CN-122027461-A - Internet of things system abnormality diagnosis method applied to large model

CN122027461ACN 122027461 ACN122027461 ACN 122027461ACN-122027461-A

Abstract

The invention discloses an anomaly diagnosis method of an Internet of things system applied to a large model, which has the technical scheme that the anomaly diagnosis method comprises the following steps of (1) detecting an anomaly sample from multidimensional time sequence data of the Internet of things system; the method comprises the steps of (1) locating abnormal indexes, namely determining the abnormal indexes which cause the abnormal samples to form an abnormal index set, and (3) carrying out abnormal diagnosis, namely constructing prompt words by utilizing the abnormal index set, and obtaining an abnormal diagnosis result by inquiring a large model. According to the method, the anomaly detection and root cause analysis technology is comprehensively adopted to determine the anomaly index in the Internet of things system, and the prompt word is constructed according to the anomaly index, so that the problem that the large model cannot process the data of the Internet of things system is solved, the large model is helped to better understand the anomaly scene of the Internet of things system, and therefore more accurate anomaly diagnosis is obtained.

Inventors

WANG FEI
CAO DONGGANG
LV MINGQI
HUANG PINGJIE
HE JIFA

Assignees

杭州希秀泛在计算技术有限公司
中国石油大学(华东)

Dates

Publication Date: 20260512
Application Date: 20260108

Claims (9)

1. The abnormality diagnosis method for the Internet of things system applied to the large model is characterized by comprising the following steps of: (1) Detecting an abnormal sample from multi-dimensional time sequence data of the Internet of things system; (2) Determining an abnormal index which causes the abnormal sample to form an abnormal index set; (3) And (3) performing abnormality diagnosis, namely constructing prompt words by using the abnormality index set, and obtaining an abnormality diagnosis result by inquiring a large model.
2. The method for diagnosing an abnormality of an internet of things system applied to a large model as claimed in claim 1, wherein the step (1) specifically includes: (1-1) acquiring multidimensional time sequence data of an Internet of things system Is marked as , wherein, The number of the sensing devices and the monitoring devices is corresponding to the time sequence data dimension; The time sequence data length corresponds to the acquisition time; (1-2) training an anomaly detection model DM based on an automatic encoder in a self-supervised learning manner, the training being aimed at minimizing the input time series data segment X t and the reconstructed time series data segment Is a difference in (2); (1-3) inputting the time sequence data segment obtained in real time into the abnormality detection model DM, calculating an abnormality score, and judging the time sequence data segment as an abnormality sample if the abnormality score is larger than a preset threshold value.
3. The method for diagnosing an anomaly of an internet of things system applied to a large model according to claim 2, wherein in the step (1-2), the model architecture of the automatic encoder comprises: An input layer for dividing X into multiple time sequence data segments based on sliding window with preset size Wherein W is the size of the sliding window, The data input to the automatic encoder is the time sequence data segment =< , ,..., In which Is that Middle (f) A feature vector); the coding layer uses an LSTM model to process X t , the processing mode is shown as the following formula, Obtaining W coding hidden state vectors r t1 ,r t2 ,...,r tW ; and a decoding layer for processing the coded hidden state vector r t1 ,r t2 ,...,r tW by using another LSTM model, wherein the processing mode is shown in the following formula, Obtaining W decoding hidden state vectors H t =<h t1 ,h t2 ,...,h tW >; A reconstruction layer, which converts H t into a reconstruction time sequence data segment consistent with the X t dimension of the input time sequence data segment by using a multi-layer perceptron 。
4. The method for diagnosing an anomaly of an internet of things system for a large model according to claim 3, wherein in the step (1-3), the real-time anomaly detection comprises the following specific steps: (1-3-1) sample reconstruction given a time-series data segment Inputting X into an abnormality detection model DM to obtain a reconstructed sample 。 (1-3-2) Anomaly scoring, calculating an anomaly score based on the formula, if score is greater than a specified threshold, determining that sample X is anomalous; wherein, the calculation formula of the anomaly score is: 。
5. The anomaly diagnosis method for the Internet of things system applied to the large model according to claim 1, wherein an anomaly sample is given The step (2) specifically includes: (2-1) randomly collecting a plurality of normal time sequence data segments and averaging to obtain a normal sample ; (2-2) For abnormal samples And normal sample Calculating a correlation coefficient on the i-th index, wherein cov (·) is a covariance function, σ (·) is a standard deviation function, and the calculation formula of the correlation coefficient is as follows: ; And (2-3) adopting a two-independent sample t test technology, taking the correlation coefficient as a P value, carrying out hypothesis test on each index, and when the P value is smaller than a preset threshold value, identifying the corresponding index i as an abnormal index, and finally obtaining an abnormal index set FS.
6. The method for diagnosing an abnormality of an internet of things system applied to a large model according to claim 5, wherein in the step (2-3), the specific steps of locating an abnormality index are as follows: (2-3-1) assume that H 0 is "the distribution of X A and X N over the ith index is the same", i.e ]= If H 0 is true, then the normal sample index is determined Index of abnormal sample Similarity, otherwise, the two sample indices are considered to have significant differences; (2-3-2) P value test using the correlation coefficient calculated in the step (2-2) as a P value indicating a probability of occurrence of a result more extreme than the obtained sample observation result in the case where the original assumption is true, the smaller the P value, the smaller the probability of occurrence of H 0 , and when the P value is smaller than the predefined threshold value α P (α P is set to 0.05), the assumption H 0 is rejected (i.e., considered to be [ Solution ] and (ii) a method for producing the same A significant difference) and identify the ith index as an abnormality index. And (2-3-3) performing iterative test, namely performing t test on two independent samples of each index to finally obtain an abnormal index set which is marked as FS.
7. The method for diagnosing an abnormality of an internet of things system applied to a large model according to claim 1, wherein the step (3) specifically includes: (3-1) abnormal index description generation of retrieving description information of each abnormal index in the abnormal index set FS and organizing the description information into an abnormal index description text AT; (3-2) abnormal index knowledge retrieval, namely, based on index names in the abnormal index set FS, retrieving related abnormal knowledge text segments EK from an external knowledge base; (3-3) generating an abnormal diagnosis prompt word, namely combining the abnormal index description text AT and the abnormal knowledge text segment EK into a complete prompt word APrompt according to a preset prompt word template; And (3-4) performing abnormality diagnosis based on the large model, namely inputting the prompt words APrompt into the large model, and acquiring and outputting an abnormality diagnosis description generated by the large model.
8. The method for diagnosing an abnormality of an internet of things system applied to a large model according to claim 7, wherein in the step (3-1), the description information at least includes one or more of an abnormality index name, a corresponding sensing device or monitoring device, an abnormality data deviation degree, an abnormality occurrence time, and an operation log.
9. The method for diagnosing an abnormality of an internet of things system applied to a large model according to claim 7, wherein in the step (3-2), the external knowledge base includes one or more of a system specification and a fault handling manual.

Description

Internet of things system abnormality diagnosis method applied to large model Technical Field The invention relates to the technical field of artificial intelligence, in particular to an anomaly diagnosis method of an Internet of things system applied to a large model. Background With the rapid development of manufacturing industry, the complexity and automation degree of industrial systems are continuously improved, so that the aspects of reliability, stability, safety and the like of the systems face higher requirements. In the fields of industrial production, manufacturing and the like, maintaining the stability and reliability of the production process is critical to ensuring the quality and production efficiency of the product. However, due to the complexity and diversity of industrial systems, various anomalies often occur, which can lead to production interruptions, equipment damage, and wasted resources. Therefore, it is very important to develop a method capable of efficiently and accurately detecting an abnormality in an industrial system and rapidly locating the cause of the abnormality. At present, the unsupervised anomaly detection based on deep learning mainly adopts an automatic encoder as a main stream model. A typical automatic encoder model includes two key components, an encoder and a decoder. The encoder is responsible for mapping the original data to a low-dimensional feature space, while the decoder remaps the features back to the original data space. The main objective of these models is to minimize the difference between the original data and the data reconstructed by the decoder, while distinguishing between normal and abnormal data by the distribution of feature space. After the abnormality is detected, the rapid root cause abnormality feature positioning plays a key role in subsequent fault removal and equipment repair. Currently, the main stream root cause feature positioning methods are divided into two types, namely a root cause feature positioning method based on deep learning and a root cause feature positioning method based on data statistics. The root cause characteristic positioning method based on deep learning estimates model behaviors through repeated model inquiry, uses local disturbance input and observes model output to rapidly position the root cause characteristics, and comprises LIME, SHAP, LEMNA and the like. However, even if the root cause feature causing the abnormality of the industrial system is located, the root cause analysis thereof requires a related-field expert to perform a manual operation, which requires a deep knowledge of the field and a rich operation experience. Furthermore, in industrial systems, there is often a large amount of unstructured data, such as operation logs, fault reports, etc., in addition to structured sensing data. The large model has remarkable advantages in the aspect of processing unstructured data, and the unstructured data can be effectively utilized through the large model, so that the comprehensiveness and accuracy of root cause analysis are further improved. Therefore, a new method for diagnosing the abnormality of the Internet of things system applied to the large model is provided. Disclosure of Invention The invention aims to provide an anomaly diagnosis method of an Internet of things system applied to a large model, which firstly solves the problem of lack of anomaly sample labeling by using a self-supervision learning model and realizes high-precision anomaly detection; and finally, constructing a structured prompt word by taking the positioned abnormal index information as a clue, and guiding the large model to be combined with a mass knowledge base for deep diagnosis, thereby realizing the efficient, accurate and interpretable abnormality diagnosis of the Internet of things system. In order to achieve the purpose, the invention provides the technical scheme that the abnormality diagnosis method of the Internet of things system applied to the large model comprises the following steps: (1) Detecting an abnormal sample from multi-dimensional time sequence data of the Internet of things system; (2) Determining an abnormal index which causes the abnormal sample to form an abnormal index set; (3) And (3) performing abnormality diagnosis, namely constructing prompt words by using the abnormality index set, and obtaining an abnormality diagnosis result by inquiring a large model. Preferably, the step (1) specifically includes: (1-1) acquiring multidimensional time sequence data of an Internet of things system Is marked as, wherein,The number of the sensing devices and the monitoring devices is corresponding to the time sequence data dimension; The time sequence data length corresponds to the acquisition time; (1-2) training an anomaly detection model DM based on an automatic encoder in a self-supervised learning manner, the training being aimed at minimizing the input time series data segment X t and the reconstructed time