A method and system for detecting abnormal data in the industrial internet
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-03-12
- Publication Date
- 2026-08-14
AI Technical Summary
[0004]静态阈值检测采用固定的阈值上下限，无法适配工业生产过程中数据的动态波动特性，易出现漏检与误检，尤其针对非线性、非平稳的工业时序数据，检测效果极差；
[0042]1、本发明构建了边缘+云端节点的多源数据采集体系，适配工业主流通信协议，能实现工业互联网设备、网络、业务、环境多源数据的全面、实时采集，同时针对工业异构数据的特点进行标准化预处理，有效提升了数据质量，为后续异常检测奠定了坚实的数基础。
Smart Images
Figure CN122578409A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of industrial internet security technology, specifically to an abnormal data detection method and system for the industrial internet. Background Technology
[0002] As a product of the deep integration of industrial production and internet technology, the Industrial Internet integrates various technologies such as equipment networking, data transmission, cloud computing, big data analysis, and industrial control, and has become a core infrastructure for intelligent manufacturing. The equipment operation data, network transmission data, and business interaction data flowing within the Industrial Internet directly determine the stability and security of industrial production. If data anomalies occur, such as deviations in operating parameters due to equipment failure, data tampering due to network attacks, or abnormal data interactions caused by operational errors, and these are not detected and addressed in a timely manner, they can lead to production interruptions, equipment damage, or even safety accidents.
[0003] Currently, methods for detecting abnormal data in the Industrial Internet mainly include traditional static threshold detection, simple clustering detection, and single machine learning detection methods. These methods have many shortcomings:
[0004] Static threshold detection uses fixed upper and lower limits, which cannot adapt to the dynamic fluctuation characteristics of data in industrial production processes. It is prone to missed detections and false detections, especially for nonlinear and non-stationary industrial time-series data, where the detection effect is extremely poor.
[0005] Single clustering detection algorithms are poorly adapted to industrial multi-source data with mixed sparsity and density, and are difficult to effectively identify outlier anomalies.
[0006] Single machine learning detection methods can only capture single-dimensional features of data and cannot take into account the time-series features, correlation features, and business rule features of industrial data, resulting in low accuracy of anomaly detection.
[0007] Furthermore, most existing methods can only identify abnormal data, but cannot accurately classify and trace the root causes of abnormal data, making it difficult to generate targeted handling strategies. Detection and control are disconnected, failing to meet the comprehensive needs of industrial internet control security.
[0008] Meanwhile, the Industrial Internet is characterized by heterogeneous multi-source data, high real-time requirements for data transmission, complex and diverse business scenarios, and close correlation between equipment and business. Existing detection methods lack a multi-source data acquisition system for the Industrial Internet, have insufficient preprocessing capabilities for heterogeneous data, and the models cannot be iteratively optimized according to changes in business scenarios, resulting in poor universality and adaptability of detection methods. Summary of the Invention
[0009] In view of the deficiencies of the prior art mentioned in the background section, the purpose of this invention is to provide an abnormal data detection method and system for the Industrial Internet.
[0010] To achieve the above objectives, in a first aspect, embodiments of the present invention provide a method for detecting abnormal data in the industrial internet, comprising:
[0011] The data to be detected is acquired based on the acquisition nodes; the acquisition nodes adopt an architecture of edge nodes + cloud nodes, and the edge nodes are deployed in the industrial site; the data to be detected includes equipment operation data, network transmission data, business interaction data and environmental perception data in the industrial production process;
[0012] The data to be detected is preprocessed;
[0013] Anomaly detection results are obtained by using a normal data feature model and a hybrid detection model to identify anomalies in the preprocessed data to be detected.
[0014] As a preferred implementation of this application, before acquiring the data to be detected based on the acquisition node, the method further includes:
[0015] Model data is acquired based on the acquisition nodes and preprocessed; the model data includes equipment operation data, network transmission data, business interaction data and environmental perception data in the industrial production process.
[0016] Based on the specific business scenarios and production process rules of the Industrial Internet, normal data features are extracted from the preprocessed model data; the normal data features include time series features, correlation features, and business rule features.
[0017] Based on the deep autoencoder and the normal data features, a normal data feature model adapted to different business scenarios is constructed.
[0018] The model data is used to train and iteratively optimize the normal data feature model.
[0019] As a specific implementation of this application, the preprocessing of the data to be detected and the model data includes standardization, noise reduction, missing value completion, and data normalization.
[0020] As a specific implementation of this application, the abnormal data detection result is obtained as follows:
[0021] The preprocessed data to be detected is input into the normal data feature model to obtain the feature reconstruction result;
[0022] The hybrid detection model is used to identify anomalies in the feature reconstruction results by considering static, dynamic, and time-series correlations of the data, thereby obtaining abnormal data detection results.
[0023] As a preferred implementation of this application, after obtaining the abnormal data detection results, the method further includes:
[0024] The anomaly detection results are classified and determined using an anomaly classification standard to obtain the classification results.
[0025] Simultaneously, the abnormal data detection results are manually reviewed and cross-verified by machine in accordance with the actual business rules of industrial production to determine the final abnormal data.
[0026] The anomaly classification standard is set based on different business scenarios of the industrial internet, including the deviation of abnormal data, the scope of impact, and the business relevance.
[0027] As a preferred implementation of this application, after obtaining the abnormal data detection results, the method further includes:
[0028] Based on the device topology, data transmission links and business process association map of the Industrial Internet, the source of the final abnormal data is traced and located to obtain the root cause of the final abnormal data.
[0029] Based on the classification and judgment results and the root cause, an anomaly handling strategy is generated and pushed to the industrial internet management and control platform.
[0030] Secondly, embodiments of this application also provide an abnormal data detection system for the Industrial Internet, including:
[0031] The data acquisition unit is used to acquire data to be detected based on the acquisition nodes; the acquisition nodes adopt an architecture of edge nodes + cloud nodes, and the edge nodes are deployed in the industrial site; the data to be detected includes equipment operation data, network transmission data, business interaction data and environmental perception data in the industrial production process;
[0032] A preprocessing unit is used to preprocess the data to be detected;
[0033] An anomaly detection unit is used to identify anomalies in the preprocessed data to be detected by employing a normal data feature model and a hybrid detection model, and to obtain anomaly detection results.
[0034] The hybrid detection model employs an improved static threshold detection, dynamic density clustering detection, and CNN-LSTM deep learning detection algorithm.
[0035] As a preferred implementation of this application, the above-mentioned abnormal data detection system further includes a model processing unit, used for:
[0036] Model data is acquired based on the acquisition nodes and preprocessed; the model data includes equipment operation data, network transmission data, business interaction data and environmental perception data in the industrial production process.
[0037] Based on the specific business scenarios and production process rules of the Industrial Internet, normal data features are extracted from the preprocessed model data; the normal data features include time series features, correlation features, and business rule features.
[0038] Based on the deep autoencoder and the normal data features, a normal data feature model adapted to different business scenarios is constructed.
[0039] The model data is used to train and iteratively optimize the normal data feature model.
[0040] Thirdly, this application also provides another information security protection device for an industrial internet communication terminal, including a processor, an input device, an output device, and a memory, wherein the processor, input device, output device, and memory are interconnected, wherein the memory is used to store a computer program, the computer program includes program instructions, and the processor is configured to call the program instructions to execute the method described in the first aspect.
[0041] The advantages of implementing the embodiments of the present invention are as follows:
[0042] 1. This invention constructs a multi-source data acquisition system with edge and cloud nodes, which is compatible with mainstream industrial communication protocols and can realize comprehensive and real-time acquisition of multi-source data from industrial Internet devices, networks, services, and environment. At the same time, it performs standardized preprocessing for the characteristics of heterogeneous industrial data, which effectively improves data quality and lays a solid data foundation for subsequent anomaly detection.
[0043] 2. This invention combines specific industrial business scenarios and production process rules to extract the temporal features, correlation features, and business rule features of data, and constructs a highly adaptable normal data feature model. This solves the problem of existing models being out of touch with industrial business scenarios, and can accurately learn the feature distribution of normal data, providing a reliable benchmark for anomaly identification.
[0044] 3. This invention employs an improved hybrid detection algorithm, which optimizes the traditional static threshold and DBSCAN clustering algorithm, combines the CNN-LSTM deep learning algorithm with deep autoencoder reconstruction error detection, and achieves multi-algorithm fusion through weighted voting. It takes into account the static, dynamic, temporal, and correlation characteristics of industrial data, significantly improves the accuracy of abnormal data detection, and reduces the false negative and false positive rates.
[0045] 4. The detection method of the present invention has strong real-time performance and is easy to operate. It can be seamlessly connected to the industrial Internet management and control platform and is applicable to industrial control safety assessment, monitoring and control in various industrial fields such as automobile manufacturing, machinery processing, chemical industry and metallurgy. It provides important technical support for the safe and stable operation of the industrial Internet and has broad application prospects. Attached Figure Description
[0046] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the accompanying drawings used in the description of the specific embodiments or the prior art will be briefly introduced below.
[0047] Figure 1 This is a flowchart of the abnormal data detection method for the Industrial Internet provided in this embodiment of the invention;
[0048] Figure 2 This is a structural diagram of the industrial internet abnormal data detection system provided in this embodiment of the invention;
[0049] Figure 3 yes Figure 2 Another structural diagram of the system shown. Detailed Implementation
[0050] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0051] It should be understood that, when used in this specification and the appended claims, the terms "comprising" and "including" indicate the presence of the described features, integrals, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or collections thereof.
[0052] The inventive concept of this application is to provide an abnormal data detection scheme for the industrial internet, construct a multi-source data acquisition system of edge + cloud nodes, realize standardized preprocessing of heterogeneous industrial data, construct a normal data feature model with multiple feature dimensions in combination with industrial business scenarios, and use an improved hybrid detection algorithm to realize multi-dimensional anomaly identification, thereby solving the problems of high false negative rate and poor adaptability of existing methods, and improving the accuracy, real-time performance and practicality of abnormal data detection in the industrial internet.
[0053] Please refer to Figure 1 This invention provides an abnormal data detection method for the industrial internet, which may include the following steps:
[0054] S1: Collect model data, construct and train a normal data feature model.
[0055] In practice, step S1 includes:
[0056] (1) Acquire model data based on the acquisition nodes and preprocess the model data.
[0057] The model data includes equipment operation data, network transmission data, business interaction data, and environmental perception data from the industrial production process.
[0058] In this embodiment, an industrial internet multi-source data acquisition node is constructed, which adopts an edge node + cloud node architecture. The edge node is deployed in the industrial field and realizes the short-range acquisition of equipment operation data (such as machine speed, feed rate, temperature, pressure), network transmission data (such as data packet size, transmission rate, link latency), business interaction data (production work order, process flow, material delivery), and environmental perception data (workshop temperature and humidity, dust concentration) through OPC UA and Modbus industrial communication protocol, with an acquisition frequency of 1Hz. The edge node uploads the acquired data to the cloud aggregation node through SSL / TLS encrypted transmission protocol, and the cloud node performs unified storage and aggregation of data.
[0059] Preprocessing of model data includes standardization (such as Z-score standardization), denoising (such as wavelet transform algorithm), missing value completion (such as K-nearest neighbor interpolation), and normalization, in order to remove duplicate values, invalid values and extreme values that exceed physical meaning in the data, and provide a data foundation for subsequent anomaly detection.
[0060] (2) Extract normal data features from the preprocessed model data according to the specific business scenarios and production process rules of the Industrial Internet.
[0061] In this embodiment, the normal data features include time-series features, correlation features, and business rule features. Their respective extraction methods are as follows:
[0062] Time series characteristics: Using the sliding window method (window size set to 60s) and Fourier transform, the time series trend, periodic change characteristics, abrupt change characteristics and stationarity characteristics of equipment operation data are extracted, such as the continuous change trend of CNC machine tool spindle speed and the periodic fluctuation characteristics every 10 minutes.
[0063] Correlation characteristics: Using mutual information method and Pearson correlation coefficient, correlation characteristics of equipment operation data, correlation characteristics of business interaction data of process flow and material distribution, and coupling characteristics of network transmission rate and business data interaction volume are extracted;
[0064] Business rule features: Hard constraint features are set based on the process thresholds of automotive parts manufacturing (such as CNC machine tool cutting temperature ≤80℃), equipment rated parameters (such as robot running speed ≤30r / min), network transmission protocol rules (such as data packet loss rate ≤1%), and business interaction logic (such as process flow must meet the sequence).
[0065] (3) Construct a normal data feature model adapted to different business scenarios based on the deep autoencoder and the normal data features.
[0066] (4) Use the model data to train and iteratively optimize the normal data feature model.
[0067] This step fully integrates the personalized needs of industrial business scenarios, extracts the core features of industrial data, and the deep autoencoder can effectively learn the feature distribution of normal data, providing a benchmark model for subsequent anomaly identification and solving the problem of existing models being out of touch with industrial business scenarios.
[0068] S2 acquires the data to be detected based on the acquisition nodes and preprocesses it.
[0069] In this embodiment, the aforementioned edge + cloud structure is used to collect the data to be detected, including equipment operation data, network transmission data, business interaction data, and environmental perception data during industrial production. Furthermore, the preprocessing of the data to be detected is described in step S1, and will not be repeated here.
[0070] S3, using a normal data feature model and a hybrid detection model to identify anomalies in the preprocessed data to be detected, and obtaining anomaly detection results.
[0071] The hybrid detection model employs an improved static threshold detection, dynamic density clustering detection, and CNN-LSTM deep learning detection algorithm.
[0072] In specific implementation, the preprocessed data to be detected is input into the normal data feature model to obtain the feature reconstruction result. The hybrid detection model is then used to identify anomalies in the static, dynamic, and time-series correlation of the feature reconstruction result to obtain the abnormal data detection result.
[0073] Specifically, this embodiment uses three algorithms to detect the data;
[0074] An improved static threshold detection method is used to calculate the mean and standard deviation of each data dimension in real time and compare them with the threshold. If they exceed the threshold, they are marked as abnormal data.
[0075] An improved DBSCAN dynamic density clustering detection method is adopted: an adaptive neighborhood radius and a minimum number of points (MinPts) are introduced. The adaptive neighborhood radius and the minimum number of points (MinPts) are automatically adjusted according to the local density of the data to cluster the data and mark outliers outside the cluster as preliminary abnormal data.
[0076] CNN-LSTM Deep Learning Detection: A CNN-LSTM model is constructed. The CNN network (2 convolutional layers + 1 pooling layer) extracts local spatial features of the data, and the LSTM network (2 hidden layers) captures long-term temporal dependency features of the data. Normal data is used as positive samples and labeled abnormal data such as device failure / network attack is used as negative samples to train the model. The abnormal probability value of the data is output. When the abnormal probability value is higher than 0.9, it is marked as preliminary abnormal data.
[0077] A weighted voting method was adopted, with the normal data feature model reconstruction error detection weight set to 0.4, the dynamic adaptive threshold detection weight set to 0.1, the improved DBSCAN clustering detection weight set to 0.2, and the CNN-LSTM detection weight set to 0.3. The fused anomaly judgment value was calculated, and when the anomaly judgment value was higher than 0.7, it was marked as preliminary abnormal data.
[0078] S4 performs graded judgment, manual review and machine cross-validation on the abnormal data detection results to determine the final abnormal data.
[0079] In practical implementation, anomaly classification standards are set based on different business scenarios of the Industrial Internet, including the deviation degree, impact scope, and business relevance of abnormal data. For example, a data deviation of <10% is classified as a Level 1 anomaly, 10% ≤ data deviation <30% as a Level 2 anomaly, and a data deviation >30% as a Level 3 anomaly. The anomaly detection results are classified and judged according to the anomaly classification standards to obtain the classification judgment results. At the same time, the anomaly data detection results are manually reviewed and cross-verified by machines in combination with the actual business rules of industrial production to eliminate false anomaly data caused by collection errors and temporary process adjustments, and to determine the final anomaly data.
[0080] S5 traces and locates the source of the final abnormal data, generates anomaly handling strategies, and pushes them to the industrial internet management and control platform.
[0081] In practical implementation, based on the device topology, data transmission links, and business process association maps of the Industrial Internet, feature tracing and path tracking are performed on the final abnormal data to locate the root cause of the abnormal data. Based on the anomaly classification results and root cause analysis conclusions, targeted anomaly handling strategies are generated and pushed to the Industrial Internet management and control platform. For example:
[0082] Level 1 Anomaly: Triggers an automatic early warning strategy, pushing early warning information to the mobile terminals of maintenance personnel, including the abnormal device, data type, and deviation degree, without requiring intervention in the production process;
[0083] Level 2 anomaly: Triggers an automatic intervention + manual review strategy. The management platform automatically issues instructions for network link optimization, device parameter fine-tuning, etc., and notifies maintenance personnel to go to the site for review to confirm the effect of the measures.
[0084] Level 3 Anomaly: Triggers an emergency shutdown + full-link control strategy, immediately disconnects the production link and network connection of the abnormal equipment, triggers a local emergency shutdown procedure in the workshop, locks the abnormal node, and has professional technicians conduct fault diagnosis and handling. Production can only be resumed after the handling is completed and verified.
[0085] This step achieves a deep integration of anomaly detection and control. Precise root cause tracing avoids blind handling, and the tiered handling strategy is adapted to anomalies of different severity, taking into account both the stability and safety of industrial production.
[0086] The advantages of implementing the information security protection method for industrial internet communication terminals provided in this embodiment of the invention are as follows:
[0087] 1. This invention constructs a multi-source data acquisition system with edge and cloud nodes, which is compatible with mainstream industrial communication protocols and can realize comprehensive and real-time acquisition of multi-source data from industrial Internet devices, networks, services, and environment. At the same time, it performs standardized preprocessing for the characteristics of heterogeneous industrial data, which effectively improves data quality and lays a solid data foundation for subsequent anomaly detection.
[0088] 2. This invention combines specific industrial business scenarios and production process rules to extract the temporal features, correlation features, and business rule features of data, and constructs a highly adaptable normal data feature model. This solves the problem of existing models being out of touch with industrial business scenarios, and can accurately learn the feature distribution of normal data, providing a reliable benchmark for anomaly identification.
[0089] 3. This invention employs an improved hybrid detection algorithm, which optimizes the traditional static threshold and DBSCAN clustering algorithm, and combines the CNN-LSTM deep learning algorithm with deep autoencoder reconstruction error detection. It achieves multi-algorithm fusion through weighted voting, taking into account the static, dynamic, temporal, and correlation characteristics of industrial data, significantly improving the accuracy of abnormal data detection and reducing the false negative and false positive rates.
[0090] 4. This invention integrates the classification, cross-validation, root cause tracing, and graded handling of abnormal data. It eliminates false anomalies through cross-validation of human and machine methods, achieves accurate root cause tracing based on digital twin topology maps, and generates targeted handling strategies according to the anomaly classification. This solves the problem of the disconnect between existing detection methods and control, and realizes a closed loop for the detection and handling of abnormal data in the industrial internet.
[0091] 5. This invention sets up iterative optimization steps for the model and detection system, feeding back the anomaly handling results and root cause analysis conclusions to the model. At the same time, it dynamically updates the detection system according to changes in the business scenarios, production processes, and network architecture of the Industrial Internet, so that the detection method can adapt to the dynamic changes of the Industrial Internet, ensuring the continuity and stability of the detection effect, and improving the versatility and adaptability of the method.
[0092] 6. The detection method of the present invention has strong real-time performance and simple operation. It can be seamlessly connected to the industrial Internet management and control platform. It is applicable to industrial control safety assessment, monitoring and control in various industrial fields such as automobile manufacturing, machinery processing, chemical industry and metallurgy. It provides important technical support for the safe and stable operation of the industrial Internet and has broad application prospects.
[0093] Based on the same inventive concept, embodiments of the present invention provide an abnormal data detection system for the industrial internet, comprising:
[0094] The model processing unit is used to collect model data and build and train normal data feature models.
[0095] The data acquisition unit is used to acquire data to be detected based on the acquisition nodes; the acquisition nodes adopt an architecture of edge nodes + cloud nodes, and the edge nodes are deployed in the industrial site; the data to be detected includes equipment operation data, network transmission data, business interaction data and environmental perception data in the industrial production process;
[0096] A preprocessing unit is used to preprocess the data to be detected;
[0097] An anomaly detection unit is used to identify anomalies in the preprocessed data to be detected by employing a normal data feature model and a hybrid detection model, and to obtain anomaly detection results.
[0098] The hybrid detection model employs an improved static threshold detection, dynamic density clustering detection, and CNN-LSTM deep learning detection algorithm.
[0099] Furthermore, the model processing unit is used for:
[0100] Model data is acquired based on the acquisition nodes and preprocessed; the model data includes equipment operation data, network transmission data, business interaction data and environmental perception data in the industrial production process.
[0101] Based on the specific business scenarios and production process rules of the Industrial Internet, normal data features are extracted from the preprocessed model data; the normal data features include time series features, correlation features, and business rule features.
[0102] Based on the deep autoencoder and the normal data features, a normal data feature model adapted to different business scenarios is constructed.
[0103] The model data is used to train and iteratively optimize the normal data feature model.
[0104] In specific implementation, the abnormal data detection unit is used for:
[0105] The preprocessed data to be detected is input into the normal data feature model to obtain the feature reconstruction result;
[0106] The hybrid detection model is used to identify anomalies in the feature reconstruction results by considering static, dynamic, and time-series correlations of the data, thereby obtaining abnormal data detection results.
[0107] Furthermore, as a preferred implementation of this application, the abnormal data detection system further includes a hierarchical judgment and verification unit, used for:
[0108] The anomaly detection results are classified and determined using an anomaly classification standard to obtain the classification results.
[0109] Simultaneously, the abnormal data detection results are manually reviewed and cross-verified by machine in accordance with the actual business rules of industrial production to determine the final abnormal data.
[0110] The anomaly classification standard is set based on different business scenarios of the industrial internet, including the deviation of abnormal data, the scope of impact, and the business relevance.
[0111] Furthermore, as a preferred implementation of this application, the data anomaly detection system further includes a source tracing and localization unit, used for:
[0112] Based on the device topology, data transmission links and business process association map of the Industrial Internet, the source of the final abnormal data is traced and located to obtain the root cause of the final abnormal data.
[0113] Based on the classification and judgment results and the root cause, an anomaly handling strategy is generated and pushed to the industrial internet management and control platform.
[0114] It should be noted that the specific workflow of this embodiment is described in the foregoing method embodiment section, and will not be repeated here.
[0115] Furthermore, such as Figure 3 As shown, another embodiment of the present invention provides another abnormal data detection system for the Industrial Internet, which may include: one or more processors 101, one or more input devices 102, one or more output devices 103, and a memory 104. The processors 101, input devices 102, output devices 103, and memory 104 are interconnected via a bus 105. The memory 104 is used to store a computer program, the computer program including program instructions, and the processor 101 is configured to invoke the program instructions to execute the method described in the above-described method embodiment.
[0116] It should be understood that, in this embodiment of the invention, the processor 101 may be a central processing unit (CPU), but it may also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor.
[0117] Input device 102 may include a keyboard, etc., and output device 103 may include a display (LCD, etc.), a speaker, etc.
[0118] The memory 104 may include read-only memory and random access memory, and provides instructions and data to the processor 101. A portion of the memory 104 may also include non-volatile random access memory. For example, the memory 104 may also store device type information.
[0119] In specific implementations, the processor 101, input device 102, and output device 103 described in the embodiments of the present invention can execute the implementation methods described in the embodiments of the information security protection method for industrial internet communication terminals provided by the present invention, which will not be repeated here.
[0120] Accordingly, embodiments of the present invention provide a computer-readable storage medium storing a computer program, the computer program including program instructions, which, when executed by a processor, implement the above-described information security protection method for industrial internet communication terminals.
[0121] The computer-readable storage medium can be an internal storage unit of the system described in any of the foregoing embodiments, such as the system's hard disk or memory. The computer-readable storage medium can also be an external storage device of the system, such as a plug-in hard disk, Smart Media Card (SMC), Secure Digital (SD) card, or Flash Card. Furthermore, the computer-readable storage medium can include both internal storage units and external storage devices. The computer-readable storage medium is used to store the computer program and other programs and data required by the system. The computer-readable storage medium can also be used to temporarily store data that has been output or will be output.
[0122] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.
[0123] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative. For instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed may be indirect coupling or communication connection through some interfaces, devices or units, or may be electrical, mechanical or other forms of connection.
[0124] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of the embodiments of the present invention, depending on actual needs.
[0125] Furthermore, the functional units in the various embodiments of this invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated units can be implemented in hardware or as software functional units. When using each module, user information is collected and stored only with the user's full authorization and in compliance with relevant laws and regulations, protecting the security and privacy of user data, and strictly prohibiting unauthorized access; data processing will be conducted within the scope stipulated by law and will not exceed the purpose and scope authorized by the user; at the same time, users have the rights to access, correct, delete, restrict processing, and refuse their personal data; and must strictly comply with applicable laws and regulations and conduct compliance reviews.
[0126] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.
[0127] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in the present invention, and these modifications or substitutions should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.
Claims
1. A method for detecting abnormal data in the Industrial Internet, characterized in that, include: Data to be detected is acquired based on the acquisition nodes; The data acquisition nodes adopt an edge node + cloud node architecture, with the edge nodes deployed at the industrial site; the data to be detected includes equipment operation data, network transmission data, business interaction data, and environmental perception data during the industrial production process. The data to be detected is preprocessed; Anomaly detection results are obtained by using a normal data feature model and a hybrid detection model to identify anomalies in the preprocessed data to be detected.
2. The abnormal data detection method for the Industrial Internet as described in claim 1, characterized in that, Before acquiring the data to be detected based on the acquisition node, the method further includes: Model data is acquired based on the acquisition nodes and preprocessed; the model data includes equipment operation data, network transmission data, business interaction data and environmental perception data in the industrial production process. Based on the specific business scenarios and production process rules of the Industrial Internet, normal data features are extracted from the preprocessed model data; the normal data features include time series features, correlation features, and business rule features. Based on the deep autoencoder and the normal data features, a normal data feature model adapted to different business scenarios is constructed. The model data is used to train and iteratively optimize the normal data feature model.
3. The abnormal data detection method for the Industrial Internet as described in claim 1 or 2, characterized in that, The preprocessing of the data to be detected and the model data includes standardization, noise reduction, missing value completion, and data normalization.
4. The abnormal data detection method for the Industrial Internet as described in claim 2, characterized in that, The hybrid detection model employs an improved static threshold detection, dynamic density clustering detection, and CNN-LSTM deep learning detection algorithm.
5. The abnormal data detection method for the Industrial Internet as described in claim 4, characterized in that, The abnormal data detection results are as follows: The preprocessed data to be detected is input into the normal data feature model to obtain the feature reconstruction result; The hybrid detection model is used to identify anomalies in the feature reconstruction results by considering static, dynamic, and time-series correlations of the data, thereby obtaining abnormal data detection results.
6. The abnormal data detection method for the Industrial Internet as described in claim 5, characterized in that, After obtaining the abnormal data detection results, the method further includes: The anomaly detection results are classified and determined using an anomaly classification standard to obtain the classification results. Simultaneously, the abnormal data detection results are manually reviewed and cross-verified by machine in accordance with the actual business rules of industrial production to determine the final abnormal data. The anomaly classification standard is set based on different business scenarios of the industrial internet, including the deviation of abnormal data, the scope of impact, and the business relevance.
7. The abnormal data detection method for the Industrial Internet as described in claim 6, characterized in that, After obtaining the abnormal data detection results, the method further includes: Based on the device topology, data transmission links and business process association map of the Industrial Internet, the source of the final abnormal data is traced and located to obtain the root cause of the final abnormal data. Based on the classification and judgment results and the root cause, an anomaly handling strategy is generated and pushed to the industrial internet management and control platform.
8. An abnormal data detection system for the industrial internet, characterized in that, include: The data acquisition unit is used to acquire the data to be detected based on the acquisition nodes; The data acquisition nodes adopt an edge node + cloud node architecture, with the edge nodes deployed at the industrial site; the data to be detected includes equipment operation data, network transmission data, business interaction data, and environmental perception data during the industrial production process. A preprocessing unit is used to preprocess the data to be detected; An anomaly detection unit is used to identify anomalies in the preprocessed data to be detected by employing a normal data feature model and a hybrid detection model, and to obtain anomaly detection results. The hybrid detection model employs an improved static threshold detection, dynamic density clustering detection, and CNN-LSTM deep learning detection algorithm.
9. The abnormal data detection system for the Internet as described in claim 8, characterized in that, It also includes a model processing unit, used for: Model data is acquired based on the acquisition nodes and preprocessed; the model data includes equipment operation data, network transmission data, business interaction data and environmental perception data in the industrial production process. Based on the specific business scenarios and production process rules of the Industrial Internet, normal data features are extracted from the preprocessed model data; the normal data features include time series features, correlation features, and business rule features. Based on the deep autoencoder and the normal data features, a normal data feature model adapted to different business scenarios is constructed. The model data is used to train and iteratively optimize the normal data feature model.
10. An information security protection device for an industrial internet communication terminal, characterized in that, The system includes a processor, an input device, an output device, and a memory, which are interconnected. The memory is used to store a computer program, which includes program instructions. The processor is configured to invoke the program instructions to perform the method as described in any one of claims 1-9.