Iot device anomaly detection method, apparatus, device, and storage medium

Abstract

The present application belongs to the technical field of Internet of Things, and discloses an Internet of Things equipment anomaly detection method, device, equipment and storage medium. The present application determines a target Internet of Things equipment according to an equipment detection instruction when detecting the equipment detection instruction; sends a preset parameter collection instruction to the target Internet of Things equipment, so that the target Internet of Things equipment feeds back running parameters of a preset dimension based on the preset parameter collection instruction; and performs anomaly detection on the target Internet of Things equipment based on the running parameters of the preset dimension through a preset anomaly detection model to obtain an anomaly detection result. Since the preset anomaly detection model is a neural network model trained by a training sample set constructed in advance according to historical running parameters, the anomaly cause of the Internet of Things equipment can be quickly located according to the collected running parameters of the preset dimension, without a large amount of manual cost, and since the collected running parameters have a large dimension, the running state of the Internet of Things equipment can be fully reflected, so that the comprehensiveness of anomaly detection can be ensured.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of Internet of Things, and in particular to an Internet of Things device anomaly detection method, device, equipment and storage medium. BACKGROUND

[0002] In recent years, with the continuous development of the application field of Internet of Things, the number of Internet of Things devices (also known as Internet of Things terminals or Internet of Things terminal devices) is becoming larger and larger, and how to efficiently and accurately find terminal faults or environmental interference has become a new challenging problem. In the application of Internet of Things, the abnormality of Internet of Things devices may be caused by terminal configuration, network congestion, terminal network residence, etc., resulting in the inability of Internet of Things devices to be used normally. In order to accurately determine the fault reason of Internet of Things devices and locate the fault node, the prior art mainly adopts the method of monitoring the voltage and current of Internet of Things devices to determine whether the Internet of Things devices are abnormal or adopts the manual duty mode (duty personnel gradually analyze the terminal fault node by observing the terminal state and various monitoring system indicators) to determine the fault reason. However, only by voltage and current can the abnormality of Internet of Things devices be determined, and the terminal software and hardware information, parameter configuration, networking state and other running states cannot be detected, and the detection is not comprehensive. In addition, the manual duty mode needs to consume a large amount of manpower, and due to the subjectivity of human beings, there will be certain deviation.

[0003] The above content is only used to assist in understanding the technical solutions of the present application and does not represent the acknowledgement of the above content as prior art. SUMMARY

[0004] The main purpose of the present application is to provide an Internet of Things device anomaly detection method, device, equipment and storage medium, which aims to solve the technical problem that the prior art cannot efficiently and accurately find terminal anomalies.

[0005] In order to achieve the above-mentioned purpose, the present application provides an Internet of Things device anomaly detection method, which comprises the following steps:

[0006] When a device detection instruction is detected, a target Internet of Things device is determined according to the device detection instruction;

[0007] A preset parameter collection instruction is sent to the target Internet of Things device, so that the target Internet of Things device feeds back running parameters of a preset dimension based on the preset parameter collection instruction;

[0008] Based on the running parameters of the preset dimension, an anomaly detection model is used to detect the target Internet of Things device to obtain an anomaly detection result.

[0009] Optionally, before the step of detecting a device detection instruction and determining a target Internet of Things device according to the device detection instruction, the method further comprises the steps of:

[0010] obtaining a data sample set constructed according to historical running parameters of different Internet of Things devices;

[0011] constructing a label training set, a label verification set and a label-free training set according to the data sample set;

[0012] training a plurality of initial neural network models according to the label training set respectively to obtain a plurality of target neural network models;

[0013] model verification is performed on each target neural network model through the label verification set;

[0014] When each target neural network model passes the model verification, the target neural network model is trained according to the label-free training set, and a preset anomaly detection model is constructed according to the trained target neural network model.

[0015] Optionally, the step of constructing a label training set, a label verification set and a label-free training set according to the data sample set comprises:

[0016] normalizing feature data of each data sample in the data sample set according to a preset normalization algorithm to obtain a normalized sample set;

[0017] segmenting the normalized sample set according to a preset sample segmentation rule to obtain a label training set, a label verification set and a label-free training set.

[0018] Optionally, before the step of normalizing feature data of each data sample in the data sample set according to a preset normalization algorithm to obtain a normalized sample set, the method further comprises:

[0019] performing feature cleaning on each data sample in the data sample set to obtain a pure sample set;

[0020] Correspondingly, the step of normalizing feature data of each data sample in the data sample set according to a preset normalization algorithm to obtain a normalized sample set comprises:

[0021] normalizing feature data of each data sample in the pure sample set according to a preset normalization algorithm to obtain a normalized sample set.

[0022] Optionally, before the step of segmenting the normalized sample set according to a preset sample segmentation rule to obtain a label training set, a label verification set and a label-free training set, the method further comprises:

[0023] completing missing data of each data sample in the normalized sample set by a preset completion value to obtain a completed sample set;

[0024] Accordingly, the step of segmenting the normalized sample set according to a preset sample segmentation rule to obtain a labeled training set, a labeled validation set, and an unlabeled training set comprises:

[0025] Segmenting the complete sample set according to a preset sample segmentation rule to obtain a labeled training set, a labeled validation set, and an unlabeled training set.

[0026] Optionally, the step of training the target neural network model according to the unlabeled training set when each target neural network model passes the model validation, and constructing a preset anomaly detection model according to the trained target neural network model comprises:

[0027] When each target neural network model passes the model validation, traversing the unlabeled training set;

[0028] Inputting the traversed current unlabeled training sample into each target neural network model for sample classification, and selecting a target training model from the target neural network model according to the sample classification result;

[0029] According to the current unlabeled training sample, constructing an extended sample set corresponding to the target training model, and training the target training model through the extended sample set;

[0030] If it is detected that the trained target training model does not converge, or there is a model that does not converge in the target neural network model other than the target training model, returning to the step of inputting the traversed current unlabeled training sample into each target neural network model for sample classification, and selecting a target training model from the target neural network model according to the sample classification result;

[0031] If it is detected that each target neural network model has been trained to converge, stopping traversing the unlabeled training set, and constructing a preset anomaly detection model according to the target neural network model that has been trained to converge.

[0032] Optionally, the step of inputting the traversed current unlabeled training sample into each target neural network model for sample classification, and selecting a target training model from the target neural network model according to the sample classification result comprises:

[0033] Inputting the traversed current unlabeled training sample into each target neural network model for sample classification to obtain a plurality of sample classification results;

[0034] Taking the sample classification result that is different from other sample classification results as a target classification result;

[0035] The target neural network model corresponding to the target classification result is taken as a target training model.

[0036] In addition, to achieve the above object, the application further provides an Internet of Things device anomaly detection device, which comprises the following modules:

[0037] An instruction response module is configured to determine a target Internet of Things device according to the device detection instruction when the device detection instruction is detected.

[0038] A parameter acquisition module is configured to send a preset parameter acquisition instruction to the target Internet of Things device, so that the target Internet of Things device feeds back running parameters of a preset dimension based on the preset parameter acquisition instruction.

[0039] An anomaly detection module is configured to perform anomaly detection on the target Internet of Things device based on the running parameters of the preset dimension through a preset anomaly detection model, so as to obtain an anomaly detection result.

[0040] In addition, to achieve the above object, the application further provides an Internet of Things device anomaly detection device, which comprises a processor, a memory and an Internet of Things device anomaly detection program stored in the memory and executable on the processor, and the steps of the Internet of Things device anomaly detection method are implemented when the Internet of Things device anomaly detection program is executed by the processor.

[0041] In addition, to achieve the above object, the application further provides a computer readable storage medium, which stores an Internet of Things device anomaly detection program, and the steps of the Internet of Things device anomaly detection method are implemented when the Internet of Things device anomaly detection program is executed.

[0042] The application determines a target Internet of Things device according to a device detection instruction when the device detection instruction is detected, sends a preset parameter acquisition instruction to the target Internet of Things device, so that the target Internet of Things device feeds back running parameters of a preset dimension based on the preset parameter acquisition instruction, performs anomaly detection on the target Internet of Things device based on the running parameters of the preset dimension through a preset anomaly detection model, and obtains an anomaly detection result. Since the preset anomaly detection model is a neural network model trained by a training sample set constructed in advance according to historical running parameters, the anomaly reason of the Internet of Things device can be quickly located according to the collected running parameters of the preset dimension, without a large amount of manual cost, and since the collected running parameters have multiple dimensions, the running state of the Internet of Things device can be fully reflected, and the comprehensiveness of anomaly detection can be ensured. BRIEF DESCRIPTION OF DRAWINGS

[0043] Figure 1is a structural schematic diagram of an electronic device of a hardware running environment related to an embodiment scheme of the present application.

[0044] Figure 2 is a flowchart of a first embodiment of the present application for an Internet of Things device anomaly detection method.

[0045] Figure 3 is a flowchart of an execution process of the Internet of Things device anomaly detection method in an embodiment of the present application

[0046] Figure 4 is a flowchart of a second embodiment of the present application for an Internet of Things device anomaly detection method.

[0047] Figure 5 is a structural block diagram of a first embodiment of the present application for an Internet of Things device anomaly detection apparatus.

[0048] The implementation, functional features and advantages of the present application will be further described with reference to the embodiments and the accompanying drawings. DETAILED DESCRIPTION

[0049] It should be understood that the specific embodiments described herein are intended to explain the present application and are not intended to limit the present application.

[0050] Referring to Figure 1 , Figure 1 is a structural schematic diagram of an Internet of Things device anomaly detection device related to a hardware running environment of an embodiment scheme of the present application.

[0051] As Figure 1 shown, the electronic device can include a processor 1001, such as a central processing unit (CPU), a communication bus 1002, a user interface 1003, a network interface 1004, and a memory 1005. The communication bus 1002 is used to realize the connection and communication between the components. The user interface 1003 can include a display, an input unit such as a keyboard, and can also include a standard wired interface, a wireless interface. The network interface 1004 can optionally include a standard wired interface, a wireless interface (such as a wireless fidelity (WI-FI) interface). The memory 1005 can be a high-speed random access memory (RAM) memory, or a stable non-volatile memory (NVM), such as a magnetic disk memory. The memory 1005 can also be a storage device independent of the aforementioned processor 1001.

[0052] Those skilled in the art can understand that Figure 1The structure shown in the figure does not constitute a limitation on the electronic device, and can include more or fewer components than the figure, or combine certain components, or different component arrangements.

[0053] As shown in Figure 1 The memory 1005 as a storage medium can include an operating system, a network communication module, a user interface module, and an Internet of Things device anomaly detection program.

[0054] In Figure 1 The network interface 1004 in the electronic device is mainly used for data communication with a network server; the user interface 1003 is mainly used for data interaction with a user; the processor 1001 and the memory 1005 in the electronic device can be arranged in an Internet of Things device anomaly detection device, and the electronic device calls the Internet of Things device anomaly detection program stored in the memory 1005 through the processor 1001, and executes the Internet of Things device anomaly detection method provided in the embodiment of the application.

[0055] The embodiment of the application provides an Internet of Things device anomaly detection method, which refers to Figure 2 , Figure 2 The flowchart of the first embodiment of the Internet of Things device anomaly detection method of the application.

[0056] In the embodiment, the Internet of Things device anomaly detection method comprises the following steps:

[0057] Step S10: When a device detection instruction is detected, determining a target Internet of Things device according to the device detection instruction.

[0058] It should be noted that the execution subject of the embodiment can be the Internet of Things device anomaly detection device, which can be a personal computer, a server, or other electronic devices with the same or similar functions, and the embodiment is not limited thereto. In the embodiment and the following embodiments, the Internet of Things device anomaly detection device is taken as an example to describe the Internet of Things device anomaly detection method.

[0059] It should be noted that the device detection instruction can be an instruction sent by another device to the Internet of Things device anomaly detection device, or an instruction generated by the Internet of Things device anomaly detection device when it detects that the current running state meets the preset condition, for example: a user sends a device detection instruction to the Internet of Things device anomaly detection device through a control terminal when the user needs to detect a certain Internet of Things device; or, the user has a timing scanning task set in advance, and the Internet of Things device anomaly detection device automatically generates a device detection instruction when it detects that the current time meets the timing scanning task. The Internet of Things device identifier can be included in the device detection instruction. Determining the target Internet of Things device according to the device detection instruction can be data analysis of the device detection instruction, extracting the Internet of Things device identifier, finding the Internet of Things device corresponding to the Internet of Things device identifier, and taking the found Internet of Things device as the target Internet of Things device.

[0060] Step S20: Send a preset parameter collection instruction to the target Internet of Things device, so that the target Internet of Things device feeds back running parameters of a preset dimension based on the preset parameter collection instruction.

[0061] It should be noted that the preset parameter collection instruction can be an Attention (AT) instruction, which can be set in advance by a manager of the Internet of Things device anomaly detection device. The running parameters of the preset dimension can include data extracted from the AT interface of the target Internet of Things device and signaling data extracted from the LOG interface of the target Internet of Things device. The data extracted from the AT interface can include: serial port detection data, International Mobile Subscriber Identity (IMSI), Reference Signal Receiving Power (RSRP), Signal to Interference plus Noise Ratio (SINR), IP (Internet Protocol) address, ping success rate, ping delay, Power Saving Mode (PSM) state, network standard, Cell-ID, Tracking Area Code (TAC), etc. The data extracted from the AT interface can fully reflect the overall running state of the target Internet of Things device, including software and hardware information, parameter configuration information, and networking state. The signaling data extracted from the LOG interface can be used for signaling according to the target Internet of Things device's network process.

[0062] Step S30: Based on the running parameters of the preset dimension, the target Internet of Things device is detected by a preset anomaly detection model to obtain an anomaly detection result.

[0063] It should be noted that the preset anomaly detection model can be a pre-trained neural network model, which can be a Multilayer Perceptron (MLP) neural network model. Based on the running parameters of the preset dimension, the target Internet of Things device is detected by the preset anomaly detection model to obtain an anomaly detection result, which can be inputting the running parameters of the preset dimension into the preset anomaly detection model for anomaly detection to determine whether the target Internet of Things device is abnormal, thereby obtaining the anomaly detection result.

[0064] In actual use, in order to facilitate the user to determine the abnormal reason and quickly handle the abnormal Internet of Things device, the anomaly detection result can be displayed, wherein the anomaly detection result can be displayed by outputting the anomaly detection result to the display device of the Internet of Things device anomaly detection device, or the anomaly detection result can be sent to the control terminal of the user for display.

[0065] It can be understood that after obtaining the anomaly detection result, historical data can also be constructed and stored according to the running parameters of the preset dimension and the anomaly detection result, so as to facilitate subsequent traceability query or further training of the preset anomaly detection model. The user can also adjust and correct the anomaly detection result.

[0066] For the sake of understanding, reference Figure 3 is made to the description, but does not limit the present scheme. Figure 3 The flowchart of the present embodiment of the Internet of Things device anomaly detection method is shown in the figure. First, the device detection instruction input by the user is used to determine the Internet of Things terminal device to be detected, and an instruction is sent to the Internet of Things terminal device. Data is obtained from the at interface and the log interface, and the obtained data is input into the neural network AI for fault delimitation (i.e., based on the running parameters of the preset dimension, the target Internet of Things device is detected by the preset anomaly detection model to obtain an anomaly detection result). Then, the delimitation result (i.e., the anomaly detection result) is output for display. The device maintenance personnel (i.e., the user) will handle the Internet of Things terminal device after determining the anomaly detection result. The anomaly detection result and the running parameters can be saved, new samples can be constructed and stored, and the neural network AI can be further trained using the constructed new samples.

[0067] The embodiment detects the target Internet of Things device according to the device detection instruction when detecting the device detection instruction, sends a preset parameter collection instruction to the target Internet of Things device, so that the target Internet of Things device feeds back the running parameters of the preset dimension based on the preset parameter collection instruction, and performs abnormality detection on the target Internet of Things device based on the running parameters of the preset dimension through a preset abnormality detection model to obtain an abnormality detection result. Since the preset abnormality detection model is a neural network model trained by a training sample set constructed in advance according to historical running parameters, the abnormality reason of the Internet of Things device can be quickly located according to the collected running parameters of the preset dimension, without a large amount of manual cost, and since the collected running parameters have multiple dimensions, the running state of the Internet of Things device can be fully reflected, and the comprehensiveness of the abnormality detection can be ensured.

[0068] Reference Figure 4 , Figure 4 FIG. 2 is a flowchart of a second embodiment of the Internet of Things device abnormality detection method.

[0069] Based on the first embodiment, the Internet of Things device abnormality detection method of the embodiment further includes, before step S10:

[0070] Step S01: obtaining a data sample set constructed according to historical running parameters of different Internet of Things devices.

[0071] It should be noted that the historical running parameters can be the previously collected running parameters of the preset dimension, the data sample set can be a collection combined by multiple data samples, and the data sample can be constructed according to the historical running parameters of the Internet of Things device.

[0072] Step S02: constructing a label training set, a label verification set and a label-free training set according to the data sample set.

[0073] It should be noted that the label training set and the label verification set are both collections combined by a large number of data samples with labels, wherein the label of the data sample can be generated according to the abnormality detection result corresponding to the historical running parameter used to construct the data sample. The label-free training set can be a collection constructed by a large number of data samples without labels.

[0074] Further, in order to reduce the data complexity in the model training process and facilitate the model training, step S02 of the embodiment can include:

[0075] normalizing feature data of each data sample in the data sample set according to a preset normalization algorithm to obtain a normalized sample set; and segmenting the normalized sample set according to a preset sample segmentation rule to obtain the label training set, the label verification set and the label-free training set.

[0076] It should be noted that the preset normalization algorithm can be a (0, 1) standardization normalization algorithm, and an expression thereof can be:

[0077] x' = (x - Xmin) / (Xmax - Xmin)

[0078] In the formula, x' can be normalized feature data, x can be feature data subjected to normalization, Xmax can be a maximum value of the feature data in all data samples, and Xmin can be a minimum value of the feature data in all data samples.

[0079] It can be understood that all feature data can be compressed to the range of (0, 1) by the preset normalization algorithm, the complexity of the data is reduced, the amount of calculation can be reduced in the model training process, and the model training is more conducive.

[0080] It should be noted that the splitting of the normalized sample set according to the preset sample splitting rule to obtain the label training set, the label verification set and the unlabeled training set can be that the normalized sample set is split according to the preset sample splitting rule to obtain three subsets, labels are generated for data samples in two of the three subsets as the label training set and the label verification set, and the remaining one subset is taken as the unlabeled training set.

[0081] Further, in order to reduce noise feature data in the data samples, reduce unnecessary calculation, and improve the model training speed, before the step of normalizing feature data of each data sample in the data sample set according to the preset normalization algorithm to obtain a normalized sample set, the embodiment can further include:

[0082] cleaning features of each data sample in the data sample set to obtain a pure sample set;

[0083] Correspondingly, the step of normalizing feature data of each data sample in the data sample set according to the preset normalization algorithm to obtain a normalized sample set can include:

[0084] normalizing feature data of each data sample in the pure sample set according to the preset normalization algorithm to obtain a normalized sample set.

[0085] It should be noted that cleaning features of each data sample in the data sample set to obtain a pure sample set can be that noise feature data in each data sample in the data sample set is removed to obtain a pure sample, and then a pure sample set is constructed according to all obtained pure samples. The noise feature data can be feature data such as data identifier (ID), serial number, name and the like that does not affect anomaly detection.

[0086] Further, in order to improve the accuracy of the trained model, before the step of segmenting the normalized sample set according to a preset sample segmentation rule to obtain a labeled training set, a labeled validation set and an unlabeled training set, the method can further include:

[0087] completing the missing data of each data sample in the normalized sample set by a preset completion value to obtain a completed sample set;

[0088] Correspondingly, the step of segmenting the normalized sample set according to a preset sample segmentation rule to obtain a labeled training set, a labeled validation set and an unlabeled training set includes:

[0089] segmenting the completed sample set according to a preset sample segmentation rule to obtain a labeled training set, a labeled validation set and an unlabeled training set.

[0090] It should be noted that the data sample is constructed according to the historical running parameters, and the historical running parameters may be affected by various unexpected factors during the collection process, resulting in some parameters being unable to be collected, which may result in missing some parameters of the running parameters, and some feature data may be missing in the data sample, i.e. there is missing data in the data sample. If such data samples are directly removed, it may result in too few data samples for training, and the model cannot be trained. If such data is not adjusted, it may result in a low accuracy of the trained model. Therefore, the missing data of each data sample in the normalized sample set can be completed by a preset completion value, which can avoid too few data samples or reduce the accuracy of the model. The preset completion value can be set according to the preset normalization algorithm used, for example, when a (0, 1) standardization normalization algorithm is used, the preset completion value can be set to 0, and the missing data in the data sample can be completed by 0.

[0091] Step S03: training a plurality of initial neural network models according to the labeled training set to obtain a plurality of target neural network models.

[0092] It should be noted that the plurality of initial neural network models can be set by actual needs, and three initial neural network models are described in the embodiment. Training the plurality of initial neural network models according to the labeled training set can be constructing a model training set for each initial neural network model according to the labeled training set, and then training the corresponding initial neural network model through the model training set, wherein each model training set can be a set constructed by all labeled training samples in the labeled training set, or a set constructed by only part of the labeled training samples in the labeled training set, and the embodiment does not limit this. The initial neural network model can be a multilayer (Multilayer Perceptron, MLP) neural network model, which can mainly include three layers of input layer, hidden layer and output layer. If the input layer is denoted by vector X, the hidden layer can be represented by function f(WX+b1), wherein W is the weight, b is the bias parameter, and the function f can be a tanh activation function. The tanh function is one of the hyperbolic functions, and the tanh function is the hyperbolic tangent. The hyperbolic tangent "tanh" is derived from the basic hyperbolic functions hyperbolic sine and hyperbolic cosine. The formula is:

[0093]

[0094] wherein e is the natural logarithm, and x is the parameter in the input tanh function.

[0095] Step S04: model verification of each target neural network model through the label verification set.

[0096] It can be understood that after the initial neural network model is trained through the labeled training set to obtain the target neural network model, the target neural network model can be model verified through the labeled verification set, so as to determine whether the target neural network model meets the expectation.

[0097] In actual use, the model verification of each target neural network model through the labeled verification set can be inputting the data samples in the labeled verification set into the target neural network model for anomaly detection to obtain the label generated by the target neural network model, comparing the generated label with the label of the data sample, and determining the detection accuracy of the target neural network model. If the detection accuracy is less than a preset threshold, the size of the labeled training set can be expanded, and the step of training the plurality of initial neural network models according to the labeled training set to obtain the plurality of target neural network models is performed again. If the detection accuracy is greater than or equal to the preset threshold, it can be determined that the target neural network model passes the model verification.

[0098] Step S05: training the target neural network model according to the unlabeled training set when each target neural network model passes the model verification, and constructing a preset anomaly detection model according to the trained target neural network model.

[0099] It should be noted that if each target neural network model passes the model verification, it means that the detection accuracy of each target neural network model on the labeled data sample is high, and at this time, the target neural network model can be trained according to the unlabeled training set, so that the outputs of the trained target neural network models for the same data sample are consistent.

[0100] In actual use, constructing a preset anomaly detection model according to the trained target neural network model can be using any one of the trained target neural network models as the preset anomaly detection model, or assigning weights to each target neural network model, combining each target neural network model according to the weights to obtain the preset anomaly detection model, which is not limited in the embodiment.

[0101] Further, in order to ensure that the outputs of the trained target neural network models are consistent, step S05 of the embodiment can include:

[0102] when each target neural network model passes the model verification, traversing the unlabeled training set;

[0103] inputting the traversed current unlabeled training sample into each target neural network model for sample classification, and selecting a target training model from the target neural network model according to the sample classification result;

[0104] constructing an extended sample set corresponding to the target training model according to the current unlabeled training sample, and training the target training model through the extended sample set;

[0105] if it is detected that the trained target training model does not converge, or there is a non-converged model in the target neural network model other than the target training model, returning to the step of inputting the traversed current unlabeled training sample into each target neural network model for sample classification, and selecting a target training model from the target neural network model according to the sample classification result;

[0106] if it is detected that each target neural network model has been trained to converge, stopping traversing the unlabeled training set, and constructing a preset anomaly detection model according to the trained target neural network model.

[0107] It should be noted that the current unlabeled training sample can be an unlabeled training sample obtained from the unlabeled training set in the current iteration process. Inputting the current unlabeled training sample into each target neural network model for sample classification can be inputting the current unlabeled training sample into each target neural network model for classification, generating corresponding labels, and thus obtaining sample classification results.

[0108] In actual use, constructing an extended sample set corresponding to the target training model according to the current unlabeled training sample can be obtaining a model training set previously used by the target training model, and adding the current unlabeled training sample to the model training set as an extended sample set.

[0109] In actual use, detecting whether the trained target training model converges can be comparing the model parameters before this training with the model parameters after the training. When the model parameter change amount is less than a preset change threshold, it is determined that the model has been trained to converge. When the model parameter change amount is greater than or equal to the preset change threshold, it is determined that the model does not converge.

[0110] In actual use, when it is detected that the trained target training model converges, the model identifier of the target training model can be added to the converged model identifier set. According to the model identifiers existing in the converged model identifier set, it can be determined whether there is an unconverged model in other target neural network models except the target training model. If the number of model identifiers in the converged model identifier set is consistent with the number of target neural network models, it can be indicated that each target neural network model has been trained to converge.

[0111] Further, in order to reasonably select a target training model, the step of inputting the current unlabeled training sample obtained in the iteration into each target neural network model for sample classification and selecting a target training model from the target neural network models according to the sample classification results can include:

[0112] Inputting the current unlabeled training sample obtained in the iteration into each target neural network model for sample classification to obtain a plurality of sample classification results;

[0113] Taking a sample classification result different from other sample classification results as a target classification result;

[0114] Taking the target neural network model corresponding to the target classification result as the target training model.

[0115] It should be noted that if there is a sample classification result in the plurality of sample classification results obtained by respectively inputting the current unlabeled training sample into each target neural network model for sample classification, which is different from other sample classification results, it indicates that the output of the target neural network model generating the sample classification result is inconsistent with other target neural network models, and the target neural network model generating the sample classification result needs to be further trained. Therefore, the sample classification result can be used as the target classification result, and the target neural network model corresponding to the target classification result can be used as the target training model.

[0116] Therefore, the model training set corresponding to the target training model can be obtained, and the extended sample set can be constructed according to the current unlabeled training sample.

[0117] For example: Assuming that there are three target neural network models H1, H2 and H3, the unlabeled training sample x is input into H1, H2 and H3 respectively, and the sample classification results obtained are H1(x), H2(x) and H3(x) respectively, wherein H2(x) and H3(x) are the same, and H1(x) is different from H2(x) and H3(x). Therefore, H1(x) can be used as the target classification result, and the target neural network model H1 generating H1(x) can be used as the target training model.

[0118] If it is assumed that the model training set corresponding to the target training model is L, the current unlabeled training sample is x, and the extended sample set is S1', S1' can be expressed as:

[0119]

[0120] Wherein, U is an unlabeled sample set, and ∪ is a union symbol.

[0121] The embodiment obtains a data sample set constructed according to historical operation parameters of different Internet of Things devices; constructs a label training set, a label verification set and a label-free training set according to the data sample set; trains a plurality of initial neural network models according to the label training set to obtain a plurality of target neural network models; performs model verification on each target neural network model through the label verification set; when each target neural network model passes the model verification, trains the target neural network model according to the label-free training set, and constructs a preset anomaly detection model according to the trained target neural network model. Since not only one neural network model is directly constructed as a preset anomaly detection model, but also a plurality of neural network models are trained through the label training set to obtain a plurality of target neural network models, and then the label test set is used to verify each target neural network model for model verification, the detection accuracy of each target neural network model is ensured, and finally each target neural network model is trained through the label-free training set to improve the detection accuracy of each target neural network model on the label-free data, and finally each target neural network model is trained to convergence to ensure the consistency of the output of each target neural network model, and then a preset anomaly detection model is constructed according to the trained target neural network model, further improving the anomaly detection accuracy of the preset anomaly detection model.

[0122] In addition, the embodiment of the present application also provides a storage medium, wherein the storage medium stores an Internet of Things device anomaly detection program, and the Internet of Things device anomaly detection program is executed by a processor to realize the steps of the Internet of Things device anomaly detection method as described above.

[0123] Reference Figure 5 , Figure 5 is a structural block diagram of the first embodiment of the Internet of Things device anomaly detection device of the present application.

[0124] As Figure 5 shown, the Internet of Things device anomaly detection device provided by the embodiment of the present application comprises:

[0125] The instruction response module 501 is configured to determine a target Internet of Things device according to the device detection instruction when detecting the device detection instruction;

[0126] The parameter acquisition module 502 is configured to send a preset parameter acquisition instruction to the target Internet of Things device, so that the target Internet of Things device feeds back operation parameters of a preset dimension based on the preset parameter acquisition instruction;

[0127] The anomaly detection module 503 is configured to perform anomaly detection on the target Internet of Things device through a preset anomaly detection model based on the operation parameters of the preset dimension, to obtain an anomaly detection result.

[0128] The embodiment determines a target Internet of Things device according to the device detection instruction when detecting the device detection instruction, sends a preset parameter collection instruction to the target Internet of Things device, so that the target Internet of Things device feeds back running parameters of a preset dimension based on the preset parameter collection instruction, and performs abnormality detection on the target Internet of Things device based on the running parameters of the preset dimension through a preset abnormality detection model to obtain an abnormality detection result. Since the preset abnormality detection model is a neural network model trained according to a training sample set constructed in advance based on historical running parameters, the abnormality reason of the Internet of Things device can be quickly located according to the collected running parameters of the preset dimension, without a large amount of manual cost, and since the collected running parameters have a large dimension, the running state of the Internet of Things device can be fully reflected, and the comprehensiveness of the abnormality detection can be ensured.

[0129] Further, the instruction response module 501 is further configured to obtain a data sample set constructed according to historical running parameters of different Internet of Things devices, construct a label training set, a label verification set and a label-free training set according to the data sample set, train a plurality of initial neural network models according to the label training set to obtain a plurality of target neural network models, perform model verification on each target neural network model through the label verification set, and train the target neural network model according to the label-free training set when each target neural network model passes the model verification, and construct a preset abnormality detection model according to the trained target neural network model.

[0130] Further, the instruction response module 501 is further configured to perform normalization processing on feature data of each data sample in the data sample set according to a preset normalization algorithm to obtain a normalized sample set, and perform segmentation on the normalized sample set according to a preset sample segmentation rule to obtain the label training set, the label verification set and the label-free training set.

[0131] Further, the instruction response module 501 is further configured to perform feature cleaning on each data sample in the data sample set to obtain a pure sample set.

[0132] The instruction response module 501 is further configured to perform normalization processing on feature data of each data sample in the pure sample set according to a preset normalization algorithm to obtain a normalized sample set.

[0133] Further, the instruction response module 501 is further configured to perform data completion on missing data of each data sample in the normalized sample set through a preset completion value to obtain a completed sample set.

[0134] The instruction response module 501 is further configured to perform set segmentation on the completed sample set according to a preset sample segmentation rule to obtain the label training set, the label verification set and the label-free training set.

[0135] Further, the instruction response module 501 is further configured to: when each target neural network model passes the model verification, traverse the unlabeled training set; input the current unlabeled training sample traversed to each target neural network model for sample classification, and select a target training model from the target neural network model according to the sample classification result; construct an extended sample set corresponding to the target training model according to the current unlabeled training sample, and train the target training model through the extended sample set; if it is detected that the trained target training model does not converge, or there is a model that does not converge in the target neural network model other than the target training model, return to the step of inputting the current unlabeled training sample traversed to each target neural network model for sample classification, and selecting a target training model from the target neural network model according to the sample classification result; if it is detected that each target neural network model has been trained to converge, stop traversing the unlabeled training set, and construct a preset anomaly detection model according to the target neural network model that has been trained to converge.

[0136] Further, the instruction response module 501 is further configured to: input the current unlabeled training sample traversed to each target neural network model for sample classification, to obtain a plurality of sample classification results; take the sample classification result different from other sample classification results in each sample classification result as a target classification result; and take the target neural network model corresponding to the target classification result as a target training model.

[0137] It should be understood that the above is only an example, and does not constitute any limitation on the technical solutions of the present application. In specific applications, those skilled in the art can set it up according to the needs, and the present application does not limit it.

[0138] It should be noted that the above-described workflow is only illustrative and does not limit the scope of protection of the present application. In actual application, those skilled in the art can select part or all of them according to actual needs to achieve the purpose of the present embodiment, which is not limited here.

[0139] In addition, technical details not described in detail in the present embodiment can be referred to the Internet of Things device anomaly detection method provided by any embodiment of the present application, which will not be repeated here.

[0140] Moreover, it is to be understood that the phraseology and terminology used herein is for the purpose of description and should not be regarded as limiting. The use of "including" "comprising" or "having" and variations thereof herein is intended to encompass the presence of successor, equivalent, and similar terms, to the extent not doing so would adversely render teachings of the present application ambiguous. The use of the term "including" and "comprising" and variations thereof are intended to be broad and encompass the terms "consisting of" and "consisting essentially of" to the extent not doing so would materially alter the meaning of the description herein.

[0141] The above-mentioned embodiment numbers of the present application are only for description, and do not represent the advantages and disadvantages of the embodiments.

[0142] Those skilled in the art can clearly understand the above-mentioned embodiment methods by means of software and the necessary general hardware platform, of course, they can also be realized by hardware, but in many cases, the former is a better embodiment. Based on such understanding, the technical solutions of the present application can be embodied in the form of a software product, which is stored in a storage medium (such as a read-only memory (ROM) / RAM, a magnetic disk, an optical disk), and includes a plurality of instructions for making a terminal device (which can be a mobile phone, a computer, a server, or a network device, etc.) execute the methods described in the embodiments of the present application.

[0143] The above is only the preferred embodiment of the present application, and does not limit the patent scope of the present application, and any equivalent structure or equivalent process transformation, or direct or indirect application in other related technical fields, which is made by using the content of the specification and drawings of the present application, is also included in the patent protection scope of the present application.

Claims

1. A method for detecting anomalies in an Internet of Things device, the method comprising: The Internet of Things device anomaly detection method comprises the following steps: obtaining a data sample set constructed according to historical running parameters of different Internet of Things devices; constructing a label training set, a label verification set, and a label-free training set according to the data sample set; training multiple initial neural network models according to the label training set to obtain multiple target neural network models; model verification of each target neural network model through the label verification set; when each target neural network model passes the model verification, traversing the label-free training set; inputting the traversed current label-free training sample into each target neural network model for sample classification, and selecting a target training model from the target neural network model according to the sample classification result, the target training model being a target neural network model whose generated sample classification result is different from that of other target neural network models; constructing an extended sample set corresponding to the target training model according to the current label-free training sample, and training the target training model through the extended sample set; if it is detected that each target neural network model has been trained to convergence, stopping traversing the label-free training set, and constructing a preset anomaly detection model according to the target neural network model that has been trained to convergence; when a device detection instruction is detected, determining a target Internet of Things device according to the device detection instruction; sending a preset parameter collection instruction to the target Internet of Things device to make the target Internet of Things device feed back running parameters of a preset dimension based on the preset parameter collection instruction; based on the running parameters of the preset dimension, performing anomaly detection on the target Internet of Things device through a preset anomaly detection model to obtain an anomaly detection result; wherein the step of inputting the traversed current label-free training sample into each target neural network model for sample classification, and selecting a target training model from the target neural network model according to the sample classification result, comprises: inputting the traversed current label-free training sample into each target neural network model for sample classification to obtain multiple sample classification results; taking a sample classification result different from other sample classification results as a target classification result; taking a target neural network model corresponding to the target classification result as a target training model. 2.The IoT device anomaly detection method of claim 1, wherein, The step of constructing a label training set, a label verification set, and a label-free training set according to the data sample set comprises: normalizing feature data of each data sample in the data sample set according to a preset normalization algorithm to obtain a normalized sample set; segmenting the normalized sample set according to a preset sample segmentation rule to obtain a label training set, a label verification set, and a label-free training set. 3.The IoT device anomaly detection method of claim 2, wherein, Before the step of normalizing feature data of each data sample in the data sample set according to a preset normalization algorithm to obtain a normalized sample set, the method further comprises: performing feature cleaning on each data sample in the data sample set to obtain a pure sample set; Correspondingly, the step of normalizing feature data of each data sample in the data sample set according to a preset normalization algorithm to obtain a normalized sample set comprises: According to a preset normalization algorithm, the feature data of each data sample in the pure sample set is normalized to obtain a normalized sample set. 4.The IoT device anomaly detection method of claim 2, wherein, Before the step of dividing the normalized sample set according to a preset sample division rule to obtain a labeled training set, a labeled validation set and an unlabeled training set, further comprising: By a preset completion value, the missing data of each data sample in the normalized sample set is completed to obtain a completed sample set; Correspondingly, the step of dividing the normalized sample set according to a preset sample division rule to obtain a labeled training set, a labeled validation set and an unlabeled training set comprises: According to a preset sample division rule, the completed sample set is divided to obtain a labeled training set, a labeled validation set and an unlabeled training set. 5.The IoT device anomaly detection method of claim 1, wherein, After the step of constructing an extended sample set corresponding to the target training model according to the current unlabeled training sample, and training the target training model through the extended sample set, further comprising: If it is detected that the trained target training model has not converged, or there is an un-converged model in other target neural network models except the target training model, the step of inputting the current unlabeled training sample into each target neural network model for sample classification, and selecting a target training model from the target neural network model according to the sample classification result is returned.

6. An Internet of Things device anomaly detection apparatus, comprising: The Internet of Things device anomaly detection apparatus comprises the following modules: An instruction response module is configured to, when a device detection instruction is detected, determine a target Internet of Things device according to the device detection instruction; A parameter acquisition module is configured to send a preset parameter acquisition instruction to the target Internet of Things device, so that the target Internet of Things device feeds back operating parameters of a preset dimension based on the preset parameter acquisition instruction; An anomaly detection module is configured to perform anomaly detection on the target Internet of Things device based on the operating parameters of the preset dimension through a preset anomaly detection model, to obtain an anomaly detection result; The instruction response module is further configured to obtain a data sample set constructed according to historical running parameters of different Internet of Things devices; construct a label training set, a label verification set and a label-free training set according to the data sample set; train a plurality of initial neural network models according to the label training set to obtain a plurality of target neural network models; perform model verification on each target neural network model through the label verification set; when each target neural network model passes the model verification, traverse the label-free training set; input a current label-free training sample obtained in the traversal into each target neural network model for sample classification, and select a target training model from the target neural network models according to a sample classification result, the target training model being a target neural network model whose generated sample classification result is different from those of other target neural network models; construct an extended sample set corresponding to the target training model according to the current label-free training sample, and train the target training model through the extended sample set; if it is detected that each target neural network model has been trained to converge, stop traversing the label-free training set, and construct a preset anomaly detection model according to the target neural network model that has been trained to converge. The instruction response module is further configured to input a current label-free training sample obtained in the traversal into each target neural network model for sample classification to obtain a plurality of sample classification results. A sample classification result that is different from other sample classification results in the sample classification results is taken as a target classification result. A target neural network model corresponding to the target classification result is taken as a target training model.

7. An Internet of Things device anomaly detection device, comprising: The Internet of Things device anomaly detection device comprises a processor, a memory and an Internet of Things device anomaly detection program stored on the memory and executable on the processor, and the Internet of Things device anomaly detection program is configured to implement the steps of the Internet of Things device anomaly detection method according to any one of claims 1-6 when executed by the processor.

8. A computer-readable storage medium, characterized in that, The computer readable storage medium stores an Internet of Things device anomaly detection program, and the Internet of Things device anomaly detection program is configured to implement the steps of the Internet of Things device anomaly detection method according to any one of claims 1-6 when executed.

Images