A real-time data anomaly detection method fusing time series analysis

Abstract

This invention relates to the field of data processing technology and discloses a real-time data anomaly detection method integrating time series analysis. The method includes: acquiring a high-frequency target time series signal and a low-frequency operating condition feature vector; generating a synchronization operating condition vector using mask dimensionality reduction and zero-order preservation mechanisms; generating a steady-state and transient composite hash key through hash mapping and comparison; reconstructing the high-frequency signal and constructing a high-dimensional state trajectory matrix; determining the routing query key based on the hash key; extracting benchmark features from the dictionary when a match is found; performing regularization on the sample covariance matrix using a noise floor parameter; and projecting the sample onto the tangent space to calculate anomaly metrics for anomaly determination; and calculating incremental benchmark features and updating the dictionary when a match is not found and the physical continuity and manifold stability conditions are met. This invention solves the multi-rate data synchronization problem, reduces hardware noise interference and calculation errors in direct ranging in non-Euclidean geometric space, and enables online learning of new operating conditions without requiring system downtime for retraining.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, specifically to a real-time data anomaly detection method that integrates time series analysis. Background Technology

[0002] In equipment operation monitoring, it is typically necessary to collect data from multiple sensors for status analysis. Sensor data usually have different sampling frequencies, such as high-frequency time-series signals and low-frequency operating parameters. For multi-rate mixed sampling data, conventional methods struggle to achieve synchronous alignment on the time axis, and data misalignment directly affects the accuracy of subsequent status determination.

[0003] In feature extraction of device states, high-dimensional state trajectory matrices and covariance matrices are often used to characterize the system state of multi-dimensional signals. Background electrical noise from the underlying hardware can be superimposed on the original data, interfering with the construction of the feature matrix. Furthermore, the covariance matrix belongs to a non-Euclidean geometric space, and some anomaly detection algorithms directly apply Euclidean distance for similarity measurement. Direct distance measurement in a non-flat space can introduce measurement bias, reducing the accuracy of anomaly measurement calculations.

[0004] The operating conditions of equipment are often dynamic. When the system enters a new operating condition that has not been pre-recorded, the original anomaly detection model, lacking corresponding baseline features, is prone to misjudging the normal new state as an abnormal state. Existing processing methods mostly rely on manual intervention, requiring shutdown to re-collect data and perform offline updates to the feature library and model retraining. They cannot automatically identify new states and update feature baselines while the equipment is running continuously, and are not suitable for the real-time monitoring needs of dynamic operating environments. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention provides a real-time data anomaly detection method that integrates time-series analysis. This method solves the problems of existing anomaly detection methods, such as difficulty in synchronizing and aligning multi-rate mixed data, calculation errors in ranging of non-Euclidean space feature matrices, and high false alarm rates due to the inability to incrementally learn new operating conditions online.

[0006] To achieve the above objectives, the present invention provides the following technical solution:

[0007] This invention provides a real-time data anomaly detection method that integrates time series analysis, comprising the following steps:

[0008] The high-frequency target time-series signal, low-frequency operating condition feature vector, quantization noise floor parameter and binarization mask vector are obtained. The low-frequency operating condition feature vector is reduced in dimensionality using the binarization mask vector to generate the master control operating condition vector, and then upsampled to generate the synchronization operating condition vector.

[0009] A steady-state hash key is generated by hash mapping the synchronous operating condition vector, and a transient composite hash key is generated by comparing the steady-state hash keys of adjacent time steps.

[0010] Based on the delay time and embedding dimension, coordinate delay operation is performed on the high-frequency data stream sequence obtained by converting the high-frequency target time series signal to construct the reconstructed phase space state vector, and a high-dimensional state trajectory matrix is ​​constructed by sliding the time window.

[0011] The routing query key is determined based on the steady-state hash key or the transient composite hash key. If the routing query key is matched, the baseline feature parameters are extracted from the dictionary data structure.

[0012] Calculate the sample covariance matrix of the high-dimensional state trajectory matrix, use the quantization noise floor parameter to regularize the sample covariance matrix, and combine the benchmark feature parameters to calculate the anomaly metric value to determine the anomaly.

[0013] When the routing query key is not matched and the continuity and stability evaluation conditions are met, the incremental baseline characteristic parameters are calculated, and the new operating condition candidate key and the incremental baseline characteristic parameters are stored in the dictionary data structure.

[0014] During the data acquisition and synchronization condition vector generation process, the low-frequency condition feature vector and the binarized mask vector are multiplied element-wise using logical multiplication. The condition parameters corresponding to a mask weight value of 1 are retained, while the condition parameters corresponding to a mask weight value of 0 are set to zero and truncated, generating the master control condition vector. Subsequently, upsampling is performed through a zero-order hold mechanism, using the sampling clock of the high-frequency target timing signal as the global reference time axis. When low-frequency condition parameter data with a new global timestamp is received, the master control condition vector value at the corresponding time is assigned to the corresponding high-frequency time step. The master control condition vector value from the previous time step is shifted and copied between two adjacent low-frequency communication update cycles and filled into all high-frequency time steps between two adjacent low-frequency communication update cycles.

[0015] In the process of generating steady-state and transient composite hash keys, the value of each physical quantity in the synchronous operating condition vector is divided by a set engineering tolerance step size and rounded down to obtain discrete grid coordinates. These coordinates are then input into a local sensitive hash function and mapped to scalar values, serving as the steady-state hash key for the current time step. The engineering tolerance step size is set according to the equipment's factory design specifications or the confidence interval of historical steady-state operating data extracted from the equipment. If the steady-state hash key of the current time step differs from that of the previous time step, the source steady-state hash key before the flip and the target steady-state hash key after the flip are extracted and concatenated using a binary left shift operation and a bitwise XOR operation to generate a transient composite hash key.

[0016] When constructing the high-dimensional state trajectory matrix, the mutual information method is used to find the first local minimum of the mutual information value as the delay step increases, determining the delay time. The maximum delay search step size ranges from 50 to 100 sampling periods. The false nearest neighbor method is used to calculate the relative change rate of the spatial Euclidean distance between adjacent points as the phase space dimension increases. Points with a relative change rate greater than a spatial distance change rate threshold between 10 and 15 are identified as false nearest neighbors. When the percentage of false nearest neighbors is below a threshold of 5%, the final embedding dimension is determined. Based on the determined delay time and embedding dimension, the high-frequency data stream is reconstructed into a phase space state vector, and then concatenated column-wise according to the chronological order of occurrence within a time sliding window to generate a two-dimensional real matrix that serves as the high-dimensional state trajectory matrix. The process of determining the routing query key is as follows: the hash key sequence within the window is extracted, and the hash key value with the highest frequency is determined as the unique routing query key for that time sliding window.

[0017] In the process of calculating anomaly metrics to determine anomalies, the sample covariance matrix of the high-dimensional state trajectory matrix is ​​calculated, and a quantization noise floor parameter is superimposed on the main diagonal for regularization. The quantization noise floor parameter is obtained by either a hardware static calibration method that collects background electrical noise for 1 to 5 seconds to calculate the variance value, or a physical resolution derivation method that calculates the voltage resolution value by dividing the full-scale input voltage value of the analog-to-digital converter by the power of the conversion bit width of the value two.

[0018] When the routing query key is a steady-state hash key, the regularized current time-step covariance matrix and the baseline covariance matrix are projected onto a flat tangent space using matrix logarithm operations. The Frobenius norm in the tangent space is calculated to generate a steady-state anomaly metric, which is then compared with a steady-state anomaly threshold. The steady-state anomaly threshold is a specific value set using the three-sigma criterion based on Gaussian distribution or the 99th quantile of kernel density estimation. When the routing query key is a transient composite hash key, the covariance matrix is ​​calculated and regularized within the transient transition window, forming a regularized current time-step covariance matrix sequence. This sequence is then aligned with a fixed number of data points using a dynamic time warping algorithm or a linear interpolation resampling method to the baseline transition trajectory sequence extracted from historical normal operating conditions. The Frobenius norm of the projection of the aligned current time step covariance matrix and the reference covariance matrix onto the tangent space is calculated point by point. The deviation values ​​within the entire transient transition window are summed and averaged to generate a transient anomaly metric. This metric is then compared with the transient anomaly threshold, which is set by extracting the probability density function of the normal trajectory deviation sample set constructed using the kernel density estimation method and extracting the critical value corresponding to the cumulative probability distribution reaching 95%.

[0019] When a routing query key is not matched and the continuity and stability assessment conditions are met, an observation interval containing a fixed number of time sliding windows is opened. The most frequently occurring unmatched routing query key within the observation interval is counted. If the proportion of the most frequently occurring unmatched routing query key to the total number of windows in the observation interval exceeds the consistency threshold of 90% or 95%, the continuity test is passed and the stability assessment begins. The Riemann geometric mean matrix corresponding to the observation interval is calculated. The sample covariance matrix and the Riemann geometric mean matrix are projected onto the tangent space using matrix logarithm operations to calculate the manifold distribution divergence. The manifold distribution divergence is compared with a stability divergence threshold, which is between 1.2 and 1.5 times the maximum value of the historical distribution divergence or the maximum value among the historical distribution divergences. When the manifold distribution divergence is below this threshold, the most frequently occurring unmatched routing query key is set as a candidate key for the new operating condition, triggering the online baseline learning window. Within the online baseline learning window, multiple regularized sample covariance matrices are obtained and projected onto a flat tangent space to calculate the arithmetic mean. Then, the matrix exponent is mapped back to the manifold space to generate incremental baseline feature parameters. The load factor of the current dictionary data structure is calculated. If it exceeds the expansion threshold between 0.70 and 0.85, a new contiguous address space is allocated, and the key-value pairs in the dictionary data structure are rehashed and migrated. The new working condition candidate keys and incremental baseline feature parameters are then inserted as key-value pairs into the expanded dictionary data structure.

[0020] This invention provides a real-time data anomaly detection method that integrates time-series analysis. It has the following beneficial effects:

[0021] 1. This invention aligns low-frequency operating condition characteristics with high-frequency time-series signals along the time axis through binarization mask dimensionality reduction and zero-order hold upsampling mechanism, and generates steady-state and transient composite hash keys using locality-sensitive hashing and bitwise operations. These steps solve the synchronization problem of multi-rate mixed sampling data, reducing data dimensionality while enabling direct addressing and mode differentiation of device operating status.

[0022] 2. In the feature measurement stage, this invention introduces a quantization noise floor parameter to perform diagonal regularization on the sample covariance matrix of the high-dimensional state trajectory matrix, and projects the covariance matrix into the tangent space of the Riemannian manifold to calculate the Frobenius norm. This process reduces the interference of underlying hardware noise on matrix feature extraction, avoids calculation bias caused by direct ranging in non-Euclidean geometric space, and improves the accuracy of anomaly detection.

[0023] 3. This invention designs an incremental update logic for unknown states. When the routing query key is not matched, physical continuity checks and manifold stability assessments are performed sequentially. For the sample set that meets the conditions, incremental baseline feature parameters are generated through tangent spatial mean operation and matrix exponential mapping, and then updated to the key-value pair dictionary data structure. Through the above steps, the system can identify and learn new operating conditions online without offline retraining, meeting the detection requirements of dynamic operating environments. Attached Figure Description

[0024] Figure 1 This is a schematic diagram of the method flow of the present invention;

[0025] Figure 2 This is a schematic diagram of the system architecture of the present invention;

[0026] Figure 3 This is a curve showing the evolution of the abnormal measurement values ​​of the present invention over time.

[0027] Figure 4 This is a bar chart showing the comprehensive performance evaluation of anomaly detection in this invention. Detailed Implementation

[0028] The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0029] Please see the appendix Figure 2 This invention provides a real-time data anomaly detection system that integrates time-series analysis, comprising:

[0030] The data acquisition module is used to simultaneously acquire high-frequency target timing signals and low-frequency operating parameters of rotating machinery, and to obtain the quantization noise floor parameters of the analog-to-digital converter.

[0031] The operating condition hash mapping module is used to discretize the dimensionality-reduced low-frequency operating condition parameters and generate steady-state hash keys. By comparing the steady-state hash key states at different times, a transient composite hash key is generated to characterize the operating condition switching process.

[0032] The phase space reconstruction module is used to map high-frequency target time-series signals to a high-dimensional phase space according to the set embedding dimension and time delay, and construct a state trajectory matrix.

[0033] The anomaly measurement module is used to perform address lookups in the key-value pair in-memory database based on the type of hash key, and to perform anomaly measurement calculations for the corresponding mode.

[0034] The incremental update module is used to calculate the statistical characteristics of the current phase space reconstructed point set when the current hash key is not found in the in-memory database, and insert it as a new key-value pair into the in-memory database.

[0035] Please see the appendix Figure 1 This invention provides a real-time data anomaly detection method that integrates time-series analysis. The method is executed by the aforementioned system and includes the following steps:

[0036] S1, Real-time Acquisition and Time Alignment of Multidimensional Heterogeneous Data. The data acquisition module obtains high-frequency vibration data sequences and low-frequency operating condition feature vectors during equipment operation. A zero-order hold is used to upsample the low-frequency operating condition feature vectors, ensuring their time resolution matches that of the high-frequency vibration data sequences, thus achieving timestamp synchronization of the heterogeneous data.

[0037] S2, Dimensionality Reduction Mapping and Two-State Hash Key Generation Based on Prior Mask. The operating condition hash mapping module uses a set binary mask vector to perform logical multiplication on the aligned low-frequency operating condition feature vector to remove redundant dimensions. The dimensionality-reduced vector is quantized and binned, and a steady-state hash key for the current time step is generated using the Locality Sensitive Hashing (LSH) algorithm. The steady-state hash key for the current time step is compared with that for the previous time step; if they are inconsistent, a transient composite hash key is generated through a bitwise XOR operation.

[0038] S3, High-frequency time-series signal phase space reconstruction. The phase space reconstruction module maps the one-dimensional high-frequency vibration data sequence obtained in step S1 into a set of state trajectory points in a high-dimensional phase space based on the given time delay and embedding dimension.

[0039] S4, a dual-mode routing anomaly measurement based on diagonal regularization. The anomaly measurement module uses the generated hash key as an index to address the in-memory database. When the current hash key is a steady-state hash key, it calls the steady-state baseline parameters in the database, combines them with the quantization noise floor parameters to construct a regularized covariance matrix, and calculates the Mahalanobis distance from the real-time state trajectory point to the baseline centroid to determine steady-state anomalies. When the current hash key is a transient composite hash key, it extracts the actual transition trajectory vector within the transient transition window, calculates the cosine similarity and magnitude difference between the actual transition trajectory vector and the benchmark transition trajectory vector in the database, and determines transient anomalies during the trajectory change phase.

[0040] S5, Incremental Online Expansion of the Deterministic Dictionary. When a hash key from step S4 fails to be addressed in the in-memory database, the incremental update module establishes a learning window to cache the reconstructed point set of the normal phase space. For steady-state hash keys, the expected value and covariance matrix of the point set are calculated; for transient composite hash keys, the actual transition trajectory vector is calculated. The calculation results are then bound to the missed hash keys and stored in the in-memory database.

[0041] The data acquisition module performs the acquisition and noise floor extraction of high-frequency target time-series signals. This process specifically includes the following steps:

[0042] Sensor nodes perceive the operating status of rotating machinery and generate simulated high-frequency target time-series signals. These signals characterize the nonlinear dynamic state of the equipment during operation. Specifically, the real-time data anomaly detection system uses physical sensors deployed on the bearing housings or casing surfaces to collect vibration data. Specific sensor types include piezoelectric accelerometers, eddy current displacement sensors, or magnetoelectric velocity sensors. The sensors convert the physical deformation or motion of the machinery into continuous voltage or current signals in real time, serving as the foundational data for subsequent extraction of dynamic characteristics.

[0043] Continuous voltage or current signals are conditioned and discretized to generate a high-frequency data stream sequence. After receiving the continuous signal, the signal conditioning circuit performs anti-aliasing processing using a hardware low-pass filter to filter out high-frequency interference components above the Nyquist frequency. The selection of the low-pass filter and the calculation of its cutoff frequency can be conventionally configured by those skilled in the art based on actual measurement requirements and the Nyquist theorem. The anti-aliasing filtering process is well-known in the field and will not be elaborated upon here.

[0044] An analog-to-digital converter (ADC) performs periodic sampling and amplitude quantization on the filtered signal at a fixed sampling frequency, converting a continuous-time signal into a discrete digital signal. Let the continuous analog signal output from the sensor be... ,in Representing a continuous-time variable, the sampling frequency configured for the analog-to-digital converter is... After discretization, a one-dimensional high-frequency data stream sequence is generated. ,in The time step number indicates the number of the time steps on the timeline. Discrete sampling points, Indicates the first The digital amplitude corresponding to each discrete sampling point.

[0045] Extracting the quantization noise floor parameter from the data acquisition channel. During data acquisition in industrial settings, the discretized high-frequency data stream sequence contains a fundamental noise component due to limitations in the resolution of the analog-to-digital conversion circuit and environmental thermal noise. When rotating machinery is in a state of pure periodic harmonic motion, its trajectory in phase space exhibits a closed loop, causing the directly calculated covariance matrix to often be incomplete and invertible. By obtaining this quantization noise floor parameter and superimposing it onto the diagonal of the covariance matrix, a regularization supplement can be provided to ensure the covariance matrix is ​​full rank. The data acquisition module obtains this quantization noise floor parameter through the underlying interface of the edge computing node.

[0046] The data acquisition module obtains the quantization noise floor parameter through two methods: hardware static calibration and physical resolution derivation. When using hardware static calibration, the data acquisition module collects background electrical noise data sequences within a preset time window under static conditions where the rotating machinery is stopped and disconnected from the power grid. The length of this preset time window is determined based on the sampling frequency of the analog-to-digital converter, ranging from 1 to 5 seconds to ensure that a dataset containing at least several thousand sampling points is collected, meeting the sample size requirement for calculating the statistical characteristics of the background noise. The data acquisition module calculates the variance of the data within this time window and uses this variance as the quantization noise floor parameter.

[0047] When using the physical resolution derivation method, the data acquisition module reads the hardware configuration register of the analog-to-digital converter (ADC) chip to obtain the full-scale input voltage value and the conversion bit width parameter. The data acquisition module performs a division operation with the full-scale input voltage value as the numerator and the conversion bit width raised to a power of two as the denominator to calculate the voltage resolution value corresponding to the least significant bit of the ADC. This voltage resolution value is then used as the quantization noise floor parameter.

[0048] Edge computing nodes denote the quantization noise floor parameter obtained through any of the above methods as a constant. ,in This represents the basic noise energy level or minimum resolvable level of the acquisition channel and is stored in local memory for subsequent use by the anomaly measurement module.

[0049] The data acquisition module and the operating condition hash mapping module work together to perform the acquisition of low-frequency operating condition parameters and the mask dimensionality reduction operation. This process specifically includes the following steps.

[0050] The system reads multi-dimensional low-frequency operating parameters of the equipment in real time from the communication bus of the industrial control system to construct a low-frequency operating condition feature vector. Specifically, the real-time data anomaly detection system synchronously extracts multiple physical quantities characterizing the macroscopic operating state of the equipment from the registers of the programmable logic controller (PLC) using industrial standard communication protocols such as ModbusTCP, PROFINET, or OPCUA. The collected physical quantities include the equipment's commanded rotational speed, actual rotational speed, set load rate, torque, and temperature at each node. Let the data acquisition module be located at the corresponding time step number... Collected from Several low-frequency physical quantities are combined to form a low-frequency operating condition feature vector. :

[0051] ;

[0052] in, Indicates the time step number The corresponding original multidimensional low-frequency operating condition feature vector; Indicates the sequence number of the discrete time step; This represents the total number of dimensions of the low-frequency operating condition parameters; Indicates the time step number The value of the physical quantity corresponding to the first specific working condition; Indicates the time step number The corresponding value of the physical quantity for the second specific working condition; Indicates the time step number The corresponding number The numerical value of a physical quantity under a specific working condition; This represents the transpose operation of a vector.

[0053] Load a binary mask vector configured based on engineering prior logic. In the actual operation of mechanical systems, there are linkages and coupling relationships between multidimensional control parameters, and some parameters exhibit delayed passive responses, not playing a decisive role in the instantaneous nonlinear dynamic state of the equipment. For example, the wind speed and rotor speed of a wind turbine are highly coupled, while the bearing temperature is a slowly changing delayed variable. If all... The dimensional parameters are directly input into the subsequent discretization and hash mapping stages. Even minute temperature fluctuations or sensor drifts, which have no direct dynamic impact, can trigger hash key flips, causing exponential expansion of the hash key state space and leading to memory overflow. The data acquisition module pre-resides with a binary mask vector in its local memory based on the device's control logic. :

[0054] ;

[0055] in, The total number of representative dimensions is The binary mask vector; This represents the total number of dimensions of the low-frequency operating condition parameters; This represents the transpose operation of a vector; This represents the mask weight value corresponding to the first physical quantity; This represents the mask weight value corresponding to the second physical quantity; Representing the The mask weight values ​​corresponding to each physical quantity are limited to a set. .when When, it indicates that the physical quantity is an independent master variable that determines the dynamic state of the equipment; when When the value is specified, it indicates that the physical quantity is a redundant variable or a dynamically coupled variable. For determining the specific value of the mask weight, those skilled in the art can use principal component analysis to extract the variance contribution rate from historical operating data, retain the core physical quantities whose variance contribution rate is greater than a set threshold (e.g., 90%), and set the mask weight value corresponding to the core physical quantities to 1, while setting the rest to 0. Alternatively, manual static calibration configuration can be performed directly in conjunction with the physical control mechanism of the mechanical equipment. Principal component analysis and parameter dimensionality reduction are well-known techniques in this field and will not be elaborated upon here.

[0056] Perform a mask dimensionality reduction operation and output the dimensionality-reduced master control operating condition vector. The data acquisition module will then read the low-frequency operating condition feature vector. With binary mask vector Element-wise logical multiplication, i.e., Hadamard product operation, is performed. During the operation, the operating parameters corresponding to a mask weight value of 1 are retained, while the operating parameters corresponding to a mask weight value of 0 are set to zero. The data acquisition module performs a truncation and elimination operation on the zeroed-out dimensions, and reassembles the remaining parameters in order to generate the dimensionality-reduced master control operating vector. .

[0057] Through this masking dimensionality reduction mechanism, the data acquisition module ensures that only core operating parameters that have a substantial impact on the dynamic topology are retained. The dimensionality-reduced master control operating vector... The dimension is denoted as And the dimension values ​​satisfy The main control operating condition vector The output is sent to the condition hash mapping module as the basic data source for generating status hash keys.

[0058] The data acquisition module implements a zero-order hold time alignment mechanism to solve the timestamp misalignment problem caused by inconsistent sampling rates between high-frequency target timing signals and low-frequency operating parameters.

[0059] In actual industrial settings, the analog-to-digital conversion sampling frequency of high-frequency target timing signals reaches kilohertz or even 10,000 Hz, while low-frequency operating parameters are limited by the bus communication bandwidth and physical response cycle of the industrial control system, with update frequencies typically ranging from hundreds of milliseconds to seconds. Due to the difference in arrival times between high-frequency and low-frequency data, the reduced master control operating vector appears discrete and sparse on the time axis. Without time alignment, the real-time data anomaly detection system cannot establish a mapping relationship between transient high-frequency dynamic characteristics and low-frequency macroscopic operating conditions. From the perspective of the actual control mechanism of the physical system, the operating control commands issued by the programmable logic controller, such as setting the speed or load, maintain a constant output between two communication cycles. Therefore, using conventional interpolation algorithms not only consumes the computing resources of edge computing nodes but also introduces fluctuation artifacts that do not conform to the actual physical control state of the equipment.

[0060] To eliminate phase differences caused by inconsistent sampling rates in heterogeneous data, the data acquisition module employs zero-order hold logic to perform a step-up upsampling transformation on the dimensionality-reduced master control condition vector. Specifically, the data acquisition module utilizes the hardware real-time clock of the edge computing node to assign a unified global timestamp to both the high-frequency target timing signal and the low-frequency condition parameters it receives. The data acquisition module uses the sampling clock of the high-frequency target timing signal as the global reference time axis. On this reference time axis, when low-frequency condition parameter data with a new global timestamp is received, the data acquisition module assigns the master control condition vector value at that moment to the corresponding high-frequency time step. Between two adjacent low-frequency communication update cycles, the data acquisition module maintains the master control condition vector value from the previous moment unchanged, directly shifts and copies this value, and fills it into all high-frequency time steps within that time interval.

[0061] Let the analog-to-digital conversion sampling frequency of the high-frequency target timing signal be... The corresponding high-frequency discrete time step number is Let the set of timestamps for updating the master control operating condition vector of the industrial control system be . Through a zero-order hold mechanism, the data acquisition module generates a synchronization condition vector sequence that is strictly consistent with the high-frequency time resolution. The alignment mapping relationship satisfies the following condition equation:

[0062] ;

[0063] in, Indicates the time step number The corresponding synchronous operating condition vector; Indicates the timestamp The master control operating condition vector is collected and reduced in dimension at all times; Indicates the first The arrival time of parameters under the second lowest frequency operating condition; Indicates the sequence number of the discrete time step; The analog-to-digital conversion sampling frequency represents the sampling frequency of the high-frequency target timing signal; Indicates the first The arrival time of parameters under the second lowest frequency operating condition; This indicates the time when the low-frequency operating condition parameter arrives for the 0th time; Indicates the time when the first low-frequency operating condition parameter arrives; This indicates the sequence number of times the low-frequency operating condition parameter is reached, and its value range is a non-negative integer.

[0064] By employing zero-order hold-time alignment, the data acquisition module ensures that the high-frequency target timing signal corresponding to each time step has a strictly time-synchronized operating condition vector. This mechanism utilizes the data hold-time characteristics of hardware registers, avoiding the processor computation latency introduced by conventional linear interpolation or polynomial spline interpolation algorithms. Regarding the underlying clock interrupt allocation and hardware timer configuration involved in the timestamp synchronization mechanism, those skilled in the art can perform conventional adaptation based on the underlying system architecture of the selected edge computing node. The underlying hardware clock synchronization processing is a well-known technology in the field and will not be elaborated upon here.

[0065] The operating condition hash mapping module receives the synchronized operating condition vector after zero-order hold-time alignment and performs discretization and steady-state hash key generation operations based on engineering tolerance. This process specifically includes the following steps.

[0066] Configure and load the engineering tolerance step size for the master control operating parameters. In the actual operating environment of a mechanical system, the operating parameters driven by the closed-loop controller, while maintaining a certain target state, are limited by the adjustment dead zone of the control algorithm and the inherent clearance of the mechanical system, resulting in slight deviations in their values ​​within the allowable fluctuation range. These slight numerical fluctuations do not represent a substantial shift in the macroscopic operating state of the equipment. To transform the continuous physical parameter space of operating conditions into a deterministic discrete state space that can be quickly indexed by a computer, the operating condition hash mapping module configures a corresponding engineering tolerance step size for each dimension of the master control operating parameter after dimensionality reduction. The specific value range of this engineering tolerance step size can be directly obtained from the equipment's factory design specifications or set by extracting the confidence interval of the equipment's historical steady-state operating data. For example, the tolerance step size for the set rotational speed can be configured as 10 revolutions per minute, and the tolerance step size for the load rate can be configured as 5%.

[0067] Quantization binning is performed to generate discrete grid coordinates. The load condition hash mapping module inputs the acquired synchronous load condition vector into the quantization binning function. Specifically, the load condition hash mapping module divides the value of each physical quantity in the synchronous load condition vector by the corresponding engineering tolerance step size and performs a floor operation on the division result. Through this operation, the load condition hash mapping module divides the continuous load condition parameter space into discrete hyperrectangular grids. Small changes in parameters within the same grid are normalized to the same grid coordinate values, thereby eliminating the risk of state space explosion caused by sensor measurement noise and steady-state adjustment jitter in the control system. This binning operation physically isolates and extracts the load condition feature space, forcibly anchoring floating parameters belonging to the same steady-state operating point to a unique discrete coordinate.

[0068] Locality-Sensitive Hash (LSH) mapping is performed to generate a steady-state hash key for the current time step. The load condition hash mapping module calls the LSH function to process the discrete grid coordinates output by the quantization binning operation, compressing and mapping their high-dimensional features into a single scalar value. The computational logic of this process satisfies the following formula:

[0069] ;

[0070] in, Indicates the time step number The corresponding steady-state hash key; Represents a locality-sensitive hash function; Represents the quantization binning function; Indicates the time step number The corresponding synchronous operating condition vector; Indicates the sequence number of the discrete time step.

[0071] Locality-Sensitive Hash Functions (LSHFCs) possess the physical characteristic of maintaining spatial locality, meaning that discrete coordinates of the same working condition that are close in distance in the original high-dimensional space have a higher probability of colliding and generating the same scalar value after hash mapping. Through the above calculations, the working condition hash mapping module associates a specific scalar index value with each high-frequency time step; this scalar index value is the steady-state hash key. This steady-state hash key serves as the primary key of the key-value pair data structure in the in-memory database, enabling subsequent baseline parameter extraction operations to have constant-level time complexity and reducing the addressing overhead of edge computing nodes. For the specific hash family construction and mapping operations of LSHFCs, those skilled in the art can use existing algorithms such as p-stable distributed hashing or locality-sensitive cosine hashing for configuration. The hash mapping processing of high-dimensional vectors is a well-known technique in this field and will not be elaborated upon here.

[0072] After generating the steady-state hash key for the current time step, the working condition hash mapping module performs the working condition state reversal identification and transient composite hash key construction operation, which specifically includes the following:

[0073] The system extracts the steady-state hash keys from the continuous time series for state comparison. A sliding comparison buffer is allocated in memory. At each high-frequency discrete time step clock tick, the steady-state hash key corresponding to the current time step number is compared with the steady-state hash key corresponding to the previous physical time step. In the actual operation of mechanical equipment, the equipment relies on rotor inertia, and changes in its internal dynamic characteristics often lag behind changes in operating condition commands. When the industrial control system issues a change in operating condition command or when the external load changes abruptly, the master control operating condition parameters cross the preset engineering tolerance boundary, causing changes in the quantization bin coordinates, which in turn triggers a jump in the value of the steady-state hash key. The operating condition hash mapping module continuously monitors these hash value jump events to define the boundary between the steady-state and transient states of the equipment.

[0074] The system defines the conditions for reversing the operating state and triggers a transient transition window. When the steady-state hash key of the current time step is the same as that of the previous time step, the operating state hash mapping module determines that the equipment is in a stable operating range and continues to use the current steady-state hash key as the index primary key. When the two values ​​are not equal, the operating state hash mapping module determines that the equipment has experienced an operating state reversal, that is, the physical operating state of the equipment has deviated from the source steady-state operating point and entered a trajectory transition phase of migrating to the target steady-state operating point. Due to the inertial damping characteristics of the physical system, this trajectory transition phase is represented as a continuous transient transition window on the time axis. The operating state hash mapping module pre-configures the duration of this transient transition window based on historical variable operating condition experimental data or the step response time of the mechanical system transfer function. Specifically, technicians can extract the historical variable operating condition step response curve of the equipment and set the time required for the parameters to reach and remain within the tolerance band of the new steady-state value (e.g., 95% steady-state recovery time) as the window length; or, in the absence of a priori models, directly set the duration to an empirical fixed value of 3 to 5 seconds. During this time period, the operating condition hash mapping module switches to the regular steady-state baseline comparison logic.

[0075] For high-frequency time-series data within the transient transition window, a transient composite hash key is generated to characterize the transient trajectory change path. Since a single steady-state hash key cannot characterize the dynamic transition process between two different steady states, and the dynamic evolution trajectory from the source state to the target state is asymmetric in phase space with the dynamic evolution trajectory from the target state back to the source state, a unique deterministic index is assigned to this directional transition process. The operating condition hash mapping module extracts the source steady-state hash key before the flip and the target steady-state hash key after the flip, and concatenates them through bitwise operations to generate the transient composite hash key. The computational logic of this process satisfies the following formula:

[0076] ;

[0077] in, Indicates the time step number The corresponding transient composite hash key; This represents the source steady-state hash key before the change in operating conditions occurred; This represents the target steady-state hash key after the change in operating conditions occurs; This represents the binary left shift operator; This indicates the set number of bits for left shift; This represents the bitwise XOR operator; Indicates the index of the discrete time step. (This refers to the number of bits used for left shift.) The specific value is allocated by the working condition hash mapping module according to the total bit width of the edge computing node processor architecture. In a 32-bit integer variable system, The value is configured to be 16 to ensure that the source hash key and the target hash key occupy separate bit ranges.

[0078] By introducing a binary left shift operation, the working condition hash mapping module eliminates the commutative interference caused by simple bitwise XOR operations, ensuring that the generated transient composite hash key has strict direction sensitivity. This transient composite hash key serves as the index key for memory database addressing during the transient transition window, guiding subsequent modules to call the transient-specific baseline transition trajectory vector. For the calls to the underlying bitwise operation instructions and register shift operations, those skilled in the art can perform conventional compilation configuration based on the instruction set architecture of the selected microprocessor. The underlying binary logic operations are well-known technologies in the field and will not be elaborated upon here.

[0079] The phase space reconstruction module receives the high-frequency data stream sequence output by the data acquisition module and performs the operation of determining the delay coordinate embedding parameters. This process specifically includes the following:

[0080] The process involves acquiring high-frequency data stream sequences and determining their delay times. A one-dimensional high-frequency data stream sequence is a projection of a high-dimensional mechanical dynamic system onto a single physical measurement direction; its time series itself cannot reveal the nonlinear dynamic topology within the system. To reconstruct the phase space based on existing nonlinear dynamic system theory, the phase space reconstruction module calculates two delay coordinate embedding parameters: delay time and embedding dimension. For determining the delay time, the phase space reconstruction module uses mutual information to quantify the nonlinear information correlation between the original high-frequency time series data and the delayed data. Specifically, the phase space reconstruction module sets a maximum delay search step size, configured to range from 50 to 100 sampling periods. This step size range is pre-estimated by technicians based on the typical rotational frequency of the mechanical equipment, ensuring the search range covers at least one complete mechanical motion cycle. Within the maximum search step size, the phase space reconstruction module calculates the mutual information values ​​between the high-frequency data stream sequence and its delayed translation sequence one by one. The phase space reconstruction module iterates through the calculation results, searching for the first local minimum of the mutual information value as the delay step size increases. The phase space reconstruction module determines the delay time as the number of delay steps corresponding to the first local minimum. At this point, the coordinates in each dimension reconstructed by the system maintain information independence, eliminating coordinate information redundancy caused by excessively short delay steps.

[0081] Based on the determined delay time, the phase space reconstruction module calculates the embedding dimension parameters required for phase space reconstruction. The module uses the spurious nearest neighbor method to determine the minimum geometric dimension required to fully unfold the phase space topology. Due to the lack of observation dimensions, phase points that are not adjacent in the high-dimensional phase space will undergo geometric folding after being projected into the low-dimensional observation space, appearing as spurious neighbors with relatively close distances. As the reconstruction dimension increases, these spurious neighbors resulting from projection folding will separate again in the high-dimensional space. The phase space reconstruction module sets a threshold for the rate of change of spatial distance, configured to range from 10 to 15, based on the empirical constant of Takens' embedding theorem in nonlinear time series analysis. The module calculates the relative rate of change of the Euclidean distance between two adjacent points in the phase space as the phase space dimension increases from the current value to the next dimension. When the relative rate of change exceeds the set threshold for the rate of change of spatial distance, the data point pair is determined to be a spurious nearest neighbor. The phase space reconstruction module calculates the percentage of false nearest neighbors in all phase point data. When this percentage is lower than a pre-configured threshold (e.g., 5%), it indicates that the dynamic structure of the system has been unfolded in the current dimension. The phase space reconstruction module then determines the dimension value at this time as the final embedding dimension.

[0082] Based on the calculated delay time and embedding dimension, the phase space reconstruction module performs coordinate delay operations on the one-dimensional high-frequency data stream sequence to construct a multi-dimensional reconstructed phase space state vector. The calculation logic of this vector mapping relationship satisfies the following core formula:

[0083] ;

[0084] in, Indicates the time step number The corresponding reconstructed phase space state vector; Indicates the sequence number of the discrete time step; Indicates the time step number The corresponding high-frequency data stream sequence values; Indicates the time step number The corresponding high-frequency data stream sequence values; Indicates the time step number The corresponding high-frequency data stream sequence values; This represents the delay time, and its unit is the number of discrete sampling steps. This represents the embedding dimension, which is the total number of dimensions in the reconstructed phase space. This represents the transpose operation of a vector.

[0085] Through the above calculations, the phase space reconstruction module achieves a physically equivalent transformation from a one-dimensional time domain to a multi-dimensional reconstructed phase space. The generated reconstructed phase space state vector preserves the topological invariance of the original mechanical dynamic system, serving as the basic feature data for subsequent covariance matrix calculation and anomaly measurement. For the kernel density estimation of the probability density function in the mutual information method and the KD-tree search algorithm used to accelerate point distance calculation in the spurious nearest neighbor method, those skilled in the art can compile and configure the code based on existing algorithm libraries. The specific optimization algorithm implementation for phase space reconstruction is well-known in the field and will not be elaborated upon here.

[0086] After generating a multidimensional reconstructed phase space state vector, the phase space reconstruction module performs a high-dimensional state trajectory matrix construction operation, which specifically includes the following:

[0087] Configure the length and sliding step of the time sliding window. The time sliding window is used to extract a continuous phase space evolution trajectory on the time axis. Regarding the determination of the window length parameter, technicians extract the basic rotational characteristic period based on the minimum rated operating speed of the tested mechanical equipment, and set the window length to include the number of high-frequency discrete sampling points corresponding to at least one complete characteristic period. Specifically, the window length... The value of satisfies ,in The sampling frequency for analog-to-digital conversion of the high-frequency target timing signal. This refers to the fundamental frequency corresponding to the lowest rated operating speed of the tested mechanical equipment. By configuring the window length to 1024 or 2048 data points, the phase space reconstruction module ensures that the data segment within the window can cover the complete local dynamic behavior information of the equipment. Regarding the sliding step size, the phase space reconstruction module configures it to a value smaller than the window length, such as one-quarter or one-half of the window length. This preserves the data overlap between adjacent windows to ensure the continuity of the state evolution sequence in the time dimension, avoiding information gaps in subsequent feature extraction processes.

[0088] A high-dimensional state trajectory matrix is ​​constructed according to a set time sliding window. The phase space reconstruction module moves the time sliding window on the time axis with a set sliding step size, and arranges and combines all reconstructed phase space state vectors falling within the current window. The phase space reconstruction module concatenates these multi-dimensional state vectors column-wise according to their chronological order of occurrence, generating a two-dimensional real matrix characterizing the dynamic evolution of the system within that time interval. The calculation logic of this high-dimensional state trajectory matrix satisfies the following formula relationship:

[0089] ;

[0090] in, Indicates the start time step number is The high-dimensional state trajectory matrix corresponding to the sliding window; Indicates the time step number The corresponding reconstructed phase space state vector; Indicates the time step number The corresponding reconstructed phase space state vector; Indicates the time step number The corresponding reconstructed phase space state vector; Indicates the discrete time step number at the start of the time sliding window; This represents the total number of high-frequency discrete time steps contained in the time sliding window.

[0091] From the perspective of matrix characteristics, since the dimension of each reconstructed phase space state vector is the embedding dimension... The generated high-dimensional state trajectory matrix It is OK The phase space reconstruction module integrates discrete state vectors into a data matrix representing the trajectory of local nonlinear dynamic evolution through the matrix construction process described above. This high-dimensional state trajectory matrix geometrically corresponds to a continuous manifold section of the original device's dynamic system attractor in the multidimensional phase space. Its row dimension contains the reconstructed coordinate information of the phase space, and its column dimension contains the temporal information of the system's evolution over time. This two-dimensional matrix data structure serves as the foundation for subsequent covariance matrix calculations and Riemannian geometric characteristic measurements. Regarding the memory pointer offset and buffer data copying mechanism during the sliding window data truncation process, those skilled in the art can utilize existing circular buffer data structures or queue management algorithms for configuration. The underlying memory scheduling and matrix concatenation processing are well-known technologies in this field and will not be elaborated upon here.

[0092] The anomaly measurement module receives the high-dimensional state trajectory matrix output by the phase space reconstruction module and the hash key output by the operating condition hash mapping module, and performs an addressing operation based on a dictionary data structure in local memory to extract the corresponding baseline feature parameters. This process specifically includes the following:

[0093] A key-value dictionary data structure residing in memory is constructed and loaded. In the actual operation of mechanical equipment, the equipment operates at various steady-state operating points and undergoes transient trajectory changes. Each operating condition corresponds to different high-frequency dynamic baseline characteristics. If a linear traversal search is used to match the baseline parameters of the current operating condition from the historical database each time an anomaly measurement is performed, it will cause frequent disk read / write overhead, and the computation latency will increase linearly with the total number of operating condition categories, failing to meet the real-time monitoring requirements of edge computing nodes. During the initialization phase, the anomaly measurement module loads the baseline feature parameters of each operating condition extracted from historical normal operating states into the random access memory of the edge computing node, constructing a dictionary data structure. Since the operating condition hash keys generated by the preceding module are dimensionality-reduced discrete scalar values, they fit the key mapping mechanism of the hash dictionary, transforming the similarity calculation of the original high-dimensional operating condition vectors into low-level memory address offset calculations. This dictionary data structure uses the operating condition hash key as the index primary key and the benchmark covariance matrix under the corresponding operating condition as the storage key.

[0094] The anomaly measurement module retrieves the routing query key corresponding to the current time sliding window. Based on the state interval of the current time sliding window, it extracts the matching hash key from the operating condition hash mapping module. Since the time sliding window contains multiple high-frequency discrete time steps, different hash key values ​​will exist within it when the window's coverage crosses the operating condition boundary. The anomaly measurement module extracts the hash key sequence corresponding to all discrete time steps within the time sliding window and uses a majority voting principle to determine the hash key value with the highest frequency in the sequence as the unique routing query key for that sliding window. When the anomaly measurement module determines that the routing query key is a steady-state hash key, it executes steady-state mode routing; when it determines that the routing query key is a transient composite hash key, it executes transient mode routing. Through this dual-mode routing mechanism, the anomaly measurement module transforms the identification process of the operating condition physical state into a unified scalar key value extraction process.

[0095] The system performs a constant-time addressing mapping, outputting the baseline characteristic parameters for the corresponding operating condition. The anomaly measurement module inputs the obtained routing query key into a memory addressing function of a dictionary data structure. This function calculates the physical offset address of the target data in memory based on the input scalar value, thus bypassing the traversal comparison process and directly reading the baseline covariance matrix matching the current operating condition. The logic of this routing addressing mapping satisfies the following formula:

[0096] ;

[0097] in, This represents the current operating condition baseline covariance matrix obtained through addressing extraction; Represents memory addressing functions for dictionary data structures; Indicates the start time step number is The routing query key corresponding to the sliding window is a non-negative integer scalar. This indicates the discrete time step number at the start of the time sliding window.

[0098] This memory addressing mechanism keeps the time complexity of retrieving baseline feature parameters at a certain level. The constant level ensures the stability of the algorithm's runtime. In actual operation, if the routing query key input by the system does not match the dictionary data structure, it indicates that the device has entered a new or unknown state that was not covered in the historical normal operation phase. For this miss, the anomaly measurement module directly marks the current high-dimensional state trajectory matrix as an anomaly, or triggers the baseline self-learning mechanism for the new operating condition. For the memory allocation, load factor setting, and chaining or open addressing methods used to resolve address conflicts between different routing query keys in the underlying hash table of the dictionary data structure, those skilled in the art can use standard programming language libraries for routine configuration. The underlying memory management of the hash dictionary is a well-known technology in this field and will not be elaborated upon here.

[0099] When the anomaly measurement module determines that the current device is in a steady-state operating range based on the routing query key, the anomaly measurement module performs anomaly detection operations in steady-state mode, i.e., mode A. This process specifically includes the following:

[0100] Calculate the sample covariance matrix of the high-dimensional state trajectory matrix. The anomaly measurement module receives the high-dimensional state trajectory matrix corresponding to the time sliding window, calculates the variance and covariance of this matrix in each reconstruction dimension, and generates the sample covariance matrix. The specific calculation logic of this sample covariance matrix satisfies the following formula:

[0101] ;

[0102] in, Indicates the start time step number is The sample covariance matrix corresponding to the sliding window; The unbiased estimate coefficients of the sample covariance; Indicates the local offset index within the sliding window. arrive Perform a continuous summation operation on all terms; Indicates the first time within the sliding window The reconstructed phase space state vector corresponding to each discrete time step; This represents the mean vector of all state vectors within the sliding window of time. This represents the total number of high-frequency discrete time steps contained in the time sliding window; Indicates the discrete time step number at the start of the time sliding window; Indicates the local offset index within the sliding window; This represents the transpose operation of a vector. From a physical perspective, this sample covariance matrix characterizes the geometric distribution and spatial extension direction of the device's local dynamic evolution trajectory in multidimensional phase space. Its main diagonal elements reflect the energy fluctuations on each delay coordinate axis, while the off-diagonal elements reflect the dynamic coupling correlation between different delay time points.

[0103] Diagonal regularization is performed on the sample covariance matrix. In high-frequency sampling environments in actual industrial settings, due to interference from sensor measurement noise and potential local linear correlations introduced during phase space reconstruction, the calculated sample covariance matrix often risks having an excessively large condition number or being in a singular state. Such a non-strictly positive definite matrix cannot be mapped to a symmetric positive definite manifold space for Riemannian geometric operations. To ensure the computational stability of subsequent metric algorithms, the anomaly metric module superimposes a regularization perturbation term on the main diagonal of the sample covariance matrix, raising the lower bound of the matrix's eigenvalues ​​and ensuring its strict positive definiteness. This regularization calculation logic satisfies the following formula:

[0104] ;

[0105] in, This represents the current time step covariance matrix after diagonal regularization. Indicates the start time step number is The sample covariance matrix corresponding to the sliding window; Represents the regularization coefficient; Indicates and Identity matrices of the same dimension; This indicates the discrete time step number at which the time sliding window begins. (Regarding the regularization coefficients...) The technicians configured the value to be 10. -6 Up to 10 -3 A fixed empirical constant between them, or dynamically set as the original sample covariance matrix. The trace is one ten-thousandth of the original dynamic characteristics, in order to reduce the interference with the original dynamic characteristics while ensuring positive definiteness.

[0106] The Riemann geometric distance between the current state and the baseline state is calculated, and the steady-state anomaly metric is output. Since the space formed by the symmetric positive definite matrices is a non-Euclidean curved Riemannian manifold, directly calculating the difference between the two covariance matrices using conventional Euclidean distance would cause metric distortion and fail to reflect the physical differences in dynamic characteristics within the topological space. The anomaly metric module calls the log-Euclidean metric algorithm to project the covariance matrix on the manifold space onto a flat tangent space through matrix logarithmic operations, and then calculates the Frobenius norm in the tangent space as the distance metric. This calculation logic satisfies the following core formula:

[0107] ;

[0108] in, Indicates anomaly metrics under steady-state conditions; This represents the current time step covariance matrix after diagonal regularization. This represents the current operating condition baseline covariance matrix extracted from the dictionary data structure. Represents the logarithmic operation of a matrix; The Frobenius norm of a matrix is ​​represented. This indicates the discrete time step number at the start of the time sliding window.

[0109] The calculated steady-state anomaly metric is compared with the set steady-state anomaly threshold. The anomaly metric module determines the steady-state anomaly metric. Whether the steady-state anomaly threshold is exceeded. If the threshold is exceeded, it is determined that the high-frequency time-series data within the current time sliding window is abnormal, and an anomaly alarm action is triggered on the edge computing node. Regarding the determination method of this steady-state anomaly threshold, technicians extract a large amount of sample data under this operating condition during the historical normal operation phase of the equipment, calculate the benchmark Riemann distance set between normal samples, and use the three sigma criterion based on Gaussian distribution or the 99th quantile of kernel density estimation to set the specific value of the steady-state anomaly threshold. For the specific calculation operations of the sample covariance matrix and the eigenvalue decomposition algorithm in the matrix logarithm operation, those skilled in the art can call existing linear algebra calculation libraries for conventional configuration. The eigenvalue decomposition and norm calculation of symmetric matrices are well-known technologies in this field and will not be elaborated here.

[0110] When the anomaly measurement module determines that the current device is in a transient track change transition phase based on the routing query key, the anomaly measurement module performs anomaly detection operations in transient mode, i.e., mode B. This process specifically includes the following:

[0111] The transient baseline transition trajectory sequence is obtained. The anomaly measurement module uses the transient composite hash key as the routing query key, inputting it into the memory addressing function of the dictionary data structure. Since the equipment's operating condition transition between different steady states exhibits a dynamic process that evolves over time, the memory storage key value corresponding to the transient composite hash key is no longer a single matrix, but a baseline transition trajectory sequence. This sequence contains a set of baseline covariance matrices extracted sequentially by discrete time steps during historical normal operating condition processes. The anomaly measurement module extracts this covariance matrix into the computational working area via memory offset addressing, using it as the comparison baseline for the current transient process.

[0112] The current state trajectory characteristics within the transient transition window are calculated. Within the set transient transition window, the anomaly measurement module continuously extracts high-dimensional state trajectory matrices with a set sliding step size. For each extracted high-dimensional state trajectory matrix, the anomaly measurement module calculates its sample covariance matrix. To eliminate the risk of matrix singularities caused by sensor noise, the anomaly measurement module employs the same diagonal regularization mechanism as the steady-state anomaly detection mode, superimposing a regularization perturbation term on the main diagonal of each sample covariance matrix. This processing step ensures that every covariance matrix extracted throughout the transient process is strictly symmetric and positive definite, thus satisfying the mapping requirements of the Riemannian geometric manifold space. The transient trajectory change process of the equipment corresponds to a dynamic evolution trajectory migrating from one attractor to another in a multidimensional phase space. In a symmetric and positive definite manifold space, this process is characterized as a continuous curve composed of multiple covariance matrices.

[0113] The integrated Riemannian geometric distance between the current trajectory and the reference transition trajectory is calculated, and a transient anomaly metric is output. Since the trajectory change transition phase contains a continuous temporal characteristic, the anomaly metric module aligns the current time-step covariance matrix sequence, after diagonal regularization, with the reference transition trajectory sequence point-by-point. In actual variable operating conditions, the duration of each transition may fluctuate, causing the length of the extracted current covariance matrix sequence to differ from the length of the reference transition trajectory sequence. The anomaly metric module uses a dynamic time warping algorithm or a linear interpolation resampling method to unify and align the sequence lengths of both. Each data point is aligned. After alignment, the anomaly measurement module projects the covariance matrix pairs on the manifold space onto the tangent space, calculates the corresponding Frobenius norm as the local bias, and sums and averages the bias values ​​over the entire transient window. This calculation logic satisfies the following core formula:

[0114] ;

[0115] in, This represents an anomaly metric in transient mode; The average coefficients represent the transient trajectory sequence; Indicates the local index within the transient sequence arrive Perform a continuous summation operation on all terms; Indicates the first The sample covariance matrix corresponding to each sliding window after diagonal regularization; Represents the first in the reference transition trajectory sequence A baseline covariance matrix; Represents the logarithmic operation of a matrix; The Frobenius norm of a matrix is ​​represented. This indicates the total number of time sliding windows contained within the transient transition window; Represents a local index of a data point within a sequence; Indicates the first The discrete time step number at the start of each sliding window.

[0116] The calculated transient anomaly metric is compared with the set transient anomaly threshold. The anomaly metric module determines the transient anomaly metric. The system checks whether the transient anomaly threshold has been exceeded. If it has, the system determines that an anomaly has occurred during the transition between operating conditions, triggering an anomaly alarm or shutdown protection action on the edge computing node. From a physical perspective, the dynamic fluctuation amplitude of the equipment during transient processes is much higher than that during stable operation. Directly using the steady-state anomaly threshold would lead to frequent false alarms. Technicians retrieve a set of normal trajectory deviation samples from the equipment during historical variable operating conditions, construct the probability density function of this deviation set using kernel density estimation, and extract the critical value corresponding to a cumulative probability distribution reaching 95%, setting it as the transient anomaly threshold. This dual-mode independent protection threshold mechanism ensures the detection fault tolerance rate of the equipment under non-stationary operating conditions. For the time axis resampling interpolation algorithm in the trajectory sequence alignment process and the method for selecting the bandwidth parameter in kernel density estimation, those skilled in the art can use existing numerical calculation libraries for configuration. The discrete sequence alignment and nonparametric statistical evaluation are well-known technologies in this field and will not be elaborated here.

[0117] During system operation, the dictionary incremental expansion module performs the judgment of unknown working conditions and the triggering of the learning window. This process specifically includes the following:

[0118] Hash miss events are captured. During dual-mode routing addressing, the dictionary incremental expansion module monitors the return results of the dictionary data structure. When the routing query key for the current time sliding window fails to find a matching physical address in the dictionary's memory addressing (i.e., a hash miss event occurs), the underlying addressing function returns a null pointer or a preset out-of-bounds error code, and the dictionary incremental expansion module suspends the calculation of abnormal metrics for that time window. This miss phenomenon physically indicates that the device's current operating speed or load combination exceeds the range of historically registered baseline data.

[0119] Perform a physical continuity check on the new state. To distinguish whether the equipment has entered a new normal operating range or experienced a physical fault causing abrupt changes in dynamic characteristics, the dictionary incremental expansion module opens an observation interval containing a fixed number of sliding windows after a miss event occurs. The dictionary incremental expansion module extracts the routing query keys for multiple consecutive time steps within this observation interval. If the values ​​of these routing query keys change continuously without a clear clustering center, it indicates that the system is in an unstable transient anomaly or chaotic state. The dictionary incremental expansion module identifies this as a equipment fault and triggers an alarm mechanism. To improve the anti-interference capability at the engineering site, the dictionary incremental expansion module counts the most frequently occurring miss routing query keys within the observation interval. If the frequency of this key value exceeds a set consistency ratio threshold (e.g., 90% or 95%), it indicates that the equipment has entered a new state with stable continuity, and the dictionary incremental expansion module then enters the manifold stability assessment phase.

[0120] The manifold space distribution divergence is calculated to assess the normal stability of the new state. For new states with persistence, the dictionary incremental expansion module obtains the high-dimensional state trajectory matrices corresponding to all time sliding windows within the observation interval and calculates their respective sample covariance matrices. To eliminate singularities caused by noise, the dictionary incremental expansion module also performs diagonal regularization on these covariance matrices. Subsequently, the dictionary incremental expansion module calculates the distribution divergence of these matrices in the Riemannian manifold space to quantify the intrinsic volatility of the device dynamics in the new state. Normal steady-state conditions manifest as a compact attractor in phase space, with their corresponding covariance matrices clustered in a small neighborhood in the manifold space; while slowly changing faults or decaying states caused by mechanical wear or component loosening often manifest as divergent trajectories in the manifold space. The calculation logic of this distribution divergence satisfies the following core formula:

[0121] ;

[0122] in, This represents the manifold distribution divergence within the observation interval of the unknown operating condition; This represents the average coefficient used in the divergence calculation; This indicates the total number of sliding windows contained within the observation interval; Indicates the local index within the observation interval arrive Perform a continuous summation operation on all terms; Indicates the first [number]th [item] within the observation interval The sample covariance matrix corresponding to each sliding window after diagonal regularization; Indicates the observation interval The Riemann geometric mean matrix of the covariance matrix of each sample. Represents the logarithmic operation of a matrix; The Frobenius norm of the matrix is ​​represented by the square symbol in the upper right corner, which indicates that the norm is squared to characterize the distance variance in the manifold space. This represents the local index of data points within the observation interval.

[0123] The divergence threshold is compared and a baseline learning window is triggered. The dictionary incremental expansion module calculates the manifold distribution divergence. Compare with the preset stability divergence threshold. If the manifold distribution divergence... If the divergence value is below the stability divergence threshold, it indicates that the new state has a compact geometric distribution similar to the normal historical operating conditions. The dictionary incremental expansion module determines that the current equipment has entered an unknown new normal operating condition. The dictionary incremental expansion module sets this consistent routing query key as the candidate key for the new operating condition and triggers an online baseline learning window for this new operating condition to perform subsequent feature extraction and dictionary data expansion processes. Regarding the setting of the stability divergence threshold, technicians extract the baseline distribution divergence values ​​under each historical normal operating condition of the equipment, and configure the maximum value or a fixed multiple (e.g., between 1.2 and 1.5 times) of the historical distribution divergence as the threshold parameter to accommodate reasonable data fluctuations under normal operating conditions. For the Riemann geometric mean matrix... For the specific solution calculation, those skilled in the art can use the Karcher mean iteration algorithm based on gradient descent to perform the calculation. The optimization approximation of the mean matrix of the manifold space is a well-known technique in this field and will not be elaborated here.

[0124] After determining that the device has entered an unknown new normal operating condition and triggering the online baseline learning window, the dictionary incremental expansion module performs incremental feature calculation and memory dictionary insertion operations. This process specifically includes the following:

[0125] The high-dimensional state trajectory matrix is ​​extracted and a candidate feature sequence is calculated. Within the triggered online baseline learning window, the dictionary incremental expansion module continuously extracts high-dimensional state trajectory matrices corresponding to multiple time sliding windows. For each high-dimensional state trajectory matrix, the dictionary incremental expansion module calculates its sample covariance matrix and performs diagonal regularization. From a physical perspective, even when the equipment is in a stable new operating condition, its local dynamic characteristics will still oscillate to a certain extent in phase space due to load fluctuations or environmental noise. The dictionary incremental expansion module collects all diagonal regularized covariance matrices within this learning window to form a candidate feature sequence, which serves as the basic data for extracting unified benchmark parameters for the new operating condition. Regarding the specific operations of calculating the sample covariance matrix and diagonal regularization, the dictionary incremental expansion module adopts the same calculation logic as the steady-state anomaly detection mode; therefore, the formulas will not be repeated here.

[0126] Calculate the incremental baseline feature parameters. The dictionary incremental expansion module calculates the geometric mean of the candidate feature sequences in the manifold space, and uses this geometric mean as the incremental baseline feature parameters for the current new operating condition. Since the regularized covariance matrix is ​​located in a non-Euclidean manifold space, directly performing an arithmetic mean will cause the generated mean matrix to deviate from the manifold structure, leading to distortion of physical features. To maintain consistency in the anomaly measurement standards before and after, the dictionary incremental expansion module adopts a log-Euclidean metric framework, projects the candidate feature sequences onto a flat tangent space to obtain the arithmetic mean, and then maps it back to the manifold space through matrix exponentiation to generate the baseline covariance matrix for the new operating condition. The core logic of this fusion calculation satisfies the following formula:

[0127] ;

[0128] in, This represents the incremental baseline covariance matrix of the new operating condition obtained through calculation; Represents matrix exponentiation; Indicates the average coefficient; This indicates the total number of time-sliding windows contained within the online baseline learning window; This indicates a local index within the learning window. arrive Perform a continuous summation operation on all terms; Represents the logarithmic operation of a matrix; Indicates the first [number]th ... The sample covariance matrix corresponding to each sliding window after diagonal regularization; Represents a local index of a data point within the sequence. (Regarding parameters) The range of values ​​is configured by technicians to include 50 to 200 time sliding windows in order to strike a balance between unbiased feature statistics and real-time online computation.

[0129] The process involves inserting and restoring monitoring data into the in-memory dictionary data structure. The incremental dictionary expansion module uses the calculated incremental benchmark covariance matrix of the new operating condition as the storage key and the previously locked candidate key of the new operating condition as the index key, then performs the insertion operation into the in-memory dictionary data structure. At the underlying implementation level, the incremental expansion module calculates the hash value of the candidate key of the new operating condition and maps it to the memory address slot of the dictionary data structure. To prevent continuous online expansion from degrading dictionary retrieval performance, the incremental expansion module evaluates the load factor of the current dictionary data structure before each insertion operation. This load factor is represented by the ratio of the number of stored operating condition key-value pairs to the total number of allocated hash slots. If the load factor exceeds a set expansion threshold, the incremental expansion module requests a new contiguous address space in memory with twice the original capacity and uses a rehashing operation to migrate all operating condition key-value pairs from the original dictionary to the new space before inserting the current new operating condition key-value pair. Through this dynamic memory expansion mechanism based on the load factor, the addressing time complexity of the dictionary remains constant even when facing an increasing number of unknown operating conditions. The specific setting for the expansion threshold is typically between 0.70 and 0.85. After the memory dictionary insertion operation is completed, the dictionary incremental expansion module releases the paused state of the anomaly measurement calculation and uses the expanded dictionary data structure to resume the real-time dual-mode routing and anomaly measurement process for the device's high-frequency time-series data, thereby achieving online closed-loop adaptive updating of the new operating condition baseline parameters. For the allocation and release of underlying memory space, the Taylor series expansion of the matrix exponent, and the chaining method for resolving hash collisions, those skilled in the art can use existing system application programming interfaces and mathematical calculation libraries for configuration. The dynamic expansion of the hash table and the basic matrix operations are well-known technologies in the field and will not be elaborated upon here.

[0130] Please see the appendix Figure 3To verify the technical effectiveness of the dual-mode measurement mechanism integrating time-series analysis of this invention in a real industrial scenario, the system was experimentally verified on a rotating machinery transmission chain test bench. The test bench consists of a variable frequency motor, a planetary gearbox, a bearing housing under test, and a magnetic powder brake. During the experiment, the data acquisition module acquired the high-frequency vibration acceleration signal of the bearing housing surface at a sampling rate of 10 kHz, and simultaneously recorded the set speed of the motor and the set load rate of the brake through an industrial bus with an update cycle of 200 milliseconds. The entire measurement process lasted for 1000 discrete time windows, with the horizontal axis representing the time sliding window number / discretionary step, and the vertical axis representing the calculated anomaly measurement value. The three vertical dashed lines in the figure divide the time axis into four key stages at the 300th, 400th, and 700th distances from the bearing: the first 300 windows represent the low-speed, light-load steady-state operation stage; the 300th to 400th windows represent the transient transition stage of increasing speed and load; the 400th to 700th windows represent the high-speed, heavy-load steady-state operation stage; and the 700th to 1000th windows represent the early, slight degradation stage. At the 700th window, the experimenters injected simulated inner ring pitting faults into the bearing under test.

[0131] In the appendix Figure 3 In the figure, the solid line represents the evolution trajectory of the abnormal metric value calculated using the dual-mode routing and Riemannian manifold metric mechanism proposed in this invention, and the dashed line represents the evolution trajectory of the abnormal metric value calculated using the traditional Euclidean distance and single baseline comparison method. The horizontal dotted line represents the set unified abnormal alarm threshold (set to 1.0). As shown in the figure, during the transient transition phase from window 300 to 400, the high-frequency vibration characteristics of the equipment change significantly due to the inertial impact of the mechanical system and the nonlinear rotor dynamic response. Traditional methods, due to their inability to identify transient intervals and lack of corresponding benchmark alignment mechanisms, cause a sudden increase in the metric value, exceeding the alarm threshold and triggering false alarms. The system of this invention successfully identifies the track change interval through transient composite hash keys and calls the benchmark transition trajectory sequence for logarithmic Euclidean tangent space alignment comparison, ensuring that the abnormal metric value in the transient mode is always kept below the alarm threshold, thus suppressing false alarms during the operating condition switching process. After injecting an early, weakly degenerate state at window 700, the method of this invention calculates the Frobenius norm of a symmetric positive definite matrix in a non-Euclidean manifold space, which has a geometric amplification effect on slight distortions in the internal dynamic structure. As a result, the actual trajectory of this manifold rises rapidly and exceeds the alarm threshold. In contrast, the traditional Euclidean distance is insensitive to this early nonlinear topological change; its dashed trajectory rises slowly, exhibiting a detection lag.

[0132] Please see the appendix Figure 4The system extracted a long-term test set containing multiple random operating condition jumps and various subtle degradation modes, and performed multi-dimensional quantitative statistics on the method of this invention, the conventional baseline comparison method based on principal component analysis, and the traditional detection method based on time-domain statistical thresholds. The horizontal axis of the bar chart corresponds to the three different detection methods mentioned above, and the vertical axis uniformly represents the percentage statistical value (%). In each comparison, the light gray bars represent the false alarm rate of the transient transition interval, and the dark gray bars represent the detection rate of the early subtle degradation state.

[0133] According to the statistical results, the false alarm rates of traditional time-domain statistical thresholding and principal component analysis methods reached 18.2% and 24.5%, respectively. This is because static thresholding and linear dimensionality reduction algorithms cannot adapt to the data distribution drift caused by nonlinear variable operating conditions. The method of this invention, relying on operating condition hash mapping and diagonal regularization, reduces the false alarm rate to 1.5%. In terms of degradation detection rate, the method of this invention reaches 98.2%, higher than the 72.4% and 85.1% of the other two traditional methods. This quantitative data shows that the introduction of dictionary addressing and Riemannian geometric manifold measurement not only solves the anti-interference problem under dynamic operating conditions, but also ensures the completeness and effectiveness of feature extraction by utilizing the constant-level time complexity of deterministic dictionary addressing. This set of comparative data verifies the effectiveness of this invention in the field of complex rotating machinery condition monitoring using high- and low-frequency data fusion and a bi-state hash key routing mechanism.

Claims

1. A real-time data anomaly detection method integrating time series analysis, characterized in that, Includes the following steps: The high-frequency target time-series signal, low-frequency operating condition feature vector, quantization noise floor parameter and binarization mask vector are obtained. The low-frequency operating condition feature vector is reduced in dimensionality using the binarization mask vector to generate the master control operating condition vector, and then upsampled to generate the synchronization operating condition vector. A steady-state hash key is generated by hash mapping the synchronous operating condition vector, and a transient composite hash key is generated by comparing the steady-state hash keys of adjacent time steps. Based on the delay time and embedding dimension, coordinate delay operation is performed on the high-frequency data stream sequence obtained by converting the high-frequency target time-series signal to construct a reconstructed phase space state vector, and a high-dimensional state trajectory matrix is ​​constructed by sliding the time window. The routing query key is determined based on the steady-state hash key or the transient composite hash key. If the routing query key is matched, the baseline feature parameters are extracted from the dictionary data structure. Calculate the sample covariance matrix of the high-dimensional state trajectory matrix, perform regularization on the sample covariance matrix using the quantization noise floor parameter, and calculate the anomaly metric value to determine anomalies in combination with the benchmark feature parameters. When the routing query key is not matched and the continuity and stability evaluation conditions are met, the incremental baseline feature parameters are calculated, and the new operating condition candidate key and the incremental baseline feature parameters are stored in the dictionary data structure.

2. The real-time data anomaly detection method based on fused time-series analysis according to claim 1, characterized in that, In the process of acquiring the quantization noise floor parameter and the upsampling to generate the synchronization condition vector: The quantization noise floor parameter can be obtained by either hardware static calibration or physical resolution derivation. The hardware static calibration method involves acquiring a background electrical noise data sequence within a preset time window while the device is stationary. The preset time window is 1 to 5 seconds long. The variance of the background electrical noise data sequence is then calculated as the quantization noise floor parameter. The physical resolution derivation method is based on the full-scale input voltage value and conversion bit width parameter of the analog-to-digital converter. The full-scale input voltage value is used as the numerator, and the conversion bit width value is used as the denominator to perform a division operation. The voltage resolution value corresponding to the least significant bit of the analog-to-digital converter is calculated and used as the quantization noise floor parameter. The process of upsampling to generate the synchronization condition vector is specifically performed through a zero-order hold mechanism, including: Using the sampling clock of the high-frequency target timing signal as the global reference time axis, when low-frequency operating condition parameter data with a new global timestamp is received, the value of the main control operating condition vector at the corresponding time is assigned to the corresponding high-frequency time step. Between two adjacent low-frequency communication update cycles, the value of the master control condition vector at the previous moment is kept unchanged. The value of the master control condition vector at the previous moment is directly shifted, copied, and filled into all high-frequency time steps between the two adjacent low-frequency communication update cycles.

3. The real-time data anomaly detection method based on fused time series analysis according to claim 1, characterized in that, In the process of using the binarized mask vector to reduce the dimensionality of the low-frequency operating condition feature vector to generate the master control operating condition vector, and performing hash mapping on the synchronization operating condition vector to generate a steady-state hash key, and comparing the steady-state hash keys of adjacent time steps to generate a transient composite hash key: The process of using the binarized mask vector to reduce the dimensionality of the low-frequency operating condition feature vector to generate the master control operating condition vector specifically includes: The low-frequency operating condition feature vector and the binary mask vector are multiplied element by element. The operating condition parameters corresponding to the mask weight value of 1 are retained, and the operating condition parameters corresponding to the mask weight value of 0 are set to zero and truncated and removed to generate the main control operating condition vector. The process of generating steady-state hash keys by hash mapping the synchronization condition vector specifically includes quantization binning and locality-sensitive hash mapping of the synchronization condition vector, specifically: The discrete grid coordinates are obtained by dividing the value of each physical quantity in the synchronous working condition vector by the set engineering tolerance step size and rounding down. The engineering tolerance step size is set according to the equipment's factory design specifications or the confidence interval of extracted historical steady-state operating data of the equipment. The discrete grid coordinates are then processed by a local sensitive hash function and mapped to scalar values, which serve as the steady-state hash key for the current time step. The process of generating a transient composite hash key by comparing the steady-state hash keys of adjacent time steps specifically includes: If the steady-state hash key at the current time step is different from the steady-state hash key at the previous time step, extract the source steady-state hash key before the flip and the target steady-state hash key after the flip, and concatenate them through a binary left shift operation and a bitwise XOR operation to generate the transient composite hash key.

4. The real-time data anomaly detection method based on fused time series analysis according to claim 1, characterized in that, In the process of constructing a reconstructed phase space state vector by performing coordinate delay operations on the high-frequency data stream sequence based on the delay time and embedding dimension, and constructing a high-dimensional state trajectory matrix by sliding a time window: The delay time is determined using the mutual information method. The mutual information value is calculated within a set maximum delay search step size, which is 50 to 100 sampling periods. The first local minimum value of the mutual information value as the delay step size increases is found, and the corresponding delay step number is determined as the delay time. The embedding dimension is determined using the false nearest neighbor method. The relative rate of change of the Euclidean distance between two adjacent points in the space is calculated when the phase space dimension increases from the current value to the next dimension. When the relative rate of change is greater than a set spatial distance change rate threshold, the two adjacent points are determined to be false nearest neighbors. The value of the spatial distance change rate threshold is between 10 and 15. The percentage of false nearest neighbors in all phase point data is calculated. When the percentage is lower than a set threshold, the dimension value at that point is determined as the final embedding dimension. The threshold is 5%. The coordinate delay operation on the high-frequency data stream sequence specifically involves constructing the reconstructed phase space state vector from the high-frequency data stream sequence based on the determined delay time and the embedding dimension. The process of constructing a high-dimensional state trajectory matrix using a time-sliding window is as follows: All the reconstructed phase space state vectors falling within the current window are concatenated column by column according to the chronological order of their occurrence to generate a two-dimensional real matrix characterizing the dynamic evolution of the system, which serves as the high-dimensional state trajectory matrix.

5. The real-time data anomaly detection method based on fused time series analysis according to claim 1, characterized in that, The process of determining the routing query key based on the steady-state hash key or the transient composite hash key, and if the routing query key is matched, specifically includes the following steps during the extraction of baseline feature parameters from the dictionary data structure: Extract the hash key sequence corresponding to all discrete time steps within the time sliding window, which is composed of the steady-state hash key or the transient composite hash key; Using the majority voting principle, the hash key value that appears most frequently in the hash key sequence is determined as the unique routing query key for the time sliding window.

6. The real-time data anomaly detection method based on fused time series analysis according to claim 1, characterized in that, In the process of regularizing the sample covariance matrix of the high-dimensional state trajectory matrix using the quantization noise floor parameter and calculating the anomaly metric value based on the benchmark feature parameters to determine anomalies, when the routing query key is a steady-state hash key, a steady-state anomaly detection operation is performed, and a steady-state anomaly metric value is calculated as the anomaly metric value to determine anomalies. Specifically, this includes: Calculate the sample covariance matrix of the high-dimensional state trajectory matrix, and superimpose the quantization noise floor parameter as a regularization perturbation term on the main diagonal of the sample covariance matrix for regularization processing to generate the current time step covariance matrix after regularization. The benchmark feature parameter is extracted from the dictionary data structure based on the steady-state hash key. The benchmark feature parameter is the benchmark covariance matrix corresponding to the current working condition. The regularized current time step covariance matrix and the reference covariance matrix are projected onto a flat tangent space through matrix logarithm operation. The Frobenius norm in the tangent space is calculated to generate the steady-state anomaly metric, and it is determined whether the steady-state anomaly metric exceeds the set steady-state anomaly threshold. The steady-state anomaly threshold is a specific value set using the three sigma criterion based on Gaussian distribution or the 99th percentile of kernel density estimation.

7. The real-time data anomaly detection method based on fused time series analysis according to claim 1, characterized in that, In the process of regularizing the sample covariance matrix of the high-dimensional state trajectory matrix using the quantization noise floor parameter and calculating the anomaly metric value based on the benchmark feature parameters to determine anomalies, when the routing query key is a transient composite hash key, a transient anomaly detection operation is performed, and a transient anomaly metric value is calculated as the anomaly metric value to determine anomalies. Specifically, this includes: The benchmark feature parameters are extracted from the dictionary data structure based on the transient composite hash key. The benchmark feature parameters are a benchmark transition trajectory sequence containing a set of benchmark covariance matrices extracted in discrete time step order during historical normal variable operating conditions. Within a set transient transition window, the high-dimensional state trajectory matrix is ​​continuously extracted and the corresponding sample covariance matrix is ​​calculated. The duration of the transient transition window is set according to the maximum value of the historical switching time of the equipment. The quantization noise floor parameter is superimposed on the main diagonal of the sample covariance matrix for regularization processing, forming a regularized current time step covariance matrix sequence. Then, a dynamic time warping algorithm or a linear interpolation resampling method is used to uniformly align the regularized current time step covariance matrix sequence with the reference transition trajectory sequence to a set fixed number of data points. The Frobenius norm of the projected regularized current time step covariance matrix and the reference covariance matrix in the tangent space is calculated point by point. The deviation values ​​within the entire transient transition window are summed and averaged to generate the transient anomaly metric value. It is then determined whether the transient anomaly metric value exceeds the set transient anomaly threshold. The transient anomaly threshold is set by using the kernel density estimation method to construct the probability density function of the normal trajectory deviation sample set, and extracting the critical value corresponding to the cumulative probability distribution reaching 95%.

8. The real-time data anomaly detection method based on fused time series analysis according to claim 1, characterized in that, The process of performing a continuity check when the routing query key is not matched and the continuity and stability evaluation conditions are met, and during the calculation of incremental baseline feature parameters and storage in the dictionary data structure, specifically includes: When the routing query key is not found in the dictionary data structure, the calculation of the anomaly metric value of the current time sliding window is paused, and the calculation and regularization of the sample covariance matrix are continued. At the same time, an observation interval containing a fixed number of time sliding windows is opened. The most frequently occurring missed route query key within the observation interval is counted. If the proportion of the most frequently occurring missed route query key to the total number of windows in the observation interval exceeds a set consistency ratio threshold, the continuity test is passed and the system enters the stability evaluation stage. The consistency ratio threshold is set to 90% or 95%.

9. The real-time data anomaly detection method based on fused time series analysis according to claim 8, characterized in that, The process of conducting stability assessment specifically includes: Obtain the regularized sample covariance matrix corresponding to all time sliding windows within the observation interval, and calculate the Riemann geometric mean matrix corresponding to the observation interval. Project all the regularized sample covariance matrices and the Riemann geometric mean matrix onto the tangent space using matrix logarithm operation, and calculate the manifold distribution divergence in the manifold space; The manifold distribution divergence is compared with a set stability divergence threshold. If the manifold distribution divergence is lower than the stability divergence threshold, the stability assessment is passed, the most frequently missed route query key is set as a new operating condition candidate key, and the online baseline learning window is triggered. The stability divergence threshold is set as follows: Extract the baseline distribution divergence values ​​of the equipment under various normal operating conditions in history, and use the maximum value of the historical distribution divergence or a fixed multiple of the maximum value of the historical distribution divergence as the stability divergence threshold, wherein the fixed multiple is between 1.2 and 1.5 times.

10. The real-time data anomaly detection method based on fused time series analysis according to claim 9, characterized in that, The process of calculating incremental baseline feature parameters through the online baseline learning window and storing the new working condition candidate key and the incremental baseline feature parameters as key-value pairs in the dictionary data structure specifically includes: Within the online baseline learning window, multiple regularized sample covariance matrices are obtained as candidate feature sequences. The candidate feature sequence is projected onto a flat tangent space to obtain the arithmetic mean, and then mapped back to the manifold space through matrix exponentiation to generate the incremental benchmark feature parameters for the new working condition. Calculate the load factor of the current dictionary data structure. If the load factor exceeds the set expansion threshold, request a new contiguous address space to rehash the key-value pairs in the dictionary data structure and migrate them. Insert the new working condition candidate key and the incremental baseline feature parameter as key-value pairs into the expanded dictionary data structure. The expansion threshold is between 0.70 and 0.85.

Images