Internet of Things anomaly identification method, network device and storage medium

Abstract

The invention discloses an Internet of Things abnormity identification method, network equipment and a storage medium, and belongs to the technical field of communication. Internet of Things operation data in the current time interval is acquired, and the Internet of Things operation data comprises registration data, control plane session data, user plane session data and user plane traffic data; and based on the Internet of Things operation data of the current time interval, carrying out Internet of Things anomaly identification. Thus, by using the Internet of Things operation data generated by the operation of the Internet of Things, the Internet of Things abnormality can be recognized earlier before the Internet of Things abnormality causes the Internet of Things terminal to generate a more serious consequence, the timeliness of Internet of Things abnormality recognition is improved, the abnormality can be solved in time, the use fluency of the Internet of Things terminal is improved, and the user experience is improved. Complaints of Internet of Things terminal users are reduced, and the satisfaction degree of the users to the Internet of Things is improved.

Description

Technical Field

[0001] The present application relates to the field of communications, and in particular to an Internet of Things anomaly identification method, network equipment and storage medium. Background Art

[0002] With the rapid development of communication technology, more and more IoT terminals are connected to mobile communication networks, and the types of terminals are becoming more and more complex. These various IoT terminals have different reliance on IoT. Some require the network to provide high-bandwidth and low-latency communication quality, some require the network to provide the terminal with the ability to be "always online", and some require the network to provide "on-time" data forwarding requirements, etc. However, most IoT terminals are "objects" that operate by themselves, and there is rarely any human intervention. Therefore, when the network operation between IoT terminals is abnormal, it is difficult for the IoT terminal itself to detect the abnormality in time. Instead, after the relevant staff of the IoT terminal can detect the fault and manually initiate a complaint, the IoT operation and maintenance personnel will find and analyze the abnormal IoT based on the complaint. This method has poor timeliness and will reduce user satisfaction with the IoT. Summary of the invention

[0003] The main purpose of this application is to provide an Internet of Things anomaly identification method, network equipment and storage medium, aiming to solve the technical problem of poor timeliness of Internet of Things anomaly identification in conventional technologies.

[0004] To achieve the above purpose, the present application provides an IoT anomaly identification method, the method comprising:

[0005] Obtaining IoT operation data for the current time interval, wherein the IoT operation data includes registration data, control plane session data, user plane session data, and user plane traffic data;

[0006] Based on the IoT operation data of the current time interval, IoT anomalies are identified.

[0007] An embodiment of the present application also provides a network device, which includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the IoT anomaly identification method as described above.

[0008] An embodiment of the present application also provides a storage medium, which is a computer-readable storage medium. A computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the Internet of Things anomaly identification method as described above are implemented.

[0009] The present application also provides an IoT anomaly identification device, the IoT anomaly identification device comprising:

[0010] An acquisition module is configured to acquire the IoT operation data of the current time interval, wherein the IoT operation data includes registration data, control plane session data, user plane session data, and user plane traffic data;

[0011] The identification module is configured to perform IoT anomaly identification based on IoT operation data in the current time interval.

[0012] The embodiment of the present application discloses a method for identifying anomalies in the Internet of Things. The method obtains the Internet of Things operation data of the current time interval and identifies anomalies in the Internet of Things based on the Internet of Things operation data of the current time interval. On the one hand, the entire Internet of Things system can spontaneously identify anomalies in the Internet of Things without human intervention. On the other hand, the Internet of Things operation data used for identifying anomalies in the Internet of Things includes registration data, control plane session data, user plane session data and user plane traffic data, all of which are source data related to the operation status of the Internet of Things network. Compared with the method of identifying anomalies in the Internet of Things by making reverse complaints due to anomalies in the Internet of Things causing failures in the Internet of Things terminal, the Internet of Things operation data generated by the operation of the Internet of Things itself can be used to identify anomalies in the Internet of Things earlier before the anomalies in the Internet of Things cause more serious consequences in the Internet of Things terminal, thereby improving the timeliness of identifying anomalies in the Internet of Things, and thus facilitating the timely resolution of anomalies, improving the fluency of use of the Internet of Things terminal, reducing complaints from users of the Internet of Things terminal, and improving user satisfaction with the Internet of Things. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] Figure 1 It is a structural diagram of an operating device of a hardware operating environment involved in an embodiment of the present application;

[0014] Figure 2 This is a flow chart of an embodiment of an Internet of Things anomaly identification method according to an embodiment of the present application;

[0015] Figure 3 A schematic diagram of a workflow of data collection for an embodiment of an Internet of Things anomaly identification method according to an embodiment of the present application;

[0016] Figure 4 This is a flow chart of an embodiment of an Internet of Things anomaly identification method according to an embodiment of the present application;

[0017] Figure 5 This is a schematic diagram of the workflow of an embodiment of an Internet of Things anomaly identification method according to an embodiment of the present application;

[0018] Figure 6 This is a flow chart of an embodiment of an Internet of Things anomaly identification method according to an embodiment of the present application;

[0019] Figure 7 This is a schematic diagram of an IoT anomaly identification device according to an embodiment of the present application.

[0020] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0021] It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0022] With the evolution and development of 5G to 5G-A (5G-Advanced, advanced 5G) and 6G network technology, the construction of mobile communication networks is accelerating towards industry users, and more and more industries are connected to 5G mobile communication networks. More and more IoT terminals are connected to 5G networks, and the types of terminals are becoming more and more complex. These various IoT terminals also have different reliance on IoT. Some require the network to provide high-bandwidth and low-latency communication quality, some require the network to provide the ability for terminals to be "always online", and some require the network to provide "on-time" data forwarding requirements, etc.

[0023] However, most IoT terminals are "objects" that operate by themselves, with little human intervention. Therefore, when the network operation between IoT terminals is abnormal, the IoT terminal itself will continue to execute according to its originally set program, and it is difficult to detect the abnormality in time and spontaneously. The operation and maintenance personnel of the IoT terminal are usually unable to monitor whether the IoT terminal has abnormalities at all times. Usually, only after a more obvious fault in the IoT terminal or a fault that affects the normal use of the IoT terminal is caused, the relevant staff of the IoT terminal will discover and file a complaint. Then the IoT operation and maintenance personnel will find and analyze the abnormal IoT based on the complaint. This method has poor timeliness and neither meets the industry users' demands for timely detection and handling of faults nor matches the operation and maintenance goals of the self-intelligent network, which greatly reduces the industry users' satisfaction with the 5G smart communication IoT.

[0024] To solve the above technical problems, refer to Figure 1 , Figure 1 This is a schematic diagram of the operating equipment structure of the hardware operating environment involved in the embodiment of the present application.

[0025] like Figure 1As shown, the operating device may include: a processor 1001, such as a central processing unit (CPU), a communication bus 1002, a user interface 1003, a network interface 1004, and a memory 1005. Among them, the communication bus 1002 is used to realize the connection and communication between these components. The user interface 1003 may include a display screen (Display), an input unit such as a keyboard (Keyboard), and the optional user interface 1003 may also include a standard wired interface and a wireless interface. The network interface 1004 may optionally include a standard wired interface and a wireless interface (such as a wireless fidelity (WIreless-FIdelity, WI-FI) interface). The memory 1005 may be a high-speed random access memory (Random Access Memory, RAM) memory, or a stable non-volatile memory (Non-Volatile Memory, NVM), such as a disk memory. The memory 1005 may also be a storage device independent of the aforementioned processor 1001.

[0026] Those skilled in the art will understand that Figure 1 The structure shown in the figure does not constitute a limitation on the operating device, and may include more or less components than shown in the figure, or combine certain components, or arrange the components differently.

[0027] like Figure 1 As shown, the memory 1005 as a storage medium may include an operating system, a data storage module, a network communication module, a user interface module and a computer program.

[0028] exist Figure 1 In the running device shown, the network interface 1004 is mainly used for data communication with other devices; the user interface 1003 is mainly used for data interaction with the user; the processor 1001 and the memory 1005 in the running device of the present application can be set in the running device, and the running device calls the computer program stored in the memory 1005 through the processor 1001, and performs the following operations:

[0029] Obtaining IoT operation data for the current time interval, wherein the IoT operation data includes registration data, control plane session data, user plane session data, and user plane traffic data;

[0030] Based on the IoT operation data of the current time interval, IoT anomalies are identified.

[0031] Exemplarily, the processor 1001 may call a computer program stored in the memory 1005, and further perform the following operations:

[0032] Based on the Internet of Things operation data of the current time interval and a preset fuzzy logic decision rule, the network operation status of the Internet of Things in the current time interval is determined.

[0033] Exemplarily, the processor 1001 may call a computer program stored in the memory 1005, and further perform the following operations:

[0034] Based on the Internet of Things operation data of the current time interval and the network operation status of the current time interval, the network operation status of the Internet of Things in the next time interval is predicted.

[0035] Exemplarily, the processor 1001 may call a computer program stored in the memory 1005, and further perform the following operations:

[0036] The network operation state of the Internet of Things in the next time interval is predicted by inputting the Internet of Things operation data of the current time interval and the network operation state of the current time interval into a network operation state prediction model, wherein the network operation state prediction model is a long short-term memory artificial neural network model.

[0037] Exemplarily, the processor 1001 may call a computer program stored in the memory 1005, and further perform the following operations:

[0038] Obtaining Internet of Things operation training data corresponding to at least one training time interval and a network operation status training label value of a next time interval of each training time interval, wherein the Internet of Things operation training data includes registration training data, control plane session training data, user plane session training data, and user plane traffic training data;

[0039] Determine the training network operation status of the Internet of Things in each training time interval based on the operation training data of each Internet of Things and the preset fuzzy logic decision rule;

[0040] Inputting the Internet of Things operation training data corresponding to each of the training time intervals and the training network operation status corresponding to each of the training time intervals into the network operation status prediction model to be trained, and obtaining the network operation status training prediction value of the next time interval of each of the training time intervals, wherein the network operation status prediction model is a long short-term memory artificial neural network model;

[0041] According to each of the network operation status training label values ​​and each of the network operation status training prediction values, the network operation status prediction model to be trained is iteratively optimized to obtain a trained network operation status prediction model.

[0042] Exemplarily, the processor 1001 may call a computer program stored in the memory 1005, and further perform the following operations:

[0043] Iteratively optimizing the network operation state prediction model to be trained according to each of the network operation state training label values ​​and each of the network operation state training prediction values ​​to obtain a network operation state prediction model to be tested;

[0044] Obtaining Internet of Things operation test data corresponding to at least one test time interval and a network operation status test tag value of a next time interval of each of the test time intervals, wherein the Internet of Things operation test data includes registration test data, control plane session test data, user plane session test data, and user plane traffic test data;

[0045] Determine the test network operation status of the Internet of Things in each of the test time intervals based on the operation test data of each of the Internet of Things and a preset fuzzy logic decision rule;

[0046] Inputting the Internet of Things operation test data corresponding to each of the test time intervals and the test network operation status corresponding to each of the test time intervals into the network operation status prediction model to be tested, and obtaining the network operation status test prediction value of the next time interval of each of the test time intervals;

[0047] Calculating the prediction accuracy of the network operation status prediction model to be tested according to each of the network operation status test label values ​​and each of the network operation status test prediction values;

[0048] When the prediction accuracy exceeds a preset accuracy threshold, the network operation status prediction model to be tested is determined as a trained network operation status prediction model.

[0049] Exemplarily, the processor 1001 may call a computer program stored in the memory 1005, and further perform the following operations:

[0050] When the Internet of Things is identified to be in an abnormal state, an abnormal prompt message is output.

[0051] Exemplarily, the registration data includes an initial registration success rate;

[0052] And / or, the control plane session data includes the control plane session establishment success rate

[0053] And / or, the user plane session data includes a user plane session establishment request success rate and an average number of online sessions;

[0054] And / or, the user plane traffic data includes N6 interface uplink traffic and N6 interface downlink traffic.

[0055] The present application embodiment provides a method for identifying anomalies in the Internet of Things, referring to Figure 2In one embodiment of the method for identifying anomalies in the Internet of Things, the method includes:

[0056] Step S10, obtaining the Internet of Things operation data of the current time interval, wherein the Internet of Things operation data includes registration data, control plane session data, user plane session data and user plane traffic data.

[0057] IoT operation data refers to network communication data related to IoT operation. Figure 3 The IoT operation data is collected from network devices and various applications in the industry user-side data network (DN, Data Network). Among them, network devices include network element devices AMF (Access and Mobility Management Function) or SMF (Session management function) of the 5G core network control plane (5GC-CP, 5G Core Network Control Plane), as well as user plane devices UPF (User Plane Function) and so on.

[0058] IoT operation data includes registration data, control plane session data, user plane session data, and user plane traffic data.

[0059] Registration data refers to data related to registration of user terminals, including the number of registration requests, the number of successful registrations, the initial registration success rate, etc. In an implementable manner, the initial registration success rate of the entire network can be calculated by obtaining the number of initial registration requests and the number of successful initial registrations of each terminal in the current time interval; control plane session data refers to data related to connection establishment and disconnection of sessions transmitted by the control plane, including the number of control plane session establishment requests, the number of successful control plane session establishment, the control plane session establishment success rate, etc. In an implementable manner, the control plane session establishment success rate can be calculated by obtaining the number of control plane session establishment requests and the number of successful control plane session establishment in the current time interval; user plane session data refers to data related to connection establishment and disconnection of sessions transmitted by the control plane, including the number of user plane session establishment requests, the number of successful user plane session establishment requests, the user plane session establishment success rate, the average number of online sessions, etc. In an implementable manner, the user plane session establishment success rate can be calculated by obtaining the number of user plane session establishment requests and the number of successful user plane session establishment requests in the current time interval; user plane traffic data refers to network traffic data of user plane interfaces, including uplink traffic and downlink traffic of each interface.

[0060] Illustratively, the registration data includes an initial registration success rate.

[0061] Exemplarily, the control plane session data includes a control plane session establishment success rate.

[0062] Exemplarily, the user plane session data includes a user plane session establishment request success rate and an average number of online sessions.

[0063] Exemplarily, the user plane traffic data includes N6 interface uplink traffic and N6 interface downlink traffic.

[0064] In the case of IoT anomalies, IoT anomalies will have a significant impact on registration, session establishment, and session quality, which will further affect the operation of IoT terminals. For example, due to IoT anomalies, the IoT terminal fails to initiate the initial registration request, which makes the IoT terminal unable to access the 5G network. Among them, the impact on registration can be characterized by the initial registration success rate, the impact on session establishment can be characterized by the initial control plane session establishment success rate, the user plane session establishment request success rate and the average number of online sessions, and the impact on session quality can be characterized by the N6 interface uplink traffic and the N6 interface downlink traffic. The N6 interface is the interface between the UPF and the DN, which is used to transmit the uplink and downlink user data flows between the UPF and the DN. The initial registration success rate, the control plane session establishment success rate, the user plane session establishment request success rate, the average number of online sessions, the N6 interface uplink traffic and the N6 interface downlink traffic are all parameters with a strong correlation with IoT anomalies. Therefore, by monitoring the initial registration success rate, the control plane session establishment success rate, the user plane session establishment request success rate, the average number of online sessions, the N6 interface uplink traffic and the N6 interface downlink traffic in the current time interval, and identifying IoT anomalies based on these IoT operation data, the accuracy of IoT anomaly identification can be improved, so that IoT anomalies can be identified earlier and more accurately before the IoT anomalies affect the operation of IoT terminals, the duration of IoT anomalies can be shortened, the adverse effects caused by IoT anomalies can be reduced, and even IoT anomalies can be eliminated before IoT terminals fail due to IoT anomalies, thereby reducing IoT terminal failures, improving IoT terminal users' satisfaction with the IoT, and improving user experience.

[0065] In this embodiment, communication data generated in the current time interval can be collected from 5GC-CP, UPF and DN, and the Internet of Things operation data of the current time interval can be obtained after statistical analysis, wherein the interval length of each time interval is the same, and the interval length of the time interval can be determined according to actual needs. This embodiment does not impose any restrictions on this. Exemplarily, it can be 1 minute, 1 hour, half a day, one day, one week, etc. The current time interval refers to the time interval between the moment when the communication data is currently collected and the moment when the communication data was previously collected.

[0066] Step S20, performing IoT anomaly identification based on IoT operation data in the current time interval.

[0067] In this embodiment, by adopting methods such as statistics, machine learning, deep learning, and rule judgment, the Internet of Things operation data in the current time interval is analyzed to realize the abnormal identification of the network operation status of the Internet of Things, wherein the network operation status includes at least a normal state and an abnormal state, and the normal state may also include one or more different levels of normal states, such as excellent, good, general, etc., and the abnormal state may also include one or more different levels of abnormal states, such as poor, bad, extremely poor, etc.; the abnormal identification of the network operation status of the Internet of Things includes at least one of judging whether the network operation status of the Internet of Things is abnormal in the current time interval, determining the degree of abnormality of the network operation status of the Internet of Things in the current time interval, predicting whether the network operation status of the Internet of Things is abnormal in the next time interval, predicting the degree of abnormality of the network operation status of the Internet of Things in the next time interval, etc.

[0068] Exemplarily, based on the Internet of Things operation data of the current time interval, the step of identifying Internet of Things anomalies may include: predicting the network operation status of the Internet of Things in the next time interval by inputting the Internet of Things operation data of the current time interval into a time series model, wherein the time series model may be a regression model, a random forest model, an XGBoost (Extreme Gradient Boosting) model, an LSTM (Long Short-Term Memory) model, or the like.

[0069] Exemplarily, after the step of performing anomaly identification of the Internet of Things based on the Internet of Things operation data of the current time interval, the method further includes:

[0070] When the Internet of Things is identified to be in an abnormal state, an abnormal prompt message is output.

[0071] After the abnormality of the Internet of Things is identified, whether the Internet of Things is identified to be in an abnormal state or not, an identification result can be generated, and the generated identification result can be stored or output for display.

[0072] In this embodiment, when it is identified that the Internet of Things is in an abnormal state in the current time interval or the next time interval, abnormal prompt information can be output to the operation and maintenance center equipment of the Internet of Things, so that the operation and maintenance personnel of the operation and maintenance center of the Internet of Things can be aware of the abnormal situation of the Internet of Things in a timely manner and take timely measures to eliminate the abnormality.

[0073] In this embodiment, by acquiring the IoT operation data of the current time interval and performing IoT anomaly identification based on the IoT operation data of the current time interval, on the one hand, the entire IoT system can spontaneously identify IoT anomalies without human intervention. On the other hand, the IoT operation data used for IoT anomaly identification includes registration data, control plane session data, user plane session data, and user plane traffic data, all of which are source data related to the IoT network operation status. Compared with the method of identifying IoT anomalies by making reverse complaints in which IoT anomalies cause IoT terminal failures, the IoT operation data generated by the IoT operation itself can be used to identify IoT anomalies earlier before the IoT anomalies cause more serious consequences to the IoT terminals, thereby improving the timeliness of IoT anomaly identification, and thus facilitating timely resolution of anomalies, improving the fluency of IoT terminal use, reducing complaints from IoT terminal users, and improving user satisfaction with the IoT.

[0074] In another embodiment of the method for identifying anomalies in the Internet of Things of the present application, refer to Figure 4 ,Based on the IoT operation data of the current time interval, the steps of IoT anomaly identification include:

[0075] Step S21, based on the Internet of Things operation data of the current time interval and the preset fuzzy logic decision rules, determine the network operation status of the Internet of Things in the current time interval.

[0076] Fuzzy logic is a scientific method based on multi-valued logic, using fuzzy set methods to study fuzzy thinking, language forms and their laws. There are many reasons for IoT anomalies. It is not that any one or several IoT operation data can accurately indicate that the IoT is abnormal. The relationship between various IoT operation data and the relationship between the abnormal state of the IoT is not linear or definite. In different actual scenarios, there may be multiple fuzzy combinations. For example, small user-side traffic does not necessarily mean that it is caused by IoT anomalies. If the initial registration success rate and session establishment success rate are both very low while the user-side traffic is small, the possibility of IoT anomalies is high. If the initial registration success rate and session establishment success rate are both very high while the user-side traffic is small, the possibility of IoT anomalies is low. It may be that the original usage of the IoT is not high. It can be seen that fuzzy logic can effectively handle these nonlinearities, uncertainties and fuzziness, and improve the robustness and reliability of IoT anomaly identification. The fuzzy logic decision rules in this embodiment can be formulated by domain experts based on historical data in advance, and can be in the form of fuzzy logic decision rule tables, membership functions, etc., and then the pre-formulated fuzzy logic decision rules can be directly applied to identify IoT anomalies in the current time interval. Fuzzy logic decision rules can be used alone to identify IoT anomalies in the current time interval, and the output network operation status can be an operation status classification label, which can be good, poor, etc. The fuzzy logic decision rule can also be used only as a normalization processing method without making a decision. In this case, the output network operation status can be a value between 0 and 1 obtained by normalization processing, so as to further grade, classify or judge the operation status according to the value of the output network operation status. For example, if the network operation status is preset to be greater than or equal to 0.6 as a normal state and less than 0.6 as an abnormal state, and the output network operation status is 0.62, it can be judged that the Internet of Things is in a normal state in the current time interval.

[0077] In this embodiment, the Internet of Things operation data of the current time interval can be input into the preset fuzzy logic decision rule for inference, and the network operation status of the Internet of Things in the current time interval that matches the Internet of Things operation data of the current time interval can be output.

[0078] In an operative manner, referring to Table 1, the IoT operation data includes the initial registration success rate, the control plane session establishment success rate, the user plane session establishment request success rate, the average number of online sessions, the N6 interface uplink traffic, and the N6 interface downlink traffic. The IoT operation data of the current time interval is input into the fuzzy logic decision rule shown in Table 1 to determine the network operation state corresponding to one item in which the initial registration success rate, the control plane session establishment success rate, the user plane session establishment request success rate, the average number of online sessions, the N6 interface uplink traffic, and the N6 interface downlink traffic all meet the conditions. For example, if the initial registration success rate is 95%, the control plane session establishment success rate is 91%, the user plane session establishment request success rate is 88%, the average number of online sessions is 895 / UPF, the N6 interface uplink traffic is 17.5G, and the N6 interface downlink traffic is 82.5G, by matching with the fuzzy logic decision rule, it can be determined that the network operation state of the IoT in the current time interval is 0.8.

[0079] Table 1

[0080]

[0081] For example, refer to Figure 4 , after the step of determining the network operation state of the Internet of Things in the current time interval based on the Internet of Things operation data in the current time interval and the preset fuzzy logic decision rule, it also includes:

[0082] Step S22, based on the Internet of Things operation data in the current time interval and the network operation status in the current time interval, predict the network operation status of the Internet of Things in the next time interval.

[0083] By determining the network operation status of the current time interval based on the IoT operation data, the abnormal situation that has occurred can be discovered as early as possible after the IoT abnormality occurs, shortening the duration of the IoT abnormality, and eliminating the abnormality in time when the impact of the IoT abnormality on the IoT terminal is small, so that the IoT terminal can resume normal use. If it can be predicted that the IoT is about to have an abnormal situation before the IoT abnormality occurs, measures can be taken in advance before the IoT abnormality occurs, and the operation and maintenance mode will be transformed from passive to active, reducing the occurrence of abnormalities. For example, after an IoT anomaly occurs, the communication speed of the IoT terminal decreases, but communication is still possible, and the functions of the IoT terminal may be completed at a slower speed but can still be performed. At this time, if the operation and maintenance personnel of the IoT terminal are usually performing routine network detection, they may notice it. If the operation and maintenance personnel of the IoT terminal do not perform network detection, the reduction in the communication speed of the IoT terminal will not be noticed because it does not cause a failure in the IoT terminal. Therefore, if the anomaly is discovered and eliminated in time after the IoT anomaly occurs, the normal communication state can be restored before the function of the IoT terminal is completely interrupted, so that the IoT terminal can resume normal operation without causing serious consequences. If the impending anomaly can be predicted before the IoT anomaly occurs and eliminated before it occurs, the anomaly can be eliminated before the communication speed of the IoT terminal is reduced, that is, for the IoT terminal, it can always be in a normal communication state, not only will no failure occur, but it can also always be in a smooth operation state.

[0084] In this embodiment, after determining the network operation status of the current time interval, the Internet of Things operation data of the current time interval and the network operation status of the current time interval can be spliced ​​into an Internet of Things operation feature vector of the current time interval, and the Internet of Things operation feature vector is input into a preset network operation status prediction model to predict the network operation status of the Internet of Things in the next time interval, wherein the network operation status prediction model can be a time series model, and the time series model can be a regression model, a random forest model, an XGBoost (Extreme Gradient Boosting, extreme gradient boosting) model, an LSTM (Long Short-Term Memory, long short-term memory artificial neural network) model, etc.

[0085] Exemplarily, based on the Internet of Things operation data of the current time interval and the network operation status of the current time interval, the step of predicting the network operation status of the Internet of Things in the next time interval includes:

[0086] Step S221, predicting the network operation state of the Internet of Things in the next time interval by inputting the Internet of Things operation data of the current time interval and the network operation state of the current time interval into the network operation state prediction model, wherein the network operation state prediction model is a long short-term memory artificial neural network model.

[0087] The long short-term memory artificial neural network model is a time recursive neural network that can use context-related information in the mapping process between input and output sequences to process and predict important events with relatively long intervals and delays in time series. The use of the Internet of Things often has a certain periodicity. For example, the data transmission volume of the Internet of Vehicles will be higher during rush hour, so whether it is registration data, session data or traffic data, it will be higher; the data transmission volume of industrial robots every day or each work cycle has similar rules. Therefore, the long short-term memory artificial neural network model can be used to learn the operating rules of the Internet of Things in normal and abnormal states, so that according to the Internet of Things operating data and network operating status in the current time interval, it can be judged whether the Internet of Things conforms to the operating rules of the normal state or the operating rules of the abnormal state, thereby predicting the network operating status of the Internet of Things in the next time interval.

[0088] When there are sufficient training samples, the long short-term memory artificial neural network model can be pre-trained, and the training process of the long short-term memory artificial neural network model can be performed on the device using the long short-term memory artificial neural network model or on other devices. The conditions for completing the training can be determined based on the loss function value, accuracy, etc. This embodiment does not impose any restrictions on this. For the trained long short-term memory artificial neural network model, no further training is required during use.

[0089] In the case of a small number of training samples, the model can be trained to a level where the accuracy meets basic usage requirements, and then further trained using actual prediction data during use. That is, after each prediction determines the predicted value of the network operation status of the Internet of Things, the true value of the network operation status can be obtained in the next time interval, so as to calculate the loss based on the predicted value of the network operation status and the true value of the network operation status, and iteratively update the long short-term memory artificial neural network model based on the loss. In an practicable manner, referring to Figure 5 The IoT operation data collected in the current time interval is used for both IoT anomaly identification and prediction and model learning and training. After model learning and training, the model for IoT anomaly identification and prediction is updated.

[0090] In this embodiment, after determining the network operation status of the current time interval, the Internet of Things operation data of the current time interval and the network operation status of the current time interval can be spliced ​​into the Internet of Things operation feature vector of the current time interval. By inputting the Internet of Things operation feature vector into a preset long short-term memory artificial neural network model, the network operation status of the Internet of Things in the next time interval can be predicted.

[0091] In this embodiment, the nonlinear, uncertain and ambiguous relationship between the IoT operation data of the current time interval and the network operation state of the IoT in the current time interval can be judged more accurately through the fuzzy logic decision rule, so as to improve the robustness and reliability of IoT abnormality identification. After determining the network operation state of the IoT in the current time interval, the network operation state of the IoT in the next time interval can be further predicted based on the IoT operation data of the current time interval and the network operation state of the current time interval, and the time of IoT abnormality identification can be advanced to before the IoT abnormality occurs, further improving the timeliness of IoT abnormality identification, taking measures in advance before the IoT abnormality occurs, and changing the operation and maintenance mode from passive to active, reducing the occurrence of abnormalities, improving the use fluency of IoT terminals, reducing complaints from IoT terminal users, and improving user satisfaction with the IoT.

[0092] In another embodiment of the method for identifying anomalies in the Internet of Things of the present application, refer to Figure 6 ,The IoT anomaly identification method also includes:

[0093] Step A1, obtaining Internet of Things operation training data corresponding to at least one training time interval and a network operation status training label value of the next time interval of each training time interval, wherein the Internet of Things operation training data includes registration training data, control plane session training data, user plane session training data and user plane traffic training data;

[0094] In this embodiment, a training method for a network operation status prediction model is provided.

[0095] In this embodiment, before model training, a batch of IoT operation training data corresponding to at least one training time interval and a network operation status training label value of the next time interval of each training time interval can be obtained, wherein the IoT operation training data includes registration training data, control plane session training data, user plane session training data and user plane traffic training data.

[0096] In an practicable manner, after obtaining the IoT operation training data set, the collected training data can also be checked for consistency and integrity, and the training data can be normalized, serialized, normalized, etc. Exemplarily, each IoT operation training data can be sorted according to the timestamp, and then each IoT operation training data can be standardized, that is, according to the performance characteristics of each type of IoT operation training data, the correctness of the IoT operation training data can be verified based on statistical methods, and abnormal data can be removed or corrected; then, based on the timestamp, the standardized IoT operation training data can be spliced ​​into training data feature vectors for each time interval, and each training data feature vector can be arranged in chronological order.

[0097] Step A2, determining the training network operation status of the Internet of Things in each training time interval based on the operation training data of each Internet of Things and the preset fuzzy logic decision rule;

[0098] In this embodiment, the Internet of Things operation training data of each training time interval can be input into the preset fuzzy logic decision rules in chronological order for reasoning, and the network operation status of the Internet of Things that matches the Internet of Things operation data of each training time interval can be output.

[0099] Step A3, inputting the IoT operation training data corresponding to each training time interval and the training network operation status corresponding to each training time interval into the network operation status prediction model to be trained, and obtaining the network operation status training prediction value of the next time interval of each training time interval, wherein the network operation status prediction model is a long short-term memory artificial neural network model;

[0100] In this embodiment, the Internet of Things operation data corresponding to each training time interval and the corresponding network operation status are spliced ​​into the Internet of Things operation training feature vector of each training time interval, and each Internet of Things operation training feature vector is input into the long short-term memory artificial neural network model to be trained in chronological order to predict the network operation status of the Internet of Things in the next time interval of each training time interval, so as to obtain the training prediction value of the network operation status of the next time interval of each training time interval.

[0101] Step A4, iteratively optimizing the network operation state prediction model to be trained according to each network operation state training label value and each network operation state training prediction value, to obtain a trained network operation state prediction model.

[0102] In this embodiment, the model loss of the long short-term memory artificial neural network model to be trained is calculated according to the difference between the network operation status training prediction value obtained by predicting each training time interval and the network operation status training label value of the next time interval of each training time interval, and whether the long short-term memory artificial neural network model to be trained has converged is judged according to the model loss; if the long short-term memory artificial neural network model to be trained has converged, it is determined that the training of the long short-term memory artificial neural network model is completed, and a trained long short-term memory artificial neural network model is obtained; if the long short-term memory artificial neural network model to be trained has not converged, the long short-term memory artificial neural network model to be trained is updated according to the model gradient calculated by the model loss, and the step of obtaining the Internet of Things operation training data corresponding to at least one training time interval and the network operation status training label value of the next time interval of each training time interval is returned to execute until the calculated model loss converges.

[0103] Exemplarily, the steps of iteratively optimizing the network operation state prediction model to be trained according to each network operation state label and each network operation state training prediction value to obtain the trained network operation state prediction model include:

[0104] Step A41, iteratively optimizing the network operation state prediction model to be trained according to each network operation state training label value and each network operation state training prediction value, to obtain the network operation state prediction model to be tested;

[0105] In order to reduce the generalization error and improve the ability of the trained model to have a better prediction effect on real data, the obtained data is usually divided into a training set and a test set. For example, after obtaining a batch of IoT operation history data, this batch of IoT operation history data can be divided into IoT operation training data and IoT operation test data according to a certain ratio, wherein the division ratio of IoT operation training data and IoT operation test data can be set according to actual conditions. For example, 80% of the IoT operation history data can be divided into IoT operation training data, and 20% of the IoT operation history data can be divided into IoT operation test data; the IoT operation training data is used to train the network operation status prediction model, and the IoT operation test data is used to test the accuracy of the network operation status prediction model. When the accuracy obtained by testing with the IoT operation test data is higher than the preset accuracy threshold, the network operation status prediction model is determined to converge. Otherwise, it is necessary to re-acquire the IoT operation history data and re-train and test the model until the accuracy obtained by testing with the IoT operation test data is higher than the preset accuracy threshold.

[0106] In an implementable manner, after obtaining the IoT operation historical data set, the collected historical data can also be checked for consistency and integrity, and the historical data can be normalized, serialized, normalized, etc. Exemplarily, each IoT operation historical data can be sorted according to the timestamp, and then each IoT operation historical data can be standardized, that is, according to the performance characteristics of each type of IoT operation historical data, the correctness of the IoT operation historical data can be verified based on statistical methods, and abnormal data can be eliminated or corrected; then, based on the timestamp, the standardized IoT operation historical data can be spliced ​​into historical data feature vectors for each time interval, and each historical data feature vector can be arranged in chronological order, and then each historical data feature vector can be divided into training data feature vectors and test data feature vectors according to a preset ratio.

[0107] In this embodiment, the model loss of the long short-term memory artificial neural network model to be trained is calculated according to the difference between the network operation status training prediction value obtained by each training time interval and the network operation status training label value of the next time interval of each training time interval, and the long short-term memory artificial neural network model to be trained is updated according to the model gradient calculated according to the model loss to obtain the network operation status prediction model to be tested.

[0108] Step A42, obtaining Internet of Things operation test data corresponding to at least one test time interval and a network operation status test tag value of the next time interval of each test time interval, wherein the Internet of Things operation test data includes registration test data, control plane session test data, user plane session test data and user plane traffic test data;

[0109] In this embodiment, the Internet of Things operation test data corresponding to at least one pre-divided test time interval and the network operation status test label value of the next time interval of each test time interval are obtained, wherein the Internet of Things operation test data includes registration test data, control plane session test data, user plane session test data and user plane traffic test data.

[0110] Step A43, determining the test network operation status of the Internet of Things in each test time interval based on the operation test data of each Internet of Things and the preset fuzzy logic decision rule;

[0111] In this embodiment, the Internet of Things operation test data of each test time interval can be input into the preset fuzzy logic decision rules in chronological order for reasoning, and the network operation status of the Internet of Things that matches the Internet of Things operation data of each test time interval can be output.

[0112] Step A44, inputting the IoT operation test data corresponding to each test time interval and the test network operation status corresponding to each test time interval into the network operation status prediction model to be tested, and obtaining the network operation status test prediction value of the next time interval of each test time interval;

[0113] In this embodiment, the Internet of Things operation data corresponding to each test time interval and the corresponding network operation status are spliced ​​into the Internet of Things operation test feature vector of each test time interval. By inputting each Internet of Things operation test feature vector into the long short-term memory artificial neural network model to be tested in chronological order, the network operation status of the Internet of Things in the next time interval of each test time interval is predicted, and the network operation status test prediction value of the next time interval of each test time interval is obtained.

[0114] Step A45, calculating the prediction accuracy of the network operation status prediction model to be tested according to each network operation status test label value and each network operation status test prediction value;

[0115] In this embodiment, the prediction accuracy of the network operation status prediction model to be tested is calculated based on the difference between the network operation status training prediction value obtained by predicting each training time interval and the network operation status training label value of the next time interval of each training time interval.

[0116] Step A46: When the prediction accuracy exceeds the preset accuracy threshold, the network operation status prediction model to be tested is determined as the trained network operation status prediction model.

[0117] In this embodiment, when the prediction accuracy exceeds the preset accuracy threshold, the long short-term memory artificial neural network model to be tested is determined to have converged, and the network operation status prediction model to be tested is determined to be the trained network operation status prediction model; when the prediction accuracy does not exceed the preset accuracy threshold, it is determined that the long short-term memory artificial neural network model to be tested has not converged, and the step of obtaining the Internet of Things operation training data corresponding to at least one training time interval and the network operation status training label value of the next time interval of each training time interval is returned to execute until the calculated prediction accuracy exceeds the preset accuracy threshold. Among them, the accuracy threshold can be set according to the actual situation, and this embodiment does not limit this, for example, it can be 95%.

[0118] In an practicable manner, after the test set test, after obtaining a batch of IoT operation history data, the batch of IoT operation history data can be divided into IoT operation training data, IoT operation test data and IoT operation verification data according to a certain ratio, wherein the division ratio of IoT operation training data, IoT operation test data and IoT operation verification data can be set according to actual conditions, for example, 70% of IoT operation history data can be divided into IoT operation training data, 20% of IoT operation history data can be divided into IoT operation test data, and 10% of IoT operation history data can be divided into IoT operation verification data. Among them, IoT operation training data is used to train the network operation state prediction model; IoT verification data is used to evaluate the network operation state prediction model and determine the better model parameters; IoT operation test data is used to test the accuracy of the network operation state prediction model. When the accuracy obtained by using IoT operation test data is higher than the preset accuracy threshold, the network operation state prediction model is determined to converge, otherwise, it is necessary to re-acquire IoT operation history data to re-train, verify and test the model until the accuracy obtained by using IoT operation test data is higher than the preset accuracy threshold.

[0119] In this embodiment, through model training, the accuracy of IoT anomaly prediction for the next time interval can be improved, so that IoT anomalies can be identified and eliminated earlier and more accurately, the smoothness of use of IoT terminals can be improved, complaints from IoT terminal users can be reduced, and user satisfaction with the IoT can be improved.

[0120] Reference Figure 7 In addition, the embodiment of the present application also provides an Internet of Things abnormality identification device, and the Internet of Things abnormality identification device includes:

[0121] The acquisition module M1 is configured to acquire the IoT operation data of the current time interval, wherein the IoT operation data includes registration data, control plane session data, user plane session data and user plane flow data;

[0122] The identification module M2 is configured to perform IoT anomaly identification based on the IoT operation data of the current time interval.

[0123] Exemplarily, the identification module M2 is further configured to:

[0124] Based on the Internet of Things operation data of the current time interval and a preset fuzzy logic decision rule, the network operation status of the Internet of Things in the current time interval is determined.

[0125] Exemplarily, the identification module M2 is further configured to:

[0126] Based on the Internet of Things operation data of the current time interval and the network operation status of the current time interval, the network operation status of the Internet of Things in the next time interval is predicted.

[0127] Exemplarily, the identification module M2 is further configured to:

[0128] The network operation state of the Internet of Things in the next time interval is predicted by inputting the Internet of Things operation data of the current time interval and the network operation state of the current time interval into a network operation state prediction model, wherein the network operation state prediction model is a long short-term memory artificial neural network model.

[0129] Exemplarily, the IoT anomaly identification device further includes a training module, and the training module is configured to:

[0130] Obtaining Internet of Things operation training data corresponding to at least one training time interval and a network operation status training label value of a next time interval of each training time interval, wherein the Internet of Things operation training data includes registration training data, control plane session training data, user plane session training data, and user plane traffic training data;

[0131] Determine the training network operation status of the Internet of Things in each training time interval based on the operation training data of each Internet of Things and the preset fuzzy logic decision rule;

[0132] Inputting the Internet of Things operation training data corresponding to each of the training time intervals and the training network operation status corresponding to each of the training time intervals into the network operation status prediction model to be trained, and obtaining the network operation status training prediction value of the next time interval of each of the training time intervals, wherein the network operation status prediction model is a long short-term memory artificial neural network model;

[0133] According to each of the network operation status training label values ​​and each of the network operation status training prediction values, the network operation status prediction model to be trained is iteratively optimized to obtain a trained network operation status prediction model.

[0134] Exemplarily, the training module is further configured to:

[0135] Iteratively optimizing the network operation state prediction model to be trained according to each of the network operation state training label values ​​and each of the network operation state training prediction values ​​to obtain a network operation state prediction model to be tested;

[0136] Obtaining Internet of Things operation test data corresponding to at least one test time interval and a network operation status test tag value of a next time interval of each of the test time intervals, wherein the Internet of Things operation test data includes registration test data, control plane session test data, user plane session test data, and user plane traffic test data;

[0137] Determine the test network operation status of the Internet of Things in each of the test time intervals based on the operation test data of each of the Internet of Things and a preset fuzzy logic decision rule;

[0138] Inputting the Internet of Things operation test data corresponding to each of the test time intervals and the test network operation status corresponding to each of the test time intervals into the network operation status prediction model to be tested, and obtaining the network operation status test prediction value of the next time interval of each of the test time intervals;

[0139] Calculating the prediction accuracy of the network operation status prediction model to be tested according to each of the network operation status test label values ​​and each of the network operation status test prediction values;

[0140] When the prediction accuracy exceeds a preset accuracy threshold, the network operation status prediction model to be tested is determined as a trained network operation status prediction model.

[0141] Exemplarily, the IoT anomaly identification device further includes an output module. After the step of performing IoT anomaly identification based on the IoT operation data of the current time interval, the output module is configured to:

[0142] When the Internet of Things is identified to be in an abnormal state, an abnormal prompt message is output.

[0143] Exemplarily, the registration data includes an initial registration success rate;

[0144] And / or, the control plane session data includes the control plane session establishment success rate

[0145] And / or, the user plane session data includes a user plane session establishment request success rate and an average number of online sessions;

[0146] And / or, the user plane traffic data includes N6 interface uplink traffic and N6 interface downlink traffic.

[0147] The IoT anomaly identification device provided by the present application adopts the IoT anomaly identification method in the above-mentioned embodiment to solve the technical problem of poor timeliness of IoT anomaly identification in conventional technology. Compared with the related art, the beneficial effects of the IoT anomaly identification device provided by the embodiment of the present application are the same as the beneficial effects of the IoT anomaly identification method provided by the above-mentioned embodiment, and the other technical features in the IoT anomaly identification device are the same as the features disclosed in the above-mentioned embodiment method, which will not be described in detail here.

[0148] In addition, an embodiment of the present application also provides a network device, which includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the Internet of Things anomaly identification method as described above.

[0149] In addition, an embodiment of the present application further provides a storage medium, which is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the Internet of Things anomaly identification method as described above are implemented.

[0150] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or system including the element.

[0151] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) as described above, and includes a number of instructions for a terminal device (which can be a mobile phone, computer, server, or network device, etc.) to execute the methods described in each embodiment of the present application.

[0152] The above are only preferred embodiments of the present application, and are not intended to limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A method for identifying anomalies in the Internet of Things, characterized in that: The Internet of Things anomaly identification method comprises: Obtaining IoT operation data for the current time interval, wherein the IoT operation data includes registration data, control plane session data, user plane session data, and user plane traffic data; Based on the IoT operation data of the current time interval, IoT anomalies are identified.

2. The method for identifying anomalies in the Internet of Things according to claim 1, characterized in that: The step of identifying anomalies of the Internet of Things based on the Internet of Things operation data of the current time interval includes: Based on the Internet of Things operation data of the current time interval and a preset fuzzy logic decision rule, the network operation status of the Internet of Things in the current time interval is determined.

3. The method for identifying anomalies in the Internet of Things according to claim 2, characterized in that: After the step of determining the network operation state of the Internet of Things in the current time interval based on the Internet of Things operation data in the current time interval and the preset fuzzy logic decision rule, the method further includes: Based on the Internet of Things operation data of the current time interval and the network operation status of the current time interval, the network operation status of the Internet of Things in the next time interval is predicted.

4. The method for identifying anomalies in the Internet of Things according to claim 3, characterized in that: The step of predicting the network operation state of the Internet of Things in the next time interval based on the Internet of Things operation data of the current time interval and the network operation state of the current time interval includes: The network operation state of the Internet of Things in the next time interval is predicted by inputting the Internet of Things operation data of the current time interval and the network operation state of the current time interval into a network operation state prediction model, wherein the network operation state prediction model is a long short-term memory artificial neural network model.

5. The method for identifying anomalies in the Internet of Things according to claim 4, characterized in that: The Internet of Things anomaly identification method also includes: Obtaining Internet of Things operation training data corresponding to at least one training time interval and a network operation status training label value of a next time interval of each training time interval, wherein the Internet of Things operation training data includes registration training data, control plane session training data, user plane session training data, and user plane traffic training data; Determine the training network operation status of the Internet of Things in each training time interval based on the operation training data of each Internet of Things and the preset fuzzy logic decision rule; Inputting the Internet of Things operation training data corresponding to each of the training time intervals and the training network operation status corresponding to each of the training time intervals into the network operation status prediction model to be trained, and obtaining the network operation status training prediction value of the next time interval of each of the training time intervals, wherein the network operation status prediction model is a long short-term memory artificial neural network model; According to each of the network operation status training label values ​​and each of the network operation status training prediction values, the network operation status prediction model to be trained is iteratively optimized to obtain a trained network operation status prediction model.

6. The method for identifying anomalies in the Internet of Things according to claim 5, characterized in that: The step of iteratively optimizing the network operation state prediction model to be trained according to each of the network operation state training label values ​​and each of the network operation state training prediction values ​​to obtain a trained network operation state prediction model comprises: Iteratively optimizing the network operation state prediction model to be trained according to each of the network operation state training label values ​​and each of the network operation state training prediction values ​​to obtain a network operation state prediction model to be tested; Obtaining Internet of Things operation test data corresponding to at least one test time interval and a network operation status test tag value of a next time interval of each of the test time intervals, wherein the Internet of Things operation test data includes registration test data, control plane session test data, user plane session test data, and user plane traffic test data; Determine the test network operation status of the Internet of Things in each of the test time intervals based on the operation test data of each of the Internet of Things and a preset fuzzy logic decision rule; Inputting the Internet of Things operation test data corresponding to each of the test time intervals and the test network operation status corresponding to each of the test time intervals into the network operation status prediction model to be tested, and obtaining the network operation status test prediction value of the next time interval of each of the test time intervals; Calculating the prediction accuracy of the network operation status prediction model to be tested according to each of the network operation status test label values ​​and each of the network operation status test prediction values; When the prediction accuracy exceeds a preset accuracy threshold, the network operation status prediction model to be tested is determined as a trained network operation status prediction model.

7. The method for identifying anomalies in the Internet of Things according to any one of claims 1 to 6, characterized in that: After the step of identifying anomalies of the Internet of Things based on the Internet of Things operation data of the current time interval, the method further includes: When the Internet of Things is identified to be in an abnormal state, an abnormal prompt message is output.

8. The method for identifying anomalies in the Internet of Things according to any one of claims 1 to 6, characterized in that: The registration data includes initial registration success rate; And / or, the control plane session data includes the control plane session establishment success rate And / or, the user plane session data includes a user plane session establishment request success rate and an average number of online sessions; And / or, the user plane traffic data includes N6 interface uplink traffic and N6 interface downlink traffic.

9. A network device, characterized in that: The network device comprises: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the method for identifying anomalies in the Internet of Things as described in any one of claims 1 to 8.

10. A storage medium, characterized in that: The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the Internet of Things anomaly identification method according to any one of claims 1 to 8 are implemented.

Images