Agricultural internet of things gated slow attention anomaly detection method and system

Abstract

The application relates to an agricultural Internet of Things gate control slow attention anomaly detection method and system. The method comprises the following steps: acquiring training samples; constructing an anomaly detection model; extracting local features of temperature and humidity telemetry data and message level network communication data in a double scale, splicing the local features with state auxiliary evidence and effective masks according to fixed fields after mode adaptation to generate double-scale unified local states with consistent field semantics; generating current state representation by light mapping of the current scale; inputting a slow scale sequence into a single time sequence coding network; generating a bounded additive residual from the state auxiliary evidence; only correcting the slow scale attention; obtaining a long-term state representation by weighted summation; fusing two types of state outputs to obtain an anomaly prediction result; and using the trained model for agricultural Internet of Things anomaly detection. By using the method, the response speed of sudden anomalies and the long-term anomaly recognition ability can be considered at the same time when the resources of edge devices are limited, and the comprehensive performance and deployability of the agricultural Internet of Things multi-modal anomaly detection are improved.

Description

Technical Field

[0001] This application relates to the field of agricultural Internet of Things (IoT) technology, and in particular to a method and system for detecting slow attention anomalies in agricultural IoT gating systems. Background Technology

[0002] With the development of agricultural IoT technology, multimodal joint anomaly detection technology for temperature and humidity telemetry and message-level network communication has been widely applied. This type of technology can simultaneously combine agricultural environmental sensor data and network operation data to conduct risk assessment, covering two detection scenarios: abnormal environmental conditions and abnormal communication behavior. It is an important technical support for ensuring the stable operation of agricultural IoT systems. Currently, traditional multimodal temporal anomaly detection methods typically first collect agricultural sensor data and network communication data, extract corresponding statistical features within a sliding window, and then directly concatenate or separately encode different modal features. The current window sequence and historical window sequences are then input into one or more recurrent neural networks, combined with ordinary attention or attention mechanisms corrected by external evidence to complete temporal weighting, and finally, the results of each branch are fused to output a normal or abnormal judgment result.

[0003] However, traditional multimodal temporal anomaly detection methods still have several limitations in practical applications in agricultural IoT scenarios. Temperature and humidity data are mainly low-frequency continuous changes, while network communication data are mainly high-frequency discrete messages. The sampling frequency, units, and field meanings of these two types of data differ. Directly concatenating the original fields for fusion can easily lead to features with large numerical ranges dominating the model learning process. Missing values ​​and placeholder values ​​are also easily misidentified as true normal values, resulting in insufficient semantic stability of the fields after heterogeneous data fusion. The distinction between missing data, invalid fields, and true zero values ​​is low, leading to a high false alarm probability. Sudden increases in traffic, port expansion, abrupt changes in protocol ratios, or jumps in temperature and humidity within the current window usually possess strong discriminative power. Inputting these phenomena along with long-term historical data into a recurrent network can easily cause the recursive and memory update processes to mix the current sharp changes with the historical background, resulting in the smoothing of current anomalous features, a longer computational path for anomaly responses, and a weakening of the discriminative information for sudden anomalies. External evidence such as data quality, deviations from normal profiles, and persistence of anomalies are often directly injected into loop gates or superimposed on attention scores in an unbounded manner. The former can alter the memory state at multiple subsequent time steps, easily leading to memory accumulation bias, while the latter can cause a small amount of quality error or profile deviation to excessively dominate historical state selection. Both methods lack clear constraints on the impact of individual evidence on the final risk assessment, resulting in insufficient controllability and auditability of the evidence's role. Furthermore, the architecture of configuring multiple sets of loop networks for the current and long-term states incurs significant overhead from redundant parameter storage and time-series computation. For current window information that only needs to be directly retained, the additional loop processing does not yield corresponding benefits; instead, it increases inference latency and deployment costs, and has poor adaptability for low-latency deployments on edge gateways and other computing-restricted devices. Summary of the Invention

[0004] Therefore, it is necessary to provide a method and system for detecting slow attention anomalies in agricultural IoT gating systems to address the aforementioned technical problems.

[0005] A method for detecting slow attention anomalies in agricultural IoT gating systems, the method comprising: Acquire training samples; the training samples include temperature and humidity telemetry data and message-level network communication data collected from agricultural IoT. An anomaly detection model is constructed; the anomaly detection model includes a unified local state construction module, a current state mapping module, a slow-scale temporal coding module, a gated slow attention module, and a binary classification risk output module. The unified local state construction module extracts the sensor local features of the temperature and humidity telemetry data at the current scale and the network local features of the message-level network communication data at the current scale and the slow scale, respectively. Modality adaptation mapping is performed on the sensor local features and the network local features, respectively. Then, these features are concatenated with the state auxiliary evidence and effective mask at the corresponding scale in a fixed field order to obtain the unified local state at the current scale and the unified local state at the slow scale with consistent field semantics. The state auxiliary evidence includes data quality evidence, normal profile deviation evidence, and abnormal persistence evidence. The current state mapping module performs a lightweight mapping on the current scale unified local state to generate a current state representation. The slow-scale temporal coding module forms a slow-scale state sequence from multiple consecutive slow-scale unified local states, which is then temporally encoded by a single temporal coding network to output the hidden state corresponding to each time step. The gated slow attention module calculates the basic attention score based on the hidden state at each time step, generates a bounded additive residual based on the state auxiliary evidence at the corresponding time step, adds the bounded additive residual to the basic attention score at the corresponding time step in an additive manner, normalizes the corrected attention score using an effective mask, and weights and sums the hidden states to obtain the long-term state representation. The current state representation and the long-term state representation are fused by the binary risk output module to output the anomaly prediction result. The anomaly detection model is trained based on the training samples and a pre-set loss function to obtain a trained anomaly detection model, which is then used for anomaly detection in agricultural IoT.

[0006] An agricultural IoT-gated slow attention anomaly detection system, the system comprising: The sample acquisition module is used to acquire training samples; the training samples include temperature and humidity telemetry data and message-level network communication data collected from agricultural Internet of Things. The model building module is used to build an anomaly detection model; the anomaly detection model includes a unified local state building module, a current state mapping module, a slow-scale temporal coding module, a gated slow attention module, and a binary classification risk output module. A unified state generation module is used to extract sensor local features of the temperature and humidity telemetry data at the current scale and the slow scale, and network local features of the message-level network communication data at the current scale and the slow scale, respectively, through the unified local state construction module. Modality adaptation mapping is performed on the sensor local features and the network local features, and then they are concatenated with state auxiliary evidence and effective masks at the corresponding scale in a fixed field order to obtain a unified local state at the current scale and a unified local state at the slow scale with consistent field semantics. The state auxiliary evidence includes data quality evidence, normal profile deviation evidence, and abnormal persistence evidence. The current state calculation module is used to perform a lightweight mapping on the current scale unified local state through the current state mapping module to generate a current state representation; The slow-scale coding module is used to form a slow-scale state sequence from multiple consecutive slow-scale unified local states through the slow-scale temporal coding module, perform temporal coding through a single temporal coding network, and output the hidden state corresponding to each time step. The gated attention calculation module is used to calculate the basic attention score based on the hidden state of each time step through the gated slow attention module, generate a bounded additive residual based on the state auxiliary evidence of the corresponding time step, add the bounded additive residual to the basic attention score of the corresponding time step in an additive manner, normalize the corrected attention score using an effective mask and sum it with weighted hidden states to obtain the long-term state representation. The result prediction module is used to fuse the current state representation and the long-term state representation through the binary risk output module and output the anomaly prediction result. The result output module is used to train the anomaly detection model based on the training samples and a pre-set loss function to obtain a trained anomaly detection model, and to use the trained anomaly detection model for agricultural Internet of Things anomaly detection.

[0007] The aforementioned agricultural IoT-gated slow attention anomaly detection method and system, by constructing a unified local state with fixed field semantics, concatenates two heterogeneous features—temperature and humidity, and network—along with state-supporting evidence and effective masks in a fixed order. This unifies the representation spaces of the two modalities, preserves the identification of missing and invalid information, reduces misjudgments caused by field misalignment and ambiguity of missing values, and enables joint analysis of heterogeneous data at the same detection moment. Through an asymmetric architecture where the current-scale state is directly mapped to the fusion layer via lightweight mapping and only slow-scale sequences are input into a single temporal coding network, it avoids the current sudden features being smoothed by iterative recursion, shortens the response path for sudden anomalies, and reduces redundant iterative computation, balancing detection response speed and long-term temporal feature extraction capabilities. By generating bounded additive residuals through state-supporting evidence, and applying limited additive correction only to the slow-scale attention score, it allows quality and deviation evidence to participate in long-term historical weight selection without changing the internal state of the recurrent network, improving the controllability of historical state selection. The embodiments of the present invention can simultaneously take into account the response speed to sudden anomalies and the ability to identify long-term anomalies under the condition of limited edge device resources, thereby improving the overall performance and deployability of multimodal anomaly detection in agricultural IoT. Attached Figure Description

[0008] Figure 1 This is a flowchart illustrating an agricultural IoT gating slow attention anomaly detection method in one embodiment; Figure 2 This is a schematic diagram of the auxiliary generation process for temperature and humidity coupling features in one embodiment; Figure 3 This is a schematic diagram of the gated slow attention calculation process in one embodiment; Figure 4 This is a schematic diagram of the overall process of gated slow attention anomaly detection in one embodiment; Figure 5 This is a flowchart of an agricultural IoT gating slow attention anomaly detection process in one embodiment. Detailed Implementation

[0009] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0010] In one embodiment, such as Figure 1 As shown, an agricultural IoT gating slow attention anomaly detection method is provided, including the following steps: Step 102, obtain training samples; the training samples include temperature and humidity telemetry data and message-level network communication data collected from agricultural IoT. Temperature and humidity telemetry data collected from agricultural IoT refers to continuous sensing records collected by agricultural field sensing devices, including temperature, relative humidity, collection timestamp, device identification, and validity markers. Message-level network communication data refers to message-level data in the agricultural IoT transmission link, including message timestamp, packet length, communication direction, protocol type, port, session identifier, and field parsing validity markers. Feature calculation is preferably completed based on message header and time information.

[0011] It is understandable that retaining complete validity markers and original field information can provide sufficient data support for subsequent feature extraction and quality assessment, avoid invalid or missing data being misjudged as normal, and help improve the data reliability of subsequent detection processes.

[0012] Step 104: Construct an anomaly detection model; the anomaly detection model includes a unified local state construction module, a current state mapping module, a slow-scale temporal coding module, a gated slow attention module, and a binary risk output module.

[0013] Step 106: Extract sensor local features of temperature and humidity telemetry data at the current scale and slow scale, and network local features of message-level network communication data at the current scale and slow scale, respectively, through the unified local state construction module. Perform modal adaptation mapping on the sensor local features and network local features respectively, and then concatenate them with state auxiliary evidence and effective mask at the corresponding scale in a fixed field order to obtain unified local states at the current scale and slow scale with consistent field semantics. State auxiliary evidence includes data quality evidence, normal profile deviation evidence, and abnormal persistence evidence. Sensor local features are a set of numerical and validity features statistically obtained from temperature and humidity telemetry data within the corresponding scale window; network local features are a set of message timing, traffic distribution, protocol port, and session dimension features statistically obtained from message-level network communication data within the corresponding scale window; modal adaptation mapping is to perform standardization and spatial mapping on the two types of heterogeneous features respectively, eliminate dimensional differences, and establish a unified feature space that can be spliced; fixed field order means that the arrangement of each component in the unified local state remains consistent throughout the entire process of training, verification, testing, and deployment; the unified local state is a standardized state vector that integrates two types of modal adaptation features, state auxiliary evidence, and validity mask, and the same field definitions and arrangement rules are used for the current scale and the slow scale.

[0014] It is understandable that the processing method of combining independent modal adaptation with fixed fields can balance the feature weights of the two types of heterogeneous data, avoid the dominance of features with large numerical ranges in model learning, and eliminate misjudgments caused by field misalignment and missing value ambiguity. This can improve the stability of joint analysis of heterogeneous data and help reduce detection errors in modality missing scenarios.

[0015] Step 108: Perform a lightweight mapping on the current scale unified local state through the current state mapping module to generate the current state representation; Lightweight mapping is a shallow feature transformation structure consisting of at least one fully connected layer and a nonlinear activation function, without containing recurrent units; the current state representation is a feature vector obtained by lightweight mapping of the current scale-uniform local state, which is used to carry the sudden abnormal feature information within the current detection window.

[0016] It is understandable that using shallow networks to directly process current-scale features can significantly shorten the computational path from current sudden anomalies to risk output. It can also fully preserve highly discriminative information such as sudden increases in traffic, sudden changes in protocol ratios, and temperature and humidity jumps within a window, which is beneficial for improving the response speed and discrimination accuracy to window-level sudden anomalies.

[0017] Step 110: The slow-scale state sequence is formed by combining multiple consecutive slow-scale unified local states through the slow-scale temporal coding module, and then temporal coding is performed through a single temporal coding network to output the hidden state corresponding to each time step. A slow-scale state sequence is a historical state sequence formed by splicing together multiple consecutive slow-scale unified local states in chronological order; a single temporal coding network is a recurrent neural network with only one set of learnable parameters throughout the entire process, specifically designed to handle the temporal dependencies of slow-scale state sequences; the hidden state is the feature vector output by the temporal coding network, used to carry the temporal context information of each historical time step.

[0018] It is understandable that configuring only one time-series coding network for slow-scale historical sequences can avoid the repetitive parameter storage and redundant calculations caused by multi-branch recurrent networks, effectively compress the model size and reduce inference latency, which is beneficial for deployment on devices with limited computing resources such as edge gateways. At the same time, it can fully extract the time-series features of long-period anomalies such as slow drift, continuous freezing, and long-term communication structure changes.

[0019] Step 112: Calculate the basic attention score based on the hidden state of each time step using the gated slow attention module, generate a bounded additive residual based on the state auxiliary evidence of the corresponding time step, add the bounded additive residual to the basic attention score of the corresponding time step in an additive manner, normalize the corrected attention score using an effective mask, and sum the hidden state by weight to obtain the long-term state representation. The base attention score is an initial attention score calculated solely based on the hidden states at each time step, used to measure the importance of different historical time steps to the current detection; the bounded additive residual is a correction amount generated by transforming the state-assisted evidence at the corresponding time step through a bounded function, and its absolute value is rigidly constrained by a preset upper limit, and is added to the base attention score only in an additive manner.

[0020] It is understandable that by correcting the slow-scale attention score solely through bounded additive residuals, state-assisted evidence can participate in the weight selection of long-term historical states. At the same time, it can avoid the accumulation of errors caused by evidence directly rewriting the internal state of the recurrent network. It can control the influence of evidence at a single time step within a clear range, which is conducive to improving the controllability, interpretability, and auditability of long-term historical selection.

[0021] Step 114: The current state representation and the long-term state representation are fused through the binary classification risk output module to output the anomaly prediction result; The fusion of current state representation and long-term state representation refers to combining the two types of feature vectors to form a joint feature vector that simultaneously contains burst information of the current window and long-term historical background information; the anomaly prediction result is the predicted value output by the model that reflects the degree of anomaly at the current detection time.

[0022] It is understandable that merging the results of two paths with different time characteristics and outputting a unified risk can simultaneously meet the needs of distinguishing between sudden and long-term anomalies, forming a complementary advantage of the two types of features, covering more types of anomaly scenarios, and helping to improve the comprehensiveness and overall discrimination capability of anomaly detection.

[0023] Step 116: Train the anomaly detection model based on the training samples and the pre-set loss function to obtain the trained anomaly detection model, and use the trained anomaly detection model for agricultural IoT anomaly detection.

[0024] In the aforementioned agricultural IoT-gated slow attention anomaly detection method, by constructing a unified local state with fixed field semantics, the heterogeneous features of temperature and humidity and network, state-assisted evidence, and effective masks are concatenated in a fixed order. This unifies the representation space of the two modalities, preserves the identification of missing and invalid information, reduces misjudgments caused by field misalignment and ambiguity of missing values, and enables joint analysis of heterogeneous data at the same detection time. Through an asymmetric architecture where the current-scale state is directly mapped to the fusion layer via lightweight mapping and only slow-scale sequences are input into a single temporal coding network, the current sudden features are avoided from being smoothed by iterative recursion, shortening the response path of sudden anomalies. Simultaneously, redundant iterative computation is reduced, balancing detection response speed and long-term temporal feature extraction capabilities. By generating bounded additive residuals through state-assisted evidence, and applying limited additive correction only to the slow-scale attention score, quality and deviation evidence can participate in long-term historical weight selection without changing the internal state of the recurrent network, improving the controllability of historical state selection. The embodiments of the present invention can simultaneously take into account the response speed to sudden anomalies and the ability to identify long-term anomalies under the condition of limited edge device resources, thereby improving the overall performance and deployability of multimodal anomaly detection in agricultural IoT.

[0025] In one embodiment, extracting sensor local features of temperature and humidity telemetry data at the current and slow scales, and network local features of message-level network communication data at the current and slow scales, respectively, includes: generating detection anchor points with a preset step size, and constructing a current-scale window and a slow-scale window at each detection anchor point; for temperature and humidity telemetry data, calculating numerical statistics and data validity statistics of temperature, relative humidity, and absolute humidity within each scale window, and simultaneously calculating the coupling deviation characteristics of the current window based on a temperature and humidity coupling benchmark model fitted with normal samples, which together form the sensor local features of the corresponding scale; for message-level network communication data, calculating statistics of message timing, traffic distribution, protocol port, and session dimension based on message header fields within each scale window, which forms the network local features of the corresponding scale; the sensor local features and network local features at the current and slow scales use the same field definitions and arrangement order.

[0026] Specifically, this involves acquiring temperature and humidity telemetry data and message-level network communication data from agricultural IoT. Temperature and humidity records include at least temperature (T), relative humidity (H), acquisition timestamp, device or subsystem identifier, and validity flags. Network records include at least message timestamp, packet length, communication direction, protocol type, source / destination port, session identifier, sequence information, Received Signal Strength Indication (RSSI) or link quality, and field resolution validity flags. Network characteristics are preferably calculated from the message header and time information, without parsing the application layer payload. For missing, out-of-bounds, duplicate timestamps, and unresolved fields, anchor points are not directly deleted; instead, missing masks and validity flags are retained.

[0027] Using the initial time t0 and the anchor step size Δt a Generate detection anchor point t k Where k is the index of the local state anchor point or the detection time, Δt a The interval between adjacent anchor points. For each t k Create sensor windows W respectively s , k and network window W n , k Sensor windows typically use a fixed time length, while network windows can use a fixed time length, a fixed number of messages, or a combination of both. Adaptive windows can also be used to dynamically adjust the statistical range. Different modes do not need to correspond one-to-one; only the window ends must map to the same anchor point. When a mode has no valid observations at that anchor point, the input is constructed with zero padding or a preset placeholder value, and the corresponding valid mask is set to 0. ; Where k is the anchor index, Δt a The interval between adjacent anchor points is defined. Each anchor point stores the start and end times of the window, the actual number of samples, the theoretical number of samples, the number of valid samples, and the source identifier, which are used to calculate the integrity of the window and the continuity of time in subsequent calculations.

[0028] A current-scale window and a slow-scale window are constructed at the same detection anchor point. The current-scale window describes rapid changes near the most recent anchor point; its local features directly form the current-scale unified local state without additional current-scale recurrent network configuration. The slow-scale window compresses a longer statistical range into a single slow-scale unified local state, and multiple consecutive slow-scale unified local states are then combined to form a time series. For the sensor window W... s , kCalculate the last values, mean, standard deviation, range, slope, and difference statistics for temperature, relative humidity, and absolute humidity (AH), as well as the proportions of missing, duplicate, frozen, out-of-bounds, and valid samples, and retain the valid mask for each dimension: ; ; Where x can represent T, H, or AH, N k τ is the number of valid samples within the window. i For the i-th original sampling time, only the time variable is represented, s x (k) represents the least squares linear slope. If the number of valid samples is lower than the preset lower limit, the corresponding statistic is set as a placeholder value and identified by a mask, instead of using an abnormally large interpolation result as a substitute.

[0029] For network window W n , k First, the adjacent arrival interval, packet length, direction, protocol, port, and session statistics are calculated from the message header fields. The message rate is defined as the number of valid messages within the window divided by the window duration; the uplink / downlink ratio is obtained by the ratio of the number of uplink messages to the total number of messages; the number of sessions and ports are counted by deduplicating the 5-tuple and port set, respectively; the protocol ratio is obtained by dividing the number of messages of each protocol by the total number of messages; the communication cycle deviation is obtained by the robust normalized distance of the current arrival interval or cycle statistics relative to the normal profile.

[0030] This yields the original local feature vector x of the sensor. s , k and the original local feature vector x of the network n , k The current scale and the slow scale use the same field names, order, and statistical definitions, but allow different window lengths, message counts, and step sizes. Therefore, they are state abstractions with the same field semantics but different statistical granularities. The two modalities are allowed to have different dimensions, and each dimension corresponds to a fixed physical or communication meaning; the feature order remains consistent during the training and deployment phases.

[0031] Absolute humidity is calculated using the following formula: ; ; ; Among them, e s(T) represents the saturated vapor pressure at temperature T, e represents the actual vapor pressure, and AH represents the absolute humidity. Absolute humidity is used to reduce the ambiguity caused by temperature changes when only relative humidity is used, and together with the temperature and humidity coupling residual, it forms the sensor-side deviation characteristic.

[0032] The temperature and humidity coupling model, part of the auxiliary feature generation module, is a lightweight model that fits the baseline relationship between temperature and humidity changes using normal data and outputs deviation residuals. It describes the statistical coupling relationship between temperature and humidity changes in a normal agricultural environment. This module does not directly output anomaly categories, nor does it replace the main time-series model. Instead, it generates interpretable deviations and incorporates sensor local features and deviation evidence D from normal profiles. To avoid anomaly samples contaminating the normal relationship, the coupling model only uses samples with normal labels and sufficient window integrity from the training set for fitting, and the parameters are frozen after training.

[0033] like Figure 2 The diagram shown illustrates the auxiliary generation process for temperature and humidity coupling characteristics. First, the temperature difference ΔT between adjacent effective observations is calculated in chronological order. i Humidity difference ΔH i When adjacent observations cross a missing interval or the time interval exceeds a preset multiple, the difference will not participate in the coupled fitting, and the corresponding difference mask will be set to invalid. ; After robustly truncating or standardizing the effective difference pairs, only a normal window is used to fit the ridge regression model. The ridge regularization term is used to mitigate parameter instability when temperature variations are small or samples are collinear. ; Where λ is the regularization coefficient, and the slope β and intercept γ of the ridge regression model are frozen after training. The temperature and humidity coupled benchmark model can be implemented using ridge regression, or fitted using Huber robust regression, recursive least squares, or low-order polynomial regression. During the detection phase, model parameters are kept frozen or updated at low frequency. During the detection phase, humidity changes are predicted based on the current ΔT, and the residuals between the actual ΔH and the predicted value are calculated. To ensure that the residuals from different seasons or devices have a comparable scale, a robust scale of the normal training residuals is used. Normalize: ; in, For the normalized coupling residual of the k-th window, To provide a robust measure of the normal training residuals, the median absolute deviation, interquartile range, or standard deviation of the normal residuals can be used, where η is a small constant to prevent division by zero. This excludes the normalized coupled residuals. In addition, the following are calculated: ① the synchronous correlation coefficient between ΔT and ΔH within the window; ② the maximum absolute correlation coefficient and corresponding lag within the finite lag set; ③ the consistency rate of the sign direction of the temperature difference and humidity difference; ④ | | The number of times or the duration of consecutive exceedances of the normal threshold; ⑤ The slope and deviation of absolute humidity. The above quantities are arranged in a fixed order to form a coupled feature vector c. k And as part of the sensor features and evidence of deviations from normal profiles.

[0034] In one embodiment, state-supporting evidence is generated based on statistical data of the corresponding window; data quality evidence is used to characterize the degree of missing data, time reliability, and field parsing validity within the corresponding window; normal profile deviation evidence is used to characterize the deviation of the current window state from the normal operating baseline; and anomaly persistence evidence is generated by exponential recursion from normal profile deviation evidence and is used to characterize the degree of continuous accumulation of state deviation.

[0035] In one embodiment, modal adaptation mapping is performed on sensor local features and network local features respectively, and then concatenated with state-supporting evidence and effective masks at the corresponding scale in a fixed field order to obtain a unified local state at the current scale and a unified local state at the slow scale with consistent field semantics. This includes: performing standardization processing on sensor local features and network local features at each scale using training set statistical parameters; the training set statistical parameters are generated based on training samples in the training set, including the center value and robust scale parameters of the corresponding features; the standardized sensor local features are input into the sensor adapter for spatial mapping, and the standardized network local features are input into the network adapter for spatial mapping, respectively, to obtain sensor adaptation representation and network adaptation representation; the sensor adaptation representation, network adaptation representation, state-supporting evidence and effective masks at the corresponding scale are concatenated in a preset fixed field order to form a unified local state vector with fixed dimensions; the generated unified local state at the current scale and the unified local state at the slow scale use the same field order and dimension definition.

[0036] Specifically, due to and The dimensions, units, and value ranges of these features differ, so they cannot be directly concatenated and fed into a Long Short-Term Memory (LSTM) network for learning. First, continuous features are standardized using only training set statistics; proportional features are kept within the [0,1] interval; and categorical protocols or directional features are encoded using fixed codes. Extreme values ​​are symmetrically truncated. During validation, testing, and deployment phases, the training set mean, scale, and encoding table must be reused, and refitting is prohibited. ; The standardized sensor and network features are then input into the lightweight adapter. and The adapter can be composed of a fully connected layer followed by a layer-normalized Gaussian Error Linear Unit (GELU) or a Rectified Linear Unit (ReLU), and will map the two modes to a preset dimension d respectively. s and d n The mapping dimension is not required to be equal to the original dimension. Its purpose is to compress redundancy, eliminate dimensional differences, and establish a concatenable representation space, without undertaking cross-window memory. ; in For sensor mode adapters, For network mode adapters, , These are the sensor local feature vector and the network local feature vector at the k-th anchor point, respectively. , These are the sensor representation and network representation after modal adaptation, respectively. After obtaining the adapted representation... and Subsequently, further evidence of data quality was constructed. Evidence of deviation from normal portrait and evidence of abnormal persistence All three types of evidence are determined by the current anchor point at the corresponding scale and its historical statistics, without using the true classification label of the current sample. ; in, It reflects the degree of missing data in the measured sample size relative to the theoretical sample size. It reflects the deviation of the actual sampling or message interval from the reference interval. This reflects the proportion of fields that failed to be parsed, went out of bounds, or were invalid. In practice, sensor quality and network quality can be calculated separately, and then combined, averaged, or maximized to form a result. To unify the technical meaning, Each component in the equation is assigned a value that indicates "the larger the value, the less reliable the system". ; ; in, For the r-th portrait feature in the current window, and These represent the center and robust scale of the corresponding feature in the normal training data, respectively. It can be obtained from the temperature and humidity coupled residuals and correlation changes. It is obtained from the deviation of absolute humidity from the normal range. , and These represent deviations in network speed, protocol structure, and communication cycle, respectively. All deviation components are non-negative, making D... k The larger the value, the more significant the deviation from a normal image. ; Used to describe whether the deviation persists. It can be determined by D. k The value is obtained through exponential recursion, and can also include the number of consecutive exceedances, cumulative exceedance duration, and the interval between the most recent exceedance. The recursion is initialized independently for each sample and each scale; when the anchor point is invalid or the sequence restarts, P is set to zero to avoid crosstalk between different devices or different samples. ρ controls the weight of the current deviation and historical deviations; a larger ρ indicates greater focus on the current window.

[0037] In the freeze implementation, ρ is set to 0.3, meaning the current deviation accounts for 30% and the historical persistent state accounts for 70%; when the sequence restarts or the time step becomes invalid, P is reset to zero. A typical implementation can select ρ based on the persistence half-life of the target anomaly: ; ; The effective mask for the k-th anchor point, also called the efficiency summary, is used to identify whether the sensor representation, network representation, and Q / D / P components are available. The placeholder representation of the missing mode after the adapter can be set to zero, but a corresponding mask must be set simultaneously to prevent the model from misinterpreting "zero values" as the true normal state. .

[0038] The unified local state is a state vector composed of multiple types of information arranged in a fixed field order, consisting of sensor adaptation representation, network adaptation representation, Q, D, P, efficiency summary, and scale label. The current scale and the slow scale share the same field contract. The unified local state is a state vector formed by concatenating sensor adaptation representation, network adaptation representation, Q, D, P, efficiency summary, and scale label in a fixed field order. The current scale and the slow scale use the same field contract and dimension definition. The above formula represents the universal field contract for any scale; to avoid confusion, the unified local state at the current scale will be denoted as […]. Both have the same field structure but different statistical granularity. The slow-scale unified local state is denoted as z. k s Any modality loss only changes the corresponding value and mask, without altering the vector length or field position. A 56-dimensional example is shown in Table 1.

[0039] Table 1. A 56-dimensional example of unified local state.

[0040] In one embodiment, performing a lightweight mapping on the current-scale unified local state to generate a current-state representation includes: inputting the current-scale unified local state into a shared lightweight mapping network, processing it through a fully connected layer and a nonlinear activation function to generate a current-state representation; the computation link of the current-state representation is independent of the slow-scale temporal coding module and the gated slow attention module.

[0041] Specifically, for the detection anchor point k, the current scale unified local state generated by the current scale window is taken. Lightweight mapping shared across all anchor points f obtains the current state representation. , This is a lightweight representation of the current scale-uniform local state obtained through a lightweight mapping without passing through a recurrent network, used to preserve burst information at the current window level. The lightweight mapping includes at least one fully connected layer and a nonlinear activation layer, optionally with an additional normalization layer; this path does not enter the Long Short-Term Memory network and does not accept Q, D, or P gating. In a 56→64-dimensional embodiment: .

[0042] In one embodiment, a slow-scale state sequence is formed by combining multiple consecutive slow-scale unified local states and performing temporal encoding through a single temporal encoding network to output the hidden state corresponding to each time step. This includes: concatenating multiple consecutive slow-scale unified local states in chronological order according to a preset slow-scale step size to form a slow-scale state sequence; inputting the slow-scale state sequence into a single-layer unidirectional long short-term memory network to perform temporal modeling and outputting the hidden state corresponding to each time step; the long short-term memory network contains only one set of learnable network parameters.

[0043] Specifically, according to the preset slow-scale window and step size, continuous slow-scale unified local states are combined into a slow-scale state sequence of length 6; for locations with insufficient history, only a mask is used, and observations are not copied: ; in This is a slow-scale state sequence ending at the k-th anchor point. The number of consecutive local states constituting the slow-scale sequence is used. The slow-scale state sequence is input into a unique temporal coding network. The main embodiment uses a single-layer, unidirectional Long Short-Term Memory (LSTM) network with an input dimension of 56 and a hidden dimension of 64, which does not use random deactivation. This network is a single temporal coding network that only processes slow-scale state sequences. It can also be replaced with a Gated Recurrent Unit (GRU), a temporal convolutional network, or a lightweight state-space model. After replacement, the core mechanisms of direct access to the current state, single temporal coding for slow scale, and bounded evidence correction are still maintained. ; The model has only one instance of a Long Short-Term Memory (LSTM) network; its running state is reinitialized across different samples, different acquisition groups, and discontinuous sequences, without propagation across samples or data partitions. Slow-scale temporal coding can be implemented using an LSM network, or it can be replaced with a gated recurrent unit, a temporal convolutional network, or a lightweight state-space model. After replacement, the core mechanisms of direct access to the current state, single slow-scale temporal coding, and bounded evidence correction remain unchanged. The current-scale unified local state and the slow-scale unified local state at the same anchor point have the same field structure, but are generated statistically by different windows, and are not a reuse of the same input tensor in two paths.

[0044] In one embodiment, calculating the basic attention score based on the hidden state at each time step and generating a bounded additive residual based on the state-assisted evidence at the corresponding time step includes: calculating the basic attention score at the corresponding time step based on the hidden state at each time step; concatenating the state-assisted evidence at the corresponding time step into an evidence vector, and generating an evidence threshold through linear transformation and activation function processing; converting the evidence threshold into a bounded additive residual through a bounded function; the absolute value of the bounded additive residual is hard-constrained by a preset upper limit; the computation link of the bounded additive residual is isolated from the internal state update of the single temporal coding network.

[0045] It is worth noting that this invention applies evidence-gated slow attention only to the hidden state output by the unique slow-scale long short-term memory network. Evidence gating is a mechanism that calculates a threshold based on reliability, deviation from normal profile, and persistence of anomalies to generate a slow-scale attention correction. The current state does not pass through the recurrent network or this gating, thus preserving a direct response to current changes such as sudden increases in traffic, temperature and humidity jumps, and field anomalies. Each slow-scale time step uses its corresponding evidence of data reliability, deviation from normal profile, and persistence of anomalies, with the evidence and hidden state corresponding one-to-one in chronological order. The role of gated slow attention is to provide a limited-amplitude auxiliary correction to the basic attention, rather than replacing the basic attention or rewriting the recurrent memory. The basic attention score is a logarithmic score of the basic attention calculated solely based on the slow-scale hidden state, without any external Q, D, or P evidence correction.

[0046] The core computing process is as follows Figure 3 The diagram shows the gated slow attention calculation process. It includes the following steps: The slow-scale hidden state is 64-dimensional, data quality evidence is 3-dimensional, evidence of deviation from normal profiles is 9-dimensional, and evidence of persistent anomalies is 9-dimensional, forming a 21-dimensional gated input; the gated intermediate representation is 8-dimensional. The corresponding dimensional relationships are as follows: ; ; in For a single slow-scale temporal coding network, the hidden state is... j This is the time step index within the slow-scale sequence. This is the evidence vector for the corresponding time step. For evidence threshold, The linear transformation weight matrix maps the evidence vector to the evidence threshold. The linear transformation weight vector maps the evidence threshold to the bounded additive residual.

[0047] The first step is to calculate the basic attention score for each slow-scale hidden state. The specific calculations are as follows: .

[0048] The second step is to construct evidence vectors for the corresponding time steps, using an optimal combination of reliability, normal profile deviation, and anomaly persistence: ; The reliability is calculated as 1 minus the data quality unreliability, ensuring a clear and consistent numerical direction. Data quality evidence reflects the proportion of missing data, field effectiveness, and window completeness. Deviation evidence reflects temperature and humidity coupling residuals, absolute humidity deviations, network speed deviations, protocol ratio deviations, and communication cycle deviations. Abnormal persistence evidence reflects whether these deviations are continuous. The gated input preferably comprises reliability, deviation, and persistence. Each evidence component is standardized using only training set statistics, and the same set of parameters is reused in the verification, testing, and deployment phases. ; In the formula, r is the index of the evidence component. and These represent the center and scale of the corresponding component in the training set, respectively. To prevent small constants with a denominator of zero, this process avoids the validation set or deployment data from having a reverse effect on the gating parameters.

[0049] The third step is to calculate the evidence threshold: ; In addition to the above-mentioned implementation method of combining linear transformation with activation function, the evidence threshold can also be generated by multilayer perceptron or monotonic neural network.

[0050] The fourth step is to convert the threshold into a bounded additive residual: ; in This is a bounded additive residual, meaning its absolute magnitude is controlled by a preset upper limit and is added additively to the base attention score at a slow scale as a correction. This is the scaling factor for the gated residual. This is the upper limit of what is allowed. Bounded additive residuals can be implemented using the hyperbolic tangent function, or using a translated and scaled sigmoid function, a piecewise saturation function, or an interval clipping function.

[0051] Step 5: Apply additive adjustments only to the baseline attention score: ; in This is the corrected attention score.

[0052] Step 6: After applying the effective mask, perform normalization, corresponding to the Softmax operation in the diagram: ; in This is for normalized attention weights.

[0053] Step 7: Generate the slow-scale context, i.e., the slow-scale long-term state representation: .

[0054] When all slow-scale time steps of a sample are invalid, ordinary normalization is not performed. Instead, the long-term state representation is set to a zero vector, and risk assessment is completed solely based on the current state path, thus avoiding a zero denominator caused by full masking. The threshold, attention weights, and bounded additive residuals can be output as time-step-level diagnostic information, but they do not constitute additional classification labels or supervision heads.

[0055] The above structure has clear limitations: the evidence does not directly rewrite the input, forget, and output gates of the Long Short-Term Memory (LSTM) network, is not directly written into the memory state, is not directly multiplied into the hidden state or value vector, and does not replace the basic attention generated by the hidden state; the evidence only corrects the slow-scale attention logarithmic fraction through a bounded additive residual with limited amplitude. The range of the bounded function directly guarantees that the absolute value of the correction does not exceed a preset upper limit. Therefore, even if there is measurement error in the evidence, a single time step cannot rely on external evidence to unboundedly dominate the long-term state representation. This structural boundary is the main deterministic advantage of this scheme compared to unbounded evidence attention and direct injection of recurrent gates; whether the detection index is improved is evaluated by objective comparison results. ; Preset upper limit The value can be predetermined in the range of 0.05 to 0.25 based on the scale of the basic attention log score in the training set and the low false alarm operating point in the validation set; in a practical validation example, it is set to 0.15, and then frozen during the testing and deployment phases.

[0056] The forward detection process of gated slow attention does not rely on additional stabilization loss; the bounded function itself guarantees that the correction amount will not exceed a preset upper limit. To further reduce potential gating degradation during training (gate saturation, convergence of gate values ​​between samples, or inconsistent evidence directions), constraints on correction magnitude, gate saturation, gate variance, and monotonicity of evidence direction can be added. These constraints are preferred training measures, do not change the model structure during deployment, and are not necessary conditions for implementing gated slow attention. ; ; ; ; ; Where N is the effective gated time step, κ∈(0,1), and This is the boundary of the unsaturated interval. R=1 is the minimum variance threshold. Q. One ablation example uses κ=0.8, =0.05、 =0.95、 =0.005, and =10 -5 , =10 -4 , =10 - ³、 =10 -5 The values ​​mentioned above are all optional training parameters and do not change the deployment structure.

[0057] Bounded functions, by their computational definition, guarantee that the absolute value of the correction amount does not exceed a preset upper limit.

[0058] In one embodiment, the bounded additive residuals are additively added to the base attention score of the corresponding time step. The modified attention score is normalized using an effective mask and the hidden states are weighted and summed to obtain the long-term state representation. This includes: adding the bounded additive residuals of each time step to the base attention score of the corresponding time step to obtain the modified attention score; performing exponential normalization on the modified attention score using an effective mask to obtain the attention weights for each time step; performing a weighted summation on the hidden states of each time step according to the attention weights to generate the long-term state representation; when all slow-scale time steps are invalid states, the long-term state representation is set to a zero vector, and only the current state representation participates in subsequent anomaly detection.

[0059] Specifically, the current path directly maps the unified local state at the current scale to the current state representation, which is used to preserve evidence of sudden anomalies that have already formed within the current scale window: ; The slow-scale hidden state is weighted by effective masking and gated slow attention to form a long-term state representation. This is used to describe slow drift, persistent freezing, and long-term changes in communication behavior. ; The main implementation method directly concatenates the current state representation and the long-term state representation. Alternatively, fusion can be achieved using interpolation, element-wise multiplication, gated fusion, or a small multilayer perceptron. The two paths respectively retain current burst information and historical persistent information, avoiding the simultaneous compression of two different types of temporal features using the same recursive process. .

[0060] The fusion of the current state representation and the long-term state representation can be achieved through direct concatenation, or through interpolation, element-wise multiplication, gated fusion, or a small multilayer perceptron structure. The concatenated vector is passed through two fully connected layers to obtain the logarithmic risk score, which is then converted into anomaly probability using a sigmoid function. One embodiment uses a mapping from 128 dimensions to 64 dimensions and from 64 dimensions to 1 dimension: ; in, For current-long-term convergence, This represents the anomaly probability. The dimensions of the first-layer weight matrix, the first-layer bias, the second-layer weight matrix, and the second-layer bias are respectively: ; A higher anomaly probability indicates that the joint representation of the current state and the long-term operational background is closer to the anomalous pattern. The model only outputs a binary classification result of normal or anomalous; attention weights, thresholds, and bounded additive residuals are used to explain the risk formation process and do not constitute additional classification output. Since the current path is not subject to evidence gating, even if external evidence is biased, it will not simultaneously change the current state representation and the long-term state representation, thus preserving an independent current response path. The binary classification decision threshold is denoted as θ and is determined only by the frozen validation set; test data and out-of-distribution samples do not participate in the selection of structure, hyperparameters, or thresholds. ; in, θ represents the candidate binary classification threshold, where α is the preset maximum false positive rate (FPR), which is the false positive rate (FPR) at which normal samples are classified as abnormal. This FPR can be 0.01, 0.05, or 0.10. Among the candidate thresholds that satisfy the FPR constraint, the one with the highest validation set recall is selected as the optimal threshold θ. opt If multiple thresholds have the same recall rate, the one with the lower false positive rate should be selected. Alternatively, the threshold with the highest F1 score (harmonic average of precision and recall) on the validation set can be selected. Once determined, the threshold remains unchanged during the testing and deployment phases.

[0061] In one embodiment, the loss function includes a weighted binary cross-entropy classification loss, a gated stabilization constraint loss, and a model parameter regularization term. In this embodiment, the class weights of the weighted binary cross-entropy classification loss are determined by the proportion of normal and abnormal samples in the training set; the gated stabilization constraint loss includes at least one of the following: correction magnitude constraint, threshold saturation constraint, threshold variance constraint, and evidence direction monotonicity constraint; the model parameter regularization term is used to constrain the range of values ​​for network parameters and suppress overfitting.

[0062] Specifically, the main classification loss uses weighted binary cross-entropy. The class weights are determined solely by the number of normal and outlier samples in the training set, used to mitigate class imbalance, and no validation or test set labels are used for fitting. ; Total loss Classification loss Gating system degradation loss Composed of regularization terms for model parameters: .

[0063] Training data is first divided into training, validation, and test sets based on device, collection batch, or time period. Then, standardized parameters, normal profiles, coupled regression models, and class weights are fitted onto the training set. During training, early stopping and model selection are performed based on the area under the precision-recall curve of the validation set, low false positive rate-recall ratio, or weighted loss. The test set is used only for final evaluation. In one implementation, modality consistency or modality dropout auxiliary losses can be added to prevent the model from relying solely on the network or sensors; however, these auxiliary losses do not add output classes during deployment.

[0064] During training, the unified local state at the current scale and the unified local state at the slow scale are generated statistically by different windows, and there is no situation where the same state tensor is used as the input of the current path and the input of the last step of the slow-scale sequence simultaneously. If the current scale and the slow scale reuse the same set of modal adapter parameters, the gradients of the two paths are accumulated only at the shared adapter parameters according to the normal backpropagation rules; if independent adapters are used, they are updated separately. This verification embodiment does not set a stopping gradient or an additional gradient balancer, but uses gradient clipping with a maximum norm of 1.0 for the entire model, and the parameter updates are completed by the same optimizer.

[0065] In one embodiment, the steps for anomaly detection in agricultural IoT using a trained anomaly detection model include: determining a binary classification threshold on a validation set according to a rule that maximizes recall under a limited maximum false alarm rate; freezing the threshold throughout the testing and deployment phases; inputting the temperature and humidity telemetry data and message-level network communication data to be detected into the trained anomaly detection model and outputting the corresponding anomaly probability; comparing the anomaly probability with the binary classification threshold and outputting the binary classification detection result.

[0066] In one specific embodiment, such as Figure 4 As shown, a schematic diagram of the overall process for gated slow attention anomaly detection is provided. Each detection anchor point completes data cleaning, local statistics, quality assessment, normal profile deviation calculation, and continuous recursion according to the current scale and slow scale, respectively, forming a unified local state with fixed field positions through modal adaptation. The unified local state at the current scale is transformed into a current state representation through lightweight mapping; the continuous unified local states at the slow scale form a slow-scale state sequence and are input into a single temporal coding network; data quality evidence Q, normal profile deviation evidence D, and anomaly persistence evidence P only apply bounded correction to the slow-scale attention score. After the current state representation and the long-term state representation are fused, a single binary risk head outputs "normal" or "abnormal". The input, processing, and output correspondence of each module is shown in Table 2 below: Table 2. Inputs, Processing, and Outputs of the Core Module

[0067] It is understandable that, given the different sampling frequencies, dimensions, and reliability of agricultural sensor data and message-level network communication data, the technical problem addressed by this invention is how to simultaneously preserve current emerging evidence and long-term continuous changes, while ensuring that external quality, deviation, and persistent evidence participate in historical selection without contaminating the recurrent memory. In this invention, the direct access to the current state and the single recursive approach at the slow scale constitute an asymmetric structure to address the possibility of recurrent smoothing of window-level strong discriminative features. The current and slow scales use the same field contract but different statistical windows, ensuring that the two paths have comparable field semantics without repeated input of the same tensor. The three types of state auxiliary evidence are neither used as labels nor input into the internal gating units of the recurrent network; they only generate bounded additive residuals that act solely on the logarithmic fraction of the slow-scale attention. The absolute magnitude of the residuals is constrained by a preset upper limit and does not directly affect the hidden states and value vectors. The evidence action path is clear and auditable, and can be output for time-step-level diagnosis. Bounded additive correction further ensures that the current path and recurrent memory are not directly rewritten by external evidence. Finally, the current state representation and the long-term state representation are fused by a single binary risk head to form a unified risk output result. Temperature and humidity coupled profiling, continuous recursion, binary classification judgment threshold selection and optional gating monotonic constraints together constitute a subordinate protection layer. The above-mentioned designs are interdependent and functionally coordinated, and are not simply parallel technical features.

[0068] The effectiveness of this invention was verified through experiments. In the publicly available data experiments, the EDEN temperature and humidity sampling period was 5 minutes. The current-scale sensor window was 30 minutes, containing a total of 6 sampling points; the current-scale network window used 256 messages. The current-scale unified local state z... k c Describes rapid changes near the most recent anchor point. The slow-scale sensor window is 120 minutes, containing 24 sampling points; the slow-scale network statistics retain 1024 messages. Each slow-scale unified local state z is represented. j s All data are obtained by compressing this longer window, where j is the time step index within the slow-scale state sequence. A slow-scale state sequence is composed of six consecutive unified local states at the slow scale, with adjacent states spaced 30 minutes apart, covering approximately 270 minutes in total. The field names and order are consistent between the current scale and the slow scale; the scale marker is used to distinguish window configurations; they are not the same tensor at the same anchor point. When historical data is insufficient, only a mask marker is used, and observations are not copied. The above parameters are determined based on the actual sampling period of publicly available data and do not restrict other embodiments from using one-minute sampling or other window configurations. Extracted from the normal temperature and humidity window of the training set. and Ridge coefficients were determined using cross-validation. , fitting and The model retains the median and median absolute deviation of the normal residuals as robust metrics. During the inference phase, the model is not retrained; only the normalized coupling residuals, synchronous correlations, and lag correlations are output.

[0069] The upper limit of bounded additive residuals is generally within the range of 0.05 to 0.25, pre-determined based on the scale of the basic attention logarithmic score in the training set and the low false alarm index in the validation set; in this embodiment, it is fixed at 0.15. The persistence recursion coefficient ρ is fixed at 0.3, and the slow scale length L... s =6, the current state mapping dimension and the temporal network hidden dimension are both 64.

[0070] Table 3 Selection and Freezing Method of Core Parameters

[0071] The dataset used in this experiment contains 48,391 samples from different sources, including 23,656 samples in the training set, 12,394 samples in the validation set, and 12,341 samples in the existing test set. The data comes from 23 independent collection groups, and the collection groups do not cross the training, validation, and test partitions. After excluding out-of-distribution samples, the actual training samples are 23,518, including 1,792 normal samples and 21,726 abnormal samples; the primary validation samples are 10,854, including 3,887 normal samples and 6,967 abnormal samples. Five pre-fixed random initializations were used for repeated training. Each batch consisted of 256 samples, with a maximum of 30 training epochs; training stopped when the validation metric showed no improvement for five consecutive epochs. The optimizer was an Adaptive Moment Estimator Optimizer with weight decay (AdamW), with a base learning rate of 10. - ³, the gating parameter learning rate is 3×10 - ³, the weight decay factor is 10 -4 The gradient norm is capped at 1.0. Different models use the same data order, common parameter initialization, sample weights, and early stopping rules under the same random initialization. The main evaluation metrics are the area under the precision-recall curve, and the anomalous recall rate when the false positive rate is no more than 1%, 5%, and 10%. The maximum F1 score, the false positive rate for normal samples, the number of parameters, the model file size, and the inference time are also recorded.

[0072] The current-state direct access model maps the unified local state at the current scale to a current-state representation using a lightweight mapping, inputting only the slow-scale state sequence into the temporal network. The dual-scale shared recursive control model, on the other hand, inputs both the current-scale and slow-scale state sequences into a temporal network with the same shared parameters. The two structures are compared to ordinary slow attention and gated slow attention versions, with all training conditions remaining consistent except for the method of obtaining the current-state representation.

[0073] Table 4. Five-way pairing results of ordinary slow attention structures

[0074] In the standard slow attention version, the area under the precision-recall curve of the main model increased by an average of 0.009375, and the 95% paired confidence interval was [0.003547, 0.015351]; the recall rate increased by an average of 0.046074 when the false positive rate was no more than 5%.

[0075] Table 5. Five-way pairing results of gated slow attention structures

[0076] In the gated slow attention version, the area under the precision-recall curve of the main model increased by an average of 0.011792, and the 95% paired confidence interval was [0.006446, 0.017138]; the recall rate increased by an average of 0.051069 when the false positive rate was no more than 5%.

[0077] Table 6 Average detection and resource indicators for the two types of structures

[0078] Under the experimental conditions, the current-state direct mapping structure achieved higher risk ranking metrics and lower false positive recall in five training iterations, along with lower inference latency. Therefore, this invention employs current-state direct mapping and slow-scale single-temporal encoding as the formal structure; the dual-scale shared recursive structure serves only as a control model.

[0079] This control group was used to verify the technical choices regarding the "location of evidence application" and "correction of amplitude boundaries" in the gated slow attention module, and to evaluate whether training constraints produce additional effects. The experiments compared the following in sequence: ordinary slow attention without external evidence; evidence directly written into the recurrent gate of the long short-term memory network; evidence unboundedly added to the attention score; using bounded additive residuals; and progressively adding amplitude, saturation, variance, and direction constraints to the bounded residuals. All models used the same data, the same training conditions, and the same control backbone, ensuring that differences in results primarily reflect the evidence intervention method, rather than changes in other modules.

[0080] Table 7 Comparison results of different evidence intervention methods and training constraints

[0081] The results show that direct injection of evidence into the loop gate achieves a higher average detection index, but requires more parameters and longer inference time, and involves external evidence continuously in updating the memory state, leading to a higher risk of loop gate saturation. Unbounded evidence attention does not change the loop memory, but the correction magnitude lacks a definite upper limit, resulting in larger residuals, higher false positives for normal samples, and greater fluctuations in repeated training in this experiment. The bounded additive residuals used in this scheme satisfy the absolute value of the correction not exceeding 0.15 across all effective time steps, limiting the influence of evidence within an auditable range from a computational structure perspective, while not rewriting the loop gate or the current state path. Although existing controls have not demonstrated that bounded residuals and magnitude, saturation, and variance constraints have a stable detection index advantage, they validate the technical trade-offs of this scheme in terms of evidence action boundaries, computational overhead, and interpretability. Monotonic constraints are only used to improve the consistency of the evidence action direction and are considered a preferred training measure. The gating module utilizes data quality, profile deviation, and persistent anomaly evidence to implement a magnitude-limited auxiliary correction to the attention score of slow-scale historical states, improving the controllability, interpretability, and auditability of long-term historical selection without changing the loop memory and the current state path.

[0082] It should be understood that, although Figure 1 The steps in the flowchart are shown sequentially as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order in which these steps are executed, and they can be performed in other orders. Figure 1 At least some of the steps in the process may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least some of the sub-steps or stages of other steps.

[0083] In one embodiment, an agricultural IoT gated slow attention anomaly detection system is provided, comprising: The sample acquisition module is used to acquire training samples; the training samples include temperature and humidity telemetry data and message-level network communication data collected from agricultural Internet of Things. The model building module is used to build an anomaly detection model; the anomaly detection model includes a unified local state building module, a current state mapping module, a slow-scale temporal coding module, a gated slow attention module, and a binary classification risk output module. A unified state generation module is used to extract sensor local features of the temperature and humidity telemetry data at the current scale and the slow scale, and network local features of the message-level network communication data at the current scale and the slow scale, respectively, through the unified local state construction module. Modality adaptation mapping is performed on the sensor local features and the network local features, and then they are concatenated with state auxiliary evidence and effective masks at the corresponding scale in a fixed field order to obtain a unified local state at the current scale and a unified local state at the slow scale with consistent field semantics. The state auxiliary evidence includes data quality evidence, normal profile deviation evidence, and abnormal persistence evidence. The current state calculation module is used to perform a lightweight mapping on the current scale unified local state through the current state mapping module to generate a current state representation; The slow-scale coding module is used to form a slow-scale state sequence from multiple consecutive slow-scale unified local states through the slow-scale temporal coding module, perform temporal coding through a single temporal coding network, and output the hidden state corresponding to each time step. The gated attention calculation module is used to calculate the basic attention score based on the hidden state of each time step through the gated slow attention module, generate a bounded additive residual based on the state auxiliary evidence of the corresponding time step, add the bounded additive residual to the basic attention score of the corresponding time step in an additive manner, normalize the corrected attention score using an effective mask and sum it with weighted hidden states to obtain the long-term state representation. The result prediction module is used to fuse the current state representation and the long-term state representation through the binary risk output module and output the anomaly prediction result. The result output module is used to train the anomaly detection model based on the training samples and a pre-set loss function to obtain a trained anomaly detection model, and to use the trained anomaly detection model for agricultural Internet of Things anomaly detection.

[0084] In one specific embodiment, such as Figure 5 As shown, a flowchart of an anomaly detection process for gated slow attention in agricultural IoT is provided, including a data acquisition and time alignment module, a local feature construction module, a unified local state module, a lightweight mapping module for the current state, a slow-scale temporal coding module, a gated slow attention module, a current-long-term fusion module, and a binary classification risk output module. The lightweight mapping module for the current state directly maps the unified local state at the current scale to the current state representation; the slow-scale temporal coding module processes continuous slow-scale state sequences using a temporal network; and the gated slow attention module only corrects the slow-scale attention score. These modules can be executed by an edge gateway, a server, or a combination of both.

[0085] Specific limitations regarding the agricultural IoT gated slow attention anomaly detection system can be found in the limitations of the agricultural IoT gated slow attention anomaly detection method described above, and will not be repeated here. Each module in the aforementioned agricultural IoT gated slow attention anomaly detection system can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the corresponding operations of each module.

[0086] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0087] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of the invention. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for detecting slow attention anomalies in agricultural IoT gating systems, characterized in that, The method includes: Acquire training samples; the training samples include temperature and humidity telemetry data and message-level network communication data collected from agricultural Internet of Things. An anomaly detection model is constructed; the anomaly detection model includes a unified local state construction module, a current state mapping module, a slow-scale temporal coding module, a gated slow attention module, and a binary classification risk output module. The unified local state construction module extracts the sensor local features of the temperature and humidity telemetry data at the current scale and the network local features of the message-level network communication data at the current scale and the slow scale, respectively. Modality adaptation mapping is performed on the sensor local features and the network local features, respectively. Then, these features are concatenated with the state auxiliary evidence and effective mask at the corresponding scale in a fixed field order to obtain the unified local state at the current scale and the unified local state at the slow scale with consistent field semantics. The state auxiliary evidence includes data quality evidence, normal profile deviation evidence, and abnormal persistence evidence. The current state mapping module performs a lightweight mapping on the current scale unified local state to generate a current state representation. The slow-scale temporal coding module forms a slow-scale state sequence from multiple consecutive slow-scale unified local states, which is then temporally encoded by a single temporal coding network to output the hidden state corresponding to each time step. The gated slow attention module calculates the basic attention score based on the hidden state at each time step, generates a bounded additive residual based on the state auxiliary evidence at the corresponding time step, adds the bounded additive residual to the basic attention score at the corresponding time step in an additive manner, normalizes the corrected attention score using an effective mask, and weights and sums the hidden states to obtain the long-term state representation. The current state representation and the long-term state representation are fused by the binary risk output module to output the anomaly prediction result. The anomaly detection model is trained based on the training samples and a pre-set loss function to obtain a trained anomaly detection model, which is then used for anomaly detection in agricultural IoT.

2. The method according to claim 1, characterized in that, Extracting the sensor local features of the temperature and humidity telemetry data at the current scale and the network local features of the message-level network communication data at the current scale and the slow scale respectively includes: Detection anchor points are generated with a preset step size, and a current scale window and a slow scale window are constructed at each detection anchor point. For temperature and humidity remote sensing data, the numerical statistics and data validity statistics of temperature, relative humidity and absolute humidity are calculated in each scale window. At the same time, the coupling deviation characteristics of the current window are calculated based on the temperature and humidity coupling benchmark model fitted by normal samples. Together, they form the local sensor features of the corresponding scale. For message-level network communication data, statistics on message timing, traffic distribution, protocol ports, and session dimensions are calculated based on the message header fields within each scale window to form local network features at the corresponding scale. The sensor local features and network local features at the current scale and the slow scale use the same field definitions and arrangement order.

3. The method according to claim 1, characterized in that, The process of performing modal adaptation mapping on sensor local features and network local features respectively, and then concatenating them with state-supporting evidence and effective masks at the corresponding scale in a fixed field order, to obtain a current-scale unified local state and a slow-scale unified local state with consistent field semantics includes: The local features of the sensor and the local features of the network at each scale are standardized using training set statistical parameters. The training set statistical parameters are generated based on training samples in the training set and include the center value and robust scale parameter of the corresponding feature. The standardized local features of the sensor are input into the sensor adapter to perform spatial mapping, and the standardized local features of the network are input into the network adapter to perform spatial mapping, so as to obtain the sensor adaptation representation and the network adaptation representation respectively. According to the preset fixed field order, the sensor adaptation representation, network adaptation representation, state auxiliary evidence of the corresponding scale and effective mask are concatenated in sequence to form a unified local state vector with fixed dimensions. The generated current-scale unified local state and the slow-scale unified local state use the same field order and dimension definition.

4. The method according to claim 1, characterized in that, The step of performing a lightweight mapping on the current scale-uniform local state to generate a representation of the current state includes: A lightweight mapping network that shares the local state input at the current scale is processed by a fully connected layer and a nonlinear activation function to generate a current state representation; the computation link of the current state representation is independent of the slow-scale temporal coding module and the gated slow attention module.

5. The method according to claim 1, characterized in that, The process of forming a slow-scale state sequence from multiple consecutive slow-scale unified local states, performing time-series coding through a single time-series coding network, and outputting the hidden state corresponding to each time step includes: According to the preset slow-scale step size, multiple consecutive slow-scale unified local states are spliced ​​together in time order to form a slow-scale state sequence. The slow-scale state sequence is input into a single-layer unidirectional long short-term memory network to perform temporal modeling, and the hidden state corresponding to each time step is output; the long short-term memory network contains only one set of learnable network parameters.

6. The method according to claim 1, characterized in that, The step of calculating the basic attention score based on the hidden state at each time step and generating bounded additive residuals based on the state-assisted evidence at the corresponding time step includes: Calculate the base attention score for each time step based on the hidden state at each time step; The state auxiliary evidence at the corresponding time step is concatenated into an evidence vector, which is then processed by a linear transformation and activation function to generate an evidence threshold. The evidence threshold is converted into a bounded additive residual by a bounded function; the absolute value of the bounded additive residual is hard-constrained by a preset upper limit; the computation link of the bounded additive residual is isolated from the internal state update of the single time-series coding network.

7. The method according to claim 1, characterized in that, The state-supporting evidence is generated based on statistical data from the corresponding window; The data quality evidence is used to characterize the degree of data missing, temporal reliability, and field parsing validity within the corresponding window. The normal image deviation evidence is used to characterize the magnitude of the deviation of the current window state from the normal operating baseline; The evidence of persistent abnormality is generated exponentially from the evidence of deviation from the normal profile and is used to characterize the degree of continuous accumulation of state deviation.

8. The method according to claim 1, characterized in that, The loss function includes weighted binary cross-entropy classification loss, gated stabilization constraint loss, and model parameter regularization term.

9. The method according to claim 1, characterized in that, The steps for anomaly detection in agricultural IoT using the trained anomaly detection model include: On the validation set, a binary classification threshold is determined according to the rule of maximizing recall under a limited maximum false positive rate. Once the threshold is determined, it is frozen throughout the testing and deployment phases. The temperature and humidity telemetry data to be detected, along with message-level network communication data, are input into the trained anomaly detection model, which outputs the corresponding anomaly probability. The anomaly probability is compared with the binary classification threshold, and the binary classification detection result is output.

10. An agricultural IoT-gated slow attention anomaly detection system, characterized in that, The system includes: The sample acquisition module is used to acquire training samples; the training samples include temperature and humidity telemetry data and message-level network communication data collected from agricultural Internet of Things. The model building module is used to build an anomaly detection model; the anomaly detection model includes a unified local state building module, a current state mapping module, a slow-scale temporal coding module, a gated slow attention module, and a binary risk output module. A unified state generation module is used to extract sensor local features of the temperature and humidity telemetry data at the current scale and the slow scale, and network local features of the message-level network communication data at the current scale and the slow scale, respectively, through the unified local state construction module. Modality adaptation mapping is performed on the sensor local features and the network local features, and then they are concatenated with state auxiliary evidence and effective masks at the corresponding scale in a fixed field order to obtain a unified local state at the current scale and a unified local state at the slow scale with consistent field semantics. The state auxiliary evidence includes data quality evidence, normal profile deviation evidence, and abnormal persistence evidence. The current state calculation module is used to perform a lightweight mapping on the current scale unified local state through the current state mapping module to generate a current state representation; The slow-scale coding module is used to form a slow-scale state sequence from multiple consecutive slow-scale unified local states through the slow-scale temporal coding module, perform temporal coding through a single temporal coding network, and output the hidden state corresponding to each time step. The gated attention calculation module is used to calculate the basic attention score based on the hidden state of each time step through the gated slow attention module, generate a bounded additive residual based on the state auxiliary evidence of the corresponding time step, add the bounded additive residual to the basic attention score of the corresponding time step in an additive manner, normalize the corrected attention score using an effective mask and sum it with weighted hidden states to obtain the long-term state representation. The result prediction module is used to fuse the current state representation and the long-term state representation through the binary risk output module and output the anomaly prediction result. The result output module is used to train the anomaly detection model based on the training samples and a pre-set loss function to obtain a trained anomaly detection model, and to use the trained anomaly detection model for agricultural Internet of Things anomaly detection.

Images