Node detection method and device of EdgeX, equipment and storage medium
By obtaining node information in the EdgeX network, generating a classification tree and performing abnormal detection, the problem of insufficient node detection accuracy and accuracy in the prior art is solved, and more efficient abnormal node recognition is achieved.
Patent Information
- Application Number
- CN202411432055.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-10-14
- Publication Date
- 2025-01-07
AI Technical Summary
In the prior art, node detection methods are insufficient in complex network environments to accurately identify node abnormalities, resulting in false positives or missed reports.
By obtaining the EdgeX network node information, performing preliminary abnormality detection, determining detection scores, generating classification trees, calculating abnormality detection scores, identifying initial abnormal nodes, and improving detection accuracy and accuracy through the classification of abnormal node information.
It improves the accuracy and accuracy of node detection, can more effectively identify abnormal situations in network nodes, and reduces false alarms and missed reports.
Smart Images
Figure CN119276748A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of node detection technology, and in particular to a node detection method, device, equipment and storage medium of EdgeX. Background Art
[0002] With the rapid development of 5G technology, artificial intelligence, computing hardware and other fields, edge computing, as an emerging computing model, is widely used to handle real-time tasks close to the data source. As an open source project in the field of edge computing, EdgeX Foundry provides a unified application framework to support the rapid development and deployment of IoT solutions. The EdgeX Foundry platform supports data interaction and processing between devices and the cloud by providing a microservice architecture. It allows developers to build and deploy applications on the edge side to achieve rapid data collection, processing and analysis, thereby reducing latency and improving efficiency. Although EdgeX Foundry provides strong support for IoT solutions, in actual applications, anomaly detection of network nodes remains a technical challenge. Traditional node anomaly detection methods mainly rely on traffic monitoring, which may not accurately identify all types of node anomalies, especially in complex network environments. Existing node detection methods often have problems with insufficient detection precision and accuracy when facing changing network conditions and diverse anomaly patterns. For example, detection based on traffic sudden drops may not be able to distinguish between normal traffic fluctuations and real anomalies, resulting in false positives or false negatives.
[0003] The above contents are only used to assist in understanding the technical solution of the present application and do not constitute an admission that the above contents are prior art. Summary of the invention
[0004] The main purpose of this application is to provide an EdgeX node detection method, device, equipment and storage medium, aiming to solve the technical problem of insufficient node detection precision and accuracy in the prior art.
[0005] To achieve the above objectives, the present application proposes an EdgeX node detection method, which includes:
[0006] Obtain node information of each node in the EdgeX network, perform preliminary anomaly detection based on the node information, and determine a detection score for each of the nodes;
[0007] Determine a classification value according to the detection score, generate a classification tree based on the classification value and the detection score, determine the edge length of each detection score in the classification tree, and determine an abnormality detection score based on the edge length;
[0008] Determine an initial abnormal node according to the abnormal detection score, obtain abnormal node information corresponding to the initial abnormal node, determine the abnormal node information type, and classify the abnormal node information based on the abnormal node information type to obtain a target classification result;
[0009] Determine abnormal nodes according to the target classification result.
[0010] In one embodiment, the steps of determining a classification value according to the detection score, generating a classification tree based on the classification value and the detection score, determining the edge length of each detection score in the classification tree, and determining the abnormality detection score based on the edge length include:
[0011] determining a first score and a second score of the detection score, the first score being greater than the second score;
[0012] determining a detection interval according to the first score and the second score;
[0013] determining a classification value according to the detection interval;
[0014] A classification tree is generated based on the classification value and the detection score, the edge length of each detection score in the classification tree is determined, and an abnormality detection score is determined based on the edge length.
[0015] In one embodiment, the steps of generating a classification tree based on the classification value and the detection score, determining the edge length of each detection score in the classification tree, and determining the abnormality detection score based on the edge length include:
[0016] Dividing the detection scores into a plurality of detection groups according to the largest decision tree node;
[0017] Create a decision tree according to the classification value and the detection grouping, determine the distance between the node corresponding to each detection score and the root node, and obtain the edge length data corresponding to the node corresponding to each detection score;
[0018] Obtaining an edge length data set according to edge length data corresponding to the detection score distance of each of the nodes;
[0019] When a termination condition is met, the detection score of each node is calculated according to the edge length data set corresponding to each node, and the termination condition is that the edge length data is greater than the preset edge length data;
[0020] The detection scores are screened to obtain anomaly detection scores.
[0021] In one embodiment, the steps of determining an initial abnormal node according to the abnormal detection score, acquiring abnormal node information of the initial abnormal node, and classifying the abnormal node information to obtain a target classification result include:
[0022] Determine a node label corresponding to the anomaly detection score, determine the anomaly detection score according to the node label, and determine an initial anomaly node according to the anomaly detection score;
[0023] Determining abnormal node information of the initial abnormal node, and normalizing the abnormal node information to obtain normalized data;
[0024] Classification is performed based on the normalized data to obtain a target classification result.
[0025] In one embodiment, the step of performing classification based on the normalized data to obtain a target classification result includes:
[0026] Determine a plurality of key characteristic data of the abnormal node information;
[0027] The normalized data corresponding to the plurality of key feature data are classified through a node detection model to obtain a target classification result.
[0028] In one embodiment, before the step of classifying the normalized data corresponding to the key feature data through a node detection model to obtain a target classification result, the step further includes:
[0029] Map the node data information to the high-dimensional feature space to obtain a feature data set;
[0030] determining a decision boundary based on the feature data set;
[0031] Constraining the decision boundary according to the feature data set to determine a boundary interval;
[0032] Model fitting is performed according to the boundary interval to obtain a node detection model.
[0033] In one embodiment, after the step of determining abnormal nodes according to the target classification results, the method further includes:
[0034] Determining abnormal parameters of the abnormal node, and determining an abnormal level of the abnormal node according to the abnormal parameters;
[0035] A detection report is generated according to the abnormal parameters and the abnormal level, and the detection report is output.
[0036] In addition, to achieve the above purpose, the present application also proposes an EdgeX node detection device, and the EdgeX node detection device includes:
[0037] A detection preparation module, used to obtain node information of each node in the EdgeX network, perform preliminary anomaly detection based on the node information, and determine the detection score of each node;
[0038] an initial detection module, configured to determine a classification value according to the detection score, and classify the detection score based on the classification value to determine an abnormal detection score;
[0039] an anomaly detection module, used to determine an initial abnormal node according to the anomaly detection score, obtain abnormal node information of the initial abnormal node, and classify the abnormal node information to obtain a target classification result;
[0040] The abnormal output module is used to determine the abnormal node according to the target classification result.
[0041] In addition, to achieve the above-mentioned purpose, the present application also proposes an EdgeX node detection device, which includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the EdgeX node detection method as described above.
[0042] In addition, to achieve the above-mentioned purpose, the present application also proposes a storage medium, which is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by the processor, the steps of the EdgeX node detection method described above are implemented.
[0043] In addition, to achieve the above-mentioned purpose, the present application also provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, it implements the steps of the EdgeX node detection method as described above.
[0044] One or more technical solutions proposed in the present application have at least the following technical effects: obtaining node information of each node in the EdgeX network, performing preliminary anomaly detection based on the node information, determining the detection score of each node, determining a classification value based on the detection score, generating a classification tree based on the classification value and the detection score, determining the edge length of each detection score in the classification tree, and determining anomaly detection scores based on the edge lengths, determining initial abnormal nodes based on the anomaly detection scores, obtaining abnormal node information corresponding to the initial abnormal nodes, determining abnormal node information types, classifying the abnormal node information based on the abnormal node information types, obtaining target classification results, determining abnormal nodes based on the target classification results, and improving the precision and accuracy of node detection. BRIEF DESCRIPTION OF THE DRAWINGS
[0045] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.
[0046] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.
[0047] Figure 1 A flowchart of the first embodiment of the EdgeX node detection method of the present application is provided;
[0048] Figure 2 A flow chart of the second embodiment of the EdgeX node detection method of the present application;
[0049] Figure 3 A schematic diagram of a classification tree provided for an embodiment of an EdgeX node detection method of the present application;
[0050] Figure 4 A schematic diagram of multiple groups of classification trees provided for an embodiment of an EdgeX node detection method of the present application;
[0051] Figure 5 A flow chart of the second embodiment of the EdgeX node detection method of the present application;
[0052] Figure 6 This is a schematic diagram of the module structure of the node detection device of EdgeX in an embodiment of the present application;
[0053] Figure 7 This is a schematic diagram of the device structure of the hardware operating environment involved in the EdgeX node detection method in the embodiment of the present application.
[0054] The purpose, features and advantages of this application will be further described in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION
[0055] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application and are not used to limit the present application.
[0056] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.
[0057] The main solution of the embodiment of the present application is: obtaining node information of each node in the EdgeX network, performing preliminary anomaly detection based on the node information, determining the detection score of each node, determining a classification value based on the detection score, generating a classification tree based on the classification value and the detection score, determining the edge length of each detection score in the classification tree, and determining the anomaly detection score based on the edge length, determining the initial abnormal node according to the anomaly detection score, obtaining the abnormal node information corresponding to the initial abnormal node, determining the abnormal node information type, classifying the abnormal node information based on the abnormal node information type, obtaining a target classification result, and determining the abnormal node according to the target classification result.
[0058] In this embodiment, for ease of description, the following description is made by taking the node detection device for identifying EdgeX as the execution subject.
[0059] Since the traditional node anomaly detection method in the prior art mainly relies on traffic monitoring, this method may not be able to accurately identify all types of node anomalies, especially in complex network environments. Existing node detection methods often have problems with insufficient detection precision and accuracy when facing changing network conditions and diverse anomaly patterns. For example, detection based on sudden drops in traffic may not be able to distinguish between normal traffic fluctuations and real anomalies, resulting in false positives or false negatives.
[0060] The present application provides a solution, by obtaining node information of each node in the EdgeX network, performing preliminary anomaly detection based on the node information, determining the detection score of each node, determining a classification value based on the detection score, generating a classification tree based on the classification value and the detection score, determining the edge length of each detection score in the classification tree, and determining anomaly detection scores based on the edge lengths, determining initial abnormal nodes based on the anomaly detection scores, obtaining abnormal node information corresponding to the initial abnormal nodes, determining abnormal node information types, classifying the abnormal node information based on the abnormal node information types, obtaining target classification results, determining abnormal nodes based on the target classification results, and improving the precision and accuracy of node detection.
[0061] It can be seen from the above embodiments that the present application obtains node information of each node in the EdgeX network, performs preliminary anomaly detection based on the node information, determines the detection score of each node, determines the classification value based on the detection score, generates a classification tree based on the classification value and the detection score, determines the edge length of each detection score in the classification tree, and determines the anomaly detection score based on the edge length, determines the initial abnormal node according to the anomaly detection score, obtains the abnormal node information corresponding to the initial abnormal node, determines the abnormal node information type, classifies the abnormal node information based on the abnormal node information type, obtains the target classification result, determines the abnormal node according to the target classification result, and improves the precision and accuracy of node detection.
[0062] It should be noted that the execution subject of this embodiment can be a computing service device with data processing, network communication and program running functions, such as a tablet computer, a personal computer, a mobile phone, etc., or an electronic device capable of realizing the above functions, an EdgeX node detection device, etc. The following takes the EdgeX node detection device as an example to illustrate this embodiment and the following embodiments.
[0063] Based on this, the embodiment of the present application provides an EdgeX node detection method, referring to Figure 1 , Figure 1 This is a flow chart of the first embodiment of the EdgeX node detection method of the present application.
[0064] In this embodiment, the EdgeX node detection method includes steps S10 to S40:
[0065] Step S10, obtaining node information of each node in the EdgeX network, performing preliminary anomaly detection based on the node information, and determining a detection score of each node.
[0066] It should be noted that the EdgeX network is an architecture that plays an important role in edge networks. It is a distributed architecture with low latency, openness and interoperability. Node information includes configuration information of each network node in the network node, network information and other information that can describe the current node status. The detection score is an analysis of the node information of the current node, which is used to measure the operating status of the current network node.
[0067] In the specific implementation, by sending sniffing information to each node in the Edge network, the sniffing information can be sent to each network node according to the existing network topology relationship. The sniffing information can receive the node information of the network node when it reaches the target network node, including the bandwidth, resource utilization, transmission rate and other information of the network node. After obtaining the node information of the network node, preliminary abnormality detection can be performed based on the node information, and the node information can be screened according to the preset detection strategy. The network node information corresponding to the node information that does not meet the preset detection strategy is extracted to form a node information set separately, and those network nodes that meet the preset detection strategy can be considered as normal network nodes. When the node information set is obtained, the scoring weight of each node parameter can be determined according to the preset scoring criteria, and then the detection score of the network node is obtained. Specifically, if the information of a network node is m={L,α,S...}, where m is the network node information, L is the bandwidth data, α is the resource utilization, and S is the transmission rate. Then the detection score of the network node can be expressed as: i =L i K1+α i K2+S i K3+..., sorce is the detection score, K i is the scoring weight.
[0068] Step S20, determining a classification value according to the detection score, generating a classification tree based on the classification value and the detection score, determining the edge length of each detection score in the classification tree, and determining an abnormality detection score based on the edge length.
[0069] It should be noted that the classification value refers to the value used to divide the detection score into two detection partitions. The classification value is between the maximum and minimum values of the detection score. The classification tree is a tree with the classification value as the root node and other detection scores as leaf nodes. The anomaly detection score refers to the detection score in the detection score that can reflect that the network node is an abnormal node.
[0070] In a specific implementation, by detecting the network nodes, a detection score set in the node information set is obtained, and a detection score is randomly selected as a classification value in the detection score set, and a detection score greater than the classification value is created on one side of the root node, and a detection score less than the classification value is created on the other side of the root node, thereby forming a classification tree, and being able to determine the side length of each detection score in the classification tree, where the side length is the distance between the child node and the root node. Since the node information set is an abnormal network node obtained by preliminary screening of abnormal nodes, the abnormal detection score is determined.
[0071] Step S30, determining an initial abnormal node according to the abnormal detection score, acquiring abnormal node information corresponding to the initial abnormal node, determining the abnormal node information type, classifying the abnormal node information based on the abnormal node information type, and obtaining a target classification result.
[0072] It should be noted that the initial abnormal node is the node corresponding to the abnormal detection score, where the initial abnormal node is composed of a large number of abnormal nodes and a small number of normal nodes. The normal node identified as an abnormal node has node information close to the division criteria of normal nodes and abnormal nodes, so it is mistakenly classified into the initial abnormal node during the initial division.
[0073] In the specific implementation, when the initial abnormal node is determined according to the abnormal detection score, the abnormal node information corresponding to the initial abnormal node can be obtained, and the type of abnormal node information can be determined, among which the bandwidth, resource utilization, transmission rate and other information of the abnormal node information can be obtained, and the abnormal node information can be classified according to different abnormal node information, and the corresponding classifier is selected to classify different types of data. For each type of data, a data set D can be created. i , and based on each data set D i The optimal hyperplane is found based on the decision function, and the objective function and constraints are determined according to the decision function. The abnormal node information is classified based on the objective function and the constraints to obtain the target classification result.
[0074] Step S40: determining abnormal nodes according to the target classification result.
[0075] In a specific implementation, when determining an abnormal node based on a target classification result, the results in the target classification result can be analyzed. Since a node has multiple types of data at the same time, a node will correspond to multiple target classification results. As long as there is at least one abnormal data, the node can be determined to be an abnormal node.
[0076] After the step of determining abnormal nodes according to the target classification result, the method further includes:
[0077] Determining abnormal parameters of the abnormal node, and determining an abnormal level of the abnormal node according to the abnormal parameters;
[0078] A detection report is generated according to the abnormal parameters and the abnormal level, and the detection report is output. In a specific implementation, the abnormal parameters of the abnormal node are determined, and the abnormal parameters are graded, the abnormal level is determined according to the mapping relationship between the abnormal score and the level, and a detection report is generated based on the abnormal parameters and the abnormal level, and the output report is output.
[0079] This embodiment provides an EdgeX node detection method, which obtains node information of each node in the EdgeX network, performs preliminary anomaly detection based on the node information, determines the detection score of each node, determines a classification value based on the detection score, generates a classification tree based on the classification value and the detection score, determines the edge length of each detection score in the classification tree, and determines anomaly detection scores based on the edge lengths, determines initial abnormal nodes based on the anomaly detection scores, obtains abnormal node information corresponding to the initial abnormal nodes, determines an abnormal node information type, classifies the abnormal node information based on the abnormal node information type, obtains a target classification result, determines the abnormal node based on the target classification result, and improves the precision and accuracy of node detection.
[0080] In one possible implementation, refer to Figure 2 , Figure 2 A flow chart of the second embodiment of the EdgeX node detection method is provided, where step S20 may include steps S21 to S24:
[0081] Step S21: Determine a first score and a second score of the detection score, wherein the first score is greater than the second score.
[0082] It should be noted that the first score and the second score are respectively the maximum value and the minimum value in the detection scores.
[0083] Step S22: determining a detection interval according to the first score and the second score.
[0084] Step S23: Determine a classification value according to the detection interval.
[0085] Step S24: generating a classification tree based on the classification value and the detection score, determining the edge length of each detection score in the classification tree, and determining the abnormality detection score based on the edge length.
[0086] In a specific implementation, the detection scores are sorted to determine the order of the detection scores, and then the maximum and minimum values of the detection scores are determined, and the detection interval is determined based on the maximum and minimum values. When determining the abnormality detection score, a value can be randomly selected in the detection interval as the classification value, and a classification tree is generated based on the detection score and the classification value, and the side length of each detection score in the classification tree is determined, and the detection score is determined based on the side length. Figure 3 , Figure 3 The diagram is a schematic diagram of a classification tree. P0 is the classification value, which is the root node of the classification tree. P1 to P6 are all child nodes. The edge length is determined based on the distance between each child node and the root node, and the anomaly score is determined based on the edge length.
[0087] Exemplarily, the steps of generating a classification tree based on the classification value and the detection score, determining the edge length of each detection score in the classification tree, and determining the abnormality detection score based on the edge length include:
[0088] Dividing the detection scores into a plurality of detection groups according to the largest decision tree node;
[0089] Create a decision tree according to the classification value and the detection grouping, determine the distance between the node corresponding to each detection score and the root node, and obtain the edge length data corresponding to the node corresponding to each detection score;
[0090] Obtaining an edge length data set according to edge length data corresponding to the detection score distance of each of the nodes;
[0091] When a termination condition is met, the detection score of each node is calculated according to the edge length data set corresponding to each node, and the termination condition is that the edge length data is greater than the preset edge length data;
[0092] The detection scores are screened to obtain anomaly detection scores.
[0093] In a specific implementation, when generating a classification tree based on the classification value and the detection score, determining the side length of each detection score in the classification tree, and determining the abnormal detection score based on the side length, accidental factors can be eliminated by constructing multiple groups of classification trees. The detection score can be divided into multiple detection groups according to the largest decision tree node, and a decision tree can be created according to the same construction method. Figure 4 , Figure 4 It is a schematic diagram of multiple groups of classification trees. Determine the distance between the node corresponding to each detection score and the root node, obtain the edge length data corresponding to the node corresponding to each detection score, and obtain the edge length data set according to the edge length data corresponding to the detection score distance of each node. When the edge length data is greater than the preset edge length data, it means that the upper limit of the tree has been reached. At this time, the detection score of each node can be calculated according to the edge length data set corresponding to each node, and the detection score is screened to obtain the abnormal detection score. When calculating the edge length, the edge length can be calculated according to h(x)=e+c(T.size), where e is the number of edges that the node experiences from the root node of the tree to the child node, T.size is the number of nodes in the same child node, c(T.size) is the average path length, and c(n) is calculated as follows:
[0094]
[0095] Among them, γ is the Euler constant, γ = 0.5772156649.
[0096] When calculating the anomaly score, according to the formula:
[0097]
[0098] Among them, h(x) is the edge length of the sample in the tree, E(h(x)) is the average edge length of the sample in t trees, and c(n) is the average path length of n samples in the BST binary tree.
[0099] Based on the above embodiments, in the third embodiment of the present application, the same or similar contents as those in the first embodiment can be referred to the above description, and will not be described in detail later. Figure 5 , step S30 may include steps S31 to S33:
[0100] Step S31: determining a node label corresponding to the anomaly detection score, determining the anomaly detection score according to the node label, and determining an initial anomaly node according to the anomaly detection score.
[0101] Step S32: determining abnormal node information of the initial abnormal node, and normalizing the abnormal node information to obtain normalized data.
[0102] Step S33: Classify based on the normalized data to obtain a target classification result.
[0103] In a specific implementation, the corresponding node label can be determined according to the anomaly detection score, and the initial abnormal node can be determined based on the node label, and the abnormal node information of the initial abnormal node is normalized to obtain normalized data. When performing normalization, the maximum and minimum values of each single information in the node information are determined according to the node label, and normalization is performed based on the data in the single information to reduce the amount of data, and the target classification result is obtained by classifying the normalized data.
[0104] Exemplarily, the step of performing classification based on the normalized data to obtain a target classification result includes:
[0105] Determine a plurality of key characteristic data of the abnormal node information;
[0106] The normalized data corresponding to the plurality of key feature data are classified through a node detection model to obtain a target classification result.
[0107] In the specific implementation, by determining multiple key feature data in the abnormal node information, and classifying the multiple features according to the feature data, classifying each feature, constructing an SVM support vector machine, and classifying the normalized data corresponding to the key feature data through the node detection model to obtain the target classification result, the objective function and constraint conditions are determined by the decision function in the node detection model, and the target classification result is obtained.
[0108] Exemplarily, before the step of classifying the normalized data corresponding to the key feature data through a node detection model to obtain a target classification result, the step further includes:
[0109] Map the node data information to the high-dimensional feature space to obtain a feature data set;
[0110] determining a decision boundary based on the feature data set;
[0111] Constraining the decision boundary according to the feature data set to determine a boundary interval;
[0112] Model fitting is performed according to the boundary interval to obtain a node detection model.
[0113] In the specific implementation, the node information can be set in a high-dimensional feature space to obtain a feature data set. For example, there is a data set D={(x1,y1),(x2,y2),..,(x n ,y n )}, where x i represents the feature vector of the i-th sample, y i Represents the category label of the i-th sample, the feature vector x i Has n dimensions, namely x i =(x 1i ,x 2i ,....,x ni ), and then find the optimal hyperplane to get the decision boundary. At this time, the hyperplane can maximize the detection of sample points to the hyperplane and correctly separate sample points of different categories. The optimal plane can be expressed by the formula w·x+b=0, where w represents the normal vector of the hyperplane and b represents the intercept of the hyperplane. Since the samples in the data set are linearly separable, the constraint condition of the sample point can be determined as y i (w·x i +b)≥1,i=1,2,...,n, and then by solving the objective function and constraints, we can get the optimal solution α=(α1,α2,...α m ), and then the decision function can be calculated Where b is the bias term, and the prediction formula of SVM can be described as f(x)=sign(w·x+b), where sign is the sign function, w is the weight vector, x is the input feature vector, and b is the bias term.
[0114] This embodiment provides an EdgeX node detection method, which can be based on preliminary screening of node information through an isolation forest, and then screening the detection scores corresponding to the node information through an SVM support vector machine, and determining the detection results of the nodes according to the classification results, and determining abnormal nodes. Through two screenings, accurate detection of nodes can be achieved, thereby improving the accuracy of the detection results.
[0115] It should be noted that the above examples are only used to understand the present application and do not constitute a limitation on the node detection method of EdgeX of the present application. More simple transformations based on this technical concept are all within the scope of protection of the present application.
[0116] This application also provides an EdgeX node detection device, please refer to Figure 6 , the EdgeX node detection device includes:
[0117] A detection preparation module 10 is used to obtain node information of each node in the EdgeX network, perform preliminary anomaly detection based on the node information, and determine a detection score of each node;
[0118] an initial detection module 20, configured to determine a classification value according to the detection score, and classify the detection score based on the classification value to determine an abnormal detection score;
[0119] An anomaly detection module 30 is used to determine an initial abnormal node according to the anomaly detection score, obtain abnormal node information of the initial abnormal node, and classify the abnormal node information to obtain a target classification result;
[0120] The abnormal output module 40 is used to determine abnormal nodes according to the target classification result.
[0121] In one embodiment, the initial detection module 20 is further used to determine a first score and a second score of the detection score, the first score being greater than the second score; determining a detection interval based on the first score and the second score; determining a classification value based on the detection interval; generating a classification tree based on the classification value and the detection score, determining the side lengths of each detection score in the classification tree, and determining an abnormal detection score based on the side lengths.
[0122] In one embodiment, the initial detection module 20 is also used to divide the detection score into multiple detection groups according to the maximum decision tree node; create a decision tree according to the classification value and the detection group, determine the distance of the node corresponding to each detection score from the root node, and obtain the edge length data corresponding to the node corresponding to each detection score; obtain an edge length data set according to the edge length data corresponding to the detection score distance of each node; when the termination condition is met, calculate the detection score of each node according to the edge length data set corresponding to each node, and the termination condition is that the edge length data is greater than the preset edge length data; filter the detection scores to obtain abnormal detection scores.
[0123] In one embodiment, the anomaly detection module 30 is further used to determine the node label corresponding to the anomaly detection score, determine the anomaly detection score according to the node label, and determine the initial abnormal node according to the anomaly detection score; determine the abnormal node information of the initial abnormal node, normalize the abnormal node information to obtain normalized data; and perform classification based on the normalized data to obtain a target classification result.
[0124] In one embodiment, the abnormality detection module 30 is further used to determine a plurality of key feature data of the abnormal node information; and classify the normalized data corresponding to the plurality of key feature data through a node detection model to obtain a target classification result.
[0125] In one embodiment, the anomaly detection module 30 is also used to map the node data information to a high-dimensional feature space to obtain a feature data set; determine a decision boundary based on the feature data set; constrain the decision boundary according to the feature data set to determine the boundary interval; perform model fitting according to the boundary interval to obtain a node detection model.
[0126] In one embodiment, the abnormal output module 40 is further used to determine the abnormal parameters of the abnormal node, and determine the abnormal level of the abnormal node according to the abnormal parameters; generate a detection report according to the abnormal parameters and the abnormal level, and output the detection report.
[0127] The EdgeX node detection device provided in this application adopts the EdgeX node detection method in the above embodiment, which can solve the technical problem of insufficient node detection precision and accuracy in the prior art. Compared with the prior art, the beneficial effects of the EdgeX node detection device provided in this application are the same as the beneficial effects of the EdgeX node detection method provided in the above embodiment, and other technical features in the EdgeX node detection device are the same as the features disclosed in the above embodiment method, which will not be repeated here.
[0128] The present application provides an EdgeX node detection device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the EdgeX node detection method in the above-mentioned embodiment 1.
[0129] Reference below Figure 7 , which shows a schematic diagram of the structure of the node detection device of EdgeX suitable for implementing the embodiment of the present application. The node detection device of EdgeX in the embodiment of the present application may include but is not limited to mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 7 The EdgeX node detection device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.
[0130] like Figure 7As shown, the node detection device of EdgeX may include a processing device 1001 (such as a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM: Read Only Memory) 1002 or a program loaded from a storage device 1003 to a random access memory (RAM: Random Access Memory) 1004. In RAM1004, various programs and data required for the operation of the node detection device of EdgeX are also stored. The processing device 1001, ROM1002 and RAM1004 are connected to each other via a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems can be connected to the I / O interface 1006: input devices 1007 including, for example, a touch screen, a touchpad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; output devices 1008 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; storage devices 1003 including, for example, a tape, a hard disk, etc.; and communication devices 1009. The communication device 1009 can allow the node detection device of EdgeX to communicate wirelessly or wired with other devices to exchange data. Although the figure shows the node detection device of EdgeX with various systems, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems may be implemented or provided alternatively.
[0131] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.
[0132] The EdgeX node detection device provided by the present application adopts the EdgeX node detection method in the above embodiment, which can solve the technical problem of insufficient node detection precision and accuracy in the prior art. Compared with the prior art, the beneficial effects of the EdgeX node detection device provided by the present application are the same as the beneficial effects of the EdgeX node detection method provided by the above embodiment, and the other technical features in the EdgeX node detection device are the same as the features disclosed in the method of the previous embodiment, which will not be repeated here.
[0133] It should be understood that the various parts disclosed in this application can be implemented by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.
[0134] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.
[0135] The present application provides a computer-readable storage medium having computer-readable program instructions (i.e., computer programs) stored thereon, and the computer-readable program instructions are used to execute the node detection method of EdgeX in the above-mentioned embodiment.
[0136] The computer-readable storage medium provided in the present application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, systems or devices, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination of the above.
[0137] The above-mentioned computer-readable storage medium may be included in the node detection device of EdgeX; or it may exist independently without being assembled into the node detection device of EdgeX.
[0138] The computer-readable storage medium carries one or more programs. When the one or more programs are executed by the node detection device of EdgeX, the node detection device of EdgeX:
[0139] Obtain node information of each node in the EdgeX network, perform preliminary anomaly detection based on the node information, and determine a detection score for each of the nodes;
[0140] Determine a classification value according to the detection score, generate a classification tree based on the classification value and the detection score, determine the edge length of each detection score in the classification tree, and determine an abnormality detection score based on the edge length;
[0141] Determine an initial abnormal node according to the abnormal detection score, obtain abnormal node information corresponding to the initial abnormal node, determine the abnormal node information type, and classify the abnormal node information based on the abnormal node information type to obtain a target classification result;
[0142] Determine abnormal nodes according to the target classification result.
[0143] Computer program code for performing the operations of the present application may be written in one or more programming languages or a combination thereof, including object-oriented programming languages such as Java, Smalltalk, C++, and conventional procedural programming languages such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).
[0144] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.
[0145] The modules involved in the embodiments described in this application may be implemented by software or hardware, wherein the name of the module does not constitute a limitation on the unit itself in some cases.
[0146] The readable storage medium provided in this application is a computer-readable storage medium, which stores computer-readable program instructions (i.e., computer programs) for executing the above-mentioned EdgeX node detection method, and can solve the technical problem of insufficient node detection precision and accuracy in the prior art. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as the beneficial effects of the EdgeX node detection method provided in the above-mentioned embodiment, and will not be repeated here.
[0147] The present application also provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of the EdgeX node detection method as described above.
[0148] The computer program product provided by this application can solve the technical problem of insufficient node detection precision and accuracy in the prior art. Compared with the prior art, the beneficial effects of the computer program product provided by this application are the same as the beneficial effects of the EdgeX node detection method provided by the above embodiment, which will not be repeated here.
[0149] The above descriptions are only some embodiments of the present application, and are not intended to limit the patent scope of the present application. All equivalent structural changes made using the contents of the present application specification and drawings under the technical concept of the present application, or direct / indirect applications in other related technical fields are included in the patent protection scope of the present application.
Claims
1. A node detection method for EdgeX, characterized in that: The EdgeX node detection method includes: Obtain node information of each node in the EdgeX network, perform preliminary anomaly detection based on the node information, and determine a detection score for each of the nodes; Determine a classification value according to the detection score, generate a classification tree based on the classification value and the detection score, determine the edge length of each detection score in the classification tree, and determine an abnormality detection score based on the edge length; Determine an initial abnormal node according to the abnormal detection score, obtain abnormal node information corresponding to the initial abnormal node, determine the abnormal node information type, and classify the abnormal node information based on the abnormal node information type to obtain a target classification result; Determine abnormal nodes according to the target classification result.
2. The EdgeX node detection method according to claim 1, characterized in that: The steps of determining a classification value according to the detection score, generating a classification tree based on the classification value and the detection score, determining the edge length of each detection score in the classification tree, and determining anomaly detection scores based on the edge length include: determining a first score and a second score of the detection score, the first score being greater than the second score; determining a detection interval according to the first score and the second score; determining a classification value according to the detection interval; A classification tree is generated based on the classification value and the detection score, the edge length of each detection score in the classification tree is determined, and an abnormality detection score is determined based on the edge length.
3. The EdgeX node detection method according to claim 2, characterized in that: The steps of generating a classification tree based on the classification value and the detection score, determining the edge length of each detection score in the classification tree, and determining the abnormal detection score based on the edge length include: Dividing the detection scores into a plurality of detection groups according to the largest decision tree node; Create a decision tree according to the classification value and the detection grouping, determine the distance between the node corresponding to each detection score and the root node, and obtain the edge length data corresponding to the node corresponding to each detection score; Obtaining an edge length data set according to edge length data corresponding to the detection score distance of each of the nodes; When a termination condition is met, the detection score of each node is calculated according to the edge length data set corresponding to each node, and the termination condition is that the edge length data is greater than the preset edge length data; The detection scores are screened to obtain anomaly detection scores.
4. The EdgeX node detection method according to claim 1, characterized in that: The steps of determining an initial abnormal node according to the abnormal detection score, acquiring abnormal node information of the initial abnormal node, and classifying the abnormal node information to obtain a target classification result include: Determine a node label corresponding to the anomaly detection score, determine the anomaly detection score according to the node label, and determine an initial anomaly node according to the anomaly detection score; Determining abnormal node information of the initial abnormal node, and normalizing the abnormal node information to obtain normalized data; Classification is performed based on the normalized data to obtain a target classification result.
5. The EdgeX node detection method according to claim 4, characterized in that: The step of performing classification based on the normalized data to obtain a target classification result comprises: Determine a plurality of key characteristic data of the abnormal node information; The normalized data corresponding to the plurality of key feature data are classified through a node detection model to obtain a target classification result.
6. The EdgeX node detection method according to claim 5, characterized in that: Before the step of classifying the normalized data corresponding to the key feature data through a node detection model to obtain a target classification result, the step further includes: Map the node data information to the high-dimensional feature space to obtain a feature data set; determining a decision boundary based on the feature data set; Constraining the decision boundary according to the feature data set to determine a boundary interval; Model fitting is performed according to the boundary interval to obtain a node detection model.
7. The EdgeX node detection method according to any one of claims 1 to 6, characterized in that: After the step of determining abnormal nodes according to the target classification results, the method further includes: Determining abnormal parameters of the abnormal node, and determining an abnormal level of the abnormal node according to the abnormal parameters; A detection report is generated according to the abnormal parameters and the abnormal level, and the detection report is output.
8. An EdgeX node detection device, characterized in that: The device comprises: A detection preparation module, used to obtain node information of each node in the EdgeX network, perform preliminary anomaly detection based on the node information, and determine a detection score of each node; an initial detection module, configured to determine a classification value according to the detection score, generate a classification tree based on the classification value and the detection score, determine the edge length of each detection score in the classification tree, and determine an abnormal detection score based on the edge length; an anomaly detection module, configured to determine an initial abnormal node according to the anomaly detection score, obtain abnormal node information corresponding to the initial abnormal node, determine the type of abnormal node information, classify the abnormal node information based on the type of abnormal node information, and obtain a target classification result; The abnormal output module is used to determine the abnormal node according to the target classification result.
9. An EdgeX node detection device, characterized in that: The device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the EdgeX node detection method according to any one of claims 1 to 7.
10. A storage medium, characterized in that: The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the EdgeX node detection method according to any one of claims 1 to 7 are implemented.