Anomaly detection equipment and systems
Through abnormal detection equipment and systems, using QR code identification and information transmission technology, timely detection of equipment failures in the local area network is achieved, solving the problems of delay in fault discovery and high maintenance costs in the existing technology, and improving network security.
Patent Information
- Application Number
- CN202210985110.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2022-08-17
- Publication Date
- 2024-12-20
- Estimated Expiration
- 2042-08-17
AI Technical Summary
The existing equipment maintenance methods in the LAN rely on manual inspection, resulting in delayed failure detection, reducing network security, and the network gate isolation deployment cost is high and the usage rate is low.
An abnormality detection device and system are designed to convert the operating status information into a QR code through an embedded device, and the operation and maintenance device identifies and sends information to the server. If the information is interrupted, a fault prompt will be sent immediately to ensure that the fault is discovered in time.
It improves the timely detection and handling of equipment failures in the LAN, improves network security, reduces the dependence of manual inspections, and avoids security accidents caused by delays.
Smart Images
Figure CN115361199B_ABST
Abstract
Description
Technical Field
[0001] The present application belongs to the field of network security technology, and specifically relates to an anomaly detection device and system. Background Art
[0002] Most of the devices in the network security field are local area network devices. In order to ensure network security, they are usually not directly connected to the external network. At the same time, due to environmental influences and human damage, local area network devices are prone to failure.
[0003] In order to effectively maintain the devices in the LAN, the current network security field usually adopts the form of network gates to isolate the internal and external networks. However, this method has a low utilization rate due to its high deployment cost. Therefore, the maintenance of existing LAN devices is mainly carried out through manual regular inspections and troubleshooting. However, when a device fails in this way, it cannot be discovered in time, which easily causes accidents and reduces safety. Summary of the invention
[0004] The embodiments of the present application provide an abnormality detection device and system, which can overcome the problem of low security in the prior art and improve security at least to a certain extent.
[0005] Other features and advantages of the present application will become apparent from the following detailed description, or may be learned in part by the practice of the present application.
[0006] According to one aspect of an embodiment of the present application, there is provided an abnormality detection device for detecting whether a device in a local area network fails, including:
[0007] An embedded device, for converting the multiple operating status information in the time period into a QR code to be identified and displaying it when receiving multiple operating status information sent by the device in the local area network in the previous time period; and for displaying the QR code to be identified in the previous time period when not receiving the operating status information sent by the device in the local area network in the current time period;
[0008] The operation and maintenance device is used to identify the two-dimensional code to be identified, obtain identification information, and send the identification information to the server; when it is determined that the two-dimensional code to be identified in the previous period is the same as the two-dimensional code to be identified in the current period, no information is sent to the server;
[0009] The server is used to receive the identification information and send abnormal prompt information to the monitoring terminal when it is detected that no information is received for more than a first preset time period, wherein the abnormal prompt information is used to indicate that a device in the local area network has a fault.
[0010] In the technical solutions provided in some embodiments of the present application, the operation and maintenance device is specifically used to determine that the QR code to be identified in the previous time period is the same as the QR code to be identified in the current time period when the embedded device receives the operating status information of the previous time period and does not receive the operating status information of the current time period.
[0011] In the technical solutions provided in some embodiments of the present application, the operation and maintenance device is also used to identify the QR code to be identified in the current time period to obtain identification information when it is determined that the QR code to be identified in the previous time period is different from the QR code to be identified in the current time period; and send the identification information to the server.
[0012] In the technical solutions provided in some embodiments of the present application, the operation and maintenance device is specifically used to determine that the QR code to be identified in the previous time period is different from the QR code to be identified in the current time period when the embedded device receives the operating status information of the previous time period and the operating status information of the current time period respectively.
[0013] In the technical solutions provided in some embodiments of the present application, the embedded device is specifically used to, when receiving the operating status information of the previous time period, convert multiple operating status information in the previous time period into a first two-dimensional code to be identified; and when receiving the operating status information of the current time period, convert the multiple operating status information in the current time period into a second two-dimensional code to be identified; wherein the first two-dimensional code to be identified is different from the second two-dimensional code to be identified.
[0014] In the technical solutions provided in some embodiments of the present application, the embedded device includes:
[0015] A control module connected to the device in the local area network, the control module is used to convert the multiple operating status information in the time period into a QR code to be identified when receiving multiple operating status information sent by the device in the local area network in the previous time period; and convert the multiple operating status information in the time period into a QR code to be identified when receiving multiple operating status information sent by the device in the local area network in the current time period;
[0016] The screen is connected to the control module and is used to display the two-dimensional code to be identified in the previous period or the two-dimensional code to be identified in the current period.
[0017] In the technical solutions provided in some embodiments of the present application, the operation and maintenance device includes a scanner, a judgment module and a processing module;
[0018] A scanner, whose position corresponds to the position of the screen, and the scanner is used to identify the two-dimensional code to be identified to obtain identification information;
[0019] A judgment module, connected to the scanner and the processing module respectively, and used to judge whether the two-dimensional code to be identified in the previous time period is the same as the two-dimensional code to be identified in the current time period;
[0020] A processing module is connected to the server, and the processing module is used for not sending information to the server when it is determined that the QR code to be identified in the previous time period is the same as the QR code to be identified in the current time period, and for sending identification information to the server when it is determined that the QR code to be identified in the previous time period is different from the QR code to be identified in the current time period.
[0021] In the technical solutions provided in some embodiments of the present application, the abnormality detection device also includes an alarm, which is connected to the control module and is used to issue an alarm signal when it is detected that the embedded device has not received any operating status information within a second preset time period.
[0022] In the technical solutions provided in some embodiments of the present application, the embedded device is specifically used to receive the operating status information of the device in the local area network when the device in the local area network is in a first operating state; and not receive the operating status information of the device in the local area network when the device in the local area network is in a second operating state.
[0023] In the technical solutions provided in some embodiments of the present application, the operating status information includes a heartbeat packet.
[0024] According to another aspect of an embodiment of the present application, there is provided an anomaly detection system, comprising: any one of the above-mentioned anomaly detection devices and a device in a local area network, wherein the anomaly detection device is used to detect whether a fault occurs in the device in the local area network.
[0025] In the technical solutions provided in some embodiments of the present application, the abnormality detection device and system of the present application can detect whether a device in a local area network has a fault, including an embedded device, which is used to convert the multiple operating status information in the time period into a QR code to be identified and display it when multiple operating status information sent by the device in the local area network in the previous time period is received; and when the operating status information sent by the device in the local area network in the current time period is not received, the QR code to be identified in the previous time period is displayed; an operation and maintenance device, which is used to identify the QR code to be identified, obtain identification information, and send the identification information to a server, and when it is determined that the QR code to be identified in the previous time period is the same as the QR code to be identified in the current time period, no information is sent to the server; a server, which is used to receive the identification information and when it is detected that no information is received for more than a first preset time period, send an abnormal prompt information to the monitoring terminal, and the abnormal prompt information is used to indicate that the device in the local area network has a fault. Since no information is sent to the server when the QR code to be identified in the previous period is the same as the QR code to be identified in the current period, the server determines that a device in the local area network has failed by not receiving information, and thus sends an abnormal prompt message in time, so as to notify the user in time, and then discover the fault in time, so that the user can handle the fault and improve safety.
[0026] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS
[0027] The drawings herein are incorporated into the specification and constitute a part of the specification, showing embodiments consistent with the present application, and together with the specification, are used to explain the principles of the present application. Obviously, the drawings described below are only some embodiments of the present application, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. In the drawings:
[0028] Figure 1 A structural schematic diagram of an abnormality detection system suitable for implementing an embodiment of the present application is shown.
[0029] Figure 2 A schematic diagram of the structure of an embedded device suitable for implementing an embodiment of the present application is shown.
[0030] Figure 3 A schematic diagram of the structure of an operation and maintenance device suitable for implementing an embodiment of the present application is shown. DETAILED DESCRIPTION
[0031] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that this application will be more comprehensive and complete and fully convey the concept of the example embodiments to those skilled in the art.
[0032] In addition, described feature, structure or characteristic can be combined in one or more embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present application. However, those skilled in the art will appreciate that the technical scheme of the present application can be put into practice without one or more of the specific details, or other methods, components, devices, steps, etc. can be adopted. In other cases, known methods, devices, realizations or operations are not shown or described in detail to avoid blurring the various aspects of the application.
[0033] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities may be implemented in software form, or in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.
[0034] The flowcharts shown in the accompanying drawings are only exemplary and do not necessarily include all the contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps can be decomposed, and some operations / steps can be combined or partially combined, so the actual execution order may change according to actual conditions.
[0035] It should be noted that the "multiple" mentioned in this article refers to two or more. "And / or" describes the association relationship of the associated objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the associated objects before and after are in an "or" relationship.
[0036] like Figure 1 As shown, the anomaly detection device 100 of the present application is used to detect whether a device 10 in a local area network fails. The anomaly detection device 100 includes an embedded device 20, an operation and maintenance device 30, a server 40 and a monitoring terminal 50.
[0037] The embedded device 20 is used to convert the multiple operating status information in the time period into a QR code to be identified and display it when receiving multiple operating status information sent by the device 10 in the local area network in the previous time period; and display the QR code to be identified in the previous time period when not receiving the operating status information sent by the device 10 in the local area network in the current time period; in one embodiment, the operating status information may include a heartbeat packet. The duration of the previous time period and the current time period is equal, which can be set according to the needs.
[0038] The operation and maintenance device 30 is used to identify the two-dimensional code to be identified, obtain identification information, and send the identification information to the server 40, and when it is determined that the two-dimensional code to be identified in the previous period is the same as the two-dimensional code to be identified in the current period, not send information to the server 40;
[0039] The server 40 is used to receive the identification information and send abnormal prompt information to the monitoring terminal 50 when it detects that no information is received for more than a first preset time. The abnormal prompt information is used to indicate that a device 10 in the local area network has a fault to prompt the user.
[0040] In one embodiment, the operation and maintenance device 30 is specifically used to determine that the QR code to be identified in the previous period is the same as the QR code to be identified in the current period when the embedded device 20 receives the operation status information of the previous period but does not receive the operation status information of the current period.
[0041] In one embodiment, the operation and maintenance device 30 is also used to identify the QR code to be identified in the current time period to obtain identification information when it is determined that the QR code to be identified in the previous time period is different from the QR code to be identified in the current time period; and send the identification information to the server 40.
[0042] In one embodiment, the operation and maintenance device 30 is specifically used to determine that the QR code to be identified in the previous period is different from the QR code to be identified in the current period when the embedded device 20 receives the operation status information of the previous period and the operation status information of the current period respectively.
[0043] In one embodiment, the embedded device 20 is specifically used to convert multiple operating status information in the previous time period into a first two-dimensional code to be identified when the operating status information of the previous time period is received; and when the operating status information of the current time period is received, convert the multiple operating status information in the current time period into a second two-dimensional code to be identified; wherein the first two-dimensional code to be identified is different from the second two-dimensional code to be identified.
[0044] In one embodiment, if Figure 2 As shown, the embedded device 20 includes a control module 21 and a screen 22 .
[0045] The control module 21 is connected to the device 10 and the screen 22 in the local area network, respectively. The control module 21 is used to convert the multiple operating status information in the time period into a QR code to be identified when receiving multiple operating status information sent by the device 10 in the local area network in the previous time period; when receiving multiple operating status information sent by the device 10 in the local area network in the current time period, convert the multiple operating status information in the time period into a QR code to be identified;
[0046] The screen 22 is used to display the two-dimensional code to be identified in the previous period or the current period. That is, the screen 22 can display the first two-dimensional code to be identified or the second two-dimensional code to be identified.
[0047] In one embodiment, if Figure 3 As shown, the operation and maintenance device 30 includes a scanner 31, a judgment module 32 and a processing module 33. The position of the scanner 31 corresponds to the position of the screen 22. The judgment module 32 is connected to the scanner 31 and the processing module 33 respectively. The processing module 33 is connected to the server 40.
[0048] A scanner 31 is used to identify the two-dimensional code to be identified and obtain identification information;
[0049] A judgment module 32 is used to judge whether the two-dimensional code to be identified in the previous period is the same as the two-dimensional code to be identified in the current period;
[0050] The processing module 33 is used for not sending information to the server 40 when it is determined that the QR code to be identified in the previous time period is the same as the QR code to be identified in the current time period, and for sending identification information to the server 40 when it is determined that the QR code to be identified in the previous time period is different from the QR code to be identified in the current time period.
[0051] In one embodiment, return Figure 1 The abnormality detection device 100 further includes an alarm 60, which is connected to the control module 21. The alarm 60 is used to send an alarm signal when it is detected that the embedded device 20 does not receive the operating status information within the second preset time. The first preset time and the second preset time can be set according to the needs.
[0052] The embedded device 20 is specifically used to receive the operation status information of the device 10 in the local area network when the device 10 in the local area network is in the first operation state; and not receive the operation status information of the device 10 in the local area network when the device 10 in the local area network is in the second operation state. The first operation state is a normal operation state, that is, a state without a fault, and the second operation state is an abnormal operation state, that is, a fault state. In one mode, when the device 10 in the local area network is in the first operation state, the operation status information is sent to the embedded device 20 at intervals; when the device 10 in the local area network is in the second operation state, the operation status information is suspended from being sent to the embedded device.
[0053] In a specific embodiment, the above device operates as follows:
[0054] When the device 10 in the local area network does not fail, the device 10 in the local area network and the embedded device 20 (local area network single chip computer) communicate with each other through the local area network; the device 10 in the local area network sends a heartbeat packet indicating the normal operation of the device to the embedded device 20 at intervals (for example, 2s); after a period of time after receiving the heartbeat packet, the embedded device 20 aggregates all the received information to generate a two-dimensional code information; (at this time, the failure is not determined, but the information is transmitted) the next generated two-dimensional code will actively cover the previous two-dimensional code;
[0055] After the QR code is normally generated, the operation and maintenance device 30 receives the normal status information of the device 10 in the local area network by scanning the QR code. The operation and maintenance device 30 parses and converts the received QR code data into binary data and sends it to the server 40. The operation and maintenance device 30 can send the information to the server 40 through the 4G network module. The server 40 determines that it can receive the heartbeat packet data, indicating that there is no fault, and does not send the information to the mobile client.
[0056] If a failure occurs in the device 10 in the local area network, the heartbeat packet will no longer be sent to the embedded device 20, and the QR code displayed by the embedded device 20 will remain unchanged. The operation and maintenance device 30 will not send the same data to the server 40 when receiving the same QR code. The server 40 will determine that the device 10 in the local area network is disconnected because it has not received new data for a long time; and the fault information will be sent to the mobile client for alarm.
[0057] In addition, when the device 10 in the local area network does not send a heartbeat packet to the embedded device 20 for a preset period of time (for example, 3 minutes), the alarm 60 considers that a connection failure occurs in the device 10 in the local area network (ie, the device 10 in the local area network is abnormal), and the alarm sounds an alarm.
[0058] The operation and maintenance device 30 usually uses a wide area network to transmit signals, such as a 4G network, that is, the operation and maintenance device 30 and the server 40 are connected via the wide area network.
[0059] Combination Figure 1 The present application also provides an anomaly detection system 200, comprising: any one of the above-mentioned anomaly detection devices 100 and a device 10 in a local area network, wherein the anomaly detection device is used to detect whether a device in the local area network fails.
[0060] In one embodiment, when the device 10 in the local area network is in the first operating state, the operating state information is sent to the embedded device 20 at intervals; when the device 10 in the local area network is in the second operating state, the sending of operating state information to the embedded device 20 is suspended.
[0061] As can be seen from the above, the abnormality detection equipment and system of the present application can detect whether a device in a local area network has a fault, including an embedded device, which is used to convert the multiple operating status information in the time period into a QR code to be identified and display it when multiple operating status information sent by the device in the local area network in the previous time period is received; and when the operating status information sent by the device in the local area network in the current time period is not received, the QR code to be identified in the previous time period is displayed; an operation and maintenance device, which is used to identify the QR code to be identified, obtain identification information, and send the identification information to a server, and when it is determined that the QR code to be identified in the previous time period is the same as the QR code to be identified in the current time period, no information is sent to the server; a server, which is used to receive the identification information and when it is detected that no information is received for more than a first preset time period, send an abnormal prompt information to the monitoring terminal, and the abnormal prompt information is used to indicate that the device in the local area network has a fault. Since no information is sent to the server when the QR code to be identified in the previous period is the same as the QR code to be identified in the current period, the server determines that a device in the local area network has failed by not receiving information, and thus sends an abnormal prompt message in time, so as to notify the user in time, and then discover the fault in time, so that the user can handle the fault and improve safety.
[0062] Those skilled in the art will readily come up with other embodiments of the present application after considering the specification and practicing the embodiments disclosed herein. The present application is intended to cover any variations, uses or adaptations of the present application, which follow the general principles of the present application and include common knowledge or customary technical means in the art that are not disclosed in the present application.
[0063] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.
Claims
1. An abnormality detection device, characterized in that: Used to detect whether a device in a local area network fails, wherein the abnormality detection device and the device in the local area network communicate with each other through the local area network, including: An embedded device, for converting the multiple operating status information in a period of time into a QR code to be identified and displaying the converted information when multiple operating status information is received from a device in a local area network in a previous period of time; and for displaying the QR code to be identified in the previous period of time when the operating status information is not received from the device in the local area network in the current period of time; wherein the operating status information includes a heartbeat packet; The operation and maintenance device is used to identify the two-dimensional code to be identified, obtain identification information, and send the identification information to the server when it is determined that the two-dimensional code to be identified in the previous period is different from the two-dimensional code to be identified in the current period; and when it is determined that the two-dimensional code to be identified in the previous period is the same as the two-dimensional code to be identified in the current period, do not send information to the server; The server is configured to receive the identification information and, when detecting that no information has been received for more than a first preset time period, send abnormal prompt information to the monitoring terminal, wherein the abnormal prompt information is used to indicate that a device in the local area network has a fault; Wherein, the embedded device comprises: A control module connected to the device in the local area network, the control module is used to convert the multiple operating status information in the time period into a QR code to be identified when receiving multiple operating status information sent by the device in the local area network in the previous time period; and convert the multiple operating status information in the time period into a QR code to be identified when receiving multiple operating status information sent by the device in the local area network in the current time period; A screen connected to the control module, used to display the QR code to be identified in the previous period or the QR code to be identified in the current period; The operation and maintenance device includes a scanner, a judgment module and a processing module; A scanner, whose position corresponds to the position of the screen, and the scanner is used to identify the two-dimensional code to be identified to obtain identification information; A judgment module, connected to the scanner and the processing module respectively, and used to judge whether the two-dimensional code to be identified in the previous time period is the same as the two-dimensional code to be identified in the current time period; A processing module is connected to the server, and the processing module is used for not sending information to the server when it is determined that the QR code to be identified in the previous time period is the same as the QR code to be identified in the current time period, and for sending identification information to the server when it is determined that the QR code to be identified in the previous time period is different from the QR code to be identified in the current time period.
2. The abnormality detection device according to claim 1, characterized in that The operation and maintenance device is specifically used to determine that the QR code to be identified in the previous period is the same as the QR code to be identified in the current period when the embedded device receives the operation status information of the previous period but does not receive the operation status information of the current period.
3. The abnormality detection device according to claim 1, characterized in that: The operation and maintenance device is also used to identify the QR code to be identified in the current time period to obtain identification information when it is determined that the QR code to be identified in the previous time period is different from the QR code to be identified in the current time period; and send the identification information to the server.
4. The abnormality detection device according to claim 3, characterized in that: The operation and maintenance device is specifically used to determine that the QR code to be identified in the previous period is different from the QR code to be identified in the current period when the embedded device receives the operation status information of the previous period and the operation status information of the current period respectively.
5. The abnormality detection device according to claim 3, characterized in that: The embedded device is specifically used to convert multiple pieces of operating status information in the previous period into a first two-dimensional code to be identified when the operating status information in the previous period is received; And when the operation status information of the current period is received, the multiple operation status information in the current period is converted into a second two-dimensional code to be identified; wherein the first two-dimensional code to be identified is different from the second two-dimensional code to be identified.
6. The abnormality detection device according to claim 1, characterized in that The abnormality detection device also includes an alarm, which is connected to the control module and is used to send an alarm signal when it is detected that the embedded device has not received the operating status information within a second preset time period.
7. The abnormality detection device according to claim 1, characterized in that The embedded device is specifically used to receive the operating status information of the device in the local area network when the device in the local area network is in the first operating state; and not receive the operating status information of the device in the local area network when the device in the local area network is in the second operating state.
8. An anomaly detection system, characterized in that: include: The anomaly detection device and the device in the local area network as described in any one of claims 1 to 7, wherein the anomaly detection device is used to detect whether a fault occurs in the device in the local area network.