A method and device for detecting an Internet of Things card

Abstract

The present invention belongs to the technical field of Internet of Things card detection, and specifically relates to an Internet of Things card detection method, and the specific steps are as follows: data collection, feature extraction, model training, real-time monitoring, anomaly detection, response processing, feedback optimization; an incremental learning method is used to gradually update the model when new data arrives, and the specific steps are as follows: initialization model, data monitoring, model update, performance evaluation, loop iteration; an Internet of Things card detection device, including a data acquisition module, a preprocessing module, a feature extraction module, an incremental learning module, a data resampling module, a weighting module, a model evaluation module, and a decision support module. The present invention can effectively reduce the risks caused by abnormal behavior, and can also adapt to new data by gradually updating model parameters, and at the same time avoid the risk of concept drift. In addition, the incremental learning method in the detection device includes regular model updates, data resampling and weighting methods, which can adapt to new data and environmental changes.

Description

Technical Field

[0001] The present invention belongs to the technical field of Internet of Things card detection, and specifically relates to an Internet of Things card detection method and device. Background Art

[0002] The IoT Link is provided by the three major operators to support mobile communication access services for smart hardware devices. It mainly serves enterprises or professional fields, such as smart cities, smart agriculture, environmental monitoring, etc.; Main functions: The IoT Link provides basic communication services such as text messages and wireless data communications, and is suitable for application scenarios of various IoT devices; It uses a dedicated number segment (11 or 13 digits) to distinguish ordinary mobile phone cards to ensure the stability and security of device connections.

[0003] In the IoT card anomaly detection based on business scenarios, the following problems still exist:

[0004] Data patterns change rapidly: IoT business scenarios may change rapidly with market and technology changes, which may result in historical data patterns not accurately reflecting current business conditions. When business patterns change, anomaly detection models based on historical data may need to be retrained to adapt to the new data distribution, which increases maintenance costs and complexity.

[0005] When data patterns change rapidly, the use of incremental learning methods will still face the change in data distribution, which may lead to a decline in model performance. This is also a problem that needs to be solved urgently. Summary of the invention

[0006] The purpose of the present invention is to provide an Internet of Things card detection method and device, which can effectively reduce the risks caused by abnormal behavior, adapt to new data by gradually updating model parameters, and avoid the risk of concept drift at the same time. In addition, the incremental learning method in the detection device includes regular model updates, data resampling and weighting methods, which can adapt to new data and environmental changes.

[0007] The technical solution adopted by the present invention is as follows:

[0008] A method for detecting an Internet of Things card, wherein the method adopts an abnormality detection method based on a business scenario, and the specific steps are as follows:

[0009] S1: Data collection: collect key data from IoT devices in real time, and clean and format the collected raw data;

[0010] S2: Feature extraction: By analyzing the usage behavior of IoT cards, normal and abnormal behavior patterns are identified, and according to the needs of business scenarios, features that can effectively distinguish normal and abnormal behaviors are selected;

[0011] S3: Model training: Select a suitable machine learning algorithm to build an anomaly detection model, and use labeled historical data to train the model so that it can learn and identify the characteristics of abnormal behavior;

[0012] S4: Real-time monitoring: Deploy the trained model to the actual business system to monitor the real-time data stream of the IoT card. As new data continues to arrive, the model is regularly updated to adapt to possible changes in behavior patterns;

[0013] S5: Anomaly Detection: When the system detects behavior that is significantly different from the normal pattern, it marks it as a potential anomaly and issues a warning to relevant personnel based on the severity of the anomaly so that timely countermeasures can be taken;

[0014] S6: Response processing: For activities marked as abnormal, further investigation is conducted to confirm whether they are real security threats, and appropriate measures are taken based on the investigation results;

[0015] S7: Feedback optimization: Regularly evaluate the performance of the anomaly detection system, and continuously adjust and optimize the detection model and strategy based on the evaluation results and new business needs.

[0016] An incremental learning method is used to gradually update the model when new data arrives. The specific steps are as follows;

[0017] Step 1: Initialize the model: First, use the initial data set to train a basic model;

[0018] Step 2: Data monitoring: Continuously monitor new data streams and compare them with the existing model when new data arrives.

[0019] Step 3: Model update: fine-tune the model using new data;

[0020] Step 4: Evaluate performance: After each update, you need to evaluate the performance of the model to ensure that it performs well on new data.

[0021] Step 5: Iteration: The above process is an iterative process until the preset number of iterations is reached or the model performance is no longer significantly improved.

[0022] In the initialization model, we first assume that there is a loss function ,in are model parameters, and the parameters of the initialization model are , so that minimize;

[0023] In the data monitoring, when a new data point When it arrives, we need to update the model to include this new data point, which can be achieved by following the steps below:

[0024] Compute the predicted value for a new data point: ,in is the prediction function of the model;

[0025] Calculate the prediction error: ;

[0026] Update the model parameters using gradient descent: ,in is the learning rate, About gradient.

[0027] The mathematical expression of incremental learning can be summarized by the following formula:

[0028]

[0029] in, is the number of updates, It is The learning rate for each update, It is in the parameter The gradient below.

[0030] In the incremental learning, the model is updated regularly, and data is resampled and weighted to address the performance degradation problem encountered by the model when the data distribution changes.

[0031] The periodic update model is used to cope with changes in data distribution and concept drift. The specific process is as follows:

[0032] Basic assumption: Assume that the original data set is ,in is the eigenvector, is the corresponding label; assuming the model parameters are , the loss function is ;

[0033] Initial training: using the original dataset Train the model and get the initial parameters ,Right now ;

[0034] New data arrives: Assume that every once in a while, there will be a new data block arrival;

[0035] Model Update: Using New Data Fine-tune the model to get new parameters , which can be achieved by minimizing the loss function on new data: ,in, Represents a dataset that merges the original data and the new data;

[0036] Periodic update: Assume that every time , new data blocks will arrive and the above model update process will be carried out; after After updates, the model parameters can be expressed as a sequence ,in Indicates Model parameters after update;

[0037] Mathematical expression: The entire process of periodically updating the model can be summarized by the following mathematical expression:

[0038]

[0039] in, Indicates New data blocks arriving within a time interval.

[0040] The resampling method includes upsampling and downsampling;

[0041] The upsampling increases the number of samples of the minority class to make it close to the number of the majority class; the downsampling reduces the number of samples of the majority class to match the number of the minority class;

[0042] The mathematical expression of resampling is:

[0043] Assume that there are two categories A and B in the original data set, where A is the majority class and B is the minority class. Let the number of samples in class A be , the number of samples in class B is ;

[0044] The upsampled sample set can be expressed as: in and Represent the sample subsets randomly selected from class A and class B respectively;

[0045] The downsampled sample set can be expressed as: , where S represents the original data set, represents a subset of samples randomly drawn from class B.

[0046] The weighting method is used to assign weights to samples according to their categories, and the selection of weights is determined based on experience or cross-validation;

[0047] The mathematical expression of weighting is:

[0048] Assume that there are two categories A and B in the original data set, where A is the majority class and B is the minority class. Let the weight of class A be , the weight of class B is ;

[0049] During model training, the loss function of each sample can be multiplied by its corresponding weight, that is: , where L represents the original loss function, represents the weight of the sample;

[0050] For classification tasks, a weighted cross entropy loss function can be used to consider sample weights, which is expressed as: , where N represents the total number of samples represents the weight of the i-th sample, represents the true label, Represents the predicted probability.

[0051] An Internet of Things card detection device, the detection device comprising:

[0052] Data acquisition module: responsible for collecting data from IoT cards;

[0053] Preprocessing module: cleans and formats the collected data to remove noise and outliers;

[0054] Feature extraction module: extract useful features from preprocessed data;

[0055] Incremental learning module: adopts incremental learning method to regularly update the model based on newly collected data;

[0056] Data resampling module: resamples the data set during model training;

[0057] Weighting module: Apply different weights to different sources or different types of data;

[0058] Model evaluation module: evaluates the performance of the model through a series of indicators (such as accuracy and recall);

[0059] Decision support module: Provides decision support based on the output of the model.

[0060] The detection device comprises:

[0061] A memory storing executable program code;

[0062] a processor coupled to the memory;

[0063] The processor calls the executable program code stored in the memory to execute the Internet of Things card detection method.

[0064] The technical effects achieved by the present invention are:

[0065] In the present invention, anomaly detection of the Internet of Things card based on business scenarios is a process involving multiple steps and technologies, which aims to ensure the safe and efficient operation of the Internet of Things devices. Through the Internet of Things card detection method provided by the present invention, the security protection capability of the Internet of Things system can be effectively improved, and the risks caused by abnormal behavior can be reduced.

[0066] The present invention, the incremental learning method allows the model to be gradually updated and improved through new data without forgetting old knowledge. This method is particularly suitable for application scenarios where data streams continue to arrive and the distribution may change over time; it can adapt to changes in data distribution and maintain the accuracy of the model; compared with training the model from scratch, incremental learning usually requires fewer resources and time; it is suitable for application scenarios that require real-time or near real-time response; in addition, by gradually updating the model parameters to adapt to new data, this method is particularly effective when processing large-scale data sets.

[0067] In the present invention, regularly updating the model is a common strategy for coping with changes in data distribution and concept drift, thereby maintaining the performance of the model and implementing a strategy of regularly updating the model to cope with changes in data distribution and concept drift problems.

[0068] In the present invention, data resampling refers to the process of reallocating the original data set to different categories or labels according to certain rules. Its main purpose is to adjust the category imbalance problem so that each category has a more balanced distribution in the new sample set.

[0069] In the present invention, data weighting refers to assigning different weights to each sample according to its importance during the model training process; its main purpose is to solve the problem of class imbalance and improve the model's recognition ability for minority classes by increasing the weight of minority class samples.

[0070] The present invention, the Internet of Things card detection device has an incremental learning method, and the incremental learning method includes periodic model update, data resampling and weighting methods, which can efficiently process a large amount of data, monitor the status of the Internet of Things card in real time, and continuously optimize the model through incremental learning to adapt to new data and environmental changes. BRIEF DESCRIPTION OF THE DRAWINGS

[0071] Figure 1 is a flow chart of an Internet of Things card detection method provided by an embodiment of the present invention;

[0072] Figure 2 is a flow chart of an incremental learning method provided by an embodiment of the present invention;

[0073] Figure 3 It is a simplified diagram of an Internet of Things card detection device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0074] In order to make the purpose and advantages of the present invention more clearly understood, the present invention is specifically described below in conjunction with embodiments. It should be understood that the following text is only used to describe one or several specific embodiments of the present invention, and does not strictly limit the scope of protection of the specific claims of the present invention.

[0075] See attached Figure 1 , an Internet of Things card detection method, the Internet of Things card detection method adopts an abnormality detection method based on business scenarios, and the specific steps are as follows:

[0076] S1: Data collection: collect key data from IoT devices in real time, such as traffic usage, signal strength, device status, etc. These data are the basis for subsequent analysis. Clean and format the collected raw data to facilitate subsequent processing and analysis; this includes removing noise data, standardizing data formats, etc.

[0077] S2: Feature extraction: By analyzing the usage behavior of IoT cards, normal and abnormal behavior patterns can be identified. For example, abnormal traffic spikes or sudden changes in communication frequency can be detected. According to the needs of business scenarios, features that can effectively distinguish normal and abnormal behaviors, such as access time, geographic location, and communication volume, can be selected;

[0078] S3: Model training: Select an appropriate machine learning algorithm, such as decision tree, random forest, or neural network, to build an anomaly detection model, and use labeled historical data to train the model so that it can learn and identify the characteristics of abnormal behavior;

[0079] S4: Real-time monitoring: Deploy the trained model to the actual business system to monitor the real-time data stream of the IoT card. As new data continues to arrive, the model is regularly updated to adapt to possible changes in behavior patterns;

[0080] S5: Anomaly Detection: When the system detects behavior that is significantly different from the normal pattern, it marks it as a potential anomaly and issues a warning to relevant personnel based on the severity of the anomaly so that timely countermeasures can be taken;

[0081] S6: Response processing: For activities marked as abnormal, further investigation is conducted to confirm whether they are real security threats. Based on the investigation results, corresponding measures are taken, such as blocking suspicious traffic, updating security policies, etc.

[0082] S7: Feedback optimization: Regularly evaluate the performance of the anomaly detection system, including indicators such as accuracy and recall, and continuously adjust and optimize the detection model and strategy based on the evaluation results and new business needs.

[0083] The working principle of the present invention is: anomaly detection of IoT cards based on business scenarios is a process involving multiple steps and technologies, aiming to ensure the safe and efficient operation of IoT devices. Through the implementation of the above steps, the security protection capability of the IoT system can be effectively improved and the risks caused by abnormal behavior can be reduced.

[0084] Embodiment 1:

[0085] See attached Figure 2 , an incremental learning method is used to gradually update the model when new data arrives. The specific steps are as follows;

[0086] Step 1: Initialize the model: First, use the initial data set to train a basic model; this model can be any type of machine learning model, such as decision tree, support vector machine, etc.

[0087] Step 2: Data monitoring: Continuously monitor new data streams. When new data arrives, compare it with the existing model. If the new data differs significantly from the prediction results of the existing model, the model needs to be updated.

[0088] Step 3: Model update: Fine-tune the model using new data; this usually involves adjusting the parameters of the model to better adapt it to the new data; in some cases, it may be necessary to retrain the entire model, but this approach is costly, so a lighter update strategy is preferred;

[0089] Step 4: Evaluate performance: After each update, you need to evaluate the performance of the model to ensure that it performs well on new data; this can be achieved through cross-validation or other performance measurement methods;

[0090] Step 5: Iteration: The above process is an iterative process, until the preset number of iterations is reached or the model performance is no longer significantly improved. As new data continues to arrive, the model will continue to learn and update.

[0091] In the initialization model, we first assume that there is a loss function ,in are model parameters, and the parameters of the initialization model are , so that minimize;

[0092] In data monitoring, when a new data point When it arrives, we need to update the model to include this new data point, which can be achieved by following the steps below:

[0093] Compute the predicted value for a new data point: ,in is the prediction function of the model;

[0094] Calculate the prediction error: ;

[0095] Update the model parameters using gradient descent: ,in is the learning rate, About gradient.

[0096] The mathematical expression of incremental learning can be summarized by the following formula:

[0097]

[0098] in, is the number of updates, It is The learning rate for each update, It is in the parameter The gradient below.

[0099] The working principle of the present invention is as follows: the incremental learning method allows the model to be gradually updated and improved through new data without forgetting old knowledge. This method is particularly suitable for application scenarios where data streams continue to arrive and the distribution may change over time; it can adapt to changes in data distribution and maintain the accuracy of the model; compared with training a model from scratch, incremental learning usually requires fewer resources and time; it is suitable for application scenarios that require real-time or near real-time response; in addition, by gradually updating model parameters to adapt to new data, this method is particularly effective when processing large-scale data sets.

[0100] Embodiment 2:

[0101] In incremental learning, the model is updated regularly, and data is resampled and weighted to address the performance degradation problem encountered by the model when the data distribution changes.

[0102] The model is updated regularly to cope with changes in data distribution and concept drift. The specific process is as follows:

[0103] Basic assumption: Assume that the original data set is ,in is the eigenvector, is the corresponding label; assuming the model parameters are , the loss function is ;

[0104] Initial training: using the original dataset Train the model and get the initial parameters ,Right now ;

[0105] New data arrives: Assume that every once in a while, there will be a new data block arrival;

[0106] Model Update: Using New Data Fine-tune the model to get new parameters , which can be achieved by minimizing the loss function on new data: ,in, Represents a dataset that merges the original data and the new data;

[0107] Periodic update: Assume that every time , new data blocks will arrive and the above model update process will be carried out; after After updates, the model parameters can be expressed as a sequence ,in Indicates The updated model parameters;

[0108] Mathematical expression: The entire process of periodically updating the model can be summarized by the following mathematical expression:

[0109]

[0110] in, Indicates New data blocks arriving within a time interval.

[0111] The working principle of the present invention is as follows: Regularly updating the model is a common strategy for coping with changes in data distribution and concept drift, thereby maintaining the performance of the model and implementing a strategy of regularly updating the model to cope with changes in data distribution and concept drift problems.

[0112] Resampling methods include upsampling and downsampling;

[0113] Upsampling increases the number of samples in the minority class to make it close to the number of the majority class; downsampling reduces the number of samples in the majority class to match the number of the minority class.

[0114] The mathematical expression of resampling is:

[0115] Assume that there are two categories A and B in the original data set, where A is the majority class and B is the minority class. Let the number of samples in class A be , the number of samples in class B is ;

[0116] The upsampled sample set can be expressed as: in and Represent the sample subsets randomly selected from class A and class B respectively;

[0117] The downsampled sample set can be expressed as: , where S represents the original data set, represents a subset of samples randomly drawn from class B.

[0118] The working principle of the present invention is: data resampling refers to the process of redistributing the original data set into different categories or labels according to certain rules. Its main purpose is to adjust the category imbalance problem so that each category has a more balanced distribution in the new sample set.

[0119] The weighted method is used to assign weights to samples according to their categories. Usually, minority samples have higher weights. The weights are selected based on experience or cross-validation.

[0120] The mathematical expression of weighting is:

[0121] Assume that there are two categories A and B in the original data set, where A is the majority class and B is the minority class. Let the weight of class A be , the weight of class B is ;

[0122] During model training, the loss function of each sample can be multiplied by its corresponding weight, that is: , where L represents the original loss function, represents the weight of the sample;

[0123] For classification tasks, a weighted cross entropy loss function can be used to consider sample weights, which is expressed as: , where N represents the total number of samples represents the weight of the i-th sample, represents the true label, Represents the predicted probability.

[0124] The working principle of the present invention is as follows: data weighting refers to assigning different weights to each sample according to its importance during the model training process; its main purpose is to solve the problem of class imbalance and improve the model's recognition ability for minority classes by increasing the weight of minority class samples.

[0125] See attached Figure 3 , an Internet of Things card detection device, the detection device comprising:

[0126] Data collection module: responsible for collecting data from IoT cards, including traffic usage, network connection status, etc. These data are the basis for subsequent analysis and processing.

[0127] Preprocessing module: cleans and formats the collected data, removes noise and outliers, and ensures data quality and availability.

[0128] Feature extraction module: extracts useful features from the preprocessed data, such as traffic peaks, connection duration, etc., for subsequent learning and analysis.

[0129] Incremental learning module: Adopts incremental learning methods to regularly update the model based on newly collected data, which includes semi-supervised learning, small sample learning, and self-supervised learning methods to adapt to the ever-changing data environment.

[0130] Data resampling module: During the model training process, the data set is resampled to ensure that each category of data is evenly represented and improve the generalization ability of the model.

[0131] Weighting module: Apply different weights to data from different sources or different types to reflect their importance in the decision-making process, which helps optimize the performance of the model, especially when facing an imbalanced dataset.

[0132] Model evaluation module: Evaluate the performance of the model through a series of indicators (such as accuracy and recall) to ensure that the model can effectively identify abnormal behaviors or predict future data trends.

[0133] Decision support module: Provides decision support based on the output of the model, such as automatically adjusting network settings or issuing alarms to help maintenance personnel respond to possible network problems in a timely manner.

[0134] The detection device includes:

[0135] A memory storing executable program code; a processor coupled to the memory; the processor calls the executable program code stored in the memory to execute the Internet of Things card detection method.

[0136] The working principle of the present invention is: the Internet of Things card detection device has an incremental learning method, and the incremental learning method includes regular model update, data resampling and weighting methods, which can efficiently process large amounts of data, monitor the status of the Internet of Things card in real time, and continuously optimize the model through incremental learning to adapt to new data and environmental changes.

[0137] The above is only a preferred embodiment of the present invention. It should be noted that, for those skilled in the art, several improvements and modifications can be made without departing from the principles of the present invention, and these improvements and modifications should also be considered as the protection scope of the present invention. The structures, devices and operating methods not specifically described and explained in the present invention shall be implemented according to the conventional means in the art unless otherwise specified and limited.

Claims

1. A method for detecting an Internet of Things card, wherein the method adopts an abnormality detection method based on a business scenario, and is characterized in that: The specific steps are as follows: S1: Data collection: collect key data from IoT devices in real time, and clean and format the collected raw data; S2: Feature extraction: By analyzing the usage behavior of IoT cards, normal and abnormal behavior patterns are identified, and according to the needs of business scenarios, features that can effectively distinguish normal and abnormal behaviors are selected; S3: Model training: Select a suitable machine learning algorithm to build an anomaly detection model, and use labeled historical data to train the model so that it can learn and identify the characteristics of abnormal behavior; S4: Real-time monitoring: Deploy the trained model to the actual business system to monitor the real-time data stream of the IoT card. As new data continues to arrive, use incremental learning methods to regularly update the model to adapt to possible changes in behavior patterns; S5: Anomaly Detection: When the system detects behavior that is significantly different from the normal pattern, it marks it as a potential anomaly and issues a warning to relevant personnel based on the severity of the anomaly so that timely countermeasures can be taken; S6: Response processing: For activities marked as abnormal, further investigation is conducted to confirm whether they are real security threats, and appropriate measures are taken based on the investigation results; S7: Feedback optimization: Regularly evaluate the performance of the anomaly detection system, and continuously adjust and optimize the detection model and strategy based on the evaluation results and new business needs; In the incremental learning, a method of regularly updating the model, resampling the data and weighting is adopted; The periodic update model is used to cope with changes in data distribution and concept drift. The specific process is as follows: Basic assumption: Assume that the original data set is ,in is the eigenvector, is the corresponding true label, N represents the total number of samples; assuming the model parameters are , the loss function is ; Initial training: using the original dataset Train the model and get the initial parameters ,Right now ; New data arrives: Assume that every once in a while, there will be a new data set arrival, Represents the total number of new samples; Model update: using new dataset Fine-tune the model to get new parameters , which is achieved by minimizing the loss function on new data: ,in, Represents a dataset that merges the original data and the new data; Periodic update: Assume that every time , new data blocks will arrive and the above model update process will be carried out; after After updates, the model parameters are represented as a sequence ,in Indicates Model parameters after update; Mathematical expression: The entire process of periodically updating the model is expressed by the following mathematical expression: in, Indicates New data blocks arriving within a time interval; The resampling method includes upsampling and downsampling; The upsampling increases the number of samples of the minority class to make it close to the number of the majority class; the downsampling reduces the number of samples of the majority class to match the number of the minority class; The mathematical expression of resampling is: Assume that there are two categories A and B in the original data set, where A is the majority class and B is the minority class. Let the number of samples in class A be , the number of samples in class B is ; The upsampled sample set is expressed as: in and Represent the sample subsets randomly selected from class A and class B respectively; The downsampled sample set is expressed as: , where S represents the original data set, represents a subset of samples randomly selected from class B; The weighting method is used to assign weights to samples according to their categories, and the selection of weights is determined based on experience or cross-validation; The mathematical expression of weighting is: Assume that there are two categories A and B in the original data set, where A is the majority class and B is the minority class. Let the weight of class A be , the weight of class B is ; During model training, the loss function of each sample is multiplied by its corresponding weight, that is: , where L represents the original loss function, represents the weight of the sample; For classification tasks, a weighted cross entropy loss function is used to consider the sample weights, which is expressed as: , where N represents the total number of samples represents the weight of the i-th sample, represents the true label, represents the predicted probability.

2. The method for detecting an Internet of Things card according to claim 1, characterized in that: In step S4, an incremental learning method is used to gradually update the model when new data arrives. The specific steps are as follows: Step 1: Initialize the model: First, use the initial data set to train a basic model; Step 2: Data monitoring: Continuously monitor new data streams and compare them with the existing model when new data arrives. Step 3: Model update: fine-tune the model using new data; Step 4: Evaluate performance: After each update, you need to evaluate the performance of the model to ensure that it performs well on new data. Step 5: Iteration: The above process is an iterative process until the preset number of iterations is reached or the model performance is no longer significantly improved.

3. The method for detecting an Internet of Things card according to claim 2, characterized in that: In the initialization model, we first assume that there is a loss function ,in are model parameters, and the parameters of the initialization model are , so that minimize; In the data monitoring, when a new data point When it arrives, the model is updated to include this new data point. This process is achieved by the following steps: Compute the predicted value for a new data point: ,in is the prediction function of the model; Calculate the prediction error: ; Update the model parameters using gradient descent: ,in is the learning rate, It is in the parameter The gradient below.

4. The method for detecting an Internet of Things card according to claim 3, characterized in that: The mathematical expression of the incremental learning is expressed by the following formula: in, is the number of updates, It is The learning rate for each update, It is in the parameter The gradient below.

Images