End real-time monitoring and abnormal behavior analysis method based on deep learning large model

Abstract

The invention discloses an edge real-time monitoring and abnormal behavior analysis method based on a deep learning large model, and the method comprises the steps: monitoring and collecting a multi-dimensional behavior data set of edge equipment in real time, and generating multi-modal aggregation data of the multi-dimensional behavior data set; generating a behavior descriptor of each data point in the multi-dimensional behavior data set according to the multi-modal aggregated data; calculating a behavior similarity index based on the behavior descriptor; according to the multi-dimensional behavior data set, predicting a predicted abnormal score of each data point by using an abnormal score prediction model based on deep learning; and according to the anomaly prediction score and the behavior similarity index, evaluating the anomaly degree of each data point, and determining an abnormal behavior data point according to the anomaly degree. According to the embodiment of the invention, the method can provide a reliable basis for the recognition and response of abnormal behaviors through the combination of a deep learning technology and multi-modal data analysis, and achieves the comprehensive monitoring and intelligent analysis of the side equipment.

Description

Technical Field

[0001] The present invention belongs to the field of edge technology, and in particular to a method for real-time edge monitoring and abnormal behavior analysis based on a deep learning big model. Background Art

[0002] With the rapid development of the Internet of Things (IoT), edge computing, and artificial intelligence (AI) technologies, edge devices are becoming increasingly intelligent and interconnected, and are widely used in smart homes, industrial automation, and smart transportation. However, with the popularization of edge devices, the detection and security of abnormal behaviors have become important issues that need to be addressed. Existing anomaly detection methods usually rely on rules or thresholds, which are difficult to adapt to changing and complex environments. When processing multi-dimensional and multi-modal edge device behavior data, they often cannot effectively integrate different types of data, resulting in information loss. Summary of the invention

[0003] The purpose of the present invention is to provide a method for real-time edge monitoring and abnormal behavior analysis based on a deep learning large model to address the deficiencies in the prior art. By combining deep learning technology and multimodal data analysis, it can provide a reliable basis for the identification and response of abnormal behaviors, thereby achieving comprehensive monitoring and intelligent analysis of edge devices.

[0004] An embodiment of the present application provides a method for real-time edge monitoring and abnormal behavior analysis based on a deep learning big model, the method comprising: Monitor and collect multi-dimensional behavior data sets of edge devices in real time, and generate multi-modal aggregated data of the multi-dimensional behavior data sets; generating a behavior descriptor for each data point in the multi-dimensional behavior data set according to the multi-modal aggregated data, wherein the behavior descriptor is a low-dimensional latent space representation; Calculating a behavior similarity index based on the behavior descriptor to evaluate the similarity between the current behavior corresponding to each data point and the normal behavior; According to the multidimensional behavior dataset, using a pre-trained deep learning-based anomaly score prediction model, predicting a predicted anomaly score for each data point; According to the abnormal prediction score and the behavior similarity index, the abnormality degree of each data point is evaluated, and the abnormal behavior data point is determined according to the abnormality degree.

[0005] Optionally, the multimodal aggregated data of the multidimensional behavior dataset is generated in the following manner: Among them, the For multimodal aggregate data, is the weight of the kth data point, is the weight of the jth data point, is the data of the kth data point, is the number of data points.

[0006] Optionally, the behavior descriptor is generated as follows: Among them, the is the behavioral descriptor of the kth data point, is the autoencoder function, is the noise term.

[0007] Optionally, the calculation formula of the behavior similarity index is: Among them, the is the behavior similarity index of the kth data point, is the behavior descriptor of the normal behavior data corresponding to the kth data point, for and The Euclidean distance between .

[0008] Optionally, evaluating the abnormality degree of each data point according to the abnormal prediction score and the behavior similarity index includes: According to the abnormal prediction score and the behavior similarity index, a final abnormal score of each data point is calculated as the abnormal degree of each data point, wherein the final abnormal score is: Among them, the is the final anomaly score of the kth data point, is the predicted anomaly score for the kth data point, is the mean of the normal behavior data corresponding to each data point, is the standard deviation of the normal behavior data corresponding to each data point.

[0009] Optionally, determining the abnormal behavior data point according to the abnormality degree includes: According to the final anomaly score of each data point, if the final anomaly score is greater than a preset threshold, the data point corresponding to the final anomaly score is determined as an abnormal behavior data point, otherwise it is a normal behavior data point.

[0010] Another embodiment of the present application provides a real-time edge monitoring and abnormal behavior analysis system based on a deep learning big model, the system comprising: A monitoring module, used to monitor and collect multi-dimensional behavior data sets of edge devices in real time, and generate multi-modal aggregated data of the multi-dimensional behavior data sets; A generating module, configured to generate a behavior descriptor for each data point in the multi-dimensional behavior data set according to the multi-modal aggregated data, wherein the behavior descriptor is a low-dimensional latent space representation; A calculation module, used for calculating a behavior similarity index based on the behavior descriptor to evaluate the similarity between the current behavior corresponding to each data point and the normal behavior; A prediction module, configured to predict a predicted anomaly score for each data point based on the multidimensional behavior dataset using a pre-trained deep learning-based anomaly score prediction model; An evaluation module is used to evaluate the abnormality degree of each data point according to the abnormal prediction score and the behavior similarity index, and determine the abnormal behavior data point according to the abnormality degree.

[0011] Yet another embodiment of the present application provides a storage medium, wherein the storage medium stores a computer program, wherein the computer program is configured to execute any of the above methods when running.

[0012] Yet another embodiment of the present application provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute any of the methods described above.

[0013] Compared with the prior art, the present invention provides a method for real-time edge monitoring and abnormal behavior analysis based on a deep learning large model, which monitors and collects multidimensional behavior data sets of edge devices in real time, and generates multimodal aggregated data of the multidimensional behavior data sets; based on the multimodal aggregated data, generates a behavior descriptor for each data point in the multidimensional behavior data set; calculates a behavior similarity index based on the behavior descriptor to evaluate the similarity between the current behavior corresponding to each data point and the normal behavior; based on the multidimensional behavior data set, uses a pre-trained deep learning-based anomaly scoring prediction model to predict the predicted anomaly score of each data point; based on the anomaly prediction score and the behavior similarity index, evaluates the degree of abnormality of each data point, and determines the abnormal behavior data point based on the degree of abnormality, thereby providing a reliable basis for the identification and response of abnormal behaviors by combining deep learning technology and multimodal data analysis, and realizing comprehensive monitoring and intelligent analysis of edge devices. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 A hardware structure block diagram of a computer terminal for a method of edge real-time monitoring and abnormal behavior analysis based on a deep learning big model provided in an embodiment of the present invention; Figure 2 A flowchart of a method for real-time edge monitoring and abnormal behavior analysis based on a deep learning big model provided in an embodiment of the present invention; Figure 3 A structural diagram of a system for real-time edge monitoring and abnormal behavior analysis based on a deep learning big model provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0015] The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, but should not be construed as limiting the present invention.

[0016] The embodiment of the present invention first provides a method for real-time edge monitoring and abnormal behavior analysis based on a deep learning large model. The method can be applied to electronic devices, such as computer terminals, specifically ordinary computers, etc.

[0017] The following describes it in detail by taking running on a computer terminal as an example. Figure 1 The hardware structure block diagram of a computer terminal for a method of edge real-time monitoring and abnormal behavior analysis based on a deep learning big model provided by an embodiment of the present invention. Figure 1 As shown, the computer terminal may include one or more ( Figure 1 Only one is shown in the figure) a processor 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA) and a memory 104 for storing data. Optionally, the computer terminal may also include a transmission device 106 for communication functions and an input and output device 108. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above-mentioned computer terminal. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations are shown.

[0018] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / modules corresponding to the edge real-time monitoring and abnormal behavior analysis method based on the deep learning large model in the embodiment of the present application. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, that is, implementing the above method. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories can be connected to the computer terminal via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0019] The transmission device 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of a computer terminal. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0020] See also Figure 2 , an embodiment of the present invention provides a method for edge real-time monitoring and abnormal behavior analysis based on a deep learning big model, which may include the following steps: S201, real-time monitoring and collection of a multi-dimensional behavior data set of an edge device, and generating multi-modal aggregated data of the multi-dimensional behavior data set; Real-time monitoring and collection of multi-dimensional behavioral data sets of edge devices, and generation of multi-modal aggregated data of the multi-dimensional behavioral data sets, are the first step of the present invention, which aims to obtain the behavioral characteristics of edge devices in their operating environment through continuous and dynamic data collection. This process involves acquiring data from multiple sensors and data sources, including but not limited to the operating status of the device, sensor readings, network communication conditions, user interaction behaviors, etc. By using appropriate acquisition techniques, a large amount of high-dimensional data is obtained in real time, and then the data is integrated and aggregated according to specific methods to form a multi-modal data set. This multi-modal aggregated data not only integrates information from different sources, but also lays the foundation for the subsequent generation of behavioral descriptors and the training of anomaly detection models.

[0021] First, multiple data sources related to edge devices can be identified. These data sources can include sensors (such as temperature sensors, pressure sensors, etc.), network traffic monitoring, user operation records, device performance indicators, etc. It is key to ensure that real-time information can be obtained from these data sources. Leverage the power of edge computing to ensure that data can be processed and stored locally on the device. Lightweight protocols such as MQTT (Message Queuing Telemetry Transport) and CoAP (The Constrained Application Protocol) can be used to achieve efficient data transmission, and data collection agents can be introduced to establish a stable communication channel between the data source and the central processing unit. During the data collection process, the collected raw data is preprocessed as necessary, such as denoising and normalization, to improve the quality and availability of the data. This step ensures that the data is more reliable and lays a good foundation for subsequent multimodal aggregation. Use timestamps to synchronize various types of data to ensure that all collected data can be analyzed and processed in the same time dimension. This process is conducive to evaluating the behavior pattern of the device in a specific time period.

[0022] Specifically, a method for generating multimodal aggregated data of a multidimensional behavior dataset may be: This formula is used to generate multimodal aggregated data of edge device multidimensional behavior datasets, effectively integrating data from multiple different sources to form a unified and representative dataset. The aggregation process not only provides a multi-angle view of behavior, but also improves the accuracy of subsequent analysis.

[0023] Among them, the It is multimodal aggregate data, which will gather data features from different sources and become the basis for subsequent behavior descriptor generation. is the weight of the kth data point. By setting the weight, the importance of certain data points can be emphasized during the aggregation process, so that the output multimodal data can more accurately reflect the actual situation. This plays an important role in the reliability and integrity of the data. is the weight of the jth data point. This parameter is used together with W_k to ensure that the relative importance of all data points is taken into account when calculating the aggregate data. By normalizing the weights, it is ensured that the contribution of all data points is within a reasonable range. The multimodal aggregation process needs to rely on these original data to form a higher-level representation through their integration. is the number of data points.

[0024] Through real-time monitoring and the generation of multimodal aggregated data, the complex behavior patterns of edge devices can be effectively captured, solving the problem of insufficient information caused by a single data source. The core significance of this process is that it provides a rich and comprehensive behavioral background for subsequent anomaly detection, allowing the model to accurately learn and understand the characteristics of normal behavior. At the same time, real-time data collection can promptly detect potential abnormal behaviors and improve the system's ability to respond to emergencies, thereby playing an important role in security protection, fault warning, etc. In addition, building a multimodal data set provides a rich data foundation for deep learning models, which helps to improve the accuracy and robustness of the model.

[0025] S202, generating a behavior descriptor for each data point in the multi-dimensional behavior data set according to the multimodal aggregated data, wherein the behavior descriptor is a low-dimensional latent space representation; Generating a behavior descriptor for each data point based on multimodal aggregated data is one of the key steps of the present invention. This process involves using the features of the aggregated data to represent the behavior of the edge device in a low-dimensional manner. Specifically, by applying the autoencoder in deep learning technology, the high-dimensional multimodal aggregated data is compressed into a low-dimensional latent space. The autoencoder consists of two parts, an encoder and a decoder. The encoder is responsible for mapping the input high-dimensional data to a low-dimensional latent space, while the decoder is used to reconstruct the original data from the latent representation. By learning the most representative features in the data, the autoencoder can effectively extract the key features of the behavior, thereby generating a behavior descriptor for each data point.

[0026] Specifically, a method for generating a behavior descriptor may be: This formula is used to generate the behavioral descriptor of the kth data point, and the multimodal aggregate data is mapped to a low-dimensional latent space through the autoencoder function, and a noise term is added to enhance the robustness of the model. This mapping process allows complex high-dimensional input data to be effectively represented as low-dimensional behavioral features, which is helpful for subsequent anomaly detection and behavioral analysis.

[0027] Among them, the is the behavioral descriptor of the kth data point, which is a low-dimensional representation obtained by summarizing the behavioral characteristics of the data point in the multimodal aggregate data. It can intuitively reflect the state and operation characteristics of the device and provide a basis for subsequent analysis. is the autoencoder function, which is the core part of encoding multimodal aggregate data. The autoencoder learns the features of the input data, compresses it into a low-dimensional space and extracts key feature information, thereby achieving an effective conversion of high-dimensional data to low-dimensional representation. The autoencoder can capture the nonlinear structure and complex patterns in the data, so that the obtained behavior descriptor can highly summarize the behavior characteristics of the device. The purpose of adding noise is to improve the robustness of the model so that the generated behavior descriptor remains insensitive to small perturbations in the data. This can effectively prevent the model from overfitting, allowing it to perform well when encountering new inputs. In addition, the noise term can also help the model better learn the potential distribution of the data, thereby improving the generalization ability of the behavior descriptor. Among them, , E is an encoder, g is a decoder, and the noise term can be generated by random noise distribution, which can be achieved by the existing technology and will not be described in detail in the present invention.

[0028] Generating low-dimensional latent space representation of behavioral descriptors is of great significance. First, low-dimensional representation can effectively reduce computational complexity, making subsequent anomaly detection and analysis processes more efficient. In edge devices, real-time monitoring and data processing have very high resource requirements. The use of low-dimensional behavioral descriptors can significantly reduce memory usage and computational burden. Secondly, behavioral descriptors concentrate on the core behavioral characteristics of edge devices, which makes it easier for anomaly detection models to identify deviations from normal behavior and improve the accuracy and flexibility of anomaly detection. In addition, low-dimensional latent space representation helps the model to generalize better and reduce the risk of overfitting, thereby improving the performance of the model on unseen data. Finally, low-dimensional behavioral descriptors provide simplified data input for subsequent similarity calculations and anomaly scoring, facilitating the implementation of efficient real-time monitoring and response mechanisms.

[0029] S203, calculating a behavior similarity index based on the behavior descriptor to evaluate the similarity between the current behavior corresponding to each data point and the normal behavior; The purpose of this step is to evaluate the similarity between the current behavior and the normal behavior of each data point by comparing the behavior descriptor of the current data point with its corresponding normal behavior data descriptor. This process is achieved by calculating the Euclidean distance between the two behavior descriptors. The smaller the value, the higher the similarity between the current behavior and the normal behavior. Finally, the exponential function is used to convert the distance value into a similarity index, so that the range of the similarity index is between (0,1), which is convenient for subsequent analysis.

[0030] Specifically, a calculation formula for a behavior similarity index may be: This formula is used to calculate the behavioral similarity index BSI_k of the kth data point. It provides an easy-to-interpret similarity index by quantifying the difference between the current behavioral descriptor BD_k and the normal behavioral descriptor BD_{k_norm} as the Euclidean distance and mapping the distance value to the range of (0, 1) using an exponential function.

[0031] Among them, the is the behavior similarity index of the kth data point. The higher its value, the higher the similarity between the current behavior and the normal behavior. On the contrary, the lower the value, the greater the deviation between the current behavior and the normal behavior. This indicator plays a core role in abnormal behavior detection. is the behavior descriptor of the normal behavior data corresponding to the kth data point. It is a feature representation extracted from the normal behavior sample and serves as a benchmark for comparison to help determine the normality of the current behavior. for: and The Euclidean distance between .

[0032] The role of calculating the behavior similarity index is multifaceted. First, it provides a quantitative reference for anomaly detection. By evaluating the similarity between the current behavior and the normal behavior, the system can more clearly lock in potential abnormal behavior. When the behavior similarity index is lower than a preset threshold, it can clearly indicate that the behavior of the data point deviates from the normal range, thereby identifying abnormal behavior. Secondly, the behavior similarity index provides an important input for subsequent anomaly scoring. Combined with the anomaly prediction score, the degree of abnormality of each data point is evaluated to form a comprehensive risk assessment system. Finally, the calculation of the behavior similarity index allows horizontal comparison of different data points, helping to identify devices or behaviors that behave abnormally within a monitoring cycle, providing a scientific basis for maintenance and management, and further improving the security and stability of edge devices.

[0033] S204, predicting a predicted anomaly score for each data point using a pre-trained deep learning-based anomaly score prediction model according to the multi-dimensional behavior data set; By feeding the model with a multidimensional behavioral dataset, we can get an anomaly score for each data point in its current state. The model analyzes the differences between the current behavioral descriptors and historical normal behaviors based on the behavioral patterns and features learned during training, thereby quantifying these differences. In this way, behaviors that do not conform to normal patterns can be efficiently and accurately identified, providing an effective method for anomaly detection.

[0034] Specifically, first collect and organize a multidimensional behavioral data set. The data set should contain enough samples to cover both normal and abnormal behaviors to ensure the training effect of the model. At this stage, data preprocessing is also particularly important, including data cleaning, normalization, missing value processing, etc., to improve the quality of subsequent model training.

[0035] Choose an appropriate deep learning model, which can be a multi-layer perceptron (MLP), convolutional neural network (CNN) or recurrent neural network (RNN) based on neural networks. The specific choice should be based on the characteristics of the data and the application scenario. In addition to selecting the model, it is also necessary to design the network architecture of the model, including the settings of the input layer, hidden layer and output layer, to ensure that it can effectively learn and capture the potential patterns in the data.

[0036] After the model is designed, it is necessary to train the model using labeled training data (usually including samples of normal and abnormal behavior). During the training process, by defining a loss function (such as mean square error or cross entropy loss), the model parameters are optimized so that the model's predictive ability is gradually enhanced. The training process usually requires multiple iterations, and by monitoring the convergence of the loss function, hyperparameters such as the learning rate and batch size are adjusted to achieve the best model performance.

[0037] After training is complete, use an independent validation set to evaluate the model. By calculating the accuracy, recall, F1 score and other indicators of the model on the validation set, we can judge its effectiveness and reliability in practical applications. If the model performance does not meet the requirements, it may be necessary to adjust the model architecture or retrain.

[0038] Once the model is trained and successfully verified, it can be applied to real-time monitoring. For each newly collected multi-dimensional behavior data point, the data is input into the pre-trained anomaly score prediction model. The model will quickly output the predicted anomaly score of the data point based on its learned features.

[0039] This step plays an important role in the entire anomaly detection process. First, by using a deep learning model, the system can learn based on a large amount of historical data, thereby automatically extracting complex feature representations and reducing the need to manually set features. This adaptive learning ability enables the model to provide accurate anomaly scores when faced with new and unseen behavior data. Secondly, the predicted anomaly score provides a quantitative basis for subsequent abnormal behavior judgments. When the anomaly score exceeds the set threshold, it can promptly identify and locate potential risk behaviors and improve the safety of edge devices. In addition, the application of this prediction model in the monitoring system can realize real-time data processing and promptly reflect the abnormal status of the equipment, which helps maintenance personnel respond quickly and prevent potential failures from causing greater losses.

[0040] S205 , evaluating the abnormality level of each data point according to the abnormality prediction score and the behavior similarity index, and determining the abnormal behavior data point according to the abnormality level.

[0041] In the method of the present invention, the degree of abnormality of each data point is evaluated based on the abnormal prediction score and the behavior similarity index, which is a comprehensive method. Specifically, while the abnormality score (from the deep learning model) directly reflects the degree of deviation of the data point, the behavior similarity index provides a relative comparison with normal behavior. Combining the two, a more comprehensive abnormality score can be obtained. In this way, it is possible to accurately identify which data points have significant abnormal characteristics in their behavior, further determine their degree of abnormality, and then dynamically classify these data points as "abnormal" or "normal".

[0042] This step is particularly important in the anomaly detection process. On the one hand, it combines two complementary indicators to enhance the reliability of anomaly detection. In some cases, relying solely on one indicator may lead to false positives or false negatives. By combining the anomaly prediction score and the behavior similarity index, these risks can be reduced and the accuracy of detection can be improved. On the other hand, this comprehensive evaluation mechanism can effectively support real-time monitoring, quickly discover and feedback whether there are potential safety hazards in the equipment, and help operation and maintenance personnel take targeted measures in a timely manner, thereby ensuring the health and safety of edge devices.

[0043] Specifically, the final anomaly score of each data point may be calculated according to the anomaly prediction score and the behavior similarity index as the degree of anomaly of each data point, wherein the final anomaly score is: This formula is used to calculate the final anomaly score AS_k for the kth data point. By combining the information in the behavior similarity index and the anomaly prediction score, a comprehensive anomaly score is constructed, making the resulting score more representative and discriminatory.

[0044] Among them, the is the final anomaly score of the kth data point, is the predicted anomaly score of the kth data point, which gives an anomaly metric independent of the similarity evaluation and can reflect the abnormal characteristics of the data point itself. is the mean of the normal behavior data corresponding to each data point, which is used to measure whether the performance of the current data point deviates from the normal state. The standard deviation of the normal behavior data corresponding to each data point provides a standardized perspective for abnormal scoring. The standard deviation reflects the degree of fluctuation of normal behavior data and can standardize the degree of deviation of the current data score so that the result is not affected by outliers.

[0045] Specifically, according to the final anomaly score of each data point, if the final anomaly score is greater than a preset threshold, the data point corresponding to the final anomaly score is determined as an abnormal behavior data point, otherwise it is a normal behavior data point.

[0046] If the anomaly score of a data point is higher than the threshold, the data point is judged as abnormal behavior; otherwise, it is considered normal behavior. The setting of this threshold is usually based on historical data analysis and experience, which can effectively distinguish between normal and abnormal phenomena. In this way, the system can automatically process real-time monitoring data and promptly feedback abnormal behavior to operation and maintenance personnel to ensure rapid response to potential problems.

[0047] By introducing threshold judgment, the system can effectively distinguish between normal and abnormal behaviors, thereby achieving more efficient anomaly detection. Secondly, the dynamic calculation of anomaly scores and the application of thresholds make the system adaptive and can be updated over time and with changes in data characteristics, improving the flexibility and intelligence of the system. In addition, this threshold mechanism can also be continuously optimized through historical data to improve the accuracy of anomaly detection, reduce false alarm rates, and improve the operating efficiency of the system, thereby playing a more active role in the real-time monitoring and management of edge devices.

[0048] It can be seen that the multidimensional behavior data set of the edge device is monitored and collected in real time, and multimodal aggregated data of the multidimensional behavior data set is generated; based on the multimodal aggregated data, a behavior descriptor for each data point in the multidimensional behavior data set is generated; based on the behavior descriptor, the behavior similarity index is calculated to evaluate the similarity between the current behavior corresponding to each data point and the normal behavior; based on the multidimensional behavior data set, a pre-trained deep learning-based anomaly scoring prediction model is used to predict the predicted anomaly score of each data point; based on the anomaly prediction score and the behavior similarity index, the degree of abnormality of each data point is evaluated, and the abnormal behavior data point is determined according to the degree of abnormality, so as to provide a reliable basis for the identification and response of abnormal behaviors by combining deep learning technology and multimodal data analysis, and realize comprehensive monitoring and intelligent analysis of edge devices.

[0049] Another embodiment of the present invention provides a real-time edge monitoring and abnormal behavior analysis system based on a deep learning big model, see Figure 3 , the system may include: A monitoring module 301 is used to monitor and collect multi-dimensional behavior data sets of edge devices in real time, and generate multi-modal aggregated data of the multi-dimensional behavior data sets; A generating module 302, configured to generate a behavior descriptor for each data point in the multi-dimensional behavior data set according to the multi-modal aggregated data, wherein the behavior descriptor is a low-dimensional latent space representation; A calculation module 303, configured to calculate a behavior similarity index based on the behavior descriptor to evaluate the similarity between the current behavior corresponding to each data point and the normal behavior; A prediction module 304 is used to predict a predicted anomaly score for each data point based on the multi-dimensional behavior data set using a pre-trained deep learning-based anomaly score prediction model; The evaluation module 305 is used to evaluate the abnormality degree of each data point according to the abnormal prediction score and the behavior similarity index, and determine the abnormal behavior data point according to the abnormality degree.

[0050] It can be seen that the multidimensional behavior data set of the edge device is monitored and collected in real time, and multimodal aggregated data of the multidimensional behavior data set is generated; based on the multimodal aggregated data, a behavior descriptor for each data point in the multidimensional behavior data set is generated; based on the behavior descriptor, the behavior similarity index is calculated to evaluate the similarity between the current behavior corresponding to each data point and the normal behavior; based on the multidimensional behavior data set, a pre-trained deep learning-based anomaly scoring prediction model is used to predict the predicted anomaly score of each data point; based on the anomaly prediction score and the behavior similarity index, the degree of abnormality of each data point is evaluated, and the abnormal behavior data point is determined according to the degree of abnormality, so as to provide a reliable basis for the identification and response of abnormal behaviors by combining deep learning technology and multimodal data analysis, and realize comprehensive monitoring and intelligent analysis of edge devices.

[0051] An embodiment of the present invention further provides a storage medium, in which a computer program is stored, wherein the computer program is configured to execute the steps of any of the above method embodiments when running.

[0052] Specifically, in this embodiment, the above storage medium may be configured to store a computer program for performing the following steps: S201, real-time monitoring and collection of a multi-dimensional behavior data set of an edge device, and generating multi-modal aggregated data of the multi-dimensional behavior data set; S202, generating a behavior descriptor for each data point in the multi-dimensional behavior data set according to the multimodal aggregated data, wherein the behavior descriptor is a low-dimensional latent space representation; S203, calculating a behavior similarity index based on the behavior descriptor to evaluate the similarity between the current behavior corresponding to each data point and the normal behavior; S204, predicting a predicted anomaly score for each data point using a pre-trained deep learning-based anomaly score prediction model according to the multi-dimensional behavior data set; S205 , evaluating the abnormality level of each data point according to the abnormality prediction score and the behavior similarity index, and determining the abnormal behavior data point according to the abnormality level.

[0053] It can be seen that the multidimensional behavior data set of the edge device is monitored and collected in real time, and multimodal aggregated data of the multidimensional behavior data set is generated; based on the multimodal aggregated data, a behavior descriptor for each data point in the multidimensional behavior data set is generated; based on the behavior descriptor, the behavior similarity index is calculated to evaluate the similarity between the current behavior corresponding to each data point and the normal behavior; based on the multidimensional behavior data set, a pre-trained deep learning-based anomaly scoring prediction model is used to predict the predicted anomaly score of each data point; based on the anomaly prediction score and the behavior similarity index, the degree of abnormality of each data point is evaluated, and the abnormal behavior data point is determined according to the degree of abnormality, so as to provide a reliable basis for the identification and response of abnormal behaviors by combining deep learning technology and multimodal data analysis, and realize comprehensive monitoring and intelligent analysis of edge devices.

[0054] An embodiment of the present invention further provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

[0055] Specifically, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor, and the input / output device is connected to the processor.

[0056] Specifically, in this embodiment, the processor may be configured to perform the following steps through a computer program: S201, real-time monitoring and collection of a multi-dimensional behavior data set of an edge device, and generating multi-modal aggregated data of the multi-dimensional behavior data set; S202, generating a behavior descriptor for each data point in the multi-dimensional behavior data set according to the multimodal aggregated data, wherein the behavior descriptor is a low-dimensional latent space representation; S203, calculating a behavior similarity index based on the behavior descriptor to evaluate the similarity between the current behavior corresponding to each data point and the normal behavior; S204, predicting a predicted anomaly score for each data point using a pre-trained deep learning-based anomaly score prediction model according to the multi-dimensional behavior data set; S205 , evaluating the abnormality level of each data point according to the abnormality prediction score and the behavior similarity index, and determining the abnormal behavior data point according to the abnormality level.

[0057] It can be seen that the multidimensional behavior data set of the edge device is monitored and collected in real time, and multimodal aggregated data of the multidimensional behavior data set is generated; based on the multimodal aggregated data, a behavior descriptor for each data point in the multidimensional behavior data set is generated; based on the behavior descriptor, the behavior similarity index is calculated to evaluate the similarity between the current behavior corresponding to each data point and the normal behavior; based on the multidimensional behavior data set, a pre-trained deep learning-based anomaly scoring prediction model is used to predict the predicted anomaly score of each data point; based on the anomaly prediction score and the behavior similarity index, the degree of abnormality of each data point is evaluated, and the abnormal behavior data point is determined according to the degree of abnormality, so as to provide a reliable basis for the identification and response of abnormal behaviors by combining deep learning technology and multimodal data analysis, and realize comprehensive monitoring and intelligent analysis of edge devices.

[0058] The above describes in detail the structure, features and effects of the present invention based on the embodiments shown in the drawings. The above is only a preferred embodiment of the present invention, but the present invention is not limited to the scope of implementation shown in the drawings. Any changes made according to the concept of the present invention, or modifications to equivalent embodiments with equivalent changes, which still do not exceed the spirit covered by the description and drawings, should be within the protection scope of the present invention.

Claims

1. A method for real-time edge monitoring and abnormal behavior analysis based on a deep learning big model, characterized in that: The method comprises: Monitor and collect multi-dimensional behavior data sets of edge devices in real time, and generate multi-modal aggregated data of the multi-dimensional behavior data sets; generating a behavior descriptor for each data point in the multi-dimensional behavior data set according to the multi-modal aggregated data, wherein the behavior descriptor is a low-dimensional latent space representation; Calculating a behavior similarity index based on the behavior descriptor to evaluate the similarity between the current behavior corresponding to each data point and the normal behavior; According to the multidimensional behavior dataset, using a pre-trained deep learning-based anomaly score prediction model, predicting a predicted anomaly score for each data point; According to the abnormal prediction score and the behavior similarity index, the abnormality degree of each data point is evaluated, and the abnormal behavior data point is determined according to the abnormality degree.

2. The method according to claim 1, characterized in that: The multimodal aggregated data of the multidimensional behavior dataset is generated in the following manner: Among them, the For multimodal aggregate data, is the weight of the kth data point, is the weight of the jth data point, is the data of the kth data point, is the number of data points.

3. The method according to claim 2, characterized in that The behavior descriptor is generated as follows: Among them, the is the behavioral descriptor of the kth data point, is the autoencoder function, is the noise term.

4. The method according to claim 3, characterized in that The calculation formula of the behavior similarity index is: Among them, the is the behavior similarity index of the kth data point, is the behavior descriptor of the normal behavior data corresponding to the kth data point, for and The Euclidean distance between .

5. The method according to claim 4, characterized in that The step of evaluating the abnormality degree of each data point according to the abnormal prediction score and the behavior similarity index includes: According to the abnormal prediction score and the behavior similarity index, a final abnormal score of each data point is calculated as the abnormal degree of each data point, wherein the final abnormal score is: Among them, the is the final anomaly score of the kth data point, is the predicted anomaly score for the kth data point, is the mean of the normal behavior data corresponding to each data point, is the standard deviation of the normal behavior data corresponding to each data point.

6. The method according to claim 5, characterized in that Determining the abnormal behavior data point according to the abnormality degree includes: According to the final anomaly score of each data point, if the final anomaly score is greater than a preset threshold, the data point corresponding to the final anomaly score is determined as an abnormal behavior data point, otherwise it is a normal behavior data point.

7. A real-time edge monitoring and abnormal behavior analysis system based on a deep learning big model, characterized in that: The system comprises: A monitoring module, used to monitor and collect multi-dimensional behavior data sets of edge devices in real time, and generate multi-modal aggregated data of the multi-dimensional behavior data sets; A generating module, configured to generate a behavior descriptor for each data point in the multi-dimensional behavior data set according to the multi-modal aggregated data, wherein the behavior descriptor is a low-dimensional latent space representation; A calculation module, used for calculating a behavior similarity index based on the behavior descriptor to evaluate the similarity between the current behavior corresponding to each data point and the normal behavior; A prediction module, configured to predict a predicted anomaly score for each data point based on the multidimensional behavior dataset using a pre-trained deep learning-based anomaly score prediction model; An evaluation module is used to evaluate the abnormality degree of each data point according to the abnormal prediction score and the behavior similarity index, and determine the abnormal behavior data point according to the abnormality degree.

8. The system according to claim 7, characterized in that The multimodal aggregated data of the multidimensional behavior dataset is generated in the following manner: Among them, the For multimodal aggregate data, is the weight of the kth data point, is the weight of the jth data point, is the data of the kth data point, is the number of data points.

9. A storage medium, characterized in that: The storage medium stores a computer program, wherein the computer program is configured to execute the method according to any one of claims 1 to 6 when executed.

10. An electronic device comprising a memory and a processor, characterized in that: A computer program is stored in the memory, and the processor is configured to run the computer program to perform the method according to any one of claims 1 to 6.

Images