Apparatus and method for multi-modal industrial process anomaly detection

Abstract

The application provides a kind of multi-modal industrial process anomaly detection device and method, belong to industrial process safety detection, industrial network transmission anomaly identification technical field, it is deployed between the instruction transmission link of industrial host computer and lower computer, including data receiving module, binary tree modeling module, sequence check module, time delay check module, jitter analysis visualization module, exception alarm module.The application uses the above-mentioned multi-modal industrial process anomaly detection device and method, solves the technical problems that the existing industrial process detection scheme is only single-dimensional check, cannot distinguish transient time delay fault and long-term network jitter, cannot quantify link stability, retrieval efficiency is low and it is difficult to identify equipment failure and malicious instruction tampering attack, there is detection blind area, fault positioning difficulty.

Description

Technical Field

[0001] This invention relates to the fields of industrial process safety detection and industrial network transmission anomaly identification, and in particular to a device and method for multimodal industrial process anomaly detection. Background Technology

[0002] In industrial production scenarios such as intelligent manufacturing, chemical engineering, and power automation, standardized processes rely on a host computer continuously sending instruction messages with fixed timing and constant transmission cycles to lower-level computers to complete automated operations. The compliance of the instruction transmission sequence and the stability of the latency directly determine production quality and on-site safety. Once the instruction execution sequence is disordered or the transmission latency is out of control, it can easily lead to equipment downtime, batch scrapping of products, and in severe cases, it can induce safety accidents such as fires and equipment damage. Currently, basic anomaly monitoring methods are widely deployed in industrial sites, but existing detection solutions can only achieve single-dimensional monitoring and are difficult to adapt to the multi-type fault identification needs in complex industrial transmission scenarios, resulting in significant detection blind spots.

[0003] Existing industrial process monitoring technologies generally employ linear storage and traversal retrieval methods to process massive amounts of real-time command data, resulting in low retrieval and matching efficiency and failing to meet the requirements of high-frequency, low-latency industrial real-time detection. Furthermore, the monitoring logic focuses only on comparing a single latency threshold, capable of identifying only occasional, transient latency exceedances, and failing to distinguish between two fundamentally different types of link faults: one is transient link interference caused by occasional latency exceedances in a single command, and the other is long-term network degradation faults caused by continuous fluctuations in periodic errors across multiple frames due to line aging and network congestion. Traditional solutions lack time-series statistical quantification mechanisms, making it impossible to quantitatively assess the severity of link jitter over a period of time. Persistent, hidden network jitter is easily missed, and maintenance personnel struggle to predict link performance degradation trends in advance.

[0004] In addition, existing monitoring systems lack multi-dimensional linkage verification capabilities, failing to simultaneously identify anomalies in both command sequences and latency. Their defense capabilities against attacks such as equipment program failures, message tampering, and malicious command interruption are weak. Traditional alarm mechanisms can only output general anomaly alerts, unable to distinguish between different causes such as command errors, momentary transmission failures, and long-term network jitter. Fault localization lacks quantitative data and visual trend support, resulting in lengthy maintenance and troubleshooting times. Overall, existing technologies suffer from multiple shortcomings, including limited detection dimensions, insufficient fault differentiation capabilities, low data retrieval efficiency, inability to quantitatively assess network stability, and weak support for maintenance and tracing. They struggle to simultaneously address single-point process anomaly interception and global network link health assessment, failing to meet the complex safety management needs of current industrial production. Summary of the Invention

[0005] The purpose of this invention is to provide a device and method for multimodal industrial process anomaly detection, which solves the technical problems of existing industrial process detection schemes that only perform single-dimensional verification, cannot distinguish between instantaneous delay faults and long-term network jitter, cannot quantify link stability, have low retrieval efficiency, are difficult to identify equipment faults and malicious instruction tampering attacks, and have detection blind spots and difficulties in fault location.

[0006] To achieve the above objectives, the present invention provides a multimodal industrial process anomaly detection device, which is deployed between the instruction transmission link between the industrial host computer and the slave computer, and includes a data receiving module, a binary tree modeling module, a sequence verification module, a delay verification module, a jitter analysis visualization module, and an anomaly alarm module. The host computer is unidirectionally connected to the data receiving module; the data receiving module is communicatively connected to the binary tree modeling module, the sequence verification module, and the delay verification module; the binary tree modeling module is connected to the sequence verification module and the delay verification module, providing a binary tree benchmark for both; the sequence verification module and the delay verification module output single-point abnormal signals in parallel to the abnormal alarm module; the delay verification module is connected to the jitter analysis and visualization module, transmitting periodic error data to it; the jitter analysis and visualization module outputs global network jitter alarms to the abnormal alarm module; the abnormal alarm module outputs hierarchical alarms, logs, and waveform data to the lower-level computer and the operation and maintenance platform.

[0007] A multimodal industrial process anomaly detection method includes the following steps: S1. Offline modeling initialization: sort out the standard instruction sequence, standard transmission cycle, legal pre-instruction, and error tolerance range. Complete the modeling of four binary trees T1, T2, T3, and T4 through depth-first traversal, and configure the sliding window length N and the network jitter stability threshold σth. S2. Real-time message acquisition: The data receiving module continuously captures and parses the host computer instruction messages, maintains the global instruction timing queue, and outputs a standardized real-time data stream. S3, Instruction Sequence Verification: Match T1 and T3 binary trees to compare historical preceding instructions. If the sequence does not match, a sequence anomaly alarm is triggered directly and subsequent verification is terminated. If the sequence complies, it enters the delay verification. S4, Single Instruction Delay Verification: Calculate the periodic error and compare it with the T4 threshold. If the limit is exceeded, output an instantaneous delay alarm and synchronously push the periodic error to the sliding window. S5. Timing jitter stability assessment: The sliding window buffers error data to generate a periodic error waveform. After the window is filled, the jitter standard deviation σ is calculated. If σ > σth, a global network jitter alarm is output. S6. Comprehensive Judgment and Log Retention: If all three checks meet the standards, the status is judged as normal; if any dimension is abnormal, the full-dimensional traceability log is retained to complete the detection loop.

[0008] Preferably, the data receiving module is used to listen to the process instruction messages issued by the host computer, parse and extract the instruction identifier, execution content, issuance timestamp, and process standard cycle parameters, and generate a structured instruction dataset; in the offline stage, it supplies the basic process parameters to the binary tree modeling module, and in the online stage, it continuously sends real-time data streams to the sequence verification module and the delay verification module.

[0009] Preferably, the binary tree modeling module is based on the production line process specifications and uses a depth-first traversal algorithm to construct four dedicated binary trees that are bound and linked: T1 stores the standard instruction sequence, T2 stores the standard instruction cycle, T3 stores the legal preceding instruction sequence, and T4 stores the differential cycle error tolerance threshold. The four binary trees are linked through a unique node identifier and synchronously provide four types of retrieval benchmarks: sequence, cycle, preceding constraint, and error threshold.

[0010] Preferably, the sequence verification module retrieves the T1 and T3 binary trees to complete the instruction sequence verification: locate the node of the real-time instruction in T1, retrieve the legal preceding instruction combination in T3, and backtrack the historical instruction queue to complete the comparison; if the sequence does not match, push the sequence abnormality signal to the abnormality alarm module; only if the sequence is compliant will the instruction flow be transferred to the delay verification module.

[0011] Preferably, the delay verification module receives the sequence verification compliance instruction, calculates the actual transmission interval between adjacent instructions, matches T2 to obtain the standard period to solve the period error, compares the error with the T4 error tolerance threshold, and pushes an instantaneous delay abnormal signal if the threshold is exceeded; and regardless of the verification result, the period error is synchronously pushed to the jitter analysis visualization module.

[0012] Preferably, the jitter analysis visualization module is configured with a fixed-length sliding window cache queue, and uses a first-in-first-out mechanism to cache N periodic error timing data within the window; a periodic error waveform is generated with the instruction timing as the horizontal axis and the periodic error as the vertical axis; the jitter intensity σ is calculated using the standard deviation formula; σ is compared with a preset stability threshold σth; if the threshold is exceeded, a global network jitter alarm is output to the abnormal alarm module. The formula for calculating jitter intensity is: ; in, This represents the total number of commands within the sliding window. For the first Instruction cycle error, This is the average of all errors within the window. The standard deviation of jitter; The larger the value, the more drastic the waveform fluctuations, indicating a poorer long-term stability of the network.

[0013] Preferably, the sliding window cache queue only starts the jitter intensity σ calculation and network stability determination after the cache is full of N periodic error data; when the window is not full, it only continues to cache error data and generate basic periodic error waveforms, without outputting global network jitter alarms.

[0014] Preferably, the anomaly alarm module summarizes the three types of detection results from the sequence verification, latency verification, and jitter analysis visualization modules, and executes hierarchical alarm logic: single-point alarms are pushed for command sequence disorder and single command instantaneous latency exceeding the limit; global link alarms are output separately for long-term severe network jitter, along with standard deviation and waveform data; if all verifications meet the standards, the transmission is determined to be normal; all alarms are synchronously and persistently stored in anomaly logs containing occurrence time, command, fault type, quantitative indicators, and waveform data.

[0015] Therefore, the present invention employs the above-described multimodal industrial process anomaly detection device and method, and the technical effects are as follows: 1. Construct four types of dedicated matching binary trees to achieve multi-dimensional structured and fast retrieval of instructions. Compared with traditional linear traversal, this significantly improves the matching and verification speed and recognition accuracy of high-frequency industrial instructions, meeting the low latency requirements of real-time industrial detection.

[0016] 2. Achieve dual-modal synchronous verification of instruction sequence compliance and single instruction transmission delay, fully covering single-point anomaly scenarios such as instruction disorder, message tampering, malicious queue jumping, and instantaneous link interference, eliminating blind spots in single-dimensional detection.

[0017] 3. By introducing sliding window timing analysis and standard deviation quantization jitter algorithm, coupled with periodic error waveform visualization, it can accurately distinguish between instantaneous and occasional delay faults and persistent long-term network jitter, quantitatively evaluate the overall stability of the link, and avoid the problem of missing hidden link degradation.

[0018] 4. Implement independent alarms based on anomaly classification, fully retain traceability data such as anomaly time, instructions, quantitative indicators and waveform trends, accurately distinguish various anomaly causes, significantly reduce the difficulty of troubleshooting industrial field faults, and improve operation and maintenance efficiency. Attached Figure Description

[0019] Figure 1 This is a block diagram of the architecture of a multimodal industrial process anomaly detection device according to the present invention; Figure 2 This is a schematic diagram of a multimodal industrial process anomaly detection process according to the present invention; Figure 3 This is a flowchart of the periodic error waveform generation and network jitter stability judgment of the present invention. Detailed Implementation

[0020] The technical solution of the present invention will be further described below with reference to the accompanying drawings and embodiments.

[0021] Unless otherwise defined, the technical or scientific terms used in this invention shall have the ordinary meaning as understood by one of ordinary skill in the art to which this invention pertains.

[0022] Example 1 like Figure 1 As shown, this invention provides a multimodal industrial process anomaly detection device, deployed between the instruction transmission link between the industrial host computer and the slave computer. The entire device consists of six core functional units: a data receiving module, a binary tree modeling module, a sequence verification module, a delay verification module, a jitter analysis and visualization module, and an anomaly alarm module. Each module is interconnected in an orderly manner according to the business logic of data input, rule modeling, hierarchical verification, time sequence analysis, and alarm output, forming a complete closed-loop industrial process anomaly detection system.

[0023] The host computer acts as the data source for process instructions, unidirectionally connecting to the data receiving module. After parsing the messages, the data receiving module sends basic process data to the binary tree modeling module for offline rule modeling, and continuously sends real-time process instruction data streams to the sequence verification module and the delay verification module. After constructing the standardized verification binary tree, the binary tree modeling module provides T1 and T3 binary trees as sequence verification benchmarks for the sequence verification module and T2 and T4 binary trees as delay error verification benchmarks for the delay verification module. The sequence verification module and the delay verification module perform single-point anomaly detection in parallel, and the single-point anomaly signals generated by both are uniformly pushed to the anomaly alarm module. The delay verification module synchronously outputs the periodic error value calculated for each instruction to the jitter analysis visualization module, which independently performs time-series fluctuation analysis. After determining network stability, the jitter analysis visualization module pushes the global network jitter alarm results separately to the anomaly alarm module. Finally, the anomaly alarm module summarizes the detection results from all dimensions and outputs status judgments, hierarchical alarm information, anomaly logs, and periodic error waveform data to the lower-level machine and the operation and maintenance platform, completing the full-link detection closed loop.

[0024] The data receiving module monitors process instruction messages sent from the host computer to the slave computer in real time, performs message parsing and standardization, extracts core parameters such as instruction identifier, instruction execution content, instruction issuance timestamp, and process standard cycle, and generates a structured real-time process instruction dataset. This module also acts as a data distribution mechanism, providing basic process parameters to the binary tree modeling module for rule modeling during the offline phase, and continuously supplying real-time detection data to the sequence verification module and delay verification module during the online operation phase, ensuring continuous and stable input of detection data throughout the entire process.

[0025] The binary tree modeling module, based on the fixed process specifications of the target production line, uses a depth-first traversal algorithm to construct a dedicated binary tree with four nodes bound one-to-one. This enables structured storage of multi-dimensional verification rules, namely T1 storing standard instruction sequences, T2 storing standard instruction cycles, T3 storing valid preceding instruction sequences, and T4 storing differentiated cycle error tolerance thresholds. The four binary trees are linked and bound using unique node identifiers for the same instruction, enabling synchronous retrieval of four types of verification data: sequences, cycles, preceding constraints, and error thresholds. Compared to the traditional linear traversal retrieval mode, the depth-first traversal binary tree retrieval speed and matching accuracy are significantly improved, making it suitable for the high-frequency, low-latency real-time detection needs of industrial applications.

[0026] The sequence verification module relies on the T1 and T3 binary trees to verify the legality of the instruction execution sequence. After receiving real-time instruction data, the module first locates the unique node corresponding to the current instruction in T1, retrieves all legal preceding instruction combinations stored in the T3 node, and backtracks the historical instruction execution queue to complete a full sequence comparison. If there are missing, disordered, or illegally inserted preceding instructions, the module directly determines that the instruction sequence is abnormal and pushes a single-point abnormality signal to the abnormality alarm module. Only when the sequence verification is completely compliant will the instruction data be transferred to the latency verification module for further latency detection, which can accurately identify sequence-related security anomalies such as device program failures, malicious instruction tampering, and illegal instruction interruption.

[0027] The latency verification module is responsible for verifying the compliance of single-instruction transmission latency, and only receives instruction data that has been determined to be compliant by the sequence verification module. The module extracts the transmission timestamps of the current instruction and the previous adjacent instruction, calculates the actual transmission interval, matches it with a T2 binary tree to obtain the standard process cycle corresponding to the instruction, and solves for the cycle error value. The error value is compared with the preset positive and negative error tolerance thresholds in the T4 binary tree; if the error exceeds the range, an instantaneous link latency anomaly is determined, and a corresponding single-point alarm signal is pushed. Regardless of whether the latency verification is compliant, the module synchronously pushes the current cycle error value to the jitter analysis visualization module, providing raw error data for global network stability timing analysis.

[0028] The jitter analysis visualization module differs from the independent global network evaluation unit in traditional detection schemes. It incorporates a fixed-length sliding window cache queue and uses a first-in, first-out (FIFO) mechanism to continuously cache the periodic error timing data of the most recent N instructions within the window. The module generates a periodic error waveform graph with the instruction execution timing as the horizontal axis and the periodic error value as the vertical axis, intuitively displaying the link latency fluctuation trend within a period. Simultaneously, it introduces a standard deviation mathematical model to quantify the severity of jitter. The calculated jitter standard deviation is compared with a preset network stability threshold σth. If the standard deviation exceeds the threshold, it is determined that the link has persistent and severe jitter, and a global network jitter alarm is independently output to the anomaly alarm module.

[0029] The formula for quantifying the severity of shaking is: ; in, This represents the total number of commands within the sliding window. For the first Instruction cycle error, This is the average of all errors within the window. The standard deviation of jitter; The larger the value, the more drastic the waveform fluctuations, indicating a poorer long-term stability of the network.

[0030] This module can clearly distinguish between transient link interference caused by occasional exceedances of limits in a single command and long-term, persistent link degradation caused by line aging and network congestion. It solves the problem of traditional single-point threshold detection easily missing latent network faults. The complete time-series analysis process is as follows: Figure 3 As shown.

[0031] The anomaly alarm module is the unified output unit of the device, which summarizes the three independent detection results from the sequence verification, delay verification, and jitter analysis visualization modules, and executes hierarchical and differentiated independent alarm logic: For two types of single-point anomalies, namely instruction sequence disorder and single instruction instantaneous latency exceeding the limit, corresponding alarms are pushed out, and the abnormal instruction, fault type and judgment basis are marked simultaneously. For long-term severe network jitter, a separate global link alarm is output, along with a jitter standard deviation quantification index and a periodic error waveform graph; If all three checks pass, the process instruction transmission and network link status are considered normal.

[0032] All alarm information is synchronously and persistently stored in the anomaly log, fully preserving the anomaly occurrence time, anomaly command, anomaly type, quantitative judgment indicators, and waveform trend data, providing complete and traceable data support for operation and maintenance personnel to trace the source of faults and optimize processes.

[0033] like Figure 2 As shown, the multimodal industrial process anomaly detection method of this invention relies on the above-mentioned detection device to achieve hierarchical and progressive parallel detection. The entire process is divided into six closed-loop steps: model pre-initialization, real-time message acquisition, instruction sequence verification, single instruction delay verification, timing jitter stability assessment, comprehensive judgment and log retention. S1. For the industrial production process to be tested, the complete standard instruction execution sequence, standard transmission cycle of each instruction, legal pre-instruction combination of each instruction, and differential cycle error tolerance range are sorted out. Based on the depth-first traversal algorithm, the four binary trees T1, T2, T3, and T4 are modeled and solidified offline. Simultaneously, the jitter analysis sliding window buffer length N and the network jitter stability threshold σth are configured to complete the initialization of the entire set of detection rules.

[0034] All four binary trees use depth-first traversal to complete data storage and retrieval. The binary tree nodes are arranged in order according to the execution sequence of industrial process instructions, ensuring the accuracy and efficiency of instruction retrieval.

[0035] S2. During the online operation phase of the device, the data receiving module continuously captures the process instruction messages issued by the host computer, parses the instruction content and transmission timestamp in real time, dynamically maintains the global instruction execution sequence queue, and continuously outputs standardized real-time instruction data streams to the subsequent verification module.

[0036] S3. Perform sequence verification on each real-time instruction, match the T1 binary tree to locate the current instruction node, and retrieve the legal preceding sequence bound in T3 to complete the comparison; if the historical instruction sequence does not match the legal preceding sequence, directly trigger the instruction sequence abnormality alarm and terminate all subsequent verification processes of the current instruction; only after the sequence verification is passed can the delay verification stage be entered.

[0037] The specific steps for verifying the preceding instruction sequence are as follows: Let the current real-time instruction be X. Retrieve the valid preceding instruction sequence [A, C, B] corresponding to instruction X in the third binary tree T3. Verify whether the historical instruction sequence before the current instruction is executed is completely matched with the valid preceding instruction sequence. If they match, the sequence is compliant. If there are missing, disordered, or newly added instructions, the sequence is judged to be abnormal.

[0038] S4. Calculate the actual transmission time difference between two adjacent instructions, match T2 to obtain the standard period and solve the period error, compare the error value with the preset error tolerance range of T4; if the error exceeds the threshold, output an instantaneous transmission delay abnormal alarm; at the same time, push the current period error value to the sliding window cache queue of the jitter analysis visualization module.

[0039] The periodic error is calculated as follows: Periodic error value = actual instruction transmission time difference - standard instruction cycle. The error value is compared with the maximum positive error and minimum negative error threshold of the corresponding node of the fourth binary tree T4. If it exceeds the threshold range, it is determined to be a single-point transmission delay anomaly.

[0040] S5, the jitter analysis visualization module continuously updates the periodic error time series data within the sliding window and generates a visualized periodic error waveform; it calculates the jitter intensity σ within the window using the standard deviation formula, compares σ with the preset stability threshold σth, and independently outputs a global network severe jitter alarm when σ>σth, thus realizing the distinction between instantaneous faults and long-term link degradation.

[0041] The generated periodic error waveform is used to visually display the latency fluctuation trend over a period of time, and to distinguish between instantaneous single-point latency over-limit faults and long-term continuous link jitter faults.

[0042] S6. The system determines that the process instruction transmission and network link are completely normal only when all three verification indicators, namely instruction sequence, single instruction latency and network jitter, meet the standards. If any verification dimension is abnormal, the system will automatically retain a complete abnormal log and record the source information of the abnormality in all dimensions. The operation and maintenance personnel can quickly distinguish different fault causes such as equipment failure, instantaneous link interference, long-term network congestion and malicious instruction tampering attacks by relying on logs, waveforms and quantitative indicators.

[0043] Therefore, this invention employs the aforementioned multimodal industrial process anomaly detection device and method. It leverages four linked, matched depth-traversal binary trees to overcome the shortcomings of traditional linear retrieval methods, such as low efficiency and limited verification dimensions. Simultaneously, it covers two types of single-point process anomalies: instruction execution sequence and single-instruction transmission delay. A new sliding window timing statistics and standard deviation quantification evaluation mechanism quantifies network jitter and visualizes link fluctuation trends, overcoming the limitations of existing detection schemes that can only identify instantaneous faults and cannot detect long-term link degradation. Through hierarchical independent alarms and persistent full log retention, it achieves accurate classification of multiple anomalies and rapid fault location. This invention is adaptable to all industrial production processes with fixed instruction sequences and fixed transmission cycles, comprehensively resisting various risks such as equipment failures, instantaneous link interference, long-term network jitter, and malicious instruction tampering attacks. It balances real-time detection, comprehensive anomaly identification, and convenient on-site maintenance, forming a complete closed loop for industrial process safety detection, from data collection, rule verification, fault analysis to alarm tracing.

[0044] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit them. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the technical solutions of the present invention, and these modifications or equivalent substitutions cannot cause the modified technical solutions to deviate from the spirit and scope of the technical solutions of the present invention.

Claims

1. A device for detecting anomalies in multimodal industrial processes, characterized in that, Deployed between the instruction transmission links of industrial host computers and slave computers, it includes a data receiving module, a binary tree modeling module, a sequence verification module, a latency verification module, a jitter analysis and visualization module, and an anomaly alarm module; The host computer is unidirectionally connected to the data receiving module; the data receiving module is communicatively connected to the binary tree modeling module, the sequence verification module, and the delay verification module respectively; the binary tree modeling module is connected to the sequence verification module and the delay verification module respectively, providing a binary tree verification benchmark for both; the sequence verification module and the delay verification module output single-point abnormal signals to the abnormal alarm module in parallel; The delay verification module is connected to the jitter analysis visualization module and transmits periodic error data to it; The jitter analysis and visualization module outputs a global network jitter alarm to the anomaly alarm module; the anomaly alarm module outputs hierarchical alarms, logs and waveform data to the lower-level machine and the operation and maintenance platform respectively.

2. A method for detecting multimodal industrial process anomalies, based on the apparatus for detecting multimodal industrial process anomalies according to any one of claims 1, characterized in that, Includes the following steps: S1. Offline modeling initialization: sort out the standard instruction sequence, standard transmission cycle, legal pre-instruction, and error tolerance range. Complete the modeling of four binary trees T1, T2, T3, and T4 through depth-first traversal, and configure the sliding window length N and the network jitter stability threshold σth. S2. Real-time message acquisition: The data receiving module continuously captures and parses the host computer instruction messages, maintains the global instruction timing queue, and outputs a standardized real-time data stream. S3, Instruction Sequence Verification: Match T1 and T3 binary trees to compare historical preceding instructions. If the sequence does not match, a sequence anomaly alarm is triggered directly and subsequent verification is terminated. If the sequence complies, it enters the delay verification. S4, Single Instruction Delay Verification: Calculate the periodic error and compare it with the T4 threshold. If the limit is exceeded, output an instantaneous delay alarm and synchronously push the periodic error to the sliding window. S5. Timing jitter stability assessment: The sliding window buffers error data to generate a periodic error waveform. After the window is filled, the jitter standard deviation σ is calculated. If σ > σth, a global network jitter alarm is output. S6. Comprehensive Judgment and Log Retention: If all three checks meet the standards, the status is judged as normal; if any dimension is abnormal, the full-dimensional traceability log is retained to complete the detection loop.

3. The multimodal industrial process anomaly detection method according to claim 2, characterized in that, The data receiving module is used to listen to the process instruction messages issued by the host computer, parse and extract the instruction identifier, execution content, issuance timestamp, and process standard cycle parameters, and generate a structured instruction dataset; in the offline stage, it supplies the basic process parameters to the binary tree modeling module, and in the online stage, it continuously sends real-time data streams to the sequence verification module and the delay verification module.

4. The multimodal industrial process anomaly detection method according to claim 2, characterized in that, The binary tree modeling module is based on the production line process specifications and uses a depth-first traversal algorithm to construct four dedicated binary trees that are bound and linked: T1 stores the standard instruction sequence, T2 stores the standard instruction cycle, T3 stores the legal preceding instruction sequence, and T4 stores the differential cycle error tolerance threshold. The four binary trees are linked by a unique node identifier, and synchronously provide four types of retrieval benchmarks: sequence, period, preconditions, and error threshold.

5. The multimodal industrial process anomaly detection method according to claim 2, characterized in that, The sequence verification module retrieves the T1 and T3 binary trees to complete the instruction sequence verification: it locates the node of the real-time instruction in T1, retrieves the legal preceding instruction combination in T3, and backtracks the historical instruction queue to complete the comparison; if the sequence does not match, it pushes the sequence abnormality signal to the abnormal alarm module, and only if the sequence is compliant will the instruction flow be transferred to the delay verification module.

6. The multimodal industrial process anomaly detection method according to claim 2, characterized in that, The delay verification module receives the sequence verification compliance instruction, calculates the actual transmission interval between adjacent instructions, matches T2 to obtain the standard period to solve the period error, compares the error with the T4 error tolerance threshold, and pushes an instantaneous delay abnormal signal if the threshold is exceeded; and regardless of the verification result, the period error is synchronously pushed to the jitter analysis visualization module.

7. The multimodal industrial process anomaly detection method according to claim 2, characterized in that, The jitter analysis visualization module is configured with a fixed-length sliding window cache queue, and uses a first-in-first-out mechanism to cache N periodic error time series data within the window; A periodic error waveform is generated with instruction timing as the horizontal axis and periodic error as the vertical axis. The jitter intensity σ is calculated using the standard deviation formula. σ is compared with a preset stability threshold σth. If the threshold is exceeded, a global network jitter alarm is output to the abnormal alarm module. The formula for calculating jitter intensity is: ； in, This represents the total number of commands within the sliding window. For the first Instruction cycle error, This is the average of all errors within the window. The standard deviation of jitter; The larger the value, the more drastic the waveform fluctuations, indicating a poorer long-term stability of the network.

8. The multimodal industrial process anomaly detection method according to claim 2, characterized in that, The sliding window cache queue only starts calculating the jitter intensity σ and determining network stability after it has cached N periodic error data. When the window is not full, it only continues to cache error data and generate basic periodic error waveforms, without outputting global network jitter alarms.

9. The multimodal industrial process anomaly detection method according to claim 2, characterized in that, The anomaly alarm module summarizes the detection results from three types of modules: sequence verification, latency verification, and jitter analysis visualization. It then executes a tiered alarm logic: single-point alarms are pushed for command sequence disorder and single command instantaneous latency exceeding the limit; global link alarms are output separately for long-term severe network jitter, along with standard deviation and waveform data; if all verifications meet the standards, the transmission is considered normal; and all alarms are synchronously and persistently stored in anomaly logs containing occurrence time, command, fault type, quantification indicators, and waveform data.

Images