Distributed anomaly detection method, device, equipment and medium for edge computing

Abstract

The present application relates to a distributed anomaly detection method, apparatus, device and medium for edge computing, and relates to the technical field of Internet of Things. The method is applied to an Internet of Things system, and the Internet of Things system includes at least one Internet of Things device. The method includes: receiving an anomaly detection request from a user, determining a target detection device according to a request parameter carried in the anomaly detection request, performing distributed anomaly detection according to data resource information stored in the target detection device, and obtaining a detection result corresponding to the anomaly detection request. When performing distributed detection on anomaly detection of an Internet of Things device, it is not necessary to transmit all the data of the Internet of Things device to the cloud, thereby solving the problem that the existing anomaly detection method for an Internet of Things device cannot accurately and timely perform anomaly detection on the Internet of Things device.

Description

Technical Field

[0001] The present application relates to the field of Internet of Things technology, and in particular to a distributed anomaly detection method, device, equipment and medium for edge computing. Background Art

[0002] At present, with the rapid development of the Internet of Things, the deployment of IoT devices has increased rapidly, which has greatly changed the way of life of human beings and facilitated human life and work. However, due to the customized development of IoT devices and the diverse deployment environments, they are in a "fragmented" state, which poses a great threat to the stability and robustness of the entire IoT system. With such a complex distribution of IoT nodes, in the absence of necessary maintenance methods, when facing abnormalities of the physical end nodes caused by external or internal factors, the entire IoT becomes very vulnerable.

[0003] The existing anomaly detection methods for IoT devices mainly use cloud servers to perform anomaly detection on IoT devices in a unified manner. However, when the existing anomaly detection methods use cloud servers to perform anomaly detection on IoT devices in a unified manner, all the data of each IoT device needs to be transmitted to the cloud for processing. In a complex IoT environment, facing system instability, high latency, and heterogeneous devices, the existing anomaly detection methods for IoT devices cannot accurately and timely detect anomalies on IoT devices. Summary of the invention

[0004] The present application provides a distributed anomaly detection method, apparatus, device and medium for edge computing, so that when performing anomaly detection on IoT devices, there is no need to transmit all the data of IoT devices to the cloud, thereby solving the problem that the existing IoT device anomaly detection method cannot accurately and timely detect anomalies on IoT devices.

[0005] In a first aspect, the present application provides a distributed anomaly detection method for edge computing, which is applied to an Internet of Things system, wherein the Internet of Things system includes at least one Internet of Things device, and the distributed anomaly detection method includes:

[0006] Receive anomaly detection requests from users;

[0007] Determining a target detection device according to a request parameter carried in the anomaly detection request;

[0008] Distributed anomaly detection is performed based on the data resource information stored in the target detection device to obtain a detection result corresponding to the anomaly detection request.

[0009] Optionally, performing distributed anomaly detection according to the data resource information stored in the target detection device to obtain a detection result corresponding to the anomaly detection request includes:

[0010] Extracting the detection algorithm and detection time period corresponding to the target detection device from the request parameters;

[0011] Determining whether the storage time period corresponding to the data resource information includes the detection time period;

[0012] If the storage time period corresponding to the data resource information matches the detection time period, extracting the target detection data corresponding to the detection time period from the data resource information;

[0013] Based on the detection algorithm and in combination with the target detection data, anomaly detection is performed on the target detection device to obtain the detection result.

[0014] Optionally, the target detection data includes device operation status data and device collection data corresponding to the target detection device, and the abnormality detection of the target detection device based on the detection algorithm and in combination with the target detection data to obtain the detection result includes:

[0015] Using the device operation status data, determining whether the target detection device is capable of running the detection algorithm;

[0016] If the target detection device can run the detection algorithm, the device operation status data and the device collection data are predicted by the detection algorithm to obtain the abnormality rate information and abnormality detection information of the target detection device;

[0017] The detection result is generated based on the abnormality rate information and the abnormality detection information.

[0018] Optionally, also include:

[0019] When the storage time period corresponding to the data resource information does not match the detection time period, and / or when the target detection device cannot run the detection algorithm, sending detection failure information to a gateway device associated with the target detection device;

[0020] According to the anomaly detection algorithm result generated by the gateway device, a detection result corresponding to the anomaly detection request is determined, and the anomaly detection algorithm result is a result generated by the gateway device performing anomaly detection based on the detection failure information.

[0021] Optionally, generating the detection result based on the abnormality rate information and the abnormality detection information includes:

[0022] If the anomaly detection information is anomaly detection success information, generating a detection success result based on the anomaly rate information and the anomaly detection success information;

[0023] If the abnormality detection information is abnormality detection failure information, a detection failure result is generated based on the abnormality detection failure information.

[0024] Optionally, determining a target detection device according to a request parameter carried in the anomaly detection request includes:

[0025] Extracting an anomaly detection link from the anomaly detection request;

[0026] Performing parameter decomposition processing on the anomaly detection request to obtain request parameters, wherein the request parameters include location information of the node to be detected;

[0027] The Internet of Things device corresponding to the location information of the node to be detected is determined as the target detection device.

[0028] Optionally, before receiving the abnormality detection request from the user, the method further includes:

[0029] Collecting data through IoT devices to obtain operating status information, collection information, and collection time period of the IoT devices;

[0030] Generate data to be detected based on the operating status information, the collected information and the collection time period;

[0031] Determine whether the cache data volume of the IoT device is greater than an initial data volume threshold;

[0032] If the cache data amount of the IoT device is not greater than the initial data amount threshold, storing the data to be detected in the IoT device;

[0033] If the cached data volume of the IoT device is greater than the initial data volume threshold, data upload information is sent to a gateway device associated with the IoT device, where the data upload information carries the data to be detected, and the gateway device is used to store the data to be detected carried by the data upload information.

[0034] In a second aspect, the present application provides a distributed anomaly detection device for edge computing, including:

[0035] Anomaly detection request receiving module, used to receive anomaly detection request from a user;

[0036] A target detection device determination module, used to determine a target detection device according to a request parameter carried by the anomaly detection request;

[0037] The distributed anomaly detection module is used to perform distributed anomaly detection based on the data resource information stored in the target detection device to obtain a detection result corresponding to the anomaly detection request.

[0038] In a third aspect, the present application provides an electronic device, including a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other via the communication bus;

[0039] Memory, used to store computer programs;

[0040] The processor is used to implement the steps of the distributed anomaly detection method for edge computing as described in any one of the embodiments of the first aspect when executing the program stored in the memory.

[0041] In a fourth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of the distributed anomaly detection method for edge computing as described in any one of the embodiments of the first aspect are implemented.

[0042] In summary, the embodiment of the present application receives the user's anomaly detection request through the Internet of Things system, determines the target detection device based on the request parameters carried by the anomaly detection request, performs distributed anomaly detection based on the data resource information stored in the target detection device, and obtains the detection result corresponding to the anomaly detection request. By using the data resource information stored in the target detection device for distributed detection, when performing anomaly detection on the Internet of Things device, there is no need to transmit all the data of the Internet of Things device to the cloud, thereby solving the problem that the existing Internet of Things device anomaly detection method cannot accurately and timely perform anomaly detection on the Internet of Things device. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0044] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0045] Figure 1 A schematic diagram of an Internet of Things system architecture provided by an embodiment of the present application;

[0046] Figure 2 A schematic diagram of a distributed anomaly detection method for edge computing provided in an embodiment of the present application;

[0047] Figure 3 This is a schematic diagram of the steps of a distributed anomaly detection method for edge computing provided by an optional embodiment of the present application;

[0048] Figure 4 This is a flow chart of data caching of an IoT device provided by an optional embodiment of the present application;

[0049] Figure 5 is an execution flow chart of an abnormality detection request provided by an optional embodiment of the present application;

[0050] Figure 6 This is a flow chart of edge gateway data caching provided by an optional embodiment of the present application;

[0051] Figure 7 A structural block diagram of an abnormality detection device provided in an embodiment of the present application;

[0052] Figure 8 It is a structural schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0053] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0054] In the related technologies, the existing IoT device anomaly detection system mainly collects data from various IoT devices through the cloud under the distributed structure of the end-edge cloud. The cloud performs anomaly detection on the collected data through clustering, neural network and other algorithms. In a complex IoT environment, faced with system instability, high latency and heterogeneous devices, the anomaly detection system cannot perform real-time operation and calculation on the collected data, and cannot eliminate abnormal IoT devices in time, resulting in poor system stability.

[0055] One of the concepts of the embodiments of the present application is to propose a distributed anomaly detection method for edge computing, which is applied to an Internet of Things system. The Internet of Things system includes at least one Internet of Things device. When performing anomaly detection on an Internet of Things device, by receiving an anomaly detection request from a user, a target detection device is determined according to request parameters carried in the anomaly detection request, and distributed anomaly detection is performed according to data resource information stored in the target detection device to obtain a detection result corresponding to the anomaly detection request. By using the data resource information stored in the target detection device for distributed detection, when performing anomaly detection on an Internet of Things device, there is no need to transmit all the data of the Internet of Things device to the cloud, thereby solving the problem that the existing Internet of Things device anomaly detection method cannot accurately and timely perform anomaly detection on the Internet of Things device.

[0056] To facilitate the understanding of the embodiments of the present application, further explanation will be given below in conjunction with the drawings and specific embodiments. The embodiments do not constitute a limitation on the embodiments of the present application.

[0057] In a specific implementation, this embodiment can use the cloud, gateway devices (such as edge gateways, etc.) and IoT devices to build an edge computing IoT system. Figure 1 When joining the IoT system, the IoT device can first connect to one of the edge gateways and become a leaf node of the IoT system. The IoT device can upload connection information containing connection parameters to the edge gateway, where the connection information includes but is not limited to the type of relevant data resources that the IoT device can collect, the data exchange format, the communication mode, the location of the IoT device, the communication protocol and other parameters. The edge gateway can be responsible for maintaining the uploaded connection parameters of the IoT device, and the IoT device can also update the connection parameters to the edge gateway when necessary.

[0058] Figure 2 The present invention provides a flow chart of a distributed anomaly detection method for edge computing provided in an embodiment of the present invention. In a specific implementation, the distributed anomaly detection method for edge computing provided in an embodiment of the present invention can be applied to an Internet of Things system, which can include at least one Internet of Things device. Figure 2 As shown, the distributed anomaly detection method for edge computing provided in the embodiment of the present application may specifically include the following steps:

[0059] Step 210: Receive an abnormality detection request from a user.

[0060] Specifically, the anomaly detection request may carry request parameters, which may be used to determine the IoT device that requires anomaly detection, the anomaly detection algorithm, and the data for anomaly detection, etc., which is not limited in this embodiment of the present application.

[0061] In a specific implementation, the user of this embodiment can use a browser, command, instruction, etc. to send an anomaly detection request to the IoT system by using a network link to implement anomaly detection of one or more IoT devices. If the user needs to perform anomaly detection on one or more IoT devices, the user can set the request parameters corresponding to the IoT devices that need to be detected in the anomaly detection request to implement anomaly detection on the specified IoT devices. The IoT system can receive the user's anomaly detection request so that the IoT device that needs to be detected can be determined based on the request parameters carried in the anomaly detection request, so that the IoT device can be used as the target detection device, that is, step 120 is executed.

[0062] Step 220: Determine a target detection device according to the request parameters carried in the anomaly detection request.

[0063] Specifically, the request parameters may include parameters such as an Internet Protocol (IP) address, a port number (port), anomaly detection algorithm parameters, algorithm input parameters, node location of anomaly detection, detection time period of anomaly detection, and detection data volume, and the embodiments of the present application do not limit this. Among them, the anomaly detection algorithm parameters can be used to specify the anomaly detection algorithm used for anomaly detection, such as the anomaly detection algorithm can include but is not limited to: principal component analysis (PCA) algorithm, minimum covariance determinant (MCD) algorithm, K-nearest neighbor (KNN) classification algorithm, one-class support vector machine (OCSVM) algorithm, local anomaly factor (LOF) algorithm and isolation forest (Isolation Forest) algorithm. The node location of anomaly detection can be used to specify the device that needs to be detected, including an Internet of Things device and / or a gateway device associated with an Internet of Things device, and the embodiments of the present application do not limit this.

[0064] After receiving the anomaly detection request, this embodiment can perform parameter parsing on the anomaly detection link included in the anomaly detection request, extract the node position of the anomaly detection from the anomaly detection link, and determine the Internet of Things device corresponding to the node position of the anomaly detection as the target detection device.

[0065] Step 230: Perform distributed anomaly detection based on the data resource information stored in the target detection device to obtain a detection result corresponding to the anomaly detection request.

[0066] Specifically, the detection results can be divided into detection success results and detection failure results, and the embodiments of the present application do not limit this. Specifically, after the embodiment of the present application determines the target detection device, distributed anomaly detection can be performed based on the data resource information stored in the target detection device. For example, data that needs to be detected for anomaly can be extracted from the data resource information stored in the target detection device as the target detection data, and the target detection data is detected for anomaly through an anomaly detection algorithm to obtain an anomaly detection result as the detection result corresponding to the anomaly detection request, so that it can be determined whether the IoT device is abnormal based on the detection result. For example, when the detection result is a detection success result, it can be determined that the IoT device is not abnormal, and when the detection result is a detection failure result, it can be determined that the IoT device is abnormal. By using the data resource information stored in the target detection device for distributed detection, when performing anomaly detection on the IoT device, it is not necessary to transmit all the data of the IoT device to the cloud, thereby solving the problem that the existing IoT device anomaly detection method cannot accurately and timely perform anomaly detection on the IoT device.

[0067] In a specific implementation, when this embodiment performs distributed anomaly detection on a target detection device, it can extract anomaly detection algorithm parameters corresponding to the target detection device from the request parameters carried by the anomaly detection request, determine the anomaly detection algorithm used by the target detection device when performing anomaly detection based on the anomaly detection algorithm parameters, and extract the detection time period from the request parameters. Based on the detection time period, data corresponding to the detection time period is extracted from the data resource information stored in the target detection device as target detection data, and the target detection data can subsequently be subjected to anomaly detection through the anomaly detection algorithm.

[0068] In actual processing, since the memory resources and central processing unit (CPU) resources of the IoT device are limited, that is, the data that the IoT device can store is limited, and the computing performance of the device is limited, when the IoT device is used as a target detection device for anomaly detection, it may happen that the IoT device cannot run the anomaly detection algorithm and / or the data resource information stored in the IoT device does not have data corresponding to the detection time period. At this time, it may not be possible to complete the anomaly detection directly on the IoT device. In order to realize the anomaly detection of the IoT device, the IoT device can be associated with the upper-level gateway device, and the data that cannot be stored can be stored in the gateway device. When the IoT device cannot run the anomaly detection algorithm and / or the data resource information stored in the IoT device does not have data corresponding to the detection time period, the anomaly detection algorithm can be run through the gateway device, and the data resource information stored in the gateway device can be detected by the anomaly detection algorithm. Detection, thereby realizing distributed anomaly detection, fully considering the performance of the IoT device, when the performance of the IoT device cannot perform anomaly detection or the anomaly detection time is long, the anomaly detection is performed through the data resource information stored in the gateway device. Compared with the existing solution of performing anomaly detection of IoT devices through the cloud, the distributed anomaly detection method for edge computing provided in the embodiment of the present application can quickly complete the anomaly detection of the IoT device, and has the advantages of fast, low latency and fast response.

[0069] It can be seen that the embodiment of the present application receives the user's anomaly detection request through an Internet of Things system including at least one Internet of Things device, determines the target detection device according to the request parameters carried by the anomaly detection request, performs distributed anomaly detection according to the data resource information stored in the target detection device, and obtains the detection result corresponding to the anomaly detection request. By using the data resource information stored in the target detection device for distributed detection, when performing anomaly detection on the Internet of Things device, there is no need to transmit all the data of the Internet of Things device to the cloud, which has the advantages of low computing latency and fast response, and effectively solves the problem that the existing Internet of Things device anomaly detection method cannot accurately and timely perform anomaly detection on the Internet of Things device.

[0070] Reference Figure 3, shows a schematic flow chart of the steps of a distributed anomaly detection method for edge computing provided by an optional embodiment of the present application, the distributed anomaly detection method can be applied to an Internet of Things system, and the Internet of Things system can include at least one Internet of Things device. The distributed anomaly detection method for edge computing can specifically include the following steps:

[0071] Step 310: Receive an abnormality detection request from a user.

[0072] In the specific implementation, refer to Figure 1 , the operating parameters of the edge gateway in the IoT system can be set, such as directly on the edge gateway before the IoT system is running, or on demand when the IoT system is running, where the operating parameters include but are not limited to cache expiration time, maximum number of concurrent requests, cache policy execution mode and related setting parameters, etc. The edge gateway can provide connection information to the cloud, including access address, access port and some or all operating parameters, and according to the actual needs of the IoT system, the edge gateway can also provide relevant information of IoT devices to the cloud.

[0073] Furthermore, for IoT devices within the IoT system, the IoT devices can collect and sample data to use the collected data as data for anomaly detection, wherein the IoT device data resources used for anomaly detection mainly include but are not limited to runtime status information (i.e., the device's operating status information) and information collected by the device (i.e., collection information). The device's operating status information may include the resource utilization of the IoT device, such as parameters such as CPU utilization and remaining memory. The collection information may include parameters such as temperature and humidity. Both the device status information and the collection information may be cached in the form of timestamps. Considering that the storage resources of IoT devices are limited, when caching data resources, a distributed caching mechanism may be used to cache the device status information and collection information in the form of timestamps. For example, the device status information and collection information that cannot be stored by the IoT device may be uploaded to an edge gateway associated with the IoT device, and the anomaly detection data uploaded by the IoT device may be cached through the edge gateway. By distributing and caching the anomaly detection data, when anomaly detection is performed, if the anomaly detection data has been stored in the IoT device, the anomaly detection algorithm can be run on the anomaly detection data through the IoT device, thereby quickly determining the anomaly detection result; if the anomaly detection data is not stored in the IoT device, the anomaly detection algorithm can be run on the anomaly detection data uploaded by the IoT device through the gateway device associated with the IoT device, thereby also realizing anomaly detection of the IoT device, and then realizing distributed anomaly detection, which has the advantages of low computing latency and fast response.

[0074] In an optional embodiment, before the embodiment of the present application receives the user's abnormality detection request, it may also specifically include: collecting data through the Internet of Things device to obtain the operating status information, collection information and collection time period of the Internet of Things device; generating the data to be detected based on the operating status information, the collection information and the collection time period; judging whether the cached data volume of the Internet of Things device is greater than the initial data volume threshold; if the cached data volume of the Internet of Things device is not greater than the initial data volume threshold, storing the data to be detected in the Internet of Things device; if the cached data volume of the Internet of Things device is greater than the initial data volume threshold, sending data upload information to the gateway device associated with the Internet of Things device, the data upload information carries the data to be detected, and the gateway device is used to store the data to be detected carried by the data upload information. Among them, the initial data volume threshold can be the maximum cached data volume of the Internet of Things device, and the embodiment of the present application does not limit this.

[0075] As an example, see Figure 4 When the IoT device is initialized, the maximum cache data volume can be set for each IoT device as the initial data volume threshold. Of course, a maximum cache data volume can also be set uniformly for multiple IoT devices. This example does not limit this. In a data collection cycle, the IoT device can collect the operating status information and collection information corresponding to each time period during operation, and generate the data to be detected by using the operating status information, collection information and collection time period in a timestamp manner. Then, it can be determined whether the amount of data cached locally is greater than the initial data volume threshold, that is, whether the amount of data cached locally is greater than the initial data volume threshold, and when it is determined that the amount of data cached locally is not greater than the initial data volume threshold, the data to be detected can be directly stored locally in the IoT device; when it is determined that the amount of data cached locally is greater than the initial data volume threshold, the data to be detected can be uploaded to the gateway device and stored by the gateway device, or the old data exceeding the initial data volume threshold can be uploaded to the gateway device and stored by the gateway device. By uploading the data to be detected to a gateway device such as an edge gateway, when the anomaly detection algorithm cannot run anomaly detection on the IoT device, the anomaly detection algorithm can be run by the edge gateway to realize anomaly detection of the IoT device, thereby realizing distributed anomaly detection.

[0076] Step 320: extract an anomaly detection link from the anomaly detection request.

[0077] Specifically, the anomaly detection link may be a Uniform Resource Locator (URL) link, which is not limited in the embodiments of the present application. The anomaly detection link may include request parameters, which are not limited in the embodiments of the present application. The present embodiment may extract the anomaly detection link from the anomaly detection request so that the target detection device may be determined based on the request parameters included in the anomaly detection link.

[0078] In a specific implementation, this embodiment can perform expression management for the anomaly detection link of the anomaly detection request in advance, that is, describe the content of the anomaly detection request through the URL, abstract and express the anomaly detection request, and decompose the anomaly detection request into multiple parameters of the URL as request parameters, thereby effectively reducing communication overhead and improving the user's data access friendliness and cross-platform. For example, taking the example of a user sending an anomaly detection request to the cloud in the Internet of Things system, the URL format of the anomaly detection request can be:

[0079] http: / / [cloud_ip_address]:[port] / [method] / [parameter] / [position] / [time] / [number], where cloud_ip_address is the cloud IP address, port is the access port number, method, parameter, position, time, and number can all be used as URL request parameters. For example, method can be the anomaly detection algorithm used in the request; parameter can be the algorithm input parameter, which can be a JSON string, such as "{contamination=0.1,n_neighbors=5}" ; position is the node position for requesting anomaly detection, in the format of "edge gateway id: IoT device id". If it only contains the edge gateway id, it means to perform anomaly detection on all IoT devices under the edge gateway. If it is the keyword "ALL", it means to perform anomaly detection on all devices under the cloud. time is the time period for anomaly detection, in the format of "start time:end time". If it is the keyword "Latest", it means to detect the most recently counted data. number is the amount of data for anomaly detection. If the amount of data in the time period is less than this amount, all the data in the time period will be used for anomaly detection. If the amount of data in the time period is more than this amount, number pieces of data will be randomly selected for anomaly detection.

[0080] As an example, see Figure 5,The user can send an anomaly detection request to the IoT system through methods such as a browser, command line, instructions, etc. After the cloud in the IoT system receives the anomaly detection request, the URL link can be extracted from the anomaly detection request as the anomaly detection link, so that the anomaly detection link can be parsed to obtain the request parameters.

[0081] Step 330: perform parameter decomposition processing on the anomaly detection request to obtain request parameters, wherein the request parameters include location information of the node to be detected.

[0082] Specifically, the location information of the node to be detected may include the node location of the anomaly detection, and the location information of the node to be detected may be used to determine the IoT device that needs to be detected for anomaly, which is not limited in the embodiments of the present application.

[0083] After determining the anomaly detection link, this embodiment can perform parameter decomposition on the anomaly detection link, such as decomposing the anomaly detection algorithm parameters, algorithm input parameters, anomaly detection node positions, anomaly detection detection time periods, and detection data volume contained in the anomaly detection link, and extracting these parameters from the anomaly detection link as request parameters.

[0084] As an example, see Figure 5 After receiving the URL information, the cloud can extract the access IP and port of the edge gateway from the parameter information of the locally maintained edge gateway, and use the access IP and port of the edge gateway to forward the anomaly detection request to the edge gateway. The forwarded URL format can be: http: / / [edge_ip_address]:[port] / [method] / [parameter] / [position] / [time] / [number], which is not limited in this example. Among them, edge_ip_address can be the IP address of the corresponding edge gateway, and port can be the port of the edge gateway, which is not limited in this example.

[0085] Step 340: determine the Internet of Things device corresponding to the location information of the node to be detected as the target detection device.

[0086] In a specific implementation, the IoT device can be determined based on the location information of the node to be detected, and then the IoT device can be used as a target detection device.

[0087] For example, refer to Figure 5After receiving the URL information forwarded by the cloud, the edge gateway can obtain the relevant information of the IoT device stored in advance from the local storage. Then, the edge gateway can perform parameter parsing on the URL information forwarded by the cloud, extract the request parameters from the URL information, and extract the location information of the node to be detected from the request parameters. According to the location information of the node to be detected, the IoT device that matches the location information of the node to be detected is searched from the relevant information of the IoT device as the target detection device.

[0088] Step 350: extracting the detection algorithm and detection time period corresponding to the target detection device from the request parameters.

[0089] In a specific implementation, this embodiment can extract anomaly detection algorithm parameters and detection time period parameters from the request parameters, so that the detection algorithm corresponding to the target detection device can be determined according to the anomaly detection algorithm parameters, and the time period corresponding to the anomaly detection data required can be determined according to the detection time period parameters, so that the data corresponding to the detection time period can be extracted from the data resource information stored in the target detection device as the target detection data.

[0090] As an example, after the edge gateway determines the target detection device, it can extract the IP address and port corresponding to the target detection device from the relevant information of the stored IoT device, and forward the URL information to the target detection device through the IP address and port corresponding to the target detection device. The URL format of the URL information forwarded by the edge gateway can be:

[0091] http: / / [iot_ip_address]:[port] / [method] / [parameter] / [time] / [number], which is not limited in this example. Among them, iot_ip_address can be the IP address of the corresponding IoT device, and port can be the access port number of the target detection device, which is not limited in this example.

[0092] In actual processing of the embodiment of the present application, after the target detection device receives the URL information forwarded by the edge gateway, it parses the URL information to obtain the request parameters, and can extract the detection algorithm and detection time period from the request parameters.

[0093] Step 360: Determine whether the storage time period corresponding to the data resource information matches the detection time period.

[0094] In a specific implementation, since the data resource information stored in the target detection device can be stored in the form of a timestamp, the data resource information can have a corresponding storage time period. When performing anomaly detection, in order to quickly determine whether the target detection device stores the data required for anomaly detection, the target detection device in this embodiment can determine the storage time period corresponding to the data resource information for the detection time period after determining the detection time period, and then determine whether the storage time period matches the detection time period. For example, taking January 1, 2000 as an example, when the storage time period corresponding to the data resource information of the Internet of Things device is from 10:00 to 12:00, if the detection time period is from 10:00 to 11:00, it can be determined that the storage time period matches the detection time period; if the detection time period is from 10:00 to 12:10, it can be determined that the storage time period does not match the detection time period. In this embodiment, when the storage time period matches the detection time period, it can be determined that the data resource information stored in the target detection device contains data for anomaly detection, that is, the data resource information contains target detection data. When performing anomaly detection, the target detection data can be directly extracted from the data resource information stored in the target detection device for anomaly detection, thereby realizing rapid detection. When the storage time period does not match the detection time period, it is determined that the data resource information stored in the target detection device does not contain data for anomaly detection, that is, the data resource information does not contain target detection data. Anomaly detection may not be performed on the target detection device, and the anomaly detection process may be executed through an edge gateway device associated with the target detection device, thereby realizing distributed anomaly detection.

[0095] Step 370: If the storage time period corresponding to the data resource information matches the detection time period, then extract the target detection data corresponding to the detection time period from the data resource information.

[0096] Specifically, the target detection data may be data for abnormality detection, and the target detection data may include device operation status data and device collection data, which is not limited in the embodiments of the present application. Specifically, when the storage time period corresponding to the data resource information includes the detection time period, the embodiment may determine that the target detection device stores the data required for abnormality detection, and may extract the data corresponding to the detection time period from the data resource information stored in the target detection device as the target detection data.

[0097] Step 380: Based on the detection algorithm and in combination with the target detection data, perform anomaly detection on the target detection device to obtain the detection result.

[0098] In this embodiment, after determining the target detection data, the target detection device can perform anomaly detection on the target detection device through the detection algorithm combined with the target detection data when the detection algorithm can be run. For example, the anomaly detection algorithm can perform anomaly detection on the target detection data to determine whether there is abnormal data in the target detection data. Then, the abnormal data can be calculated to account for the total proportion of the target detection data to obtain the anomaly rate. After determining the anomaly rate, anomaly detection success information can be generated, and anomaly detection success result can be generated based on the anomaly rate and anomaly detection success information. If the anomaly rate is not calculated, anomaly detection failure information can be generated, and then a detection failure result can be generated based on the anomaly detection failure information, thereby realizing anomaly detection of the Internet of Things device. When performing anomaly detection on the Internet of Things device, there is no need to transmit all the data of the Internet of Things device to the cloud, thereby solving the problem that the existing Internet of Things device anomaly detection method cannot accurately and timely perform anomaly detection on the Internet of Things device.

[0099] In a specific implementation, the target detection device may have limited storage capacity, resulting in limited storage data. In this case, anomaly detection can be performed through a gateway device associated with the target detection device, and anomaly detection can be performed using the data to be detected corresponding to the target detection device pre-stored in the gateway device, thereby achieving distributed detection. Through a distributed data caching mechanism, data resources are distributedly cached in IoT devices and gateway devices, that is, data resources are distributedly cached in multiple devices, so as to utilize edge computing to reduce data transmission volume, reduce access latency, and other purposes, reduce the number of requests for data resources, and thus improve the execution efficiency of anomaly detection tasks.

[0100] In actual processing, the target detection device may have limited computing power (such as CPU computing power, etc.), that is, the current computing power of the target detection device may not be able to run the anomaly detection algorithm normally. At this time, the anomaly detection algorithm can also be run through the gateway device associated with the target detection device to perform anomaly detection on the target detection data to achieve distributed detection.

[0101] Optionally, in the case where the target detection data includes device operating status data and device collection data corresponding to the target detection device, the above-mentioned abnormality detection of the target detection device based on the detection algorithm and in combination with the target detection data to obtain the detection result may specifically include the following sub-steps:

[0102] Sub-step 3801, using the device operation status data, determines whether the target detection device can run the detection algorithm.

[0103] Specifically, the device operation status data may include the runtime status information of the target detection device, which is not limited in the embodiments of the present application; the device collection data may include the collection information of the target detection device, which is not limited in the embodiments of the present application.

[0104] In a specific implementation, this embodiment can determine the computing capacity of the target detection device based on the device operation status data, and then determine whether the computing capacity of the target detection device can run the anomaly detection algorithm. Figure 5 After determining the detection algorithm, the target detection device can determine whether the anomaly detection algorithm can be run according to the device operation status data, so that when the anomaly detection algorithm can be run normally, the detection algorithm can be directly run through the target detection device to perform anomaly detection on the target detection data; when the anomaly detection algorithm cannot be run normally, the anomaly detection algorithm can be run through gateway devices such as edge gateways to realize distributed anomaly detection.

[0105] In actual processing, in order to quickly realize anomaly detection, in an optional implementation, an algorithm running mark can be set in advance for the target detection device. For example, for each IoT device in the IoT system, it can be determined whether the anomaly detection algorithm can be run on the IoT device based on the computing power of the IoT device. When it is determined that the anomaly detection algorithm cannot be run on the IoT device, an algorithm running mark can be set for the IoT device. The mark indicates that the computing power of the current IoT device cannot run the anomaly detection algorithm. When performing distributed anomaly detection, the algorithm running mark of the target detection device can be used to quickly determine whether the target detection device can run the anomaly detection algorithm. When the target detection device can run the anomaly detection algorithm, the anomaly detection algorithm is directly run through the target detection device to realize anomaly detection; when the target detection device cannot run the anomaly detection algorithm, the anomaly detection algorithm is run through the gateway device, which can quickly realize distributed anomaly detection and achieve the purpose of improving the efficiency of distributed anomaly detection.

[0106] Sub-step 3802: If the target detection device can run the detection algorithm, the device operation status data and the device collection data are predicted using the detection algorithm to obtain the abnormality rate information and abnormality detection information of the target detection device.

[0107] In a specific implementation, if the target detection device can run the detection algorithm, the target detection device can use the detection algorithm to perform status prediction on the device operation status data and the device collection data to obtain the abnormality rate as the abnormality rate information, and can determine the abnormality detection success information based on the abnormality rate as the abnormality detection information.

[0108] As an example, to improve the accuracy of anomaly detection, when the IoT device is initialized, data can be collected from the IoT device, and the device operation status data and device acquisition data during the initial operation of the IoT device can be collected as a training set. The data contained in the training set can be data with an anomaly rate of 0, that is, normal data. Then, for each anomaly detection algorithm, the training set can be used to train the algorithm so that the anomaly detection algorithm can learn the characteristics of normal data through the training set. Figure 5 When predicting the status of device operation status data and device collection data, the trained anomaly detection algorithm can predict the anomaly of each piece of data in the device operation status data and device collection data, predict whether each piece of data is abnormal, and calculate the percentage of abnormal data in the target detection data to obtain the anomaly rate. The anomaly rate can then be used to determine whether the IoT device has an anomaly, realize anomaly detection of the IoT device, and obtain the detection results. The target detection device can then return the algorithm results to the associated edge gateway. The edge gateway will sort out all the algorithm results (i.e., detection results) of the IoT devices and return them to the cloud, which will then be fed back to the user through the cloud.

[0109] In an optional embodiment, the embodiment of the present application also includes: when the storage time period corresponding to the data resource information does not match the detection time period, and / or when the target detection device cannot run the detection algorithm, sending detection failure information to a gateway device associated with the target detection device; based on the anomaly detection algorithm result generated by the gateway device, determining the detection result corresponding to the anomaly detection request, the anomaly detection algorithm result being the result generated by the gateway device performing anomaly detection based on the detection failure information.

[0110] In a specific implementation, when the storage time period corresponding to the data resource information does not match the detection time period, and / or when the target detection device cannot run the detection algorithm, it can be determined that the target detection device does not store data corresponding to the detection time period, or the computing power of the target detection device is unable to run the anomaly detection algorithm. At this time, anomaly detection can be performed through a gateway device associated with the target detection device to generate anomaly detection algorithm results, and then the detection result can be determined based on the anomaly detection algorithm results. For example, referring to Figure 5When the target detection device does not store data corresponding to the detection time period and / or cannot run the anomaly detection algorithm, it can generate operation failure information, and can generate detection failure information in combination with the operation failure information and the failure reason and send it to the edge gateway. When the edge gateway receives the detection failure information, it will determine whether the data resources in the detection time period corresponding to the target detection device have been cached. If not, the edge gateway will send a data cache request to the corresponding target detection device to obtain the target detection data from the target detection device. Then the edge gateway can organize the target detection data set. After the data is organized, the corresponding anomaly detection algorithm will be run on the edge gateway to obtain the detection result. By distributing and caching data resources on multiple devices, edge computing can be used to reduce data transmission volume and access latency. The highly repetitive and time-consuming anomaly detection tasks can be assigned to edge gateways and IoT devices for distributed execution. This can reduce network latency and improve algorithm execution efficiency, effectively control data request hit rates, and reduce the number of requests for data resources, thereby improving the execution efficiency of anomaly detection tasks. Secondly, the interoperability and cross-platform nature of distributed computing can be improved through URL request descriptions. Finally, the distributed execution of anomaly detection improves the resource utilization of edge gateways and IoT devices, effectively reducing the computational latency of anomaly detection.

[0111] As an example, see Figure 6 , when it is necessary to perform anomaly detection on the edge gateway side (indicating that the computing power of the target detection device is not capable of running the anomaly detection algorithm at this time), but the edge gateway does not have the data resources within the time period requested by the required IoT device, that is, the edge gateway does not store the target detection data, the edge gateway can send a data resource request to the IoT device, and obtain the data resources within the request time period from the IoT device through the data resource request. When the relevant data resources are successfully collected, the edge gateway will save the collected data resources locally according to the IoT device and timestamp, and use the anomaly detection algorithm to perform anomaly detection as the target detection data. If the edge gateway does not successfully collect the relevant data resources from the IoT device, the edge gateway can determine whether the failure is caused by the request timeout. If so, the edge gateway can continue to request data resources from the IoT device; if not, it means that the IoT device may also lack this part of the data resources, that is, the IoT device does not store the relevant data resources. At this time, it can be determined that the anomaly detection has failed, and a detection failure result can be generated, ending the anomaly detection process of the IoT device.

[0112] Sub-step 3803, generating the detection result based on the abnormality rate information and the abnormality detection information.

[0113] After determining the abnormality rate, this embodiment can determine abnormality detection success information based on the abnormality rate as abnormality detection information, and then generate a successful detection result based on the abnormality rate and the abnormality detection success information; when the abnormality rate is not successfully determined, abnormality detection failure information can be generated as abnormality detection information, and a detection failure result is generated based on the abnormality detection failure information.

[0114] In an optional embodiment, the embodiment of the present application generates the detection result based on the abnormality rate information and the abnormality detection information, which may specifically include: if the abnormality detection information is abnormality detection success information, then based on the abnormality rate information and the abnormality detection success information, a detection success result is generated; if the abnormality detection information is abnormality detection failure information, then based on the abnormality detection failure information, a detection failure result is generated.

[0115] In summary, the embodiment of the present application receives an anomaly detection request from a user to extract an anomaly detection link from the anomaly detection request, then performs parameter decomposition processing on the anomaly detection request to obtain request parameters, determines the Internet of Things device corresponding to the location information of the node to be detected contained in the request parameters as the target detection device, extracts the detection algorithm and detection time period corresponding to the target detection device from the request parameters, and when the storage time period and the detection time period corresponding to the data resource information match, extracts the target detection data corresponding to the detection time period from the data resource information, performs anomaly detection on the target detection device based on the detection algorithm and in combination with the target detection data to obtain a detection result, thereby realizing anomaly detection of the Internet of Things device. When performing anomaly detection on the Internet of Things device, it is not necessary to transmit all the data of the Internet of Things device to the cloud. Through the distributed data caching mechanism, the data resources are distributedly cached in multiple devices, effectively controlling the data request hit rate and reducing the number of requests for data resources, thereby improving the execution efficiency of the anomaly detection task, thereby solving the problem that the existing Internet of Things device anomaly detection method cannot accurately and timely perform anomaly detection on the Internet of Things device.

[0116] It should be noted that, for the purpose of simple description, the method embodiments are expressed as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present application are not limited to the described order of actions, because according to the embodiments of the present application, certain steps may be performed in other orders or simultaneously.

[0117] like Figure 7 As shown, the embodiment of the present application also provides a distributed anomaly detection method device 700 for edge computing, including:

[0118] Anomaly detection request receiving module 710, used to receive anomaly detection request from a user;

[0119] A target detection device determination module 720, configured to determine a target detection device according to a request parameter carried in the anomaly detection request;

[0120] The distributed anomaly detection module 730 is used to perform distributed anomaly detection based on the data resource information stored in the target detection device to obtain a detection result corresponding to the anomaly detection request.

[0121] Optionally, the target detection device determination module 720 includes:

[0122] An extraction submodule, used to extract the detection algorithm and detection time period corresponding to the target detection device from the request parameters;

[0123] A first judgment submodule, used to judge whether the storage time period corresponding to the data resource information matches the detection time period;

[0124] a target detection data extraction submodule, configured to extract target detection data corresponding to the detection time period from the data resource information when the storage time period corresponding to the data resource information matches the detection time period;

[0125] The anomaly detection submodule is used to perform anomaly detection on the target detection device based on the detection algorithm and in combination with the target detection data to obtain the detection result.

[0126] Optionally, the target detection data includes device operation status data and device collection data corresponding to the target detection device, and the abnormality detection submodule includes:

[0127] A first judgment unit, used to judge whether the target detection device can run the detection algorithm by using the device operation status data;

[0128] A state prediction unit, used to perform state prediction on the device operation state data and the device collection data through the detection algorithm when the target detection device is capable of running the detection algorithm, so as to obtain abnormality rate information and abnormality detection information of the target detection device;

[0129] A detection result generating unit is used to generate the detection result based on the abnormality rate information and the abnormality detection information.

[0130] Optionally, the abnormality detection device 700 further includes:

[0131] a detection failure information sending module, configured to send detection failure information to a gateway device associated with the target detection device when the storage time period corresponding to the data resource information does not match the detection time period and / or when the target detection device cannot run the detection algorithm;

[0132] A detection result determination module is used to determine the detection result corresponding to the abnormal detection request based on the abnormal detection algorithm result generated by the gateway device, and the abnormal detection algorithm result is the result generated by the gateway device performing abnormal detection based on the detection failure information.

[0133] Optionally, the detection result generating unit includes:

[0134] a detection success result generating subunit, configured to generate a detection success result based on the anomaly rate information and the anomaly detection success information when the anomaly detection information is anomaly detection success information;

[0135] The detection failure result generating subunit is used to generate a detection failure result based on the abnormal detection failure information when the abnormal detection information is abnormal detection failure information.

[0136] Optionally, the distributed anomaly detection module 730 includes:

[0137] An anomaly detection link extraction submodule, used to extract an anomaly detection link from the anomaly detection request;

[0138] A parameter decomposition processing submodule is used to perform parameter decomposition processing on the anomaly detection request to obtain request parameters, wherein the request parameters include location information of the node to be detected;

[0139] The target detection device determination submodule is used to determine the Internet of Things device corresponding to the location information of the node to be detected as the target detection device.

[0140] Optionally, the abnormality detection device 700 further includes:

[0141] A collection module, used to collect data through IoT devices to obtain operating status information, collection information and collection time period of the IoT devices;

[0142] A to-be-detected data generating module, used to generate the to-be-detected data based on the running status information, the collected information and the collected time period;

[0143] A first judgment module is used to judge whether the cache data volume of the IoT device is greater than the initial data volume threshold;

[0144] A storage module is used to store the data to be detected in the Internet of Things device when the amount of cached data in the Internet of Things device is not greater than the initial data amount threshold; when the amount of cached data in the Internet of Things device is greater than the initial data amount threshold, send data upload information to a gateway device associated with the Internet of Things device, the data upload information carries the data to be detected, and the gateway device is used to store the data to be detected carried by the data upload information.

[0145] It should be noted that the distributed anomaly detection device for edge computing provided in the embodiments of the present application can execute the distributed anomaly detection method for edge computing provided in any embodiment of the present application, and has the corresponding functions and beneficial effects of executing the distributed anomaly detection method for edge computing.

[0146] In a specific implementation, the above-mentioned distributed anomaly detection device for edge computing can be integrated into a device, so that the device can be applied to an Internet of Things system, determine the target detection device according to the request parameters carried by the anomaly detection request received by the Internet of Things system, and perform distributed anomaly detection according to the data resource information stored in the target detection device. As an electronic device, when performing anomaly detection on an Internet of Things device, it is not necessary to transmit all the data of the Internet of Things device to the cloud. The electronic device can be composed of two or more physical entities, or it can be composed of one physical entity. For example, the electronic device can be a personal computer (PC), a computer, a server, etc., and the embodiments of the present application do not impose specific restrictions on this.

[0147] like Figure 8 As shown, an embodiment of the present application provides an electronic device, including a processor 111, a communication interface 112, a memory 113 and a communication bus 114, wherein the processor 111, the communication interface 112, and the memory 113 communicate with each other through the communication bus 114; the memory 113 is used to store computer programs; the processor 111 is used to execute the program stored in the memory 113, and implement the steps of the distributed anomaly detection method for edge computing provided by any of the aforementioned method embodiments. Exemplarily, the steps of the distributed anomaly detection method for edge computing may include the following steps: receiving an anomaly detection request from a user; determining a target detection device based on request parameters carried by the anomaly detection request; performing distributed anomaly detection based on the data resource information stored in the target detection device to obtain a detection result corresponding to the anomaly detection request.

[0148] An embodiment of the present application also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of the distributed anomaly detection method for edge computing provided in any of the aforementioned method embodiments are implemented.

[0149] It should be noted that, in this article, relational terms such as "first" and "second" are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0150] The above description is only a specific implementation of the present application, so that those skilled in the art can understand or implement the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein can be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest range consistent with the principles and novel features applied for herein.

Claims

1. A distributed anomaly detection method for edge computing, characterized in that: Applied to an Internet of Things system, the Internet of Things system includes at least one Internet of Things device, and the distributed anomaly detection method includes: Receive anomaly detection requests from users; Determining a target detection device according to a request parameter carried in the anomaly detection request; Performing distributed anomaly detection according to the data resource information stored in the target detection device to obtain the detection result corresponding to the anomaly detection request, including: extracting the detection algorithm and detection time period corresponding to the target detection device from the request parameters; judging whether the storage time period corresponding to the data resource information matches the detection time period; if the storage time period corresponding to the data resource information matches the detection time period, extracting the target detection data corresponding to the detection time period from the data resource information; performing anomaly detection on the target detection device based on the detection algorithm and in combination with the target detection data to obtain the detection result; When the storage time period corresponding to the data resource information does not match the detection time period, the gateway device runs an anomaly detection algorithm to perform anomaly detection on the data resource information stored in the gateway device, thereby achieving anomaly detection.

2. The method according to claim 1, characterized in that The target detection data includes device operation status data and device collection data corresponding to the target detection device, and the detection result is obtained by performing abnormal detection on the target detection device based on the detection algorithm and in combination with the target detection data, including: Using the device operation status data, determining whether the target detection device is capable of running the detection algorithm; If the target detection device can run the detection algorithm, the device operation status data and the device collection data are predicted by the detection algorithm to obtain the abnormality rate information and abnormality detection information of the target detection device; The detection result is generated based on the abnormality rate information and the abnormality detection information.

3. The method according to claim 2, characterized in that Also includes: When the storage time period corresponding to the data resource information does not match the detection time period, and / or when the target detection device cannot run the detection algorithm, sending detection failure information to a gateway device associated with the target detection device; According to the anomaly detection algorithm result generated by the gateway device, a detection result corresponding to the anomaly detection request is determined, and the anomaly detection algorithm result is a result generated by the gateway device performing anomaly detection based on the detection failure information.

4. The method according to claim 2, characterized in that: The generating the detection result based on the abnormality rate information and the abnormality detection information includes: If the anomaly detection information is anomaly detection success information, generating a detection success result based on the anomaly rate information and the anomaly detection success information; If the abnormality detection information is abnormality detection failure information, a detection failure result is generated based on the abnormality detection failure information.

5. The method according to claim 1, characterized in that The step of determining a target detection device according to a request parameter carried by the anomaly detection request includes: extracting an anomaly detection link from the anomaly detection request; Performing parameter decomposition processing on the anomaly detection request to obtain request parameters, wherein the request parameters include location information of the node to be detected; The Internet of Things device corresponding to the location information of the node to be detected is determined as the target detection device.

6. The method according to any one of claims 1 to 5, characterized in that: Before receiving the abnormality detection request from the user, the method further includes: Collecting data through IoT devices to obtain operating status information, collection information, and collection time period of the IoT devices; Generate data to be detected based on the operating status information, the collected information and the collection time period; Determine whether the cache data volume of the IoT device is greater than an initial data volume threshold; If the cache data amount of the IoT device is not greater than the initial data amount threshold, storing the data to be detected in the IoT device; If the cached data volume of the IoT device is greater than the initial data volume threshold, data upload information is sent to a gateway device associated with the IoT device, where the data upload information carries the data to be detected, and the gateway device is used to store the data to be detected carried by the data upload information.

7. A distributed anomaly detection device for edge computing, characterized in that: include: Anomaly detection request receiving module, used to receive anomaly detection request from a user; A target detection device determination module, used to determine a target detection device according to a request parameter carried by the anomaly detection request; A distributed anomaly detection module, used to perform distributed anomaly detection according to the data resource information stored in the target detection device, and obtain the detection result corresponding to the anomaly detection request, including: extracting the detection algorithm and detection time period corresponding to the target detection device from the request parameters; judging whether the storage time period corresponding to the data resource information matches the detection time period; if the storage time period corresponding to the data resource information matches the detection time period, extracting the target detection data corresponding to the detection time period from the data resource information; based on the detection algorithm, performing anomaly detection on the target detection device in combination with the target detection data, and obtaining the detection result; When the storage time period corresponding to the data resource information does not match the detection time period, the gateway device runs an anomaly detection algorithm to perform anomaly detection on the data resource information stored in the gateway device, thereby achieving anomaly detection.

8. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; Memory, used to store computer programs; A processor is used to implement the steps of the distributed anomaly detection method for edge computing described in any one of claims 1 to 6 when executing a program stored in a memory.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the distributed anomaly detection method for edge computing as described in any one of claims 1 to 6 are implemented.

Images