CN-121486241-B - Abnormality detection method of Internet of things equipment, abnormality detection model training method and system

CN121486241BCN 121486241 BCN121486241 BCN 121486241BCN-121486241-B

Abstract

The application discloses an anomaly detection method of equipment of the Internet of things, an anomaly detection model training method and an anomaly detection model training system, and is applied to the technical field of the Internet of things. The method comprises the steps of obtaining multi-mode state data of the Internet of things equipment, carrying out multi-mode feature extraction and domain offset elimination on the multi-mode state data through an edge end anomaly detection model to obtain multi-mode cross-domain adaptive feature data, carrying out global feature and local feature collaborative enhancement on the multi-mode cross-domain adaptive feature data to obtain key feature enhancement data, carrying out key feature compression on the key feature enhancement data to obtain key feature compression data, and carrying out normal or abnormal classification judgment on the key feature compression data to obtain an anomaly detection result. The abnormal detection of the Internet of things equipment with high accuracy, high suitability and high real-time performance is realized through multi-mode feature extraction and domain offset elimination of the edge end abnormal detection model, key feature enhancement and compression, and normal or abnormal classification detection.

Inventors

ZHAO YI
WU SHOUKUN
YANG FENGBIAO
RUI TAO

Assignees

天津云创硬见科技有限公司

Dates

Publication Date: 20260508
Application Date: 20260112

Claims (9)

1. The method for detecting the abnormality of the equipment of the Internet of things is characterized by being applied to the equipment of the edge end and comprising the following steps: Acquiring multi-mode state data of the Internet of things equipment, wherein the multi-mode state data at least comprises time sequence state data, discrete state data and network state data; Performing anomaly detection on the Internet of things equipment based on the multi-mode state data through an edge anomaly detection model to obtain an anomaly detection result, wherein in the edge anomaly detection model: performing multi-mode feature extraction and domain offset elimination on the multi-mode state data through an antagonistic cross-domain adaptation network to obtain multi-mode cross-domain adaptation feature data; Carrying out global feature and local feature collaborative enhancement on the multi-mode cross-domain adaptive feature data through a key feature enhancement network to obtain key feature enhancement data; Performing key feature compression on the key feature enhancement data through a key feature compression network to obtain key feature compression data; Performing normal or abnormal classification judgment based on the key feature compressed data through an abnormality detection network to obtain an abnormality detection result; The key feature enhancement network comprises an attention fusion unit, a local feature extraction unit and a residual fusion unit connected with the attention fusion unit and the local feature extraction unit; global feature and local feature collaborative enhancement is carried out on the multi-mode cross-domain adaptive feature data through a key feature enhancement network to obtain key feature enhancement data, wherein the method comprises the following steps: Performing fine adjustment and normalization on initial attention weights of the cross-domain adaptive feature data of each mode configured offline based on fluctuation conditions of real-time feature values of the cross-domain adaptive feature data of each mode in the multi-mode cross-domain adaptive feature data relative to normal baseline values through the attention fusion unit to obtain attention weights of the cross-domain adaptive feature data of each mode, and performing weighted fusion on the cross-domain adaptive feature data of each mode based on the attention weights of the cross-domain adaptive feature data of each mode to obtain global cross-domain adaptive feature data; Extracting local key features of each mode cross-domain adaptive feature data in the multi-mode cross-domain adaptive feature data by the local feature extraction unit to obtain original local key feature data; And carrying out residual fusion on the original local key characteristic data of the cross-domain adaptive characteristic data of each mode and the global cross-domain adaptive characteristic data through the residual fusion unit to obtain key characteristic enhancement data.
2. The internet of things device anomaly detection method of claim 1, wherein the antagonistic cross-domain adaptation network comprises a multi-modal feature extraction sub-network and a cross-domain adaptation sub-network; performing multi-mode feature extraction and domain offset elimination on the multi-mode state data through an antagonistic cross-domain adaptation network to obtain multi-mode cross-domain adaptation feature data, wherein the multi-mode cross-domain adaptation feature data comprises: The multimode characteristic extraction sub-network is used for carrying out multimode characteristic extraction on the multimode state data to obtain multimode original characteristic data; And performing domain offset elimination on the multi-mode original characteristic data through the cross-domain adaptation sub-network to obtain multi-mode cross-domain adaptation characteristic data.
3. The method for detecting the abnormality of the equipment of the Internet of things according to claim 2, wherein the multi-modal feature extraction sub-network comprises a data classification unit, different feature extraction units connected with the data classification unit and a feature summarization unit connected with the different feature extraction units, wherein the different feature extraction units comprise a time sequence feature extraction unit, a discrete feature extraction unit and a network feature extraction unit; The multi-mode feature extraction is carried out on the multi-mode state data through the multi-mode feature extraction sub-network to obtain multi-mode original feature data, and the multi-mode original feature data comprises the following steps: Identifying original state data of each mode from the multi-mode state data through the data classification unit, wherein the original state data of each mode at least comprises time sequence state data, discrete state data and network state data; the time sequence state data is subjected to convolution and gating processing through the time sequence feature extraction unit, so that short-term abrupt change feature vectors and long-term trend feature vectors are obtained and serve as time sequence feature data; semantic coding is carried out on the discrete state data through the discrete feature extraction unit, so that a dense numerical vector is obtained as discrete feature data; The network characteristic extraction unit is used for carrying out multidimensional statistical value calculation on the network state data to obtain a statistical value vector as network characteristic data; and summarizing the time sequence characteristic data, the discrete characteristic data and the network characteristic data into the multi-mode original characteristic data through the characteristic summarizing unit.
4. The method for detecting an anomaly of an internet of things device according to claim 2, wherein the cross-domain adaptation sub-network comprises a cross-domain adaptation encoder unit; performing domain offset cancellation on the multi-modal raw feature data through the cross-domain adaptation sub-network to obtain multi-modal cross-domain adaptation feature data, including: And mapping the multi-mode original feature data to a cross-domain feature alignment space through the cross-domain adaptive encoder unit, and performing domain offset elimination to obtain multi-mode cross-domain adaptive feature data, wherein the cross-domain feature alignment space is a feature mapping and alignment rule which is formed after anti-learning training and has cross-domain feature distribution alignment capability.
5. The method for detecting anomalies in an internet of things device according to claim 1, wherein the key feature compression network includes a progressive compression encoder unit; performing key feature compression on the key feature enhancement data through a key feature compression network to obtain key feature compressed data, including: and compressing the key feature enhancement data step by the step compression encoder unit to obtain the key feature compressed data.
6. The method for detecting an anomaly in an internet of things device according to claim 1, wherein the anomaly detection network comprises a classification unit; and carrying out normal or abnormal classification judgment based on the key feature compressed data through an abnormality detection network to obtain an abnormality detection result, wherein the abnormality detection result comprises the following steps: And calculating the deviation degree of the key feature compressed data and the normal baseline feature data through the classification unit, and determining an abnormality detection result based on the deviation degree and an abnormality judgment threshold value.
7. The edge anomaly detection model training method is characterized by being applied to cloud equipment and comprising the following steps of: the method comprises the steps of obtaining training sample data, wherein the training sample data comprise multi-mode state data, domain labels and abnormal labels of different Internet of things devices in a historical time range, wherein the domain labels represent application scenes of the devices or brands of the devices; the method comprises the steps of obtaining an anomaly detection result of different Internet of things equipment by using an edge anomaly detection model based on multi-modal state data of the different Internet of things equipment, wherein in the edge anomaly detection model, multi-modal characteristic extraction and domain offset elimination are carried out on the multi-modal state data through an opposite cross-domain adaptation network to obtain multi-modal cross-domain adaptation characteristic data, global characteristic and local characteristic cooperative enhancement are carried out on the multi-modal cross-domain adaptation characteristic data through a key characteristic enhancement network to obtain key characteristic enhancement data, key characteristic compression is carried out on the key characteristic enhancement data through a key characteristic compression network to obtain key characteristic compression data, and normal or abnormal classification judgment is carried out on the key characteristic compression data through an anomaly detection network to obtain the anomaly detection result; identifying domain sources and anomaly types of different internet of things devices based on the multi-mode cross-domain adaptation feature data of the different internet of things devices, and training network parameters of the antagonistic cross-domain adaptation network based on the domain sources and anomaly types and domain labels and anomaly labels of the different internet of things devices; Training network parameters of the key feature enhancement network based on the multi-mode cross-domain adaptation feature data and the abnormal labels of the different internet of things devices; performing feature reconstruction on the key feature compression data of the different Internet of things devices to obtain key feature reconstruction data of the different Internet of things devices, and training network parameters of the key feature compression network based on the key feature reconstruction data and the key feature enhancement data of the different Internet of things devices; based on key feature compression data and anomaly labels of different Internet of things devices, training network parameters of the anomaly detection network; And transmitting the trained network parameters to edge equipment so that the edge equipment configures the edge anomaly detection model based on the trained network parameters.
8. The edge anomaly detection model training method of claim 7, further comprising: Receiving key feature compression data and a domain label of the Internet of things equipment, wherein the key feature compression data and the domain label are sent by the edge equipment when the configured edge abnormality detection model detects that the Internet of things equipment is abnormal; Fusing the key feature compression data with the same-domain historical abnormal data and cross-domain historical abnormal data of the Internet of things equipment to obtain global context feature data; Performing global anomaly analysis on the Internet of things equipment based on the global context characteristic data through a cloud anomaly analysis model to obtain an anomaly analysis result, wherein the anomaly analysis result at least comprises an anomaly type and an anomaly root cause; Generating an anomaly tag based on the anomaly type and the anomaly root cause, and generating training sample data based on the key feature compression data, the domain tag and the anomaly tag; optimizing each network parameter of the edge anomaly detection model based on the training sample data; and transmitting the optimized network parameters to the edge equipment so that the edge equipment updates the edge anomaly detection model based on the optimized network parameters.
9. The system for detecting the abnormality of the equipment of the Internet of things is characterized by comprising edge equipment and cloud equipment which are in communication connection; The edge device is configured to perform the method for detecting an anomaly of an internet of things device according to any one of claims 1 to 6; The cloud device is configured to execute the edge anomaly detection model training method according to any one of claims 7 to 8.

Description

Abnormality detection method of Internet of things equipment, abnormality detection model training method and system Technical Field The application relates to the technical field of the Internet of things, in particular to an abnormality detection method of equipment of the Internet of things, an abnormality detection model training method and an abnormality detection model training system. Background Currently, internet of things (IoT) devices such as intelligent machine tools of factories, intelligent household sockets, urban traffic signal controllers and the like are increasingly widely applied, and once hardware faults, network attacks, data transmission and the like of the internet of things devices occur, production line downtime, household safety risks and even urban traffic confusion can be caused, so that the abnormality of the internet of things devices needs to be detected and found in time. The Internet of things equipment has three core characteristics, namely, the mode is miscellaneous, time sequence data of continuous changes of temperature, current and the like, scattered discrete data of equipment fault codes and the like, network data of network transmission data packet sizes, frequencies and the like, formats and meanings of different data are large, scene adaptation is difficult, the numerical ranges of normal operation of the same type of Internet of things equipment in different brands or different scenes (such as temperature sensors of workshops and temperature sensors of families) are completely different, edge equipment resources are limited, calculation power of most edge equipment is small, bandwidth is narrow, and abnormality detection time is long. The three core characteristics of the Internet of things equipment bring serious challenges to the accuracy, suitability and real-time performance of the abnormality detection technology of the Internet of things equipment. Disclosure of Invention The application provides an abnormality detection method, an abnormality detection model training method and an abnormality detection model training system for equipment of the Internet of things, which are used for solving the problems of poor accuracy, poor suitability and poor instantaneity of the abnormality detection technology of the equipment of the Internet of things in the prior art. The technical scheme provided by the application is as follows: In one aspect, the application provides a method for detecting abnormality of an internet of things device, which is applied to an edge device and comprises the following steps: acquiring multi-mode state data of the Internet of things equipment; Performing anomaly detection on the Internet of things equipment based on the multi-mode state data through an edge anomaly detection model to obtain an anomaly detection result, wherein in the edge anomaly detection model: multimode characteristic extraction and domain offset elimination are carried out on the multimode state data through the antagonistic cross-domain adaptive network to obtain multimode cross-domain adaptive characteristic data; Carrying out global feature and local feature collaborative enhancement on the multi-mode cross-domain adaptive feature data through a key feature enhancement network to obtain key feature enhancement data; carrying out key feature compression on the key feature enhancement data through a key feature compression network to obtain key feature compression data; and carrying out normal or abnormal classification judgment based on the key feature compressed data through an abnormality detection network to obtain an abnormality detection result. Optionally, the antagonistic cross-domain adaptation network comprises a multi-modal feature extraction sub-network and a cross-domain adaptation sub-network; Multimode characteristic extraction and domain offset elimination are carried out on the multimode state data through the antagonistic cross-domain adaptive network to obtain multimode cross-domain adaptive characteristic data, wherein the method comprises the following steps: Multimode characteristic extraction is carried out on the multimode state data through a multimode characteristic extraction sub-network to obtain multimode original characteristic data; and performing domain offset elimination on the multi-mode original characteristic data through the cross-domain adaptation sub-network to obtain multi-mode cross-domain adaptation characteristic data. Optionally, the multi-mode feature extraction sub-network comprises a data classification unit, different feature extraction units connected with the data classification unit and a feature summarization unit connected with the different feature extraction units, wherein the different feature extraction units comprise a time sequence feature extraction unit, a discrete feature extraction unit and a network feature extraction unit; multimode characteristic extraction is carried out on the multimode state data