An adaptive anomaly detection method and system for resource-constrained devices

Abstract

This application provides an adaptive anomaly detection method and system for resource-constrained devices. By normalizing device data and performing multi-timescale processing based on multiple independent timescale processing units, corresponding exponential moving averages and exponential moving variances are obtained. Based on the exponential moving averages and exponential moving variances output by each timescale processing unit, corresponding dynamic threshold intervals are generated. These multiple dynamic threshold intervals are then fused to obtain a comprehensive dynamic threshold interval. This allows for data-state mapping and control-state mapping, constructing a sustainable, adaptive, and hierarchically expressible adaptive state assessment mechanism. Furthermore, the entire method can operate efficiently in low-power, low-storage embedded environments. Based on this, anomaly detection maintains continuous, stable, and accurate judgment capabilities during dynamic device changes, improving the accuracy and robustness of anomaly detection.

Description

Technical Field

[0001] This application relates to the field of data processing, and in particular to an adaptive anomaly detection method and system for resource-constrained devices. Background Technology

[0002] As the scale of IoT devices continues to expand, the amount of data generated at the edge is growing exponentially, significantly increasing the demands on edge intelligent computing for real-time performance, resource efficiency, and environmental adaptability. Traditional cloud-based large-scale deep learning solutions generally rely on high-performance computing platforms and high-speed network bandwidth when performing inference or model updates. However, low-power microcontrollers (MCUs) deployed in large numbers in industrial sites, agricultural environments, urban public facilities, and home devices have only a few KB to a dozen KB of RAM and extremely limited Flash space, making it difficult to support complex models. Meanwhile, the method of using fixed threshold rules to achieve local intelligent judgment was common in early smart terminals, but these static rules are unable to handle noise, drift, and dynamic offsets caused by device aging that evolve over time in real-world environments, leading to high false alarm rates or severe missed alarms. Especially in typical IoT applications such as power monitoring, structural health monitoring, environmental sensing, and predictive maintenance, sensor readings exhibit significant instability and non-stationarity, making reliance on fixed thresholds prone to failure.

[0003] Therefore, a device anomaly detection method that is more adaptable to resource-constrained platforms is needed, enabling online adaptive anomaly detection for time-varying data with extremely low resource consumption. Summary of the Invention

[0004] The purpose of this application is to provide an adaptive anomaly detection method and system for resource-constrained devices.

[0005] In a first aspect, embodiments of the present invention provide an adaptive anomaly detection method for resource-constrained devices, including: Step S1: Normalize the device data currently collected by the sensor to obtain normalized device data; Step S2: The normalized device data is input into three independent time-scale processing units, wherein the three time-scale processing units use a first smoothing factor, a second smoothing factor and a third smoothing factor to perform exponential moving average and exponential moving variance calculations, respectively, and the first smoothing factor is greater than the second smoothing factor, and the second smoothing factor is greater than the third smoothing factor. Step S3: Based on the exponential moving average and exponential moving variance output by the three time scale processing units, generate the first dynamic threshold interval, the second dynamic threshold interval and the third dynamic threshold interval respectively, and perform threshold fusion based on the first dynamic threshold interval, the second dynamic threshold interval and the third dynamic threshold interval to obtain the comprehensive dynamic threshold interval. Step S4: Based on the comprehensive dynamic threshold range, the normalized device data is mapped to a data state, and based on the exponential moving variance output by the three time-scale processing units, the normalized device data is mapped to a control state; wherein, the data state represents the operating state of the corresponding device, and the data state includes normal state, early warning state and abnormal state; the control state represents the confidence level of the data state.

[0006] Optionally, the generation of a first dynamic threshold interval, a second dynamic threshold interval, and a third dynamic threshold interval based on the exponential moving average and exponential moving variance output by the three time-scale processing units specifically includes: The fluctuation coefficient is obtained by multiplying the preset sensitivity coefficient by the standard deviation corresponding to the exponential moving variance output by any time scale processing unit. The exponential moving average output by any of the time-scale processing units is added to and the fluctuation coefficient is subtracted to obtain the upper and lower limits of the corresponding dynamic threshold interval.

[0007] Optionally, the step of fusing thresholds based on the first dynamic threshold interval, the second dynamic threshold interval, and the third dynamic threshold interval to obtain a comprehensive dynamic threshold interval specifically includes: Obtain the pairwise differences between the exponential moving averages output by the three time-scale processing units, and construct the mean difference vectors corresponding to the three time-scale processing units. If the difference between the exponential moving average output by the first time scale processing unit and the exponential moving average output by the second time scale processing unit in the mean difference vector is greater than the first preset threshold, then the first dynamic threshold interval is determined to be the comprehensive dynamic threshold interval. If the difference between the exponential moving average output by the second time scale processing unit and the exponential moving average output by the third time scale processing unit in the mean difference vector is less than the second preset threshold, then the third dynamic threshold interval is determined to be the comprehensive dynamic threshold interval. Otherwise, the second dynamic threshold interval is determined as the comprehensive dynamic threshold interval.

[0008] Optionally, the process of mapping the normalized device data to a control state based on the exponential moving variance output by the three time-scale processing units specifically includes: Obtain the pairwise differences between the exponential moving averages output by the three time-scale processing units, and construct the mean difference vectors corresponding to the three time-scale processing units. The difference between the exponential moving average output by the time scale processing unit corresponding to the first smoothing factor and the normalized device data is determined as the first offset, and the difference between the exponential moving average output by the time scale processing unit corresponding to the second smoothing factor and the normalized device data is determined as the second offset. Based on the difference between the exponential moving average output by the time-scale processing unit corresponding to the first smoothing factor and the exponential moving average output by the corresponding time-scale processing unit in the previous period, the mutation flag of the corresponding time-scale processing unit is updated; wherein, when the difference between the exponential moving average output by the time-scale processing unit and the exponential moving average output by the time-scale processing unit in the previous period is greater than a preset difference, the mutation flag of the time-scale processing unit is updated to 1. The confidence level is determined based on the exponential moving variance output by the time-scale processing unit corresponding to the first smoothing factor, the exponential moving variance output by the time-scale processing unit corresponding to the second smoothing factor, the difference between the first offset and the second offset, and the mutation marker of the time-scale processing unit corresponding to the first smoothing factor. Based on the mean difference vectors corresponding to the three time-scale processing units, the consistency index of the three time-scale processing units is determined. Based on the credibility and the consistency index, the normalized device data is mapped to a control state.

[0009] Optionally, any time-scale processing unit performs exponential moving average and exponential moving variance calculations using the corresponding smoothing factor, specifically including: Based on the corresponding smoothing factor, the normalized device data, and the exponential moving average output by any time scale processing unit in the previous period, calculate the exponential moving average for the current period. Based on the corresponding smoothing factor, the normalized device data, and the exponential moving average and exponential moving variance output by any time scale processing unit in the previous period, the exponential moving variance of the current period is calculated.

[0010] Optionally, the method further includes: If the control state is higher than the first threshold, the abnormal monitoring result of the corresponding device is determined based on the data state. If the control state is lower than the first threshold and higher than the second threshold, the abnormal monitoring result of the corresponding device is determined based on the locally deployed lookup table and the normalized device data. If the control state is lower than the second threshold, the abnormal monitoring result of the corresponding device is determined to be abnormal and an alarm is triggered.

[0011] Secondly, embodiments of the present invention provide an adaptive anomaly detection system for resource-constrained devices, comprising: The normalization unit is used to normalize the device data currently collected by the sensor to obtain normalized device data; The trend calculation unit is used to input the normalized device data into three independent time scale processing units, wherein the three time scale processing units respectively use a first smoothing factor, a second smoothing factor and a third smoothing factor to perform exponential moving average and exponential moving variance calculations, and the first smoothing factor is greater than the second smoothing factor, and the second smoothing factor is greater than the third smoothing factor. The threshold interval integration unit is used to generate a first dynamic threshold interval, a second dynamic threshold interval, and a third dynamic threshold interval based on the exponential moving average and exponential moving variance output by the three time scale processing units, and to perform threshold fusion based on the first dynamic threshold interval, the second dynamic threshold interval, and the third dynamic threshold interval to obtain a comprehensive dynamic threshold interval. A two-dimensional state mapping unit is used to map the normalized device data into a data state based on the comprehensive dynamic threshold range, and to map the normalized device data into a control state based on the exponential moving variance output by the three time-scale processing units; wherein, the data state represents the operating state of the corresponding device, and the data state includes normal state, warning state and abnormal state; the control state represents the confidence level of the data state.

[0012] Optionally, the step of fusing thresholds based on the first dynamic threshold interval, the second dynamic threshold interval, and the third dynamic threshold interval to obtain a comprehensive dynamic threshold interval specifically includes: Obtain the pairwise differences between the exponential moving averages output by the three time-scale processing units, and construct the mean difference vectors corresponding to the three time-scale processing units. If the difference between the exponential moving average output by the first time scale processing unit and the exponential moving average output by the second time scale processing unit in the mean difference vector is greater than the first preset threshold, then the first dynamic threshold interval is determined to be the comprehensive dynamic threshold interval. If the difference between the exponential moving average output by the second time scale processing unit and the exponential moving average output by the third time scale processing unit in the mean difference vector is less than the second preset threshold, then the third dynamic threshold interval is determined to be the comprehensive dynamic threshold interval. Otherwise, the second dynamic threshold interval is determined as the comprehensive dynamic threshold interval.

[0013] Thirdly, embodiments of the present invention provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the adaptive anomaly detection method for resource-constrained devices described in the first aspect.

[0014] Fourthly, embodiments of the present invention provide a storage medium storing computer program instructions thereon, characterized in that, when the computer program instructions are executed, they implement the adaptive anomaly detection method for resource-constrained devices described in the first aspect.

[0015] This invention provides an adaptive anomaly detection method and system for resource-constrained devices. By normalizing device data and performing multi-timescale processing based on multiple independent timescale processing units, corresponding exponential moving averages and exponential moving variances are obtained. Based on the exponential moving averages and exponential moving variances output by each timescale processing unit, corresponding dynamic threshold intervals are generated. These multiple dynamic threshold intervals are then fused to obtain a comprehensive dynamic threshold interval. This allows for data-state mapping and control-state mapping, constructing a sustainable, adaptive, and hierarchically expressible adaptive state assessment mechanism. Furthermore, the entire method can operate efficiently in low-power, low-storage embedded environments. Based on this, anomaly detection maintains continuous, stable, and accurate judgment capabilities during dynamic changes in the device, improving the accuracy and robustness of anomaly detection. Attached Figure Description

[0016] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly described below.

[0017] Figure 1 This is a flowchart illustrating the adaptive anomaly detection method for resource-constrained devices provided by the present invention. Figure 2 This is a flowchart illustrating the control state mapping method provided in an embodiment of the present invention; Figure 3 This is a schematic diagram of the adaptive anomaly detection system for resource-constrained equipment provided by the present invention; Figure 4 This is a schematic diagram of the physical structure of the electronic device provided in an embodiment of the present invention. Detailed Implementation

[0018] The technical solutions in the embodiments of this application will now be described with reference to the accompanying drawings.

[0019] Similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, in the description of this application, terms such as "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0020] Figure 1 This is a flowchart illustrating the adaptive anomaly detection method for resource-constrained devices provided by the present invention, as shown below. Figure 1 As shown, the method includes: Step S1: Normalize the device data currently collected by the sensor to obtain normalized device data; Step S2: The normalized device data is input into three independent time-scale processing units, wherein the three time-scale processing units use a first smoothing factor, a second smoothing factor and a third smoothing factor to perform exponential moving average and exponential moving variance calculations, respectively, and the first smoothing factor is greater than the second smoothing factor, and the second smoothing factor is greater than the third smoothing factor. Step S3: Based on the exponential moving average and exponential moving variance output by the three time scale processing units, generate the first dynamic threshold interval, the second dynamic threshold interval and the third dynamic threshold interval respectively, and perform threshold fusion based on the first dynamic threshold interval, the second dynamic threshold interval and the third dynamic threshold interval to obtain the comprehensive dynamic threshold interval. Step S4: Based on the comprehensive dynamic threshold range, the normalized device data is mapped to a data state, and based on the exponential moving variance output by the three time-scale processing units, the normalized device data is mapped to a control state; wherein, the data state represents the operating state of the corresponding device, and the data state includes normal state, early warning state and abnormal state; the control state represents the confidence level of the data state.

[0021] Here, built-in or external sensors collect current operating data at a fixed frequency (e.g., every 10 milliseconds, 100 milliseconds, or every 1 second). The data type can be temperature, current, voltage, humidity, vibration amplitude, acceleration, sound intensity, or other physical quantities related to device operation. The sensor outputs raw device data in each sampling period. To ensure the consistency and stability of subsequent calculations, the currently collected device data is normalized. The normalization method can be linear scaling, mapping the input to a range of 0 to 1, or scaling based on a range derived from long-term historical data statistics; this embodiment of the invention does not specifically limit this method. The normalized data possesses dimensionless properties, making it independent of the engineering units of the original sensors, thereby ensuring the adaptability of the entire method under multiple devices and multiple scenarios.

[0022] After normalization, the normalized device data is simultaneously sent to three independent time-scale processing units. These three units use a first smoothing factor, a second smoothing factor, and a third smoothing factor, respectively, to update the exponential moving average and exponential moving variance. The first smoothing factor is the largest, followed by the second, and the third is the smallest. This approach allows each time scale to represent a different trend. The time-scale processing unit using the largest smoothing factor can quickly reflect instantaneous changes or short-term disturbances; the unit using the second smoothing factor has a moderate response speed to changes, filtering out some short-term noise and focusing more on medium-term trends; and the unit using the third smoothing factor, because it updates the slowest, can retain historical data to the greatest extent, resulting in strong long-term stability. In this embodiment, the three time-scale processing units perform exponential moving average and exponential moving variance updates in each sampling period, thereby forming short-term, medium-term, and long-term operational characteristics, enabling continuous monitoring of the overall trend, local changes, and short-term disturbances of the device data.

[0023] In some embodiments, the exponential moving average for the current period can be calculated based on the corresponding smoothing factor, normalized device data, and the exponential moving average output by the processing unit for this time scale in the previous period. Furthermore, the exponential moving variance for the current period can be calculated based on the corresponding smoothing factor, normalized device data, the exponential moving average output by the processing unit for this time scale in the previous period, and the exponential moving variance. For example, the exponential moving average and exponential moving variance for the current period can be calculated using the following formula: EMA(t) = α × X(t) + (1-α) × EMA(t-1) EMV(t) = (1-α) × EMV(t-1) + α × (X(t) - EMA(t-1)) 2 Where EMA(t) and EMA(t-1) are the exponential moving averages of the current period and the previous period, respectively, α is the smoothing factor, X(t) is the equipment operation data, and EMV(t) and EMV(t-1) are the exponential moving variances of the current period and the previous period, respectively.

[0024] Here, three independent time-scale processing units implement a hierarchical structure for trend expression along the time dimension. The technical benefits of this structure are reflected in the following three aspects: First, the fast time scale provides a sensitive response to the short-term characteristics of the data, enabling immediate capture of changes in the face of fluctuations, shocks, or sudden changes; second, the medium-speed time scale provides a smooth expression of medium-term fluctuations, capable of identifying changing trends without being overly affected by short-term noise; third, the long-term time scale provides a historical long-term baseline, ensuring the system always has a relatively stable reference value and does not lose its judgment basis due to some short-period disturbances. The three time scales working together enable the entire anomaly detection scheme to have strong adaptability under different operating stages and different noise conditions.

[0025] After the three time-scale processing units have completed updating the exponential moving average and exponential moving variance for the current sampling period, three independent dynamic threshold intervals can be generated based on their respective statistical results. In some embodiments, for any time-scale processing unit, a preset sensitivity coefficient can be multiplied by the standard deviation corresponding to the exponential moving variance output by that time-scale processing unit to obtain a volatility coefficient. Then, the exponential moving average output by that time-scale processing unit is added to and subtracted from the volatility coefficient to obtain the upper and lower limits of the corresponding dynamic threshold interval. Specifically, the first dynamic threshold interval generated by the time-scale processing unit based on the first smoothing factor reflects the short-term range of change, the second dynamic threshold interval generated by the time-scale processing unit based on the second smoothing factor reflects the medium-term trend range, and the third dynamic threshold interval generated by the time-scale processing unit based on the third smoothing factor reflects the long-term baseline range. Since the three dynamic threshold intervals target different time scales, they may differ in width, position, or stability. For example, during periods of stable equipment operation, the three intervals may be close to each other, while during short-term disturbances, the fast interval may widen significantly, while the long-term interval remains relatively narrow. This differentiated characteristic of the dynamic threshold intervals provides a multi-dimensional reference basis for subsequent state judgments.

[0026] Subsequently, the three dynamic threshold intervals can be integrated into a single comprehensive dynamic threshold interval. In this embodiment of the invention, threshold fusion can employ methods such as weighted fusion, interval selection, or dynamic optimization. For example, weighted fusion assigns different weights to the three dynamic threshold intervals and forms a comprehensive dynamic threshold interval based on the weighted results of the upper and lower limits of the intervals; the interval selection method may favor long-term scale intervals when the device experiences drastic fluctuations to maintain the stability of the judgment; while the dynamic optimization method can select the most suitable dynamic threshold interval as the comprehensive dynamic threshold interval based on the difference, variance relationship, or trend consistency of the three intervals.

[0027] In some embodiments, to obtain the boundary of a comprehensive dynamic threshold interval applicable to the current period's data, a mean difference vector-based interval selection method can be used to fuse the three dynamic threshold intervals. This allows the final comprehensive dynamic threshold interval to reflect the relationship between short-term changes, medium-term stability, and long-term trends. Specifically, within a sampling period, due to significant differences in the smoothing factors used by the three time-scale processing units, the exponential moving averages output by the three time-scale processing units are often not entirely consistent in actual operating environments. Therefore, this embodiment of the invention subtracts these three averages pairwise to obtain a difference structure reflecting the trend differences between different time scales, which serves as a mean difference vector composed of two difference components. This vector characterizes the trend differences of the exponential moving averages output by the three time-scale processing units, and is used to further determine which dynamic threshold interval should be selected as the comprehensive dynamic threshold interval.

[0028] When the first component of the mean difference vector (i.e., the difference between the exponential moving average output by the first time-scale processing unit and the exponential moving average output by the second time-scale processing unit) is greater than a pre-set first threshold, it is determined that there is a significant difference between the current device data in the short-term and medium-term dimensions. Since this difference usually means that the device operation has undergone rapid and obvious changes, the first dynamic threshold interval is directly selected as the comprehensive dynamic threshold interval for this period. This allows the comprehensive dynamic threshold interval to quickly respond to and adapt to short-term changes, enabling it to keenly capture rapid scale changes and allowing the anomaly detection scheme to automatically adjust the judgment criteria according to the data characteristics at different stages.

[0029] On the other hand, when the second component of the mean difference vector (i.e., the difference between the exponential moving average output by the second time-scale processing unit and the exponential moving average output by the third time-scale processing unit) is less than the second preset threshold, it can be determined that the medium-term trend and the long-term trend are relatively consistent, indicating that the equipment is operating in a relatively stable state. In this case, the embodiment of the present invention selects the third dynamic threshold interval as the comprehensive dynamic threshold interval, making the final interval more dependent on the trend baseline of the long-term scale. Since the third time-scale processing unit updates slowly and has strong stability, its corresponding dynamic threshold interval can better reflect the overall operating status of the equipment under such data characteristics.

[0030] When neither of the above two conditions is met—that is, the difference between the exponential moving average output by the first timescale processing unit and the exponential moving average output by the second timescale processing unit does not exceed the first preset threshold, and the difference between the exponential moving average output by the second timescale processing unit and the exponential moving average output by the third timescale processing unit is also not lower than the second preset threshold—this embodiment of the invention considers the trend relationship of the current cycle to be closer to the characteristics of the medium term, i.e., short-term changes are not drastic, and there is no high consistency between the long-term trend and the medium-term trend. In this case, this embodiment of the invention determines the second dynamic threshold range as the comprehensive dynamic threshold range to balance the difference between short-term fluctuations and the long-term baseline, so that the comprehensive dynamic threshold range can reflect the current device trend with moderate sensitivity.

[0031] Through the above method, this embodiment of the invention, without relying on complex calculation models, rapidly achieves the fusion and selection process of three candidate dynamic threshold intervals by comparing the pairwise differences of the exponential moving averages corresponding to three time scales. The finally determined comprehensive dynamic threshold interval will be used in the next step of the device's data state judgment logic, and can automatically match the most suitable threshold interval under different fluctuation levels, different trend characteristics, and different operating stages. It can be seen that the fusion method of this embodiment of the invention solves the problem that a single time scale is easily affected by noise, because the fused interval considers short-term, medium-term, and long-term trend expressions simultaneously, and the comprehensive dynamic threshold interval can automatically adjust with data fluctuations, giving the anomaly detection scheme strong adaptive characteristics. At the same time, the fused interval reduces misjudgments caused by drastic changes in a single scale, enabling the anomaly detection scheme to achieve a better balance between change and stability in actual operation.

[0032] Once the comprehensive dynamic threshold range is determined, normalized device data can be mapped to corresponding data states. In this embodiment of the invention, the data state represents the operating status of the corresponding device, including three categories: normal state, warning state, and abnormal state. If the normalized data is within the comprehensive dynamic threshold range, the system determines that the device is in a normal state; if the normalized data slightly exceeds the range boundary, the system determines it to be in a warning state to indicate possible trend changes; if the normalized data significantly exceeds the range boundary, the system determines it to be in an abnormal state, indicating that the device's current operation is inconsistent with long-term, medium-term, and short-term trends. Through this data state mapping method based on the comprehensive dynamic threshold range, the current operating type of the device can be determined according to the actual data deviation.

[0033] Meanwhile, this embodiment of the invention also maps the normalized device data to a control state based on the exponential moving averages output by the three time-scale processing units, reflecting the confidence level of the aforementioned data state judgment. For example, if the exponential moving averages output by the three time-scale processing units are all small, the control state can be set to a higher value to represent high confidence; if the exponential moving average output by the time-scale processing unit corresponding to the first smoothing factor is large, but the exponential moving averages output by the time-scale processing units corresponding to the second and third smoothing factors are still relatively stable, the control state can be set to a medium value to represent medium confidence; if the exponential moving averages output by the three time-scale processing units are all large, the control state can be set to a smaller value to represent low confidence, indicating that the current state judgment may be greatly affected by data fluctuations. It is evident that the introduction of the control state provides the system with credibility information, making the data state not only have classification significance but also include reliability information for reference during decision-making.

[0034] In some embodiments, such as Figure 2 As shown, normalized device data can be mapped to control states in the following way: Step S41: Obtain the pairwise differences between the exponential moving averages output by the three time-scale processing units, and construct the mean difference vectors corresponding to the three time-scale processing units. Step S42: Determine the difference between the exponential moving average output by the time scale processing unit corresponding to the first smoothing factor and the normalized device data as the first offset, and determine the difference between the exponential moving average output by the time scale processing unit corresponding to the second smoothing factor and the normalized device data as the second offset. Step S43: Based on the difference between the exponential moving average output by the time-scale processing unit corresponding to the first smoothing factor and the exponential moving average output by the corresponding time-scale processing unit in the previous period, update the mutation flag of the corresponding time-scale processing unit; wherein, when the difference between the exponential moving average output by the time-scale processing unit and the exponential moving average output by the time-scale processing unit in the previous period is greater than a preset difference, the mutation flag of the time-scale processing unit is updated to 1. Step S44: Determine the confidence level based on the exponential moving variance output by the time scale processing unit corresponding to the first smoothing factor, the exponential moving variance output by the time scale processing unit corresponding to the second smoothing factor, the difference between the first offset and the second offset, and the mutation marker of the time scale processing unit corresponding to the first smoothing factor. Step S45: Determine the consistency index of the three time-scale processing units based on the mean difference vectors corresponding to the three time-scale processing units. Step S46: Based on the credibility and the consistency index, map the normalized device data to a control state.

[0035] Specifically, the exponential moving averages output by the three time-scale processing units will exhibit certain numerical differences due to their varying response speeds. To capture these trend differences, the exponential moving averages output by the three time-scale processing units can be subtracted pairwise to construct a mean difference vector. This vector contains two sets of differences: one set represents the difference between the exponential moving average output by the time-scale processing unit corresponding to the first smoothing factor and the one corresponding to the second smoothing factor; the other set represents the difference between the exponential moving average output by the time-scale processing unit corresponding to the second smoothing factor and the one corresponding to the third smoothing factor.

[0036] Simultaneously, the offset can be calculated as the difference between the normalized device data and the exponential moving averages output by the time-scale processing units corresponding to different smoothing factors. Specifically, the difference between the exponential moving average output by the time-scale processing unit corresponding to the first smoothing factor and the normalized device data is recorded as the first offset, and the difference between the exponential moving average output by the time-scale processing unit corresponding to the second smoothing factor and the normalized device data is recorded as the second offset. These two offsets reflect the relative position of the current data at different time scales and are used to describe the degree of deviation of the device's current instantaneous data from different trend levels.

[0037] Furthermore, this embodiment of the invention also sets a mutation flag for the time-scale processing unit corresponding to the first smoothing factor. This flag indicates whether the exponential moving average output by the time-scale processing unit corresponding to the first smoothing factor has undergone a significant mutation in the current period. Specifically, the exponential moving average output by the time-scale processing unit corresponding to the first smoothing factor in the current period can be compared with the exponential moving average output in the previous period. If the difference between the two is greater than a preset difference, the mutation flag is updated to 1, indicating that there is a mutation in this period; if it does not exceed the preset difference, the mutation flag is 0. The existence of the mutation flag enables the control state to perceive short-term jumps, thereby reflecting the possibility of short-term trend anomalies in subsequent reliability assessments.

[0038] After obtaining the exponential moving variance output by the time-scale processing unit corresponding to the first smoothing factor, the exponential moving variance output by the time-scale processing unit corresponding to the second smoothing factor, the difference between the first offset and the second offset, and the mutation marker of the time-scale processing unit corresponding to the first smoothing factor, these indicators can be combined to generate the reliability of the current period. Reliability can be understood as the degree of reliability of the data state judgment result. For example, when the exponential moving variance output by the time-scale processing unit corresponding to the first smoothing factor and the exponential moving variance output by the time-scale processing unit corresponding to the second smoothing factor are both at low levels, the difference between the first offset and the second offset is small, and the mutation marker is 0, a high reliability can be output; if the exponential moving variance output by the time-scale processing unit corresponding to the first smoothing factor is large or the difference between the first offset and the second offset is significant, and the mutation marker is 1, then the reliability is low. Since reliability is determined by multiple factors, it can simultaneously reflect the degree of data fluctuation, the degree of trend deviation, and the mutation situation. In some embodiments, reliability can be calculated based on the following formula: N(t) = 1 / (wN1·σ1) + 1 / (wN2·σ2) - wN3·|△1-△2| - wN4·Flag Where N(t) is the confidence level of the current period, wN1, wN2, wN3 and wN4 are weight terms, σ1 and σ2 are the exponential moving variances of the time scale processing unit output corresponding to the first smoothing factor and the second smoothing factor, respectively, Δ1 and Δ2 are the first offset and the second offset, and Flag is the mutation marker.

[0039] Meanwhile, this embodiment of the invention also calculates the consistency index of the three time-scale processing units based on the previously constructed mean difference vector. This consistency index reflects whether the changing trends of the three time scales are consistent. Specifically, if the differences between the exponential moving averages output by the first and second time-scale processing units, and between the exponential moving averages output by the second and third time-scale processing units, are both small, a higher consistency index can be set; conversely, if the differences between the exponential moving averages output by the first and second time-scale processing units, or between the exponential moving averages output by the second and third time-scale processing units, are large, a lower consistency index can be set.

[0040] After obtaining the credibility and consistency index, they can be combined for the control state mapping of the current cycle. Specifically, the system calculates the control state for the current cycle based on the level of credibility and the magnitude of the consistency index. A higher value is assigned to the control state when both credibility and consistency index are high; a medium value is assigned when credibility or consistency index is low; and a smaller value is assigned when both credibility and consistency index are low. Ultimately, the control state, as supplementary information to the data state, together with the data state, constitutes the state description of the device for the current cycle, expressing both the current state of the data and the credibility level behind that state judgment.

[0041] In some embodiments, after obtaining the data state and control state of the normalized device data, anomaly detection can be performed based on these two dimensions of state representation. Specifically, two thresholds can be set: a first threshold and a second threshold, where the first threshold is greater than the second threshold. If the control state is higher than the first threshold, it indicates that the sensor has exhibited stable data change characteristics in the recent period. In this case, the final device anomaly monitoring result can be directly determined based on the data state. Under this judgment path, no computationally expensive models or external inference mechanisms need to be invoked, enabling anomaly detection to be completed with low resource consumption.

[0042] If the control state is below the first threshold but above the second threshold, then while the data state judgment has a certain degree of reliability, it still has some uncertainty. Therefore, directly judging based on the data state may not be sufficient to give a correct conclusion. In this case, a locally deployed lookup table can be invoked. This lookup table is generated through training with a large number of samples before deployment and contains the mapping relationship between normalized device data and decision labels. In actual operation, the normalized device data can be encoded into the lookup table index, and the anomaly monitoring results can be output through an O(1) time complexity table entry matching method. This method avoids the computational overhead of complex model reasoning and provides higher decision reliability than direct judgment under medium confidence conditions.

[0043] When the control state falls below the second threshold, i.e., in a low-confidence state, in order to ensure monitoring security, this embodiment of the invention will directly determine the abnormal monitoring result as abnormal and trigger an alarm. This strategy ensures that the system will not ignore potential fault risks even when information is uncertain, thus avoiding security vulnerabilities.

[0044] In summary, the embodiments of the present invention, through normalization, multi-timescale processing, dynamic threshold fusion, data state mapping and control state mapping, can construct an adaptive state evaluation mechanism that can operate sustainably, adapt to changes, and express trends hierarchically. Moreover, the entire method can run efficiently in low-power, low-storage embedded environments. On this basis, anomaly detection maintains continuous, stable and accurate judgment capabilities during dynamic changes in the device, thereby improving the accuracy and robustness of anomaly detection.

[0045] Based on any of the above embodiments Figure 3 This is a schematic diagram of the adaptive anomaly detection system for resource-constrained devices provided by the present invention. This system can be referenced in conjunction with the method provided in the above embodiments. Figure 3 As shown, the system includes: The normalization unit 310 is used to normalize the device data currently collected by the sensor to obtain normalized device data; The trend calculation unit 320 is used to input the normalized device data into three independent time scale processing units respectively. The three time scale processing units respectively use a first smoothing factor, a second smoothing factor and a third smoothing factor to perform exponential moving average and exponential moving variance calculations, and the first smoothing factor is greater than the second smoothing factor, and the second smoothing factor is greater than the third smoothing factor. The threshold interval integration unit 330 is used to generate a first dynamic threshold interval, a second dynamic threshold interval, and a third dynamic threshold interval based on the exponential moving average and exponential moving variance output by the three time scale processing units, and to perform threshold fusion based on the first dynamic threshold interval, the second dynamic threshold interval, and the third dynamic threshold interval to obtain a comprehensive dynamic threshold interval. The dual-dimensional state mapping unit 340 is used to map the normalized device data into a data state based on the comprehensive dynamic threshold range, and to map the normalized device data into a control state based on the exponential moving variance output by the three time-scale processing units; wherein, the data state represents the operating state of the corresponding device, and the data state includes normal state, warning state and abnormal state; the control state represents the confidence level of the data state.

[0046] The system provided in this invention normalizes device data and performs multi-time-scale processing based on multiple independent time-scale processing units to obtain corresponding exponential moving averages and exponential moving variances. Based on the exponential moving averages and exponential moving variances output by each time-scale processing unit, corresponding dynamic threshold intervals are generated. Multiple dynamic threshold intervals are then fused to obtain a comprehensive dynamic threshold interval. This allows for data-state mapping and control-state mapping, enabling the construction of a sustainable, adaptive, and hierarchically expressible adaptive state assessment mechanism. Furthermore, the entire method can operate efficiently in low-power, low-storage embedded environments. Based on this, anomaly detection maintains continuous, stable, and accurate judgment capabilities during dynamic device changes, improving the accuracy and robustness of anomaly detection.

[0047] Based on any of the above embodiments, the threshold fusion based on the first dynamic threshold interval, the second dynamic threshold interval, and the third dynamic threshold interval to obtain a comprehensive dynamic threshold interval specifically includes: Obtain the pairwise differences between the exponential moving averages output by the three time-scale processing units, and construct the mean difference vectors corresponding to the three time-scale processing units. If the difference between the exponential moving average output by the first time scale processing unit and the exponential moving average output by the second time scale processing unit in the mean difference vector is greater than the first preset threshold, then the first dynamic threshold interval is determined to be the comprehensive dynamic threshold interval. If the difference between the exponential moving average output by the second time scale processing unit and the exponential moving average output by the third time scale processing unit in the mean difference vector is less than the second preset threshold, then the third dynamic threshold interval is determined to be the comprehensive dynamic threshold interval. Otherwise, the second dynamic threshold interval is determined as the comprehensive dynamic threshold interval.

[0048] Based on any of the above embodiments, the appendix Figure 4 The diagram illustrates the physical structure of an electronic device according to an embodiment of the present invention. This electronic device may include a processor 410, a communications interface 420, a memory 430, and a communication bus 440. The processor 410, communications interface 420, and memory 430 communicate with each other via the communication bus 440. The processor 410 can call logical instructions stored in the memory 430 to execute the following method: Step S1: Normalize the device data currently collected by the sensor to obtain normalized device data; Step S2: The normalized device data is input into three independent time-scale processing units, wherein the three time-scale processing units use a first smoothing factor, a second smoothing factor and a third smoothing factor to perform exponential moving average and exponential moving variance calculations, respectively, and the first smoothing factor is greater than the second smoothing factor, and the second smoothing factor is greater than the third smoothing factor. Step S3: Based on the exponential moving average and exponential moving variance output by the three time scale processing units, generate the first dynamic threshold interval, the second dynamic threshold interval and the third dynamic threshold interval respectively, and perform threshold fusion based on the first dynamic threshold interval, the second dynamic threshold interval and the third dynamic threshold interval to obtain the comprehensive dynamic threshold interval. Step S4: Based on the comprehensive dynamic threshold range, the normalized device data is mapped to a data state, and based on the exponential moving variance output by the three time-scale processing units, the normalized device data is mapped to a control state; wherein, the data state represents the operating state of the corresponding device, and the data state includes normal state, early warning state and abnormal state; the control state represents the confidence level of the data state.

[0049] Furthermore, the logical instructions in the aforementioned memory 430 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention embodiment, essentially, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in this invention embodiment. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0050] On the other hand, embodiments of the present invention also provide a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, is implemented to perform the methods provided in the above embodiments, including, for example: Step S1: Normalize the device data currently collected by the sensor to obtain normalized device data; Step S2: The normalized device data is input into three independent time-scale processing units, wherein the three time-scale processing units use a first smoothing factor, a second smoothing factor and a third smoothing factor to perform exponential moving average and exponential moving variance calculations, respectively, and the first smoothing factor is greater than the second smoothing factor, and the second smoothing factor is greater than the third smoothing factor. Step S3: Based on the exponential moving average and exponential moving variance output by the three time scale processing units, generate the first dynamic threshold interval, the second dynamic threshold interval and the third dynamic threshold interval respectively, and perform threshold fusion based on the first dynamic threshold interval, the second dynamic threshold interval and the third dynamic threshold interval to obtain the comprehensive dynamic threshold interval. Step S4: Based on the comprehensive dynamic threshold range, the normalized device data is mapped to a data state, and based on the exponential moving variance output by the three time-scale processing units, the normalized device data is mapped to a control state; wherein, the data state represents the operating state of the corresponding device, and the data state includes normal state, early warning state and abnormal state; the control state represents the confidence level of the data state.

[0051] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0052] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0053] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. An adaptive anomaly detection method for resource-constrained devices, characterized in that, include: Step S1: Normalize the device data currently collected by the sensor to obtain normalized device data; Step S2: The normalized device data is input into three independent time-scale processing units, wherein the three time-scale processing units use a first smoothing factor, a second smoothing factor and a third smoothing factor to perform exponential moving average and exponential moving variance calculations, respectively, and the first smoothing factor is greater than the second smoothing factor, and the second smoothing factor is greater than the third smoothing factor. Step S3: Based on the exponential moving average and exponential moving variance output by the three time scale processing units, generate the first dynamic threshold interval, the second dynamic threshold interval and the third dynamic threshold interval respectively, and perform threshold fusion based on the first dynamic threshold interval, the second dynamic threshold interval and the third dynamic threshold interval to obtain the comprehensive dynamic threshold interval. Step S4: Based on the comprehensive dynamic threshold range, the normalized device data is mapped to a data state, and based on the exponential moving variance output by the three time-scale processing units, the normalized device data is mapped to a control state; wherein, the data state represents the operating state of the corresponding device, and the data state includes normal state, early warning state and abnormal state; the control state represents the confidence level of the data state.

2. The adaptive anomaly detection method for resource-constrained equipment according to claim 1, characterized in that, The exponential moving average and exponential moving variance output from the three time-scale processing units are used to generate a first dynamic threshold interval, a second dynamic threshold interval, and a third dynamic threshold interval, respectively, specifically including: The fluctuation coefficient is obtained by multiplying the preset sensitivity coefficient by the standard deviation corresponding to the exponential moving variance output by any time scale processing unit. The exponential moving average output by any of the time-scale processing units is added to and the fluctuation coefficient is subtracted to obtain the upper and lower limits of the corresponding dynamic threshold interval.

3. The adaptive anomaly detection method for resource-constrained equipment according to claim 1, characterized in that, The threshold fusion based on the first dynamic threshold interval, the second dynamic threshold interval, and the third dynamic threshold interval to obtain a comprehensive dynamic threshold interval specifically includes: Obtain the pairwise differences between the exponential moving averages output by the three time-scale processing units, and construct the mean difference vectors corresponding to the three time-scale processing units. If the difference between the exponential moving average output by the first time scale processing unit and the exponential moving average output by the second time scale processing unit in the mean difference vector is greater than the first preset threshold, then the first dynamic threshold interval is determined to be the comprehensive dynamic threshold interval. If the difference between the exponential moving average output by the second time scale processing unit and the exponential moving average output by the third time scale processing unit in the mean difference vector is less than the second preset threshold, then the third dynamic threshold interval is determined to be the comprehensive dynamic threshold interval. Otherwise, the second dynamic threshold interval is determined as the comprehensive dynamic threshold interval.

4. The adaptive anomaly detection method for resource-constrained equipment according to claim 1, characterized in that, The exponential moving variance output by the three time-scale processing units maps the normalized device data to a control state, specifically including: Obtain the pairwise differences between the exponential moving averages output by the three time-scale processing units, and construct the mean difference vectors corresponding to the three time-scale processing units. The difference between the exponential moving average output by the time scale processing unit corresponding to the first smoothing factor and the normalized device data is determined as the first offset, and the difference between the exponential moving average output by the time scale processing unit corresponding to the second smoothing factor and the normalized device data is determined as the second offset. Based on the difference between the exponential moving average output by the time-scale processing unit corresponding to the first smoothing factor and the exponential moving average output by the corresponding time-scale processing unit in the previous period, the mutation flag of the corresponding time-scale processing unit is updated; wherein, when the difference between the exponential moving average output by the time-scale processing unit and the exponential moving average output by the time-scale processing unit in the previous period is greater than a preset difference, the mutation flag of the time-scale processing unit is updated to 1. The confidence level is determined based on the exponential moving variance output by the time-scale processing unit corresponding to the first smoothing factor, the exponential moving variance output by the time-scale processing unit corresponding to the second smoothing factor, the difference between the first offset and the second offset, and the mutation marker of the time-scale processing unit corresponding to the first smoothing factor. Based on the mean difference vectors corresponding to the three time-scale processing units, the consistency index of the three time-scale processing units is determined. Based on the credibility and the consistency index, the normalized device data is mapped to a control state.

5. The adaptive anomaly detection method for resource-constrained equipment according to claim 1, characterized in that, Each time-scale processing unit performs exponential moving average and exponential moving variance calculations using the corresponding smoothing factor, specifically including: Based on the corresponding smoothing factor, the normalized device data, and the exponential moving average output by any time scale processing unit in the previous period, calculate the exponential moving average for the current period. Based on the corresponding smoothing factor, the normalized device data, and the exponential moving average and exponential moving variance output by any time scale processing unit in the previous period, the exponential moving variance of the current period is calculated.

6. The adaptive anomaly detection method for resource-constrained devices according to any one of claims 1 to 5, characterized in that, The method further includes: If the control state is higher than the first threshold, the abnormal monitoring result of the corresponding device is determined based on the data state. If the control state is lower than the first threshold and higher than the second threshold, the abnormal monitoring result of the corresponding device is determined based on the locally deployed lookup table and the normalized device data. If the control state is lower than the second threshold, the abnormal monitoring result of the corresponding device is determined to be abnormal and an alarm is triggered.

7. An adaptive anomaly detection system for resource-constrained equipment, characterized in that, include: The normalization unit is used to normalize the device data currently collected by the sensor to obtain normalized device data; The trend calculation unit is used to input the normalized device data into three independent time scale processing units, wherein the three time scale processing units respectively use a first smoothing factor, a second smoothing factor and a third smoothing factor to perform exponential moving average and exponential moving variance calculations, and the first smoothing factor is greater than the second smoothing factor, and the second smoothing factor is greater than the third smoothing factor. The threshold interval integration unit is used to generate a first dynamic threshold interval, a second dynamic threshold interval, and a third dynamic threshold interval based on the exponential moving average and exponential moving variance output by the three time scale processing units, and to perform threshold fusion based on the first dynamic threshold interval, the second dynamic threshold interval, and the third dynamic threshold interval to obtain a comprehensive dynamic threshold interval. A two-dimensional state mapping unit is used to map the normalized device data into a data state based on the comprehensive dynamic threshold range, and to map the normalized device data into a control state based on the exponential moving variance output by the three time-scale processing units; wherein, the data state represents the operating state of the corresponding device, and the data state includes normal state, warning state and abnormal state; the control state represents the confidence level of the data state.

8. The adaptive anomaly detection system for resource-constrained equipment according to claim 7, characterized in that, The threshold fusion based on the first dynamic threshold interval, the second dynamic threshold interval, and the third dynamic threshold interval to obtain a comprehensive dynamic threshold interval specifically includes: Obtain the pairwise differences between the exponential moving averages output by the three time-scale processing units, and construct the mean difference vectors corresponding to the three time-scale processing units. If the difference between the exponential moving average output by the first time scale processing unit and the exponential moving average output by the second time scale processing unit in the mean difference vector is greater than the first preset threshold, then the first dynamic threshold interval is determined to be the comprehensive dynamic threshold interval. If the difference between the exponential moving average output by the second time scale processing unit and the exponential moving average output by the third time scale processing unit in the mean difference vector is less than the second preset threshold, then the third dynamic threshold interval is determined to be the comprehensive dynamic threshold interval. Otherwise, the second dynamic threshold interval is determined as the comprehensive dynamic threshold interval.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the adaptive anomaly detection method for resource-constrained devices as described in any one of claims 1 to 6.

10. A storage medium storing computer program instructions thereon, characterized in that, When the computer program instructions are executed, they implement the adaptive anomaly detection method for resource-constrained devices as described in any one of claims 1-6.

Images