Edge intelligent gateway for protocol adaptation mapping and anomaly detection

Abstract

The application provides an edge intelligent gateway for protocol adaptive mapping and anomaly detection, which comprises a hardware interface layer, a data mapping layer, a data contextualization layer and an application service layer, and the four layers are cooperatively optimized through a bidirectional feedback loop. The hardware interface layer collects physical layer signal characteristics and monitors device heartbeat; the data mapping layer performs protocol adaptive mapping based on reinforcement learning, and identifies device types through a convolutional neural network; the data contextualization layer automatically generates an information model through open world knowledge completion based on an information model knowledge graph, and realizes six-dimensional anomaly detection through two-stage fusion reasoning of a three-dimensional structured tensor, a rule engine and a time sequence correlation analyzer; and the application service layer provides OPC UA and MQTT data services. The application solves the problems of protocol adaptation rigidity, information model construction lag and lack of anomaly detection in a flexible manufacturing scene, and is suitable for industrial device access and monitoring.

Description

Technical Field

[0001] This invention relates to the field of industrial internet and edge computing technology, specifically to an edge intelligent gateway for flexible manufacturing scenarios, used to realize protocol adaptive mapping, data semantic conversion and edge-side anomaly detection for heterogeneous industrial equipment. Background Technology

[0002] In discrete manufacturing systems, production lines need to frequently switch product types, adjust process routes, and quickly integrate different types of processing equipment, testing devices, logistics equipment, and auxiliary tooling. This dynamic reconfiguration characteristic requires the underlying equipment integration layer to have a high degree of adaptability; new equipment should be automatically identified, configured, and incorporated into the production control system after integration.

[0003] However, industrial sites have long suffered from the legacy of equipment heterogeneity. Equipment deployed by different manufacturers at different times uses various communication protocols (such as Modbus RTU / TCP, Profinet, EtherCAT, CANopen, CC-Link, DeviceNet, EtherNet / IP, proprietary protocols, etc.), with different data frame formats, encoding methods, and register definitions. Discrete manufacturing suffers from severe protocol fragmentation: equipment of the same model from the same manufacturer may have its protocol frame structure slightly adjusted due to firmware upgrades; equipment from different generations may use different versions of the same protocol (such as Modbus classic and extended versions, Profinet V2.3 and V2.4); protocol specification documents for some older equipment are missing or incomplete, resulting in a lack of authoritative basis for protocol analysis. Furthermore, the physical interface forms in the field are diverse, including RS-485 (two-wire / four-wire), CAN (ISO 11898), Ethernet (10 / 100 / 1000M), USB, etc., each with different electrical characteristics, topologies, and terminal matching requirements.

[0004] Currently, gateway products for industrial equipment access mainly adopt the following two technical approaches:

[0005] The first approach is the traditional industrial gateway solution based on pre-configured protocol adapters. This solution pre-develops dedicated protocol stack parsing modules and register mapping tables for each target communication protocol. At runtime, the gateway parses and forwards data frames from access devices according to the preset configuration. The typical architecture of this solution is a "one protocol, one adapter" model. The gateway internally maintains a set of static protocol parser instances, each bound to a fixed frame structure definition and function code mapping rules. When a new vendor's equipment or a new version of the same protocol is introduced into a flexible manufacturing production line, it is necessary to wait for the gateway vendor to develop a corresponding adapter plugin or for the user to perform secondary development and manually write the register mapping table. This process typically takes several days to weeks. Furthermore, existing gateway products generally only perform protocol parsing at the data link layer and above, failing to utilize the protocol type indication information and physical connection fault characterization information contained in the physical layer signals. They also lack built-in anomaly detection capabilities, only performing transparent data forwarding without verifying the rationality, consistency, or timeliness of device data.

[0006] The second approach is a unified device access solution based on the OPC UA standard. OPC UA (IEC 62541OLE for Process Control Unified Architecture) provides a standardized path to address device heterogeneity issues through a unified information model and cross-platform communication mechanisms. This solution requires mapping heterogeneous device data into the OPC UA information model, describing device components, attributes, and methods through nodes and references. However, many legacy devices and new specialized devices that do not support OPC UA cannot directly use this protocol and must undergo protocol conversion at the gateway layer. Existing OPC UA integration solutions typically rely on engineers manually modeling point by point according to the OPC UA specification or using semi-automatic filling based on fixed templates. Faced with the frequent occurrence of unknown device models and protocol versions in flexible manufacturing, manual modeling methods are severely outdated and cannot support dynamic device access requirements.

[0007] In recent years, artificial intelligence technologies such as knowledge graphs, deep learning, and reinforcement learning have provided new technical approaches to solving the aforementioned problems. Knowledge graphs can structure and organize device semantic information, supporting reasoning and retrieval for unknown devices; deep learning can automatically extract protocol features from raw data frames; and reinforcement learning can autonomously learn optimal mapping strategies in complex protocol environments. However, existing research mostly focuses on the implementation of single technical points, lacking a systematic edge gateway solution that integrates physical layer detection, protocol adaptive mapping, knowledge graph reasoning, and anomaly detection into a closed-loop optimization. Summary of the Invention

[0008] This invention provides an edge smart gateway with protocol adaptive mapping and anomaly detection. It addresses the problems of existing technologies that rely on manual pre-configuration for protocol adaptation and model building, lack physical layer perception and real-time anomaly detection capabilities at the edge, resulting in long device access cycles, slow fault response, and inability to meet the rapid reconfiguration requirements of flexible manufacturing.

[0009] The core technology of this invention is mainly achieved by constructing a four-layer modular architecture: physical signal detection at the hardware interface layer, adaptive mapping of protocols driven by reinforcement learning and device type identification by convolutional neural networks at the data mapping layer, automatic generation of information models driven by knowledge graphs and six-dimensional anomaly fusion reasoning driven by three-dimensional structured tensors at the data contextualization layer, and unified data service at the application service layer. A two-way feedback loop between layers is used to achieve closed-loop collaborative optimization, which reduces the time from physical access of heterogeneous devices to inclusion in the unified information model to minutes. At the same time, it enables real-time detection and root cause inference of multi-dimensional anomalies at the data source.

[0010] In a first aspect, the present invention provides an edge intelligent gateway with protocol adaptive mapping and anomaly detection, comprising: The hardware interface layer is used to establish physical connections with industrial field equipment, collect physical layer signal characteristics and raw data frames from the communication port, and perform physical signal detection and equipment heartbeat monitoring. The data mapping layer communicates with the hardware interface layer and is used to receive physical layer signal characteristics and raw data frames, perform protocol adaptive mapping to identify protocol types, parse data frame structures, implement protocol layer integrity detection and device status monitoring, perform device type identification, and uniformly convert heterogeneous protocol data into an intermediate representation format. The data contextualization layer, which communicates with the data mapping layer, is used to receive device data in intermediate representation format and device type identification results, perform open-world knowledge completion based on the preset information model knowledge graph and automatically generate a unified information model, as well as implement multi-dimensional anomaly detection and fault auditing. The application service layer communicates and connects with the data contextualization layer to deploy external data service interfaces, providing structured data services and abnormal message push. The hardware interface layer, data mapping layer, data contextualization layer, and application service layer achieve collaborative optimization through a two-way feedback loop between layers.

[0011] Furthermore, the hardware interface layer includes: The signal acquisition unit is configured at the multi-protocol physical interface to capture the electrical characteristics, timing characteristics and link characteristics of each interface in real time. The feature fusion unit, implemented based on a field-programmable gate array, is used to fuse electrical features, timing features, and link features into a protocol fingerprint vector. The physical signal detection unit is used to detect physical layer anomalies based on the physical feature baseline template library of each interface type. The heartbeat monitoring unit is used to identify the heartbeat representation of each communication protocol at the physical layer, monitor the heartbeat arrival time, and trigger a graded alarm when the heartbeat times out.

[0012] Furthermore, the data mapping layer includes: The protocol adaptive mapping module is based on reinforcement learning to build a multi-protocol parsing strategy decision engine. It takes protocol fingerprint vector, historical parsing records and current system resource status as input, outputs the selection action of the optimal protocol parsing strategy, and triggers a strategy reselection mechanism when parsing fails. The protocol layer integrity detection module is used to perform structural integrity verification, semantic compliance verification, and timing consistency verification on data frames. The equipment status monitoring module is used to establish dynamic statistical baselines for key status parameters and implement baseline-based adaptive threshold over-limit detection. The device type identification module is used to input the parsed data frame into the character-level text convolutional neural network model and output the device type classification result and its confidence vector.

[0013] Furthermore, the device type classification results and their confidence vectors output by the device type identification module are input into the candidate strategy ranking stage of the protocol adaptive mapping module to narrow the search space of candidate protocol parsing strategies. The device type identification module also receives a reverse feedback signal from the data contextualization layer. When a semantic conflict is detected during the knowledge completion process, the data contextualization layer generates a confidence correction signal and feeds it back to the device type identification module to trigger the re-identification of the device type.

[0014] Furthermore, the data contextualization layer includes: The information model knowledge graph construction unit is used to organize device entities and their relationships into a triplet knowledge network based on the unified communication protocol specification as the ontology framework. The open-world knowledge completion unit is used to calculate the mapping score between unknown entities and candidate parent nodes in the knowledge graph for unknown entities appearing in the data frames of newly connected devices through an embedded learning model. When the difference between the highest score and the second highest score meets a preset threshold, the semantic link is confirmed and knowledge completion is performed. The information model automatic generation unit is used to incrementally compile and generate an information model that conforms to the unified communication protocol specification based on the completed knowledge subgraph, and automatically load it into the server address space.

[0015] Furthermore, multi-dimensional anomaly detection and fault auditing includes six-dimensional anomaly detection, which covers physical layer detection, protocol layer detection, state layer detection, heartbeat layer detection, semantic layer detection, and association layer detection. The data contextualization layer maintains a hierarchical fault counter for each anomaly detection dimension of each device. The counter is updated using an exponential decay mechanism and multiple thresholds are set to trigger different levels of alarms and handling actions.

[0016] Furthermore, the multi-dimensional anomaly detection and fault auditing employs a collaborative inference mechanism combining a rule engine and a long short-term memory network temporal correlation analyzer, including: A three-dimensional structured tensor is constructed with anomaly source dimension, anomaly target dimension, and time lag dimension to model the temporal delay characteristics of cross-dimensional anomaly propagation. The rules engine is used to query the three-dimensional structured tensor when an anomaly is triggered, aggregate causal weights along the time lag dimension, match them with the prior propagation templates of multiple root cause hypotheses, and generate the probability distribution of the preliminary root cause hypothesis. A Long Short-Term Memory Network Temporal Correlation Analyzer is used to receive multidimensional anomalous feature sequences with multiple time windows, learn temporal dependencies, and output the posterior probability and tensor correction signal of each root cause hypothesis. The fusion inference unit is used to weight and fuse the probability distribution of the initial root cause hypothesis with the posterior probability to determine the final root cause inference, and update the three-dimensional structured tensor according to the tensor correction signal when inference conflicts occur.

[0017] Furthermore, the Long Short-Term Memory Network Temporal Association Analyzer also outputs an instantaneous causal matrix, which updates the slices representing instantaneous causal relationships in the three-dimensional structured tensor according to a predetermined ratio of old tensor retention to new matrix incorporation, thereby enabling online learning of the tensor.

[0018] Furthermore, the hierarchical fault counters correspond to the various dimensions of the six-dimensional anomaly detection. Each type of counter includes two sub-registers: sliding window counting and full lifecycle cumulative counting. Each dimension counter is set with three levels of thresholds, including warning level, critical level, and fatal level. When different levels of thresholds are reached, differentiated response strategies are triggered, including log recording, audible and visual alarms, work order push, and device isolation. When the multi-dimensional counters synchronously increase by more than a preset multiple within a preset time window, a multi-dimensional associated alarm is triggered.

[0019] Furthermore, the application service layer includes: The OPC UA server is used to load the unified information model generated by the data contextualization layer into the address space and provide data services in client / server and publish / subscribe modes. MQTT brokers are used to publish abnormal events, device status changes, and heartbeat alarms to subscribers in the form of messages; The local caching and monitoring unit is used to cache device data and abnormal logs locally on the gateway, supports resume transmission after network interruption and offline query, and provides a local monitoring interface. The interlayer bidirectional feedback loop includes: the hardware interface layer receiving feedback signals from the data mapping layer to adjust the physical layer sampling parameters; the data mapping layer receiving knowledge completion feedback information from the data contextualization layer to correct classification confidence and policy evaluation; and the data contextualization layer returning semantic consistency verification results to the data mapping layer.

[0020] The main contributions and innovations of this invention are as follows: 1. This invention reduces the time from physical access to inclusion of new equipment into the OPC UA unified information model from several days in traditional solutions to minutes through a vertically integrated mechanism of physical signal detection at the hardware interface layer, reinforcement learning strategy decision-making at the data mapping layer, and automatic modeling of knowledge graphs at the data contextualization layer. This meets the core requirement of rapid reconfiguration in flexible manufacturing.

[0021] 2. This invention monitors the electrical, timing, and link characteristics of multiple types of communication interfaces in real time through the hardware interface layer. It can identify potential physical layer problems before data link layer failures occur, and advance the warning time of communication failures from post-event alarms to pre-event warnings, effectively reducing unplanned downtime.

[0022] 3. Based on information model knowledge graph and open-world knowledge completion technology, this invention can automatically link entities in unknown device data frames to existing knowledge graphs and compile them to generate information models that conform to the OPC UA specification, completely eliminating the human input and human error that rely on engineers to manually model point by point or fill templates in traditional solutions.

[0023] 4. This invention utilizes a six-dimensional anomaly detection engine, combining the prior knowledge reasoning of a rule engine with the temporal learning capabilities of a long short-term memory network, to complete a full closed loop from anomaly perception to root cause inference locally on the gateway. This reduces equipment fault response from reliance on cloud analysis to the edge millisecond level, significantly improving equipment operation and maintenance efficiency in flexible manufacturing environments.

[0024] Details of one or more embodiments of the present invention are set forth in the following drawings and description, so that other features, objects and advantages of the invention will be more readily understood. Attached Figure Description

[0025] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this invention, illustrate exemplary embodiments of the invention and are used to explain the invention, but do not constitute an undue limitation of the invention. In the drawings: Figure 1 This is a diagram of an edge smart gateway system architecture with protocol adaptive mapping and anomaly detection according to an embodiment of the present invention; Figure 2 This is a schematic diagram of multi-interface signal acquisition and feature extraction at the hardware interface layer according to an embodiment of the present invention; Figure 3 This is a flowchart of the adaptive mapping decision process of the data mapping layer protocol according to an embodiment of the present invention; Figure 4 This is a flowchart of six-dimensional anomaly fusion reasoning according to an embodiment of the present invention. Detailed Implementation

[0026] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numerals in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with one or more embodiments of this specification. Rather, they are merely examples of apparatuses and methods consistent with some aspects of one or more embodiments of this specification as detailed in the appended claims.

[0027] It should be noted that the steps of the corresponding methods are not necessarily performed in the order shown and described in this specification in other embodiments. In some other embodiments, the methods may include more or fewer steps than described in this specification. Furthermore, a single step described in this specification may be broken down into multiple steps in other embodiments; and multiple steps described in this specification may be combined into a single step in other embodiments.

[0028] Example 1 I. System Overall Architecture like Figure 1 As shown, this invention provides an edge intelligent gateway with protocol adaptive mapping and anomaly detection, employing a four-layer modular architecture, comprising, from bottom to top, a hardware interface layer, a data mapping layer, a data contextualization layer, and an application service layer. This four-layer architecture achieves vertical integration from physical signal acquisition to semantic model generation, from data parsing to anomaly reasoning, and from edge processing to external services, and enables collaborative optimization between layers through bidirectional feedback loops. Vertical arrows indicate the forward data flow between layers, while reverse arrows on the left indicate bidirectional feedback loops.

[0029] The core feature of the four-layer architecture lies in the closed-loop design of inter-layer data flow: the hardware interface layer not only outputs physical feature vectors and raw data frames upwards, but also receives protocol parsing feedback signals from the data mapping layer, dynamically adjusting the physical layer sampling parameters; the data mapping layer not only outputs device data in intermediate representation format and device type identification results, but also receives knowledge completion feedback information from the data contextualization layer, correcting the device type classification confidence and protocol parsing strategy evaluation; the data contextualization layer not only outputs a unified information model and anomaly detection results, but also returns semantic consistency verification results to the data mapping layer, forming a complete closed loop of "physical detection—protocol mapping—contextual understanding—feedback correction". This bidirectional feedback mechanism between layers differs from the traditional unidirectional pipeline architecture, enabling each layer to continuously optimize during operation.

[0030] II. Hardware Interface Layer like Figure 1 and Figure 2 As shown, the hardware interface layer is used to establish physical connections with industrial field devices. The hardware interface layer includes a signal acquisition unit, a feature fusion unit, a physical signal detection unit, and a heartbeat monitoring unit. Specifically, the hardware interface layer is deployed at the bottom layer and connects to industrial field devices (i.e., [missing information]) through multi-protocol physical interfaces. Figure 2 The industrial field equipment layer has a built-in FPGA logic unit that is responsible for physical signal detection and equipment heartbeat monitoring. It outputs physical feature vectors and raw data frames to the upper layer, and receives correction and diagnostic parameters from the upper layer to dynamically adjust the sampling strategy.

[0031] The industrial field device layer includes five categories of industrial field devices: servo drives, PLC controllers, CNC machine tools, sensor arrays, and logistics equipment. Among them, the PLC controllers and CNC machine tools can be connected via both RS-485 and Ethernet interfaces, demonstrating the diversity of interfaces for industrial field devices.

[0032] The interface module layer includes four types of physical interface modules: RS-485 interface module, Ethernet interface module, CAN interface module, and USB interface module. Each interface module establishes a connection with the access device through a corresponding physical layer transceiver to achieve electrical signal adaptation and conversion.

[0033] The core processing layer is an FPGA logic unit with a built-in CPU, undertaking five core functions: signal acquisition, timing analysis, feature extraction, heartbeat detection, and baseline template self-learning. The raw signals acquired by each interface module are uniformly fed into the FPGA logic unit, where the FPGA utilizes its hardware parallel processing capabilities to complete real-time processing and feature extraction of multi-channel signals.

[0034] The feature output layer outputs four types of feature vectors: electrical feature sub-vectors, timing feature sub-vectors, link feature sub-vectors, and heartbeat features. The first three types of sub-vectors are concatenated into a protocol fingerprint vector using an FPGA hardware-level feature fusion algorithm, which is used for initial screening and identification of protocol types.

[0035] Specifically, the signal acquisition unit is configured at the multi-protocol physical interface to capture the electrical, timing, and link characteristics of each interface in real time. The multi-protocol physical interfaces include a standard serial communication (RS-232 / RS-485) interface, a CAN 2.0B interface, a 10 / 100 / 1000M Ethernet interface, and a Universal Serial Bus (USB) interface. For the standard serial communication (RS-485) interface, a high-speed analog-to-digital converter (sampling rate not less than 1 Mbps) is used to sample and monitor the differential signal level amplitude, common-mode voltage, signal edge slope, and termination impedance reflection coefficient, detecting bus conflicts and signal attenuation. For the CAN interface, bit timing parameters (including nominal bit time, synchronization segment, propagation segment, and phase segment) are monitored, along with baud rate, frame interval, and bus arbitration priority. For the Ethernet interface, physical encoding (10 Mbps, 100 Mbps, and 1 Gbps interface signals), link rate adaptation results, full-duplex / half-duplex mode, auto-negotiation pulse sequence, and cyclic redundancy check error frame rate are monitored.

[0036] Specifically, the feature fusion unit, implemented based on a field-programmable gate array (FPGA), is used to concatenate the electrical, timing, and link features acquired by the signal acquisition unit using a hardware-level feature fusion algorithm to generate a protocol fingerprint vector. The protocol fingerprint vector is a structured vector representation that fuses multi-dimensional signal features from the physical layer. It is formed by concatenating electrical, timing, and link feature sub-vectors through parallel hardware-level fusion processing using an FPGA, and is used to uniquely identify and distinguish different communication protocol types and versions. It is a 36-dimensional vector, whose initial values ​​are generated by pre-training in the cloud and burned into the edge gateway at the factory.

[0037] Specifically, the physical signal detection unit is used to detect physical layer anomalies such as level drops, baud rate drift, bit timing errors, acknowledgment / acknowledgment frame errors, and link jitter based on the normal physical characteristic baseline template library for each interface type. The baseline template is automatically built during the initial self-learning phase of device access and is locked as a reference benchmark after stable operation for N cycles (default N=1000).

[0038] Specifically, the heartbeat monitoring unit identifies the heartbeat representation of each communication protocol at the physical layer, monitors the heartbeat arrival time, and triggers tiered alarms when the heartbeat times out. Specifically: Modbus and Modbus Ethernet protocols maintain Transmission Control Protocol (TCP) connections by periodically reading holding registers; the Profinet bus confirms link activity by discovering and receiving greeting frames within the Basic Configuration Protocol (DCP) cycle; the CANopen bus uses node guardians or heartbeat messages in network management; and the Control and Communication Link Bus (CC-Link) confirms device online status by updating the remote output bit area / remote write register area within the refresh cycle. The heartbeat monitoring unit monitors the heartbeat arrival time, triggering a warning-level alarm when the interval between two consecutive heartbeats exceeds twice the expected period, a critical-level alarm when it exceeds three times, and confirming device disconnection and releasing gateway resources when it exceeds five times.

[0039] III. Data Mapping Layer like Figure 2 and Figure 3 As shown, the data mapping layer sits above the hardware interface layer and incorporates a reinforcement learning (RL)-driven protocol parsing engine, enabling protocol layer integrity detection, device status monitoring, and adaptive protocol mapping. This layer uniformly converts the heterogeneous protocol data reported by the hardware interface layer into a JSON intermediate representation and outputs device type identification results. Simultaneously, it receives correction confidence and policy feedback signals from the upper data contextualization layer.

[0040] Specifically, the data mapping layer receives raw data frames and protocol fingerprint vectors reported by the hardware interface layer. It automatically identifies the protocol type and parses the data frame structure using a reinforcement learning-driven protocol parsing engine, performs protocol layer integrity checks and device status monitoring, and identifies the device type using a CTCNN (Character-level Text Convolutional Neural Network) model, uniformly converting heterogeneous protocol data into an intermediate representation format. The data mapping layer includes a protocol adaptive mapping module, a protocol layer integrity detection module, a device status monitoring module, and a device type identification module.

[0041] The core of the protocol adaptive mapping module is a multi-protocol parsing policy decision engine based on reinforcement learning (i.e. Figure 1 The module's inputs include: the protocol fingerprint vector output from the hardware interface layer (including interface type, electrical features, timing features, and link features), historical successful / failed parsing records, and the current system resource status (processor usage, memory availability, and number of concurrent connections); the output is the action for selecting the optimal protocol parsing strategy.

[0042] State space of reinforcement learning Defined as:

[0043] in, For protocol fingerprint vector, This is a historical success rate matrix. For resource load, For time window statistics. Action space. ,in It covers more than 100 protocol parsers.

[0044] The reward function employs a multi-objective dynamic reward mechanism, comprehensively considering four optimization objectives: parsing success rate, parsing latency, system resource consumption, and anomaly penalty.

[0045] in, The instant reward value for a single protocol parsing; The weighting coefficient for the success rate item is set to 1.0; This is an indicator variable for whether a single parsing attempt was successful. The weighting coefficient for the time delay term is set to 0.3; This represents the parsing delay of the current data frame, in milliseconds (ms). The reference delay value is 100ms. This is the weighting coefficient for the processor resource item, with a value of 0.2. This represents the current system processor utilization rate, with a value range of [value range missing]. ; This is the weighting coefficient for the abnormal penalty item, with a value of 0.8; Count the abnormal frames within the past 100 frames.

[0046] The policy network employs a two-layer fully connected network plus a soft maximum function. The structure of the output layer:

[0047] in, This refers to the action, i.e., the selected protocol parsing strategy; The input policy network's state vector; , These are the weight matrices for the first and second layers of the policy network, respectively. , These are the bias vectors for the first and second layers of the policy network, respectively.

[0048] The policy network is trained online using the Proximal Policy Optimization (PRO) algorithm. When parsing fails, a policy reselection mechanism is automatically triggered (i.e., the feedback signal from the parsing failure is corrected and fed back to the RL policy network as a sample for online training to update the network parameters, and then the policy selection is re-executed). A maximum of 5 retries are allowed; if more than 5 retries are attempted, the parser is downgraded to a general regular expression matching parser.

[0049] During protocol parsing, the protocol layer integrity detection module performs multi-level checks on the structural integrity, semantic compliance, and timing consistency of data frames. Structural integrity checks include frame length compliance, cyclic redundancy check / vertical redundancy check failure detection, function code validity verification, register address out-of-bounds detection, and data length discrepancy detection. Semantic compliance checks include protocol version consistency detection, vendor-defined extended field compliance detection, and multi-frame continuity verification. Timing consistency checks use a sliding time window to statistically analyze the mean and variance of frame arrival intervals, detecting communication jitter, request-response latency, and burst traffic.

[0050] The equipment status monitoring module performs real-time monitoring and trend analysis of key status parameters based on the parsed equipment operation data. A normal operation baseline is established for each key status parameter of each piece of equipment, and a sliding window statistical method is used (100 points for rapidly changing parameters such as current, and 1000 points for slowly changing parameters such as temperature) to calculate the baseline mean. and standard deviation Implement adaptive threshold over-limit detection based on dynamic statistical baseline.

[0051] The device type recognition module employs a character-level text convolutional neural network (CTCNN) model, using the key sequence of JSON format data frames parsed from the protocol as input. The CTCNN workflow includes: Step 1, character-level one-hot encoding: map each character in the input key sequence to a one-hot vector of fixed dimension; Step 2, Parallel scanning of multi-scale convolution kernels: Convolution kernels with sizes of [sizes to be filled in] are used. , , and The four sets of convolutional kernels perform parallel feature extraction on the character sequence, capturing local semantic patterns at different granularities; Step 3, Global Max Pooling: Take the global maximum value of the output of each group of convolutional kernels to extract the most significant feature signal; Step 4, Soft Max Function Classification: Input the concatenated feature vector into the fully connected layer and the Softmax layer, and output the device type classification result and its confidence vector.

[0052] The output of CTCNN's device type recognition is not only used for knowledge graph subgraph retrieval but also participates in the policy decision-making process of reinforcement learning protocol parsing. Specifically, the device type classification results and their confidence vectors output by CTCNN are directly input into the candidate policy ranking stage of the reinforcement learning action space. When CTCNN identifies the device type as "servo driver," the reinforcement learning agent will prioritize activating the EtherCAT and CANopen parsers; when it identifies it as "programmable logic controller," it will prioritize activating the Modbus TCP and Profinet parsers. This collaborative mechanism between CTCNN and reinforcement learning injects the semantic information of device type recognition into the protocol parsing policy decision-making process, significantly reducing the search space for candidate policies.

[0053] Simultaneously, the CTCNN module receives bidirectional feedback signals from the data contextualization layer: when a semantic conflict is found between the CTCNN classification result and the reference model for that device type in the Information Model Knowledge Graph (IMKG) during knowledge completion (e.g., identified as a "servo drive" but with a function code specific to a programmable logic controller appearing in the data frame), the data contextualization layer generates a confidence correction signal, reducing the classification confidence of CTCNN, and re-identifying the device type in the next iteration. This bidirectional feedback closed-loop mechanism continuously optimizes the accuracy of device type identification as the system runs.

[0054] IV. Data Contextualization Layer like Figure 1 As shown, the data contextualization layer sits above the data mapping layer and integrates core modules such as the Information Model Knowledge Graph (IMKG), open-world knowledge completion, automatic generation of OPC UA information models, and six-dimensional anomaly fusion reasoning. This layer transforms the JSON data output from the data mapping layer into a semantically meaningful OPC UA information model, performs multi-dimensional anomaly detection and root cause analysis, outputs the OPC UA information model and anomaly detection results to the upper layer, and simultaneously receives feedback from the corrected knowledge graph from the application service layer.

[0055] Specifically, the data contextualization layer receives JSON-formatted device data and device type identification results from the data mapping layer, constructs an information model knowledge graph (IMKG) based on the OPC UA information model specification, links unknown device entities to the IMKG through open-world knowledge completion, and automatically generates the OPC UA information model. Simultaneously, this layer performs deep analysis of device heartbeats, cumulative fault counting and threshold management, consistency auditing of the anomaly log chain and knowledge graph, and executes six-dimensional anomaly fusion reasoning through a rule engine and a long short-term memory network temporal correlation analyzer.

[0056] Information Model Knowledge Graph Construction: IMKG uses various device reference information models released by OPC Foundation as its ontology framework, with objects, variables, and methods as entities, and OPC UA specification references, including component relationships, attribute relationships, and type definition relationships, as relationships, and is organized into a triplet knowledge network.

[0057] Open-world knowledge completion: For newly connected devices, after identifying the device type using CTCNN, the system retrieves the reference model from the corresponding IMKG subgraph. For unknown entities appearing in the JSON data frame (i.e., keys not appearing in the IMKG), a complex domain embedding model is used for knowledge embedding and information completion.

[0058] The triplet scoring function for the complex field embedding model is defined as:

[0059] in, For triplet scoring functions; Subject entity; For relationship; For object entities; Subject entity in the first Complex embeddings of dimension; For the relationship in the first Complex embeddings of dimension; For the object entity in the first Complex embeddings of dimension; The complex conjugation of the object entity embedding; Dimension index for complex number embeddings.

[0060] For unknown key names In the set of candidate superior nodes Calculate its score with each candidate node:

[0061] If the difference between the first and second scores is less than 5%, the link completion is confirmed and an incremental node set is generated; if the difference is greater than or equal to 5%, the unknown entity is marked and the completion fails.

[0062] Simultaneously, automated semantic verification is performed. When a semantic conflict is detected (e.g., an unknown key is linked to a mismatched node type, or a function code that the device type should not have appears in the data frame), the system generates a confidence correction signal, which is fed back to the CTCNN module via a reverse path. After receiving the correction signal, CTCNN reduces the confidence of the current classification result, re-identifies the device type under the constraints of the alternative type list, and outputs a new classification result in the next iteration.

[0063] Automatic information model generation: The completed knowledge subgraph is incrementally compiled to generate an information model that conforms to the OPC UA specification. It is automatically updated and loaded into the OPC UA server address space through the addition of node services, and can be read in real time by the upper-layer manufacturing execution system or data acquisition and monitoring control system.

[0064] Fault Accumulation Counting and Threshold Management: The data contextualization layer maintains layered fault counters for each device, corresponding to the dimensions of six-dimensional anomaly detection, including: physical signal anomaly counter, protocol layer integrity anomaly counter, device status exceeding limits counter, heartbeat anomaly counter, semantic consistency anomaly counter, and correlation reasoning anomaly counter. Each type of counter includes two sub-registers: a 24-hour sliding window count and a full lifecycle cumulative count. Three threshold levels are set for each type of counter: warning level (e.g., physical signal anomaly counter > 5 times / hour), critical level (e.g., physical signal anomaly counter > 20 times / hour), and fatal level (e.g., physical signal anomaly counter > 50 times / hour). When the warning level is reached, a log is recorded and a prompt is pushed to the local data acquisition and monitoring control system; when the critical level is reached, an audible and visual alarm is triggered and a work order is pushed to the manufacturing execution system; when the fatal level is reached, device isolation is automatically performed and an emergency event is pushed to the cloud platform. The counters adopt an exponential decay mechanism, multiplying by a decay coefficient every hour. Ensure that recent anomalies have a higher weight than historical anomalies. When the multi-dimensional counters increase more than three times synchronously within 30 minutes, trigger an association count alarm.

[0065] Six-Dimensional Anomaly Fusion Reasoning: The core of the six-dimensional anomaly detection engine is the collaborative fusion reasoning mechanism of a rule engine and a long short-term memory network temporal correlation analyzer. This invention employs a three-dimensional structured tensor, with the three dimensions being: anomaly source dimension... {Physical Layer, Protocol Layer, State Layer, Heartbeat Layer, Semantic Layer, Association Layer}, Anomaly Target Dimension {Physical layer, protocol layer, state layer, heartbeat layer, semantic layer, association layer} and time lag dimension Hours. Tensor elements Representing dimensions At any moment Abnormal events on dimensions At any moment The strength of causal influence, with a value range of [value missing]. The initialization of the three-dimensional structured tensor adopts the prior knowledge of domain experts and sets the initial causal weights based on the statistical laws of industrial communication faults.

[0066] like Figure 4 As shown, the rule engine performs the first level of fusion reasoning, which includes the following steps: Step 1, Time Lag Aggregation: Aggregating the Source Dimensions in the 3D Structured Tensor With the target dimension The 24 lagged slices are summed using exponential decay weighting to compress immediate causality and historical lagged causality into a single image. Comprehensive causal table This is used to characterize the actual impact strength between different dimensions of anomalies at the current site:

[0067] in, This represents the time lag decay rate, with a default value of 0.3.

[0068] Step 2, Root Cause Pattern Matching: Combine the comprehensive cause-and-effect table Prior propagation templates with 20 root cause hypotheses Perform a weighted comparison frame by frame:

[0069] in, This is the set of dimension indices that currently triggered the exception. root cause Source dimension in the prior template For target dimension The expected causal weight, with a value range of .

[0070] Step 3, Soft Maximization: Soft maximization is performed on the original scores of the 20 root causes to transform the unbounded matching scores into a normalized probability distribution.

[0071] in, This is a 20-dimensional original rating vector, with each element being... ; The root cause probability distribution output by the rule engine, after Softmax normalization, has a sum equal to 1.

[0072] The Long Short-Term Memory (LSTM) network temporal association analyzer performs the second-level fusion inference. The LSTM network receives a six-dimensional anomaly feature sequence from the past T time windows (default T=24, each window is 1 hour). As input, the hidden layer has a dimension of 32, and 20 root cause hypotheses for anomalies are initially defined (including open circuit, short circuit, increased impedance, inconsistent protocol versions, etc.). The output is the posterior probability distribution of each root cause hypothesis:

[0073] in, The posterior probability distribution of the root cause hypothesis output by the Long Short-Term Memory network; This is the weight matrix of the output layer of the Long Short-Term Memory network; For the Long Short-Term Memory Network in the first The hidden state of each time step (the last moment); This is the bias vector for the output layer of the Long Short-Term Memory network. The time window length for inputting the Long Short-Term Memory network; the default value is 24.

[0074] The preliminary root cause probability distribution output by the rule engine is weighted and fused with the posterior probability output by the Long Short-Term Memory network:

[0075] in, This represents the final root cause probability distribution after fusion. The fusion weight coefficient between the rule engine and the long short-term memory network is 0.7 when a hard rule is triggered and 0.2 when there is no hard rule. This is the root cause probability distribution output by the rule engine.

[0076] Long Short-Term Memory Network Outputs Simultaneously The instantaneous causal matrix is ​​updated by retaining 95% of the old tensor and incorporating 5% of the new matrix, and only updating the instantaneous causal representation in the three-dimensional structured tensor. The algorithm slices tensors to enable online learning. When the inference of the rule engine conflicts with the posterior probability of the Long Short-Term Memory (LSTM) network, the correction signal output by the LSM network updates the causal weights of the corresponding elements.

[0077] Anomaly log chain and knowledge graph consistency audit: Complete metadata for each anomaly event is recorded in a structured format, including log code (UUID), timestamp (millisecond-level NTP synchronization), device code (physical port + device address), anomaly dimension (physical layer / protocol layer / state layer / heartbeat layer / semantic layer / association layer), anomaly type, severity (warning level / critical level / fatal level), root cause inference, associated anomaly code list, recovery status, and snapshot data (device data frame cached 5 seconds before and after the anomaly). The edge gateway is equipped with a local circular log cache with a default capacity of 100,000 entries, which is overwritten cyclically according to the first-in-first-out principle. Critical and fatal level logs are automatically locked and cannot be overwritten. Multi-condition retrieval by device code, time range, anomaly dimension, and severity is supported, with a retrieval response latency of less than 100ms. A full audit of device semantic constraints in the IMKG is performed periodically (hourly), including data type compliance audit, numerical range compliance audit, temporal logic compliance audit, and topology relationship compliance audit.

[0078] V. Application Service Layer like Figure 1As shown, the application service layer is located at the top layer of the architecture, deploying an OPC UA server and an MQTT broker. It is responsible for publishing the information model generated by the data contextualization layer and pushing abnormal events to the upper-layer systems. The upper-layer systems include a Manufacturing Execution System (MES) (hereinafter referred to as the Upper-Level Manufacturing Execution System), a Supervisory Control and Data Acquisition System (SCADA), a Distributed Control System (DCS), a cloud platform, and mobile maintenance terminals, which can access gateway data through standard interfaces.

[0079] Specifically, the application service layer includes an OPC UA server, a Message Queuing Telemetry Transport (MQTT) broker, and a local caching and monitoring unit.

[0080] The OPC UA server loads the information model generated by the data contextualization layer into the OPC UA server address space, providing a unified client / server and publisher / subscriber service interface. Upper-layer applications (manufacturing execution systems, data acquisition and monitoring control systems) can access real-time data, historical data, and alarm events from newly connected devices through the standard OPC UA interface. The OPC UA server supports secure channels and session management to ensure the security of industrial data interaction.

[0081] The MQTT broker deploys a lightweight MQTT messaging middleware, publishing abnormal events, device status changes, and heartbeat alarms to the target end in the form of MQTT messages, ensuring that critical abnormal events are not lost. Cloud platforms, mobile operations and maintenance applications, and third-party monitoring systems can subscribe to corresponding topics to receive abnormal push notifications in real time.

[0082] The local caching and monitoring unit caches the device data and anomaly logs for the most recent 72 hours locally on the gateway, supporting resume download after network interruption and offline querying. A built-in lightweight web monitoring interface allows maintenance personnel to directly view the device's real-time status, anomaly trends, and alarm history through a browser, without relying on a host computer or cloud platform.

[0083] VI. System Working Mechanism The system follows a fully automated closed-loop process: hardware access, physical detection, protocol mapping, device identification, knowledge completion, model generation, anomaly analysis, and external service. The details are as follows: Step 1: The new device connects to the edge gateway hardware interface layer through the physical interface. The signal acquisition unit starts port scanning and signal acquisition, the feature fusion unit generates a protocol fingerprint vector, the heartbeat monitoring unit starts monitoring the device's heartbeat, and the physical signal detection unit outputs the physical feature detection results.

[0084] Step 2: The data mapping layer receives the protocol fingerprint vector and inputs it into the reinforcement learning policy network. The policy network combines historical parsing records and the current system resource state, and uses a multi-objective dynamic reward mechanism to determine the optimal protocol parsing strategy and attempt to parse the data frame. If the device uses a new version of a known protocol, the reinforcement learning agent triggers a policy reselection mechanism, attempting general regular expression matching to obtain frame structure features.

[0085] Step 3: After successful parsing, the protocol layer integrity detection module performs structural integrity, semantic compliance, and timing consistency checks on the data frame; the device status monitoring module establishes a dynamic baseline based on the parsed operational data and performs threshold detection; data frames that pass the checks are uniformly converted into a JSON format intermediate representation. If parsing fails, a strategy reselection mechanism is triggered, with a maximum of 5 retries. If more than 5 retries are attempted, parsing is downgraded to a general regular expression matching parser.

[0086] Step 4: Extract the key sequence from the JSON data frame, input it into the CTCNN device type recognition model, and output the device type classification result and its confidence vector. The initial classification result of CTCNN directly participates in the candidate policy ranking stage of reinforcement learning protocol parsing, narrowing the candidate policy search space.

[0087] Step 5: The data contextualization layer retrieves the corresponding IMKG subgraph based on the device type, performs open-world knowledge completion on unknown keys using a complex domain embedding model, and corrects the CTCNN classification results through bidirectional feedback closed-loop verification (forward path: CTCNN—subgraph retrieval—complex domain embedding model—knowledge completion; reverse path: semantic conflict detection—confidence correction—CTCNN reclassification). After automated semantic verification, an OPC UA information model is generated and automatically updated and loaded into the server address space through the newly added node service.

[0088] Step Six: The data contextualization layer performs in-depth analysis on the heartbeat data (timeout detection, content verification, jitter detection), updates the hierarchical fault counter, records the abnormal log chain, and performs IMKG semantic consistency audit.

[0089] Step 7: The six-dimensional anomaly detection engine performs time-lag aggregation and root cause pattern matching on the three-dimensional structured tensor through the rule engine, and executes the first-level association reasoning; then it learns the temporal dependency relationship through the long short-term memory network temporal association analyzer, and executes the second-level reasoning analysis and online update of the three-dimensional structured tensor; finally, it integrates and infers the root cause of the anomaly and generates hierarchical alarm events.

[0090] Step 8: The application service layer publishes equipment data to the manufacturing execution system / data acquisition and monitoring control system through OPC UA, and pushes abnormal events to the cloud platform and mobile terminals through MQTT, realizing unified access between industrial systems and IoT systems.

[0091] Step 9: Device operation data is continuously fed back to IMKG and the reinforcement learning policy network, semantic consistency verification results are fed back to CTCNN and the reinforcement learning module, and anomaly association learning results are used to update the 3D structured tensor, forming a complete closed loop from hardware access to data mapping to contextual understanding to service publishing and then to feedback correction.

[0092] Example 2 Based on the same concept, the edge intelligent gateway of this invention was deployed in a discrete manufacturing site where the production line needs to frequently switch processing equipment. A certain type of servo driver is now connected, using an RS-485 two-wire half-duplex interface with a fixed baud rate and a Modbus RTU variant protocol extended by a certain manufacturer.

[0093] After the device is powered on, the field-programmable gate array of the hardware interface layer periodically scans the port to detect the device's online / offline status. The high-speed analog-to-digital converter samples the differential signal and extracts electrical features, timing features, and link features, which are then spliced ​​into a protocol fingerprint vector by the feature fusion unit.

[0094] The data mapping layer inputs the protocol fingerprint vector into the reinforcement learning policy network and compares it with the historical cluster centers. If the similarity meets the threshold, the policy network outputs the action probability distribution. The extended Modbus parser has the highest probability and is successfully parsed on the first attempt after activation.

[0095] The parsed data frame key sequence consists of several industrial abbreviations, which are identified as servo drive types by the CTCNN model, with confidence levels meeting the threshold. The data contextualization layer retrieves the IMKG servo subgraph, matching some known attributes. Unknown key names are linked to corresponding higher-level nodes via a complex domain embedding model. The difference between the first and second scores meets the threshold, allowing direct confirmation of the link without semantic conflicts. The completed subgraph is incrementally compiled to generate an OPC UA information model, containing variable nodes such as servo speed, torque, and alarm status. This model is automatically updated and loaded through new node services, and the upper-level manufacturing execution system reads it in real-time. The time from physical access to inclusion of the equipment in the unified information model is in the minutes range.

[0096] After the equipment had been running stably for a period of time, mechanical vibrations at the site caused the RS-485 bus terminals to loosen, increasing contact resistance. Real-time monitoring at the hardware interface layer detected a significant drop in differential level, exceeding the baseline threshold, leading to an increase in the cyclic redundancy check (CRC) error frame rate and heartbeat interval drift. The six-dimensional exponential decay correlation counters were updated, with the physical signal anomaly counter, protocol layer anomaly counter, and heartbeat anomaly counter increasing synchronously, triggering a warning threshold. The rule engine queried a predefined correlation pattern library, matching the synchronous growth patterns of the physical layer, protocol layer, and heartbeat, and read the three-dimensional structured tensor. The causal weight of immediate physical layer degradation leading to protocol layer errors was high, while the causal weight of delayed physical layer degradation leading to heartbeat timeouts was lower, generating a preliminary root cause hypothesis of "deteriorating communication link quality." The Long Short-Term Memory (LSTM) network temporal correlation analyzer received six-dimensional sequences from several past time windows, extracted temporal dependency features, and output the posterior probability of each root cause hypothesis. The probability of "deteriorating communication link quality" was significantly higher than other hypotheses. By fusing the results from the rule engine and the LTM network temporal correlation analyzer, the first root cause was determined to be "deteriorating communication link quality." The system generates a critical alarm and pushes the alarm information and suspected cause to the operation and maintenance terminal via MQTT.

[0097] Example 3 In other embodiments of the present invention, protocol type identification can use a protocol signature matching method based on a fixed byte sequence to replace the combination of reinforcement learning and physical layer detection. This method can achieve fast identification in scenarios where the types of protocols are limited and the signatures are clear, but it cannot handle unknown protocols and ambiguous boundary situations.

[0098] The physical layer dimension of anomaly detection can use fixed threshold judgment to replace the statistical baseline template matching method. This is simple to implement in stable environments, but statistical template matching has better adaptability when the baseline changes due to frequent equipment replacement in flexible manufacturing environments.

[0099] The external service protocol can use only OPC UA to replace the combination of OPC UA and MQTT. This is simple to implement in scenarios where only industrial systems such as manufacturing execution systems / data acquisition and monitoring control systems are connected. However, in IoT scenarios that require both cloud platform and mobile terminal access, the lightweight message push advantage of MQTT is irreplaceable.

[0100] The above-mentioned alternatives can all achieve some of the functions of the present invention under specific constraints, but the combined solution proposed in this invention has the optimal balance in terms of comprehensiveness, scalability and adaptability in flexible manufacturing scenarios.

[0101] The above embodiments are merely illustrative of several implementations of the present invention, and their descriptions are relatively specific and detailed, but they should not be construed as limiting the scope of the present invention. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the present invention, and these all fall within the protection scope of the present invention. Therefore, the protection scope of the present invention should be determined by the appended claims.

Claims

1. An edge intelligent gateway with protocol adaptive mapping and anomaly detection, characterized in that, include: The hardware interface layer is used to establish physical connections with industrial field equipment, collect physical layer signal characteristics and raw data frames from the communication port, and perform physical signal detection and equipment heartbeat monitoring. The data mapping layer, which is communicatively connected to the hardware interface layer, is used to receive the physical layer signal characteristics and the original data frame, perform protocol adaptive mapping to identify the protocol type, parse the data frame structure, implement protocol layer integrity detection and device status monitoring, perform device type identification, and uniformly convert heterogeneous protocol data into an intermediate representation format. The data contextualization layer, which is communicatively connected to the data mapping layer, is used to receive device data and device type identification results in the intermediate representation format, perform open-world knowledge completion based on the preset information model knowledge graph and automatically generate a unified information model, and implement multi-dimensional anomaly detection and fault auditing. The application service layer communicates with the data contextualization layer and is used to deploy external data service interfaces, providing structured data services and abnormal message push. The hardware interface layer, data mapping layer, data contextualization layer, and application service layer achieve collaborative optimization through a bidirectional inter-layer feedback loop; the hardware interface layer includes: The signal acquisition unit is configured at the multi-protocol physical interface to capture the electrical characteristics, timing characteristics and link characteristics of each interface in real time. The feature fusion unit, implemented based on a field-programmable gate array, is used to fuse the electrical features, timing features, and link features into a protocol fingerprint vector. The physical signal detection unit is used to detect physical layer anomalies based on the physical feature baseline template library of each interface type. The heartbeat monitoring unit is used to identify the heartbeat representation of each communication protocol at the physical layer, monitor the heartbeat arrival time, and trigger a graded alarm when the heartbeat times out. The data mapping layer includes: The protocol adaptive mapping module is based on reinforcement learning to build a multi-protocol parsing strategy decision engine. It takes protocol fingerprint vector, historical parsing records and current system resource status as input, outputs the selection action of the optimal protocol parsing strategy, and triggers a strategy reselection mechanism when parsing fails. The protocol layer integrity detection module is used to perform structural integrity verification, semantic compliance verification, and timing consistency verification on data frames. The equipment status monitoring module is used to establish dynamic statistical baselines for key status parameters and implement adaptive threshold over-limit detection based on the baselines. The device type identification module is used to input the parsed data frame into the character-level text convolutional neural network model and output the device type classification result and its confidence vector. The device type classification result and its confidence vector output by the device type identification module are input into the candidate strategy ranking stage of the protocol adaptive mapping module to narrow down the search space of candidate protocol parsing strategies. The device type identification module also receives a reverse feedback signal from the data contextualization layer. When a semantic conflict is detected during the knowledge completion process, the data contextualization layer generates a confidence correction signal and feeds it back to the device type identification module, triggering the re-identification of the device type.

2. The edge smart gateway according to claim 1, characterized in that, The data contextualization layer includes: The information model knowledge graph construction unit is used to organize device entities and their relationships into a triplet knowledge network based on the unified communication protocol specification as the ontology framework. The open-world knowledge completion unit is used to calculate the mapping score between unknown entities appearing in the data frames of newly accessed devices and candidate higher-level nodes in the knowledge graph through an embedded learning model. When the difference between the highest score and the second highest score meets a preset threshold, the semantic link is confirmed and knowledge completion is performed. The information model automatic generation unit is used to incrementally compile and generate an information model that conforms to the unified communication protocol specification based on the completed knowledge subgraph, and automatically load it into the server address space.

3. The edge smart gateway according to claim 2, characterized in that, The multi-dimensional anomaly detection and fault auditing includes six-dimensional anomaly detection, which covers physical layer detection, protocol layer detection, state layer detection, heartbeat layer detection, semantic layer detection, and association layer detection. The data contextualization layer maintains a hierarchical fault counter for each anomaly detection dimension of each device. The counter is updated using an exponential decay mechanism and multiple thresholds are set to trigger different levels of alarms and handling actions.

4. The edge smart gateway according to claim 3, characterized in that, The multi-dimensional anomaly detection and fault auditing employs a collaborative inference mechanism combining a rule engine and a long short-term memory network temporal correlation analyzer, including: A three-dimensional structured tensor is constructed with anomaly source dimension, anomaly target dimension, and time lag dimension to model the temporal delay characteristics of cross-dimensional anomaly propagation. The rule engine is used to query the three-dimensional structured tensor when an anomaly is triggered, aggregate causal weights along the time lag dimension, match them with the prior propagation templates of multiple root cause hypotheses, and generate a probability distribution of the preliminary root cause hypothesis. A Long Short-Term Memory Network Temporal Correlation Analyzer is used to receive multidimensional anomalous feature sequences with multiple time windows, learn temporal dependencies, and output the posterior probability and tensor correction signal of each root cause hypothesis. The fusion inference unit is used to weight and fuse the probability distribution of the preliminary root cause hypothesis with the posterior probability to determine the final root cause inference, and update the three-dimensional structured tensor according to the tensor correction signal when an inference conflict occurs.

5. The edge smart gateway according to claim 4, characterized in that, The Long Short-Term Memory Network Temporal Association Analyzer also outputs an instantaneous causal matrix, and updates the slices representing instantaneous causal relationships in the three-dimensional structured tensor according to a predetermined ratio of old tensor retention and new matrix incorporation, thereby realizing online learning of the tensor.

6. The edge smart gateway according to claim 5, characterized in that, The hierarchical fault counters correspond to the various dimensions of the six-dimensional anomaly detection. Each type of counter includes two sub-registers: a sliding window count and a full lifecycle cumulative count. Each dimension counter is set with three levels of thresholds, including warning level, critical level, and fatal level. When different levels of thresholds are reached, differentiated response strategies are triggered, including log recording, audible and visual alarms, work order push, and device isolation. When the multi-dimensional counters synchronously increase by more than a preset multiple within a preset time window, a multi-dimensional associated alarm is triggered.

7. The edge smart gateway according to claim 6, characterized in that, The application service layer includes: The OPC UA server is used to load the unified information model generated by the data contextualization layer into the address space and provide data services in client / server and publish / subscribe modes to the outside world. MQTT brokers are used to publish abnormal events, device status changes, and heartbeat alarms to subscribers in the form of messages; The local caching and monitoring unit is used to cache device data and abnormal logs locally on the gateway, supports resume transmission after network interruption and offline query, and provides a local monitoring interface. The interlayer bidirectional feedback loop includes: the hardware interface layer receiving feedback signals from the data mapping layer to adjust the physical layer sampling parameters; the data mapping layer receiving knowledge completion feedback information from the data contextualization layer to correct classification confidence and policy evaluation; and the data contextualization layer returning semantic consistency verification results to the data mapping layer.

Images