Abnormality detection method, device, equipment and storage medium for Internet of Things devices

Abstract

Embodiments of the present invention disclose a method, apparatus, device, and storage medium for detecting anomalies in an IoT device. This method belongs to the field of IoT technology and includes: marking sequence data uploaded by an IoT device according to preset criteria to obtain a first marking result; correcting the sequence data using an outlier correction method; marking the corrected sequence data according to a kernel density estimation method to obtain a second marking result; inputting the corrected sequence data into an encoder neural network model to obtain predicted sequence data, and calculating difference sequence data based on the predicted sequence data and the corrected sequence data; marking the difference sequence data according to preset criteria to obtain a third marking result; and determining whether the IoT device is abnormal based on the first marking result, the second marking result, and the third marking result to obtain a detection result. Embodiments of the present application can improve the detection efficiency and accuracy of the IoT platform.

Description

Technical Field

[0001] The present invention relates to the field of Internet of Things technology, and in particular to an abnormality detection method, apparatus, device and storage medium for Internet of Things devices. Background Art

[0002] With the widespread adoption of NB-IoT, low-power wide-area network (LPWAN) IoT devices regularly upload data to IoT platforms under the control of their own rules engines. The IoT platform uses the frequency of data uploads to determine the operating status of IoT devices, thereby ensuring their safe operation. Currently, operations and maintenance personnel rely on past experience to observe the data uploaded by IoT devices and then check logs to determine whether any IoT device anomalies are occurring. This method is not only time-consuming and labor-intensive, but also has low detection efficiency and accuracy. Summary of the Invention

[0003] The present invention provides an anomaly detection method, apparatus, device, and storage medium for an IoT device, aiming to improve the detection efficiency and accuracy of an IoT platform.

[0004] In a first aspect, an embodiment of the present invention provides a method for detecting anomalies in an IoT device, comprising:

[0005] Receiving sequence data uploaded by an IoT device, and marking the sequence data using a preset marker according to a preset criterion to obtain a first marking result;

[0006] Correcting the sequence data by an outlier correction method;

[0007] Marking the corrected sequence data using the preset marker according to a kernel density estimation method to obtain a second marking result;

[0008] Inputting the corrected sequence data into an encoder neural network model to obtain predicted sequence data, and calculating difference sequence data based on the predicted sequence data and the corrected sequence data;

[0009] Marking the difference sequence data using the preset marker according to the preset criterion to obtain a third marking result;

[0010] Whether the IoT device is abnormal is determined based on the first marking result, the second marking result, and the third marking result to obtain a detection result.

[0011] In a second aspect, an embodiment of the present invention further provides an anomaly detection device for an Internet of Things device, comprising:

[0012] a first labeling unit, configured to receive sequence data uploaded by an IoT device and label the sequence data using a preset label according to a preset criterion to obtain a first labeling result;

[0013] a correction unit, configured to correct the sequence data using an outlier correction method;

[0014] a second labeling unit, configured to label the corrected sequence data using the preset label according to a kernel density estimation method to obtain a second labeling result;

[0015] a calculation unit, configured to input the corrected sequence data into an encoder neural network model to obtain predicted sequence data, and calculate difference sequence data based on the predicted sequence data and the corrected sequence data;

[0016] a third marking unit, configured to mark the difference sequence data using the preset marker according to the preset criterion to obtain a third marking result;

[0017] A judging unit is configured to judge whether the IoT device is abnormal based on the first marking result, the second marking result, and the third marking result to obtain a detection result.

[0018] In a third aspect, an embodiment of the present invention further provides a computer device, which includes a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the above method when executing the computer program.

[0019] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium, wherein the storage medium stores a computer program, and the computer program can implement the above method when executed by a processor.

[0020] The embodiments of the present invention provide an abnormality detection method, apparatus, device, and storage medium for an Internet of Things device. The method comprises: receiving sequence data uploaded by an Internet of Things device, and marking the sequence data with a preset marker according to a preset criterion to obtain a first marking result; correcting the sequence data using an outlier correction method; marking the corrected sequence data with the preset marker according to a kernel density estimation method to obtain a second marking result; inputting the corrected sequence data into an encoder neural network model to obtain predicted sequence data, and calculating difference sequence data based on the predicted sequence data and the corrected sequence data; marking the difference sequence data with the preset marker according to the preset criterion to obtain a third marking result; and judging whether the Internet of Things device is abnormal based on the first marking result, the second marking result, and the third marking result to obtain a detection result. The technical solution of the embodiment of the present invention first marks the sequence data, the corrected sequence data and the difference sequence data according to the preset criteria, the kernel density estimation method and the preset criteria, and obtains the first marking result, the second marking result and the third marking result, and then automatically judges whether the Internet of Things device is abnormal based on the first marking result, the second marking result and the third marking result, thereby improving the detection efficiency and accuracy of the Internet of Things platform. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0022] Figure 1 A schematic diagram of a flow chart of an abnormality detection method for an Internet of Things device provided by an embodiment of the present invention;

[0023] Figure 2 A structural diagram of an encoder neural network model for an anomaly detection method for an IoT device provided by an embodiment of the present invention;

[0024] Figure 3 A schematic block diagram of an abnormality detection device for an Internet of Things device provided by an embodiment of the present invention; and

[0025] Figure 4 A schematic block diagram of a computer device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0026] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of them. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0027] It will be understood that when used in this specification and the appended claims, the terms “comprises” and “comprising” indicate the presence of described features, integers, steps, operations, elements and / or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or groups thereof.

[0028] It should also be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the present invention. As used in the specification and appended claims, the singular forms "a," "an," and "the" are intended to include the plural forms unless the context clearly indicates otherwise.

[0029] It should be further understood that the term "and / or" used in the present description and the appended claims refers to and includes any and all possible combinations of one or more of the associated listed items.

[0030] As used in this specification and the appended claims, the term "if" can be interpreted as "when" or "upon" or "in response to determining" or "in response to detecting," depending on the context. Similarly, the phrase "if it is determined" or "if [described condition or event] is detected" can be interpreted as meaning "upon determination" or "in response to determining" or "upon detection of [described condition or event]" or "in response to detecting [described condition or event]," depending on the context.

[0031] See also Figure 1 , Figure 1 This is a flow chart of an abnormality detection method for an Internet of Things device provided by an embodiment of the present invention. The abnormality detection method for an Internet of Things device according to the embodiment of the present invention can be applied to an Internet of Things platform. For example, the abnormality detection method for an Internet of Things device can be implemented by a software program configured on the Internet of Things platform. Figure 1 As shown, the method includes the following steps S100-S150.

[0032] S100: Receive sequence data uploaded by an IoT device, and mark the sequence data using a preset marker according to a preset criterion to obtain a first marking result.

[0033] In an embodiment of the present invention, an IoT platform receives sequence data uploaded by an IoT device, wherein the sequence data is data uploaded at fixed time units, for example, data uploaded by the IoT device every hour or half an hour. The sequence data is labeled with a preset marker according to a preset criterion to obtain a first labeling result, wherein the preset criterion is the 3δ criterion; the preset marker includes a first preset marker and a second preset marker; and the first labeling result is the result of labeling the sequence data with the first marker and the second marker. In actual application, according to the 3δ criterion, the sequence data within a preset range is regarded as normal data and labeled with the first preset marker, wherein the preset range is (μ-3δ, μ+3δ), where μ is the mean of the sequence data and δ is the variance of the sequence data; the sequence data outside the preset range is regarded as abnormal data, that is, the sequence data less than μ-3δ and greater than μ+3δ is regarded as abnormal data, and the sequence data outside the preset range is regarded as abnormal data and labeled with the second preset marker to obtain the first labeling result. It should be noted that, in an embodiment of the present invention, the first preset marker is the character "0" and the second preset marker is the character "1". In other embodiments, the first preset marker and the second preset marker may also be represented by other characters. It is understandable that the preset criteria may also be other criteria, for example, the 6δ criterion.

[0034] S110, correcting the sequence data using an outlier correction method.

[0035] In an embodiment of the present invention, after the sequence data is labeled using a preset marker according to a preset criterion to obtain a first labeling result, the normal data adjacent to the abnormal data in the sequence data is selected as the correction data. It is understandable that in actual applications, the normal data to the left of the abnormal data is preferentially selected as the correction data. When the normal data does not exist to the left of the abnormal data, the normal data to the right of the abnormal data is selected as the correction data; the abnormal data in the sequence data is replaced with the correction data. It should be noted that in an embodiment of the present invention, correcting the sequence data before performing kernel density estimation and inputting into the encoder neural network model can improve the accuracy of the second labeling result and the third labeling result to a certain extent.

[0036] S120 , labeling the corrected sequence data using the preset label according to a kernel density estimation method to obtain a second labeling result.

[0037] In an embodiment of the present invention, after the sequence data is corrected, the preset marker is used to mark the corrected sequence data according to the kernel density estimation method to obtain a second marking result. Specifically, the Gaussian kernel function is used to perform kernel density estimation, and the sequence data corresponding to the kernel density estimation value within the preset range is regarded as abnormal data, and the second preset marker is used to mark the abnormal data, wherein the preset range is (0, 2%); the sequence data corresponding to the kernel density estimation value outside the preset range is regarded as normal data, and the first preset marker is used to mark the normal data to obtain a second marking result. In actual application, the corrected sequence data is divided into 24×1 lengths, and the kernel density estimation value of the sequence data distribution is obtained by kernel density estimation, and the 2% quantile of the kernel density estimation value is obtained, and the data of the 0 to 2% quantile is marked with the second preset marker, and the remaining corrected sequence data is marked with the first preset marker.

[0038] S130. Input the corrected sequence data into the encoder neural network model to obtain predicted sequence data, and calculate difference sequence data based on the predicted sequence data and the corrected sequence data.

[0039] In the embodiment of the present invention, after the modified sequence data is marked with the preset marker to obtain a second marking result, the modified sequence data is input into the encoder neural network model to obtain predicted sequence data, wherein the encoder neural network model includes a fully connected encoder and a convolutional encoder, and its structure is as follows: Figure 2As shown, specifically, the feature maps corresponding to the corrected sequence data are respectively input into the fully connected encoder and the convolutional encoder to obtain the main feature map and the size feature map, wherein the fully connected encoder uses a fully connected layer (FC) to compress the feature map in order of 24, 20, 16, 12, 8, and 4 sizes, and then reversely uses the fully connected layer to restore the feature map in order of 4, 8, 12, 16, 20, and 24 to learn and obtain the main feature map corresponding to the corrected sequence data; the convolutional encoder includes double one-dimensional convolution (DoubleConv1d), one-dimensional maximum pooling (MaxPool1d), one-dimensional deconvolution (ConvTranspose1d), splicing (concat) and one-dimensional convolution (conv1d) operations, wherein the Double one-dimensional convolution is a neural network module that expands the number of feature layers and reduces the size of feature maps by combining two 5×1 one-dimensional convolutions, one-dimensional batch normalization, and the ReLu nonlinear function. In practical applications, the feature map corresponding to the 24×1 corrected sequence data is downsampled using double one-dimensional convolution and one-dimensional maximum pooling to reduce the size of the feature map and increase the number of layers of the feature map, thereby extracting the feature map. Feature maps of the same size from the downsampling process are then upsampled using one-dimensional deconvolution and double one-dimensional convolution to restore the size of the feature map. The main feature map and the size feature map are concatenated to obtain a concatenated feature map, which is then fused using one-dimensional convolution to obtain 24×1 predicted sequence data. After obtaining the 24×1 predicted sequence data, the difference data between the predicted sequence data and the corrected sequence data is calculated, and the absolute value of the difference data is taken to obtain the difference sequence data. It should be noted that, in an embodiment of the present invention, before the corrected sequence data is input into the encoder neural network model to obtain the predicted sequence data, the encoder neural network model needs to be trained. Specifically, the sequence data is obtained from the sample library according to the preset training batch, the sequence data is divided by time, and the divided sequence data is input into the encoder neural network model. The encoder neural network model is trained according to the input sequence data, the preset loss function, the preset iterator algorithm, the preset learning rate and the preset number of training rounds, wherein the preset loss function is the mean square loss function, the preset iterator algorithm is the Adam algorithm, the preset learning rate is 0.001, the preset number of training rounds is 200, and the preset training batch is 10, so as to obtain the trained encoder neural network model.

[0040] S140. Mark the difference sequence data using the preset marker according to the preset criterion to obtain a third marking result.

[0041] In an embodiment of the present invention, after calculating difference sequence data based on the predicted sequence data and the corrected sequence data, the difference sequence data is labeled using the preset marker according to the 3δ criterion to obtain a third labeling result. Specifically, according to the 3δ criterion, the difference sequence data (μ-3δ, μ+3δ) is regarded as normal data and labeled using a first preset marker, where μ is the mean of the difference sequence data and δ is the variance of the difference sequence data; the difference sequence data less than μ-3δ and greater than μ+3δ is regarded as abnormal data and labeled using a second preset marker to obtain a third labeling result.

[0042] S150: Determine whether the IoT device is abnormal based on the first marking result, the second marking result, and the third marking result to obtain a detection result.

[0043] In an embodiment of the present invention, the sequence data marked with the second preset marker in the first marking result is used as the first target abnormal data. If the sequence data marked with the first preset marker in the first marking result is marked with the second preset marker in both the second marking result and the third marking result, the sequence data is used as the second target abnormal data; otherwise, the sequence data is used as normal data. The IoT device log is checked based on the first target abnormal data and the second target abnormal data, and maintenance personnel use the log to determine whether the IoT device is abnormal to obtain a detection result. It is understandable that if the first marking result, the second marking result, and the third marking result all contain normal data, the IoT device is normal. If the first marking result only contains normal data, the IoT device is tested based on the abnormal data in the second and third marking results. If both the first and second marking results contain normal data, the IoT device is also tested. It should be noted that in this embodiment of the present invention, the comprehensive determination of whether the IoT device is abnormal based on the first, second, and third marking results can improve the detection efficiency and accuracy of the IoT platform.

[0044] Figure 3 FIG. 2 is a schematic block diagram of an abnormality detection device 200 for an Internet of Things device provided by an embodiment of the present invention. Figure 3 As shown, corresponding to the above abnormality detection method for IoT devices, the present invention also provides an abnormality detection device 200 for IoT devices. The abnormality detection device 200 for IoT devices includes a unit for executing the above abnormality detection method for IoT devices. Figure 3The anomaly detection device 200 for an IoT device includes a first marking unit 201 , a correction unit 202 , a second marking unit 203 , a calculation unit 204 , a third marking unit 205 and a judgment unit 206 .

[0045] Among them, the first marking unit 201 is used to receive sequence data uploaded by the Internet of Things device, and mark the sequence data with a preset marker according to a preset criterion to obtain a first marking result; the correction unit 202 is used to correct the sequence data by an outlier correction method; the second marking unit 203 is used to mark the corrected sequence data with the preset marker according to the kernel density estimation method to obtain a second marking result; the calculation unit 204 is used to input the corrected sequence data into the encoder neural network model to obtain predicted sequence data, and calculate difference sequence data based on the predicted sequence data and the corrected sequence data; the third marking unit 205 is used to mark the difference sequence data with the preset marker according to the preset criterion to obtain a third marking result; the judgment unit 206 is used to judge whether the Internet of Things device is abnormal based on the first marking result, the second marking result and the third marking result to obtain a detection result.

[0046] In some embodiments, such as this embodiment, the first marking unit 201 includes a first marking sub-unit 2011 and a second marking sub-unit 2012 .

[0047] Among them, the first marking subunit 2011 is used to treat the sequence data within the preset range as normal data according to the 3δ criterion, and mark the normal data with a first preset marker; the second marking subunit 2012 is used to treat the sequence data outside the preset range as abnormal data, and mark the abnormal data with a second preset marker to obtain a first marking result.

[0048] In some embodiments, such as this embodiment, the correction unit 202 includes a selection unit 2021 and a replacement unit 2022 .

[0049] The selection unit 2021 is configured to select the normal data adjacent to the abnormal data in the sequence data as the correction data; and the replacement unit 2022 is configured to replace the abnormal data in the sequence data with the correction data.

[0050] In some embodiments, such as this embodiment, the second marking unit 203 includes a third marking sub-unit 2031 and a fourth marking sub-unit 2032 .

[0051] Among them, the third marking subunit 2031 is used to use the Gaussian kernel function to perform kernel density estimation, and to treat the sequence data corresponding to the kernel density estimation value within the preset range as abnormal data, and to use the second preset marker to mark the abnormal data; the fourth marking subunit 2032 is used to treat the sequence data corresponding to the kernel density estimation value outside the preset range as normal data, and to use the first preset marker to mark the normal data to obtain a second marking result.

[0052] In some embodiments, such as this embodiment, the computing unit 204 includes an input unit 2041 , a splicing and fusion unit 2042 , a first computing subunit 2043 , and a second computing subunit 2044 .

[0053] Among them, the input unit 2041 is used to input the feature maps corresponding to the corrected sequence data into the fully connected encoder and the convolution encoder in the encoder neural network model respectively to obtain the main feature map and the size feature map; the splicing and fusion unit 2042 is used to splice the main feature map and the size feature map to obtain a spliced ​​feature map, and use one-dimensional convolution to fuse the spliced ​​feature map to obtain predicted sequence data; the first calculation subunit 2043 is used to calculate the difference data between the predicted sequence data and the corrected sequence data; the second calculation subunit 2044 is used to take the absolute value of the difference data to obtain difference sequence data.

[0054] In some embodiments, such as this embodiment, the judgment unit 206 includes a first acting unit 2061 , a second acting unit 2062 , and a judgment subunit 2063 .

[0055] Among them, the first acting unit 2061 is used to use the sequence data marked with the second preset marker in the first marking result as the first target abnormal data; the second acting unit 2062 is used to use the sequence data as the second target abnormal data if the sequence data marked with the first preset marker in the first marking result is marked with the second preset marker in both the second marking result and the third marking result; the judging subunit 2063 is used to judge whether the Internet of Things device is abnormal based on the first target abnormal data and the second target abnormal data to obtain a detection result.

[0056] It should be noted that those skilled in the art can clearly understand that the specific implementation process of the anomaly detection device 200 and each unit of the above-mentioned Internet of Things device can refer to the corresponding description in the aforementioned method embodiment. For the convenience and conciseness of the description, it will not be repeated here.

[0057] The above-mentioned abnormality detection device of the Internet of Things device can be implemented in the form of a computer program. The computer program can be used in Figure 4 Runs on the computer device shown.

[0058] See also Figure 4 , Figure 4 1 is a schematic block diagram of a computer device provided in an embodiment of the present application. The computer device 900 is a server with an Internet of Things platform.

[0059] See Figure 4 The computer device 900 includes a processor 902 , a memory, and an interface 907 connected via a system bus 901 , wherein the memory may include a storage medium 903 and an internal memory 904 .

[0060] The storage medium 903 can store an operating system 9031 and a computer program 9032. When the computer program 9032 is executed, the processor 902 can execute the above-mentioned anomaly detection method for IoT devices.

[0061] The processor 902 is used to provide computing and control capabilities to support the operation of the entire computer device 900.

[0062] The internal memory 904 provides an environment for the operation of the computer program 9032 in the storage medium 903. When the computer program 9032 is executed by the processor 902, the processor 902 can execute an abnormality detection method for an Internet of Things device.

[0063] The interface 905 is used to communicate with other devices. Those skilled in the art will appreciate that Figure 4 The structure shown in the figure is merely a block diagram of a portion of the structure related to the solution of the present application, and does not constitute a limitation on the computer device 900 to which the solution of the present application is applied. The specific computer device 900 may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0064] In which, the processor 902 is used to run the computer program 9032 stored in the memory to implement the following steps: receiving sequence data uploaded by the Internet of Things device, and marking the sequence data with a preset marker according to a preset criterion to obtain a first marking result; correcting the sequence data through an outlier correction method; marking the corrected sequence data with the preset marker according to a kernel density estimation method to obtain a second marking result; inputting the corrected sequence data into the encoder neural network model to obtain predicted sequence data, and calculating difference sequence data based on the predicted sequence data and the corrected sequence data; marking the difference sequence data with the preset marker according to the preset criterion to obtain a third marking result; judging whether the Internet of Things device is abnormal based on the first marking result, the second marking result and the third marking result to obtain a detection result.

[0065] In certain embodiments, such as the present embodiment, when the processor 902 implements the step of marking the sequence data according to the preset criteria with a preset marker to obtain a first marking result, it specifically implements the following steps: according to the 3δ criterion, the sequence data within the preset range is regarded as normal data, and the normal data is marked with a first preset marker; the sequence data outside the preset range is regarded as abnormal data, and the sequence data outside the preset range is regarded as abnormal data, and the abnormal data is marked with a second preset marker to obtain a first marking result.

[0066] In certain embodiments, such as the present embodiment, when the processor 902 implements the step of correcting the sequence data using the outlier correction method, it specifically implements the following steps: selecting the normal data adjacent to the abnormal data in the sequence data as the correction data; and replacing the abnormal data in the sequence data with the correction data.

[0067] In certain embodiments, such as the present embodiment, when the processor 902 implements the step of labeling the corrected sequence data using the preset marker according to the kernel density estimation method to obtain a second labeling result, it specifically implements the following steps: performing kernel density estimation using a Gaussian kernel function, and treating the sequence data corresponding to the kernel density estimation value within a preset range as abnormal data, and labeling the abnormal data using the second preset marker; treating the sequence data corresponding to the kernel density estimation value outside the preset range as normal data, and labeling the normal data using the first preset marker to obtain a second labeling result.

[0068] In certain embodiments, such as the present embodiment, the processor 902, when implementing the step of inputting the corrected sequence data into the encoder neural network model to obtain predicted sequence data, specifically implements the following steps: inputting the feature maps corresponding to the corrected sequence data into the fully connected encoder and the convolutional encoder in the encoder neural network model respectively to obtain a main feature map and a size feature map; splicing the main feature map and the size feature map to obtain a spliced ​​feature map, and using one-dimensional convolution to fuse the spliced ​​feature map to obtain predicted sequence data.

[0069] In certain embodiments, such as the present embodiment, the processor 902, when implementing the step of calculating the difference sequence data based on the predicted sequence data and the corrected sequence data, specifically implements the following steps: calculating the difference data between the predicted sequence data and the corrected sequence data; taking the absolute value of the difference data to obtain the difference sequence data.

[0070] In certain embodiments, such as the present embodiment, when the processor 902 implements the step of determining whether the IoT device is abnormal based on the first marking result, the second marking result, and the third marking result to obtain a detection result, the processor 902 specifically implements the following steps: using the sequence data marked with the second preset marker in the first marking result as the first target abnormal data; if the sequence data marked with the first preset marker in the first marking result is marked with the second preset marker in both the second marking result and the third marking result, using the sequence data as the second target abnormal data; and determining whether the IoT device is abnormal based on the first target abnormal data and the second target abnormal data to obtain a detection result.

[0071] It should be understood that in the embodiment of the present application, the processor 902 may be a central processing unit (CPU), and the processor 902 may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Among them, the general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0072] Those skilled in the art will appreciate that all or part of the steps in the method of the above-described embodiment can be implemented by instructing relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium. The computer program is executed by at least one processor in the wireless communication system to implement the steps in the method of the above-described embodiment.

[0073] Therefore, the present invention also provides a storage medium. The storage medium may be a computer-readable storage medium. The storage medium stores a computer program. When executed by a processor, the computer program causes the processor to perform any embodiment of the above-mentioned method for detecting anomalies in an IoT device.

[0074] The storage medium may be any computer-readable storage medium that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a magnetic disk, or an optical disk.

[0075] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, wireless communication software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the composition and steps of each example according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0076] In the several embodiments provided herein, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of the various units is merely a logical functional division, and actual implementation may employ other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be omitted or not implemented.

[0077] The steps in the methods of the embodiments of the present invention may be adjusted in order, combined, or deleted as needed. The units in the devices of the embodiments of the present invention may be combined, divided, or deleted as needed. Furthermore, the functional units in the various embodiments of the present invention may be integrated into a single processing unit, each unit may exist physically separately, or two or more units may be integrated into a single unit.

[0078] If this integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the existing technology, or all or part of the technical solution, can be embodied in the form of a software product. This wireless communication software product is stored in a storage medium and includes several instructions for causing a computer device (such as a personal wireless communication device, terminal, or network device) to execute all or part of the steps of the method described in various embodiments of the present invention.

[0079] In the above embodiments, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0080] Obviously, those skilled in the art may make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, to the extent such changes and modifications fall within the scope of the claims and their equivalents, the present invention is intended to encompass such changes and modifications.

[0081] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in the present invention, and such modifications or substitutions are intended to be within the scope of protection of the present invention. Therefore, the scope of protection of the present invention shall be subject to the scope of protection of the claims.

Claims

1. A method for detecting anomalies in an Internet of Things device, characterized in that: include: Receiving sequence data uploaded by an IoT device, and marking the sequence data using a preset marker according to a preset criterion to obtain a first marking result; Correcting the sequence data by an outlier correction method; Marking the corrected sequence data using the preset marker according to a kernel density estimation method to obtain a second marking result; Inputting the corrected sequence data into an encoder neural network model to obtain predicted sequence data, and calculating difference sequence data based on the predicted sequence data and the corrected sequence data; Marking the difference sequence data using the preset marker according to the preset criterion to obtain a third marking result; Determine whether the IoT device is abnormal based on the first marking result, the second marking result, and the third marking result to obtain a detection result; The step of inputting the corrected sequence data into an encoder neural network model to obtain predicted sequence data includes: Inputting the feature maps corresponding to the corrected sequence data into the fully connected encoder and the convolutional encoder in the encoder neural network model respectively to obtain a main feature map and a size feature map; The main feature map and the size feature map are spliced ​​together to obtain a spliced ​​feature map, and the spliced ​​feature map is fused using a one-dimensional convolution to obtain predicted sequence data.

2. The method for detecting anomalies in an IoT device according to claim 1, wherein: The step of labeling the sequence data using a preset marker according to a preset criterion to obtain a first labeling result includes: According to the 3δ criterion, the sequence data within a preset range is regarded as normal data, and the normal data is marked with a first preset marker; The sequence data outside the preset range is regarded as abnormal data, and the abnormal data is marked with a second preset marker to obtain a first marking result.

3. The method for detecting anomalies in an IoT device according to claim 2, wherein: The correcting the sequence data by using an outlier correction method includes: selecting the normal data adjacent to the abnormal data in the sequence data as correction data; The abnormal data in the sequence data is replaced with the correction data.

4. The method for detecting anomalies in an IoT device according to claim 3, wherein: The step of labeling the corrected sequence data using the preset label according to the kernel density estimation method to obtain a second labeling result includes: Performing kernel density estimation using a Gaussian kernel function, treating the sequence data corresponding to the kernel density estimation value within a preset range as abnormal data, and marking the abnormal data using the second preset marker; The sequence data corresponding to the kernel density estimation value outside the preset range is regarded as normal data, and the normal data is marked with the first preset marker to obtain a second marking result.

5. The method for detecting anomalies in an IoT device according to claim 1, wherein: The calculating of difference sequence data based on the predicted sequence data and the corrected sequence data includes: Calculating difference data between the predicted sequence data and the corrected sequence data; The absolute value of the difference data is taken to obtain difference sequence data.

6. The method for detecting anomalies of an Internet of Things device according to claim 4, wherein: The determining whether the IoT device is abnormal based on the first marking result, the second marking result, and the third marking result to obtain a detection result includes: Using the sequence data marked by the second preset marker in the first marking result as first target abnormal data; If the sequence data marked with the first preset marker in the first marking result is marked with the second preset marker in both the second marking result and the third marking result, the sequence data is used as the second target abnormal data; Whether the IoT device is abnormal is determined based on the first target abnormal data and the second target abnormal data to obtain a detection result.

7. An abnormality detection device for an Internet of Things device, characterized in that: include: a first labeling unit, configured to receive sequence data uploaded by an IoT device and label the sequence data using a preset label according to a preset criterion to obtain a first labeling result; a correction unit, configured to correct the sequence data using an outlier correction method; a second labeling unit, configured to label the corrected sequence data using the preset label according to a kernel density estimation method to obtain a second labeling result; a calculation unit, configured to input the corrected sequence data into an encoder neural network model to obtain predicted sequence data, and calculate difference sequence data based on the predicted sequence data and the corrected sequence data; a third marking unit, configured to mark the difference sequence data using the preset marker according to the preset criterion to obtain a third marking result; a judging unit, configured to judge whether the IoT device is abnormal based on the first marking result, the second marking result, and the third marking result to obtain a detection result; Wherein, the calculation unit includes: An input unit, configured to input the corrected feature maps corresponding to the sequence data into a fully connected encoder and a convolutional encoder in an encoder neural network model to obtain a main feature map and a size feature map; The splicing and fusion unit is used to splice the main feature map and the size feature map to obtain a splicing feature map, and use a one-dimensional convolution to fuse the splicing feature map to obtain prediction sequence data.

8. A computer device, characterized in that: The computer device is equipped with an Internet of Things platform, and includes a memory and a processor. The memory stores a computer program, and the processor implements the method according to any one of claims 1 to 6 when executing the computer program.

9. A computer-readable storage medium, characterized in that The storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 6 can be implemented.

Images