Elevator data management system and method based on Internet of Things

Abstract

The invention provides an elevator data management system and method based on the Internet of Things, and relates to the field of safety management of the Internet of Things, operation data of an elevator is packaged into a network transmission data packet, and the abnormal verification degree of the network transmission data packet is determined; the method comprises the following steps: extracting network transmission characteristics of a control instruction from a bidirectional communication data packet of an elevator and an Internet of Things control system, constructing a communication compliance model of the control instruction, and then determining an automatic blocking constraint condition of the control instruction; when it is detected that the transmission abnormality level of the network transmission data packet exceeds a preset communication security threshold, determining a security traceability incidence matrix of the network transmission data packet based on the automatic blocking constraint condition and the abnormality verification degree; and then link tracing is carried out on the communication log of the Internet of Things equipment to obtain a link tracing identifier of the communication log, and the link tracing identifier is stored in a security event database. According to the invention, full-link traceability of elevator data in a network transmission process can be realized.

Description

Technical Field

[0001] This application relates to the field of Internet of Things (IoT) security management, and more specifically, to an IoT-based elevator data management system and method. Background Technology

[0002] IoT security management is a systematic project to ensure the security of IoT devices, networks, data, and applications throughout their entire lifecycle. It covers the entire process of control, from device access authentication, communication encryption, and data privacy protection to vulnerability monitoring, risk warning, and emergency response. It prevents unauthorized access by establishing a trusted identity mechanism, ensures data transmission and storage security by using encryption technology, monitors abnormal network behavior in real time by relying on a situational awareness platform, and combines regular vulnerability scanning, firmware security hardening, and compliance audits to resist risks such as malicious attacks, data leaks, and device hijacking. Ultimately, it achieves trusted interconnection and stable operation of "people-devices-data-applications" in the IoT ecosystem, building a solid security defense for smart homes, industrial internet, smart cities, and other scenarios.

[0003] With the deep penetration of IoT technology into the elevator operation and maintenance field, the end-to-end transmission of elevator operation data through IoT sensors, edge gateways, and cloud platforms has become the core support for intelligent management. However, as special equipment, elevators face challenges in data transmission, such as complex network environments (multi-link cross-transmission), numerous device nodes (multi-device collaboration such as sensors, controllers, and gateways), and hidden security risks (e.g., data packet tampering, unauthorized access, and transmission anomalies). Currently, traditional data traceability methods mostly rely on single-node log records, making it difficult to associate multi-dimensional data such as device identifiers, timestamps, and operating condition information in the transmission link. This makes it impossible to accurately locate the root cause of the anomaly and trace the complete transmission path when abnormal transmission events (e.g., malicious command injection or data loss) occur. It is also difficult to clarify different causes such as equipment failure, network attacks, or human error. Therefore, how to achieve end-to-end traceability of elevator data during network transmission has become a difficult problem for the industry. Summary of the Invention

[0004] This application provides an elevator data management system and method based on the Internet of Things, which can realize full-link traceability of elevator data during network transmission.

[0005] In a first aspect, this application provides an elevator data management method based on the Internet of Things, comprising the following steps:

[0006] The elevator's operating data is collected by IoT devices, encapsulated into network transmission data packets, and transmitted to the IoT security management center.

[0007] During data transmission, the network data packets are subjected to transmission anomaly detection to obtain the anomaly check value of the network data packets during data transmission.

[0008] The network transmission characteristics of control commands are extracted from the bidirectional communication data packets between the elevator and the Internet of Things control system. Based on the network transmission characteristics and elevator operating condition information, a communication compliance model for control commands is constructed. Based on the communication compliance model, automatic blocking constraints for control commands in network transmission are determined.

[0009] When the abnormal transmission level of the network data packet is detected to exceed the preset communication security threshold, the security tracing association matrix of the network data packet is determined based on the automatic blocking constraint and the abnormality verification degree, and a blocking command is sent to the IoT communication gateway to interrupt the data packet transmission of the abnormal communication link.

[0010] The communication logs of IoT devices are traced using the security tracing association matrix to obtain the link tracing identifier of the communication logs, and the link tracing identifier is stored in the security event database.

[0011] In this embodiment, the process of detecting transmission anomalies in the network data packets to obtain the anomaly checksum of the network data packets during data transmission specifically includes:

[0012] The transmission time sequence of the network data packets is analyzed to obtain the arrival interval time sequence and transmission rate fluctuation characteristics of the network data packets;

[0013] The timing deviation and rate anomaly coefficient of the network transmitted data packets are calculated based on the arrival interval time sequence and the transmission rate fluctuation characteristics.

[0014] The anomaly check degree of the network transmitted data packet in data transmission is determined by the timing deviation and the rate anomaly coefficient.

[0015] In this embodiment, extracting the network transmission characteristics of control commands from the bidirectional communication data packets between the elevator and the IoT control system specifically includes:

[0016] The protocol fields in the bidirectional communication data packets are parsed to extract the transmission frequency and response time delay of the control commands;

[0017] The behavioral feature vector of the control command is determined based on the number of times the control command is triggered per unit time, the frequency of the control command being sent, and the response time delay.

[0018] The behavioral feature vector is then used as the network transmission feature of control commands.

[0019] In this embodiment, the communication compliance model for constructing control commands based on the network transmission characteristics and elevator operating condition information specifically includes:

[0020] The system acquires real-time load, operating speed, and fault alarm status from elevator operating condition information, and then constructs an operating condition status matrix.

[0021] A communication compliance model for control commands is constructed based on the network transmission characteristics and the operating condition matrix.

[0022] In this embodiment, the automatic blocking constraints for control commands in network transmission based on the communication compliance model specifically include:

[0023] The risk level of the control command is determined by the compliance score output by the communication compliance model, and the corresponding blocking priority is set.

[0024] Generate blocking rule templates based on the protocol characteristics of control commands;

[0025] The automatic blocking constraints for control commands in network transmission are determined by the blocking rule template, the risk level of the control command, and the corresponding blocking priority.

[0026] In this embodiment, determining the security tracing correlation matrix of the network transmission data packets based on the automatic blocking constraint and the anomaly check value specifically includes:

[0027] Parse the abnormal path node information from the network transmission data packets;

[0028] The automatic blocking constraints are associated and matched with the path node information to obtain a node-rule mapping table;

[0029] The security tracing association matrix of the network transmission data packets is constructed based on the node-rule mapping relationship table and the anomaly verification degree.

[0030] In this embodiment, the link tracing of communication logs of IoT devices through the security tracing association matrix to obtain the link tracing identifier of the communication logs specifically includes:

[0031] The transmission path and different jump nodes of abnormal data packets are located based on the security tracing correlation matrix.

[0032] The communication logs of the IoT devices corresponding to the transmission path are retrieved from the IoT communication gateway, and then the session identifier of the communication logs is extracted.

[0033] The risk anomaly matching degree of the communication log is obtained by matching the session identifier with the characteristics of historical abnormal events in the security event database.

[0034] The risk propagation path is determined by the risk anomaly matching degree and all transition nodes;

[0035] Link tracing identifiers are generated from communication logs based on the risk diffusion path.

[0036] In this embodiment, the Internet of Things (IoT) device refers to an intelligent terminal device that embeds sensors, processors, communication modules, and software programs and is capable of interacting with the IoT control system.

[0037] In this embodiment, the IoT security management center refers to the core hub in the elevator IoT system that centrally manages device identities, encrypts data transmission, verifies control commands, and handles anomalies, thereby ensuring the reliability of elevator operation data and the security of remote monitoring.

[0038] Secondly, this application provides an elevator data management system based on the Internet of Things (IoT), used to execute an elevator data management method based on the IoT, the elevator data management system comprising:

[0039] The data acquisition module is used to collect elevator operation data through IoT devices, encapsulate the operation data into network transmission data packets, and transmit them to the IoT security management center.

[0040] The feature processing module is used to detect transmission anomalies in the network data packets during data transmission and obtain the anomaly check value of the network data packets during data transmission.

[0041] The feature processing module is also used to extract network transmission features of control commands from the bidirectional communication data packets between the elevator and the Internet of Things control system, construct a communication compliance model of control commands based on the network transmission features and elevator operating condition information, and determine automatic blocking constraints of control commands in network transmission based on the communication compliance model.

[0042] The feature processing module is also used to determine the security tracing association matrix of the network transmission data packet based on the automatic blocking constraint and the anomaly verification degree when the abnormal transmission level of the network transmission data packet is detected to exceed the preset communication security threshold, and to send a blocking command to the Internet of Things communication gateway to interrupt the data packet transmission of the abnormal communication link.

[0043] The traceability module is used to trace the communication logs of IoT devices through the security traceability association matrix, obtain the traceability identifier of the communication logs, and store the traceability identifier in the security event database.

[0044] The technical solutions provided by the embodiments disclosed in this application have the following beneficial effects:

[0045] First, elevator operation data is collected via IoT devices, encapsulated into network transmission data packets, and transmitted to the IoT security management center. During data transmission, transmission anomaly detection is performed on the network transmission data packets to obtain the anomaly checksum. Network transmission characteristics of control commands are extracted from the bidirectional communication data packets between the elevator and the IoT control system. Based on these network transmission characteristics and elevator operating condition information, a communication compliance model for the control commands is constructed. Automatic blocking constraints for control commands in network transmission are determined based on this communication compliance model. When the anomaly level of the network transmission data packets exceeds a preset communication security threshold, a security tracing association matrix for the network transmission data packets is determined based on the automatic blocking constraints and the anomaly checksum. A blocking command is then sent to the IoT communication gateway to interrupt the data packet transmission of the abnormal communication link. The communication logs of the IoT devices are traced using the security tracing association matrix to obtain the link tracing identifier for the communication logs, and this identifier is stored in the security event database.

[0046] Therefore, this application uses the security tracing association matrix to trace the communication logs of IoT devices, obtains the link tracing identifier of the communication logs, and stores the link tracing identifier in the security event database. First, it collects elevator operation data in real time through IoT devices and encapsulates it into network transmission data packets, establishing a standardized transmission path from the edge to the cloud, laying the foundation for subsequent anomaly identification and tracking. Second, it introduces an anomaly verification evaluation mechanism during data transmission, which can dynamically detect and quantify integrity anomalies and security deviations of data packets during transmission, effectively identifying hidden risks such as tampering, packet loss, and command forgery. This anomaly evaluation not only breaks through the limitations of traditional static detection relying on node logs but also provides real-time perception basis for accurate tracing. Furthermore, by extracting the network transmission characteristics of control commands from bidirectional communication data, and... By combining elevator operating conditions, a communication compliance model for control commands is constructed, enabling dynamic judgment of the legality of transmitted content and enhancing the ability to identify malicious injection or misoperation commands. Based on this, automatic blocking constraints are designed. When the abnormal level of data transmission is detected to exceed the preset security threshold, the communication gateway can be immediately linked to block the command and cut off the suspicious communication link, curbing the spread and abuse of abnormal data from the source. By constructing a security traceability association matrix and integrating multi-source heterogeneous information such as device identification, timestamp, transmission path, and operating status, deep association and analysis from single logs to multi-dimensional link information are achieved. This provides structured support for full-link visualization and traceability of elevator data in the Internet of Things transmission process. Finally, the system stores the traced link identifiers in the security event database, forming standardized security data that can be used for subsequent accountability, cause tracing, and situational awareness.

[0047] In summary, the proposed solution enables end-to-end traceability of elevator data during network transmission. Attached Figure Description

[0048] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only for this embodiment of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0049] Figure 1 This is a flowchart of the elevator data management method based on the Internet of Things provided in this application;

[0050] Figure 2 This is an exemplary flowchart for determining the anomaly verification degree provided in this application;

[0051] Figure 3 This is an exemplary flowchart for determining automatic blocking constraints provided in this application;

[0052] Figure 4 This is a module structure diagram of the IoT-based elevator data management system provided in this application. Detailed Implementation

[0053] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0054] This application provides an elevator data management system and method based on the Internet of Things (IoT). The core of the system involves collecting elevator operation data through IoT devices, encapsulating this data into network transmission data packets, and transmitting them to an IoT security management center. During data transmission, anomaly detection is performed on the network transmission data packets to obtain anomaly verification scores. Network transmission characteristics of control commands are extracted from the bidirectional communication data packets between the elevator and the IoT control system. A communication compliance model for the control commands is constructed based on these network transmission characteristics and elevator operating condition information. Automatic blocking constraints for control commands in network transmission are determined based on this communication compliance model. When the anomaly level of the network transmission data packets exceeds a preset communication security threshold, a security tracing association matrix for the network transmission data packets is determined based on the automatic blocking constraints and the anomaly verification scores. A blocking command is then sent to the IoT communication gateway to interrupt the data packet transmission of the abnormal communication link. The communication logs of the IoT devices are traced using the security tracing association matrix to obtain the link tracing identifier for the communication logs, and this identifier is stored in a security event database. This application enables full-link tracing of elevator data during network transmission.

[0055] Example 1: To better understand the above technical solution, the following will provide a detailed description of the technical solution in conjunction with the accompanying drawings and specific implementation methods. (Refer to...) Figure 1 As shown in the figure, this is an exemplary flowchart of an IoT-based elevator data management method according to this embodiment of the present application. The IoT-based elevator data management method includes the following steps:

[0056] In step S1, elevator operation data is collected through IoT devices, the operation data is encapsulated into network transmission data packets, and transmitted to the IoT security management center.

[0057] It should be noted that the IoT device mentioned in this application refers to an intelligent terminal device that is embedded with sensors, processors, communication modules and software programs and can interact with the IoT control system; the IoT security management center refers to the core hub in the elevator IoT system that centrally manages device identity, encrypts data transmission, verifies control commands and handles anomalies, and ensures the reliability of elevator operation data and the security of remote monitoring.

[0058] It should also be noted that managing elevator data during network transmission is crucial for building a robust data security defense. Elevator data contains equipment control commands (such as door opening / closing and start / stop signals) and sensitive operating parameters. If eavesdropping, tampering, or forgery occurs during transmission, it may lead to command failure, data distortion, or even safety accidents such as elevator malfunctions. Through transmission management (such as encrypted communication, anomaly verification, and identity authentication), unauthorized access and data leakage can be prevented, ensuring that data packets arrive at the management center intact and reliably. At the same time, anomaly monitoring during transmission can promptly detect malicious attacks (such as data packet replay and link hijacking), preventing the spread of attacks by blocking risky links, and providing reliable data transmission guarantees for remote elevator monitoring and intelligent operation and maintenance.

[0059] In step S2, during data transmission, the network data packets are subjected to transmission anomaly detection to obtain the anomaly check value of the network data packets during data transmission.

[0060] In this embodiment, reference Figure 2 As shown, this diagram is an exemplary flowchart for determining the anomaly checksum in an embodiment of this application. In this embodiment, the anomaly detection of the network transmission data packet and the anomaly checksum of the network transmission data packet in data transmission can be achieved by the following steps:

[0061] In step S21, the transmission time sequence of the network transmission data packets is analyzed to obtain the arrival interval time sequence and transmission rate fluctuation characteristics of the network transmission data packets.

[0062] In step S22, the timing deviation and rate anomaly coefficient of the network transmitted data packets are calculated based on the arrival interval time sequence and the transmission rate fluctuation characteristics.

[0063] In step S23, the anomaly check degree of the network transmitted data packet in data transmission is determined by the timing deviation degree and the rate anomaly coefficient.

[0064] It should be noted that the arrival interval time series mentioned in this application represents a sequence reflecting the transmission pattern of network data packets, the transmission rate fluctuation feature represents a feature that quantifies the degree of drastic change in the transmission rate of network data packets, the time sequence deviation represents a measure of the degree of deviation between the actual transmission interval and the normal transmission interval of network data packets, the rate anomaly coefficient represents a parameter that quantifies the degree of abnormal fluctuation in the transmission rate of network data packets, and the anomaly check degree represents a check index of the degree of anomaly of network data packets during network transmission.

[0065] In specific implementation, firstly, a packet capture tool deployed on the IoT gateway (such as a dedicated parsing module based on the libpcap library) extracts the header timestamp of each network transmission packet. The arrival interval of consecutive network transmission packets (i.e., the difference between the reception time of the next packet and the reception time of the previous packet) is calculated. The sequence of all time differences is used as the arrival interval time sequence of the network transmission packets. Simultaneously, a sliding window algorithm is used to count the number of packets and the total number of bytes per unit time, calculate the transmission rate within the window, and the set of percentage differences between the rates of all adjacent windows is used as the transmission rate fluctuation characteristic of the network transmission packets. First, a Gaussian mixture model is used to fit the probability distribution of normal intervals. The deviation probability of each time difference in the arrival interval time series from the benchmark distribution is calculated, and the mean of all deviation probabilities is used as the temporal deviation of the network transmission data packet. At the same time, a benchmark range of rate fluctuation is constructed using historical normal transmission data. The exponential smoothing method is used to predict the trend of transmission rate fluctuation characteristics. The percentage of actual fluctuation values ​​exceeding the benchmark range of rate fluctuation is calculated, and this percentage is used as the rate anomaly coefficient of the network transmission data packet. Then, the product between the temporal deviation and the rate anomaly coefficient is used as the anomaly check degree of the network transmission data packet in data transmission.

[0066] In step S3, the network transmission characteristics of control commands are extracted from the bidirectional communication data packets between the elevator and the IoT control system. Based on the network transmission characteristics and the elevator operating condition information, a communication compliance model for the control commands is constructed. Based on the communication compliance model, automatic blocking constraints for control commands in network transmission are determined.

[0067] In this embodiment, extracting the network transmission characteristics of control commands from the bidirectional communication data packets between the elevator and the IoT control system can be achieved through the following steps:

[0068] The protocol fields in the bidirectional communication data packets are parsed to extract the transmission frequency and response time delay of the control commands;

[0069] The behavioral feature vector of the control command is determined based on the number of times the control command is triggered per unit time, the frequency of the control command being sent, and the response time delay.

[0070] The behavioral feature vector is then used as the network transmission feature of control commands.

[0071] It should be noted that the network transmission characteristics in this application reflect the characteristics of the control command transmission behavior pattern;

[0072] It should also be noted that the intelligent integrated system for elevator operation management created by the IoT control system described in this application realizes closed-loop management of elevator status monitoring, remote control, fault early warning and safety protection through IoT technology. The core objective is to improve the safety, reliability and operation and maintenance efficiency of elevator operation. The IoT control system deeply integrates elevator equipment, sensors, communication networks, data platforms and control logic, breaking the limitations of traditional elevator "single machine operation and manual inspection", and forming a full-link intelligent management system of "perception-transmission-analysis-decision-control".

[0073] In specific implementation, firstly, the bidirectional communication data packets are parsed using the Scapy library to extract the timestamp field from the header of the bidirectional communication data packets. The transmission frequency of control commands is calculated by parsing the timestamp field. At the same time, the difference between the transmission timestamp of the control command and the reception timestamp of the response packet of the IoT control system is used as the response time delay of the control command. Secondly, the number of times the control command is triggered per unit time is counted based on a sliding window. The number of triggers, the transmission frequency of the control command, and the response time delay are used as the original features. After eliminating the difference in dimensions using the min-max normalization method, a vector is formed, and the resulting vector is used as the behavioral feature vector of the control command.

[0074] In this embodiment, the communication compliance model for control commands, constructed based on the network transmission characteristics and elevator operating condition information, can be achieved through the following steps:

[0075] The system acquires real-time load, operating speed, and fault alarm status from elevator operating condition information, and then constructs an operating condition status matrix.

[0076] A communication compliance model for control commands is constructed based on the network transmission characteristics and the operating condition matrix.

[0077] It should be noted that the operating condition state matrix mentioned in this application represents a matrix that quantifies the operating state of the elevator at different times, and the communication compliance model represents a model for verifying the legality of control command communication.

[0078] In specific implementation, firstly, the real-time load, operating speed, and fault alarm status of the elevator at different times are obtained from the elevator operation status information. All real-time load, operating speed, and fault alarm status are aligned by timestamps and then formed into a matrix, which is used as the operation status matrix. Secondly, the network transmission characteristics of control commands at different times (i.e., the behavioral feature vector of control commands, including the normalized trigger count, sending frequency, and response time delay) are spatiotemporally correlated with the operation status matrix. That is, by accurately aligning the timestamps, the network transmission characteristics at the same time are dimensionally concatenated with the corresponding rows (real-time load, operating speed, and fault alarm status) in the operation status matrix to form a "operation status-transmission" fused feature set (e.g., [load 300kg, speed 1.0m / s, no alarm, trigger count 0.2, sending frequency 0.3, response delay 0.1], with a corresponding label of compliance score 0.8). Subsequently, the fused feature set is trained using the random forest algorithm, and the model obtained after training is used as the communication compliance model of control commands.

[0079] In this embodiment, reference Figure 3 As shown, this figure is an exemplary flowchart for determining automatic blocking constraints in an embodiment of this application. In this embodiment, determining the automatic blocking constraints for control commands in network transmission based on the communication compliance model can be achieved through the following steps:

[0080] In step S31, the risk level of the control command is determined by the compliance score of the control command output by the communication compliance model, and the corresponding blocking priority is set.

[0081] In step S32, a blocking rule template is generated based on the protocol characteristics of the control command;

[0082] In step S33, the automatic blocking constraints for control commands in network transmission are determined by the blocking rule template, the risk level of the control command, and the corresponding blocking priority.

[0083] It should be noted that the blocking priority mentioned in this application represents the urgency of handling abnormal commands, the blocking rule template represents a standardized template for matching abnormal control commands in network transmission and defining basic handling logic, and the automatic blocking constraint represents the constraint conditions for automatically blocking control commands in network communication security protection.

[0084] In specific implementation, firstly, the compliance score of the control commands is output through the communication compliance model. Risk levels are categorized based on preset thresholds (e.g., less than 0.4 for high risk, 0.4-0.7 for medium risk, and greater than 0.7 for low risk). Blocking priorities are then set according to the risk level and the importance of the command (e.g., emergency elevator stop commands have lower risk tolerance) (e.g., extremely high risk corresponds to "immediate blocking" priority, and medium risk corresponds to "blocking after alarm" priority). Secondly, a deep protocol analysis tool (e.g., a protocol analysis module based on Scapy) is used to extract the protocol features of the control commands, including the command protocol type (e.g., Modbus / TCP function code, MQTT subject field), source / destination IP address, port number, and data frame format. Key information such as the format is combined with the rule syntax of the Network Intrusion Detection System (NIDS) (e.g., the Suricata rule format) to generate a blocking rule template. Then, the matching threshold in the blocking rule template is adjusted based on the risk level of the control command (e.g., high / medium / low) (high-risk commands use stricter thresholds, such as triggering if the sending frequency exceeds the baseline by 2 times, while low-risk commands are relaxed to 5 times). Then, the template is bound to the corresponding response action according to the blocking priority (e.g., immediate blocking / blocking after alarm / alarm only) (high priority is bound to "immediately cut off transmission + log upload", medium priority is bound to "trigger audible and visual alarm + block after 2 seconds delay"). Finally, the constraints are formed, and the obtained constraints are used as automatic blocking constraints for control commands in network transmission.

[0085] In step S4, when the abnormal transmission level of the network transmission data packet is detected to exceed the preset communication security threshold, the security tracing correlation matrix of the network transmission data packet is determined based on the automatic blocking constraint and the abnormality verification degree, and a blocking command is issued to the IoT communication gateway to interrupt the data packet transmission of the abnormal communication link.

[0086] It should be noted that the transmission anomaly level mentioned in this application represents an indicator of the severity of the deviation of the transmission behavior of network transmission data packets from the normal mode. The transmission anomaly level can be calculated by collecting multi-dimensional characteristics such as the transmission frequency, response delay, and protocol compliance of network transmission data packets in real time, comparing them with the normal benchmark, and using the obtained deviation as the transmission anomaly level of the network transmission data packets. The communication security threshold represents the critical standard value for determining whether the risk of network transmission data packet anomalies needs to be addressed by initiating proactive protection measures, and can be directly obtained from the elevator's Internet of Things control system.

[0087] In this embodiment, the security tracing correlation matrix of the network transmission data packets can be determined based on the automatic blocking constraint and the anomaly check degree using the following steps:

[0088] Parse the abnormal path node information from the network transmission data packets;

[0089] The automatic blocking constraints are associated and matched with the path node information to obtain a node-rule mapping table;

[0090] The security tracing association matrix of the network transmission data packets is constructed based on the node-rule mapping relationship table and the anomaly verification degree.

[0091] It should be noted that, in this application, the abnormal path node information represents the node transmission trajectory information of the abnormal data packet; the node-rule mapping relationship table refers to a structured data table that records the matching relationship between each transmission node in the abnormal path and the automatic blocking constraint conditions; and the security tracing association matrix represents the state association matrix for locating the source of abnormal events in network transmission data packets.

[0092] In specific implementation, firstly, deep packet inspection tools such as Scapy are used to disassemble the network transmission data packets layer by layer of the protocol stack. The focus is on extracting end-to-end node data of data packets containing abnormal characteristics (e.g., unauthorized IPs, protocol field tampering, high-frequency transmission), including the source / destination IPs and routing node IDs at the network layer, port numbers and forwarding timestamps at the transport layer, gateway identifiers, terminal device MAC addresses, and abnormal behavior characteristics of each node at the application layer (e.g., a checksum error in a data packet forwarded by a gateway). This data is integrated into structured information containing "node identifier - transmission sequence - abnormal characteristics," and this structured information is used as the abnormal path node information. Secondly, based on the Drools rule engine, the core rule elements in the automatic blocking constraints (e.g., "unauthorized IP segment list," "command frequency threshold," "risk level judgment criteria") are parsed and compared with the abnormal path node information. The system performs field-level comparisons on specific features in the point information (such as whether a node's IP is in the unauthorized list or whether the sending frequency exceeds the constraint threshold). It records the trigger rule ID, matching risk level, and associated blocking action type (such as "immediate blocking" or "blocking after alarm") for each abnormal node. All associated data are then combined into a table, which serves as the node-rule mapping table. Then, using Python's NumPy tool, nodes in the abnormal path (source device, gateway, terminal, etc.) are represented by rows, and rule entries for automatic blocking constraints are represented by columns. Matrix elements are filled with associated data (such as matching degree and risk level) in the node-rule mapping table, and the abnormal verification value is marked with an additional dimension in the first row of the matrix. The final matrix is ​​used as the security tracing association matrix for the network transmission data packets.

[0093] It should be noted that in this application, when the abnormal transmission level exceeds the preset communication security threshold, a security tracing association matrix constructed based on automatic blocking constraints and abnormal verification degree is used to achieve a precise mapping of "node-rule-risk" by structurally integrating transmission node identifiers, rule matching features, risk quantification levels, and credibility indicators. This provides a standardized association data foundation for locating the root cause of anomalies, solving the pain points of fragmented information and ambiguous association logic in traditional tracing. Simultaneously, real-time intervention by issuing blocking commands to the IoT communication gateway not only curbs the continuous threat to elevator operation from abnormal data such as malicious control commands and forged status frames through link interruption, but also preserves complete temporal trajectory evidence by "freezing" abnormal transmission snapshots to avoid the loss of key tracing information. This collaborative mechanism of "tracing modeling and risk isolation" not only achieves precise location of abnormal nodes and traceability of rule triggering basis, but also improves the accuracy and security of the entire link tracing of elevator data transmission through the closed-loop design of the technical process.

[0094] In step S5, the communication logs of IoT devices are traced through the security tracing association matrix to obtain the link tracing identifier of the communication logs, and the link tracing identifier is stored in the security event database.

[0095] In this embodiment, the link tracing of communication logs of IoT devices through the security tracing association matrix to obtain the link tracing identifier of the communication logs can be achieved through the following steps:

[0096] The transmission path and different jump nodes of abnormal data packets are located based on the security tracing correlation matrix.

[0097] The communication logs of the IoT devices corresponding to the transmission path are retrieved from the IoT communication gateway, and then the session identifier of the communication logs is extracted.

[0098] The risk anomaly matching degree of the communication log is obtained by matching the session identifier with the characteristics of historical abnormal events in the security event database.

[0099] The risk propagation path is determined by the risk anomaly matching degree and all transition nodes;

[0100] Link tracing identifiers are generated from communication logs based on the risk diffusion path.

[0101] It should be noted that, in this application, the transmission path represents the complete sequence of nodes and flow links that abnormal data packets traverse in the IoT device network from the source node (e.g., sensor) to the terminal node (e.g., elevator controller); the jump node represents the key node in the transmission path that triggers at least one security rule (e.g., unauthorized access, abnormal data format), and the key node undergoes a "behavioral jump" (from normal to abnormal) during the abnormal data transmission process; the risk anomaly matching degree represents the degree of matching between the current abnormal characteristics and historical risk characteristics of the communication log; the risk diffusion path represents the complete trajectory of the abnormal risk spreading from the initial triggering node (e.g., the compromised sensor) to other nodes; and the link tracing identifier represents the standardized coding that marks the communication logs of IoT devices in the full-link tracing process.

[0102] In specific implementation, firstly, a subset of nodes participating in abnormal transmission is filtered out using the node identifiers (e.g., a sensor IP, gateway ID) of the "triggering rules" in the security tracing association matrix. Then, the flow relationship between nodes is reconstructed by combining the time-series data (the data packet reception / forwarding time sequence of each node) in the elements, forming a complete link from the source of the abnormal data packet to the terminal. This link is then used as the transmission path. Based on this, nodes that "trigger at least one security rule" and are "at the beginning or critical turning point of abnormal behavior in time sequence" are further filtered out from this transmission path (e.g., the edge gateway that triggers the "unauthorized IP rule" for the first time, the switch that forwards abnormal data to the core node), and all the nodes obtained are used as transition nodes. Secondly, relying on the ELK log analysis platform to connect to the IoT communication gateway log system, the associated devices (e.g., communication logs between sensors and IoT communication gateways) are filtered according to the transmission path. Structured fields containing timestamps, source / destination IPs, and session IDs are extracted from the logs, where the ID that uniquely identifies a single communication process is the session identifier. Then, based on... Using a vector space model, the features of the communication logs corresponding to the current session identifier (e.g., command type, frequency, data format) and the features of historical abnormal events in the security event database (e.g., session features of known attacks) are converted into feature vectors. The similarity is calculated using a cosine similarity algorithm, and the obtained similarity is used as the risk anomaly matching degree. Then, the cosine similarity between the communication logs corresponding to each jump node and the communication logs corresponding to the current session identifier is calculated. Jump nodes with a cosine similarity greater than or equal to the risk anomaly matching degree are selected from all jump nodes. Then, a graph database (e.g., Neo4j) is used to construct a topological relationship of "node-time-risk value" to trace the propagation link of the anomaly from the initial node (e.g., intrusion source) to the terminal node (e.g., elevator controller), and the obtained propagation link is used as the risk diffusion path. Finally, the core information such as the node sequence, key timestamps, and risk anomaly matching degree in the risk diffusion path are encoded into a unique string (e.g., a combination of "node ID-risk level-timestamp-matching degree"), and the obtained string is used as the link tracing identifier.

[0103] In specific implementation, the link tracing identifier is stored in the security event database. It should be noted that the security event database is a core data carrier that stores historical abnormal event characteristics, link tracing identifiers and risk pattern data in IoT communication, providing support for real-time tracing analysis, historical reference and security strategy optimization.

[0104] Therefore, this application uses the security tracing association matrix to trace the communication logs of IoT devices, obtains the link tracing identifier of the communication logs, and stores the link tracing identifier in the security event database. First, it collects elevator operation data in real time through IoT devices and encapsulates it into network transmission data packets, establishing a standardized transmission path from the edge to the cloud, laying the foundation for subsequent anomaly identification and tracking. Second, it introduces an anomaly verification evaluation mechanism during data transmission, which can dynamically detect and quantify integrity anomalies and security deviations of data packets during transmission, effectively identifying hidden risks such as tampering, packet loss, and command forgery. This anomaly evaluation not only breaks through the limitations of traditional static detection relying on node logs but also provides real-time perception basis for accurate tracing. Furthermore, by extracting the network transmission characteristics of control commands from bidirectional communication data, and... By combining elevator operating conditions, a communication compliance model for control commands is constructed, enabling dynamic judgment of the legality of transmitted content and enhancing the ability to identify malicious injection or misoperation commands. Based on this, automatic blocking constraints are designed. When the abnormal level of data transmission is detected to exceed the preset security threshold, the communication gateway can be immediately linked to block the command and cut off the suspicious communication link, curbing the spread and abuse of abnormal data from the source. By constructing a security traceability association matrix and integrating multi-source heterogeneous information such as device identification, timestamp, transmission path, and operating status, deep association and analysis from single logs to multi-dimensional link information are achieved. This provides structured support for full-link visualization and traceability of elevator data in the Internet of Things transmission process. Finally, the system stores the traced link identifiers in the security event database, forming standardized security data that can be used for subsequent accountability, cause tracing, and situational awareness.

[0105] In summary, the proposed solution enables end-to-end traceability of elevator data during network transmission.

[0106] Example 2: This application provides an elevator data management system based on the Internet of Things (IoT), referencing... Figure 4 As shown in the figure, this is a schematic diagram of an IoT-based elevator data management system according to this embodiment of the present application. The IoT-based elevator data management system includes:

[0107] The data acquisition module 100 is used to collect elevator operation data through IoT devices, encapsulate the operation data into network transmission data packets, and transmit them to the IoT security management center.

[0108] The feature processing module 200 is used to perform transmission anomaly detection on the network transmission data packet during data transmission and obtain the anomaly check value of the network transmission data packet in data transmission.

[0109] The feature processing module 200 is also used to extract network transmission features of control commands from the bidirectional communication data packets between the elevator and the Internet of Things control system, construct a communication compliance model of control commands based on the network transmission features and elevator operating condition information, and determine automatic blocking constraints of control commands in network transmission based on the communication compliance model.

[0110] The feature processing module 200 is further configured to, when the abnormal transmission level of the network transmission data packet is detected to exceed a preset communication security threshold, determine the security tracing association matrix of the network transmission data packet based on the automatic blocking constraint and the abnormal verification degree, and issue a blocking command to the Internet of Things communication gateway to interrupt the data packet transmission of the abnormal communication link;

[0111] The tracing module 300 is used to perform link tracing on the communication logs of IoT devices through the security tracing association matrix, obtain the link tracing identifier of the communication logs, and store the link tracing identifier in the security event database.

[0112] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0113] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, including read-only memory (ROM), random access memory (RAM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), one-time programmable read-only memory (OTPROM), electrically-erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disc storage, disk storage, magnetic tape storage, or any other computer-readable medium capable of carrying or storing data.

[0114] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

Claims

1. An elevator data management method based on the Internet of Things, characterized in that, Includes the following steps: The elevator's operating data is collected by IoT devices, encapsulated into network transmission data packets, and transmitted to the IoT security management center. During data transmission, the network data packets are subjected to transmission anomaly detection to obtain the anomaly check value of the network data packets during data transmission. The network transmission characteristics of control commands are extracted from the bidirectional communication data packets between the elevator and the Internet of Things control system. Based on the network transmission characteristics and elevator operating condition information, a communication compliance model for control commands is constructed. Based on the communication compliance model, automatic blocking constraints for control commands in network transmission are determined. When the abnormal transmission level of the network data packet is detected to exceed the preset communication security threshold, the security tracing association matrix of the network data packet is determined based on the automatic blocking constraint and the abnormality verification degree, and a blocking command is sent to the IoT communication gateway to interrupt the data packet transmission of the abnormal communication link. The communication logs of IoT devices are traced using the security tracing association matrix to obtain the link tracing identifier of the communication logs, and the link tracing identifier is stored in the security event database.

2. The method as described in claim 1, characterized in that, The process of detecting transmission anomalies in the network data packets to obtain the anomaly checksum of the network data packets during data transmission specifically includes: The transmission time sequence of the network data packets is analyzed to obtain the arrival interval time sequence and transmission rate fluctuation characteristics of the network data packets; The timing deviation and rate anomaly coefficient of the network transmitted data packets are calculated based on the arrival interval time sequence and the transmission rate fluctuation characteristics. The anomaly check degree of the network transmitted data packet in data transmission is determined by the timing deviation and the rate anomaly coefficient.

3. The method as described in claim 1, characterized in that, The network transmission characteristics for extracting control commands from bidirectional communication data packets between elevators and IoT control systems specifically include: The protocol fields in the bidirectional communication data packets are parsed to extract the transmission frequency and response time delay of the control commands; The behavioral feature vector of the control command is determined based on the number of times the control command is triggered per unit time, the frequency of the control command being sent, and the response time delay. The behavioral feature vector is then used as the network transmission feature of control commands.

4. The method as described in claim 1, characterized in that, The communication compliance model for control commands, constructed based on the network transmission characteristics and elevator operating condition information, specifically includes: The system acquires real-time load, operating speed, and fault alarm status from elevator operating condition information, and then constructs an operating condition status matrix. A communication compliance model for control commands is constructed based on the network transmission characteristics and the operating condition matrix.

5. The method as described in claim 1, characterized in that... The automatic blocking constraints for control commands in network transmission determined based on the aforementioned communication compliance model specifically include: The risk level of the control command is determined by the compliance score output by the communication compliance model, and the corresponding blocking priority is set. Generate blocking rule templates based on the protocol characteristics of control commands; The automatic blocking constraints for control commands in network transmission are determined by the blocking rule template, the risk level of the control command, and the corresponding blocking priority.

6. The method as described in claim 1, characterized in that, Determining the security tracing correlation matrix of the network transmission data packets based on the automatic blocking constraints and the anomaly checksum specifically includes: Parse the abnormal path node information from the network transmission data packets; The automatic blocking constraints are associated and matched with the path node information to obtain a node-rule mapping table; The security tracing association matrix of the network transmission data packets is constructed based on the node-rule mapping relationship table and the anomaly verification degree.

7. The method as described in claim 1, characterized in that, By performing link tracing on the communication logs of IoT devices using the aforementioned security tracing association matrix, the link tracing identifiers of the communication logs specifically include: The transmission path and different jump nodes of abnormal data packets are located based on the security tracing correlation matrix. The communication logs of the IoT devices corresponding to the transmission path are retrieved from the IoT communication gateway, and then the session identifier of the communication logs is extracted. The risk anomaly matching degree of the communication log is obtained by matching the session identifier with the characteristics of historical abnormal events in the security event database. The risk propagation path is determined by the risk anomaly matching degree and all transition nodes; Link tracing identifiers are generated from communication logs based on the risk diffusion path.

8. The method as described in claim 1, characterized in that, The IoT device refers to an intelligent terminal device that embeds sensors, processors, communication modules, and software programs and can interact with the IoT control system.

9. The method as described in claim 1, characterized in that, The IoT security management center refers to the core hub in the elevator IoT system that centrally manages device identities, encrypts data transmission, verifies control commands, and handles anomalies, ensuring the reliability of elevator operation data and the security of remote monitoring.

10. An elevator data management system based on the Internet of Things (IoT), used to execute the elevator data management method based on the IoT as described in any one of claims 1 to 9, characterized in that, The elevator data management system includes: The data acquisition module is used to collect elevator operation data through IoT devices, encapsulate the operation data into network transmission data packets, and transmit them to the IoT security management center. The feature processing module is used to detect transmission anomalies in the network data packets during data transmission and obtain the anomaly check value of the network data packets during data transmission. The feature processing module is also used to extract network transmission features of control commands from the bidirectional communication data packets between the elevator and the Internet of Things control system, construct a communication compliance model of control commands based on the network transmission features and elevator operating condition information, and determine automatic blocking constraints of control commands in network transmission based on the communication compliance model. The feature processing module is also used to determine the security tracing association matrix of the network transmission data packet based on the automatic blocking constraint and the anomaly verification degree when the abnormal transmission level of the network transmission data packet is detected to exceed the preset communication security threshold, and to send a blocking command to the Internet of Things communication gateway to interrupt the data packet transmission of the abnormal communication link. The traceability module is used to trace the communication logs of IoT devices through the security traceability association matrix, obtain the traceability identifier of the communication logs, and store the traceability identifier in the security event database.

Images