An IoT device anomaly detection system based on temporal feature correlation

Abstract

An anomaly detection system for Internet of Things (IoT) devices based on timing feature reconciliation includes a plurality of IoT devices and a backend host device. Each IoT device is equipped with a first wireless communication circuit; the backend host device is equipped with a second wireless communication circuit, a processor unit, and a memory unit. A physical electronic wireless transmission path is established between each IoT device and the backend host device to transmit a plurality of state packets. After the processor unit obtains the plurality of state packets, it allocates a physical addressing temporary storage space in the memory unit to establish a timing array; the processor unit is equipped with a timing reconciliation circuit, which can perform hardware comparison to block repeatedly transmitted state packets, and perform logical breakpoint reconciliation to determine whether each state packet is an abnormal event.

Claims

1. An IoT device anomaly detection system based on temporal feature reconciliation, comprising: a plurality of IoT devices, each IoT device having a first wireless communication circuit; and a back-end host device having a second wireless communication circuit, a processor unit, and a memory unit, the processor unit being electrically connected to the memory unit and the second wireless communication circuit; wherein, The multiple IoT devices and the backend host device establish a physical electronic wireless transmission path through the first wireless communication circuit, an external mobile network base station cluster, and the second wireless communication circuit. Based on the physical electronic wireless transmission path, the multiple status packets of the multiple IoT devices are transmitted to the backend host device. After the processor unit obtains the multiple status packets, it allocates a physical address temporary storage space in the memory unit to establish a timing array. The processor unit is equipped with a timing verification circuit, which is coupled to the physical address temporary storage space. The timing verification circuit compares the temporary storage level signals of two adjacent status packets in the physical address temporary storage space to filter out duplicate status packets. The timing verification circuit also performs a logic breakpoint verification on the timing array to determine whether each status packet is an abnormal event.

2. The IoT device anomaly detection system as described in claim 1, wherein each status packet is modulated by the first wireless communication circuit into a high-frequency radio carrier signal conforming to a preset electronic communication protocol format, and each status packet is selected from any one of an arrival event, an acknowledgment event, and an departure event.

3. The IoT device anomaly detection system as described in claim 2, wherein filtering out duplicate status packets is performed when the timing reconciliation circuit detects that two adjacent status packets in the entity address temporary storage space are both the same entry event, confirmation event, or exit event, and the difference in hardware timestamps written to the memory unit by the two status packets is less than a preset jitter threshold, the timing reconciliation circuit generates a level blocking signal to clear the subsequently sent status packet.

4. The IoT device anomaly detection system as described in claim 3, wherein the timing reconciliation circuit compares the temporary level signal of a specific incoming event, and if no corresponding confirmation event temporary level signal is detected in the physical address temporary storage space within a preset time, the incoming event is determined to be an abnormal event.

5. The IoT device anomaly detection system as described in claim 1, further comprising a local cache database connected to the processor unit, the local cache database being a physical non-volatile memory chip for storing multiple location addresses of the multiple IoT devices, the processor unit having a positioning module, the positioning module receiving a positioning request for a specific IoT device, prioritizing obtaining the location address of the specific IoT device from the local cache database, and selectively sending a socket request to a third-party location service cloud server through a network interface card to obtain the location address of the specific IoT device, and synchronously writing it into the local cache database.

6. The IoT device anomaly detection system as claimed in claim 5, wherein the positioning module obtains a mobile network base station signature received by a first wireless communication circuit of the plurality of IoT devices.

7. The IoT device anomaly detection system as described in claim 6, wherein the parameters of the mobile network base station signature include Mobile Country Code (MCC), Mobile Network Code (MNC), Tracking Area Code (TAC), and Base Station Cell ID.

8. The IoT device anomaly detection system as described in claim 1, further comprising a database connected to the processor unit, the processor unit acquiring multiple device parameters of the multiple IoT devices and storing them in the database; and the processor unit having a prediction module that compares the multiple device parameters of each IoT device to predict and generate a repair order for each IoT device.

9. The IoT device anomaly detection system as described in claim 8, wherein the prediction module obtains the initial power, final power and maximum instantaneous voltage drop of each IoT device, compares it with the slope of the historical discharge curve of each IoT device stored in the database, and writes an identification tag in a designated magnetic area in the database before a specified date when the predicted power of each IoT device is exhausted, and the prediction module generates the repair work order based on the identification tag.

10. The IoT device anomaly detection system as described in claim 9, wherein the prediction module reads the power drop signal of the historical discharge curve slope stored in the database, and drives the processor unit to change the level state of a power consumption counter register in the memory unit according to the number of times each IoT device transmits, so as to generate a power consumption rate characteristic signal per hundred transmissions, thereby filtering out each IoT device with high power consumption but low turnover, and further accessing the level state of the average wake-up time and RF radio frequency indicators of each IoT device to determine the operation content of the repair work order.

Images