An automated anomaly detection method and system for large-scale industrial internet of things

Abstract

The application discloses an automation anomaly detection method and system for a large-scale industrial Internet of Things, and comprises the following contents: multi-dimensional sensing data of a production device is acquired, and preprocessing is performed through a standardized interface; a mass data integration environment is constructed, data is dynamically stored and managed, and a usable data set is formed; multi-feature extraction is performed on the usable data set, real-time data intelligent analysis technology is applied in combination with an anomaly detection algorithm to identify abnormal observation values; based on multi-device collaborative computing technology of edge computing, a computing task is unloaded to a network edge to perform localized processing, and a predictive maintenance instruction is generated. The application belongs to the technical field of the industrial Internet of Things, and can realize low latency, high precision and safe collaboration.

Description

Technical Field

[0001] This invention relates to the field of industrial Internet of Things (IoT) technology. Background Technology

[0002] As industrial manufacturing is undergoing a digital and intelligent transformation, the Industrial Internet, as a new type of digital infrastructure, is essentially data-driven automated decision-making.

[0003] However, existing technologies have obvious shortcomings in practical applications: (1) Most existing industrial IoT monitoring systems rely excessively on cloud centers for data processing. With the exponential growth in the number of connected devices, the massive data transmission to the cloud not only occupies a large amount of bandwidth and causes network congestion, but also causes extremely high transmission latency, which cannot meet the real-time requirements of industrial scenarios, especially security monitoring, resulting in delayed response to abnormal events and low efficiency.

[0004] (2) In terms of anomaly detection technology, existing monitoring methods are often relatively simple and lack the ability to deeply mine massive multidimensional sensing data. Faced with the characteristics of complex data formats and strong correlation in industrial environments, traditional methods are difficult to achieve accurate fault prediction. They often only issue alarms after a fault occurs, making it impossible to provide early warnings to avoid production interruptions. Furthermore, they lack a standardized fault handling framework and have a low level of intelligent operation and maintenance.

[0005] (3) With the introduction of edge computing, multi-device collaborative computing has become a trend, but the existing collaborative mechanism lacks effective trust building methods, and there are security risks of data privacy leakage and malicious attacks during task unloading and data interaction.

[0006] Therefore, there is an urgent need to develop an automated anomaly detection method and system for large-scale industrial Internet of Things to solve the problems in existing technologies. Summary of the Invention

[0007] The purpose of this invention is to provide an automated anomaly detection method and system for large-scale industrial Internet of Things (IoT), which can achieve low latency, high accuracy and secure collaboration capabilities, in order to solve the problems mentioned in the background art, such as over-reliance on cloud centers, single monitoring methods and lack of effective trust building methods.

[0008] To achieve the above objectives, the present invention provides the following technical solution: An automated anomaly detection method for large-scale industrial IoT includes the following steps: S1: Acquire multi-dimensional sensing data from production equipment, forward and preprocess the data through a standardized interface to obtain preprocessed data; S2: Construct a massive multi-dimensional perception data integration environment, classify the data value of the preprocessed data based on metadata description and generate value tags, and at the same time construct and dynamically update the trust measurement profile of each edge node participating in collaborative computing based on blockchain technology. S3: Based on the value tags, trust metrics profiles, and the real-time load capacity of the nodes, the task adaptability is calculated through a three-parameter collaborative decision function. Based on the task adaptability, the data migration path and the task unloading strategy are dynamically determined to form a usable dataset and execute localized business processing. S4: Apply an anomaly detection algorithm to the available dataset to identify anomalous observations that do not match the expected pattern, and generate predictive maintenance instructions based on the anomaly detection results.

[0009] By adopting the above technical solution and introducing three key parameters—value tags, trust profiles, and load capacity—and constructing their collaborative decision function, the scheduling of data and tasks is upgraded from simple rule matching to a quantifiable and computable optimization process. In dynamic, resource-constrained edge environments, this solution achieves a refined and adaptive balance between data value, security, and resource utilization, forming a core innovative architecture with technological depth.

[0010] As a further aspect of the present invention: the anomaly detection algorithm is applied in step S4 for calculation, including at least one of the following: A density-based local anomaly factor algorithm is applied to compare local data density with preset values ​​to identify anomalies; Apply time-series forecasting models to calculate future equipment status data to support predictive maintenance; A machine learning supervision mechanism based on novelty detection technology is introduced, and a goodness-of-fit test is performed to determine whether the data distribution conforms to the expected pattern.

[0011] By adopting the above technical solutions, not only can local minor anomaly patterns be accurately identified, but future states can also be predicted based on historical data, and the effectiveness of the model can be verified in real time, thereby significantly improving the accuracy, foresight, and robustness of industrial IoT anomaly detection.

[0012] As a further aspect of the present invention: the data value classification in S2 includes: calculating the data value score by weighted summation based on the reliability weight of the data source, the matching degree between the data and historical anomaly patterns, and the timeliness factor of the data, and dividing the data into high, medium and low value levels to generate corresponding value labels.

[0013] By adopting the above technical solution and providing a specific weighted calculation model, the data value classification is transformed from a qualitative concept into an executable quantitative process. This enables the system to automatically and objectively evaluate the comprehensive value of each piece of data, providing accurate and calculable input for subsequent intelligent decision-making. It ensures that high-value data is processed first and improves the overall efficiency of anomaly detection.

[0014] As a further aspect of the present invention: the generation of predictive maintenance instructions in S4 includes: training a prediction model using historical data without anomalies, and constructing and updating a predictive maintenance knowledge graph for production equipment by combining the anomaly detection results.

[0015] By adopting the above technical solutions and constructing a predictive operation and maintenance knowledge graph, the standardized accumulation and visual association of fault diagnosis experience and maintenance strategies have been achieved, providing intelligent decision support for maintenance personnel, effectively improving operation and maintenance efficiency and reducing reliance on human expert experience.

[0016] As a further aspect of the present invention: the multi-dimensional sensing data acquired in S1 includes high-definition video data of the production environment and equipment operating status data; the method further includes: simulating data center energy efficiency and load based on the Monte Carlo method to optimize the computing task offloading strategy.

[0017] By adopting the above technical solutions, on the one hand, three-dimensional monitoring is achieved by integrating video and equipment status data; on the other hand, Monte Carlo simulation is used to optimize the energy efficiency configuration of underlying computing resources, so that the system can ensure high-precision detection while taking into account the comprehensiveness of perception and the green economy of system operation.

[0018] As a further aspect of the present invention: the construction of the trust measurement profile in S2 includes: dynamically calculating and updating the trust value of each node through smart contracts based on the completion quality of historical tasks of edge nodes, data tampering records, and network behavior compliance; the trust value is decayed and updated over time according to a preset decay factor.

[0019] By adopting the above technical solution, the vulnerability of trust in the real world is simulated, ensuring that the trust measurement profile of a node can reflect its current security status in real time. This effectively prevents the security risks of long-term profit from a single malicious act or the long-term undetected failure of a historically high-trust node after it has been compromised, and significantly enhances the inherent security capabilities of the collaborative computing environment.

[0020] As a further aspect of the present invention: the dynamic decision data migration path and computation task unloading strategy in S3 includes: taking the value tag, trust metric profile and node real-time load capacity as input parameters, solving the three-parameter collaborative decision function to obtain the task adaptability, and selecting the node with the highest task adaptability as the target node for data migration or task unloading.

[0021] By adopting the above technical solution, the decision-making process is concretized into a function solution process, and the task suitability is clarified as the core indicator for selecting nodes. This makes the system's decision-making logic clear, interpretable, and optimizable, ensuring the scientific and reasonable nature of scheduling decisions.

[0022] As a further aspect of the present invention, the real-time load capacity of the node is calculated based on the node's CPU (Central Processing Unit) utilization, memory usage, and network bandwidth utilization.

[0023] By adopting the above technical solution, the quantification method of node load capacity is clarified, making the last parameter of the three-parameter decision function computable, and ensuring the integrity and closed-loop nature of the input parameters of the entire collaborative decision-making model.

[0024] As a further aspect of the present invention, the construction of a massive multidimensional sensing data integration environment in S2 includes: integrating heterogeneous software and hardware resources, providing a unified data storage cloud environment through virtualization technology, and realizing unified data collection, transmission, storage and processing.

[0025] By adopting the above technical solutions, a unified and standardized data storage and access environment is provided for upper-layer applications, solving the problems of difficult data integration and complex management caused by the wide variety of device types and different interfaces in large-scale industrial IoT, and improving the system's compatibility and scalability.

[0026] As a further aspect of the present invention: the method is applied to a smart factory environment, and the anomaly detection results and predictive maintenance instructions are responded to and pushed within 10 seconds.

[0027] By adopting the above technical solution and limiting the response time and push speed, it was verified that the system can still meet the stringent real-time requirements of smart factories after the introduction of complex collaboration and security mechanisms, proving the feasibility and efficiency of the technical solution in practical applications.

[0028] Compared with the prior art, the beneficial effects of the present invention are: 1. By adopting the above technical solution, this invention constructs a closed loop for data acquisition, storage and analysis based on edge computing, realizes localized anomaly detection and computation offloading, significantly reduces data transmission latency and alleviates the load on the cloud center, and meets the stringent real-time requirements of industrial scenarios; 2. By adopting the above technical solution, this invention integrates multiple machine learning algorithms and time series modeling techniques, realizing accurate anomaly identification and fault prediction of massive heterogeneous data, solving the problems of single traditional monitoring methods and delayed early warning, and improving the intelligent level of industrial equipment operation and maintenance. 3. This invention constructs a multi-device trust mechanism through blockchain technology, effectively ensuring data security and privacy in cross-domain collaboration; 4. This invention achieves the standardized accumulation and reuse of fault diagnosis experience by constructing a predictive maintenance knowledge graph.

[0029] Other features and advantages of the present invention will be disclosed in detail in the following detailed description and accompanying drawings. Attached Figure Description

[0030] Figure 1 This is a flowchart illustrating the steps of an automated anomaly detection method for large-scale industrial Internet of Things (IoT) in an embodiment of the present invention. Detailed Implementation

[0031] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0032] Example 1 In this embodiment of the invention, an automated anomaly detection method and system for large-scale industrial Internet of Things (IoT) is described, see [link to relevant documentation]. Figure 1 As shown, an automated anomaly detection method for large-scale industrial IoT is applied in a smart factory environment. It aims to solve the problems of difficult real-time processing of massive heterogeneous data, delayed anomaly detection, and excessive cloud load. Specifically, it includes the following steps: S1: Acquire multi-dimensional sensing data and multi-source heterogeneous data from production equipment, and forward and preprocess the data through standardized multi-sensor data acquisition and transmission interfaces to obtain preprocessed data.

[0033] In this embodiment, the execution entity is an edge acquisition node deployed in the factory workshop. The multi-dimensional sensing data includes 1080P video stream data acquired by high-definition cameras deployed on the production line, as well as time-series data acquired by vibration sensors and temperature sensors deployed on core processing equipment such as CNC machine tools.

[0034] Specifically, the video data acquisition frequency is 25 frames per second, and the vibration data sampling frequency is 10 kHz.

[0035] The multi-source heterogeneous data includes fine-grained CPU utilization, memory usage, and operational status logs of server-related components. This data is uniformly encapsulated through standardized multi-sensor data acquisition and transmission interfaces such as Modbus (Industrial Serial Communication Protocol) and OPC UA (Open Platform Unified Communication Architecture).

[0036] The preprocessing process specifically includes data cleaning and format normalization. For time-series data, sliding window filtering is used to remove burst noise. For video data, keyframes are extracted and converted to YUV (a color encoding method) format. Finally, all data is tagged with a unified timestamp and device ID, and encapsulated in JSON (JavaScript Object Notation) format for transmission to the next stage.

[0037] In one feasible embodiment, the data packet structure collected at a certain moment is: {"DeviceID":"CNC_001","Timestamp":"2023-10-01 10:00:00","Vibration":5.2,"Temp":45.5,"CPU":30}.

[0038] S2: Construct a massive multi-dimensional perception data integration environment, dynamically store and manage preprocessed data based on metadata description and management methods, and transfer data to analysis nodes based on on-demand data migration technology to form a usable dataset.

[0039] This step constructs a virtualized storage layer. The system integrates heterogeneous hardware and software resources from different production devices and provides device access interfaces through Docker (Application Container Engine) container technology. For hot data with high real-time requirements, such as alarm-related data, it is stored in the Redis (Remote Dictionary Service) memory database on the local edge node. For historical cold data, it is migrated to the backend distributed file system HDFS through on-demand data migration technology.

[0040] Dynamic storage management uses a metadata description method to define attributes such as data source, type, and precision. For example, the metadata for vibration data can be defined as follows: .

[0041] Based on the needs of data analysis tasks, the system automatically loads relevant data from the storage layer to the computing nodes to form a usable dataset. Assuming the system's current storage capacity reaches 100PB, it can support the deployment and management of more than 2 million device data in a single project.

[0042] S3: Extract multiple features from the available dataset and apply real-time data intelligent analysis technology combined with anomaly detection algorithms to perform calculations, identify abnormal observations that do not match the expected pattern, and output anomaly detection results.

[0043] This step is the core analysis process, and the following algorithm models are used for parallel computation: Density-based Local Outlier Factor (LOF) algorithm: This is used to detect local anomalous patterns in data. For a given data point p, its local reachability density lrd(p) is calculated.

[0044] The formula for calculating locally accessible density is:

[0045] in, Let k represent the set of points in the neighborhood of point p. The reachable distance from point o to point p is defined as follows: , Let k be the distance from point o.

[0046] The formula for calculating the Local Outlier Factor (LOF(p)) at point p is:

[0047] If the value of LOF(p) is close to 1, it indicates that the density of p is similar to that of its neighbors and is considered normal; if LOF(p) is much greater than the preset value, such as setting the threshold to 2.0, it indicates that the density of p is much less than that of its neighbors and is considered an anomaly.

[0048] In this embodiment, by calculating the LOF value of the vibration signal of the device in real time, early local wear of the bearing can be effectively identified.

[0049] Support Vector Data Description (SVDD) methods: This method is used to construct a single-class anomaly detection model. It seeks a hypersphere with the smallest volume that contains all normal sample data. The objective function is:

[0050]

[0051] Where R is the radius of the hypersphere, and c is the center of the hypersphere. To sample The kernel function that maps to the high-dimensional feature space, where 'a' is the penalty coefficient. These are slack variables; during the detection phase, if new sample points... Distance to the center c of the ball If the radius is greater than R, it is considered abnormal; this embodiment uses a Gaussian kernel function to accurately characterize the normal boundary of the device's operating state.

[0052] In addition, this step also introduces time-series-based modeling of production equipment: The ARIMA (Autoregressive Integral Moving Average) model is trained using historical data without outliers. For time series data... The prediction model is expressed as:

[0053] The system measures the current observation value. Compared with the predicted value The difference, if the residual If the value exceeds the preset confidence interval, such as 3 times the standard deviation, an alert will be triggered.

[0054] Simultaneously, a machine learning supervision mechanism based on novelty detection technology is introduced: the system periodically performs goodness-of-fit tests using the chi-square test formula:

[0055] in, For the frequency of observation, The expected frequency is given. If the test result rejects the null hypothesis, it indicates that the data distribution has drifted, and the model will automatically trigger the retraining process to ensure detection accuracy.

[0056] S4: Multi-device collaborative computing technology based on edge computing offloads computing tasks to servers at the network edge to perform localized business processing, and generates predictive maintenance instructions based on anomaly detection results.

[0057] To address the high transmission latency issue in cloud computing centers, this step utilizes MEC (Mobile Edge Computing) servers deployed on the factory side to offload computations. The system constructs a computation task queue, and when local edge node resources are limited, the aforementioned LOF or SVDD computation tasks are offloaded to a nearby MEC server.

[0058] In this process, blockchain-based multi-device trust building technology is used to ensure collaborative security. The specific execution logic is as follows: Edge node A generates a computing task request and uses its private key. Sign the task hash value and broadcast it to the blockchain network; MEC server B receives the task, verifies the signature, and then performs the calculation. After the calculation is completed, server B will upload the hash of the calculation result and the execution proof to the blockchain for storage. The smart contract automatically verifies the validity of the result and rewards server B with corresponding tokens. This mechanism ensures data isolation and privacy protection during cross-domain multi-device collaboration, preventing data tampering by malicious nodes; Finally, the system generates predictive maintenance instructions based on the anomaly detection results; In one feasible implementation, when the LOF value exceeds the threshold of 2.0 for 5 consecutive minutes and the SVDD model determines it to be abnormal, the system generates a Level 1 maintenance alert with the following command format:<Action:Check_Bearing,Device:CNC_001,Urgency:High> The data is automatically pushed to the maintenance personnel's terminals, and the intelligent operation and maintenance knowledge graph is updated simultaneously.

[0059] S5: Energy efficiency optimization.

[0060] To reduce the energy consumption caused by large-scale computing, the system simulates the energy efficiency and load of data centers based on the Monte Carlo method. The system simulates the energy consumption distribution of devices under different load scenarios by generating random number sequences.

[0061] The energy consumption calculation model is as follows:

[0062] Generated through Monte Carlo simulation For each load sample, calculate the total energy consumption for that sample. Statistical analysis yields the resource scheduling strategy with the lowest energy consumption, thereby optimizing the computation offloading path and achieving green computing.

[0063] Example 2 The difference between this embodiment and Embodiment 1 is that this embodiment focuses on the specific implementation of the dynamic orchestration mechanism based on data value classification and collaborative trust measurement. This mechanism is the core of the present invention to achieve secure and efficient collaborative anomaly detection.

[0064] Based on the system architecture described in Embodiment 1, the method in this embodiment further includes the following specific steps: Data value classification and tag generation: In step S2, when the preprocessed data enters the integrated environment, the system parses its metadata and calls the value assessment model to perform calculations. The metadata includes the data source device ID (such as CNC_001), data type (vibration, temperature, video), timestamp, sensor accuracy, etc.

[0065] Data Value Score The calculation model is as follows:

[0066] in: As a data source reliability weight, it is dynamically adjusted based on the historical failure rate of the equipment, with a value range of [0,1]. In one feasible embodiment, the core equipment CNC_001's... The value is 0.9, while that of a regular sensor is 0.6.

[0067] The matching degree between the data and historical anomaly patterns is calculated by comparing the real-time data features with the anomaly feature database (knowledge graph). The value ranges from [0,1]. The higher the matching degree, the higher the value.

[0068] The data timeliness factor is defined as follows: , where λ is the time decay constant, and the newer the data, the higher its value.

[0069] w1, w2, and w3 are preset weight coefficients that satisfy w1 + w2 + w3 = 1. In this embodiment, w1 = 0.4, w2 = 0.4, and w3 = 0.2 are set to emphasize the reliability of the data source and abnormal correlation.

[0070] Based on calculations The system automatically generates data value tags; in one feasible embodiment, For high value, For medium value, "Low value"; the tag is appended to the packet header, in the format shown below.<Value:High,Score:0.82> .

[0071] Collaborative Trust Measurement and Profile Building: Similarly, in step S2, the system maintains the trust measurement profile of each edge node in real time based on the blockchain network. Each node (such as EdgeNode_A, MEC_Server_B) has an identity account on the blockchain.

[0072] The dynamic calculation of the node trust value T_{value} is executed through a smart contract, and the calculation model is as follows:

[0073] in: The basic trust value is determined by the security authentication level during node registration, such as based on a digital certificate.

[0074] To score the quality of task completion, indicators such as task completion rate, result accuracy, and response latency are calculated based on the node's history and recorded on the blockchain after evaluation by the task issuer.

[0075] As a penalty factor, when data tampering, malicious attacks, or violations of the service agreement are found through result hash verification, the penalty is triggered by the arbitration mechanism.

[0076] For adjustment coefficients, The value range is [0,1].

[0077] For example, node MEC_Server_B has a history of high task completion quality and no violation records. The value was dynamically updated to 0.95, but node EdgeNode_C experienced excessive latency due to a data forwarding error. When the value drops to 0.65, these values ​​form a trust profile for each node in real time.

[0078] Dynamic orchestration of decision execution: In step S3, the system's orchestration engine receives data value tags and node trust profiles, and executes a decision-making algorithm.

[0079] Example of decision-making logic: When a carrier is received <value:high>When a tag sends a vibration data packet, the orchestration engine queries the trust list of available nodes in the current network. Data migration tasks are preferentially assigned to nodes with high trust values. The node (such as MEC_Server_B) is selected, and a real-time anomaly detection task (such as LOF calculation) is started.

[0080] for <value:medium>Data can be assigned to trust values. Regular monitoring and analysis are performed on the nodes.

[0081] For trust value For nodes that are not critical to the task list, the orchestration engine may temporarily exclude them from the list or require them to submit proof of their security status (such as runtime environment hash) before they can receive tasks. Only after the proof is verified will low-value data processing tasks be assigned to them.

[0082] This decision-making process is executed automatically through smart contracts. The contract code logic encodes the above rules to ensure that the execution is immutable.

[0083] Through the mechanism described in this embodiment, the system realizes the "quality-based diversion" of data streams and the "trust-based scheduling" of computing tasks; a high-value vibration data from a critical device will be securely routed to the most trusted node for in-depth analysis with the highest priority, which greatly improves the timeliness and reliability of anomaly detection, while effectively avoiding potential security risks, demonstrating the significant technological progress of this invention compared to the prior art.

[0084] Example 3 This embodiment provides an automated anomaly detection system for large-scale industrial IoT, implementing the aforementioned automated anomaly detection method for large-scale industrial IoT. The system includes: Edge data acquisition and processing module: This module is configured to access and manage more than 2 million devices, supports the GB35114-2017 standard, and integrates a multi-sensor interface unit to perform the data acquisition and preprocessing functions described in Example 1 S1 and output preprocessed data.

[0085] Multidimensional perception data storage and management module: includes a heterogeneous resource virtualization submodule, which is used to execute the storage function described in Example 1 S2. This module uses virtualization technology to shield the differences in underlying hardware, achieves a data storage capacity of no less than 100PB, and ensures data availability and reliability.

[0086] Anomaly Detection and Analysis Module: This module is the computing core of the system, with a built-in LOF calculation unit, SVDD calculation engine and time series prediction unit. This module is used to execute the algorithm calculation logic described in S3 of Example 1. This module can achieve a response time of less than 10 seconds for analysis results and a multi-dimensional analysis speed of tens of millions of alarm data within 10 seconds.

[0087] Edge computing collaboration module: further includes a multi-device trust building sub-module, which is used to perform the computing offloading and blockchain trust building functions described in Example 1 S4. This module is connected to the anomaly detection and analysis module to offload computationally intensive tasks such as SVDD high-dimensional mapping to the edge server to form localized closed-loop processing.

[0088] Data display and push module: used to receive anomaly detection results and build a predictive operation and maintenance knowledge graph for production equipment. In one feasible embodiment, "equipment CNC_001" is associated with nodes such as "bearing wear" and "maintenance plan" and displayed in the form of visual charts on the operation and maintenance screen, so that the incremental aggregation time of alarm data is within 10 seconds.

[0089] Through the above embodiments, the present invention effectively solves the problems of high data processing latency, low anomaly detection accuracy, and poor collaborative computing security in large-scale industrial IoT scenarios, realizes predictive maintenance of industrial equipment, improves production efficiency by about 20%, and reduces maintenance costs by about 40%.

[0090] Example 4 The difference between this embodiment and embodiment two is that this embodiment elaborates on the specific implementation of the three-parameter collaborative decision function described in claim 1, S3, and the operation flow of the trust value decay update model.

[0091] Building upon the data value tag generation and node trust profile construction already implemented in Example 2, the system orchestration engine in this example executes the following decision-making and update process: 1. Definition and solution of the three-parameter collaborative decision function: The goal of the system is to select the optimal edge node for data packet D or computation task T. The decision function F(D / T,N) is defined as the task fitness score:

[0092] in: The value score of data packet D (calculated by Example 2) is normalized to [0,1].

[0093] Let N be the current trust metric value of node N, and its value range is normalized to [0,1].

[0094] Let N be the real-time load capacity factor for node N. It can be calculated as: ,in These represent the node's CPU, memory, and network bandwidth utilization (0-1), respectively, where w1+w2+w3=1. The larger the value, the lighter the load and the stronger the capability.

[0095] This is an adjustment coefficient used to balance the weights of value, trust, and load in decision-making, and can be dynamically adjusted according to the system strategy. For example, it can be set when the strategy prioritizes security. When prioritizing efficiency, you can set... Relatively large.

[0096] Example of a decision-making process: The system is data packet D1 (value score) Select a node. There are currently two candidate nodes: Node A: Trust Value Loading factor .

[0097] Node B: Trust Value Loading factor (High load).

[0098] Set coefficients .

[0099] Calculate for node A Calculate for node B: Although node B has a lower trust level than node A, its load is much lighter than A's, so the decision function is calculated as follows: The system can adjust the current policy based on factors such as node trust value. When load balancing is required, node B is selected as the target node to achieve load balancing.

[0100] If node B's trust value is only 0.4, then after calculation... This will significantly reduce the risk, and the system will prioritize selecting the high-trust node A, which demonstrates the flexibility of multi-parameter collaborative decision-making.

[0101] 2. Trust value decay update model: To address dynamic node risks, the system uses smart contracts to implement trust value decay. This decay occurs at preset time intervals. Trust value of node N Automatic updates:

[0102] in, The decay constant controls the rate at which trust decays over time.

[0103] Update process example: The initial trust value of node C is 0.9, with a decay constant. .

[0104] After 1 day, , Automatic decay to .

[0105] If node C does not have any new interactions during this period, its trust value will continue to decay slowly, encouraging the node to continue providing reliable services.

[0106] If node C successfully completes a high-value computation task and receives a positive evaluation, its trust value will receive an increment. For example, +0.05 is added to the decayed value to achieve dynamic updates.

[0107] This mechanism ensures the real-time and dynamic nature of trust profiles, enabling rapid response to changes in node status and strengthening the system's security resilience.

[0108] Through the three-parameter collaborative decision function and trust decay model described in this embodiment, the present invention elevates collaborative orchestration from a vague concept to a computable, controllable, and adaptive intelligent system engineering, achieving optimal utilization of edge computing resources while ensuring security.

[0109] This invention provides an automated anomaly detection method and system for large-scale industrial Internet of Things (IoT), which can achieve low latency, high accuracy and secure collaborative capabilities.

[0110] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the invention can be implemented in other specific forms without departing from its spirit or essential characteristics. Therefore, the embodiments should be considered in all respects as exemplary and non-limiting, and the scope of the invention is defined by the appended claims rather than the foregoing description. Thus, all variations falling within the meaning and scope of equivalents of the claims are intended to be included within the present invention. No reference numerals in the claims should be construed as limiting the scope of the claims.

[0111] Furthermore, it should be understood that although this specification describes embodiments, not every embodiment contains only one independent technical solution. This narrative style is merely for clarity. Those skilled in the art should consider the specification as a whole, and the technical solutions in each embodiment can also be appropriately combined to form other embodiments that can be understood by those skilled in the art.< / value:medium> < / value:high>

Claims

1. An automated anomaly detection method for large-scale industrial Internet of Things (IIoT), characterized in that, Includes the following steps: S1: Acquire multi-dimensional sensing data from production equipment, forward and preprocess the data through a standardized interface to obtain preprocessed data; S2: Construct a massive multi-dimensional perception data integration environment, classify the data value of the preprocessed data based on metadata description and generate value tags, and at the same time construct and dynamically update the trust measurement profile of each edge node participating in collaborative computing based on blockchain technology. S3: Based on the value tags, trust metrics profiles, and the real-time load capacity of the nodes, the task adaptability is calculated through a three-parameter collaborative decision function. Based on the task adaptability, the data migration path and the task unloading strategy are dynamically determined to form a usable dataset and execute localized business processing. S4: Apply an anomaly detection algorithm to the available dataset to identify anomalous observations that do not match the expected pattern, and generate predictive maintenance instructions based on the anomaly detection results.

2. The automated anomaly detection method for large-scale industrial IoT according to claim 1, characterized in that, The anomaly detection algorithm used in S4 is used for calculation, including at least one of the following: A density-based local anomaly factor algorithm is applied to compare local data density with preset values ​​to identify anomalies; Apply time-series forecasting models to calculate future equipment status data to support predictive maintenance; A machine learning supervision mechanism based on novelty detection technology is introduced, and a goodness-of-fit test is performed to determine whether the data distribution conforms to the expected pattern.

3. The automated anomaly detection method for large-scale industrial IoT according to claim 1, characterized in that, The data value classification in S2 includes: calculating the data value score by weighted summation based on the reliability weight of the data source, the matching degree between the data and historical anomaly patterns, and the timeliness factor of the data, and dividing the data into high, medium and low value levels to generate corresponding value labels.

4. The automated anomaly detection method for large-scale industrial IoT according to claim 1, characterized in that, The generation of predictive maintenance instructions in S4 includes: training a predictive model using historical data without anomalies, and constructing and updating a predictive maintenance knowledge graph for production equipment by combining anomaly detection results.

5. The automated anomaly detection method for large-scale industrial IoT according to claim 1, characterized in that, The multi-dimensional sensing data acquired in S1 includes high-definition video data of the production environment and equipment operating status data; the method also includes: simulating data center energy efficiency and load based on the Monte Carlo method to optimize the computing task offloading strategy.

6. The automated anomaly detection method for large-scale industrial Internet of Things according to claim 1, characterized in that, The construction of the trust measurement profile in S2 includes: dynamically calculating and updating the trust value of each node through smart contracts based on the completion quality of historical tasks of edge nodes, data tampering records, and network behavior compliance; the trust value decays and is updated over time according to a preset decay factor.

7. The automated anomaly detection method for large-scale industrial IoT according to claim 1, characterized in that, The dynamic decision-making data migration path and computation task unloading strategy in S3 includes: taking the value tag, trust metric profile and node real-time load capacity as input parameters, solving the three-parameter collaborative decision function to obtain the task adaptability, and selecting the node with the highest task adaptability as the target node for data migration or task unloading.

8. The method according to claim 7, characterized in that, The real-time load capacity of the node is calculated based on the node's CPU utilization, memory usage, and network bandwidth utilization.

9. The automated anomaly detection method for large-scale industrial Internet of Things according to claim 1, characterized in that, The construction of a massive multi-dimensional sensing data integration environment in S2 includes: integrating heterogeneous software and hardware resources, providing a unified data storage cloud environment through virtualization technology, and realizing unified data collection, transmission, storage and processing.

10. The automated anomaly detection method for large-scale industrial Internet of Things according to claim 1, characterized in that, The method is applied to a smart factory environment, and the anomaly detection results and predictive maintenance instructions are responded to and pushed within 10 seconds.

Images