Device state detection method and apparatus, edge service device, and storage medium

Abstract

The application provides a device state detection method and device, edge service device and storage medium, the method comprises the following steps: obtaining target activity data of an Internet of Things device, the target activity data comprising target log data and target traffic data; determining a behavior density matrix corresponding to the Internet of Things device according to the target activity data; determining a credibility score corresponding to the Internet of Things device according to the behavior density matrix; and determining the current state of the Internet of Things device according to the credibility score. The method is used to solve the defect that the existing state detection method of the Internet of Things device is relatively complex, resulting in the remote service device being unable to effectively and accurately detect the state of the Internet of Things device, and to realize sustainable and accurate detection of the current state of the Internet of Things device, thereby effectively ensuring the security of the Internet of Things device.

Description

Technical Field

[0001] This invention relates to the field of data detection technology, and in particular to a device status detection method, apparatus, edge service device, and storage medium. Background Technology

[0002] In recent years, with the rapid development of new energy sources, the integration of comprehensive energy sources on the load side and the diversification of loads have made the power grid increasingly complex. In the process of power grid digitalization and the development of new power systems, the proportion of IoT devices in the power system is increasing, and the access of these IoT devices also has a certain impact on the stable operation of the power grid.

[0003] Existing methods for detecting the status of IoT devices generally involve a remote service device using relevant information for each IoT device, including device information, authentication information, and resource information, to determine the current status of each device. While this method can effectively reflect the current status of IoT devices, the complexity of the entire status detection process prevents remote service devices from accurately and effectively detecting the status of IoT devices. Summary of the Invention

[0004] This invention provides a device status detection method, apparatus, edge service device, and storage medium to address the shortcomings of existing IoT device status detection methods, which are relatively complex and prevent remote service devices from accurately detecting the status of IoT devices. This invention enables continuous and accurate detection of the current status of IoT devices, thereby effectively ensuring the security of IoT devices.

[0005] This invention provides a device status detection method, comprising:

[0006] Acquire target activity data of IoT devices, including target log data and target traffic data;

[0007] Based on the target activity data, determine the corresponding dense matrix of behaviors for the IoT device;

[0008] Based on this dense matrix, the credibility score corresponding to the IoT device is determined;

[0009] The current status of the IoT device is determined based on this credibility score.

[0010] According to a device status detection method provided by the present invention, the method for determining a dense behavior matrix corresponding to an IoT device based on target activity data includes: determining relationship information based on the target activity data; obtaining a behavior sequence based on the relationship information and a preset embedding matrix; and determining a dense behavior matrix corresponding to the IoT device based on the behavior sequence.

[0011] According to a device status detection method provided by the present invention, the method for acquiring target activity data of an Internet of Things (IoT) device includes: acquiring current activity data of the IoT device, the current activity data including current activity data and current traffic data; parsing the current activity data to obtain a target digital feature vector, and determining intermediate activity data based on the target digital feature vector; and determining target activity data based on the length of the intermediate activity data.

[0012] According to a device status detection method provided by the present invention, the method parses current activity data to obtain a target digital feature vector and determines intermediate activity data based on the target digital feature vector, including: parsing current log data to obtain a first digital feature vector; determining intermediate log data based on the index value corresponding to the first digital feature vector, wherein the index value is an integer greater than or equal to 1; parsing current traffic data to obtain a second digital feature vector; and normalizing the second digital feature vector to obtain intermediate traffic data.

[0013] According to a device status detection method provided by the present invention, determining target activity data based on the length of intermediate activity data includes: when the length of the intermediate activity data reaches a preset length threshold, determining the intermediate activity data as target activity data; when the length does not reach the preset length threshold, supplementing the length, and determining the supplemented intermediate activity data as the target activity data.

[0014] According to a device status detection method provided by the present invention, the method for determining the credibility score corresponding to the IoT device based on the behavior dense matrix includes: obtaining behavior feature information based on the behavior dense matrix using an anomaly detection model; and obtaining the credibility score corresponding to the IoT device based on the behavior feature information.

[0015] According to a device status detection method provided by the present invention, the current status of the Internet of Things (IoT) device is determined based on a confidence score, including: determining the current status of the IoT device as normal when the confidence score is greater than a preset score threshold; and determining the current status of the IoT device as abnormal when the confidence score is less than or equal to the preset score threshold.

[0016] The present invention also provides a device for detecting equipment status, comprising:

[0017] The acquisition module is used to acquire target activity data of IoT devices, which includes target log data and target traffic data.

[0018] The processing module is used to determine the behavior density matrix corresponding to the IoT device based on the target activity data; determine the credibility score corresponding to the IoT device based on the behavior density matrix; and determine the current status of the IoT device based on the credibility score.

[0019] The present invention also provides an edge service device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the device status detection method as described above.

[0020] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the device status detection method as described above.

[0021] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the device status detection method as described above.

[0022] The present invention provides a device status detection method, apparatus, edge service device, and storage medium that acquires target activity data of IoT devices, including target log data and target traffic data. Then, based on the target activity data, a dense behavioral matrix corresponding to the IoT device can be accurately determined. Next, based on the dense behavioral matrix, a trust score corresponding to the IoT device can be accurately determined. Finally, based on the trust score, the current status of the IoT device can be effectively and continuously obtained. This method addresses the shortcomings of existing IoT device status detection methods, which are complex and prevent remote service devices from effectively and accurately detecting the status of IoT devices. It achieves continuous and accurate detection of the current status of IoT devices, thereby effectively ensuring the security of IoT devices. Attached Figure Description

[0023] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0024] Figure 1 This is a schematic diagram of a scenario for the device status detection method provided by the present invention;

[0025] Figure 2 This is one of the flowcharts of the device status detection method provided by the present invention;

[0026] Figure 3 This is a schematic diagram of the anomaly detection model provided by the present invention;

[0027] Figure 4 This is a schematic diagram of a model update scenario provided by the present invention;

[0028] Figure 5 This is the second flowchart of the equipment status detection method provided by the present invention;

[0029] Figure 6a This is a schematic diagram of the system framework of the smart IoT system for power provided by the present invention;

[0030] Figure 6b This is a schematic diagram illustrating the performance of different models provided by this invention on target log data;

[0031] Figure 6c This is a schematic diagram of the detection results obtained by the anomaly detection model provided by the present invention after detecting different devices;

[0032] Figure 7 This is a schematic diagram of the structure of the equipment status detection device provided by the present invention;

[0033] Figure 8 This is a schematic diagram of the edge service device provided by the present invention. Detailed Implementation

[0034] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0035] It should be noted that the edge service device involved in the embodiments of the present invention can be referred to as an edge server, which refers to a device with communication capabilities and computing resources, capable of receiving, extracting, aggregating and storing activity data generated by IoT devices using the local communication interface of the edge service device.

[0036] Activity data, also known as device data, can include log data and traffic data.

[0037] Log data refers to the data generated by the system or application software in IoT devices during operation.

[0038] Traffic data refers to the data generated by IoT devices when they access the Internet or use related data value-added services through mobile communication technology.

[0039] Optionally, mobile communication technologies may include, but are not limited to, one of the following: General Packet Radio Service (GPRS), Enhanced Data Rates for GSM Evolution (EDGE), Time Division-Synchronous Code Division Multiple Access (TD-SCDMA), High Speed ​​Downlink Packet Access (HSDPA), Wideband Code Division Multiple Access (WCDMA), and Long Term Evolution (LTE).

[0040] The IoT devices involved in the embodiments of this invention may include, but are not limited to, computers, cameras, mobile terminals, and wearable devices.

[0041] Edge service devices and IoT devices can be connected via wireless communication technology, which may include, but is not limited to, one of the following: fourth-generation mobile communication technology (4G), fifth-generation mobile communication technology (5G), and Wireless Fidelity (WiFi).

[0042] like Figure 1 The diagram shown is a scenario illustration of the device status detection method provided by this invention. Figure 1 In this configuration, the edge service device 101 connects to at least one IoT device 102. The at least one IoT device 102 sends activity data to the edge service device 102; the edge service device 101 receives the activity data sent by the at least one IoT device 102 and determines the current state of each IoT device 102 based on the activity data.

[0043] Optionally, the current state can be either a normal state or an abnormal state; no specific limitation is made here.

[0044] It should be noted that the execution subject of the embodiments of the present invention can be a device status detection device or an edge service device. The embodiments of the present invention will be further described below using an edge service device as an example.

[0045] like Figure 2 The diagram shown is a flowchart of the device status detection method provided by the present invention, which may include:

[0046] 201. Obtain target activity data of IoT devices.

[0047] The target activity data may include target log data and target traffic data.

[0048] The target activity data refers to log data and traffic data with a uniform format. That is, the data format of the target log data and the data format of the target traffic data are the same.

[0049] If the data format of the current activity data acquired by the edge service device is uniform, then the edge service device can directly use the current activity data as the target activity data; if the data format of the current activity data acquired by the edge service device is not uniform, then the edge service device can standardize the data format of the current activity data to obtain activity data with uniform data format, that is, obtain the target activity data.

[0050] The current activity data can include current log data and current traffic data.

[0051] Generally, data format can include data length. Edge service devices can standardize the length of the current activity data to obtain the target activity data.

[0052] In some embodiments, the edge service device may first send a data acquisition request to the IoT device; then, the IoT device receives the data acquisition request sent by the edge service device; the IoT device acquires its current activity data according to the data acquisition request and sends the current activity data to the edge service device; then, the edge service device receives the current activity data sent by the IoT device; since the data format of the current activity data may be inconsistent, the edge service device performs standardization processing on the current activity data to obtain target activity data with a unified data format.

[0053] In some embodiments, the edge service device may periodically send data acquisition requests to the IoT device so that the edge service device can subsequently periodically determine the current state of the IoT device.

[0054] The request sending cycle can be set before the edge service device leaves the factory, or it can be customized by the user according to the actual situation of the IoT device. The request sending cycle for each IoT device corresponding to the edge service device can be the same or different, and no specific limitation is made here.

[0055] 202. Based on the target activity data, determine the behavior density matrix corresponding to the IoT devices.

[0056] Target activity data is a type of data information. Edge service devices can first remove redundant and interfering information from this data information. Then, the target activity data after removing redundant and interfering information is converted into corresponding speech sequences. That is, the various behavioral sequences in this data information are mapped to a constructed behavior dense matrix. In other words, the edge service device can construct a behavior sequence to detect the behavioral feature information contained in the target activity data. The length of this behavior sequence is N.

[0057] In some embodiments, the edge service device can first perform feature processing on the target activity data to filter out redundant and interfering information, obtaining new target activity data. Then, it can extract the relationship information between the behavioral features contained in the new target activity data so that the edge service device can accurately detect the current state of the IoT device. Then, the edge service device reconstructs the relationship information and obtains a given number of behavioral vectors from a preset embedding matrix based on the relationship information to obtain a behavioral sequence, thereby obtaining the behavior dense matrix corresponding to the IoT device. That is, the edge service device can map the relationship information onto the behavior dense matrix.

[0058] In some embodiments, the edge service device can input target activity data into the mapping layer of the anomaly detection model that processes heterogeneous data to obtain the behavior dense matrix of the IoT device output by the mapping layer.

[0059] Edge service devices can first use target activity data as input data for anomaly detection models. Based on the three dilated convolutional layers in the mapping layer, they can extract the relational information of the target activity data in different dimensions. The receptive field of view of these three dilated convolutional layers is different.

[0060] Among them, the dilated convolutional layer, also known as the dilated convolutional layer, differs from the traditional convolutional kernel in that it incorporates holes, allowing the anomaly detection model to have a larger receptive field. The three dilated convolutional layers mentioned above correspond to different kernel sizes, with the number of kernels and the degree of dilation increasing sequentially.

[0061] After the target activity data passes through these three dilated convolutional layers, the anomaly detection model obtains a relational feature tensor with a shape of batch_size × N × kernel_quantity. Here, N represents the number of behavior vectors in the behavior matrix, i.e., the length of the behavior sequence; kernel_quantity represents the number of convolutional kernels in the previous dilated convolutional layer, i.e., the number of behavior vectors contained in the preset embedding matrix.

[0062] Then, the edge service device uses the normalization exponent (Softmax) function to perform one-hot encoding based on the dimension corresponding to kernel_quantity in the relation feature tensor, and uses the position of the maximum value to represent the dimension. This results in a mapping tensor with shape batch_size×N×1. This mapping tensor can be used to obtain the behavior vector corresponding to the encoding from the preset embedding matrix, thereby obtaining a behavior dense matrix with shape batch_size×N×Embedding_size.

[0063] The dense matrix of behaviors can include behavioral feature information from the target activity data.

[0064] 203. Determine the credibility score corresponding to the IoT device based on the dense behavior matrix.

[0065] The credibility score refers to the degree of risk that IoT devices may pose.

[0066] In some embodiments, the edge service device can extract behavior vectors from the acquired behavior density matrix and perform detection and evaluation of the current state of the IoT device based on the behavior vectors, so as to accurately obtain the evaluation results and thus accurately obtain the credibility score.

[0067] Optionally, the behavior vector can be a normal behavior vector or an abnormal behavior vector; no specific limitation is made here.

[0068] In some embodiments, the edge service device obtains the credibility score corresponding to the IoT device based on the analysis layer in the anomaly detection model according to the behavior density matrix.

[0069] In this process, the edge service device first inputs the behavior dense matrix into the analysis layer. Then, three convolutional layers with different receptive field sizes within this analysis layer convolve the behavior dense matrix to obtain the behavioral feature information within it. These three convolutional layers with different receptive field sizes have convolution kernels of different sizes, allowing for the extraction of dimensional information from different fields of view within the behavior dense matrix, thereby obtaining more comprehensive and accurate behavioral feature information.

[0070] Then, the edge service device concatenates the behavioral feature information from the outputs of these three different convolutional layers to obtain the target feature vector. Next, the edge service device inputs the target feature vector into the fully connected layer and the sigmoid layer in the anomaly detection model for processing. Finally, the output result can be accurately obtained, that is, the credibility score corresponding to the IoT device can be accurately obtained.

[0071] For example, such as Figure 3The diagram shown is a structural schematic of the anomaly detection model provided by this invention. Figure 3 The anomaly detection model comprises a mapping layer, an analysis layer, a fully connected layer, and a sigmoid layer. The mapping layer includes three dilated convolutional layers: Conv_dx1, Conv_dx2, and Conv_dx3. The analysis layer includes three convolutional layers: Conv1, Conv2, and Conv3. This anomaly detection model for processing heterogeneous data can effectively and comprehensively learn the behavioral characteristics of different IoT devices.

[0072] Optionally, after step 203, the method may also be implemented in at least one of the following ways:

[0073] Implementation Method 1: The edge service device stores the IoT device and its corresponding credibility score in the anomaly detection model, so that the edge service device can continuously and in real time detect the security of other IoT devices.

[0074] Optionally, the edge service device may store the IoT device and its corresponding credibility score in the anomaly detection model, which may include: the edge service device storing the IoT device and its corresponding credibility score in the anomaly detection model in the form of key-value pairs.

[0075] Here, key-value pairs refer to the corresponding credibility scores obtained based on IoT devices.

[0076] Implementation Method 2: The edge service device sends the anomaly detection model to the remote service device.

[0077] A remote service device, also known as a remote server, is capable of connecting to at least one edge service device.

[0078] For example, such as Figure 4 The image shown is a schematic diagram of a model update scenario provided by this invention. Figure 4 In the process, the remote service device 401 can connect to at least one edge service device 101, and each edge service device 101 can connect to at least one IoT device 102.

[0079] The target edge service device 101 updates its anomaly detection model based on target activity data received from at least one IoT device 102, and sends the updated anomaly detection model to the remote service device 401. The remote service device 401 receives at least one updated anomaly detection model and performs mean aggregation on these models to obtain a global model. Then, the remote service device 401 distributes the global model to each edge service device 101. Next, the target edge service device 101 receives the global model sent by the remote service device 401 and updates its anomaly detection model based on the global model. The target edge service device is any one of the at least one edge service devices mentioned above.

[0080] This iterative process not only expands the data samples used during anomaly detection model training but also allows for real-time updates to the global model and each anomaly detection model. This fully utilizes the computing power of the edge service device 101, effectively reducing its communication and computational costs. Furthermore, since the distance between the edge service device 101 and the IoT device 102 is less than the distance between the remote service device 401 and the IoT device 102, the transmission latency of the target activity data is effectively reduced, thereby improving the transmission efficiency of that data.

[0081] Optionally, the algorithm for model update training is as follows: input parameters are: mean aggregation, ω0, Set i , and D i .

[0082] Where ω0 represents the initial parameters of the global model; Set i Indicates at least one edge service device; Indicates in Set i The model update obtained by the i-th edge service device in the (t+1)th iteration; D i Let represent the target activity dataset in the i-th edge service device.

[0083] The entire training process is as follows: Initialize ω0;

[0084]

[0085] 204. Determine the current status of IoT devices based on the credibility score.

[0086] Optionally, the edge service device determines the current state of the IoT device based on the credibility score, which may include: if the credibility score is greater than a preset score threshold, the edge service device determines the current state of the IoT device as normal; if the credibility score is less than or equal to the preset score threshold, the edge service device determines the current state of the IoT device as abnormal.

[0087] The preset score threshold can be set before the edge service device leaves the factory, or it can be customized by the user based on a large amount of experimental data; no specific limitation is made here.

[0088] It should be noted that the edge service device determines whether to continue to trust an IoT device based on a trust score. A higher trust score indicates better security for the IoT device, in which case the edge service device can continue to trust it. Conversely, a lower trust score indicates a greater likelihood that the IoT device has been compromised or hijacked, meaning its security is worse, and in which case the edge service device will no longer trust it.

[0089] Optionally, after the edge service device determines that the current state of the IoT device is abnormal, the method may further include: the edge service device outputting a warning message.

[0090] Optionally, after step 204, the method may further include: the edge service device sending the current status of the IoT device to the IoT device.

[0091] The IoT device receives the current status sent by the edge service device and processes it accordingly. If the current status is normal, the IoT device operates normally; if the current status is abnormal, the IoT device should take appropriate measures to bring it back to normal.

[0092] In some embodiments, since the edge service device can periodically acquire the current state of the IoT device, it can be demonstrated that the edge service device is capable of reliably detecting the continuous behavior of the IoT device.

[0093] In this embodiment of the invention, target activity data of an IoT device is acquired, including target log data and target traffic data. Then, based on this target activity data, a dense behavioral matrix corresponding to the IoT device can be accurately determined. Next, based on this dense behavioral matrix, a credibility score corresponding to the IoT device can be accurately determined. Finally, based on the credibility score, the current state of the IoT device can be effectively and continuously obtained. This method addresses the shortcomings of existing IoT device state detection methods, which are complex and prevent remote service devices from effectively and accurately detecting the state of IoT devices. It achieves continuous and accurate detection of the current state of IoT devices, thereby effectively ensuring the security of IoT devices.

[0094] like Figure 5 The diagram shown is a flowchart of the device status detection method provided by the present invention, which may include:

[0095] 501. Obtain the current activity data of IoT devices.

[0096] The current activity data can include current activity data and current traffic data.

[0097] The data format for current activities is inconsistent.

[0098] 502. Analyze the current activity data to obtain the target number feature vector, and determine the intermediate activity data based on the target number feature vector.

[0099] Because the current activity data is not in a standardized format, and the edge service device has not standardized the current activity data, the intermediate activity data obtained by the edge service device based on the current activity data is also not in a standardized format.

[0100] Intermediate activity data can include intermediate log data and intermediate traffic data. That is, the data format of the intermediate log data is not the same as that of the intermediate traffic data.

[0101] Optionally, the edge service device parses the current activity data to obtain a target digital feature vector, and determines intermediate activity data based on the target digital feature vector. This may include: the edge service device parses the current log data to obtain a first digital feature vector; the edge service device determines the intermediate log data based on the index value corresponding to the first digital feature vector, where the index value is an integer greater than or equal to 1; the edge service device parses the current traffic data to obtain a second digital feature vector; and the edge service device normalizes the second digital feature vector to obtain intermediate traffic data.

[0102] Here, the first digital feature vector refers to the event sequence corresponding to the intermediate log data, and the index value corresponding to the first digital feature vector refers to the vector element corresponding to the event sequence. This vector element is a non-negative integer. That is to say, the edge service device can map the first digital feature vector to the non-negative integer field [1, +∞) to obtain a sequence vector whose elements represent events.

[0103] In addition, the edge service device can also map the second digital feature vector into the fractional domain [0, 1] to obtain intermediate traffic data.

[0104] Optionally, the timing of edge service devices acquiring intermediate log data and intermediate traffic data is not limited.

[0105] In summary, since the value range corresponding to the current log data is different from the value range corresponding to the current traffic data, the edge service device can accurately determine whether the intermediate activity data corresponding to the current activity data is intermediate log data or intermediate traffic data based on the numerical feature vector corresponding to the current activity data and the value range of the corresponding numerical feature vector.

[0106] 503. Determine the target activity data based on the length of the intermediate activity data.

[0107] Because the data format of intermediate activity data is not uniform, edge service devices can process the length of the intermediate activity data to obtain target activity data with a uniform data format.

[0108] Optionally, the edge service device determines the target activity data based on the length of the intermediate activity data, which may include: if the length of the intermediate activity data reaches a preset length threshold, the edge service device determines the intermediate activity data as the target activity data; if the length does not reach the preset length threshold, the edge service device supplements the length and determines the intermediate activity data with the supplemented length as the target activity data.

[0109] The preset length threshold is determined based on the length of intermediate log data and the length of intermediate traffic data.

[0110] Optionally, if the length of the intermediate activity data reaches a preset length threshold, the edge service device determines the intermediate activity data as the target activity data; if the length does not reach the preset length threshold, the edge service device supplements the length and determines the intermediate activity data with the supplemented length as the target activity data. This may include: the edge service device obtaining the valid data corresponding to the intermediate activity data according to a data formula; and the edge service device determining the target activity data according to a target formula.

[0111] The data formulas are S = D and D = D. logOr, D = D traffic ;

[0112] The target formula is D input ∈R L ;

[0113] D represents intermediate activity data, D log D represents intermediate log data. traffic S represents intermediate traffic data; S represents the valid data corresponding to intermediate activity data D.

[0114] D input Represents target activity data; len s L represents the length of the valid data S; L = Max(len) log len traffic ), where len represents the length of the input vector. log Indicates intermediate log data D log The length, len traffic Indicates intermediate flow data D traffic Length; Padding(L-len) s ) indicates a length of L-len s Zero-filled fields; R L Represents target activity data D input The corresponding dimension.

[0115] Edge service devices can transmit intermediate log data D log Length and intermediate flow data D traffic The larger of the lengths is determined as the preset length threshold; then, the edge service device can accurately obtain the target activity data according to the target formula, so that the edge service device can effectively and accurately obtain the relationship information of the IoT devices based on the target activity data.

[0116] 504. Determine relationship information based on target activity data.

[0117] Optionally, the edge service device determines the relationship information based on the target activity data, which may include: the edge service device obtaining the relationship information according to the extraction formula.

[0118] The extraction formula is R. Dinput =Extarctor(D input ),

[0119] R Dinput Represents relational information, Size words Representing relational information R Dinput The length of the word vector; Representing relational information RDinput The corresponding two-dimensional dimension.

[0120] Edge service devices can effectively and accurately obtain the relationship information corresponding to IoT devices based on the extraction formula.

[0121] 505. Based on the relational information and the preset embedding matrix, the behavior sequence is obtained.

[0122] Optionally, the edge service device obtains a behavior sequence based on the relationship information and a preset embedding matrix, which may include: the edge service device obtaining an intermediate quantity according to a first formula; the edge service device obtaining a behavior vector index according to a second formula; and the edge service device obtaining a behavior sequence according to a third formula.

[0123] The first formula is:

[0124]

[0125]

[0126] The second formula is

[0127] Index i ∈[1, ..., Size words ];

[0128] The third formula is

[0129] I i =M relation ,

[0130] SoftMax(R Dinput ) = Soft Dinput , indicating an intermediate quantity; Representing relational information R Dinput The word vector in the j-th row and i-th column; Argmax(Soft Dinput ) = Soft Dinput This indicates that the edge service device selects the intermediate quantity Soft based on the maximum value principle. Dinput The behavior index value corresponding to the behavior vector obtained from the data; Index i This represents the i-th index value corresponding to the i-th length in the word vector; Embedding(M relation A Dinput ) represents a sequence of actions; M relation Represents the preset embedding matrix; I i M represents the preset embedding matrix. relation The i-th behavior vector; FL represents the dimension of behavior vector I; M represents the preset embedding matrix. relation The corresponding two-dimensional dimension.

[0131] Edge service devices can effectively and accurately obtain the behavior sequence corresponding to IoT devices based on the first, second, and third formulas.

[0132] 506. Based on the behavior sequence, determine the behavior density matrix corresponding to the IoT device.

[0133] Optionally, the edge service device determines the behavior density matrix corresponding to the IoT device based on the behavior sequence, which may include: the edge service device obtaining the behavior density matrix corresponding to the IoT device according to the fourth formula.

[0134] The fourth formula is

[0135] M behavior =Embedding(Argmax(Softmax(Extarctor(D input )))),

[0136] M behavior ∈R N×FL ;

[0137] M behavior R represents a dense matrix. N×FL M represents a dense matrix of behavior behavior The corresponding two-dimensional dimension.

[0138] According to the fourth formula, edge service devices can effectively and accurately obtain the dense matrix of behaviors corresponding to IoT devices.

[0139] 507. Based on the anomaly detection model, behavioral feature information is obtained from the dense behavioral matrix.

[0140] In some embodiments, the edge service device can input target activity data into the mapping layer in the anomaly detection model to obtain the behavior dense matrix corresponding to the IoT device output by the mapping layer.

[0141] Edge service devices process target activity data in three dilated convolutional layers of the mapping layer to accurately obtain behavioral feature information contained in the behavior dense matrix.

[0142] 508. Based on behavioral characteristic information, obtain the credibility score corresponding to the IoT device.

[0143] In some embodiments, the edge service device can input target activity data into the analysis layer of the anomaly detection model to obtain the credibility score of the IoT device output by the analysis layer.

[0144] Edge service devices process behavioral feature information in three convolutional layers of the analysis layer, which can accurately obtain the credibility score of the IoT device.

[0145] It should be noted that steps 507-508- Figure 2 Steps 202-203 shown are similar and will not be described in detail here.

[0146] 509. Determine the current status of IoT devices based on the credibility score.

[0147] It should be noted that step 509 and Figure 2 Step 204 is similar and will not be described in detail here.

[0148] In some embodiments, edge service devices can be located within a smart power IoT system, playing a significant role in the continuous and stable operation of the power grid.

[0149] like Figure 6a The diagram shown is a schematic representation of the system framework of the smart power IoT system provided by this invention. Figure 6a In the power smart IoT system 60, the system framework may include a perception layer 601, a network layer 602, a platform layer 603, and an application layer 604, etc.

[0150] At least one edge service device 101 is provided in the perception layer 601, a communication network and an IoT gateway may be provided in the network layer 602, a power IoT management platform may be provided in the platform layer 603, and power IoT application services may be provided in the application layer 604.

[0151] In some embodiments, the edge service device can conduct simulation experiments on the device status detection method. The edge service device acquires a simulation dataset, which may include: a Hadoop Distributed File System (DFS) dataset (HDFS for short) and an open-source IoT device network dataset (N-BaloT) dataset. The HDFS dataset can be used to simulate target log data, and the N-BaloT dataset can be used to simulate target traffic data.

[0152] Then, the edge service device uses the anomaly detection model to perform simulation evaluation on the simulation dataset. As shown in Table 1, the anomaly detection model provided by this invention performs well on the simulation dataset.

[0153] Table 1:

[0154]

[0155] As shown in Table 1, the traffic detection performance metrics of the anomaly detection model can include Accuracy, Precision, Recall, and F1-Score. Accuracy reaches 99.614%, Precision reaches 99.639%, Recall reaches 98.956%, and F1-Score reaches 99.296%.

[0156] In other words, the anomaly detection model exhibits superior detection performance for target traffic data from IoT devices. Furthermore, this anomaly detection model can also effectively detect target log data from IoT devices, yielding log detection performance metrics. Compared to traffic detection performance metrics, the main difference in log detection performance metrics lies in precision. The precision of the log detection performance metrics is 80.000%, lower than that of the traffic detection performance metrics. However, the accuracy of the log detection performance metrics is 99.471%, similar to the 99.614% of the traffic detection performance metrics. Similarly, the recall of the log detection performance metrics is 98.418%, similar to the 98.956% of the traffic detection performance metrics. The F1-Score of the log detection performance metrics is 88.258%, while that of the traffic detection performance metrics is 99.296%.

[0157] The device status detection method provided by this invention can effectively complete the security protection task of IoT devices. This method can not only use target log data to detect abnormal behaviors that may exist in the data generated by IoT devices in problem scenarios, but also use target traffic data to detect abnormal communication behaviors that exist in the communication process between edge service devices and IoT devices.

[0158] In some embodiments, since the log detection performance index of the anomaly detection model for the target log data is weaker than the traffic detection performance index of the anomaly detection model for the target traffic data, in order to further evaluate the log detection performance index of the anomaly detection model for the target log data, other detection models can be used to detect the target log data to obtain a first performance index, and the first performance index can be compared with the log detection performance index.

[0159] Optionally, the additional detection module may include the LightLog model.

[0160] For example, such as Figure 6b The diagram shown illustrates the performance of different models provided by this invention on target log data. Figure 6bAs can be seen, although the anomaly detection model is inferior to the LightLog model in terms of precision, its recall is significantly higher. Furthermore, the accuracy of this anomaly detection model is similar to that of the LightLog model; its F1-Score of 88.258% is higher than the LightLog model's F1-Score of 76.892%.

[0161] In some embodiments, the edge service device can use the anomaly detection module to evaluate the detection performance of target traffic data of different IoT devices. As shown in Table 2, the anomaly detection model provided by the present invention performs well on target traffic data.

[0162] Table 2:

[0163]

[0164] Among these nine devices, the relevant device model parameters for each device are as follows: First device: SIMPLEHOME_XCS7_1003_WHT_SECURITY_CAMERA;

[0165] Second device: Provision_PT_838_Security_Camera;

[0166] Third device: Ennio_Doorbell;

[0167] Fourth device: Philips_B120N10_Baby_Monitor;

[0168] Fifth device: Provision_PT_737E_Security_Camera;

[0169] Sixth device: Ecobee_Thermostat;

[0170] Seventh device: Samsung_SNH_1011_N_Webcam;

[0171] Eighth device: Danmini_Doorbell;

[0172] Ninth device: SimpleHome_XCS7_1002_WHT_Security_Camera.

[0173] For example, such as Figure 6cThe diagram shown is a schematic of the detection results obtained by the anomaly detection model provided by this invention after detecting different devices. Figure 6c As can be seen from Table 2, the anomaly detection model performs better in all performance indicators for detecting target traffic data from various devices, and can achieve a high degree of accuracy while having a low false alarm rate.

[0174] Based on the analysis results obtained from the above simulation experiments, it can be concluded that the detection performance indicators of edge service devices when using anomaly detection models to detect target activity data are all superior, thus enabling effective detection of the current state of IoT devices.

[0175] In this embodiment of the invention, current activity data of an IoT device is acquired, including current log data and current traffic data. This current activity data is parsed to obtain a target numerical feature vector. Based on the target numerical feature vector, intermediate activity data is determined. Since the intermediate activity data has an inconsistent format, it needs to be standardized according to its length to obtain a target activity with a uniform data format. Then, based on the target activity data, the corresponding behavior density matrix of the IoT device can be accurately determined. Next, based on an anomaly detection model and the behavior density matrix, the credibility score corresponding to the IoT device can be accurately and continuously obtained. Finally, based on the credibility score, the current state of the IoT device can be effectively and continuously obtained. This method addresses the shortcomings of existing IoT device state detection methods, which are complex and prevent remote service devices from accurately detecting the state of IoT devices. It achieves continuous and accurate detection of the current state of IoT devices, thereby effectively ensuring the security of IoT devices.

[0176] The equipment status detection device provided by the present invention is described below. The equipment status detection device described below and the equipment status detection method described above can be referred to in correspondence.

[0177] like Figure 7 The diagram shown is a structural schematic of the equipment status detection device provided by the present invention, which may include:

[0178] The acquisition module 701 is used to acquire target activity data of IoT devices, which includes target log data and target traffic data.

[0179] The processing module 702 is used to determine the behavior density matrix corresponding to the IoT device based on the target activity data; determine the credibility score corresponding to the IoT device based on the behavior density matrix; and determine the current status of the IoT device based on the credibility score.

[0180] Optionally, the processing module 702 is specifically used to determine relationship information based on the target activity data; obtain a behavior sequence based on the relationship information and a preset embedding matrix; and determine the behavior density matrix corresponding to the IoT device based on the behavior sequence.

[0181] Optionally, the acquisition module 701 is specifically used to acquire the current activity data of the IoT device, which includes current activity data and current traffic data;

[0182] The processing module 702 is specifically used to parse the current activity data to obtain the target digital feature vector, and determine the intermediate activity data based on the target digital feature vector; and determine the target activity data based on the length of the intermediate activity data.

[0183] Optionally, the processing module 702 is specifically used to parse the current log data to obtain a first digital feature vector; determine intermediate log data based on the index value corresponding to the first digital feature vector, wherein the index value is an integer greater than or equal to 1; parse the current traffic data to obtain a second digital feature vector; and normalize the second digital feature vector to obtain intermediate traffic data.

[0184] Optionally, the processing module 702 is specifically used to determine the intermediate activity data as the target activity data when the length of the intermediate activity data reaches a preset length threshold; and to supplement the length when the length does not reach the preset length threshold, and to determine the intermediate activity data after the supplemented length as the target activity data.

[0185] Optionally, the processing module 702 is specifically used to obtain behavioral feature information based on the anomaly detection model and the dense matrix of the behavior; and to obtain the credibility score corresponding to the IoT device based on the behavioral feature information.

[0186] Optionally, the processing module 702 is specifically used to determine the current state of the IoT device as normal when the credibility score is greater than a preset score threshold, and to determine the current state of the IoT device as abnormal when the credibility score is less than or equal to the preset score threshold.

[0187] Figure 8 An example is a schematic diagram of the physical structure of an edge service device, such as... Figure 8As shown, the edge service device may include a processor 810, a communications interface 820, a memory 830, and a communication bus 840. The processor 810, communications interface 820, and memory 830 communicate with each other via the communication bus 840. The processor 810 can call logical instructions in the memory 830 to execute a device status detection method. This method includes: acquiring target activity data of the IoT device, including target log data and target traffic data; determining a dense behavioral matrix corresponding to the IoT device based on the target activity data; determining a trust score corresponding to the IoT device based on the dense behavioral matrix; and determining the current status of the IoT device based on the trust score.

[0188] Furthermore, the logical instructions in the aforementioned memory 830 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, essentially, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0189] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the device status detection method provided by the above methods. The method includes: acquiring target activity data of an IoT device, the target activity data including target log data and target traffic data; determining a behavior density matrix corresponding to the IoT device based on the target activity data; determining a credibility score corresponding to the IoT device based on the behavior density matrix; and determining the current status of the IoT device based on the credibility score.

[0190] In another aspect, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the device status detection method provided by the methods described above. The method includes: acquiring target activity data of an IoT device, the target activity data including target log data and target traffic data; determining a behavior density matrix corresponding to the IoT device based on the target activity data; determining a credibility score corresponding to the IoT device based on the behavior density matrix; and determining the current status of the IoT device based on the credibility score.

[0191] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0192] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0193] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for detecting equipment status, characterized in that, include: Acquire target activity data of IoT devices, wherein the target activity data includes target log data and target traffic data; The target activity data is input into the mapping layer of the anomaly detection model. Multiple dilated convolutional layers in the mapping layer extract the relationship information of the target activity data in different dimensions. Based on the preset embedding matrix, the behavior dense matrix corresponding to the IoT device is obtained. The behavior dense matrix includes the behavior feature information in the target activity data. The behavior dense matrix is ​​input into the analysis layer of the anomaly detection model. The behavior dense matrix is ​​convolved by multiple convolutional layers with different receptive field sizes in the analysis layer to extract the behavior feature information in the behavior dense matrix. The result is concatenated to obtain the target feature vector. The target feature vector is then input into the fully connected layer and the sigmoid function layer of the anomaly detection model for processing to obtain the credibility score corresponding to the IoT device. The current status of the IoT device is determined based on the credibility score.

2. The method according to claim 1, characterized in that, The step of determining the dense behavior matrix corresponding to the IoT device based on the target activity data includes: Based on the target activity data, determine the relationship information; Based on the relationship information and a preset embedding matrix, a behavior sequence is obtained; Based on the behavior sequence, a dense matrix of behaviors corresponding to the IoT device is determined.

3. The method according to claim 1, characterized in that, The acquisition of target activity data of IoT devices includes: Obtain current activity data of IoT devices, wherein the current activity data includes current activity data and current traffic data; The current activity data is parsed to obtain the target number feature vector, and intermediate activity data is determined based on the target number feature vector; The target activity data is determined based on the length of the intermediate activity data.

4. The method according to claim 3, characterized in that, The step of parsing the current activity data to obtain a target numerical feature vector, and determining intermediate activity data based on the target numerical feature vector, includes: The current log data is parsed to obtain a first digital feature vector; The intermediate log data is determined based on the index value corresponding to the first digital feature vector, wherein the index value is an integer greater than or equal to 1; The current traffic data is parsed to obtain a second digital feature vector; The second digital feature vector is normalized to obtain intermediate flow data.

5. The method according to claim 3 or 4, characterized in that, The step of determining the target activity data based on the length of the intermediate activity data includes: If the length of the intermediate activity data reaches a preset length threshold, the intermediate activity data is determined as the target activity data. If the length does not reach the preset length threshold, the length is supplemented, and the intermediate activity data after the supplemented length is determined as the target activity data.

6. The method according to any one of claims 1-4, characterized in that, The step of determining the credibility score corresponding to the IoT device based on the dense behavior matrix includes: Based on the anomaly detection model, behavioral feature information is obtained according to the behavioral density matrix; Based on the behavioral characteristic information, a credibility score is obtained for the IoT device.

7. The method according to any one of claims 1-4, characterized in that, Determining the current state of the IoT device based on the credibility score includes: If the credibility score is greater than a preset score threshold, the current state of the IoT device is determined to be a normal state. If the credibility score is less than or equal to the preset score threshold, the current state of the IoT device is determined to be an abnormal state.

8. A device for detecting equipment status, characterized in that, include: The acquisition module is used to acquire target activity data of IoT devices, including target log data and target traffic data. The processing module is used to input the target activity data into the mapping layer of the anomaly detection model, extract the relationship information corresponding to the target activity data in different dimensions through multiple dilated convolutional layers in the mapping layer, and obtain the behavior dense matrix corresponding to the IoT device based on a preset embedding matrix. The behavior dense matrix includes the behavior feature information in the target activity data. The behavior dense matrix is ​​then input into the analysis layer of the anomaly detection model, and convolved with multiple convolutional layers of different receptive field sizes in the analysis layer to extract the behavior feature information in the behavior dense matrix. The concatenation is then used to obtain a target feature vector, which is input into the fully connected layer and the sigmoid function layer of the anomaly detection model for processing to obtain the credibility score corresponding to the IoT device. Based on the credibility score, the current state of the IoT device is determined.

9. An edge service device, comprising: A memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, when the processor executes the program, it implements the device state detection method as described in any one of claims 1 to 7.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the device status detection method as described in any one of claims 1 to 7.

Images