A method, apparatus, device, and storage medium for detecting anomalies in Internet of Things (IoT) terminals.

Abstract

The application discloses an Internet of Things terminal anomaly detection method and device, equipment and a storage medium, and relates to the field of Internet of Things security. The method comprises the following steps: collecting terminal data of an Internet of Things terminal, and performing preprocessing, so as to input target terminal data obtained to a target anomaly detection model, extract low-dimensional feature data of the target terminal data through a variational autoencoder in the model, and perform anomaly prediction on the low-dimensional feature data through a gated recurrent unit in the target anomaly detection model, so as to obtain an anomaly prediction result; decoding the anomaly prediction result through a variational autoencoder in the model, comparing error values between reconstructed terminal data and the target terminal data, and determining whether the Internet of Things terminal is abnormal according to the error values. Thus, the detection performance can be improved by using the low-dimensional feature of the variational autoencoder transform domain, the anomaly positioning speed and the accuracy of the anomaly monitoring point are improved, and the gated recurrent unit is used to process a large number of anomaly detection cases.

Description

Technical Field

[0001] This invention relates to the field of Internet of Things (IoT) security, and in particular to a method, apparatus, device, and storage medium for detecting anomalies in IoT terminals. Background Technology

[0002] Currently, the integration of the Internet of Things (IoT) with intelligent operation terminals has become a development trend. With the comprehensive development of the IoT, the intelligent terminal devices connected within it are gradually becoming more intelligent and automated, and various intelligent terminal devices have been applied in various fields, such as edge computing, intelligent industrial manufacturing, transportation, smart homes, and smart cities. With the rapid popularization of IoT intelligent terminals, the detection of abnormal states of IoT intelligent terminals is becoming increasingly diversified, and the demand for the ability to detect massive amounts of data is also increasing.

[0003] Traditional anomaly detection methods for IoT smart terminals primarily focus on certain attribute characteristics of abnormal data, identifying anomalous behavior through a limited behavioral baseline. However, they fail to delve deeper into and utilize a large amount of valuable data attributes, resulting in wasted data. Furthermore, the imbalance and diversity of data from IoT smart terminal devices significantly complicate anomaly detection, making it difficult for traditional methods to quickly pinpoint anomalies. Summary of the Invention

[0004] In view of this, the purpose of this invention is to provide an anomaly detection method, apparatus, device, and storage medium for Internet of Things (IoT) terminals. This method utilizes a combination of variational autoencoders and gated cyclic units for anomaly detection. It leverages the low-dimensionality of the variational autoencoder's transform domain to improve detection performance, increase anomaly location speed, and enhance the accuracy of anomaly detection points. The gated cyclic unit handles a large number of anomaly detection scenarios. The specific solution is as follows:

[0005] In a first aspect, this application discloses a method for detecting anomalies in an Internet of Things (IoT) terminal, comprising:

[0006] Collect terminal data from IoT terminals and preprocess the terminal data to obtain target terminal data;

[0007] The target terminal data is input into the target anomaly detection model, and the low-dimensional feature data of the target terminal data is extracted by the variational autoencoder in the target anomaly detection model. The low-dimensional feature data is then used to perform anomaly prediction by the gated recurrent unit in the target anomaly detection model to obtain the anomaly prediction result.

[0008] The anomaly prediction result is decoded using the variational autodecoder in the target anomaly detection model to obtain reconstructed terminal data;

[0009] The error value between the reconstructed terminal data and the target terminal data is compared to determine whether the IoT terminal is malfunctioning based on the error value.

[0010] Optionally, the step of collecting terminal data from IoT terminals and preprocessing the terminal data to obtain target terminal data includes:

[0011] Terminal data uploaded by IoT terminals is collected from a preset IoT cloud platform, and the terminal data is divided into several segments by a sliding window to obtain several segments of data corresponding to the terminal data.

[0012] Redundancy detection is performed on the segmented data to identify discarded data in the segmented data, and the discarded data is deleted from the segmented data to obtain a number of first processed data.

[0013] Missing data is detected on the aforementioned first-processed data, and missing values ​​are filled in according to the missing detection results to obtain several second-processed data.

[0014] The target terminal data is obtained by standardizing the several second-processed data using a preset standardization formula.

[0015] Optionally, the preset standardized formula is:

[0016] ;

[0017] Where x' is the target terminal data, x is the second processed data, μ is the mean of x, and σ is the standard deviation of x.

[0018] Optionally, before inputting the target terminal data into the target anomaly detection model to extract low-dimensional feature data of the target terminal data through the variational autoencoder in the target anomaly detection model, and performing anomaly prediction on the low-dimensional feature data through the gated recurrent unit in the target anomaly detection model to obtain the anomaly prediction result, the method further includes:

[0019] The initial anomaly detection model is trained using a pre-set training dataset to obtain the trained anomaly detection model.

[0020] Calculate the model loss of the trained anomaly detection model and determine whether the model loss is less than a preset model loss threshold;

[0021] If the model loss is not less than the preset model loss threshold, then update the model parameters of the trained anomaly detection model and jump to the step of training the initial anomaly detection model with the preset training dataset to perform the next round of model training until the model loss is less than the preset model loss threshold.

[0022] If the model loss is less than the preset model loss threshold, then the trained anomaly detection model is used as the target anomaly detection model for IoT terminal anomaly detection.

[0023] Optionally, the step of inputting the target terminal data into the target anomaly detection model to extract low-dimensional feature data of the target terminal data through the variational autoencoder in the target anomaly detection model includes:

[0024] The target terminal data is input into the target anomaly detection model, and the target terminal data is mapped to a low-dimensional space through the variational autoencoder in the target anomaly detection model, so as to extract the low-dimensional feature data corresponding to the target terminal data from the low-dimensional space.

[0025] Optionally, the step of decoding the anomaly prediction result using the variational autodecoder in the target anomaly detection model to obtain reconstructed terminal data includes:

[0026] The anomaly prediction result is forward-propagated through the variational autodecoder in the target anomaly detection model to decode and reconstruct the anomaly prediction structure, thereby obtaining reconstructed terminal data corresponding to the anomaly prediction result.

[0027] Optionally, comparing the error value between the reconstructed terminal data and the target terminal data to determine whether the IoT terminal is abnormal based on the error value includes:

[0028] Calculate the error value between the reconstructed terminal data and the target terminal data, and compare the error value with a preset error threshold;

[0029] If the error value is greater than a preset error threshold, the IoT terminal is determined to be in an abnormal state.

[0030] If the error value is not greater than a preset error threshold, the IoT terminal is determined to be in a normal state.

[0031] Secondly, this application discloses an IoT terminal anomaly detection device, comprising:

[0032] The data preprocessing module is used to collect terminal data from IoT terminals and preprocess the terminal data to obtain target terminal data.

[0033] An anomaly prediction module is used to input the target terminal data into a target anomaly detection model, extract low-dimensional feature data of the target terminal data through a variational autoencoder in the target anomaly detection model, and perform anomaly prediction on the low-dimensional feature data through a gated recurrent unit in the target anomaly detection model to obtain an anomaly prediction result.

[0034] The data reconstruction module is used to decode the anomaly prediction result through the variational autodecoder in the target anomaly detection model to obtain reconstructed terminal data.

[0035] An anomaly detection module is used to compare the error value between the reconstructed terminal data and the target terminal data to determine whether the IoT terminal has an anomaly based on the error value.

[0036] Thirdly, this application discloses an electronic device, comprising:

[0037] Memory, used to store computer programs;

[0038] A processor is used to execute the computer program to implement the IoT terminal anomaly detection method as described above.

[0039] Fourthly, this application discloses a computer-readable storage medium for storing a computer program, which, when executed by a processor, implements the aforementioned method for detecting anomalies in an IoT terminal.

[0040] In this application, terminal data from an IoT terminal is first collected and preprocessed to obtain target terminal data. Then, the target terminal data is input into a target anomaly detection model. A variational autoencoder in the target anomaly detection model extracts low-dimensional feature data from the target terminal data. A gated recurrent unit in the target anomaly detection model performs anomaly prediction on the low-dimensional feature data to obtain an anomaly prediction result. The variational autodecoder in the target anomaly detection model decodes the anomaly prediction result to obtain reconstructed terminal data. Finally, the error value between the reconstructed terminal data and the target terminal data is compared to determine whether the IoT terminal has experienced an anomaly. Therefore, the method of this application can preprocess the collected terminal data of IoT terminals and input it along with the preprocessed target terminal data into a target anomaly detection model. The variational autoencoder in the target anomaly detection model extracts low-dimensional feature data from the target terminal data, and a gated recurrent unit in the model performs anomaly prediction on the low-dimensional feature data to obtain the anomaly prediction result. Then, the variational autodecoder in the target anomaly detection model decodes the anomaly prediction result. Finally, the error value between the reconstructed terminal data obtained from the decoding and the target terminal data can be compared to determine whether the IoT terminal has an anomaly. In this way, the method of this application can perform anomaly detection based on a combination of variational autoencoders and gated recurrent units. It can leverage the low-dimensionality of the variational autoencoder's transform domain to improve detection performance, increase anomaly location speed and anomaly monitoring point accuracy, and utilize the gated recurrent unit to handle a large number of anomaly detection scenarios. Attached Figure Description

[0041] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0042] Figure 1 A flowchart of an IoT terminal anomaly detection method provided in this application;

[0043] Figure 2 A timing diagram of an IoT terminal anomaly detection method provided in this application;

[0044] Figure 3 This application provides an interactive schematic diagram of an IoT terminal anomaly detection method.

[0045] Figure 4This application provides a schematic diagram of the structure of an IoT terminal anomaly detection device.

[0046] Figure 5 This application provides a structural diagram of an electronic device. Detailed Implementation

[0047] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0048] Existing anomaly detection methods primarily focus on certain attribute characteristics of abnormal data from smart terminals, identifying anomalous behavior through limited behavioral baselines. However, they fail to conduct in-depth analysis and utilization of a large amount of valuable data attributes, resulting in wasted data collection. Furthermore, the imbalance and diversity of data from IoT smart terminal devices significantly complicate anomaly detection, making it difficult for traditional methods to quickly pinpoint anomalies in terminal devices.

[0049] To overcome the aforementioned technical problems, this application discloses an anomaly detection method for Internet of Things (IoT) terminals. Anomaly detection can be performed based on a combination of variational autoencoders and gated cyclic units. The low-dimensionality of the transformation domain of the variational autoencoder can be used to improve detection performance, increase anomaly location speed and accuracy of anomaly monitoring points, and the gated cyclic unit can be used to handle a large number of anomaly detection cases.

[0050] See Figure 1 As shown, this embodiment of the invention discloses a method for detecting anomalies in an IoT terminal, including:

[0051] Step S11: Collect terminal data from IoT terminals and preprocess the terminal data to obtain target terminal data.

[0052] In this embodiment, it is necessary to collect terminal data from IoT terminals, and then preprocess the collected terminal data to obtain the corresponding target terminal data. Specifically, the IoT terminal will transmit its own terminal data to a preset IoT cloud platform, therefore, as... Figure 2As shown, when it is necessary to perform anomaly detection on IoT terminals, terminal data uploaded by IoT terminals is collected from a preset IoT cloud platform. It should be noted that the terminal data collected at this time may be normal data or abnormal data. The main types of data collected are: the domain name requested by the terminal for resolution, the six-tuple information of the established network connection, namely the source IP (Internet Protocol), source port, destination IP, destination port, protocol type, timestamp, started process information, file system changes, traffic logs, and system logs.

[0053] Next, the collected terminal data needs to be preprocessed. It should be noted that preprocessing first involves segmenting the collected terminal data using a sliding window to obtain several segmented data points corresponding to the target terminal data. Then, these segmented data points are standardized. The standardization process first involves redundancy detection to identify discarded data within the segmented data, followed by deletion of discarded data, resulting in several first-processed data points. Next, missing value detection is performed on these first-processed data points to determine if any missing values ​​exist, and then missing value imputation is performed to obtain several second-processed data points. Finally, these second-processed data points are standardized using a preset standardization formula to obtain the target terminal data. The preset standardization formula is: Let x' be the target terminal data, i.e., the original data; x be the second-processed data, i.e., the data after removing discarded data and filling in missing values; μ be the mean of x; and σ be the standard deviation of x. In this way, by standardizing the data, the accuracy of the detection results can be improved. Furthermore, since the VAE (Variational Autoencoder) model is not a sequence model, directly using this model would cause the original data samples to become independent individuals, ignoring the time-series information of the data and resulting in poor detection performance. Therefore, segmenting the data through this sliding window to obtain multiple consecutive segmented data allows the processed data to adapt to the VAE model.

[0054] Step S12: Input the target terminal data into the target anomaly detection model, extract low-dimensional feature data of the target terminal data through the variational autoencoder in the target anomaly detection model, and perform anomaly prediction on the low-dimensional feature data through the gated recurrent unit in the target anomaly detection model to obtain anomaly prediction results.

[0055] In this embodiment, before performing terminal anomaly detection based on target terminal data using the target anomaly detection model, it is first necessary to construct the target terminal data, specifically, as follows: Figure 2 As shown, the initial anomaly detection model needs to be trained using a preset training dataset to obtain a trained anomaly detection model. Then, the model loss of the trained anomaly detection model needs to be calculated, and it needs to be determined whether the current model loss is less than a preset model loss threshold. If it is greater than or equal to the preset model loss threshold, it indicates that the current model loss is too large and the prediction accuracy cannot meet the requirements. The model parameters of the trained anomaly detection model need to be updated, and the next round of model training needs to be performed. Then, the model loss corresponding to the model obtained in the next round of model training is calculated until the final model loss is less than the preset model loss threshold. The obtained trained anomaly detection model is then used as the target anomaly detection model for anomaly detection of IoT terminals.

[0056] In this embodiment, anomaly detection is performed by combining VAE and GRU. Since the target anomaly detection model consists of three parts: a VAE encoder, a GRU (Gated Recurrent Unit) prediction, and a VAE decoder, the target terminal data first needs to be processed by the VAE encoder, i.e., a variational autoencoder, to extract low-dimensional feature data. Specifically, the target terminal data needs to be input into the target anomaly detection model, and the variational autoencoder in the target anomaly detection model maps the target terminal data to a low-dimensional space, thereby automatically extracting deeper dynamic patterns, i.e., features, from the target terminal data. After feature extraction, the low-dimensional feature data can be used as input to the GRU model, and then the GRU model is used to predict abnormal behavior. The feature data mainly includes: network connection six-tuple information (source IP, source port, destination IP, destination port, protocol type, timestamp), started process information, file system integrity information, traffic logs, and system logs, and finally, the prediction result value of the anomaly prediction is obtained.

[0057] Step S13: Decode the anomaly prediction result using the variational autodecoder in the target anomaly detection model to obtain reconstructed terminal data.

[0058] In this embodiment, the anomaly prediction result value needs to be decoded by the VAE decoder to obtain the reconstructed terminal data. Specifically, the anomaly prediction result value needs to be forward-propagated by the variational autodecoder in the target anomaly detection model to decode and reconstruct the anomaly prediction structure to obtain the reconstructed terminal data corresponding to the anomaly prediction result.

[0059] Step S14: Compare the error value between the reconstructed terminal data and the target terminal data to determine whether the IoT terminal is abnormal based on the error value.

[0060] In this embodiment, as Figure 2As shown, the error value between the reconstructed terminal data and the target terminal data can be calculated, and the error value can be compared with a preset error threshold. If the error value is greater than the preset error threshold, it is determined that the collected IoT terminal data is abnormal, and the IoT terminal is in an abnormal state. If the error value is not greater than the preset error threshold, it is determined that the collected IoT terminal data is normal data, and the IoT terminal is in a normal state.

[0061] Therefore, the method of this application can preprocess the collected terminal data of IoT terminals and input it along with the preprocessed target terminal data into a target anomaly detection model. The variational autoencoder in the target anomaly detection model extracts low-dimensional feature data from the target terminal data, and the gated recurrent unit in the model performs anomaly prediction on the low-dimensional feature data to obtain the anomaly prediction result. Then, the variational autodecoder in the target anomaly detection model decodes the anomaly prediction result. Finally, the error value between the reconstructed terminal data obtained from the decoding and the target terminal data can be compared to determine whether the IoT terminal has an anomaly. Thus, the method of this application can perform anomaly detection based on a combination of variational autoencoders and gated recurrent units. It leverages the low-dimensionality of the variational autoencoder's transform domain to improve detection performance, increase anomaly location speed and accuracy, and utilizes the gated recurrent unit to handle a large number of anomaly detections, thereby improving the anomaly recognition rate of IoT smart terminals, ensuring the security and stability of IoT smart terminals, and effectively reducing losses caused by equipment malfunctions.

[0062] See Figure 3 As shown, this embodiment of the invention discloses a method for detecting anomalies in an IoT terminal, including:

[0063] like Figure 3 As shown, using the method of this application, the IoT terminal transmits its terminal data to a preset IoT cloud platform. When it is necessary to detect anomalies in the IoT terminal, the terminal data uploaded by the IoT terminal is collected from the preset IoT cloud platform. Then, the collected terminal data needs to be segmented by a sliding window to obtain several segmented data corresponding to the target terminal data. The segmented data is then standardized using a preset standardization formula to obtain the target terminal data.

[0064] After obtaining the target terminal data, it is necessary to extract several low-dimensional feature data corresponding to the segmented data through the VAE decoder of the target anomaly detection model. Then, the low-dimensional feature data is input into the GRU model of the target anomaly detection model to perform anomaly prediction and obtain the corresponding anomaly prediction result value. Finally, the anomaly prediction result value is decoded through the VAE decoder to obtain the reconstructed terminal data.

[0065] After obtaining the reconstructed terminal data, the error value between the reconstructed terminal data and the target terminal data can be calculated to determine whether there is an anomaly in the IoT terminal by comparing the results. It should be noted that the method of this application was compared with traditional decision trees (C4.5) and gradient boosting trees (XGBoost) in actual tests. Experimental results show that, compared with other machine learning and deep learning methods, the method of this invention has certain advantages in detection throughput, accuracy, and recall, and the comparison results are shown in Table 1.

[0066] Table 1

[0067]

[0068] Therefore, the method of this application effectively improves the recognition rate of abnormal behavior of IoT smart terminals, solves the problems of poor responsiveness and high detection latency of traditional methods, ensures the security and stability of IoT smart terminals, reduces losses caused by equipment abnormalities, and does not affect the normal operation of IoT smart terminals.

[0069] See Figure 4 As shown, this embodiment of the invention discloses an IoT terminal anomaly detection device, comprising:

[0070] The data preprocessing module 11 is used to collect terminal data from IoT terminals and preprocess the terminal data to obtain target terminal data.

[0071] The anomaly prediction module 12 is used to input the target terminal data into the target anomaly detection model, extract low-dimensional feature data of the target terminal data through the variational autoencoder in the target anomaly detection model, and perform anomaly prediction on the low-dimensional feature data through the gated recurrent unit in the target anomaly detection model to obtain anomaly prediction results.

[0072] The data reconstruction module 13 is used to decode the anomaly prediction result through the variational autodecoder in the target anomaly detection model to obtain reconstructed terminal data.

[0073] The anomaly determination module 14 is used to compare the error value between the reconstructed terminal data and the target terminal data, so as to determine whether the IoT terminal has an anomaly based on the error value.

[0074] In this application, terminal data from an IoT terminal is first collected and preprocessed to obtain target terminal data. Then, the target terminal data is input into a target anomaly detection model. A variational autoencoder in the target anomaly detection model extracts low-dimensional feature data from the target terminal data. A gated recurrent unit in the target anomaly detection model performs anomaly prediction on the low-dimensional feature data to obtain an anomaly prediction result. The variational autodecoder in the target anomaly detection model decodes the anomaly prediction result to obtain reconstructed terminal data. Finally, the error value between the reconstructed terminal data and the target terminal data is compared to determine whether the IoT terminal has experienced an anomaly. Therefore, the method of this application can preprocess the collected terminal data of IoT terminals and input it along with the preprocessed target terminal data into a target anomaly detection model. The variational autoencoder in the target anomaly detection model extracts low-dimensional feature data from the target terminal data, and a gated recurrent unit in the model performs anomaly prediction on the low-dimensional feature data to obtain the anomaly prediction result. Then, the variational autodecoder in the target anomaly detection model decodes the anomaly prediction result. Finally, the error value between the reconstructed terminal data obtained from the decoding and the target terminal data can be compared to determine whether the IoT terminal has an anomaly. In this way, the method of this application can perform anomaly detection based on a combination of variational autoencoders and gated recurrent units. It can leverage the low-dimensionality of the variational autoencoder's transform domain to improve detection performance, increase anomaly location speed and anomaly monitoring point accuracy, and utilize the gated recurrent unit to handle a large number of anomaly detection scenarios.

[0075] In some embodiments, the data preprocessing module 11 may specifically include:

[0076] The data segmentation unit is used to collect terminal data uploaded by IoT terminals from a preset IoT cloud platform, and to perform sliding window segmentation on the terminal data to obtain several segmented data corresponding to the terminal data.

[0077] A data deletion unit is used to perform redundancy detection on the plurality of segmented data to identify discarded data in the segmented data, and delete the discarded data from the segmented data to obtain a plurality of first processed data.

[0078] A data filling unit is used to perform missing detection on the plurality of first-processed data and fill in missing values ​​according to the missing detection results to obtain a plurality of second-processed data.

[0079] The data standardization unit is used to standardize the plurality of second-processed data using a preset standardization formula to obtain target terminal data.

[0080] In some embodiments, the IoT terminal anomaly detection device may further include:

[0081] The model training unit is used to train the initial anomaly detection model using a pre-set training dataset to obtain the trained anomaly detection model.

[0082] The loss calculation unit is used to calculate the model loss of the trained anomaly detection model and determine whether the model loss is less than a preset model loss threshold.

[0083] The step jump unit is used to update the model parameters of the trained anomaly detection model if the model loss is not less than the preset model loss threshold, and jump to the step of training the initial anomaly detection model with the preset training dataset to perform the next round of model training until the model loss is less than the preset model loss threshold.

[0084] The model determination unit is used to select the trained anomaly detection model as the target anomaly detection model for IoT terminal anomaly detection if the model loss is less than the preset model loss threshold.

[0085] In some embodiments, the anomaly prediction module 12 may specifically include:

[0086] The data feature extraction unit is used to input the target terminal data into the target anomaly detection model, and to map the target terminal data to a low-dimensional space through the variational autoencoder in the target anomaly detection model, so as to extract the low-dimensional feature data corresponding to the target terminal data from the low-dimensional space.

[0087] In some embodiments, the data reconstruction module 13 may specifically include:

[0088] The data reconstruction unit is used to forward propagate the anomaly prediction result through the variational autodecoder in the target anomaly detection model to decode and reconstruct the anomaly prediction structure, so as to obtain the reconstructed terminal data corresponding to the anomaly prediction result.

[0089] In some embodiments, the anomaly determination module 14 may specifically include:

[0090] An error comparison unit is used to calculate the error value between the reconstructed terminal data and the target terminal data, and to compare the error value with a preset error threshold.

[0091] The first state determination unit is used to determine that the Internet of Things terminal is in an abnormal state if the error value is greater than a preset error threshold.

[0092] The second state determination unit is used to determine that the IoT terminal is in a normal state if the error value is not greater than a preset error threshold.

[0093] Furthermore, embodiments of this application also disclose an electronic device, Figure 5 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content of the diagram should not be construed as limiting the scope of this application.

[0094] Figure 5 This is a schematic diagram of the structure of an electronic device 20 provided in an embodiment of this application. Specifically, the electronic device 20 may include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 stores a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the IoT terminal anomaly detection method disclosed in any of the foregoing embodiments. Alternatively, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0095] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 25 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0096] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk, or optical disk, etc. The resources stored thereon can include an operating system 221, computer programs 222, etc., and the storage method can be temporary storage or permanent storage.

[0097] The operating system 221 is used to manage and control the various hardware devices on the electronic device 20 and the computer program 222, which may be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program capable of performing the IoT terminal anomaly detection method executed by the electronic device 20 as disclosed in any of the foregoing embodiments, the computer program 222 may further include a computer program capable of performing other specific tasks.

[0098] Furthermore, this application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned disclosed method for detecting anomalies in IoT terminals. Specific steps of this method can be found in the corresponding content disclosed in the foregoing embodiments, and will not be repeated here.

[0099] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0100] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0101] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0102] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0103] The technical solutions provided in this application have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A method for detecting abnormality of an Internet of Things terminal, characterized by comprising: The method comprises the following steps: Collect terminal data of an Internet of Things terminal, and preprocess the terminal data to obtain target terminal data; Input the target terminal data into a target anomaly detection model to extract low-dimensional feature data of the target terminal data through a variational autoencoder in the target anomaly detection model, and perform anomaly prediction on the low-dimensional feature data through a gated recurrent unit in the target anomaly detection model to obtain an anomaly prediction result; Decode the anomaly prediction result through a variational auto-decoder in the target anomaly detection model to obtain reconstructed terminal data; Compare error values between the reconstructed terminal data and the target terminal data to determine whether the Internet of Things terminal is abnormal according to the error values; The method comprises the following steps: Collect terminal data uploaded by an Internet of Things terminal from a preset Internet of Things cloud platform, and perform sliding window segmentation on the terminal data to obtain a plurality of segmented data corresponding to the terminal data; Perform redundancy detection on the plurality of segmented data to determine discarded data in the segmented data, and delete the discarded data from the segmented data to obtain a plurality of first processed data; Perform missing value detection on the plurality of first processed data, and perform missing value filling according to the missing value detection result to obtain a plurality of second processed data; Standardize the plurality of second processed data through a preset standardization formula to obtain target terminal data; The preset standardization formula is as follows: ； Wherein, x' is the target terminal data, x is the second processed data, μ is the mean of x, and σ is the standard deviation of x; Before the target terminal data is input into the target anomaly detection model to extract low-dimensional feature data of the target terminal data through the variational autoencoder in the target anomaly detection model, and perform anomaly prediction on the low-dimensional feature data through the gated recurrent unit in the target anomaly detection model to obtain an anomaly prediction result, the method further comprises the following steps: Train an initial anomaly detection model through a preset training data set to obtain a trained anomaly detection model; Calculate the model loss of the trained anomaly detection model, and determine whether the model loss is less than a preset model loss threshold; If the model loss is not less than the preset model loss threshold, update the model parameters of the trained anomaly detection model, and jump to the step of training the initial anomaly detection model through the preset training data set to perform the next round of model training until the model loss is less than the preset model loss threshold; If the model loss is less than the preset model loss threshold, the trained anomaly detection model is used as a target anomaly detection model for anomaly detection of an Internet of Things terminal; The method comprises the following steps: input the target terminal data into the target anomaly detection model, and map the target terminal data to a low-dimensional space through a variational autoencoder in the target anomaly detection model to extract low-dimensional feature data corresponding to the target terminal data from the low-dimensional space; wherein the decoding the anomaly prediction result through the variational auto-decoder in the target anomaly detection model to obtain reconstructed terminal data comprises: forward propagating the anomaly prediction result through the variational auto-decoder in the target anomaly detection model to decode and reconstruct the anomaly prediction structure to obtain reconstructed terminal data corresponding to the anomaly prediction result; wherein the comparing the error value between the reconstructed terminal data and the target terminal data to determine whether the Internet of Things terminal is abnormal according to the error value comprises: calculating the error value between the reconstructed terminal data and the target terminal data, and comparing the error value with a preset error threshold value; if the error value is greater than the preset error threshold value, determining that the Internet of Things terminal is in an abnormal state; if the error value is not greater than the preset error threshold value, determining that the Internet of Things terminal is in a normal state.

2. An IoT terminal abnormality detection apparatus characterized by comprising: comprise: a data preprocessing module configured to collect terminal data of an Internet of Things terminal, and preprocess the terminal data to obtain target terminal data; an anomaly prediction module configured to input the target terminal data into a target anomaly detection model, extract low-dimensional feature data of the target terminal data through a variational autoencoder in the target anomaly detection model, and predict an anomaly of the low-dimensional feature data through a gated recurrent unit in the target anomaly detection model to obtain an anomaly prediction result; a data reconstruction module configured to decode the anomaly prediction result through a variational auto-decoder in the target anomaly detection model to obtain reconstructed terminal data; an anomaly determination module configured to compare an error value between the reconstructed terminal data and the target terminal data to determine whether the Internet of Things terminal is abnormal according to the error value; wherein the data preprocessing module comprises: a data segmentation unit configured to collect terminal data uploaded by an Internet of Things terminal from a preset Internet of Things cloud platform, and segment the terminal data through a sliding window to obtain a plurality of segmented data corresponding to the terminal data; a data deletion unit configured to detect redundancy of the plurality of segmented data to determine discarded data in the segmented data, and delete the discarded data from the segmented data to obtain a plurality of first processed data; a data filling unit configured to detect missing values of the plurality of first processed data, and fill the missing values according to a missing value detection result to obtain a plurality of second processed data; a data standardization unit configured to standardize the plurality of second processed data through a preset standardization formula to obtain target terminal data; wherein the preset standardization formula is: ； wherein x' is target terminal data, x is second processed data, μ is a mean value of x, and σ is a standard deviation of x. The Internet of Things terminal anomaly detection device further comprises: A model training unit configured to train an initial anomaly detection model by using a preset training data set to obtain a trained anomaly detection model; A loss calculation unit configured to calculate a model loss of the trained anomaly detection model and determine whether the model loss is less than a preset model loss threshold; A step jump unit configured to, if the model loss is not less than the preset model loss threshold, update model parameters of the trained anomaly detection model and jump to the step of training the initial anomaly detection model by using the preset training data set to perform next round of model training until the model loss is less than the preset model loss threshold; A model determination unit configured to, if the model loss is less than the preset model loss threshold, determine the trained anomaly detection model as a target anomaly detection model used for performing Internet of Things terminal anomaly detection. The anomaly prediction module 12 comprises: A data feature extraction unit configured to input target terminal data into the target anomaly detection model and map the target terminal data to a low-dimensional space by using a variational autoencoder in the target anomaly detection model to extract low-dimensional feature data corresponding to the target terminal data from the low-dimensional space. The data reconstruction module 13 comprises: A data reconstruction unit configured to perform forward propagation on the anomaly prediction result by using a variational auto-decoder in the target anomaly detection model to decode and reconstruct the anomaly prediction result to obtain reconstructed terminal data corresponding to the anomaly prediction result. The anomaly determination module 14 comprises: An error comparison unit configured to calculate an error value between the reconstructed terminal data and the target terminal data and compare the error value with a preset error threshold; A first state determination unit configured to determine that the Internet of Things terminal is in an abnormal state if the error value is greater than the preset error threshold; A second state determination unit configured to determine that the Internet of Things terminal is in a normal state if the error value is not greater than the preset error threshold.

3. An electronic device, comprising: The computer program is saved in the memory and executed by the processor to implement the Internet of Things terminal anomaly detection method. The computer program is saved in the memory and executed by the processor to implement the Internet of Things terminal anomaly detection method. The computer program is saved in the memory and executed by the processor to implement the Internet of Things terminal anomaly detection method.

4. A computer-readable storage medium, characterized in that, ​

Images