Safety monitoring method and device of power Internet of Things terminal equipment and medium

Abstract

The invention discloses a safety monitoring method and device for power Internet of Things terminal equipment and a medium, and the method comprises the steps: carrying out the feature extraction of a power consumption simulation signal of a CPU module in the power Internet of Things terminal equipment, and obtaining a power consumption statistical feature embedded coding vector and a power consumption simulation mode feature graph; transforming and screening the power consumption statistical feature embedded coding vector and the power consumption simulation mode feature map to obtain a feature map; and determining whether the power Internet of Things terminal device is attacked according to the feature map, and obtaining a safety monitoring result. According to the safety monitoring method and device for the electric power Internet of Things terminal equipment and the medium, whether the electric power Internet of Things terminal equipment is attacked or not can be accurately judged according to the change mode and trend in the obtained feature map by monitoring the power consumption analog signal in real time, capturing the dynamic change features and conducting intelligent analysis, and the safety of the electric power Internet of Things terminal equipment is ensured. The problem that it is difficult to capture dynamic changes of signals and carry out accurate safety monitoring on the power Internet of Things terminal equipment can be solved.

Description

Technical Field

[0001] The present invention relates to the technical field of electric power Internet of Things, and in particular to a method, device and medium for security monitoring of electric power Internet of Things terminal equipment. Background Art

[0002] The power Internet of Things (IoT) integrates advanced sensor technology, network communication technology and data analysis technology to achieve real-time monitoring and management of all aspects of the power system, greatly improving the operating efficiency and service quality of the power system; however, with the rapid increase in the number of power IoT devices and the continuous expansion of their application scope, the security threats faced by IoT terminal devices are becoming increasingly severe; malicious attackers may exploit hardware or software vulnerabilities in power IoT terminal devices to carry out behaviors such as denial of service attacks and data tampering, which seriously threaten the stable operation of the power system and personal privacy security. Existing technologies mainly monitor and evaluate the side channel security of terminal devices to ensure their security in actual operation.

[0003] However, the security monitoring and assessment of side channels mainly relies on the classification and judgment of the statistical characteristics of the power consumption data of terminal devices. Although the statistical characteristic values ​​of the power consumption data can reflect some basic characteristics of the CPU power consumption, the power consumption characteristics of terminal devices usually change over time, and this static classification and judgment method usually cannot capture the dynamic behavior changes of the signal, thereby limiting its accuracy and reliability in practical applications. Summary of the invention

[0004] The present invention provides a method, device and medium for safety monitoring of electric power Internet of Things terminal equipment, so as to solve the problem that it is difficult to capture dynamic changes of signals and to perform accurate safety monitoring of electric power Internet of Things terminal equipment.

[0005] Obtain the power consumption simulation signal of the CPU module from the power Internet of Things terminal device;

[0006] Extracting features from the power consumption simulation signal to obtain a power consumption statistical feature embedding coding vector and a power consumption simulation modal feature graph;

[0007] Performing linear transformation and dual feature screening on the power consumption statistical feature embedding coding vector and the power consumption analog modal feature map to obtain a power consumption analog-digital hybrid modal joint coding feature map;

[0008] According to the power consumption analog-digital hybrid mode joint coding feature diagram, it is determined whether the power Internet of Things terminal device is attacked to obtain a security monitoring result.

[0009] The present invention extracts features from power consumption simulation signals, extracts power consumption statistical features embedded in coding vectors and power consumption simulation modal feature graphs, these features can reflect the power consumption characteristics of the device in different states, including normal state and potential security threat state; and the power consumption simulation signal itself is a dynamically changing signal, through real-time monitoring and feature extraction of this signal, the dynamic change characteristics of power consumption can be captured, because attack behavior often leads to abnormal changes in power consumption mode, so this characteristic is crucial for identifying whether the device is attacked. Linear transformation and dual feature screening are performed on the extracted power consumption statistical features embedded in coding vectors and power consumption simulation modal feature graphs, which can further extract more representative feature information, help remove redundant information, retain the most valuable features for security monitoring, and thus improve the accuracy of monitoring. By jointly encoding power consumption statistical features and analog modal features to form a power consumption analog-digital hybrid modal joint coding feature graph, the operating state of the device can be more comprehensively reflected. This hybrid modal representation method can integrate the advantages of multiple information sources and improve the ability to identify complex attack behaviors.

[0010] Compared with the existing technology, the present invention can accurately determine whether the power Internet of Things terminal device is attacked based on the change pattern and trend in the obtained characteristic graph by real-time monitoring of power consumption simulation signals, capturing dynamic change characteristics, and performing intelligent analysis, and give corresponding security monitoring results. Therefore, it can solve the problem of difficulty in capturing dynamic changes of signals and accurately monitoring the security of power Internet of Things terminal devices.

[0011] As a preferred solution, feature extraction is performed on the power consumption simulation signal to obtain a power consumption statistical feature embedding coding vector and a power consumption simulation modal feature graph, specifically:

[0012] Performing analog-to-digital conversion on the power consumption analog signal to obtain CPU power consumption data;

[0013] Extracting a number of statistical characteristic values ​​from the CPU power consumption data to obtain CPU power consumption statistical characteristics;

[0014] Capturing the mutual relationship and interaction between the CPU power consumption statistical features through low-dimensional embedded coding to obtain the power consumption statistical feature embedded coding vector;

[0015] The power consumption simulation signal is subjected to waveform feature analysis by a power consumption simulation feature extractor to obtain the power consumption simulation modal feature diagram.

[0016] This preferred solution uses low-dimensional embedded coding technology to capture the relationships and interactions between CPU power consumption statistical features and compress them into a low-dimensional space. This not only reduces the dimension of the data and reduces the computational complexity, but also retains important information in the original data and improves the efficiency of data processing.

[0017] As a preferred solution, the power consumption simulation signal is subjected to waveform feature analysis according to the power consumption simulation feature extractor to obtain the power consumption simulation modal feature diagram, specifically:

[0018] Extracting local features of the power consumption simulation signal through a deep convolution operation of the power consumption simulation feature extractor to obtain a local feature set;

[0019] Based on the point-by-point convolution operation of the power consumption simulation feature extractor, the local feature set is integrated into a global feature representation to obtain the power consumption simulation modal feature map.

[0020] This preferred solution uses multiple convolution layers to stack, and convolution kernels at different levels can extract features at different abstract levels; low-level convolution kernels usually extract low-level features such as edges and textures, while high-level convolution kernels can extract more complex, global features. This multi-level feature extraction makes the final feature representation richer and more comprehensive. The point-by-point convolution operation can integrate and reduce the channel information of different local feature sets to generate a global feature representation. This integration method helps reduce feature redundancy and improve the efficiency of feature expression.

[0021] As a preferred solution, the power consumption statistical feature embedding coding vector and the power consumption simulation modal feature map are linearly transformed and dual-featured screened to obtain a power consumption simulation-digital hybrid modal joint coding feature map, specifically:

[0022] Performing a linear transformation on the power consumption statistical feature embedding coding vector according to two different weight modifier matrices to obtain a representation vector set including a first power consumption statistical feature mapping mode representation vector and a second power consumption statistical feature mapping mode representation vector;

[0023] Based on the gradient amplitude of each position in the representation vector set, performing gradient amplitude-based masking processing on the representation vector set to obtain a masked representation vector set including a masked first power consumption statistical feature mapping mode representation vector and a masked second power consumption statistical feature mapping mode representation vector;

[0024] The power consumption analog modal feature graph is subjected to dual feature screening according to the masked representation vector set to obtain the power consumption analog-digital hybrid modal joint coding feature graph.

[0025] This preferred solution linearly transforms the power consumption statistical feature embedding coding vector through two different weight modifier matrices, and can obtain two feature mapping pattern representation vectors with different angles or focuses. This transformation increases the flexibility of feature expression and can capture more diverse feature information. Masking based on the gradient amplitude of each position in the representation vector set can highlight the features that have a greater impact on the final result, while suppressing or ignoring those with less impact, which helps to improve the accuracy and efficiency of feature extraction and enables the model to focus on important feature information more accurately.

[0026] As a preferred solution, based on the gradient amplitude of each position in the representation vector set, the representation vector set is subjected to gradient amplitude-based masking processing to obtain a masked representation vector set including a masked first power consumption statistical feature mapping mode representation vector and a masked second power consumption statistical feature mapping mode representation vector, specifically:

[0027] Based on the representation vector set, calculating the absolute value of the difference between the target eigenvalue and the eigenvalue of its adjacent position, and obtaining the gradient amplitude of each position in the first power consumption statistical feature mapping mode representation vector and the second power consumption statistical feature mapping mode representation vector;

[0028] Marking the gradient amplitude according to a preset mask threshold to obtain a masked first power consumption statistical feature mapping mode representation vector and a masked second power consumption statistical feature mapping mode representation vector;

[0029] The masked representation vector set is formed by the masked first power consumption statistical feature mapping pattern representation vector and the masked second power consumption statistical feature mapping pattern representation vector.

[0030] This preferred solution can highlight the change of the feature value in space by calculating the absolute value of the difference between the target feature value and the feature value of its adjacent position, which is conducive to capturing the key change points in the power consumption statistical feature mapping pattern. Through the preset mask threshold, it is possible to flexibly control which feature positions are retained or ignored, so that the effect of feature selection can be optimized by adjusting the threshold.

[0031] As a preferred solution, the gradient amplitude is marked according to a preset mask threshold to obtain a masked first power consumption statistical feature mapping mode representation vector and a masked second power consumption statistical feature mapping mode representation vector, specifically:

[0032] If the gradient magnitude is greater than the mask threshold, marking the corresponding position of the gradient magnitude in the masked vector as an activated state;

[0033] If the gradient magnitude is less than or equal to the mask threshold, marking the corresponding position of the gradient magnitude in the masked vector as a suppressed state;

[0034] Each position in the first power consumption statistical feature mapping pattern representation vector and the second power consumption statistical feature mapping pattern representation vector is traversed to obtain the masked first power consumption statistical feature mapping pattern representation vector and the masked second power consumption statistical feature mapping pattern representation vector.

[0035] In this preferred scheme, positions with larger gradient amplitudes usually represent significant changes in eigenvalues ​​in space, and these positions often contain important information; by marking these positions as activated states and marking other positions as inhibited states, those features that have little impact on the results can be effectively filtered out, thereby retaining those feature information that is more critical to the power consumption statistical feature mapping pattern.

[0036] As a preferred solution, the power consumption analog modal feature map is subjected to dual feature screening according to the masked representation vector set to obtain the power consumption analog-digital hybrid modal joint coding feature map, specifically:

[0037] Using the eigenvalues ​​of each position in the masked first power consumption statistical feature mapping mode representation vector of the masked representation vector set as weights, weighting each channel feature matrix of the power consumption simulation modal feature graph to obtain a weighted power consumption simulation modal feature graph;

[0038] Activating the weighted power consumption simulation modal feature graph to obtain a preliminarily screened power consumption simulation modal feature graph;

[0039] Based on the masked second power consumption statistical feature mapping mode representation vector and a preset function, the power consumption analog modal feature graph after preliminary screening is subjected to feature screening again to obtain the power consumption analog-digital hybrid modal joint coding feature graph.

[0040] This preferred solution uses the eigenvalues ​​of each position in the masked first power consumption statistical feature mapping mode representation vector as weights to weight each channel feature matrix of the power consumption simulation modal feature map, so that important feature positions can get greater weights in the weighted feature map, thereby enhancing the influence of these features in subsequent processing, which helps to improve the accuracy and effectiveness of feature representation. This dual screening mechanism can further eliminate those features that have little impact on the results, while retaining and strengthening those features that contribute more to the power consumption analog-digital hybrid modal joint encoding feature map, which helps to improve the accuracy and efficiency of feature screening.

[0041] As a preferred solution, it is determined whether the power Internet of Things terminal device is attacked according to the power consumption analog-digital hybrid mode joint coding feature map to obtain a security monitoring result, which is specifically:

[0042] Modulating the characteristic value in the power consumption analog-digital hybrid mode joint coding characteristic map to calculate and obtain two modulation values;

[0043] Performing phase conversion on the power consumption analog-digital hybrid mode joint coding characteristic diagram according to the two modulation values ​​to obtain an optimized power consumption analog-digital hybrid mode joint coding phase conversion characteristic diagram;

[0044] The power consumption optimized analog-digital hybrid mode joint coding phase conversion characteristic diagram is anomaly identified according to a preset classifier to obtain the safety monitoring result.

[0045] This preferred scheme uses the two calculated modulation values ​​to perform phase conversion on the power consumption analog-digital hybrid mode joint coding feature map, which can realize the rearrangement and combination of the feature map in the phase domain; this phase conversion can reveal the manifestation of the feature map at different phases, thereby more accurately reflecting the power consumption characteristics of the system in different states; and the phase conversion also helps to improve the accuracy and effectiveness of subsequent abnormality identification.

[0046] As a preferred solution, the power consumption simulation signal of the CPU module is obtained from the power Internet of Things terminal device, specifically:

[0047] A sampling resistor is connected in series between the power module of the power Internet of Things terminal device and the CPU module, and a current analog signal of the CPU module is obtained by collecting the voltage drop across the sampling resistor;

[0048] The current analog signal is processed according to the sampling resistor to obtain the power consumption analog signal of the CPU module.

[0049] In this preferred solution, since current is a direct reflection of power consumption, the power consumption of the CPU module can be calculated in real time by real-time monitoring of the voltage drop of the sampling resistor, which helps to promptly discover and deal with potential power consumption anomalies.

[0050] The present application also provides a safety monitoring device for a power Internet of Things terminal device, including a signal module, an extraction module, a screening module and a detection module;

[0051] Wherein, the signal module is used to obtain the power consumption simulation signal of the CPU module from the power Internet of Things terminal device;

[0052] The extraction module is used to extract features from the power consumption simulation signal to obtain a power consumption statistical feature embedding coding vector and a power consumption simulation modal feature graph;

[0053] The screening module is used to perform linear transformation and dual feature screening on the power consumption statistical feature embedding coding vector and the power consumption analog modal feature map to obtain a power consumption analog-digital hybrid modal joint coding feature map;

[0054] The detection module is used to determine whether the power Internet of Things terminal device is attacked based on the power consumption analog-digital hybrid mode joint coding feature map to obtain a security monitoring result.

[0055] As a preferred solution, the extraction module includes a data unit, a feature unit, a vector unit and a feature map unit;

[0056] Wherein, the data unit is used to perform analog-to-digital conversion on the power consumption analog signal to obtain CPU power consumption data;

[0057] The feature unit is used to extract a number of statistical feature values ​​from the CPU power consumption data to obtain CPU power consumption statistical features;

[0058] The vector unit is used to capture the mutual relationship and interaction between the CPU power consumption statistical features through low-dimensional embedded coding to obtain the power consumption statistical feature embedded coding vector;

[0059] The feature graph unit is used to perform waveform feature analysis on the power consumption simulation signal according to the power consumption simulation feature extractor to obtain the power consumption simulation modal feature graph.

[0060] As a preferred solution, the feature graph unit includes a feature subunit and a representation subunit;

[0061] Wherein, the feature subunit is used to extract the local features of the power consumption simulation signal through the deep convolution operation of the power consumption simulation feature extractor to obtain a local feature set;

[0062] The representation subunit is used to integrate the local feature set into a global feature representation based on the point-by-point convolution operation of the power consumption simulation feature extractor to obtain the power consumption simulation modal feature graph.

[0063] As a preferred solution, the screening module includes a transformation unit, a mask unit and a dual screening unit;

[0064] The transformation unit is used to perform a linear transformation on the power consumption statistical feature embedded coding vector according to two different weight modifier matrices to obtain a representation vector set including a first power consumption statistical feature mapping mode representation vector and a second power consumption statistical feature mapping mode representation vector;

[0065] The mask unit is used to perform gradient amplitude-based masking processing on the representation vector set based on the gradient amplitude of each position in the representation vector set to obtain a masked representation vector set including a masked first power consumption statistical feature mapping mode representation vector and a masked second power consumption statistical feature mapping mode representation vector;

[0066] The dual screening unit is used to perform dual feature screening on the power consumption analog modal feature map according to the masked representation vector set to obtain the power consumption analog-digital hybrid modal joint encoding feature map.

[0067] As a preferred solution, the mask unit includes a gradient subunit, a marking subunit and a vector subunit;

[0068] Wherein, the gradient subunit is used to calculate the absolute value of the difference between the target eigenvalue and the eigenvalue of its adjacent position based on the representation vector set, and obtain the gradient amplitude of each position in the first power consumption statistical feature mapping mode representation vector and the second power consumption statistical feature mapping mode representation vector;

[0069] The marking subunit is used to mark the gradient amplitude according to a preset mask threshold value to obtain a masked first power consumption statistical feature mapping mode representation vector and a masked second power consumption statistical feature mapping mode representation vector;

[0070] The vector subunit is used to form the masked representation vector set by using the masked first power consumption statistical feature mapping mode representation vector and the masked second power consumption statistical feature mapping mode representation vector.

[0071] As a preferred embodiment, the marker subunit is specifically:

[0072] If the gradient magnitude is greater than the mask threshold, marking the corresponding position of the gradient magnitude in the masked vector as an activated state;

[0073] If the gradient magnitude is less than or equal to the mask threshold, marking the corresponding position of the gradient magnitude in the masked vector as a suppressed state;

[0074] Each position in the first power consumption statistical feature mapping pattern representation vector and the second power consumption statistical feature mapping pattern representation vector is traversed to obtain the masked first power consumption statistical feature mapping pattern representation vector and the masked second power consumption statistical feature mapping pattern representation vector.

[0075] As a preferred solution, the dual screening unit includes a weighting subunit, an activation subunit and a screening subunit;

[0076] Wherein, the weighted subunit is used to weight each channel feature matrix of the power consumption simulation modal feature diagram by using the feature values ​​of each position in the masked first power consumption statistical feature mapping mode representation vector of the masked representation vector set as weights to obtain a weighted power consumption simulation modal feature diagram;

[0077] The activation subunit is used to activate the weighted power consumption simulation modal feature graph to obtain the power consumption simulation modal feature graph after preliminary screening;

[0078] The screening subunit is used to perform feature screening again on the power consumption simulation modal feature graph after preliminary screening based on the masked second power consumption statistical feature mapping mode representation vector and a preset function to obtain the power consumption analog-digital hybrid modal joint encoding feature graph.

[0079] As a preferred solution, the detection module includes a modulation unit, a phase unit and an identification unit;

[0080] Wherein, the modulation unit is used to modulate the characteristic value in the power consumption analog-digital hybrid mode joint coding characteristic map to calculate and obtain two modulation values;

[0081] The phase unit is used to perform phase conversion on the power consumption analog-digital hybrid mode joint coding characteristic diagram according to the two modulation values ​​to obtain an optimized power consumption analog-digital hybrid mode joint coding phase conversion characteristic diagram;

[0082] The identification unit is used to identify abnormalities of the power consumption optimized analog-digital hybrid mode joint encoding phase conversion feature diagram according to a preset classifier to obtain the safety monitoring result.

[0083] As a preferred solution, the signal module includes a collection unit and a processing unit;

[0084] The acquisition unit is used to connect a sampling resistor in series between the power module and the CPU module of the power Internet of Things terminal device, and obtain a current analog signal of the CPU module by acquiring a voltage drop across the sampling resistor;

[0085] The processing unit is used to perform signal processing on the current analog signal according to the sampling resistor to obtain the power consumption analog signal of the CPU module.

[0086] The present application also provides a storage medium, on which a computer program is stored. The computer program is called and executed by a computer to implement the above-mentioned method for security monitoring of an electric power Internet of Things terminal device. BRIEF DESCRIPTION OF THE DRAWINGS

[0087] Figure 1It is a flowchart of a safety monitoring method for a power Internet of Things terminal device provided in an embodiment of the present application;

[0088] Figure 2 is a block diagram of an electronic device provided in an embodiment of the present application;

[0089] Figure 3 It is an application scenario diagram provided by an embodiment of the present application;

[0090] Figure 4 It is a structural schematic diagram of a safety monitoring device for an electric power Internet of Things terminal device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0091] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0092] In the description of this application, it should be understood that the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, features defined as "first" and "second" may explicitly or implicitly include one or more of the features. In the description of this application, unless otherwise specified, "several" means two or more.

[0093] A security monitoring method for electric power Internet of Things terminal equipment provided in an embodiment of the present application is mainly used in situations where it is necessary to overcome the limitations of the prior art of relying solely on statistical characteristics of power consumption data for security monitoring, and to achieve more accurate, dynamic and comprehensive security monitoring of electric power Internet of Things terminal equipment.

[0094] Embodiment 1:

[0095] See also Figure 1 The embodiment of the present application provides a method for security monitoring of a power Internet of Things terminal device, including S1 to S4, and the specific implementation steps are as follows:

[0096] S1. Obtain the power consumption simulation signal of the CPU module from the power Internet of Things terminal device.

[0097] Step S1 of the embodiment of the present application is specifically as follows:

[0098] A sampling resistor with a known resistance is connected in series between the power module and the CPU module of the power Internet of Things terminal device. The "CPU module" in the power Internet of Things terminal is a key hardware component. As the computing core of the Internet of Things device or terminal, it is responsible for executing program instructions, processing data, coordinating communication tasks, managing storage resources, and controlling other parts of the device.

[0099] Based on Kirchhoff's current law, the data acquisition module continuously monitors and collects the voltage drop across the sampling resistor. The current flowing through the CPU module is calculated using Ohm's law combined with the voltage drop and the sampling resistor to obtain the current analog signal of the CPU module.

[0100] Based on the sampling resistor, the current analog signal is converted into a power consumption analog signal using a preset power consumption calculation formula.

[0101] In this embodiment S1, considering that directly connecting the device to the internal circuit of the CPU for current monitoring may cause a circuit short circuit or other electrical faults, thereby disrupting the normal operation of the terminal device, a sampling resistor with a known resistance value is connected in series. When the current passes through the resistor, a voltage drop is generated at both ends of the resistor, so that a current analog signal is obtained on this basis, which is conducive to maintaining the stability of the device; and the current analog signal is converted into a power consumption analog signal, which is conducive to more intuitively reflecting the working status and energy consumption of the CPU;

[0102] In addition, since current is a direct reflection of power consumption, the power consumption of the CPU module can be calculated in real time by monitoring the voltage drop of the sampling resistor in real time, which helps to promptly discover and deal with potential power consumption anomalies.

[0103] S2. Extract features from the power consumption simulation signal to obtain a power consumption statistical feature embedding coding vector and a power consumption simulation modal feature diagram.

[0104] Step S2 of the embodiment of the present application includes S2.1 to S2.2; wherein S2.1 is a process of performing low-dimensional embedding coding to obtain a power consumption statistical feature embedding coding vector, and S2.2 is a process of performing a convolution operation to generate a power consumption simulation modal feature diagram, specifically:

[0105] S2.1, performing AD conversion on the power consumption analog signal to obtain CPU power consumption data;

[0106] Using statistical analysis technology, several statistical characteristic values ​​are extracted from the CPU power consumption data to obtain the CPU power consumption statistical characteristics; the CPU power consumption statistical characteristics include mean, maximum, minimum, skewness, kurtosis, spectrum mean, spectrum variance, spectrum standard deviation and root mean square amplitude, which fully reflect the average level, fluctuation range, asymmetry of data distribution, kurtosis, frequency component information, overall energy level, power consumption stability, and randomness and irregularity of data;

[0107] The CPU power consumption statistical features are low-dimensionally embedded and encoded through the power consumption statistical feature embedding coding matrix to map multiple statistical feature values ​​into a unified low-dimensional feature space, integrate the information of multiple statistical feature values, and capture the mutual relationship and interaction between each statistical feature value to generate a more representative power consumption statistical feature embedding coding vector;

[0108] The present embodiment S2.1 can extract the power consumption statistical characteristics of the CPU module; by calculating the CPU power consumption statistical characteristics, the energy consumption distribution characteristics of the CPU module are revealed; and by making full use of the implicit information in the extracted multiple statistical feature values ​​and performing low-dimensional embedding encoding on the features, the mutual relationship and interaction between the CPU power consumption statistical characteristics can be captured and compressed into a low-dimensional space, which not only reduces the dimension of the data and reduces the computational complexity, but also retains the important information in the original data and improves the efficiency of data processing, thereby generating a more representative power consumption statistical feature embedding coding vector, providing a more compact and effective data representation for subsequent security monitoring.

[0109] S2.2. Through the depthwise convolution operation of the power simulation feature extractor in the deep separable convolutional neural network model, a convolution kernel is independently applied to each input channel (different time steps or frequency components of the power simulation signal). The purpose is to perform waveform feature analysis on the power simulation signal to extract local features inside each input channel, especially features related to the power waveform structure, such as waveform shape, amplitude change, etc., so as to extract local features of the power simulation signal and obtain a local feature set.

[0110] Based on the pointwise convolution operation of the power simulation feature extractor, all the depthwise convolution output channels are weighted summed at each position to generate the power simulation modal feature map.

[0111] This embodiment S2.2 can capture the timing variation pattern of CPU power consumption; deep convolution is responsible for extracting local features, while point-by-point convolution is responsible for integrating these local features into global feature representations. Through the synergistic effect of deep convolution and point-by-point convolution, it is possible to deeply explore the waveform structure and timing variation characteristics in the power consumption simulation signal, such as the rising edge, falling edge, peak, trough, periodic change, burst pulse and frequency drift of the waveform, thereby generating a power consumption simulation modal feature map; and the resulting feature map not only captures the timing variation characteristics of the power consumption signal, but also reflects the intrinsic structure and pattern of the power consumption waveform. The generation method of this feature map not only reduces the amount of calculation, but also improves the learning efficiency and feature extraction capability of the model.

[0112] S3. Perform linear transformation and dual feature screening on the power consumption statistical feature embedding coding vector and the power consumption analog modal feature map to obtain the power consumption analog-digital hybrid modal joint coding feature map.

[0113] Step S3 of the embodiment of the present application includes S3.1 to S3.3; wherein S3.1 is a process of performing linear transformation to obtain a representation vector set A, S3.2 is a process of performing feature masking to obtain a masked representation vector set B, and S3.3 is a process of performing dual feature screening to generate a power consumption analog-digital hybrid mode joint coding feature map, specifically:

[0114] S3.1. According to the first weight modifier matrix and the second weight modifier matrix, a linear transformation is performed on the power consumption statistical feature embedded coding vector to obtain a representation vector set A including a first power consumption statistical feature mapping mode representation vector and a second power consumption statistical feature mapping mode representation vector.

[0115] In this embodiment S3.1, the power consumption statistical feature embedding coding vector is linearly transformed through two different weight modifier matrices to expand the expression range of the feature, so as to capture the correlation between the power consumption statistical feature and the power consumption simulation modal feature from different angles. This transformation increases the flexibility of feature expression.

[0116] S3.2. For each position of the first power consumption statistical feature mapping mode representation vector in the representation vector set A, calculate the absolute value of the difference between the target eigenvalue and the eigenvalue of the adjacent previous position and the eigenvalue of the next position, and obtain the gradient amplitude of each position in the first power consumption statistical feature mapping mode representation vector;

[0117] If the gradient magnitude is greater than a preset mask threshold, the corresponding position of the gradient magnitude is marked as an activated state in the masked vector; wherein the activated state can be represented as 1;

[0118] If the gradient magnitude is less than or equal to the mask threshold, the corresponding position of the gradient magnitude is marked as a suppressed state in the masked vector; wherein the suppressed state can be represented as 0;

[0119] By traversing all positions of the first power consumption statistical feature mapping pattern representation vector and applying the above mask processing logic, a masked first power consumption statistical feature mapping pattern representation vector having the same length as the original vector is finally generated.

[0120] Similarly, based on the gradient amplitude of each position of the second power consumption statistical feature mapping pattern representation vector in the representation vector set A, the second power consumption statistical feature mapping pattern representation vector is subjected to gradient amplitude-based masking processing to obtain a masked second power consumption statistical feature mapping pattern representation vector.

[0121] A masked representation vector set B is formed by the masked first power consumption statistical feature mapping pattern representation vector and the masked second power consumption statistical feature mapping pattern representation vector.

[0122] In this embodiment S3.2, feature masking is performed based on the gradient amplitude at each position in the two feature vectors after linear transformation, which can highlight the features that have a greater impact on the final result, while suppressing or ignoring those features with a smaller impact, which helps to improve the accuracy and efficiency of feature extraction, so that the model can focus on important feature information more accurately;

[0123] Moreover, positions with larger gradient amplitudes usually represent significant changes in feature values ​​in space, and these positions often contain important information. By marking these positions as activated and marking other positions as inhibited, features that have little impact on the results can be effectively filtered out, thereby retaining feature information that is more critical to the power consumption statistical feature mapping pattern.

[0124] In addition, by calculating the absolute value of the difference between the target feature value and the feature value of its adjacent position, the change of the feature value in space can be highlighted, which is conducive to capturing the key change points in the power consumption statistical feature mapping pattern. Through the preset mask threshold, it is possible to flexibly control which feature positions are retained or ignored, so that the effect of feature selection can be optimized by adjusting the threshold.

[0125] S3.3, using the eigenvalues ​​of each position in the masked first power consumption statistical feature mapping pattern representation vector of the masked representation vector set B as weights, weighting each channel feature matrix of the power consumption simulation modal feature graph to obtain a weighted power consumption simulation modal feature graph;

[0126] Using a hyperbolic tangent function to activate the weighted power consumption simulation modal feature graph, to obtain a preliminary screened power consumption simulation modal feature graph;

[0127] Based on the feature interaction joint encoding formula, the masked second power consumption statistical feature mapping pattern representation vector and Sigmoid function in the masked representation vector set B are used to perform feature screening on the power consumption analog modal feature map after preliminary screening to obtain the power consumption analog-digital hybrid modal joint encoding feature map.

[0128] Among them, the feature interaction joint encoding formula is:

[0129]

[0130]

[0131]

[0132] Among them, V meta represents the power consumption statistical feature embedding encoding vector, represents the first weight modifier matrix, represents the second weight modifier matrix, w 0f and w 0g Represent different bias terms, V 1 represents the first power consumption statistical feature mapping mode representation vector, V 2 Represents the second power consumption statistical feature mapping mode representation vector, V 1 (i+1) and V 1 (i-1) respectively represent the feature values ​​of the i+1th position and the i-1th position in the first power consumption statistical feature mapping mode representation vector, V 2 (i+1) and V 2 (i-1) respectively represent the feature values ​​of the i+1th position and the i-1th position in the second power consumption statistical feature mapping mode representation vector, mask(·) represents mask processing, θ is a preset mask threshold, represents the eigenvalue of the ith position of the masked first power consumption statistical feature mapping pattern representation vector, V 1s represents the masked first power consumption statistical feature mapping pattern representation vector, represents the eigenvalue of the ith position of the masked second power consumption statistical feature mapping pattern representation vector, V 2s represents the masked second power consumption statistical feature mapping pattern representation vector, represents matrix multiplication, F main Represents the power consumption simulation modal characteristic diagram, tanh is the hyperbolic tangent function, T gate It represents the power consumption analog mode feature map after preliminary screening, sigmoid is the sigmoid activation function, and F represents the power consumption analog-digital hybrid mode joint encoding feature map.

[0133] In this embodiment S3.3, weighted operations are performed along the channel dimension to extract the parts that are closely related to the power consumption statistical features, thereby strengthening the important feature interactions between the two. In addition, the hyperbolic tangent function and the Sigmoid function are introduced for feature activation processing, which can improve the nonlinear expression ability of the features; wherein, the output range of the hyperbolic tangent function is between -1 and +1, which is used to preliminarily screen out features that are highly related to the power consumption statistical features; and the output range of the Sigmoid function is between 0 and 1, which is suitable for probability estimation and binary decision-making, and is used for the final feature screening, thereby obtaining the power consumption analog-digital hybrid mode joint coding feature map;

[0134] In addition, by using the eigenvalues ​​of each position in the masked first power consumption statistical feature map mode representation vector as weights, weighting each channel feature matrix of the power consumption analog modal feature map can make important feature positions get greater weights in the weighted feature map, thereby enhancing the influence of these features in subsequent processing, which helps to improve the accuracy and effectiveness of feature representation. This dual screening mechanism can further eliminate those features that have little impact on the results, while retaining and strengthening those features that contribute more to the power consumption analog-digital hybrid modal joint encoding feature map, which helps to improve the accuracy and efficiency of feature screening.

[0135] It can be seen that this embodiment S3 proposes a feature interaction screening encoding method based on the attention mechanism. Specifically, firstly, the power consumption statistical feature embedding encoding vector is linearly transformed through two different weight modifier matrices to expand the expression range of the feature, so as to capture the correlation between the power consumption statistical feature and the power consumption simulation modal feature from different angles;

[0136] Next, feature masking is performed based on the gradient amplitude of each position in the two feature vectors after linear transformation to highlight important power consumption statistical features, thereby enhancing the focus on important features in the subsequent feature screening process;

[0137] Then, the two masked feature vectors are used to perform two feature screenings on the power consumption simulation modal feature graph. Through weighted operations along the channel dimension, the parts closely related to the power consumption statistical features are extracted, thereby strengthening the important feature interaction between the two.

[0138] In addition, in order to improve the nonlinear expression ability of features, the hyperbolic tangent function and the Sigmoid function were introduced for feature activation processing in the two feature screenings.

[0139] S4. Determine whether the power Internet of Things terminal device is attacked based on the power consumption analog-digital hybrid mode joint coding feature diagram to obtain the security monitoring result.

[0140] Step S4 of the embodiment of the present application includes S4.1 to S4.2; wherein S4.1 is a process of performing phase conversion to generate an optimized power consumption analog-digital hybrid mode joint coding feature diagram F, and S4.2 is a process of performing abnormal identification on the optimized power consumption analog-digital hybrid mode joint coding phase conversion feature diagram F to obtain a safety monitoring result, specifically:

[0141] S4.1. Calculate the sum of the absolute values ​​of each characteristic value in the power consumption analog-digital hybrid mode joint coding characteristic diagram to obtain the first power consumption analog-digital hybrid mode joint coding and modulation value; calculate the square root of the sum of the squares of each characteristic value of the power consumption analog-digital hybrid mode joint coding characteristic diagram to obtain the second power consumption analog-digital hybrid mode joint coding and modulation value;

[0142] After point-wise subtraction of the power consumption analog-digital hybrid mode joint coding characteristic diagram and the second power consumption analog-digital hybrid mode joint coding and modulation value, point-wise multiplication is performed with the number of eigenvalues ​​of the power consumption analog-digital hybrid mode joint coding characteristic diagram and the reciprocal of the first power consumption analog-digital hybrid mode joint coding and modulation value, and the reciprocal of each eigenvalue is taken to obtain the first power consumption analog-digital hybrid mode joint coding phase conversion characteristic diagram;

[0143] After point-wise subtraction of the power consumption analog-digital hybrid mode joint coding characteristic diagram from the first power consumption analog-digital hybrid mode joint coding and modulation value, point-wise multiplication is performed with the square root of the number of eigenvalues ​​of the power consumption analog-digital hybrid mode joint coding characteristic diagram and the reciprocal of the second power consumption analog-digital hybrid mode joint coding and modulation value, and the reciprocal of each eigenvalue is taken to obtain the second power consumption analog-digital hybrid mode joint coding phase conversion characteristic diagram;

[0144] Calculate the dot product feature map of the second power consumption analog-digital hybrid mode joint coding phase conversion feature map and the weighted hyperparameter, and subtract the dot product feature map of the first power consumption analog-digital hybrid mode joint coding phase conversion feature map to obtain the optimized power consumption analog-digital hybrid mode joint coding feature map F.

[0145] Among them, the power consumption optimized analog-digital hybrid mode joint coding feature diagram is:

[0146]

[0147]

[0148] f i ∈F∈R W×H×C ;

[0149] n=W×H×C

[0150] Among them, f iare the eigenvalues ​​of the power consumption analog-digital hybrid mode joint coding feature map, α is the first power consumption analog-digital hybrid mode joint coding and modulation value, β is the second power consumption analog-digital hybrid mode joint coding and modulation value, F is the power consumption analog-digital hybrid mode joint coding feature map, W is the length of the power consumption analog-digital hybrid mode joint coding feature map, C is the number of channels of the power consumption analog-digital hybrid mode joint coding feature map, H is the height of the power consumption analog-digital hybrid mode joint coding feature map, n represents the number of eigenvalues ​​of the power consumption analog-digital hybrid mode joint coding feature map, R represents a real number set, α -1 is the inverse of the first power consumption analog-digital hybrid mode joint coding and modulation value, [·] ⊙-1 is the inverse of each eigenvalue, F is the first power consumption analog-digital hybrid mode joint coding phase conversion characteristic diagram, F 2 is the second power consumption analog-digital hybrid mode joint coding phase conversion characteristic diagram, β -1 is the inverse of the second power analog-digital hybrid mode joint coding and modulation value, ω is a weighted hyperparameter, F′ is the optimized power analog-digital hybrid mode joint coding feature map, ⊙ is the position point multiplication, It is subtracted by position point.

[0151] In this embodiment S4.1, the difference of the difference and modulation representation of the feature value in the power consumption analog-digital hybrid mode joint coding feature map relative to the overall feature set in the power consumption analog-digital hybrid mode joint coding feature map is used as the semantic change intensity information, and a phase-like conversion corresponding to the position-based intensity modulation is performed through different and modulation representation forms, so that the aggregation enhancement of the semantic change phase perception can improve the axial aggregation feeling along the feature aggregation direction by performing a spatial translation operation based on alternating stacking under the set scale equalization of the power consumption analog-digital hybrid mode joint coding feature map, thereby improving the perception effect of the aggregated semantics of the power consumption analog-digital hybrid mode joint coding feature map on the detailed semantic changes, so as to improve the expression effect of the power consumption analog-digital hybrid mode joint coding feature map, and improve the accuracy of the recognition result obtained by inputting it into the classifier-based anomaly identifier;

[0152] Moreover, by using the two calculated modulation values ​​to perform phase conversion on the power consumption analog-digital hybrid mode joint coding feature map, the feature map can be rearranged and combined in the phase domain; this phase conversion can reveal the manifestation of the feature map at different phases, thereby more accurately reflecting the power consumption characteristics of the system in different states; in addition, the phase conversion also helps to improve the accuracy and effectiveness of subsequent anomaly identification.

[0153] S4.2. According to the anomaly identifier of the classifier, anomaly identification is performed on the optimized power consumption analog-digital hybrid mode joint coding phase conversion feature map F to obtain a security monitoring result; wherein, the security monitoring result is used to indicate whether the power Internet of Things terminal device is attacked.

[0154] To apply the embodiments of this application, please refer to Figure 2 , Figure 2 is a block diagram of an electronic device provided in an embodiment of the present application, and is a schematic diagram of the structure of an electronic device 600 suitable for implementing the first embodiment of the present application;

[0155] The terminal devices in the embodiments of the present application may include but are not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., as well as fixed terminals such as digital TVs, desktop computers, etc. Figure 2 The electronic device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0156] like Figure 2 As shown, the electronic device 600 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage device 608 into a random access memory (RAM) 603. Various programs and data required for the operation of the electronic device 600 are also stored in the RAM 603. The processing device 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604;

[0157] Typically, the following devices may be connected to the I / O interface 605: an input device 606 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 607 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 608 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 609. The communication device 609 may allow the electronic device 600 to communicate with other devices wirelessly or by wire to exchange data. Although Figure 2 The electronic device 600 is shown with various devices, but it should be understood that it is not required to implement or have all the devices shown. More or fewer devices may be implemented or have alternatively;

[0158] In particular, according to an embodiment of the present application, Figure 1The described process can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication device 609, or installed from the storage device 608, or installed from the ROM 602. When the computer program is executed by the processing device 601, the above-mentioned functions defined in the method of the embodiment of the present application are executed.

[0159] It should be noted that the computer-readable medium mentioned above in the present application may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0160] In some embodiments, the client and the server may communicate using any currently known or future developed network protocol such as HTTP (HyperText Transfer Protocol), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0161] The computer-readable medium may be included in the electronic device, or may exist independently without being installed in the electronic device.

[0162] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including, but not limited to, object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0163] Figure 1-2 Flowcharts and block diagrams in the present invention show the possible architecture, functions and operations of the system, method and computer program product according to various embodiments of the present application. In this regard, each box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the box can also occur in a sequence different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flow chart, and the combination of the boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0164] The modules involved in the embodiments described in this application can be implemented by software or hardware. The name of the module does not limit the module itself in some cases. For example, the test parameter acquisition module can also be described as a "module for acquiring device test parameters corresponding to the target device".

[0165] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0166] In the context of the present application, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0167] To apply the embodiments of this application, please refer to Figure 3 , Figure 3 is an application scenario diagram provided by an embodiment of the present application, which shows an application scenario of a security monitoring method for a power Internet of Things terminal device in the present embodiment;

[0168] like Figure 3 As shown, in this application scenario, first, in the power module of the power Internet of Things terminal device (for example, Figure 3 M1) and CPU modules (e.g. Figure 3 A sampling resistor is connected in series between M2) and a data acquisition module (for example, Figure 3 M3) collects the voltage drop across the sampling resistor to obtain the current analog signal of the CPU module (for example, Figure 3 Then, the acquired current simulation signal is input to a server (for example, Figure 3In S) shown in , the server can process the current simulation signal based on the security monitoring algorithm of the power Internet of Things terminal device to determine whether the power Internet of Things terminal device is attacked.

[0169] The above description is only a preferred embodiment of the present application and an explanation of the technical principles used. Those skilled in the art should understand that the scope of disclosure involved in the present application is not limited to the technical solution formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above disclosed concept. For example, the above features are replaced with the technical features with similar functions disclosed in this application (but not limited to) by each other to form a technical solution.

[0170] In addition, although each operation is described in a specific order, this should not be construed as requiring these operations to be performed in the specific order shown or to be performed in a sequential order. Under certain circumstances, multitasking and parallel processing may be advantageous. Similarly, although some specific implementation details are included in the above discussion, these should not be construed as limiting the scope of the application. Some features described in the context of a separate embodiment can also be implemented in a single embodiment in combination. On the contrary, the various features described in the context of a single embodiment can also be implemented in multiple embodiments individually or in any suitable sub-combination mode.

[0171] Although the subject matter has been described in language specific to structural features and / or method logic actions, it should be understood that the subject matter defined is not necessarily limited to the specific features or actions described above. On the contrary, the specific features and actions described above are merely exemplary forms of implementation. With respect to the apparatus in the above-mentioned embodiments, the specific manner in which each module performs the operation has been described in detail in the embodiments related to the method, and will not be described in detail here.

[0172] Overall, this embodiment has the following beneficial effects:

[0173] This application performs feature extraction on the power consumption analog signal, extracts the power consumption statistical feature embedding coding vector and the power consumption simulation modal feature map. These features can reflect the power consumption characteristics of the device in different states, including normal state and potential security threat state; and the power consumption simulation signal itself is a dynamically changing signal. Through real-time monitoring and feature extraction of this signal, the dynamic change characteristics of power consumption can be captured. Since attack behaviors often lead to abnormal changes in power consumption patterns, this characteristic is crucial for identifying whether the device is under attack. Linear transformation and dual feature screening of the extracted power consumption statistical feature embedding coding vector and power consumption simulation modal feature map can further extract more representative feature information, help remove redundant information, retain the most valuable features for security monitoring, and thus improve the accuracy of monitoring. By jointly encoding the power consumption statistical features and the analog modal features to form a power consumption analog-digital hybrid modal joint coding feature map, the operating status of the device can be more comprehensively reflected. This hybrid modal representation method can integrate the advantages of multiple information sources and improve the ability to identify complex attack behaviors;

[0174] Therefore, the present application can effectively overcome the limitations of the prior art that security monitoring only relies on statistical characteristics of power consumption data, and achieve more accurate, dynamic and comprehensive security monitoring of power Internet of Things terminal equipment.

[0175] Embodiment 2:

[0176] See also Figure 4 , an embodiment of the present application provides a safety monitoring device for a power Internet of Things terminal device, including a signal module 10, an extraction module 20, a screening module 30 and a detection module 40;

[0177] Among them, the signal module 10 is used to obtain the power consumption simulation signal of the CPU module from the power Internet of Things terminal device;

[0178] The extraction module 20 is used to extract features from the power consumption simulation signal to obtain a power consumption statistical feature embedding coding vector and a power consumption simulation modal feature diagram;

[0179] The screening module 30 is used to perform linear transformation and dual feature screening on the power consumption statistical feature embedding coding vector and the power consumption analog mode feature map to obtain the power consumption analog-digital hybrid mode joint coding feature map;

[0180] The detection module 40 is used to determine whether the power Internet of Things terminal device is attacked based on the power consumption analog-digital hybrid mode joint coding feature diagram to obtain a security monitoring result.

[0181] In one embodiment, the signal module 10 includes a collection unit and a processing unit;

[0182] The acquisition unit is used to connect a sampling resistor of known resistance in series between the power module and the CPU module of the power Internet of Things terminal device; the "CPU module" in the power Internet of Things terminal is a key hardware component. As the computing core of the Internet of Things device or terminal, it is responsible for executing program instructions, processing data, coordinating communication tasks, managing storage resources, and controlling other parts of the device;

[0183] The acquisition unit is also used to continuously monitor and collect the voltage drop across the sampling resistor through the data acquisition module based on Kirchhoff's current law, and calculate the current flowing through the CPU module using Ohm's law combined with the voltage drop and the sampling resistor to obtain the current analog signal of the CPU module.

[0184] The processing unit is used to convert the current analog signal into a power consumption analog signal based on the sampling resistor and using a preset power consumption calculation formula.

[0185] The signal module 10 of this embodiment takes into account that directly connecting the device to the internal circuit of the CPU for current monitoring may cause a circuit short circuit or other electrical faults, thereby disrupting the normal operation of the terminal device. Therefore, by connecting a sampling resistor with a known resistance in series, when current passes through the resistor, a voltage drop will be generated at both ends of the resistor, so as to obtain a current analog signal on this basis, which is conducive to maintaining the stability of the device; and, converting the current analog signal into a power consumption analog signal is conducive to more intuitively reflecting the working status and energy consumption of the CPU;

[0186] In addition, since current is a direct reflection of power consumption, the power consumption of the CPU module can be calculated in real time by monitoring the voltage drop of the sampling resistor in real time, which helps to promptly discover and deal with potential power consumption anomalies.

[0187] In one embodiment, the extraction module 20 includes a data unit, a feature unit, a vector unit, a feature sub-unit and a representation sub-unit; wherein the data unit, the feature unit and the vector unit are processes for performing low-dimensional embedding coding to obtain power consumption statistical feature embedding coding vectors, and the feature sub-unit and the representation sub-unit are processes for performing convolution operations to generate power consumption simulation modal feature graphs, specifically:

[0188] A data unit, used for performing AD conversion on the power consumption analog signal to obtain CPU power consumption data;

[0189] The feature unit is used to extract several statistical feature values ​​from the CPU power consumption data by using statistical analysis technology to obtain CPU power consumption statistical features; wherein the CPU power consumption statistical features include mean, maximum, minimum, skewness, kurtosis, spectrum mean, spectrum variance, spectrum standard deviation and root mean square amplitude, which fully reflect the average level, fluctuation range, asymmetry of data distribution, kurtosis, frequency component information, overall energy level, power consumption stability and randomness and irregularity of data of power consumption data;

[0190] A vector unit is used to perform low-dimensional embedding coding on the CPU power consumption statistical features through the power consumption statistical feature embedding coding matrix, so as to map multiple statistical feature values ​​into a unified low-dimensional feature space, integrate the information of multiple statistical feature values, and capture the mutual relationship and interaction between each statistical feature value, so as to generate a more representative power consumption statistical feature embedding coding vector;

[0191] The data unit, feature unit and vector unit of this embodiment can extract the power consumption statistical characteristics of the CPU module; by calculating the CPU power consumption statistical characteristics, the energy consumption distribution characteristics of the CPU module are revealed; and by making full use of the implicit information in the extracted multiple statistical feature values, the features are low-dimensionally embedded and encoded, which can capture the mutual relationship and interaction between the CPU power consumption statistical characteristics and compress them into a low-dimensional space, which not only reduces the dimension of the data and reduces the calculation complexity, but also retains the important information in the original data and improves the efficiency of data processing, thereby generating a more representative power consumption statistical feature embedding coding vector, providing a more compact and effective data representation for subsequent security monitoring.

[0192] A feature subunit is used to independently apply a convolution kernel to each input channel (different time steps or frequency components of the power simulation signal) through the depthwise convolution operation of the power simulation feature extractor in the deep separable convolutional neural network model, with the purpose of performing waveform feature analysis on the power simulation signal to extract local features inside each input channel, especially features related to the power waveform structure, such as waveform shape, amplitude change, etc., so as to extract local features of the power simulation signal and obtain a local feature set;

[0193] The representation subunit is used for performing a pointwise convolution operation based on the power simulation feature extractor to perform weighted summation of all depthwise convolution output channels at each position to generate a power simulation modal feature map.

[0194] The feature subunit and representation subunit of this embodiment can capture the time-series variation pattern of CPU power consumption; deep convolution is responsible for extracting local features, while point-by-point convolution is responsible for integrating these local features into global feature representations. Through the synergistic effect of deep convolution and point-by-point convolution, the waveform structure and time-series variation characteristics in the power consumption simulation signal can be deeply excavated, such as the rising edge, falling edge, peak, trough, periodic change, burst pulse and frequency drift of the waveform, so as to generate a power consumption simulation modal feature map; and the obtained feature map not only captures the time-series variation characteristics of the power consumption signal, but also reflects the intrinsic structure and pattern of the power consumption waveform. The generation method of this feature map not only reduces the amount of calculation, but also improves the learning efficiency and feature extraction ability of the model.

[0195] In one embodiment, the screening module 30 includes a transformation unit, a gradient subunit, a marking subunit, a vector subunit, a weighting subunit, an activation subunit, and a screening subunit; wherein the transformation unit is a process of performing a linear transformation to obtain a representation vector set A, the gradient subunit, the marking subunit, and the vector subunit are processes of performing feature masking to obtain a masked representation vector set B, and the weighting subunit, the activation subunit, and the screening subunit are processes of performing dual feature screening to generate a power consumption analog-digital hybrid mode joint coding feature map, specifically:

[0196] The transformation unit is used to perform linear transformation on the power consumption statistical feature embedded coding vector according to the first weight modifier matrix and the second weight modifier matrix to obtain a representation vector set A including the first power consumption statistical feature mapping mode representation vector and the second power consumption statistical feature mapping mode representation vector.

[0197] The transformation unit of this embodiment performs a linear transformation on the power consumption statistical feature embedded coding vector through two different weight modifier matrices to expand the expression range of the feature, thereby being able to capture the correlation between the power consumption statistical feature and the power consumption simulation modal feature from different angles. This transformation increases the flexibility of feature expression.

[0198] A gradient subunit is used to calculate the absolute value of the difference between the target eigenvalue and the eigenvalue of the adjacent previous position and the eigenvalue of the next position for each position of the first power consumption statistical feature mapping mode representation vector in the representation vector set A, and obtain the gradient amplitude of each position in the first power consumption statistical feature mapping mode representation vector;

[0199] A marking subunit, used for marking the corresponding position of the gradient amplitude as an activated state in the masked vector if the gradient amplitude is greater than a preset mask threshold; wherein the activated state can be represented by 1;

[0200] The marking subunit is further used for marking the corresponding position of the gradient amplitude as a suppressed state in the masked vector if the gradient amplitude is less than or equal to the mask threshold; wherein the suppressed state can be represented as 0;

[0201] The marking subunit is further used to traverse all positions of the first power consumption statistical feature mapping pattern representation vector and apply the above-mentioned mask processing logic to finally generate a masked first power consumption statistical feature mapping pattern representation vector with the same length as the original vector.

[0202] The marking subunit is also used for performing gradient amplitude-based masking processing on the second power consumption statistical feature mapping pattern representation vector based on the gradient amplitude of each position of the second power consumption statistical feature mapping pattern representation vector in the representation vector set A to obtain a masked second power consumption statistical feature mapping pattern representation vector.

[0203] The vector subunit is used to form a masked representation vector set B by using the masked first power consumption statistical feature mapping mode representation vector and the masked second power consumption statistical feature mapping mode representation vector.

[0204] In this embodiment, the gradient subunit, the marking subunit and the vector subunit perform feature masking based on the gradient amplitude at each position in the two feature vectors after the linear transformation, which can highlight the features that have a greater impact on the final result, while suppressing or ignoring those features with a smaller impact, which helps to improve the accuracy and efficiency of feature extraction, so that the model can focus on important feature information more accurately;

[0205] Moreover, positions with larger gradient amplitudes usually represent significant changes in feature values ​​in space, and these positions often contain important information. By marking these positions as activated and marking other positions as inhibited, features that have little impact on the results can be effectively filtered out, thereby retaining feature information that is more critical to the power consumption statistical feature mapping pattern.

[0206] In addition, by calculating the absolute value of the difference between the target feature value and the feature value of its adjacent position, the change of the feature value in space can be highlighted, which is conducive to capturing the key change points in the power consumption statistical feature mapping pattern. Through the preset mask threshold, it is possible to flexibly control which feature positions are retained or ignored, so that the effect of feature selection can be optimized by adjusting the threshold.

[0207] A weighting subunit, configured to weight each channel feature matrix of the power consumption simulation modal feature diagram by using the feature values ​​of each position in the masked first power consumption statistical feature mapping mode representation vector of the masked representation vector set B as weights to obtain a weighted power consumption simulation modal feature diagram;

[0208] An activation subunit is used to activate the weighted power consumption simulation modal feature graph using a hyperbolic tangent function to obtain a preliminarily screened power consumption simulation modal feature graph;

[0209] The screening subunit is used to perform feature screening again on the power consumption analog modal feature graph after preliminary screening based on the feature interaction joint coding formula, using the masked second power consumption statistical feature mapping pattern representation vector and the Sigmoid function in the masked representation vector set B, to obtain the power consumption analog-digital hybrid modal joint coding feature graph.

[0210] Among them, the feature interaction joint encoding formula is:

[0211]

[0212]

[0213]

[0214]

[0215] Among them, V meta represents the power consumption statistical feature embedding encoding vector, represents the first weight modifier matrix, represents the second weight modifier matrix, w 0f and w 0g Represent different bias terms, V 1 represents the first power consumption statistical feature mapping mode representation vector, V 2 Represents the second power consumption statistical feature mapping mode representation vector, V 1 (i+1) and V 1 (i-1) respectively represent the feature values ​​of the i+1th position and the i-1th position in the first power consumption statistical feature mapping mode representation vector, V 2 (i+1) and V 2 (i-1) respectively represent the feature values ​​of the i+1th position and the i-1th position in the second power consumption statistical feature mapping mode representation vector, mask(·) represents mask processing, θ is a preset mask threshold, represents the eigenvalue of the ith position of the masked first power consumption statistical feature mapping pattern representation vector, V 1s represents the masked first power consumption statistical feature mapping pattern representation vector, represents the eigenvalue of the ith position of the masked second power consumption statistical feature mapping pattern representation vector, V 2s represents the masked second power consumption statistical feature mapping pattern representation vector, represents matrix multiplication, F main Represents the power consumption simulation modal characteristic diagram, tanh is the hyperbolic tangent function, Tgate It represents the power consumption analog mode feature map after preliminary screening, sigmoid is the sigmoid activation function, and F represents the power consumption analog-digital hybrid mode joint encoding feature map.

[0216] In this embodiment, the weighted subunit, activation subunit and screening subunit extract the parts closely related to the power consumption statistical characteristics through weighted operations along the channel dimension, thereby strengthening the important feature interaction between the two. In addition, the hyperbolic tangent function and the Sigmoid function are introduced for feature activation processing, which can improve the nonlinear expression ability of the features; wherein, the output range of the hyperbolic tangent function is between -1 and +1, which is used to preliminarily screen out features that are highly related to the power consumption statistical characteristics; and the output range of the Sigmoid function is between 0 and 1, which is suitable for probability estimation and binary decision-making, and is used for the final feature screening, thereby obtaining the power consumption analog-digital hybrid mode joint coding feature map;

[0217] In addition, by using the eigenvalues ​​of each position in the masked first power consumption statistical feature map mode representation vector as weights, weighting each channel feature matrix of the power consumption analog modal feature map can make important feature positions get greater weights in the weighted feature map, thereby enhancing the influence of these features in subsequent processing, which helps to improve the accuracy and effectiveness of feature representation. This dual screening mechanism can further eliminate those features that have little impact on the results, while retaining and strengthening those features that contribute more to the power consumption analog-digital hybrid modal joint encoding feature map, which helps to improve the accuracy and efficiency of feature screening.

[0218] It can be seen that the screening module 30 of this embodiment proposes a feature interaction screening encoding method based on the attention mechanism. Specifically, firstly, the power consumption statistical feature embedding encoding vector is linearly transformed through two different weight modifier matrices to expand the expression range of the feature, so as to capture the correlation between the power consumption statistical feature and the power consumption simulation modal feature from different angles;

[0219] Next, feature masking is performed based on the gradient amplitude of each position in the two feature vectors after linear transformation to highlight important power consumption statistical features, thereby enhancing the focus on important features in the subsequent feature screening process;

[0220] Then, the two masked feature vectors are used to perform two feature screenings on the power consumption simulation modal feature graph. Through weighted operations along the channel dimension, the parts closely related to the power consumption statistical features are extracted, thereby strengthening the important feature interaction between the two.

[0221] In addition, in order to improve the nonlinear expression ability of features, the hyperbolic tangent function and the Sigmoid function were introduced for feature activation processing in the two feature screenings.

[0222] In one embodiment, the detection module 40 includes a modulation unit, a phase unit and an identification unit; wherein the modulation unit and the phase unit are processes of performing phase conversion to generate an optimized power consumption analog-digital hybrid mode joint coding feature map F, and the identification unit is a process of performing abnormal identification on the optimized power consumption analog-digital hybrid mode joint coding phase conversion feature map F to obtain a safety monitoring result, specifically:

[0223] A modulation unit, used to calculate the sum of the absolute values ​​of each characteristic value in the power consumption analog-digital hybrid mode joint coding characteristic diagram to obtain a first power consumption analog-digital hybrid mode joint coding and modulation value; calculate the square root of the sum of the squares of each characteristic value of the power consumption analog-digital hybrid mode joint coding characteristic diagram to obtain a second power consumption analog-digital hybrid mode joint coding and modulation value;

[0224] A phase unit, used to perform point-wise subtraction of the power consumption analog-digital hybrid mode joint coding characteristic diagram from the second power consumption analog-digital hybrid mode joint coding and modulation value, respectively perform point-wise multiplication with the number of eigenvalues ​​of the power consumption analog-digital hybrid mode joint coding characteristic diagram and the reciprocal of the first power consumption analog-digital hybrid mode joint coding and modulation value, and take the reciprocal of each eigenvalue to obtain the first power consumption analog-digital hybrid mode joint coding phase conversion characteristic diagram;

[0225] The phase unit is further used to perform point-wise subtraction of the power consumption analog-digital hybrid mode joint coding characteristic diagram from the first power consumption analog-digital hybrid mode joint coding and modulation value, respectively perform point-wise multiplication with the square root of the number of eigenvalues ​​of the power consumption analog-digital hybrid mode joint coding characteristic diagram and the reciprocal of the second power consumption analog-digital hybrid mode joint coding and modulation value, and take the reciprocal of each eigenvalue to obtain the second power consumption analog-digital hybrid mode joint coding phase conversion characteristic diagram;

[0226] The phase unit is also used to calculate the dot product feature map of the second power consumption analog-digital hybrid mode joint coding phase conversion feature map and the weighted hyperparameter, and to subtract the dot product feature map of the first power consumption analog-digital hybrid mode joint coding phase conversion feature map to obtain the optimized power consumption analog-digital hybrid mode joint coding feature map F.

[0227] Among them, the power consumption optimized analog-digital hybrid mode joint coding feature diagram is:

[0228]

[0229]

[0230] f i ∈F∈R W×H×C ;

[0231] n=W×H×C

[0232] Among them, f i are the eigenvalues ​​of the power consumption analog-digital hybrid mode joint coding feature map, α is the first power consumption analog-digital hybrid mode joint coding and modulation value, β is the second power consumption analog-digital hybrid mode joint coding and modulation value, F is the power consumption analog-digital hybrid mode joint coding feature map, W is the length of the power consumption analog-digital hybrid mode joint coding feature map, C is the number of channels of the power consumption analog-digital hybrid mode joint coding feature map, H is the height of the power consumption analog-digital hybrid mode joint coding feature map, n represents the number of eigenvalues ​​of the power consumption analog-digital hybrid mode joint coding feature map, R represents a real number set, α -1 is the inverse of the first power consumption analog-digital hybrid mode joint coding and modulation value, [·] ⊙-1 is the inverse of each eigenvalue, F is the first power consumption analog-digital hybrid mode joint coding phase conversion characteristic diagram, F 2 is the second power consumption analog-digital hybrid mode joint coding phase conversion characteristic diagram, β -1 is the inverse of the second power analog-digital hybrid mode joint coding and modulation value, ω is a weighted hyperparameter, F′ is the optimized power analog-digital hybrid mode joint coding feature map, ⊙ is the position point multiplication, It is subtracted by position point.

[0233] The modulation unit and the phase unit of this embodiment use the difference of the difference and modulation representation of the feature value in the power consumption analog-digital hybrid mode joint coding feature map relative to the overall feature set in the power consumption analog-digital hybrid mode joint coding feature map as the semantic change intensity information, and perform a phase-like conversion corresponding to the position-based intensity modulation through different and modulation representation forms, so as to perform a spatial translation operation based on alternating stacking under the set scale equalization of the power consumption analog-digital hybrid mode joint coding feature map, so that the aggregation enhancement of the semantic change phase perception can improve the axial aggregation feeling along the feature aggregation direction, thereby improving the perception effect of the aggregated semantics of the power consumption analog-digital hybrid mode joint coding feature map for the detailed semantic changes, so as to improve the expression effect of the power consumption analog-digital hybrid mode joint coding feature map, and improve the accuracy of the recognition result obtained by inputting it into the classifier-based abnormality identifier;

[0234] Moreover, by using the two calculated modulation values ​​to perform phase conversion on the power consumption analog-digital hybrid mode joint coding feature map, the feature map can be rearranged and combined in the phase domain; this phase conversion can reveal the manifestation of the feature map at different phases, thereby more accurately reflecting the power consumption characteristics of the system in different states; in addition, the phase conversion also helps to improve the accuracy and effectiveness of subsequent anomaly identification.

[0235] The identification unit is used to perform anomaly identification on the optimized power consumption analog-digital hybrid mode joint coding phase conversion feature map F according to the anomaly identifier of the classifier to obtain a security monitoring result; wherein the security monitoring result is used to indicate whether the power Internet of Things terminal device is attacked.

[0236] To apply the embodiments of this application, please refer to Figure 2 , Figure 2 is a block diagram of an electronic device provided in an embodiment of the present application, and is a schematic diagram of the structure of an electronic device 600 suitable for implementing the second embodiment of the present application;

[0237] The terminal devices in the embodiments of the present application may include but are not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., as well as fixed terminals such as digital TVs, desktop computers, etc. Figure 2 The electronic device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0238] like Figure 2 As shown, the electronic device 600 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage device 608 into a random access memory (RAM) 603. Various programs and data required for the operation of the electronic device 600 are also stored in the RAM 603. The processing device 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604;

[0239] Typically, the following devices may be connected to the I / O interface 605: an input device 606 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 607 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 608 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 609. The communication device 609 may allow the electronic device 600 to communicate with other devices wirelessly or by wire to exchange data. Although Figure 2 The electronic device 600 is shown with various devices, but it should be understood that it is not required to implement or have all the devices shown. More or fewer devices may be implemented or have alternatively;

[0240] In particular, according to an embodiment of the present application, Figure 1The described process can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication device 609, or installed from the storage device 608, or installed from the ROM 602. When the computer program is executed by the processing device 601, the above-mentioned functions defined in the method of the embodiment of the present application are executed.

[0241] It should be noted that the computer-readable medium mentioned above in the present application may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0242] In some embodiments, the client and the server may communicate using any currently known or future developed network protocol such as HTTP (HyperText Transfer Protocol), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0243] The computer-readable medium may be included in the electronic device, or may exist independently without being installed in the electronic device.

[0244] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including, but not limited to, object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0245] Figure 1-2 Flowcharts and block diagrams in the present invention show the possible architecture, functions and operations of the system, method and computer program product according to various embodiments of the present application. In this regard, each box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the box can also occur in a sequence different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flow chart, and the combination of the boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0246] The modules involved in the embodiments described in this application can be implemented by software or hardware. The name of the module does not limit the module itself in some cases. For example, the test parameter acquisition module can also be described as a "module for acquiring device test parameters corresponding to the target device".

[0247] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0248] In the context of the present application, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0249] To apply the embodiments of this application, please refer to Figure 3 , Figure 3 is an application scenario diagram provided by an embodiment of the present application, which shows an application scenario of a security monitoring method for a power Internet of Things terminal device in the present embodiment;

[0250] like Figure 3 As shown, in this application scenario, first, in the power module of the power Internet of Things terminal device (for example, Figure 3 M1) and CPU modules (e.g. Figure 3 A sampling resistor is connected in series between M2) and a data acquisition module (for example, Figure 3 M3) collects the voltage drop across the sampling resistor to obtain the current analog signal of the CPU module (for example, Figure 3 Then, the acquired current simulation signal is input to a server (for example, Figure 3In S) shown in , the server can process the current simulation signal based on the security monitoring algorithm of the power Internet of Things terminal device to determine whether the power Internet of Things terminal device is attacked.

[0251] The above description is only a preferred embodiment of the present application and an explanation of the technical principles used. Those skilled in the art should understand that the scope of disclosure involved in the present application is not limited to the technical solution formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above disclosed concept. For example, the above features are replaced with the technical features with similar functions disclosed in this application (but not limited to) by each other to form a technical solution.

[0252] In addition, although each operation is described in a specific order, this should not be construed as requiring these operations to be performed in the specific order shown or to be performed in a sequential order. Under certain circumstances, multitasking and parallel processing may be advantageous. Similarly, although some specific implementation details are included in the above discussion, these should not be construed as limiting the scope of the application. Some features described in the context of a separate embodiment can also be implemented in a single embodiment in combination. On the contrary, the various features described in the context of a single embodiment can also be implemented in multiple embodiments individually or in any suitable sub-combination mode.

[0253] Although the subject matter has been described in language specific to structural features and / or method logic actions, it should be understood that the subject matter defined is not necessarily limited to the specific features or actions described above. On the contrary, the specific features and actions described above are merely exemplary forms of implementation. With respect to the apparatus in the above-mentioned embodiments, the specific manner in which each module performs the operation has been described in detail in the embodiments related to the method, and will not be described in detail here.

[0254] Overall, this embodiment has the following beneficial effects:

[0255] This application performs feature extraction on the power consumption analog signal, extracts the power consumption statistical feature embedding coding vector and the power consumption simulation modal feature map. These features can reflect the power consumption characteristics of the device in different states, including normal state and potential security threat state; and the power consumption simulation signal itself is a dynamically changing signal. Through real-time monitoring and feature extraction of this signal, the dynamic change characteristics of power consumption can be captured. Since attack behaviors often lead to abnormal changes in power consumption patterns, this characteristic is crucial for identifying whether the device is under attack. Linear transformation and dual feature screening of the extracted power consumption statistical feature embedding coding vector and power consumption simulation modal feature map can further extract more representative feature information, help remove redundant information, retain the most valuable features for security monitoring, and thus improve the accuracy of monitoring. By jointly encoding the power consumption statistical features and the analog modal features to form a power consumption analog-digital hybrid modal joint coding feature map, the operating status of the device can be more comprehensively reflected. This hybrid modal representation method can integrate the advantages of multiple information sources and improve the ability to identify complex attack behaviors;

[0256] Therefore, the present application can effectively overcome the limitations of the prior art that security monitoring only relies on statistical characteristics of power consumption data, and achieve more accurate, dynamic and comprehensive security monitoring of power Internet of Things terminal equipment.

[0257] Embodiment three:

[0258] The embodiment of the present application provides a computer-readable storage medium, the computer-readable storage medium includes a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute the security monitoring method of a power Internet of Things terminal device;

[0259] Wherein, the safety monitoring method of a power Internet of Things terminal device, if implemented in the form of a software functional unit and used as an independent product, can be stored in a computer-readable storage medium. Based on such an understanding, the present invention implements all or part of the processes in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. Wherein, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form, etc. The computer-readable medium can include: any entity or device capable of carrying the computer program code, recording medium, U disk, mobile hard disk, disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electric carrier signal, telecommunication signal and software distribution medium, etc.

[0260] The above are preferred embodiments of the present invention. It should be noted that, for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A security monitoring method for a power Internet of Things terminal device, characterized in that: include: Obtain the power consumption simulation signal of the CPU module from the power Internet of Things terminal device; Extracting features from the power consumption simulation signal to obtain a power consumption statistical feature embedding coding vector and a power consumption simulation modal feature graph; Performing linear transformation and dual feature screening on the power consumption statistical feature embedding coding vector and the power consumption analog modal feature map to obtain a power consumption analog-digital hybrid modal joint coding feature map; According to the power consumption analog-digital hybrid mode joint coding feature diagram, it is determined whether the power Internet of Things terminal device is attacked to obtain a security monitoring result.

2. A method for safety monitoring of electric power Internet of Things terminal equipment according to claim 1, characterized in that: The power consumption simulation signal is subjected to feature extraction to obtain a power consumption statistical feature embedding coding vector and a power consumption simulation modal feature graph, specifically: Performing analog-to-digital conversion on the power consumption analog signal to obtain CPU power consumption data; Extracting a number of statistical characteristic values ​​from the CPU power consumption data to obtain CPU power consumption statistical characteristics; Capturing the mutual relationship and interaction between the CPU power consumption statistical features through low-dimensional embedded coding to obtain the power consumption statistical feature embedded coding vector; The power consumption simulation signal is subjected to waveform feature analysis by a power consumption simulation feature extractor to obtain the power consumption simulation modal feature diagram.

3. A safety monitoring method for a power Internet of Things terminal device as claimed in claim 2, characterized in that: The power consumption simulation signal is subjected to waveform feature analysis according to the power consumption simulation feature extractor to obtain the power consumption simulation modal feature diagram, specifically: Extracting local features of the power consumption simulation signal through a deep convolution operation of the power consumption simulation feature extractor to obtain a local feature set; Based on the point-by-point convolution operation of the power consumption simulation feature extractor, the local feature set is integrated into a global feature representation to obtain the power consumption simulation modal feature map.

4. A method for safety monitoring of a power Internet of Things terminal device according to claim 1, characterized in that: The power consumption statistical feature embedding coding vector and the power consumption analog modal feature map are linearly transformed and dual-featured screened to obtain a power consumption analog-digital hybrid modal joint coding feature map, specifically: Performing a linear transformation on the power consumption statistical feature embedding coding vector according to two different weight modifier matrices to obtain a representation vector set including a first power consumption statistical feature mapping mode representation vector and a second power consumption statistical feature mapping mode representation vector; Based on the gradient amplitude of each position in the representation vector set, performing gradient amplitude-based masking processing on the representation vector set to obtain a masked representation vector set including a masked first power consumption statistical feature mapping mode representation vector and a masked second power consumption statistical feature mapping mode representation vector; The power consumption analog modal feature graph is subjected to dual feature screening according to the masked representation vector set to obtain the power consumption analog-digital hybrid modal joint coding feature graph.

5. A safety monitoring method for a power Internet of Things terminal device as claimed in claim 4, characterized in that: Based on the gradient amplitude of each position in the representation vector set, the representation vector set is subjected to a masking process based on the gradient amplitude to obtain a masked representation vector set including a masked first power consumption statistical feature mapping mode representation vector and a masked second power consumption statistical feature mapping mode representation vector, specifically: Based on the representation vector set, calculating the absolute value of the difference between the target eigenvalue and the eigenvalue of its adjacent position, and obtaining the gradient amplitude of each position in the first power consumption statistical feature mapping mode representation vector and the second power consumption statistical feature mapping mode representation vector; Marking the gradient amplitude according to a preset mask threshold to obtain a masked first power consumption statistical feature mapping mode representation vector and a masked second power consumption statistical feature mapping mode representation vector; The masked representation vector set is formed by the masked first power consumption statistical feature mapping pattern representation vector and the masked second power consumption statistical feature mapping pattern representation vector.

6. A method for safety monitoring of electric power Internet of Things terminal equipment according to claim 5, characterized in that: The gradient amplitude is marked according to a preset mask threshold to obtain a masked first power consumption statistical feature mapping mode representation vector and a masked second power consumption statistical feature mapping mode representation vector, specifically: If the gradient magnitude is greater than the mask threshold, marking the corresponding position of the gradient magnitude in the masked vector as an activated state; If the gradient magnitude is less than or equal to the mask threshold, marking the corresponding position of the gradient magnitude in the masked vector as a suppressed state; Each position in the first power consumption statistical feature mapping pattern representation vector and the second power consumption statistical feature mapping pattern representation vector is traversed to obtain the masked first power consumption statistical feature mapping pattern representation vector and the masked second power consumption statistical feature mapping pattern representation vector.

7. A method for safety monitoring of a power Internet of Things terminal device as claimed in claim 4, characterized in that: The power consumption analog modal feature map is subjected to dual feature screening according to the masked representation vector set to obtain the power consumption analog-digital hybrid modal joint coding feature map, specifically: Using the eigenvalues ​​of each position in the masked first power consumption statistical feature mapping mode representation vector of the masked representation vector set as weights, weighting each channel feature matrix of the power consumption simulation modal feature graph to obtain a weighted power consumption simulation modal feature graph; Activating the weighted power consumption simulation modal feature graph to obtain a preliminarily screened power consumption simulation modal feature graph; Based on the masked second power consumption statistical feature mapping mode representation vector and a preset function, the power consumption analog modal feature graph after preliminary screening is subjected to feature screening again to obtain the power consumption analog-digital hybrid modal joint coding feature graph.

8. A method for safety monitoring of electric power Internet of Things terminal equipment according to claim 1, characterized in that: According to the power consumption analog-digital hybrid mode joint coding feature map, it is determined whether the power Internet of Things terminal device is attacked, and a security monitoring result is obtained, which is specifically: Modulating the characteristic value in the power consumption analog-digital hybrid mode joint coding characteristic map to calculate and obtain two modulation values; Performing phase conversion on the power consumption analog-digital hybrid mode joint coding characteristic diagram according to the two modulation values ​​to obtain an optimized power consumption analog-digital hybrid mode joint coding phase conversion characteristic diagram; The power consumption optimized analog-digital hybrid mode joint coding phase conversion characteristic diagram is anomaly identified according to a preset classifier to obtain the safety monitoring result.

9. A method for safety monitoring of electric power Internet of Things terminal equipment according to claim 1, characterized in that: Get the power consumption simulation signal of the CPU module from the power IoT terminal device, specifically: A sampling resistor is connected in series between the power module of the power Internet of Things terminal device and the CPU module, and a current analog signal of the CPU module is obtained by collecting the voltage drop across the sampling resistor; The current analog signal is processed according to the sampling resistor to obtain the power consumption analog signal of the CPU module.

10. A safety monitoring device for a power Internet of Things terminal device, characterized in that: It includes a signal module, an extraction module, a screening module and a detection module; Wherein, the signal module is used to obtain the power consumption simulation signal of the CPU module from the power Internet of Things terminal device; The extraction module is used to extract features from the power consumption simulation signal to obtain a power consumption statistical feature embedding coding vector and a power consumption simulation modal feature graph; The screening module is used to perform linear transformation and dual feature screening on the power consumption statistical feature embedding coding vector and the power consumption analog modal feature map to obtain a power consumption analog-digital hybrid modal joint coding feature map; The detection module is used to determine whether the power Internet of Things terminal device is attacked based on the power consumption analog-digital hybrid mode joint coding feature map to obtain a security monitoring result.

11. A safety monitoring device for electric power Internet of Things terminal equipment according to claim 10, characterized in that: The extraction module includes a data unit, a feature unit, a vector unit and a feature map unit; Wherein, the data unit is used to perform analog-to-digital conversion on the power consumption analog signal to obtain CPU power consumption data; The feature unit is used to extract a number of statistical feature values ​​from the CPU power consumption data to obtain CPU power consumption statistical features; The vector unit is used to capture the mutual relationship and interaction between the CPU power consumption statistical features through low-dimensional embedded coding to obtain the power consumption statistical feature embedded coding vector; The feature graph unit is used to perform waveform feature analysis on the power consumption simulation signal according to the power consumption simulation feature extractor to obtain the power consumption simulation modal feature graph.

12. A safety monitoring device for electric power Internet of Things terminal equipment according to claim 11, characterized in that: The feature graph unit includes a feature subunit and a representation subunit; Wherein, the feature subunit is used to extract the local features of the power consumption simulation signal through the deep convolution operation of the power consumption simulation feature extractor to obtain a local feature set; The representation subunit is used to integrate the local feature set into a global feature representation based on the point-by-point convolution operation of the power consumption simulation feature extractor to obtain the power consumption simulation modal feature graph.

13. A safety monitoring device for electric power Internet of Things terminal equipment according to claim 10, characterized in that: The screening module includes a transformation unit, a mask unit and a dual screening unit; The transformation unit is used to perform a linear transformation on the power consumption statistical feature embedded coding vector according to two different weight modifier matrices to obtain a representation vector set including a first power consumption statistical feature mapping mode representation vector and a second power consumption statistical feature mapping mode representation vector; The mask unit is used to perform gradient amplitude-based masking processing on the representation vector set based on the gradient amplitude of each position in the representation vector set to obtain a masked representation vector set including a masked first power consumption statistical feature mapping mode representation vector and a masked second power consumption statistical feature mapping mode representation vector; The dual screening unit is used to perform dual feature screening on the power consumption analog modal feature map according to the masked representation vector set to obtain the power consumption analog-digital hybrid modal joint encoding feature map.

14. A safety monitoring device for electric power Internet of Things terminal equipment according to claim 13, characterized in that: The mask unit includes a gradient subunit, a marking subunit and a vector subunit; Wherein, the gradient subunit is used to calculate the absolute value of the difference between the target eigenvalue and the eigenvalue of its adjacent position based on the representation vector set, and obtain the gradient amplitude of each position in the first power consumption statistical feature mapping mode representation vector and the second power consumption statistical feature mapping mode representation vector; The marking subunit is used to mark the gradient amplitude according to a preset mask threshold value to obtain a masked first power consumption statistical feature mapping mode representation vector and a masked second power consumption statistical feature mapping mode representation vector; The vector subunit is used to form the masked representation vector set by using the masked first power consumption statistical feature mapping mode representation vector and the masked second power consumption statistical feature mapping mode representation vector.

15. A safety monitoring device for electric power Internet of Things terminal equipment according to claim 14, characterized in that: The marking subunit is specifically: If the gradient magnitude is greater than the mask threshold, marking the corresponding position of the gradient magnitude in the masked vector as an activated state; If the gradient magnitude is less than or equal to the mask threshold, marking the corresponding position of the gradient magnitude in the masked vector as a suppressed state; Each position in the first power consumption statistical feature mapping pattern representation vector and the second power consumption statistical feature mapping pattern representation vector is traversed to obtain the masked first power consumption statistical feature mapping pattern representation vector and the masked second power consumption statistical feature mapping pattern representation vector.

16. A safety monitoring device for electric power Internet of Things terminal equipment according to claim 13, characterized in that: The dual screening unit includes a weighting subunit, an activation subunit and a screening subunit; Wherein, the weighted subunit is used to weight each channel feature matrix of the power consumption simulation modal feature diagram by using the feature values ​​of each position in the masked first power consumption statistical feature mapping mode representation vector of the masked representation vector set as weights to obtain a weighted power consumption simulation modal feature diagram; The activation subunit is used to activate the weighted power consumption simulation modal feature graph to obtain the power consumption simulation modal feature graph after preliminary screening; The screening subunit is used to perform feature screening again on the power consumption simulation modal feature graph after preliminary screening based on the masked second power consumption statistical feature mapping mode representation vector and a preset function to obtain the power consumption analog-digital hybrid modal joint encoding feature graph.

17. A safety monitoring device for electric power Internet of Things terminal equipment according to claim 10, characterized in that: The detection module includes a modulation unit, a phase unit and an identification unit; The modulation unit is used to modulate the characteristic value in the power consumption analog-digital hybrid mode joint coding characteristic map to calculate and obtain two modulation values; The phase unit is used to perform phase conversion on the power consumption analog-digital hybrid mode joint coding characteristic diagram according to the two modulation values ​​to obtain an optimized power consumption analog-digital hybrid mode joint coding phase conversion characteristic diagram; The identification unit is used to perform abnormal identification on the power consumption optimized analog-digital hybrid mode joint encoding phase conversion characteristic diagram according to a preset classifier to obtain the safety monitoring result.

18. The safety monitoring device for electric power Internet of Things terminal equipment according to claim 10, characterized in that: The signal module includes a collection unit and a processing unit; The acquisition unit is used to connect a sampling resistor in series between the power module and the CPU module of the power Internet of Things terminal device, and obtain a current analog signal of the CPU module by acquiring a voltage drop across the sampling resistor; The processing unit is used to perform signal processing on the current analog signal according to the sampling resistor to obtain the power consumption analog signal of the CPU module.

19. A storage medium, characterized in that: The storage medium stores a computer program, which is called and executed by a computer to implement a security monitoring method for an electric power Internet of Things terminal device as described in any one of claims 1 to 9 above.

Images