A device graph construction method for IoT devices

Abstract

The present invention discloses a method for constructing a device graph for IoT devices. By improving input features and community detection methods, the application scope and versatility of the device graph are improved, and new technical ideas are provided for fields such as anomaly detection and predictive maintenance of equipment. On the other hand, under the development trend of the IoT where everything is connected, the device graph and related graph-based technologies can also propose new possibilities for the management and control methods of massive devices.

Description

Technical Field

[0001] The present invention relates to the technical field of Internet of Things, and in particular to a method for constructing a device graph of an Internet of Things device. Background Art

[0002] Device graph refers to a graph structure for storing data, where nodes on the graph represent different types of devices, and the lines or edges between nodes represent certain relationships between devices. The device graph connects user behaviors with multiple devices and aggregates them in a meaningful way to help people understand the relationships between different types of devices. Related methods of device graphs have been widely used in the advertising field. Advertising companies use device graphs to understand which devices each user has, with the goal of sending customized advertising content to that specific user, and it plays an important role in building recommendation systems. With the rapid growth in the number of IoT devices and application scenarios, using device graphs to discover and manage relationships between massive devices can bring new development directions to IoT applications.

[0003] At present, there are few published studies on device graphs. In the existing literature, the author [1] proposed a method to construct a device relationship graph (containing only all devices and the relationships between these devices) based on three features: device ID, IP address and timestamp, and further identified small communities related to a single user or family in the device relationship graph. Specifically, the method in this paper can be divided into two stages: after collecting all network traffic in a certain area over a period of time, firstly, devices that share the same IP address in a short time segment are screened out, and vertical relationships are created between these devices to form an overall device relationship graph; then, the Louvain community detection algorithm is used to further process the device relationship graph, and user-level or family-level communities are obtained by adjusting relevant parameters. Through these communities, it can be known which devices belong to the same user. However, the author of this paper also proposed some restrictions on the input features when implementing the device graph: for example, the acquisition of device ID depends on network cookies and the device's own advertising identifier, but these features are sometimes not extracted from network traffic. When the method in this paper is used on large-scale data, it may cause new problems. At the same time, since the IP address may be regarded as the user's personal privacy data in some cases, further limiting the large-scale application of the method in this article, the present invention discusses and solves related problems.

[0004] Mediacorp[2], a public broadcasting service provider in Singapore, proposed a method for constructing a device graph. The authors used user behavior data collected from the company's websites and platforms to build a larger and more effective device graph that can be updated weekly. First, the authors used additional input features and experimented with the effects of different classifiers to enhance the association between different devices that may belong to the same user, forming a large-scale device relationship graph. Next, the authors used a community detection algorithm to find small communities among them, thereby obtaining the final device graph. However, the device relationship construction method used in the first stage of this paper is similar to the method in [1]. We believe that the effectiveness of this method will be limited when applied on a large scale due to insufficient selection of input features.

[0005] Community detection is also known as graph partitioning. For a graph consisting of nodes and the edges between them, a community can be defined as a subset of nodes, where the nodes in a community are closely connected to each other and loosely connected to the nodes in other communities in the same graph. This method is mainly used to detect hidden relationships between nodes in a graph or network and divide them into different clusters based on the correlation or similarity between the nodes. Community detection algorithms have been used in anomaly detection to help identify rare malicious events, such as financial fraud and cyber attacks [3]. However, due to the complexity of large-scale graph data, traditional methods have been shown to be unable to solve the problem of anomaly detection.

[0006] Main references:

[0007] [1]Malloy,Matthew&Barford,Paul&Alp,Enis&Koller,Jonathan&Jewell,Adria.(2017).Internet Device Graphs.1913-1921.10.1145 / 3097983.3098114.

[0008] [2]Koduri,Manasa&Lim,Pei&Li,Zhen&Kumar,Sandeep&Saleem,Muhammad&Moy,Roger.(2021).Cross-Device Identity Resolution using Machine Learning:AScalable Device Graph Approach.The International FLAIRS ConferenceProceedings.34.10.32473 / flairs.v34i1.128625.

[0009] [3] Ma, Xiaoxiao&Wu, Jia&Xue, Shan&Yang, Jian&Sheng, Quan&Xiong, Hui. (2021). A Comprehensive Survey on Graph Anomaly Detection with Deep Learning.

[0010] [4] Jia, Yuting & Zhang, Qinqin & Zhang, Weinan & Wang, Xinbing. (2019). CommunityGAN: Community Detection with Generative Adversarial Nets.

[0011] [5]CN201811350687.6 A method for establishing a device map of network resources and a method for using the device map. Summary of the invention

[0012] In the traditional device graph construction process, only limited features such as device ID, IP address and timestamp are used. These features cannot fully describe the characteristics or behavior of the device, which can easily lead to the neglect of some key connections between devices. Secondly, IP addresses as personal information are not available in some scenarios, which will cause the device graph construction method based on IP addresses to fail. There are many types of community detection algorithms and they are not universal. The process of manually selecting suitable community detection algorithms for specific application scenarios is time-consuming and labor-intensive. At the same time, traditional community detection methods are prone to community overlap when the node relationships are complex.

[0013] The present invention takes into account that the existing device relationship graph construction method only uses three features (device ID, IP address and timestamp) as input. Such an input feature set cannot fully explore the relationship between all devices in the graph, and therefore has certain limitations in practical applications. In addition, the use of IP addresses further limits the versatility of the current method in all scenarios. Some regions classify IP addresses as personal data, making them unable to be used directly in some scenarios. Therefore, the present invention proposes an enhanced input feature set that contains more legitimate data features, so that the method of the present invention can be used in most scenarios.

[0014] In addition, there are many types of existing community detection algorithms, and most of them are only applicable to a specific scenario. Therefore, there is no method that is effective in any scenario, which makes it difficult to select the most appropriate community detection algorithm in practical applications. In response to the above-mentioned community detection problems, the present invention proposes a new universal method that can select an appropriate method for different scenarios.

[0015] The device map construction and application method proposed in the present invention expands the selection range of input features and improves the community detection method based on the traditional device map construction method, thereby obtaining a more accurate and more universal device map construction method. In addition, the present invention also proposes new application scenarios of device maps in smart homes and industrial Internet.

[0016] The present invention achieves the above-mentioned purpose through the following technical solutions:

[0017] A method for constructing a device graph of an Internet of Things device comprises the following steps:

[0018] Step 1: Data collection and preprocessing: Collect device network communication data within a period of time, assign each piece of data to a fixed-length time segment according to its timestamp, and extract the corresponding features of each piece of data according to the requirements of the enhanced input data set;

[0019] Step 2: Build a device relationship graph: In each time segment, calculate the feature similarity between devices in the current time segment based on the features of each piece of data; then, summarize the similarity information of all time segments to build a weighted undirected device relationship graph, which contains the relationship between all devices in the data collection time period;

[0020] Step 3: Use community detection algorithm to segment the device relationship graph.

[0021] A further solution is that in step 3, the community detection algorithm based on integrated model learning includes: after obtaining the complete device relationship diagram, the system automatically calls the preset community detection algorithm and integrates the results of the detection algorithm to obtain the community detection result; according to the result, the device relationship diagram is segmented and marked to obtain the device map within the collection time period.

[0022] A further solution is that in step 3, the community detection algorithm based on the generative adversarial network includes: first, using the labeled community data and the adversarial learning method to train a community detection classifier with high resolution ability, and the classifier can be used on different device relationship graphs after one training; then, applying the pre-trained community detection classifier to the current device relationship graph to obtain community detection results with less overlap; according to the result, the device relationship graph is segmented and marked to obtain the device map within the collection time period.

[0023] A further solution is that in step 1, the input data set is enhanced based on time segments to obtain the characteristics of device features changing over time and identify suspicious or irrelevant devices in the graph.

[0024] The device map construction and application method of the present invention can be effectively applied to the following two new scenarios in addition to the traditional advertising field.

[0025] The device map constructed by the method is applied in security scenarios; if there is an isolated device in the obtained device map, that is, the device has no close connection with any other device and is not classified into a certain community, it means that the device may be a malicious device invaded from the outside; the constructed device map is used to continuously monitor the operating status of each device, so as to timely discover abnormal behavior of certain devices.

[0026] The device map constructed by the method is applied in the predictive maintenance scenario of intelligent production equipment in the manufacturing industry; production equipment with similar operating status are classified into the same community, so that isolated equipment that cannot be classified into any community is easy to identify, and the equipment is inspected to find out the cause of its abnormal status.

[0027] The beneficial effects of the present invention are:

[0028] 1) The enhanced input feature set improves device relevance while eliminating the limitations of personal information such as IP addresses on the application of the method;

[0029] 2) The improved community detection method can solve the problems of low universality and community overlap of traditional methods;

[0030] 3) The application of equipment graphs in scenarios such as anomaly detection and predictive maintenance is proposed, which expands the application scope of equipment graphs. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0032] Figure 1 This is a schematic diagram of the enhanced input feature set of the present invention;

[0033] Figure 2 A schematic diagram of a community detection algorithm based on integrated model learning according to the present invention;

[0034] Figure 3 A schematic diagram of a community detection algorithm based on a generative adversarial network according to the present invention;

[0035] Figure 4 A schematic diagram of the process of constructing the equipment map of the present invention; DETAILED DESCRIPTION

[0036] To make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be described in detail below. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other implementation methods obtained by ordinary technicians in this field without creative work belong to the scope of protection of the present invention.

[0037] In any embodiment, if Figure 1 As shown, a method for constructing a device graph of an Internet of Things device of the present invention includes:

[0038] Construct an enhanced input feature set for the device graph. Figure 1 As shown, considering that dividing the complete data into uniform time segments is an important basis for understanding the distribution of device behavior, this feature set is still based on time segments. By considering the changes in more diverse device features over time, it brings more inspiration to the construction of the device relationship graph. Its purpose is to understand the relationship between devices so as to easily identify suspicious or irrelevant devices in the graph. Figure 1 The feature list of the enhanced input feature set in security scenarios and predictive maintenance scenarios is shown. By introducing multiple features related to the application scenarios and reducing the dependence on privacy data such as IP addresses, the enhanced input feature set can reflect the correlation between devices while using as little personal information as possible, and is therefore applicable to more application scenarios.

[0039] Improved community detection method: Figure 2 and Figure 3 As shown in the flowchart in the middle left half, the complete device map construction method includes three main steps: data collection and preprocessing, construction of device relationship graph, and segmentation of device relationship graph using community detection algorithm. Among them, the accuracy of the results of the community detection algorithm has a great influence on the application effect of the device map in real scenarios. In order to achieve a more universal community detection algorithm while improving the accuracy of community detection, the community detection method proposed in the present invention consists of two parts of algorithms, which respectively solve the problems of universality of the community detection method and community overlap, and comprehensively consider the results of the two parts to obtain a community detection algorithm that has both adaptability and accuracy and can be applied to different scenarios.

[0040] The first part of the improved community detection method adopts the idea of ​​ensemble model learning, which achieves a higher community segmentation accuracy by combining multiple single community detection algorithms with the best performance, and at the same time enables the community detection algorithm to have higher adaptability. Although different community detection methods can be used to perform the same task (segmentation graph or network), their construction method and performance are closely related to the actual application scenario. In the current practical application process, multiple community detection methods must be tried in the same scenario to finally select the method that is most suitable for the current scenario. The present invention integrates the results of multiple community detection algorithms, which can effectively help select the most suitable algorithm combination, thereby reducing the picky problem of a single algorithm for the scene.

[0041] like Figure 2 As shown in Figure 1, the community detection algorithm based on integrated model learning can include the following main steps:

[0042] Data collection and preprocessing: Use appropriate methods to collect device network communication data over a period of time, assign each piece of data to a fixed-length time segment according to its timestamp, and extract the corresponding features of each piece of data according to the requirements of the enhanced input data set;

[0043] Constructing a device relationship graph: In each time segment, the feature similarity between devices in the current time segment is calculated based on the features of each piece of data; then, the similarity information of all time segments is summarized to construct a weighted undirected device relationship graph, which contains the relationships between all devices in the data collection period;

[0044] Community detection algorithm: After obtaining a complete device relationship diagram, the system automatically calls a variety of preset community detection algorithms and integrates the results of various detection algorithms to obtain a more universal community detection result; based on the result, the device relationship diagram is segmented and marked to obtain the device map within the collection time period.

[0045] The second part of the improved community detection algorithm is mainly used to solve the problem of overlapping communities. When the nodes (i.e., devices) in the device relationship graph are closely connected and complex in structure, the overlapping of communities obtained using some community detection methods will be more obvious. In such a case, a device may be divided into multiple communities, which is not conducive to the subsequent analysis of the relationship between devices or between devices and users. To solve this problem, the present invention proposes a community detection method combined with a generative adversarial network (GAN). The generative adversarial network consists of a generator and a classifier. The classifier is trained to distinguish true and false data through real data and fictitious data continuously generated by the generator. Through mutual challenges and improvements between the generator and the classifier, a classifier with strong community detection capabilities is finally achieved.

[0046] Depend on Figure 3 As shown in Figure 2, the community detection algorithm based on generative adversarial networks can include the following main steps:

[0047] Data collection and preprocessing: Use appropriate methods to collect device network communication data over a period of time, assign each piece of data to a fixed-length time segment according to its timestamp, and extract the corresponding features of each piece of data according to the requirements of the enhanced input data set;

[0048] Constructing a device relationship graph: In each time segment, the feature similarity between devices in the current time segment is calculated based on the features of each piece of data; then, the similarity information of all time segments is summarized to construct a weighted undirected device relationship graph, which contains the relationships between all devices in the data collection period;

[0049] Community detection algorithm: First, use the labeled community data and adversarial learning methods to train a community detection classifier with high resolution. After one training, the classifier can be used on different device relationship graphs (no need to train it separately each time). Then, apply the pre-trained community detection classifier to the current device relationship graph to obtain community detection results with less overlap. According to the results, the device relationship graph is segmented and labeled to obtain the device map within the collection time period.

[0050] The complete process of the device map construction method proposed in the present invention is as follows Figure 4As shown. In the community detection algorithm step, the two parts take the device relationship graph as input and divide it into communities. The community detection results of the two parts need to be fused before forming the final device map to achieve further complementarity and correction of the results. The fusion method of community detection results is not fixed. For example, based on the results of the generative adversarial network part, a most suitable community can be selected for the devices that are divided into multiple communities in the results obtained by the integrated model part. Specifically, assuming that the device relationship graph contains a total of 5 devices and the relationships between these devices (named A, B, C, D, E respectively), if the community obtained by the integrated model is [[A, B, C], [C, D, E]], and the result obtained by the generative adversarial network part is [[A, B, C], [D, E]], then the community in the final device map should be [[A, B, C]] ,[D,E]]; or, we can consider the results of both parts of the algorithm at the same time and take the maximum intersection of each corresponding community on both sides. Specifically, assuming that the above five devices are still used, if the community obtained by the integrated model is [[A,B,C],[C,E]], and the result obtained by the generative adversarial network part is [[A,B],[C,E]], then the community in the final device map should be [[A,B],[C,E]], among which device D is not included in any community, indicating that the device is not closely connected with all other devices, and the device may have different problems depending on the scenario.

[0051] In a specific embodiment, the device graph construction and application method proposed in the present invention can be effectively applied to the following two new scenarios in addition to the traditional advertising field.

[0052] Security scenario: Using Figure 1 As shown in the input feature list corresponding to the security scenario in the example, and combined with the improved community detection method, the device map construction method proposed in the present invention can accurately divide the relationship between different devices. First, if there is an isolated device in the obtained device map, that is, the device has no close connection with any other device and is not classified into a certain community, it means that the device may be a malicious device invaded from the outside. Secondly, the constructed device map can be used to continuously monitor the operating status of each device, so as to promptly discover abnormal behavior of certain devices.

[0053] Predictive maintenance scenarios for smart production equipment in the manufacturing industry: In the manufacturing environment, if the health status of smart production equipment (such as robots) is only detected locally or not detected at all, it will bring challenges to the formulation and optimization of maintenance plans for these production equipment. Figure 1As shown in the input feature list corresponding to the equipment predictive maintenance scenario, by introducing a variety of features related to equipment performance as input, such as CPU information, equipment location, indoor temperature, power consumption, overload errors, etc., the equipment map construction method proposed in the present invention can classify production equipment with similar operating status into the same community based on the above features. In this way, isolated equipment that has not been classified into any community can be easily identified, so that the equipment can be further inspected and the cause of its abnormal status can be found. This method can also provide an alarm function for intervention before the robot is damaged or unable to work.

[0054] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can easily think of changes or replacements within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims. It should also be noted that the various specific technical features described in the above specific embodiments can be combined in any suitable manner without contradiction. In order to avoid unnecessary repetition, the present invention will not further explain various possible combinations. In addition, the various different embodiments of the present invention can also be combined arbitrarily, as long as they do not violate the concept of the present invention, they should also be regarded as the contents disclosed by the present invention.

Claims

1. A method for constructing a device graph of an Internet of Things device, characterized in that: The following steps are involved: Step 1: Data collection and preprocessing: Collect device network communication data within a period of time, assign each piece of data to a fixed-length time segment according to its timestamp, and extract the corresponding features of each piece of data according to the requirements of the enhanced input data set; Step 2: Build a device relationship graph: In each time segment, calculate the feature similarity between devices in the current time segment based on the features of each piece of data; then, summarize the similarity information of all time segments to build a weighted undirected device relationship graph, which contains the relationship between all devices in the data collection time period; Step 3: Use community detection algorithm to segment the device relationship graph; In step 3, the community detection algorithm based on integrated model learning includes: after obtaining a complete device relationship graph, the system automatically calls a preset community detection algorithm and fuses the results of the detection algorithm to obtain a community detection result; according to the result, the device relationship graph is segmented and marked to obtain a device map within the collection time period; In step 3, the community detection algorithm based on the generative adversarial network includes: using the labeled community data and the adversarial learning method to train a community detection classifier with high resolution, and the classifier is used on different device relationship graphs after one training; applying the pre-trained community detection classifier to the current device relationship graph to obtain community detection results with less overlap; and segmenting and marking the device relationship graph according to the result to obtain a device map within the collection time period.

2. A method for constructing a device graph of an Internet of Things device as claimed in claim 1, characterized in that: In step 1, the input data set is enhanced based on time segments to obtain the characteristics of device features changing over time and identify suspicious or irrelevant devices in the graph.

3. A method for constructing a device graph for an Internet of Things device as described in any one of claims 1-2, and application of the device graph constructed by the method in security scenarios.

4. The application of the method for constructing a device graph of an Internet of Things device as claimed in claim 3, characterized in that: If there is an isolated device in the obtained device map, that is, the device has no close connection with any other device and is not classified into a certain community, it means that the device may be a malicious device that has invaded from the outside; the constructed device map is used to continuously monitor the operating status of each device, so as to promptly discover abnormal behavior of certain devices.

5. A method for constructing a device graph of an Internet of Things device as described in any one of claims 1-2, and application of the device graph constructed by the method in a predictive maintenance scenario of intelligent production equipment in the manufacturing industry.

6. The application of the method for constructing a device graph of an Internet of Things device as claimed in claim 5, characterized in that: Production equipment with similar operating status is grouped into the same community, making it easy to identify isolated equipment that cannot be classified into any community, and to inspect the equipment and find out the cause of its abnormal status.

Images