Gigabit Ethernet equipment fingerprint classification method based on generalized extreme value distribution compensation

Abstract

The invention discloses a gigabit Ethernet equipment fingerprint classification method based on generalized extreme value distribution compensation. The method comprises the following steps: acquiring historical data basic fingerprints of a plurality of gigabit Ethernet equipment from a historical database; the method comprises the following steps: acquiring a plurality of current data of gigabit Ethernet equipment, and processing the current data in a historical data basic fingerprint acquisition mode to obtain a current data basic fingerprint; a minority oversampling technology is synthesized by using an SMOTE algorithm, and data enhancement is carried out on current data basic fingerprints; after random value extraction undersampling is carried out on historical data basic fingerprints, current data basic fingerprints are added, and a new and old data mixed fingerprint database is obtained; based on the new and old data mixed fingerprint database after generalized extreme value distribution fitting, training a fingerprint classifier by adopting an SVM (Support Vector Machine) method to obtain a fingerprint classifier with robustness for subsequent fingerprint classification; according to the compensation method based on generalized extreme value distribution, the influence of environment change on fingerprints can be resisted.

Description

Technical Field

[0001] The invention relates to the technical field of wireless positioning, and in particular to a Gigabit Ethernet device fingerprint classification method based on generalized extreme value distribution compensation. Background Art

[0002] The popularity of Ethernet communication technology has made the network one of the basic infrastructures of modern society. With the rapid development of the Internet of Things (IoT), more and more devices are connected to the network, and the security authentication of these devices has become particularly important. Although the traditional authentication mechanism based on MAC (Media Access Control Address) and digital certificates provides security to a certain extent, they have obvious security flaws. MAC addresses can be easily copied or forged by malicious users through technical means, and digital certificates can also be subject to man-in-the-middle attacks, resulting in invalid identity authentication.

[0003] In order to deal with these security threats, new device authentication technologies have begun to be explored in existing technologies. Ethernet fingerprint technology, as an emerging authentication method, realizes identity authentication by analyzing the physical layer characteristics of network devices. Existing studies have shown that the fingerprints formed by physical layer characteristics are unique in different network cards. Even communication devices of the same model and manufacturer in the same series will have slight differences in fingerprints. The 10M rate negotiation signal fingerprint in 100M Ethernet can be extracted by associating symbol differential trajectory diagrams and signal amplitude distribution histograms, and the fingerprint can be identified using the naive Bayes algorithm, SVM and deep learning methods respectively, or the adjacent symbol constellation trajectory diagram (AdjacentConstellationTranceFigure,ACTF) method can be used to extract the 1000M Ethernet signal fingerprint and use convolutional neural networks to identify it. The recognition rates reached 96.29% and 99.49% respectively under the conditions of signal-to-noise ratio of 10dB and 30dB.

[0004] Existing research shows that Ethernet fingerprint technology is affected by time factors, and its accuracy will decrease over time. This is because the physical characteristics of network equipment may change due to factors such as temperature, humidity, and power fluctuations, resulting in deviations in fingerprint features. It is necessary to design robust algorithms and models to resist the impact of environmental changes on fingerprints. In addition, the acquisition process of Ethernet fingerprints is relatively complex, and it takes a long time to collect enough data to train the classification model. In a rapidly changing network environment, this time delay may affect the real-time and efficiency of authentication. In order to improve the speed of fingerprint acquisition and the training efficiency of the classification model, it is necessary to design lightweight algorithms and models to reduce the pressure of collecting data. Summary of the invention

[0005] Technical purpose: In view of the defects in the prior art, the present invention discloses a Gigabit Ethernet device fingerprint classification method based on generalized extreme value distribution compensation. The compensation method based on generalized extreme value distribution can adapt to the changes in physical characteristics of network equipment caused by factors such as time and power supply fluctuations, thereby resisting the impact of environmental changes on fingerprints.

[0006] Technical solution: In order to achieve the above technical objectives, the present invention adopts the following technical solution.

[0007] A Gigabit Ethernet device fingerprint classification method based on generalized extreme value distribution compensation, the method comprising: Acquire historical data basic fingerprints of several Gigabit Ethernet devices from a historical database; the historical database stores several historical data of Gigabit Ethernet devices, the several historical data constitute a historical data basic data set, and extract fingerprints from the historical data basic data set to obtain historical data basic fingerprints; Collect some current data of Gigabit Ethernet devices, process the current data by obtaining the basic fingerprint of historical data, and obtain the basic fingerprint of current data; The SMOTE algorithm is used to synthesize a minority oversampling technique to enhance the current data base fingerprint; After randomly undersampling the basic fingerprint of historical data, add the basic fingerprint of current data to obtain a mixed fingerprint library of new and old data; Based on the new and old data mixed fingerprint library after generalized extreme value distribution fitting, the SVM support vector machine method is used to train the fingerprint classifier to obtain a robust fingerprint classifier for subsequent fingerprint classification.

[0008] Beneficial effects: 1. The robust Gigabit Ethernet device classification method designed by the present invention is based on the compensation method of generalized extreme value distribution, which can adapt to the physical property changes of network devices caused by factors such as time and power supply fluctuations, thereby resisting the impact of environmental changes on fingerprints. This method compensates for the fingerprint distribution through multiple iterations, corrects the deviation of Ethernet fingerprints over time, and improves the accuracy of fingerprint classification.

[0009] 2. The time for training the Gigabit Ethernet device classifier is improved based on the data enhancement method: By combining old data with new data to simultaneously train the classifier and using the SMOTE oversampling method to expand the fingerprint data set, the fingerprint collection time is reduced. At the same time, the lightweight algorithm and model reduce the pressure of data collection, improve the speed of fingerprint collection and the training efficiency of the classification model, thereby improving the overall processing speed.

[0010] 3. Based on the DPC algorithm and the clustering density of the sub-cluster, the under-sampling distribution fitting of the mixed class is performed. While retaining the aggregation characteristics within the class, the distribution characteristics of the old distribution are quickly fitted, which improves the iteration speed of distribution compensation and reduces the generation time of the mixed training set. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] Figure 1 It is a schematic diagram of the structure of the Gigabit Ethernet device signal acquisition system of the present invention; Figure 2 The present invention is a flow chart of the method. DETAILED DESCRIPTION

[0012] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0013] As attached Figure 2 As shown, a Gigabit Ethernet device fingerprint classification method based on generalized extreme value distribution compensation in this embodiment includes the following steps: S1. Obtaining historical data basic fingerprints of several Gigabit Ethernet devices from a historical database; the historical database stores several historical data of Gigabit Ethernet devices, and the several historical data constitute a historical data basic data set, and extracting fingerprints from the historical data basic data set to obtain the historical data basic fingerprint; preprocessing, feature extraction, and LDA dimension reduction of the historical data basic data set to obtain the historical data basic fingerprint; The historical data of each Gigabit Ethernet device in the historical data basic data set is truncated into several signal sequences according to a preset length, and all signal sequences are preprocessed, feature extracted, and LDA dimension reduced to obtain several device fingerprints as the historical data basic fingerprint; that is, for each Gigabit Ethernet device, fingerprint information in different time periods can be obtained.

[0014] Among them, all signal sequences are preprocessed, including: performing DC removal processing and power normalization processing on all signal sequences in turn, wherein the DC removal processing includes: subtracting the average value of the signal sequence to obtain the signal sequence after DC removal; the power normalization processing includes: dividing the signal sequence after DC removal by its standard deviation to obtain the signal sequence after power normalization, and finally achieving standardization of all signal sequences.

[0015] In this embodiment, some historical data of the Gigabit Ethernet device is obtained by constructing a Gigabit Ethernet device signal acquisition system, such as Figure 1 As shown. The Gigabit Ethernet device signal acquisition system includes three external access terminals, multiple Gigabit Ethernet network cards, a Gigabit Ethernet switch, an Ethernet signal adapter board, and three SMA interfaces. The three external access terminals can be desktop computers, laptops, etc.; multiple Gigabit Ethernet network cards are used as fingerprint sources of Gigabit Ethernet devices. Multiple Gigabit Ethernet network cards can be plugged into Gigabit Ethernet devices, and each Gigabit Ethernet network card has its own device fingerprint; the Gigabit Ethernet network card is a PCIE or USB network card; a Gigabit Ethernet switch, as a unified terminal device, is also a Gigabit Ethernet classification system for classifying received device fingerprint information. The Ethernet signal adapter board has two RJ45 interfaces connected to the Gigabit Ethernet device, and three SMA interfaces as outputs and connected to an oscilloscope. The oscilloscope is used to collect the Gigabit Ethernet signal of the Gigabit Ethernet network card in the Gigabit Ethernet device. When a user uses a Gigabit Ethernet device, the signal passes through the adapter board and is collected by the oscilloscope. The oscilloscope inputs the collected signal into the processor, extracts the signal fingerprint, and collects the terminal device fingerprint library. After the fingerprint database is generated, the processor controls the oscilloscope to regularly collect Gigabit Ethernet device signals and extract fingerprints, and judge the identity of the Gigabit Ethernet device through the switch. For unknown devices, the communication link of the device is disconnected by controlling the switch port.

[0016] The transmission signals of multiple Gigabit Ethernet network cards are collected using the Gigabit Ethernet signal collection system; the historical database of this embodiment stores 4 days of historical data to form a historical data basic data set. The historical data of each Gigabit Ethernet device is intercepted into several signal sequences according to a preset length. The following describes the processing process of a signal sequence of a Gigabit Ethernet device: Define a signal sequence for a Gigabit Ethernet device as , Signal sequence The A signal, , represents the length of the signal sequence, When performing signal acquisition, we often encounter problems with DC bias and power differences between different devices. DC bias is not part of the signal characteristics and may interfere with subsequent processing. In order to eliminate this interference, the signal sequence needs to be Perform DC removal, that is, subtract the average value from the signal. The calculation method for DC removal is as follows: , in, is the signal sequence after DC removal, for The A signal; At the same time, the power difference between different devices will also affect the effect of signal processing. To solve this problem, power normalization technology can be used, that is, each value of the signal is divided by its standard deviation to achieve signal standardization. The calculation method of power normalization is: , in, is the signal sequence after power normalization. Through these steps, the accuracy and consistency of signal processing can be ensured, and the signal sequence after power normalization is obtained Can improve the quality of signal processing.

[0017] Signal sequence after power normalization is the time series data, the signal sequence after power normalization The truncated average spectrum is used as a relatively stable random signal of the device fingerprint. The relationship between its correlation function and power spectrum is analyzed to perform spectrum analysis, and feature extraction is performed by calculating its power spectrum. The feature extraction process includes: In a limited time period Considering the stationary power-normalized signal sequence A truncated signal , whose discrete Fourier transform is: , in, To cut off the signal The discrete sequence obtained by the discrete Fourier transform is is the frequency index, For discrete sequences Length; The time interval length T is determined according to the length of the power-normalized signal sequence. , divided into Z signal groups, each signal group includes L truncated signals ; Finally, all discrete sequences and their power spectrum averages are calculated to obtain the device power spectrum set; in one embodiment, Z is 100 and L is 50. Correspondingly, the discrete sequence The power spectrum Defined as: , Since random signals have many possible forms of realization, After taking the absolute value of the square and dividing it by 2T, we get a signal group , where L is the number of truncated signals in the signal group, and the average power spectrum of the signal group is calculated : , in, Indicates the average value calculation; through this method, the device power spectrum fingerprint set is obtained ,in, The average power spectrum calculated for the Zth signal group; for The matrix representation of , Z is the number of signal groups.

[0018] Linear Discriminant Analysis (LDA) is used to reduce the dimension of the obtained power spectrum fingerprint. The specific steps are as follows: For each device category, the scatter matrix of its fingerprint samples is calculated, where the sample refers to the average value of each power spectrum. The scatter matrix measures the difference between samples in the same category. Gigabit Ethernet fingerprint dataset for Ethernet device categories, The intra-class scatter matrix of classes and the between-class scatter matrix They are defined as: , in, For the A set of power spectrum fingerprints of devices of different categories, , is the Ethernet device category number; For the The sample mean of the power spectrum fingerprint of each category of equipment, For the The number of samples of the power spectrum fingerprint set of each category of equipment, is the sample mean of the power spectrum fingerprint set of all categories of equipment; In order to find the best dimensionality reduction direction, it is necessary to solve the following generalized eigenvalue problem: , in, is the eigenvector, is the between-class scatter matrix The corresponding eigenvalues; Solving this formula, we get a series of eigenvalues ​​and corresponding eigenvectors. In descending order of eigenvalues, we select the eigenvectors corresponding to the first d largest eigenvalues. These eigenvectors form a matrix V to project the original data onto the selected eigenvectors, i.e., the eigenvectors corresponding to the first d largest eigenvalues, to achieve dimensionality reduction. For the original data set, i.e., each fingerprint sample in the device power spectrum fingerprint set , which is expressed as , can be calculated by the following formula: , in, is the transposed matrix of the selected eigenvector. In this way, the dimension-reduced representation of the Gigabit Ethernet signal fingerprint is obtained. , and further obtain the device power spectrum fingerprint set after dimensionality reduction .

[0019] S2. Collect some current data of Gigabit Ethernet devices, process the current data by obtaining the basic fingerprint of historical data, and obtain the basic fingerprint of current data. Perform preprocessing, feature extraction, and LDA dimension reduction on the current data in the same way to obtain the basic fingerprint of current data; S3, using the SMOTE algorithm to synthesize minority oversampling technology, perform data enhancement on the current data base fingerprint, generate new samples, and solve the problem of insufficient number of minority class samples; Since the number of newly collected fingerprints is small, the ratio of current data basic fingerprints to historical data basic fingerprints is 1:9; the SMOTE (Synthetic Minority Over-sampling Technique) algorithm is used to enhance the data of the newly collected fingerprints. SMOTE is an unsupervised learning algorithm used to deal with the problem of class imbalance in data sets. It achieves sample balance by generating new sample points between minority class samples. The specific steps are as follows: (1) Determine the neighborhood of each newly collected sample in the current data base fingerprint: For the current data base fingerprint For each sample in , use the K-nearest neighbor algorithm to determine its M nearest neighbor samples; (2) Calculate the imbalance of the sample set: Based on the ratio q of newly collected samples to old data, randomly select q domain samples from the M nearest neighbor samples of each newly collected sample; (3) Generate new sample points: For each newly collected sample, a new sample is generated by linear interpolation based on the selected q neighborhood samples. If an original newly collected sample is , a randomly selected neighborhood sample is , then the new sample The formula for generating is: ,in, is a number randomly selected from the interval [0, 1]. The expanded device power spectrum fingerprint set is obtained , where R is the number of expanded power spectrum fingerprints.

[0020] S4. After randomly sampling and undersampling the basic fingerprint of historical data, add the basic fingerprint of current data to obtain a mixed fingerprint library of new and old data. In order to compensate for the offset of new data caused by time changes, the distribution of old data and the mixed distribution of new and old data are calculated based on the generalized extreme value distribution. Based on the difference between the distribution of old data and the distribution of new and old data, the method of multiple random sampling is adopted to compensate the distribution so that the distribution of old data fingerprint and the distribution of new data fingerprint are successfully fitted. The undersampling process is as follows: make The current data base fingerprint A column of independent and identically distributed samples follows distribution F, , if there is a list of constants , so that: If established, Obey the following distribution: , in, is a positional parameter, is the scale parameter, is the scale parameter, is a positional parameter, It is called the extreme value index. Based on the maximum likelihood estimation method, the maximum likelihood estimation is performed on the eigenvalues ​​of the generalized extreme value distribution of the old data fingerprint to obtain the location parameter of the generalized distribution. , scale parameters and extreme value indicators ; S41, undersample the old data; assume that the old data samples are divided into F subclusters Based on the DPC algorithm, the density peak clustering algorithm quickly finds the clustering density of each subcluster, with the aim of strengthening the local regional features of each subcluster, removing noise points, and the local regional features of the i-th subcluster. The calculation formula is: , in, It is a sample , The distance between is the cutoff distance, i.e. the search radius of the neighborhood, and the function Defined as ; easy to obtain, local density That is, with the sample Distance less than or equal to The number of sample points.

[0021] Each subcluster Density and sampling weights Defined as: , in, is the number of Ethernet device categories; the sub-cluster is under-sampled using the sampling weight to obtain the under-sampled sub-cluster The expression is: , S42, the under-sampled fingerprint data Mix with the new fingerprint data and calculate the generalized extreme value distribution eigenvalues ​​of the mixed fingerprint data, including the location parameters , scale parameters , extreme value index ; Define the difference function To measure the difference between new and old data: , in, , are the extreme value indicators of new data and old data respectively, , are the scale parameters of the new data and the scale parameters of the old data, respectively. are the position parameters of the new data and the old data respectively; S43. Given a threshold ,if , then the distribution characteristics of the new data are considered to be no significantly different from those of the old data; if the difference is greater than or equal to the threshold , then randomly sample the mixed data to obtain a new subset; randomly sample the compensation parameters from the target distribution: , Wherein, p is abstracted as a random sampling process. In one embodiment, according to the ratio of old data to new data, the sampling ratio is set to 90%. They are the extreme value index, scale parameter, and location parameter of the distribution after random sampling; For each sample, a new difference function is calculated If the threshold condition is not met, the sample set is divided into GROUP1 and GROUP2, and the calculation and , respectively, are the difference functions calculated from sample set GROUP1, sample set GROUP2 and old data; select and The smaller one is used as the new distribution , S44, calculate the eigenvalue of the generalized extreme value distribution again, and repeat the above steps, i.e. S42 to S44, until .

[0022] S5. Based on the new and old data mixed fingerprint library after generalized extreme value distribution fitting, the SVM support vector machine method is used to train the fingerprint classifier to obtain a robust fingerprint classifier for subsequent fingerprint classification.

[0023] The robust Gigabit Ethernet device classification method designed by the present invention is based on the compensation method of generalized extreme value distribution, which can adapt to the physical property changes of network devices caused by factors such as time and power supply fluctuations, thereby resisting the impact of environmental changes on fingerprints. This method compensates for the fingerprint distribution through multiple iterations, corrects the deviation of Ethernet fingerprints over time, and improves the accuracy of fingerprint classification.

[0024] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A Gigabit Ethernet device fingerprint classification method based on generalized extreme value distribution compensation, characterized in that: Methods include: Acquire historical data basic fingerprints of several Gigabit Ethernet devices from a historical database; the historical database stores several historical data of Gigabit Ethernet devices, the several historical data constitute a historical data basic data set, and extract fingerprints from the historical data basic data set to obtain historical data basic fingerprints; Collect some current data of Gigabit Ethernet devices, process the current data by obtaining the basic fingerprint of historical data, and obtain the basic fingerprint of current data; The SMOTE algorithm is used to synthesize a minority oversampling technique to enhance the current data base fingerprint; After randomly undersampling the basic fingerprint of historical data, add the basic fingerprint of current data to obtain a mixed fingerprint library of new and old data; Based on the new and old data mixed fingerprint library after generalized extreme value distribution fitting, the SVM support vector machine method is used to train the fingerprint classifier to obtain a robust fingerprint classifier for subsequent fingerprint classification.

2. The Gigabit Ethernet device fingerprint classification method based on generalized extreme value distribution compensation according to claim 1 is characterized in that: The fingerprint extraction process includes: preprocessing the data set, feature extraction, and LDA dimension reduction to obtain device fingerprints. The data set contains data of several Gigabit Ethernet devices. The data of each Gigabit Ethernet device in the data set is truncated into several signal sequences according to a preset length. Preprocessing, feature extraction, and LDA dimension reduction are performed on each signal sequence to obtain several device fingerprints of several devices.

3. The Gigabit Ethernet device fingerprint classification method based on generalized extreme value distribution compensation according to claim 2 is characterized in that: The preprocessing process includes: A signal sequence for a Gigabit Ethernet device is , Signal sequence The A signal, , Indicates the length of the signal sequence. To remove DC, the calculation formula includes: ， in, is the signal sequence after DC removal, for The A signal; Then the power normalization calculation is performed on the signal sequence after DC removal. The calculation formula includes: ， in, is the signal sequence after power normalization.

4. The Gigabit Ethernet device fingerprint classification method based on generalized extreme value distribution compensation according to claim 2 is characterized in that: The feature extraction process includes: for each preprocessed signal sequence , determine the time interval length T, divide it into Z signal groups, each signal group includes L truncated signals ,Finally, all discrete sequences and their power spectrum averages are calculated to obtain the device power spectrum set; The calculation formula for discrete sequence is: ， in, To cut off the signal The discrete sequence obtained by the discrete Fourier transform is is the frequency index, For discrete sequences Length, Indicates the length of the signal sequence, discrete sequence The power spectrum The calculation formula is: ， Take a signal group , where L is the number of truncated signals in the signal group, and the average power spectrum of the signal group is calculated : ， in, Indicates the average value calculation; through this method, the device power spectrum fingerprint set is obtained ,in, The average power spectrum calculated for the Zth signal group; for The matrix representation of .

5. The Gigabit Ethernet device fingerprint classification method based on generalized extreme value distribution compensation according to claim 2 is characterized in that: The LDA dimension reduction process includes: For a Gigabit Ethernet fingerprint dataset for Ethernet device categories, The intra-class scatter matrix of and the between-class scatter matrix They are defined as: ， in, For the A set of power spectrum fingerprints of devices of different categories, , is the Ethernet device category number; For the The sample mean of the power spectrum fingerprint of each category of equipment, For the The number of samples of the power spectrum fingerprint set of each category of equipment, is the sample mean of the power spectrum fingerprint set of all categories of equipment; The calculation formulas for eigenvalues ​​and eigenvectors include: ， in, is the eigenvector, is the between-class scatter matrix The corresponding eigenvalues; Solving this formula, we get a series of eigenvalues ​​and corresponding eigenvectors. In descending order of eigenvalues, we select the eigenvectors corresponding to the first d largest eigenvalues. These eigenvectors form a matrix V to project the original data onto the selected eigenvectors, i.e., the eigenvectors corresponding to the first d largest eigenvalues, to achieve dimensionality reduction. For each fingerprint sample in the device power spectrum fingerprint set, , which is expressed as , the calculation formula is: ， in, is the transposed matrix of the selected eigenvector, and the device power spectrum fingerprint set after dimensionality reduction is obtained .

6. The Gigabit Ethernet device fingerprint classification method based on generalized extreme value distribution compensation according to claim 1, characterized in that: The processing of the SMOTE algorithm includes: Determine the neighborhood of each newly collected sample in the current data base fingerprint: For the current data base fingerprint For each sample in , use the K-nearest neighbor algorithm to determine its M nearest neighbor samples; Calculate the imbalance of the sample set: According to the ratio q of the newly collected samples to the old data, randomly select q domain samples from the M nearest neighbor samples of each newly collected sample; For each newly collected sample, a new sample is generated by linear interpolation based on the selected q neighboring samples.

7. The Gigabit Ethernet device fingerprint classification method based on generalized extreme value distribution compensation according to claim 1 is characterized in that: The undersampling process includes: make The current data base fingerprint A column of independent and identically distributed samples follows distribution F, , if there exists a list of constants , so that: If established, Obey the following distribution: ， in, is a positional parameter, is the scale parameter, is the scale parameter, is a positional parameter, It is called the extreme value index. Based on the maximum likelihood estimation method, the maximum likelihood estimation is performed on the eigenvalues ​​of the generalized extreme value distribution of the old data fingerprint to obtain the location parameter of the generalized distribution. , scale parameters and extreme value indicators ; Undersample the old data; assume that the old data samples are divided into F subclusters Based on the DPC algorithm, the density peak clustering algorithm quickly finds the clustering density of each subcluster and the local area characteristics of the i-th subcluster The calculation formula is: ， in, It is a sample , The distance between is the cutoff distance, i.e. the search radius of the neighborhood, and the function Defined as ; Each subcluster Density and sampling weights Defined as: ， in, is the number of Ethernet device categories; the sub-cluster is under-sampled using the sampling weight to obtain the under-sampled sub-cluster The expression is: ， The under-sampled fingerprint data Mix with the new fingerprint data and calculate the generalized extreme value distribution eigenvalues ​​of the mixed fingerprint data, including the location parameters , scale parameters , extreme value index ; Define the difference function To measure the difference between new and old data: ， in, , are the extreme value indicators of new data and old data respectively, , are the scale parameters of the new data and the scale parameters of the old data, respectively. are the position parameters of the new data and the old data respectively; Given a threshold ,if , then the distribution characteristics of the new data are considered to be no significantly different from those of the old data; if the difference is greater than or equal to the threshold , then randomly sample the mixed data to obtain a new subset; randomly sample the compensation parameters from the target distribution: ， Among them, p is abstracted as a random sampling process, They are the extreme value index, scale parameter, and location parameter of the distribution after random sampling; For each sample, a new difference function is calculated If the threshold condition is not met, the sample set is divided into GROUP1 and GROUP2, and the calculation and , respectively, are the difference functions calculated from sample set GROUP1, sample set GROUP2 and old data; select and The smaller one is used as the new distribution , Calculate the generalized extreme value distribution eigenvalue again until it satisfies .

Images