Method and system for screening abnormality of Internet of Things devices through traffic anomaly detection

Abstract

The invention discloses a method and system for screening abnormalities of Internet of Things devices through traffic abnormality detection. The technical scheme that the present invention adopts is: 1) mirroring the flow through switch, obtain the IP address of equipment in the network and specific flow information, generate flow log; 2) utilize the log data collector of local file to monitor flow log directory or log file, Obtain real-time log data for temporary storage; 3) Collect eigenvalue data, synthesize time series vectors through log vectorization, and use the method of time series anomaly detection based on prediction to monitor traffic anomalies in multiple dimensions for different devices; 4) Perform hierarchical processing on abnormal information obtained through time series abnormal detection. The present invention optimizes the mode of equipment anomaly detection by utilizing the method of traffic anomaly analysis, and greatly reduces the pressure on equipment load caused by anomaly analysis that requires a large amount of equipment resources to be occupied in business scenarios.

Description

technical field [0001] The invention belongs to the field of anomaly detection of Internet of Things equipment, and specifically relates to a method and system for screening anomalies of Internet of Things equipment through traffic anomaly detection. Background technique [0002] As the Internet of Things is used more and more widely in various fields of production and life, especially in the power system, the number and variety of IoT terminals are huge, and with the intelligentization of the power system, the number and types of terminals will increase. Further increase, which has brought enormous pressure on the security protection and operation and maintenance of the power system. Therefore, it is necessary to reduce the equipment resources occupied by power system security protection and operation and maintenance, and reduce the pressure brought by anomaly detection on the system. [0003] Due to the large number of Internet of Things terminals, for some types of devic...

AI Technical Summary

Problems solved by technology

[0003] Due to the large number of IoT terminals, for certain types of devices, using traditional anomaly detection methods for such devices, it takes a lot of resources to perform anomaly detection on all devices and is difficult to implement

For example, for abnormal detection of camera equipment, if the method of image processing is to take images according to the time granularity for abnormal detection, it will put a lot of pressure on the system. In addition, if the time granularity of taking pictures is increased to reduce the If small anomaly detection puts pressure on the system, it will inevitably lose some timing information in the video stream, making it difficult to detect some timing-related anomalies

Images