:

[0073] in, Indicates service node The corresponding dynamic change in edge weight.

[0074] Furthermore, obtain service nodes Corresponding node-level anomaly score Modal reconstruction deviation Node-level implicit representation and dynamic edge weight changes Constructing a root cause score:

[0075] in, Indicates service node Root cause score This indicates normalization processing. This represents a function that performs a scoring mapping on the node-level implicit representation. , , and This indicates the preset weights or learnable weights.

[0076] Multiple service nodes are sorted from highest to lowest based on their root cause scores, and the nodes with the highest scores are selected. Each service node is used as a root cause candidate set. The value is a preset positive integer, preferably 3, and Not greater than the total number of service nodes; when the total number of service nodes is less than When all service nodes are considered as candidates, if at least two service nodes have the same root cause score, the ranking is determined sequentially based on the node-level anomaly score, the absolute value of the dynamic edge weight change, and the node identifier order.

[0077] In one embodiment, an anomaly type recommendation result or an unknown type result is generated based on a root cause candidate set, diagnostic feature representation, and a preset anomaly type set. The preset anomaly type set includes one or more of resource contention, dependency blocking, configuration anomalies, service instance anomalies, and data access anomalies.

[0078] Specifically, the node-level hidden representation, submodal reconstruction bias, modal gating weight, dynamic edge weight change, and window-level anomaly score corresponding to each candidate service node in the root cause candidate set are input into the anomaly type recognition network to calculate the confidence level corresponding to each candidate anomaly type:

[0079] in , indicating the first The confidence level corresponding to the candidate exception type. This represents the diagnostic vector constructed from the root cause candidate set and its diagnostic feature representation. and Network parameters indicating anomaly type identification.

[0080] The rejection threshold is determined based on historical samples, preset calibration samples, validation samples, or manually set threshold rules. If the confidence level of at least one candidate anomaly type is not lower than the rejection threshold, then anomaly type recommendation results are generated in descending order of confidence level; if the confidence level of each candidate anomaly type is lower than the rejection threshold, then unknown type results are generated.

[0081] In one embodiment, structured diagnostic data is generated based on node-level anomaly scores, root cause candidate sets, anomaly type recommendation results, or unknown type results. Specifically, anomaly detection results are generated based on node-level anomaly scores; root cause localization results are generated based on the root cause candidate set; anomaly type results are generated based on the anomaly type recommendation results or unknown type results; dominant modality information is determined based on submodal reconstruction bias or modality gating weights; key change edge information is determined based on dynamic edge weight changes; and the anomaly detection results, root cause localization results, anomaly type results, dominant modality information, and key change edge information are combined into structured diagnostic data.

[0082] Structured diagnostic data includes at least a list of node-level anomaly scores, a root cause candidate set and its ranking, recommended anomaly type identifiers or unknown type identifiers, dominant modality information, key change edge information, corresponding time window identifiers, and service node identifiers. Structured diagnostic data can be displayed through result tables, alarm messages, or diagnostic dashboards to provide a basis for anomaly detection, root cause localization, and maintenance handling in industrial manufacturing scenarios.

[0083] In one embodiment, the multimodal spatiotemporal model is pre-trained during the training phase. The training data originates from the operational data of service nodes in the industrial manufacturing operation support environment, and includes at least indicator modal data, log modal data, call chain modal data, node anomaly annotation data, and prior service dependency graphs. Before training, the training data undergoes the same processing as in the online inference phase, including time alignment, missing data completion, normalization, log template statistics, call chain aggregation, and window construction.

[0084] The training phase executes the same dynamic edge weight generation, call chain modal reweighting, graph attention spatial dependency modeling, multi-head temporal attention modeling, and gated cross-modal fusion forward process as the online inference phase, and optimizes the model parameters through a joint optimization objective. The joint optimization objective includes reconstruction loss, node anomaly classification or regression loss, encoder-decoder consistency constraint loss, and graph structure sparsity regularization, which can be expressed as:

[0085] in, For node-level anomaly classification or regression loss, To reconstruct the loss, For encoding / decoding consistency constraint loss, For graph structure sparse regularization terms, To reconstruct the loss weights, The loss weight is used to define the consistency constraints between encoding and decoding.

[0086] In one embodiment, the reconstruction loss can be constructed based on the reconstruction biases of the metric mode, log mode, and call chain mode:

[0087] in, This represents the loss from the modal reconstruction of the indicator. Indicates the log modality reconstruction loss. This represents the call chain modality reconstruction loss. Node-level anomaly classification or regression loss can employ one or more of the following: weighted binary classification loss, ranking loss, or anomaly scoring constraint loss. The encoder-decoder consistency constraint loss can be constructed through a comparison constraint between the encoded and decoded representations. The graph structure sparsity regularization term can be represented as:

[0088] in, Represents the dynamic edge weight matrix. This represents the baseline adjacency matrix corresponding to the prior service dependency graph. This represents the regularization weight.

[0089] In one embodiment, model training employs an adaptive optimizer for parameter updates, and the initial learning rate can be set to... The weight decay coefficient can be set to The learning rate can be decayed according to a preset number of training rounds, and the decay coefficient can be set to... The training epochs can be set to 120, the early stopping patience value to 7, and the gradient clipping threshold to 10. The window length can be set to 10 time steps, and the sliding step size can be set to 1 time step. The metric modality embedding dimension can be set to 16, the log modality embedding dimension to 8, and the call chain modality embedding dimension to 4. The number of attention heads can be set to 2 to 4, the number of encoder and decoder layers can be set to 2, the Dropout ratio can be set to 0.2, the dynamic graph hiding dimension can be set to 16, the dynamic graph update step size can be set to 2, and the graph structure regularization weight can be set to... The encoding / decoding consistency constraint weight can be set to 0.1.

[0090] The following embodiment of the present invention will illustrate an information fusion-driven anomaly detection and localization method for industrial manufacturing provided by the present invention through a more specific example.

[0091] In the production operation support environment of an industrial manufacturing enterprise, equipment access nodes, data acquisition nodes, process orchestration nodes, data storage nodes, log processing nodes, cache nodes, analysis nodes, and front-end gateway nodes continuously run and call each other. The node names in this embodiment are only used to describe the service nodes supporting production operation and their calling relationships, and do not limit the specific deployment form of the nodes.

[0092] In this embodiment, indicator modal observation data, log modal observation data, and call chain modal observation data are acquired according to a preset sampling period. The sliding window length is set to 10 time steps, and the sliding step size is 1 time step. For any window-level multimodal sample, missing data completion and normalization are performed on the indicator modal observation data; log template statistics are performed on the log modal observation data to obtain log modal features organized by service nodes; and aggregation from the source service node to the target service node level is performed on the call chain modal observation data to obtain call chain modal edge features organized by service dependency edges.

[0093] After inputting the above window-level multimodal samples into the pre-trained multimodal spatiotemporal model, the model generates a dynamic edge weight matrix based on the indicator modal implicit representation and log modal implicit representation of the service nodes at both ends of the effective edge, and reweights the edge features of the call chain modality edge by edge; then, through spatial dependency modeling, temporal dependency modeling and gated cross-modal fusion, the node-level anomaly score and diagnostic feature representation of each service node are obtained.

[0094] When the node-level anomaly scores of analysis nodes and data storage nodes in a certain window increase, the method further generates a root cause score vector based on the node-level anomaly scores, modal reconstruction deviations, and dynamic edge weight changes related to the incoming and outgoing edges of each service node, and obtains a root cause candidate set based on the root cause score vector. If the root cause score corresponding to the data storage node is higher than that of other service nodes, the data storage node is ranked as a higher-priority root cause candidate.

[0095] Furthermore, the method calculates the confidence level corresponding to each candidate anomaly type based on a preset set of anomaly types. When the confidence level corresponding to resource competition is higher than that of other anomaly types but not lower than the rejection threshold, a recommendation result for the anomaly type containing resource competition is generated; when the confidence levels corresponding to all candidate anomaly types are lower than the rejection threshold, an unknown type result is generated.

[0096] To verify the technical effectiveness of the method in this embodiment, tests were conducted on a dataset containing abnormal scenarios such as resource contention, dependency blocking, configuration anomalies, service instance anomalies, and data access anomalies. Test metrics included anomaly detection F1 score, AUC score, root cause localization Hit@K, mean reciprocal ranking (MRR), anomaly type Hit@K, and unknown type output rate.

[0097] Table 1 Comparison of Anomaly Detection Performance

[0098] As shown in Table 1, on the D1 dataset, the F1 score of the method in this embodiment is 90.30%, which is 3.36 percentage points higher than the 86.94% of the comparative method; on the D2 dataset, the F1 score of the method in this embodiment is 96.53%, which is 0.64 percentage points higher than the 95.89% of the comparative method. These results demonstrate that the method in this embodiment has good overall detection performance in multimodal anomaly detection tasks.

[0099] Table 2 Ablation Experiment Results of Core Module

[0100] As shown in Table 2, the F1 score of the complete model is 0.901, higher than that of all ablation variants. When dynamic edge weight generation, encoder-decoder consistency constraints, and gated cross-modal fusion are removed simultaneously, the F1 score decreases to 0.854. These results indicate that dynamic edge weight generation enhances the ability to perceive changes in the strength of dependencies between nodes, gated cross-modal fusion improves the adaptive collaborative ability of information from different modalities, and encoder-decoder consistency constraints improve the stability of latent representations; all three factors collectively enhance anomaly detection performance.

[0101] Table 3. Root Cause Localization and Abnormality Type Recommendation Results

[0102] As shown in Table 3, under the end-to-end process of the test set, the service node root cause localization accuracy (Hit@1) of the method in this embodiment is 85.35%, Hit@5 is 92.81%, and the service MRR is 88.16%; the anomaly type recommendation accuracy (Hit@1) is 86.19%, Hit@5 is 99.91%, and the anomaly type MRR is 92.23%. These results demonstrate that the method in this embodiment can not only output node-level anomaly detection results but also further provide a top-ranked root cause candidate set and anomaly type recommendation results.

[0103] In summary, the method in this embodiment can effectively identify abnormal nodes under multimodal observation data conditions, and combine dynamic edge weight changes, diagnostic feature representations, and anomaly type confidence to generate root cause candidate sets, anomaly type recommendation results or unknown type results, as well as structured diagnostic data, thereby improving the accuracy and usability of anomaly diagnosis in the industrial manufacturing operation support environment.

[0104] It should be noted that the above test data, comparison methods, evaluation indicators, and experimental results are only used to illustrate the feasibility and technical effects of the method in this embodiment, and do not constitute a limitation on the scope of protection of this invention. In other industrial manufacturing scenarios, service node scales, sampling cycles, window lengths, anomaly type sets, or deployment environments, the model parameters, detection thresholds, and rejection thresholds can be adjusted according to the actual data distribution.

[0105] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to the method section.

[0106] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. An information fusion-driven anomaly detection and localization method for industrial manufacturing, characterized in that, include: S1. Obtain multimodal observation data and prior service dependency graph. The multimodal observation data includes indicator modal data, log modal data, and call chain modal data. The prior service dependency graph is used to characterize the inter-node call relationship between service nodes. S2. Preprocess the multimodal observation data to obtain window-level multimodal samples; S3. Input the window-level multimodal samples into the pre-trained multimodal spatiotemporal model to extract the indicator modal latent representation, log modal latent representation and call chain modal edge features of each service node in the current window; S4. The multimodal spatiotemporal model generates a dynamic edge weight matrix based on the effective edge range defined by the prior service dependency graph, using the indicator modal implicit representation and the log modal implicit representation, and reweights the call chain modal edge features using the dynamic edge weight matrix to obtain the reweighted call chain modal representation. S5. The multimodal spatiotemporal model uses the indicator modal implicit representation, the log modal implicit representation, and the reweighted call chain modal representation to extract the structural dependency relationships and their temporal evolution features between service nodes, dynamically weighted and fused them into a joint spatiotemporal representation, and outputs the node-level anomaly score and diagnostic feature representation of each service node based on the joint spatiotemporal representation; S6. Construct a root cause score based on the node-level anomaly score, the diagnostic feature representation, and the change in the dynamic edge weight matrix to obtain a root cause candidate set; generate anomaly type recommendation results or unknown type results based on the root cause candidate set, the diagnostic feature representation, and a preset anomaly type set, and generate structured diagnostic data based on the node-level anomaly score, the root cause candidate set, and the anomaly type recommendation results or unknown type results.

2. The method according to claim 1, characterized in that, The preprocessing includes time alignment, missing data completion, normalization, log template statistics, call chain aggregation, and sliding window construction.

3. The method according to claim 1, characterized in that, The generation of the dynamic edge weight matrix includes: for each valid edge in the prior service dependency graph, concatenating or combining the index modal implicit representation and log modal implicit representation of the service nodes at both ends of the valid edge to obtain an edge state vector; inputting the edge state vector into an edge weight generation network or a nonlinear mapping function to output the dynamic edge weight of the valid edge; wherein, no edge weight is generated for edges that do not exist in the prior service dependency graph.

4. The method according to claim 1, characterized in that, The reweighting specifically involves multiplying the dynamic edge weight of each valid edge with the edge feature vector of that edge in the call chain modal data edge by edge to obtain the reweighted call chain edge features; the reweighted features of all valid edges constitute the reweighted call chain modal representation.

5. The method according to claim 1, characterized in that, The extraction of structural dependencies between service nodes, the extraction of temporal evolution features, and the dynamic weighted fusion of multimodal modes are achieved through an end-to-end trained multimodal spatiotemporal model. The multimodal spatiotemporal model sequentially includes a feature mapping layer, a dynamic edge weight generation layer, a call chain edge reweighting layer, a graph attention spatial dependency modeling layer, a multi-head temporal attention layer, a gated cross-modal fusion layer, a decoding and reconstruction layer, and an anomaly scoring layer. The feature mapping layer performs nonlinear mapping on window-level multimodal samples to obtain the indicator modal implicit representation, log modal implicit representation, and call chain modal edge features of each service node; the dynamic edge weight generation layer generates a dynamic edge weight matrix based on the indicator modal implicit representation and log modal implicit representation within the effective edge range of the prior service dependency graph; the call chain edge-by-edge reweighting layer uses the dynamic edge weight matrix to weight the call chain modal edge features edge by edge to obtain the reweighted call chain modal representation; and the graph attention space dependency modeling layer uses the indicator modal implicit representation and log modal implicit representation as input. The input and weighted call chain modal representation is used as the edge feature input to extract the spatial structural dependencies between service nodes; the multi-head temporal attention layer performs temporal modeling on the spatial dependency representation to extract the temporal evolution features of the service node state; the gated cross-modal fusion layer generates adaptive gating weights based on the contribution of each modality and fuses the spatial structural dependencies and temporal evolution features into a joint spatiotemporal representation; the decoding and reconstruction layer completes the multimodal data reconstruction based on the joint spatiotemporal representation; and the anomaly scoring layer outputs the node-level anomaly score and diagnostic feature representation of the service nodes based on the joint spatiotemporal representation.

6. The method according to claim 1, characterized in that, The root cause score is constructed for each service node as follows: the node-level anomaly score, the submodal reconstruction bias in the diagnostic feature representation, the node-level latent representation, and the dynamic edge weight changes associated with the incoming and outgoing edges of the service node are obtained; after normalizing the above items, a weighted sum is performed using preset weights, or the root cause score of the node is obtained by mapping through a learned scoring network; the top K nodes are selected as the root cause candidate set according to the root cause scores from high to low.

7. The method according to claim 1, characterized in that, The change in the dynamic edge weight matrix refers to the difference between the dynamic edge weight matrix of the current window and the historical baseline edge weight matrix, the dynamic edge weight matrix of the previous time window, or the reference edge weight matrix in the prior service dependency graph.

8. The method according to claim 1, characterized in that, The preset set of anomaly types includes one or more of resource contention, dependency blocking, configuration anomaly, service instance anomaly, and data access anomaly; the generation of anomaly type recommendation results or unknown type results includes: calculating the confidence level corresponding to each candidate anomaly type; if there is an anomaly type with a confidence level not lower than the rejection threshold, then the recommendation result is output; otherwise, the unknown type is output.

9. The method according to claim 1, characterized in that, The structured diagnostic data includes at least: anomaly detection results, root cause localization results, anomaly type results, dominant modality information, and key change edge information; the anomaly detection results include a list of node-level anomaly scores, the root cause localization results include a root cause candidate set and its ranking, and the anomaly type results include anomaly type recommendation identifiers or unknown type identifiers; the dominant modality information is determined based on the contribution or deviation of each modality in the diagnostic feature representation, and the key change edge information is determined based on the dynamic edge weight change amount; the structured diagnostic data is output in the form of tables, alarm messages, or visualization panels.

10. The method according to claim 1, characterized in that, The training process of the multimodal spatiotemporal model employs a joint optimization objective for parameter updates. This joint optimization objective includes: reconstruction loss for each modality, node-level anomaly classification or regression loss, encoding / decoding consistency constraint loss, and a sparse regularization term on the graph structure. in, This represents the node-level anomaly classification or regression loss. This represents the reconstruction loss for the metric modality, log modality, and call chain modality. This represents the encoding / decoding consistency constraint loss between the encoded and decoded representations. This represents the regularization loss for dynamic graph structures. Indicates the reconstruction loss weights. This represents the weight of the consistency constraint loss.

Images