Iot anomaly data detection method based on improved feature selection and hierarchical model

Abstract

The application relates to an Internet of Things abnormal data detection method based on improved feature selection and a hierarchical model, mainly comprising the following steps: collecting Internet of Things data, performing data missing value, abnormal value and Z-score standardization data preprocessing; removing redundant features from the preprocessed data by using an improved correlation feature selection algorithm, screening important features, and performing data dimension reduction; dividing the feature-selected data into a training set and a test set; further dividing the training set into a sub-training set and two validation sets; inputting the sub-training set into a multilayer hierarchical model for training, saving the trained model; and obtaining a final training model. Finally, the test set is used to test the effect of the overall model, and a detection result is obtained. The application effectively selects features of Internet of Things data, reasonably divides data and fuses hierarchical models, and the detection effect of the Internet of Things abnormal data is obviously improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of Internet of Things (IoT) anomaly data detection and machine learning, and more particularly, to an IoT anomaly data detection method based on improved features and hierarchical models. BACKGROUND

[0002] With the continuous development of the Internet of Things technology, the number of devices connected to the Internet of Things has increased dramatically, and the number of data and devices has also increased explosively, which leads to the characteristics of the Internet of Things system, such as various types of devices, excessive number of devices, massive device data, complex interaction, and difficulty in effectively monitoring the running status. It is particularly important to monitor the running status of a large number of Internet of Things devices. Effective and timely detection can help managers discover and troubleshoot errors in Internet of Things devices in a timely manner to avoid significant losses. For a large amount of data generated by Internet of Things devices, a machine learning algorithm can be used to train a model for anomaly data detection and judgment. By inputting the Internet of Things device data into the trained algorithm model, the analysis result can help managers determine whether the device is abnormal to facilitate the monitoring of the running status of the device. In traditional detection technology, a single algorithm model has the problem of low detection effect. Although existing research shows that model fusion can improve this problem, traditional fusion model methods, such as Stacking, have high training time and complexity under the condition of a large number of samples due to the use of K-fold cross-validation. Blending does not require K-fold cross-validation, which solves the problem of slow training of Stacking, but it wastes a lot of data sets. At the same time, in most machine learning tasks, how to select reasonable features is one of the main factors affecting learning. Using a high-dimensional data set to train a classification model may cause the learning model to overfit the training data, so a feature selection algorithm needs to be added to the learning model to solve such problems. In summary, these anomaly data detection methods still have some shortcomings and cannot effectively detect various types of abnormal data, especially for data generated by Internet of Things devices. SUMMARY

[0003] In view of the above shortcomings or improvement needs of the prior art, the present application provides an IoT anomaly data detection method based on improved feature selection and hierarchical models, which aims to solve the problems of high dimensionality, low detection accuracy, and slow efficiency in existing machine learning algorithms for IoT anomaly data.

[0004] To achieve the above-mentioned purpose, the present application provides an IoT anomaly data detection method based on improved feature selection and hierarchical models, comprising the following steps:

[0005] Step A. Acquire the data generated by IoT devices and label the data as a set S = [s1, s2, s3, ..., sn]. T , S∈R n×m Where n represents that the dataset S has n samples, and for each sample si = [xi1, xi2, xi3, ..., xim, yi], i = 1, 2, 3, ..., m, it means that si contains an n-dimensional feature set x = [xi1, xi2, xi3, ..., xim] and a label category y. i Data set S is preprocessed by removing missing values, outliers, and standardizing the data to obtain the processed dataset S. new Then proceed to step B.

[0006] Step B. Take the dataset obtained from Step A. The feature set and label categories are divided to obtain the total feature set. And the set of label categories Y = [y1, y2, y3, ..., yn] T An improved relevance-based feature selection algorithm is used to select features from feature set X, eliminating redundant features, reducing feature dimensionality, and obtaining the optimal feature subset. Where c≤m, and c represents the optimal number of features for each sample after filtering.

[0007] Preferably, step A specifically involves preparing the training dataset S = [s1, s2, s3, ..., sn]. T To handle missing values ​​in the data, according to the formula... Imput the values ​​using the mean; remove outliers if any are found, and then generate the training dataset S = [s1, s2, s3, ..., sn]. T According to the formula Calculate the standard deviation, then use the formula Z-score standardization is performed to obtain the final dataset S. new .

[0008] Preferably, step B specifically involves: processing the dataset The feature set and label categories are divided to obtain the total feature set. And the set of label categories Y = [y1, y2, y3, ..., yn] T .

[0009] Furthermore, define an empty set of selected features. Candidate feature set Z m ={XZ s}, Z mInitially, m features in the feature set X are given, and the improved correlation feature selection algorithm is as follows:

[0010]

[0011] wherein the formula involved in J(x j ) is as follows:

[0012]

[0013]

[0014] I(x j ; x i ; Y) = I(x j , x i ; Y) - I(x j ; Y) - I(x i ; Y)

[0015]

[0016]

[0017]

[0018]

[0019] wherein x j represents a to-be-selected feature from a to-be-selected feature set Z m ; x i represents a selected feature from a selected feature set Z s ; Y represents a label from a label category set Y = [y1, y2, y3, …, yn] T ; I(x j ; Y|x i ) is conditional mutual information, representing an information measure of the to-be-selected feature x j and the label category Y under the influence of the selected feature x i ; I(x i ; Y|x j ) is conditional mutual information, representing an information measure of the selected feature x i and the label category Y under the influence of the to-be-selected feature x j ; I(x j ; x i ; Y) is mutual information, representing information correlation of the selected feature x i , the label category Y and the to-be-selected feature x j ; H(Y) is information entropy of the label category; H(x j ) is information entropy of the to-be-selected feature; H(xi I(x) represents the information entropy of the selected features; j ;x i Mutual information represents the selected feature x. i and candidate features x j The correlation of information between them; the set of features to be selected Z m All features are selected using an improved mutual information-based feature selection algorithm J(x) j The set Z is obtained by evaluating the results. m The score for each candidate feature.

[0020] Furthermore, the feature with the highest score among the candidate features is selected, and its index is added to the selected feature set Z. s In the middle; simultaneously update the candidate feature set Z m ={XZ s}, that is, remove the feature; update the feature selection algorithm J(x) j Then, if the feature set Z has been selected... s If the number of elements in the subset is not equal to the set number c of the optimal feature subset, then repeat the above steps; otherwise, stop the entire algorithm process; finally, the selected feature set Z is obtained. s Traverse set Z s Z s The saved elements are the set of candidate features Z. m For each feature, assign an index and construct the optimal feature subset Z = [z1, z2, z3, ..., zc] based on its index. T , where c≤m; then proceed to step C.

[0021] Step C. Partition the data using the optimal feature subset Z obtained in Step B and the corresponding label category set Y. The partition result is: Z = {Z...} train Z test}, Y = {Y train ,Y test The ratio of Z to Z is 8:2. train and Y train 80% of the total, Z test and Y test It accounts for 20%.

[0022] Furthermore, to fully utilize the hierarchical model, the training set Z... train and corresponding label Y train It is divided into three parts, denoted as Z. train ={Z train1 Z val2 Z val3} and Y train ={Y train1 ,Y val2 ,Yval3}, wherein Z train1 is the corresponding label Y train1 ; Z val2 and Z val3 are the corresponding labels Y val2 and Y val3 respectively, and the division ratio of the three is 2:1:1, wherein Z train1 and Y train1 account for 50%, and Z val2 and Y val2 , Z val3 and Y val3 account for 25%; then step D is entered.

[0023] Step D. Z train1 and Y train1 obtained in step C are input into the first layer learner T1 = {T1_M1, T1_M2, T1_M3, T1_M4, T1_M5} of the hierarchical model for training, wherein T1_M1 is a decision tree, T1_M2 is a random forest, T1_M3 is a gradient boosting tree, T1_M4 is XGBoost, and T1_M5 is KNN. Z train1 and Y train1 are input into T1 for training, and then the model trained each time is saved to a new model set T1_train, wherein T1_train = {T1_m1 new , T1_m2 new , T1_m3 new , T1_m4 new , T1_m5 new}, and then step E is entered.

[0024] Step E. The sub-validation set Z val2 obtained in step B is input into the model T1_train trained in step D for verification. Since there are five groups of learners, five groups of prediction results are obtained, denoted as wherein [a1, a2…ai] represents the result predicted by the first learner, which is a set of probability representations, wherein a1+a2+…ai=1; if there is only one abnormal category, then i=2, indicating that the probabilities of the prediction results being normal and abnormal are a1 and a2 respectively; if there is more than one abnormal category, then i>2, indicating that the probabilities of each abnormal category predicted by the model are [a1, a2…ai]; then step F is entered.

[0025] Step F. Y val2 and Z pro2The second layer learner set T2 = {T2_M1, T2_M2} of the hierarchical model is trained, preferably wherein T2_M1 is a decision tree with a random seed replacement, and T2_M2 is a random forest with a random seed replacement, and then the new model of each training is saved to a new model set T2_train, wherein T2_train = {m1 new ,m2 new}. The parameters of the decision tree are {n_estimators = 100, max_features = 16, random_state = 4869}, and the parameters of the random forest are {n_estimators = 100, max_features = "sqrt", random_state = 4869, n_jobs = 8}, and then the validation set is validated in this layer to further improve the training ability of the model, and then step G is entered.

[0026] Step G. The sub-validation set Z val3 The model T2_train trained in step F is inputted for validation, and since there are two groups of learners, two groups of prediction results are obtained, which are combined twice to form a new sample, denoted as where [a1, a2…ai] represents the result of the first sample prediction, which is a set of probability representations, wherein a1+a2+…ai = 1; if there is only one abnormal category, i = 2, indicating that the probabilities of the prediction results being normal and abnormal are a1 and a2 respectively; if there is more than one abnormal category, i > 2, then [a1, a2…ai] represents the probability of each abnormal category predicted by the model; and then step H is entered.

[0027] Step H. Y val3 and Z pro3 are inputted into the third layer model of the hierarchical model for training, the third layer uses the CatBoost algorithm for training, the entire training model is saved, and then step I is entered.

[0028] Step I. The test set Z test and the corresponding label Y test obtained in step C are inputted into the overall hierarchical model for testing, and the final test accuracy is set to >= T%; if the requirement is not met, step D is returned, each layer of the model is re-parameterized and optimized until the final test result meets the requirement, and then step J is entered.

[0029] Step J. The hierarchical model trained in step I is used for Internet of Things abnormal data detection, the model is deployed on a local Internet of Things device detection end or a cloud platform, data collected by the Internet of Things device is inputted into the trained model for real-time data anomaly detection, and a final detection result is obtained.

[0030] As described above, compared with the prior art, the improved feature selection and hierarchical model based IoT abnormal data detection method of the present application has the following technical effects: due to the steps A-C, the irrelevant and redundant data is removed by the improved correlation feature selection algorithm, the model calculation time is reduced, and the learning accuracy is improved; due to the steps D-H, by improving the division method of the data training set and the validation set and the improved hierarchical model, the advantages of multiple algorithms are combined, the problem of low accuracy of a single model is solved, and the problems of traditional fusion models such as K-fold cross-validation leading to high training complexity of Stacking and insufficient use of training data of Blending model are solved. In summary, by using the design method of the present application, the problems of low abnormal data detection and slow detection efficiency of existing IoT can be effectively solved. BRIEF DESCRIPTION OF DRAWINGS

[0031] Figure 1 is a flowchart of the improved feature selection and hierarchical model based IoT abnormal data detection method designed by the present application;

[0032] Figure 2 is a verification data result table of the present application. DETAILED DESCRIPTION

[0033] The specific embodiments of the present application will be further described in detail below in conjunction with the drawings of the specification. The specific idea of the present application is to construct an abnormal data detection model using the fusion model idea of machine learning algorithm for the massiveness of IoT device data. On the one hand, to solve the problems of poor model algorithm accuracy and precision caused by large sample data volume and high dimension, an improved feature selection algorithm is used to reasonably select the features of the sample data and select the optimal feature subset; by improving the hierarchical model, the sample data is preprocessed and the training set and the validation set of the sample data are reasonably divided to reduce the training time; on the other hand, by using the improved hierarchical model, the divided sub-training set is trained in the first layer, the sub-validation set is validated in the first layer, the validation result is used as the input of the second layer and is trained again, the sub-validation set is validated in the second layer, and finally the third layer is trained to output, which significantly improves the effect of abnormal detection.

[0034] As shown in Figure 1 , the improved feature selection and hierarchical model based IoT abnormal data detection method provided by the present application comprises the following steps:

[0035] Step A. Obtain the data generated by the IoT device, and mark the data as a set S=[s1, s2, s3, …, sn] T , S∈R n×m; wherein n represents that the data set S has n samples, for each sample si=[si1, xi2, xi3, …, xim, yi], i=1, 2, 3…m, represents that si contains an n-dimensional feature set x=[xi1, xi2, xi3, …, xim] and a label category yi; the data set S is preprocessed for missing values, outliers and standardization, and a processed data set S is obtained new , then step B is entered;

[0036] Step B. The feature set and label category of the data set obtained from step A are divided to obtain the total feature set and the label category set Y=[y1, y2, y3, …, yn] T ; the feature selection of the feature set X is performed using the improved correlation feature selection algorithm, redundant features are removed, dimension reduction of features is realized, and an optimal feature subset is obtained, wherein c≤m, and c represents the optimal number of features of each sample after screening.

[0037] Preferably, step A is specifically that the to-be-trained data set S=[s1, s2, s3, …, sn] T is subjected to missing value processing, and the missing values are filled in according to the formula using the average value; if there are outliers, the outliers are deleted, and then the to-be-trained data set S=[s1, s2, s3, …, sn] T is subjected to outlier processing, and the standard deviation is calculated according to the formula , and then Z-score standardization is performed according to the formula to obtain the final data set S new .

[0038] Preferably, step B is specifically that the feature set and label category of the data set are divided to obtain the total feature set and the label category set Y=[y1, y2, y3, …, yn] T .

[0039] Further, the empty selected feature set is defined as m {X-Z s}, and Z m is initially m features in the feature set X, and the improved correlation feature selection algorithm is given as

[0040]

[0041] , wherein J(x jThe formula involved in the above equation is:

[0042]

[0043]

[0044] I(x j ;x i ;Y) = I(x j ,x i ;Y) - I(x j ;Y) - I(x i ;Y)

[0045]

[0046]

[0047]

[0048]

[0049] wherein x j represents a candidate feature from a candidate feature set Z m ; x i represents a selected feature from a selected feature set Z s ; Y represents a label from a label category set Y = [y1, y2, y3, …, yn] T ; I(x j ; Y | x i ) is conditional mutual information, representing the information measure of the candidate feature x j and the label category Y under the influence of the selected feature x i ; I(x i ; Y | x j ) is conditional mutual information, representing the information measure of the selected feature x i and the label category Y under the influence of the candidate feature x j ; I(x j ; x i ; Y) is mutual information, representing the information correlation of the selected feature x i , the label category Y and the candidate feature x j ; H(Y) is the information entropy of the label category; H(x j ) is the information entropy of the candidate feature; H(x i ) is the information entropy of the selected feature; I(x j ; x i ) is mutual information, representing the information correlation between the selected feature x i and the candidate feature x j ; and Z represents the candidate feature set.m All features in Z are evaluated by the improved mutual information feature selection algorithm J(x j ) to get the score of each candidate feature in Z m .

[0050] Further, the feature with the highest score is selected from the scores of each candidate feature, and its index is added to the selected feature set Z s ; meanwhile, the candidate feature set Z m ={X-Z s} is updated, i.e., the feature is removed; the feature selection algorithm J(x j ) is updated; then, if the number of elements in the selected feature set Z s is not equal to the number of the set optimal feature subset c, the above steps are repeated; otherwise, the entire algorithm process is stopped; finally, the selected feature set Z s is obtained, and the set Z s is traversed; wherein Z s stores the index of each feature in the candidate feature set Z m , and the optimal feature subset Z = [z1, z2, z3, …, zc] T is constructed according to the index, wherein c≤m; then step C is entered.

[0051] Step C. The optimal feature subset Z obtained in step B and the corresponding label category set Y are reasonably divided. The division result is: Z = {Z train , Z test}, Y = {Y train , Y test}, and the division ratio is 8:2, wherein Z train and Y train account for 80%, and Z test and Y test account for 20%.

[0052] Further, in order to fully utilize the hierarchical model, the training set Z train and the corresponding label Y train are divided into three parts, represented as Z train ={Z train1 , Z val2 , Z val3} and Y train ={Y train1 , Y val2 , Y val3}, wherein Z train1 is a sub-training set corresponding to the label Y train1 ; Z val2 and Z val3 are sub-validation sets corresponding to the labels Y val2 and Yval3 ; the ratio of the three is 2:1:1, wherein Z train1 and Y train1 account for 50%, Z val2 and Y val2 , Z val3 and Y val3 account for 25%; then step D is entered;

[0053] Step D. Z train1 and Y train1 obtained in step C are input into the first layer learner T1={T1_M1, T1_M2, T1_M3, T1_M4, T1_M5} of the hierarchical model for training, wherein T1_M1 is a decision tree, T1_M2 is a random forest, T1_M3 is a gradient boosting tree, T1_M4 is XGBoost, and T1_M5 is KNN, and T1 is looped through, and Z train1 and Y train1 are input into T1 for training, and then the model trained each time is saved into a new model set T1_train, wherein T1_train={T1_m1 new , T1_m2 new , T1_m3 new , T1_m4 new , T1_m5 new}, and then step E is entered;

[0054] Step E. The sub-validation set Z val2 obtained in step B is input into the model T1_train trained in step D for verification, and since there are five learners, five groups of prediction results are obtained, denoted as wherein [a1, a2…ai] represents the result predicted by the first learner, and is a set of probability representations, wherein a1+a2+…ai=1; if there is only one abnormality category, then i=2, indicating that the probabilities of the prediction results being normal and abnormal are a1 and a2, respectively; if there is more than one abnormality category, then i>2, indicating that [a1, a2…ai] represents the probability of each abnormality category predicted by the model; then step F is entered;

[0055] Step F. Y val2 and Z pro2 obtained in steps C and E are input into the second layer learner set T2={T2_M1, T2_M2} of the hierarchical model for training, preferably wherein T2_M1 is a decision tree with a replaced random seed, and T2_M2 is a random forest with a replaced random seed, and then the new model trained each time is saved into a new model set T2_train, wherein T2_train={m1 new , m2 new}. The parameters of the decision tree are {n_estimators=100, max_features=16, random_state=4869}; the parameters of the random forest are {n_estimators=100, max_features="sqrt", random_state=4869, n_jobs=8}; then the validation set is validated at this layer to further improve the training ability of the model; then step G is entered;

[0056] Step G. The sub-validation set Z obtained in step C is input into the third layer of the hierarchical model for training, and the third layer adopts the CatBoost algorithm for training, and the whole trained model is saved, and then step I is entered. val3 The trained model T2_train in step F is input for validation, and since there are 2 groups of learners, 2 groups of prediction results are obtained, which are combined into a new sample, denoted as Where [a1, a2…ai] represents the prediction result of the first sample, which is a set of probability representations, and a1+a2+…ai=1; if there is only one kind of anomaly, i=2, indicating that the probabilities of predicting normal and abnormal are a1 and a2 respectively; if there is more than one kind of anomaly, i>2, then [a1, a2…ai represents the probability of each kind of anomaly predicted by the model; then step H is entered.

[0057] Step H. Y val3 and Z pro3 are obtained in steps C and G, which are input into the third layer model of the hierarchical model for training, the third layer adopts the CatBoost algorithm for training, and the whole trained model is saved, and then step I is entered. test and the corresponding label Y test are input into the overall hierarchical model for testing, and the final test accuracy is set to >=T%; if the requirement is not met, return to step D to re-optimize the parameters of each layer model until the final test result meets the requirement, and then step J is entered.

[0058] Step J. The trained hierarchical model in step I is used for Internet of Things anomaly data detection, and the model is deployed on a local Internet of Things device detection end or a cloud platform. The data collected by the Internet of Things device is input into the trained model for real-time data anomaly detection to obtain the final detection result.

[0059] In order to illustrate the detection effect of the present application in the field of Internet of Things anomaly data detection, verification testing is performed on the public data set MQTTset. The data of this data set is collected from the sensors built-in the Internet of Things device, and the data anomaly type contains 5 types, and the normal type is 1 type. The test obtained by the present application is compared with the current method, and the evaluation result is shown in the table of Figure 2 .

[0060] Compared with experiments on the data set MQTTset, the application is superior to the traditional single model and the traditional two fusion models in accuracy, recall rate and F1.

[0061] The embodiments of the application are described in detail above with reference to the drawings, but the application is not limited to the above-described embodiments, and various changes can be made within the knowledge of those skilled in the art without departing from the spirit of the application.

Claims

1. A method for detecting abnormal IoT data based on improved feature selection and hierarchical models, characterized in that, Includes the following steps: Step A. Acquire the data generated by IoT devices and label the data as a set S = [s1, s2, s3, ..., sn]. T , S∈R n×m Where n represents the number of samples in dataset S, and for each sample si = [xi1, xi2, xi3, ..., xim, yi], i = 1, 2, 3, ..., m, it means that si contains an n-dimensional feature set x = [xi1, xi2, xi3, ..., xim] and a label category yi; Data preprocessing of dataset S, including missing values, outliers, and standardization, yields the processed dataset S. new Then proceed to step B; Step B. Take the dataset obtained from Step A. The feature set and label categories are divided to obtain the total feature set. And the set of label categories Y = [y1, y2, y3, ..., yn] T An improved relevance-based feature selection algorithm is used to select features from feature set X, eliminating redundant features, reducing feature dimensionality, and obtaining the optimal feature subset. Where c≤m, c represents the number of optimal features for each sample after filtering, and then proceed to step C; Step C. Divide the optimal feature subset Z obtained in Step B and the corresponding label category set Y into data partitions; The partition result is: Z = {Z} train Z test }, Y = {Y train ,Y test }; where the training set Z train Corresponding label Y train Test set Z test Corresponding label Y test ; Training set Z train and corresponding label Y train It is divided into three parts, denoted as Z. train ={Z train1 Z val2 Z val3 } and Y train ={Y train1 ,Y val2 ,Y val3 }, where Z train1 For the sub-training set, corresponding to label Y train1 Z val2 and Z val3 The sub-validation sets correspond to the labels Y respectively. val2 and Y val3 Then proceed to step D; Step D. Take the Z obtained in step C. train1 and Y train1 Train the first layer learner T1 = {T1_M1, T1_M2, T1_M3, T1_M4, T1_M5} of the hierarchical model, where T1_M1 is a decision tree, T1_M2 is a random forest, T1_M3 is a gradient boosting tree, T1_M4 is an XGBoost, and T1_M5 is a KNN. Save the model as the training model T1_train, and then proceed to step E. Step E. Take the sub-validation set Z obtained in step C. val2 The trained model T1_train from step D is used for validation. Since there are 5 learners, 5 sets of prediction results will be obtained. These 5 sets of prediction results are then merged into a new sample data Z. pro2 Then proceed to step F; Step F. Take the Y obtained in steps C and E. val2 and Z pro2 Train the second-layer learner T2 = {T2_M1, T2_M2} of the hierarchical model, save the trained model T2_train, and then proceed to step G; Step G. The sub-validation set Z obtained in step C... val3 The trained model T2_train from step F is used for validation. Since there are two learners, two sets of prediction results will be obtained. The two sets of prediction results are then merged into a new sample data Z. pro3 Then proceed to step H; Step H. Obtain Y from steps C and G val3 and Z pro3 Train the third layer of the input hierarchical model. The third layer is trained using the CatBoost algorithm. Save the entire trained model and then proceed to step I. Step I. The test set Z obtained in Step C... test and corresponding label Y test Input the overall hierarchical model for testing, and set the final test accuracy to be >= T%. If the requirements are not met, return to step D and readjust the parameters of each layer of the model until the final test results meet the requirements, and then proceed to step J. Step J. Use the hierarchical model trained in Step I for IoT anomaly detection. Deploy the model on a local IoT device detection terminal or cloud platform. Input the data collected by the IoT device into the trained model for real-time data anomaly detection to obtain the final detection result.

2. The IoT anomaly data detection method based on improved feature selection and hierarchical model according to claim 1, characterized in that, Step A includes the following sub-steps: Step A1. Prepare the training dataset S = [s1, s2, s3, ..., sn]. T To handle missing values ​​in the data, according to the formula... Fill in the gaps with the average; if there are outliers, delete them and then proceed to step A2. Step A2. Prepare the training dataset S = [s1, s2, s3, ..., sn]. T According to the formula Calculate the standard deviation, then use the formula Z-score standardization is performed to obtain the final dataset S. new Then proceed to step B.

3. The IoT anomaly data detection method based on improved feature selection and hierarchical model according to claim 1, characterized in that, Step B includes the following sub-steps: Step B1. Transfer the dataset The feature set and label categories are divided to obtain the total feature set. And the set of label categories Y = [y1, y2, y3, ..., yn] T ; Then proceed to step B2; Step B2. Define an empty set of selected features. Candidate feature set Z m ={XZ s }, Z m The initial set consists of m features from the feature set X; An improved relevance feature selection algorithm is presented: Where x j This represents the candidate features, which are derived from the candidate feature set Z. m ;x i This represents the selected features, which come from the set of selected features Z. s Y represents the label, which comes from the label category set Y = [y1, y2, y3, ..., yn]. T ;I(x j ;Y|x i ) represents conditional mutual information, indicating the candidate feature x. j and label category Y in the selected feature x i Information measure under influence; I(x) i ;Y|x j ) represents conditional mutual information, indicating the selected feature x. i and label category Y in candidate feature x j Information measure under influence; I(x) j ;x i ;Y) represents interactive information, indicating the selected feature x i Label category Y and candidate features x j The information correlation among the three; H(Y) is the information entropy of the label category; H(x) j H(x) represents the information entropy of the candidate feature; i The information entropy of the selected features is denoted as . I(x j ;x i Mutual information represents the selected feature x. i and candidate features x j The correlation of information between them; the set of features to be selected Z m All features are selected using an improved mutual information-based feature selection algorithm J(x) j The set Z is obtained by evaluating the results. m The score for each candidate feature; Then proceed to step B3; Step B3. Select the feature with the highest score from the scores of each candidate feature in Step B2, and add its index to the selected feature set Z. s In the middle; simultaneously update the candidate feature set Z m ={ZZ s }, that is, remove the feature; renew Feature selection algorithm j(x) j Then proceed to step B4; Step B4. If the feature set Z has been selected s If the number of elements in the subset is not equal to the number c of the set optimal feature subset, then repeat step B3; otherwise, stop the process and proceed to step B5. Step B5. The selected feature set Z obtained in step B4... s Traverse set Z s Z s The saved elements are the set of candidate features Z. m For each feature, assign an index and construct the optimal feature subset Z = [z1, z2, z3, ..., zc] based on its index. T , where c≤m; then proceed to step C.

4. The IoT anomaly data detection method based on improved feature selection and hierarchical model according to claim 1, characterized in that, Step C includes the following sub-steps: Step C1. Divide the optimal feature subset Z obtained in Step B and the corresponding label category set Y into data partitions; the partition result is: Z = {Z train Z test }, Y = {Y train ,Y test The ratio of Z to Z is 8:

2. train and Y train 80% of the total, Z test and Y test 20%; then proceed to step C2; Step C2. Training set Z train and corresponding label Y train It is divided into three parts, denoted as Z. train ={Zx rain1 Z val2 Z val3 } and Y train ={Y train1 ,Y val2 ,Y val3 }, where Z train1 For the sub-training set, corresponding to label Y train1 Z val2 and Z val3 The sub-validation sets correspond to the labels Y respectively. val2 and Y val3 The ratio of the three is 2:1:1, where Z train1 and Y train1 50%, Z val2 and Y val2 Z val3 and Y val3 It accounts for 25%; then proceed to step D.

5. The IoT anomaly data detection method based on improved feature selection and hierarchical model according to claim 4, characterized in that, Step D includes the following sub-steps: Step D1. Take the Z obtained in step C. train1 and Y train1 The first layer learner T1 = {T1_M1, T1_M2, T1_M3, T1_M4, T1_M5} of the hierarchical model is used for training, where T1_M1 is a decision tree, T1_M2 is a random forest, T1_M3 is a gradient boosting tree, T1_M4 is an XGBoost, and T1_M5 is a KNN. The process iterates through T1, and the Z... train1 and Y train1 Input the data into M1 for training, and then proceed to step D2; Step D2. Save the models trained in Step D1 each time to a new model set T1_train, where T1_train = {T1_m1} new ,T1_m2 new ,T1_m3 new ,T1_m4 new ,T1_m5 new Then proceed to step E.

6. The IoT anomaly data detection method based on improved feature selection and hierarchical model according to claim 1, characterized in that, Step E includes the following steps: Step E1. Obtain the sub-validation set Z from step B. val2 The trained model T1_train from step D is input for validation. Since there are 5 learners, 5 sets of prediction results will be obtained, represented as follows: Where [a1, a2, ..., ai] represents the result predicted by the first learner, which are sets of probabilities, where a1 + a2 + ..., ai = 1; if there is only one type of anomaly, then i = 2, which means that the probabilities of the predicted result being normal and abnormal are a1 and a2, respectively; if there is more than one type of anomaly, then i > 2, and [a1, a2, ..., ai] represents the probability of each type of anomaly predicted by the model; then proceed to step F.

7. The IoT anomaly data detection method based on improved feature selection and hierarchical model according to claim 1, characterized in that, Step F includes the following steps: Step F1. Take the Y obtained in steps C and E. val2 and Z pro2 Train the second-layer learner set T2 = {T2_M1, T2_M2} of the hierarchical model, where T2_M1 is a decision tree with a random seed and T2_M2 is a random forest with a random seed. Then proceed to step F2. Step F2. Save the new model trained in step F1 to a new model set T2_train, where T2_train = {T2_m1} new ,T2_m2 new Then proceed to step G.

8. The IoT anomaly data detection method based on improved feature selection and hierarchical model according to claim 1, characterized in that, Step G includes the following steps: Step G1. Take the sub-validation set Z obtained in step C. val3 The trained model T2_train from step F is input for validation. Since there are two learners, two sets of prediction results will be obtained. These two results are then combined into a new sample, represented as follows: Where [a1, a2, ..., ai] represents the prediction result of the first sample, which are sets of probabilities, where a1 + a2 + ..., ai = 1; if there is only one type of anomaly, then i = 2, which means that the probabilities of the prediction result being normal and abnormal are a1 and a2, respectively; if there is more than one type of anomaly, then i > 2, and [a1, a2, ..., ai] represents the probability of each type of anomaly predicted by the model; then proceed to step H.

9. The IoT anomaly data detection method based on improved feature selection and hierarchical model according to claim 1, characterized in that, Step H includes the following steps: Step H1. Obtain Y from steps C and G. val3 and Z pro3 The model is trained by inputting the third layer of the hierarchical model. The third layer is trained using the CatBoost algorithm, and the entire trained model is saved.

Images