An edge node-oriented industrial internet of things anomaly detection system and method

Abstract

This invention discloses an industrial IoT anomaly detection system and method for edge nodes. The invention relates to the fields of industrial IoT and edge computing technology, and involves real-time acquisition and preprocessing of industrial sensor data streams. A resource-adaptive screening module, deployed on each edge node, dynamically selects and activates a screener of the corresponding level from a set of screeners containing at least three capability levels based on the real-time available computing resources of the edge node. This screener performs initial anomaly screening on the sensor data stream and generates suspected anomaly events with confidence levels. Through this resource-adaptive screening mechanism, the invention enables edge nodes to dynamically select and activate matching screeners based on their own real-time available computing resources. This solves the problem of fixed and rigid detection models in existing technologies that cannot adapt to heterogeneous hardware resources, allowing edge nodes of the entire spectrum, from low-power microcontrollers to high-performance edge gateways, to participate in anomaly detection, achieving high adaptability in heterogeneous edge environments.

Description

Technical Field

[0001] This invention relates to the field of industrial Internet of Things (IIoT) and edge computing technology, specifically to an industrial IoT anomaly detection system and method for edge nodes. Background Technology

[0002] The Industrial Internet of Things (IIoT) deploys numerous sensors on industrial equipment to collect real-time operating parameters such as vibration, temperature, and current, providing a data foundation for equipment condition monitoring and anomaly detection. With the rapid growth in sensor deployment, the traditional model of uploading all sensor data to the cloud for centralized processing faces multiple challenges, including communication bandwidth bottlenecks, high transmission latency, and data privacy and security concerns. Edge computing, by offloading computing tasks from the cloud to edge nodes closer to the data source, has become a key technological approach to address these challenges.

[0003] However, existing edge computing-based industrial IoT anomaly detection solutions generally suffer from two core technical problems. First, the detection models of edge nodes do not take into account the huge heterogeneity of hardware resources. In real-world deployment environments of the Industrial Internet of Things (IIoT), the hardware form of edge nodes varies greatly, ranging from low-power microcontrollers to high-performance edge gateways. Patent publication "CN118193954B," titled "A Method and System for Anomaly Detection of Industrial Equipment Based on Federated Learning," discloses a solution that uniformly deploys a hybrid model of convolutional neural networks and long short-term memory networks on all edge nodes. This model is completely undeployable and unrunnable on low-resource nodes at the microcontroller level. Patent publication "CN119758923B," titled "A Method and Device for Monitoring Threshold Data of Industrial Sensors," discloses a solution that uniformly deploys a lightweight threshold rule model on all edge nodes. While this can be deployed on low-resource nodes, its detection capability is extremely limited, only able to identify single-parameter exceedances. It cannot effectively identify common industrial anomaly patterns such as multi-parameter coupling anomalies and progressive degradation. Both of these solutions essentially treat edge nodes as homogeneous computing units and deploy models in a one-size-fits-all manner, without providing a mechanism for dynamically adapting detection strategies based on the actual resource status of the nodes. Secondly, edge nodes operate in isolation during the anomaly detection execution phase, lacking a real-time collaborative verification mechanism. In the aforementioned patents, each edge node makes independent judgments during the detection execution phase, and there is no real-time information exchange between nodes. However, in industrial scenarios, adjacent devices on the same production line naturally have physical connections and similar operating conditions. Independent detection by a single node cannot utilize this spatial redundancy information for cross-verification, resulting in false alarms caused by sensor malfunctions or local disturbances that cannot be filtered by neighboring nodes. Cross-device anomaly patterns that require multiple nodes to work together to identify cannot be captured. We propose an industrial IoT anomaly detection system and method oriented towards edge nodes. Summary of the Invention

[0004] The purpose of this invention is to provide an industrial Internet of Things (IoT) anomaly detection system and method for edge nodes.

[0005] To achieve the above objectives, the present invention provides the following technical solution: an industrial IoT anomaly detection system for edge nodes, the detection system comprising: Data acquisition module: Deployed at each edge node, it is used to acquire industrial sensor data streams in real time, preprocess the acquired raw sensor data, and generate standardized sensor data sequences; Resource adaptive screening module: Deployed on each edge node, it is used to obtain the real-time available computing resource parameters of the edge node, dynamically select and activate the corresponding level of screener from the pre-deployed multi-level screener set according to the preset resource model mapping strategy, so as to perform anomaly screening on sensor data stream and generate suspected abnormal events with confidence. The multi-level screener set includes at least a first-level screener based on online statistics, a second-level screener based on a knowledge distillation compression model, and a third-level screener based on a channel pruning deep neural network; Edge Collaborative Verification Module: Deployed on each edge node, when the suspected abnormal event occurs, it determines the adjacent edge nodes within the collaborative range according to the preset device topology relationship and establishes a dynamic collaborative group, sends the abnormal feature summary vector to the nodes in the collaborative group, uses a pre-trained graph attention network to perform distributed cross-validation on the suspected abnormal event, and outputs the collaboratively confirmed abnormal event and collaborative confidence. The anomaly feature summary vector is a compressed, fixed-dimensional low-dimensional vector output from the intermediate layer of the currently active screener.

[0006] As a further aspect of the present invention: the first-level screener is implemented based on the adaptive Z-score statistic and exponentially weighted moving average of the sliding window, with a memory footprint of less than 100 kilobytes, and is suitable for microcontroller-level resource-constrained nodes; the second-level screener is implemented based on a compressed model obtained by knowledge distillation of a pre-trained neural network in the cloud, with a memory footprint of less than 5 megabytes, and is suitable for edge nodes with medium computing power; the third-level screener is implemented based on a hybrid model of a convolutional neural network and a long short-term memory network after channel pruning and integer quantization, with a memory footprint of less than 50 megabytes, and is suitable for high-performance edge gateways.

[0007] As a further aspect of the present invention: in the resource adaptive screening module, the real-time available computing resource parameters include at least CPU utilization, available memory, power budget and data arrival rate. The resource model mapping strategy is based on a preset lookup table method and lightweight decision tree to map each resource parameter to the corresponding screening level. Furthermore, a hysteresis threshold mechanism is used when switching screening levels to prevent frequent jitter.

[0008] As a further aspect of the present invention: In the edge collaborative verification module, the graph attention network is constructed using an industrial field equipment topology graph as its framework. The nodes of the equipment topology graph are either equipment or sensors, and the edges are either physical connections or process coupling relationships. The attention weights of the edges are adaptively learned by the network. The graph attention network uses the anomaly feature summary vector of the node initiating collaboration as the query vector, and the anomaly feature summary vectors of each neighboring node in the collaboration group as the key vector and value vector. After aggregating neighbor information through a multi-head attention mechanism, the collaborative verification result is output.

[0009] As a further aspect of the present invention: in the edge collaboration verification module, the threshold for determining the collaboration confidence is dynamically weighted based on the number of nodes participating in the collaboration, the topological distance between each node and the node initiating the anomaly, and the historical detection accuracy of each node.

[0010] In addition, this application also provides an industrial IoT anomaly detection method for edge nodes, the detection method including the following steps: S1. Data Acquisition: Edge nodes collect industrial sensor data streams in real time, perform preprocessing operations on the collected raw sensor data, and generate standardized sensor data sequences. S2. Resource Assessment and Screener Selection: Edge nodes acquire their own real-time available computing resource parameters and, according to a preset resource model mapping strategy, dynamically select and activate a screener that matches the current resource conditions from a multi-level screener set pre-deployed on the edge nodes; the multi-level screener set includes at least a first-level screener based on online statistics, a second-level screener based on a knowledge distillation compression model, and a third-level screener based on a channel pruning deep neural network; S3. Adaptive anomaly screening: The activated screener performs segment-by-segment window processing on the sensor data sequence to generate suspected anomaly events with anomaly confidence scores. S4. Edge Collaborative Cross-validation: When the suspected abnormal event occurs, the adjacent edge nodes within the collaborative range are determined according to the preset device topology relationship and a dynamic collaborative group is established. The fixed-dimensional abnormal feature summary vector generated by compression based on the output of the currently activated intermediate layer of the screener is sent to the nodes in the collaborative group. The suspected abnormal event is distributed cross-validated using a pre-trained graph attention network to obtain the collaborative validation result. S5. Anomaly Confirmation and Result Output: Based on the collaborative verification results output by the graph attention network, suspected anomaly events with collaborative confidence exceeding the preset judgment threshold are confirmed as real anomaly events, anomaly alarms are generated and anomaly detection results are output. For suspected anomaly events with collaborative confidence not exceeding the judgment threshold, they are marked as false alarms caused by sensor local faults or noise and recorded in the log.

[0011] As a further aspect of the present invention: in S1, the real-time acquisition of industrial sensor data streams by the edge node includes: acquiring continuous time-series signals generated by at least one of vibration sensors, temperature sensors, current sensors, and pressure sensors deployed on industrial equipment; the preprocessing operation includes timestamp alignment, missing value filling, outlier removal, and normalization processing; the standardized sensor data sequence is a data segment divided into fixed time windows, and each data segment contains standardized sampled values ​​of all sensor channels within a time window.

[0012] As a further aspect of the present invention: S2 specifically includes: collecting the CPU utilization, available memory, power budget, and data arrival rate of the edge node at fixed intervals as the real-time available computing resource parameters; comparing each collected resource parameter with the hierarchical threshold in the preset resource-model mapping table one by one to determine the highest screener level allowed to be activated under the current resource conditions; when it is necessary to switch from the current screener level to the target screener level, performing a lag judgment; if the target level is higher than the current level, then the resource conditions corresponding to the target level are required to continuously meet the first time threshold before performing the upgrade switch; if the target level is lower than the current level, then the resource shortage state is required to continuously meet the second time threshold before performing the downgrade switch; the first time threshold is less than the second time threshold.

[0013] As a further aspect of the present invention: In step S4, the abnormal feature summary vector is generated as follows: the feature map output of the intermediate layer of the currently activated screener is obtained, and after dimensionality reduction by global average pooling, it is compressed into a fixed-dimensional vector of 32 to 128 dimensions by random projection or principal component analysis. When the currently activated screener is the first-level screener, the abnormal feature summary vector is concatenated into a fixed-dimensional vector by deviation magnitude, deviation duration, deviation sensor identifier and current resource level encoding.

[0014] As a further aspect of the present invention: in step S5, the preset judgment threshold is dynamically weighted based on the number of nodes participating in the collaboration, the topological distance between each node and the node initiating the anomaly, and the historical detection accuracy of each node.

[0015] Compared with the prior art, the beneficial effects of the present invention by adopting the above technical solution are as follows: 1. This invention enables edge nodes to dynamically select and activate matching screeners based on their real-time available computing resources through a resource adaptive screening mechanism. This solves the problem of fixed and rigid detection models in the prior art that cannot adapt to heterogeneous hardware resources. It enables edge nodes of the entire spectrum, from low-power microcontrollers to high-performance edge gateways, to participate in anomaly detection, achieving high adaptability in heterogeneous edge environments.

[0016] 2. This invention enables edge nodes to establish dynamic collaborative groups and perform distributed cross-verification based on device topology when they detect suspected anomalies through an edge collaborative verification mechanism. This solves the problems of high false alarm rate and inability to identify cross-device anomalies caused by isolated and uncooperative edge node detection in the prior art. It significantly reduces the false alarm rate caused by sensor local faults and noise while maintaining low communication overhead, and improves the ability to detect cross-device associated anomalies. Attached Figure Description

[0017] Figure 1 This is a schematic diagram of the system architecture of the present invention.

[0018] Figure 2 This is a flowchart of the method steps of the present invention.

[0019] Figure 3 This is a schematic diagram of the internal structure of the resource adaptive screening module and the switching of the screening level. Detailed Implementation

[0020] The specific embodiments of the present invention will be further described below with reference to the accompanying drawings. It should be noted that the description of these embodiments is for the purpose of helping to understand the present invention, but does not constitute a limitation of the present invention.

[0021] Furthermore, the technical features involved in the various embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0022] Please see the appendix Figure 1 -Appendix Figure 3 This invention discloses an industrial IoT anomaly detection system for edge nodes, the detection system comprising: Data acquisition module: Deployed at each edge node, it is used to acquire industrial sensor data streams in real time, preprocess the acquired raw sensor data, and generate standardized sensor data sequences; Resource adaptive screening module: Deployed on each edge node, it is used to obtain the real-time available computing resource parameters of the edge node, dynamically select and activate the corresponding level of screener from the pre-deployed multi-level screener set according to the preset resource model mapping strategy, so as to perform anomaly screening on sensor data stream and generate suspected abnormal events with confidence. The multi-level screening set includes at least a first-level screening based on online statistics, a second-level screening based on a knowledge distillation compression model, and a third-level screening based on a channel-pruned deep neural network; Edge Collaborative Validation Module: Deployed on each edge node, it is used to determine the adjacent edge nodes within the collaborative range and establish a dynamic collaborative group when a suspected abnormal event occurs, based on the preset device topology relationship. The abnormal feature summary vector is sent to the nodes within the collaborative group, and a pre-trained graph attention network is used to perform distributed cross-validation on the suspected abnormal event. The module outputs the abnormal event confirmed by the collaboration and the collaborative confidence score. The anomaly feature summary vector is a compressed, fixed-dimensional low-dimensional vector of the output of the intermediate layer of the currently active screener.

[0023] Example 1 This embodiment describes the deployment and operation process of the present invention on low-resource industrial sensor nodes.

[0024] Deployment Scenario: A temperature monitoring system for a reactor in a chemical plant. The edge node uses an STM32F407 microcontroller with a Cortex-M4 core, a clock speed of 168MHz, 192KB of SRAM, and 1MB of Flash. It connects to four temperature sensors and two pressure sensors via an RS485 bus, with a sampling frequency of 1Hz. This node is in an extremely low-resource scenario and can only run the first-level screener.

[0025] S1. Data Acquisition: Edge nodes acquire raw readings from 4 temperature sensors and 2 pressure sensors at a frequency of 1Hz. Preprocessing operations include timestamp alignment of data from each sensor channel, linear interpolation filling of occasional read timeout data, removal of invalid readings exceeding the sensor range, Z-score normalization of data from each channel, generation of standardized sensor data sequences, and division of the data sequences into fixed time windows of 60 sampling points, i.e., the most recent minute of data.

[0026] S2. Resource Assessment and Screener Selection: The edge node collects the current CPU utilization value (approximately 12%) and available memory (approximately 110KB) every 5 seconds. Power consumption is sufficient, and the data arrival rate is 6 sensor readings per second. The collected parameters are compared with the preset resource-model mapping table. Currently, available memory is less than 256KB and CPU utilization is less than 90%, only meeting the operating conditions for the first-level screener. The resource adaptive screening module activates the first-level screener. In this embodiment, only the first-level screener runs; no screener level switching occurs.

[0027] S3. Adaptive Anomaly Screening: The first-level screener performs anomaly detection calculations on sensor data within each time window. It maintains a sliding window with a length of 60 sampling points for each sensor and calculates the adaptive Z-score value of the data within the window online. The median of the data within the window is used instead of the traditional mean, and the absolute deviation of the median is used instead of the traditional standard deviation to resist the contamination of the statistics by occasional spikes. At the same time, it maintains the exponentially weighted moving average and exponentially weighted moving variance of each sensor. When the current sampled value deviates from the exponentially weighted moving average by more than 3 times the moving standard deviation, it is marked as a suspected anomaly. When 3 consecutive sampling points are marked as suspected anomalies, a suspected anomaly event with confidence is generated.

[0028] S4. Edge Collaborative Cross-Validation: After a suspected abnormal event occurs at this node, based on the preset equipment topology, the temperature sensor of this reactor belongs to the same process segment as the temperature sensors of adjacent reactors in the same workshop, with a topological distance of 1 hop. The collaborative scope is determined to be nodes B and C. Since the currently activated first-level screener has no available intermediate feature layers in the neural network, the abnormal feature summary vector is directly concatenated into a 32-dimensional vector by the deviation magnitude, deviation duration, deviation sensor identifier, and current resource level encoding, and sent to nodes B and C. Each node runs its currently activated screener to perform a quick evaluation of its own sensor data and returns the evaluation result as a summary vector of the same dimension. The graph attention network of this node uses the summary vector of this node as the query vector and the summary vectors returned by nodes B and C as the key vector and value vector, respectively, and calculates the aggregation weight through attention.

[0029] S5. Anomaly Confirmation and Result Output: The collaboration confidence score of the graph attention network output is 0.78. The temperature data of node B shows a slight abnormal upward trend. The deviation is smaller than that of this node but the direction is consistent. The dynamic collaboration threshold is calculated as 0.65 based on the number of nodes participating in the collaboration (3), the average topological distance of 1 hop, and the historical detection accuracy. The collaboration confidence score of 0.78 is greater than 0.65. This suspected abnormal event is confirmed as a real abnormal event. An abnormal alarm is generated and reported to the cloud. The anomaly type is progressive temperature anomaly. The equipment involved are reactor A and reactor B.

[0030] Technical Results: In this embodiment, a microcontroller node with only 192KB of SRAM successfully achieved real-time anomaly screening using a first-level screener with approximately 80KB of RAM. Furthermore, collaborative verification with neighboring nodes eliminated potential false alarms caused by single-node sensor failures and successfully identified genuine cross-device progressive temperature anomalies. If the fixed-model approach of existing technologies were used, this microcontroller node would be unable to deploy a detection model and would completely lose its anomaly detection capability.

[0031] Example 2 This embodiment describes the deployment and operation process of the present invention on a medium-computing-power industrial edge gateway.

[0032] Deployment Scenario: An equipment status monitoring system in an automotive parts processing workshop. The edge nodes adopt an industrial edge gateway based on RK3588, with four Cortex-A76 cores plus four Cortex-A55 cores and 8GB RAM. It connects to vibration sensors, spindle current sensors and coolant temperature sensors of 12 CNC machine tools in the workshop via Ethernet. Each machine tool has a total of 6 sensor signals with a sampling frequency of 100Hz.

[0033] S1. Data Acquisition: The edge gateway collects 72 sensor signals from 12 CNC machine tools at a frequency of 100Hz. The preprocessing operations include aligning the timestamps of each sensor channel, using the gateway's local clock as a reference, filling occasional communication packet loss with the previous valid value, replacing outliers exceeding 3 times the standard deviation of the sensor range with the median, performing min-max normalization on the data of each channel to the interval between 0 and 1, and dividing the preprocessed data sequence into 200 sampling points in a 2-second time window, with each data segment having a dimension of 200 by 72.

[0034] S2. Resource Assessment and Screener Selection: A complete set of three screeners is deployed on the edge gateway, including a Level 1 statistical screener (approximately 90KB memory), a Level 2 knowledge distillation student model screener (approximately 3.5MB memory, with one-eighth the number of parameters of the teacher model), and a Level 3 channel-pruning CNN / LSTM hybrid model screener (approximately 42MB memory, with a pruning rate of 60% and INT8 quantization). The edge gateway collects resource parameters at a 5-second cycle. Under normal operating conditions, CPU utilization is approximately 35%, available memory is approximately 5.2GB, data arrival rate is stable, and all three screeners can run. The policy decision unit selects to activate the Level 3 screener with the highest detection accuracy. When the gateway simultaneously performs a local data compression task, causing CPU utilization to rise to 78%, the resource adaptive screening module detects resource stress. After a lag judgment, if the resource stress persists for more than 30 seconds, the screener is automatically downgraded from Level 3 to Level 2, freeing up approximately 38MB of memory and reducing CPU usage by approximately 25%. When the compression task is completed and CPU utilization drops below 40% for more than 15 seconds, the screener automatically reverts to Level 3.

[0035] S3. Adaptive Anomaly Screening: The third-level screener performs CNN and LSTM hybrid model inference on each 200x72 data segment. The CNN part extracts the spatial coupling features between the 72 sensor channels through three-layer convolutional layers with pruned channels, while the LSTM part captures temporal dependency patterns through a two-layer pruned recurrent network. The model outputs the anomaly confidence score and anomaly category probability distribution for each time window. Windows with anomaly confidence scores exceeding the dynamic threshold of 0.72 are marked as suspected anomaly events. The second-level screener uses a knowledge distillation student model during degradation operation. Its structure consists of two lightweight CNN layers plus a single-layer GRU, with an inference speed approximately three times that of the third-level screener and a detection accuracy approximately 92% of that of the third-level screener.

[0036] S4. Edge Collaborative Cross-Validation: 12 CNC machine tools are divided into 3 work sections according to the production process. The spindle current sensor of machine tool M03 detects an anomaly score of 0.74, exceeding the dynamic threshold of 0.72, generating a suspected anomaly event. The edge collaborative validation module, based on the equipment topology, defines the collaborative scope as the edge nodes M01, M02, M03, M04, and M05 corresponding to the 5 machine tools within the same work section group, establishing a dynamic collaborative group. The anomaly feature summary vector is generated by reducing the output feature map of the last convolutional layer of the third-level screener to 64 dimensions through global average pooling, then projecting it to 32 dimensions through a random projection matrix, and sending it to the other 4 nodes within the collaborative group. Each neighboring node runs its current screener to quickly evaluate its own data and returns a summary vector of the same dimension. The graph attention network employs 4-head attention, 2-layer message passing, and a hidden layer dimension of 64. It uses the summary vector of M03 as the query vector and the summary vectors of the 4 neighboring nodes as the key and value vectors. The weights of each neighbor are calculated by scaling dot product attention, and the collaborative verification results are output after multi-head concatenation and a fully connected classification layer.

[0037] S5. Anomaly Confirmation and Result Output: Nodes M02 and M04 also detected a slight spindle current anomaly pattern, with anomaly scores of 0.58 and 0.55 respectively. The data of nodes M01 and M05 were normal. The collaborative confidence score of the graph attention network output was 0.83. The dynamic collaborative threshold was calculated as 0.70 based on the number of nodes participating in the collaboration (5), the average topological distance of approximately 1.2 hops, and the historical detection accuracy of the nodes. Since the collaborative confidence score of 0.83 is greater than 0.70, the suspected anomaly event was confirmed as a real anomaly event. Furthermore, since multiple nodes in the collaborative group detected similar anomaly patterns, the event was further determined to be a common anomaly of the spindle drive system of the first section group rather than a single machine failure of M03. An anomaly alarm was generated and reported.

[0038] Technical effect: In this embodiment, the edge gateway can run the highest accuracy level 3 screener during normal operation, and can automatically degrade to level 2 screener when resources are scarce to ensure continuous detection without interruption. Collaborative verification not only confirms the authenticity of the anomaly, but also reveals that the anomaly is a common section-level anomaly rather than a single machine failure through the similarity of the anomaly patterns of neighboring nodes, providing key information for subsequent maintenance decisions.

[0039] Comparative Example This comparative example adopts the technical solution of the patent published under publication number "CN118193954B" entitled "A Method and System for Anomaly Detection of Industrial Equipment Based on Federated Learning" to illustrate the limitations of the prior art.

[0040] Comparative Scheme Description: According to the technical solution of the above patent, the same CNN and LSTM hybrid anomaly feature extraction model is uniformly deployed on all edge nodes. The edge nodes are only responsible for extracting anomaly features, and all anomaly determinations are completed in the cloud through federated learning aggregation.

[0041] Comparative results in low-resource scenarios: In the same low-resource scenario as Example 1, the minimum memory requirement of the CNN and LSTM hybrid model is approximately 2MB, the model parameters are approximately 500KB, and the intermediate activation tensor during runtime is approximately 1.5MB, far exceeding the 192KB SRAM limit of the STM32F407. The model cannot be loaded on this node, and the edge nodes completely lose their anomaly detection capabilities. Even after forcibly pruning the model to its limits, the model's memory usage is still no less than 800KB while retaining basic detection capabilities, making it impossible to run under the 192KB constraint. The sensor data covered by this node cannot be processed locally and must all be uploaded to the cloud; all monitoring at this node becomes completely unusable when the network is interrupted.

[0042] Comparative results in a medium-resource scenario: In the same medium-resource scenario as in Example 2, the CNN and LSTM models can be deployed and run normally on the RK3588 edge gateway. However, when the gateway performs other computing tasks, which increases the CPU utilization, the model inference latency increases from the normal 20ms to more than 120ms, resulting in obvious detection lag.

[0043] More importantly, because the edge nodes of this patent operate independently during the detection and execution phase without a real-time collaboration mechanism, when the gateway detects an abnormal current in a single machine tool, it cannot perform cross-verification through neighboring nodes. This abnormality may be a real equipment failure or it may be occasional noise from the sensor itself.

[0044] In this comparative example, a current sensor on machine tool M03 experienced intermittent spikes due to loose wiring. The CNN and LSTM models flagged this as an anomaly with an anomaly score of 0.79 and reported it to the cloud. After federated aggregation in the cloud, it was confirmed that the node's weights were normal, and the event was marked as a genuine anomaly, resulting in a false alarm. In the second example, the same sensor failure scenario was correctly identified as a single-node sensor failure through edge collaborative verification. Neighboring nodes showed no similar anomaly patterns, and the collaborative confidence score was only 0.35, lower than the collaborative threshold of 0.70, thus avoiding false alarms.

[0045] Summary of existing technology deficiencies exposed by comparison: First, the fixed model deployment strategy makes it impossible for low-resource nodes to participate in anomaly detection, resulting in severely insufficient system coverage in heterogeneous edge environments.

[0046] Second, edge node detection operates in isolation and lacks a real-time collaborative verification mechanism, making it impossible to distinguish between genuine device anomalies and local sensor malfunctions, leading to false alarms.

[0047] Based on the results of the above embodiments 1, 2 and comparative examples, in terms of hardware adaptability, the resource adaptive screening mechanism of the present invention enables nodes with extremely low resources to run the first-level screener to participate in anomaly detection. In contrast, the fixed CNN and LSTM models of the prior art cannot be deployed on such nodes at all. The resource adaptive orchestration of embodiment 2 also demonstrates the ability to automatically switch the screener level according to load changes during runtime, ensuring the continuity of the detection service.

[0048] Regarding detection accuracy, the edge collaborative verification mechanism of the present invention successfully identified progressive cross-equipment temperature anomalies in Example 1 through multi-node cross-verification, and correctly distinguished between section-level common anomalies and single-machine sensor failures in Example 2. In contrast, existing technical solutions, due to the lack of a collaborative mechanism, misjudged occasional spikes caused by loose sensor wiring as real anomalies, resulting in false alarms.

[0049] This invention achieves full spectrum coverage from nodes with extremely low resources to high-performance gateways in heterogeneous edge environments through the coordinated operation of two core mechanisms: resource adaptive screening and edge collaborative verification. At the same time, it significantly reduces the false alarm rate through multi-node redundant verification.

[0050] While the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the invention. Any variations and modifications can be made by those skilled in the art without departing from the spirit and scope of the invention. Therefore, any modifications, equivalent changes, and alterations made to the above embodiments based on the technical essence of the present invention, without departing from the scope of the invention, fall within the protection scope defined by the claims of the present invention.

Claims

1. An industrial IoT anomaly detection system for edge nodes, characterized in that, The detection system includes: Data acquisition module: Deployed at each edge node, it is used to acquire industrial sensor data streams in real time, preprocess the acquired raw sensor data, and generate standardized sensor data sequences; Resource adaptive screening module: Deployed on each edge node, it is used to obtain the real-time available computing resource parameters of the edge node, dynamically select and activate the corresponding level of screener from the pre-deployed multi-level screener set according to the preset resource model mapping strategy, so as to perform anomaly screening on sensor data stream and generate suspected abnormal events with confidence. The multi-level screener set includes at least a first-level screener based on online statistics, a second-level screener based on a knowledge distillation compression model, and a third-level screener based on a channel pruning deep neural network; Edge Collaborative Verification Module: Deployed on each edge node, when the suspected abnormal event occurs, it determines the adjacent edge nodes within the collaborative range according to the preset device topology relationship and establishes a dynamic collaborative group, sends the abnormal feature summary vector to the nodes in the collaborative group, uses a pre-trained graph attention network to perform distributed cross-validation on the suspected abnormal event, and outputs the collaboratively confirmed abnormal event and collaborative confidence. The anomaly feature summary vector is a compressed, fixed-dimensional low-dimensional vector output from the intermediate layer of the currently active screener.

2. The industrial IoT anomaly detection system for edge nodes according to claim 1, characterized in that, The first-level screener is implemented based on the adaptive Z-score statistic and exponentially weighted moving average with a sliding window, with a memory footprint of less than 100 kilobytes, and is suitable for microcontroller-level resource-constrained nodes. The second-level screener is implemented based on a compressed model obtained by knowledge distillation of a pre-trained neural network in the cloud, with a memory footprint of less than 5 megabytes, and is suitable for edge nodes with medium computing power. The third-level screener is implemented based on a hybrid model of a convolutional neural network and a long short-term memory network with channel pruning and integer quantization, with a memory footprint of less than 50 megabytes, and is suitable for high-performance edge gateways.

3. The industrial IoT anomaly detection system for edge nodes according to claim 1, characterized in that, In the resource adaptive screening module, the real-time available computing resource parameters include at least CPU utilization, available memory, power budget and data arrival rate. The resource model mapping strategy is based on a preset lookup table method and lightweight decision tree to map each resource parameter to the corresponding screener level. When switching screener levels, a hysteresis threshold mechanism is used to prevent frequent jitter.

4. The industrial IoT anomaly detection system for edge nodes according to claim 1, characterized in that, In the edge collaborative verification module, the graph attention network is constructed with an industrial field equipment topology graph as the skeleton. The nodes of the equipment topology graph are either equipment or sensors, and the edges are either physical connections or process coupling relationships. The attention weights of the edges are adaptively learned by the network. The graph attention network uses the anomaly feature summary vector of the node initiating collaboration as the query vector, and the anomaly feature summary vectors of each neighbor node in the collaboration group as the key vector and value vector. After aggregating neighbor information through a multi-head attention mechanism, the collaborative verification result is output.

5. The industrial IoT anomaly detection system for edge nodes according to claim 1, characterized in that, In the edge collaboration verification module, the threshold for determining the collaboration confidence level is dynamically weighted based on the number of nodes participating in the collaboration, the topological distance between each node and the node initiating the anomaly, and the historical detection accuracy of each node.

6. An industrial IoT anomaly detection method for edge nodes according to any one of claims 1-5, characterized in that, The detection method includes the following steps: S1. Data Acquisition: Edge nodes collect industrial sensor data streams in real time, perform preprocessing operations on the collected raw sensor data, and generate standardized sensor data sequences. S2. Resource Assessment and Screener Selection: Edge nodes acquire their own real-time available computing resource parameters and, according to a preset resource model mapping strategy, dynamically select and activate a screener that matches the current resource conditions from a multi-level screener set pre-deployed on the edge nodes; the multi-level screener set includes at least a first-level screener based on online statistics, a second-level screener based on a knowledge distillation compression model, and a third-level screener based on a channel pruning deep neural network; S3. Adaptive anomaly screening: The activated screener performs segment-by-segment window processing on the sensor data sequence to generate suspected anomaly events with anomaly confidence scores. S4. Edge Collaborative Cross-validation: When the suspected abnormal event occurs, the adjacent edge nodes within the collaborative range are determined according to the preset device topology relationship and a dynamic collaborative group is established. The fixed-dimensional abnormal feature summary vector generated by compression based on the output of the currently activated intermediate layer of the screener is sent to the nodes in the collaborative group. The suspected abnormal event is distributed cross-validated using a pre-trained graph attention network to obtain the collaborative validation result. S5. Anomaly Confirmation and Result Output: Based on the collaborative verification results output by the graph attention network, suspected anomaly events with collaborative confidence exceeding the preset judgment threshold are confirmed as real anomaly events, anomaly alarms are generated and anomaly detection results are output. For suspected anomaly events with collaborative confidence not exceeding the judgment threshold, they are marked as false alarms caused by sensor local faults or noise and recorded in the log.

7. The industrial IoT anomaly detection system for edge nodes according to claim 6, characterized in that, In step S1, the real-time acquisition of industrial sensor data streams by the edge node includes: acquiring continuous time-series signals generated by at least one of the vibration sensors, temperature sensors, current sensors, and pressure sensors deployed on industrial equipment; the preprocessing operations include timestamp alignment, missing value filling, outlier removal, and normalization; the standardized sensor data sequence is a data segment divided into fixed time windows, and each data segment contains standardized sampled values ​​of all sensor channels within a time window.

8. The industrial IoT anomaly detection system for edge nodes according to claim 7, characterized in that, S2 specifically includes: collecting the CPU utilization, available memory, power budget, and data arrival rate of the edge node at fixed intervals as the real-time available computing resource parameters; comparing each collected resource parameter with the hierarchical threshold in the preset resource-model mapping table one by one to determine the highest screener level allowed to be activated under the current resource conditions; when it is necessary to switch from the current screener level to the target screener level, a lag judgment is performed; if the target level is higher than the current level, the resource conditions corresponding to the target level are required to continuously meet the first time threshold before the upgrade switch is performed; if the target level is lower than the current level, the resource shortage state is required to continuously meet the second time threshold before the downgrade switch is performed; the first time threshold is less than the second time threshold.

9. An industrial IoT anomaly detection system for edge nodes according to claim 8, characterized in that, In step S4, the abnormal feature summary vector is generated as follows: the feature map output of the intermediate layer of the currently activated screener is obtained, and after dimensionality reduction by global average pooling, it is compressed into a fixed-dimensional vector of 32 to 128 dimensions by random projection or principal component analysis. When the currently activated screener is the first-level screener, the abnormal feature summary vector is concatenated into a fixed-dimensional vector by deviation magnitude, deviation duration, deviation sensor identifier and current resource level encoding.

10. An industrial IoT anomaly detection system for edge nodes according to claim 9, characterized in that, In step S5, the preset judgment threshold is dynamically weighted based on the number of nodes participating in the collaboration, the topological distance between each node and the node initiating the anomaly, and the historical detection accuracy of each node.

Images