Equipment energy consumption data intelligent analysis system based on Internet of Things

Abstract

The invention discloses an equipment energy consumption data intelligent analysis system based on Internet of Things, which relates to the technical field of equipment energy consumption analysis, and comprises a transmission initialization module, an operation parameter acquisition and analysis module, a health state monitoring module and a risk assessment and response module, the system firstly initializes a transmission environment, establishes a preliminary secure communication channel, and encrypts data. Through a multi-level security mechanism, such as encryption processing of transmission initialization, real-time monitoring of parameters and evaluation of hidden danger coefficients of a machine learning model, the system ensures that the data transmission process is safe, risks such as man-in-the-middle attack, data eavesdropping or tampering and the like are quickly identified and coped with, and commercial secret leakage is prevented. The risk assessment and response module adopts different measures according to the risk level, optimizes or switches the transmission channel, improves the response efficiency, avoids unnecessary interruption, and comprehensively guarantees the safety and stability of data transmission.

Description

Technical Field

[0001] The present invention relates to the technical field of equipment energy consumption analysis, and in particular to an intelligent analysis system for equipment energy consumption data based on the Internet of Things. Background Art

[0002] Intelligent analysis of device energy consumption data based on IoT refers to the real-time collection and transmission of energy consumption data of various devices to a centralized system or cloud platform through IoT technology. In this process, IoT sensors are embedded in the devices to monitor the operating status, energy consumption, environmental conditions and other data of the devices. These data are transmitted to the central data processing center through the network for aggregation and sorting. The data can cover multiple dimensions, such as the working hours, power consumption, and frequency of use of the equipment, to ensure the comprehensiveness and accuracy of the data.

[0003] Then, intelligent analysis uses technologies such as big data, artificial intelligence, and machine learning to deeply mine and analyze the energy consumption data of these devices. The analysis system can identify energy consumption patterns, potential equipment failures, and energy waste points, and provide energy-saving optimization suggestions. For example, the system can predict the energy consumption trend of the equipment and inform in advance of possible abnormal power consumption, thereby helping enterprises take preventive measures to reduce energy consumption. In addition, this intelligent analysis can also help enterprises develop more scientific energy consumption management strategies, maximize the efficiency of equipment use, reduce energy costs, and achieve more sustainable development.

[0004] The prior art has the following deficiencies:

[0005] Although modern network technology is relatively mature, data transmission still faces potential security threats, especially hacker attacks, such as man-in-the-middle attacks, data eavesdropping or data tampering. For some companies, especially large-scale manufacturing companies, high-tech manufacturing (such as semiconductors, automobiles, and electronic products) and high-energy-consuming industries (such as steel, chemicals, and papermaking), their energy consumption data may contain commercial secrets. Once such attacks occur, sensitive energy consumption data may be leaked or maliciously tampered with, affecting the accuracy of data analysis. At the same time, the company's core secrets will be at risk of being leaked, resulting in economic losses and reputation damage. In the case where energy consumption data involves commercial secrets or user privacy, data leakage may also lead to legal disputes and regulatory penalties, further exacerbating the risks and losses of the company.

[0006] The above information disclosed in this Background section is only for enhancement of understanding of the background of the present disclosure and therefore it may contain information that does not constitute the prior art that is already known to one of ordinary skill in the art. Summary of the invention

[0007] The purpose of the present invention is to provide an intelligent analysis system for device energy consumption data based on the Internet of Things, which ensures that data transmission is always running under safe monitoring through multi-level security mechanisms, such as encryption processing of transmission initialization, real-time monitoring parameters, and machine learning model evaluation of hidden danger coefficients. For man-in-the-middle attacks, data eavesdropping or tampering, the system quickly identifies them through the source IP change rate index and the transmission protocol change rate index to prevent the leakage of commercial secrets and avoid economic losses and reputation damage. Through the risk assessment module, the system divides abnormal states into low, medium, and high risks, and takes different countermeasures. The intelligent hierarchical response improves the security and stability of transmission to solve the problems in the above-mentioned background technology.

[0008] In order to achieve the above-mentioned purpose, the present invention provides the following technical solutions: including a transmission initialization module, an operation parameter collection and analysis module, a health status monitoring module and a risk assessment and response module:

[0009] Transmission initialization module: before starting data transmission, the system first initializes the transmission environment, establishes a preliminary secure communication channel, and encrypts the data;

[0010] Operation parameter collection and analysis module: When data transmission starts, the system collects the operation parameters in the transmission channel in real time, performs data analysis on the acquired operation parameters, and uses machine learning models to conduct a comprehensive evaluation of the analyzed data information to determine the abnormal state of the transmission channel;

[0011] Health status monitoring module: the system monitors the health status of the transmission channel in real time to ensure that the transmission conditions meet safety standards;

[0012] The risk assessment and response module further comprehensively analyzes the identified abnormal status of the transmission channel, determines the risk level of the abnormal status, and takes different response measures for abnormal status of the transmission channel with different risk levels.

[0013] Preferably, before starting data transmission, the system needs to fully initialize the transmission environment to ensure the security and reliability of the data transmission process. The specific steps are as follows:

[0014] First, the system must identify the source (sender) and destination (receiver) of the data.

[0015] The system selects the communication protocol for encryption and transmission management during data transmission;

[0016] After the communication protocol is determined, the system establishes a preliminary secure communication channel between the data source and the target;

[0017] The transmission environment is set up and the system selects a suitable encryption method for the data to be transmitted.

[0018] Preferably, data analysis is performed on the obtained operating parameters, and the operating parameters in the transmission channel include network identity monitoring indicators and protocol integrity monitoring indicators. The network identity monitoring indicators and protocol integrity monitoring indicators are placed under a detection window, and an abnormality analysis is performed on the network identity monitoring indicators and the protocol integrity monitoring indicators. A source IP address change rate index and a transmission protocol change rate index are generated respectively, and the source IP address change rate index and the transmission protocol change rate index are input into a pre-learned machine model. A transmission channel hidden danger coefficient is generated by the machine model, and an intelligent evaluation of the transmission channel security status is performed based on the transmission channel hidden danger coefficient.

[0019] Preferably, the generated transmission channel hidden danger coefficient is compared and analyzed with a preset transmission channel hidden danger coefficient reference threshold, and the analysis result is as follows:

[0020] If the transmission channel hidden danger coefficient is greater than or equal to the transmission channel hidden danger coefficient reference threshold, it is judged that the data transmission channel is in an unsafe state;

[0021] If the transmission channel hidden danger coefficient is less than the transmission channel hidden danger coefficient reference threshold, it is determined that the data transmission channel is in a safe state.

[0022] Preferably, when the data transmission channel is determined to be in an unsafe state, several transmission channel hidden danger coefficients generated by the data transmission channel during the operation of the fixed detection window are continuously obtained to establish an analysis set, and the transmission channel hidden danger coefficient in the analysis set is compared with the first-level reference threshold, the second-level reference threshold and the transmission channel hidden danger coefficient reference threshold, wherein the second-level reference threshold is greater than the first-level reference threshold, and the first-level reference threshold is greater than the transmission channel hidden danger coefficient reference threshold, and the transmission channel hidden danger coefficient is compared and analyzed with the second-level reference threshold, the first-level reference threshold and the transmission channel hidden danger coefficient reference threshold, and the number of transmission channel hidden danger coefficients that are less than the first-level reference threshold and greater than or equal to the transmission channel hidden danger coefficient reference threshold is calibrated as Ea, the number of transmission channel hidden danger coefficients that are less than the second-level reference threshold and greater than or equal to the first-level reference threshold is calibrated as Eb, and the number of transmission channel hidden danger coefficients that are greater than or equal to the second-level reference threshold is calibrated as Ec.

[0023] Preferably, Ea, Eb, and Ec are comprehensively analyzed to generate a risk index Risk Index , based on the formula: In the formula, w a 、w b 、w c are the weight coefficients of Ea, Eb, and Ec respectively, and w a 、w b 、w c Both are greater than 0.

[0024] Preferably, within the detection window, the system collects all source IP address data passing through the transmission channel and records them as a set IP(t), where IP(t)={ip i (t)}={ip1(t), ip2(t),…,ip n (t)}, where ip i (t) represents the i-th source IP address detected at time t, and n represents the total number of source IP addresses detected within the detection window;

[0025] In the time window, the change frequency of the source IP address needs to be measured by the change weight. When the source IP address changes, a change weight is given. The value of the change weight is related to the time interval of the source IP address change. The exponential decay weight model is used to reduce the impact of long-term changes and enhance the importance of recent changes. The calculation expression is as follows: Where W(t) is the source IP address change weight, e represents a mathematical constant, λ is the exponential decay coefficient, and t i Indicates the time when the i-th IP address change occurs, t i-1 Indicates the time when the last IP address change occurred for the ith IP address change, ip i+1 It is the source IP address data collected for the i+1th time;

[0026] In addition to the frequency of change, it is also necessary to measure the magnitude of the change, that is, the degree of difference between each IP address change. The hash function distance is used to evaluate the difference in source IP addresses. Each IP address is hashed and the gap between the hash values ​​of adjacent IP addresses is calculated. The Hamming distance is used to quantify the degree of change of the IP address. The calculation expression is as follows: In the formula, D(ip i , ip i+1 ) is used to represent two adjacent source IP addresses ip i and ip i+1 The change range between i ) is the hash value obtained by applying the hash function H to the i-th source IP address. i+1 ) is the hash value obtained by applying the same hash function H to the i+1th source IP address, Represents the Hamming distance, which is used to calculate the bitwise XOR difference between two hash values;

[0027] Combine the source IP address change weight W(t) and the two adjacent source IP addresses ip i and ip i+1 The change range D(ip i , ip i+1), define the change intensity, which represents the total change intensity of the source IP address within the detection window, multiply the weight by the amplitude and normalize it to ensure that the index range is within the appropriate range. The calculation expression is as follows: Where S(t) represents the intensity index of source IP address change, W(t i ) represents the change weight of the i-th IP address change;

[0028] In order to obtain the final source IP address change rate index, the intensity index S(t) of the source IP address change is weighted and combined with the total number of changes in the detection window. At the same time, the false alarm rate that may be caused by network fluctuations during the transmission process is considered. By controlling the false alarm rate, unnecessary alarms are reduced. The calculation expression is as follows: In the formula, I IP Indicates the source IP address change rate index, T w It represents the detection window duration, and β represents the false alarm correction factor.

[0029] Preferably, in the detection window, the change data of the relevant transmission protocol is extracted, and the transmission protocol of each data packet in the monitored data stream is marked as Q z , where Q z = {Q1, Q2, Q3, ..., Q m}, Q z Indicates the transport protocol type used by the zth data packet, and m indicates the total number of transport protocol types that may be involved

[0030] For each protocol switch, the switch event is recorded and the number of protocol switch events is defined, that is, the number of protocol switches that occur within the detection window. z Switch to Q z+1 , the number of protocol switching events increases by 1, and the calculation expression is as follows: Where S(t) represents the number of protocol switching events, Q z+1 represents the type of transport protocol used by the z+1th data packet, δ(·) is the indicator function, if Q z ≠

[0031] Q z+1 , then δ=1, otherwise δ=0;

[0032] Within the detection window, different transmission protocol types Q z The frequency of occurrence is different, so a weight is introduced to represent the probability of a protocol type appearing in the entire detection window. The calculation expression is as follows: In the formula, represents the weight, Represents protocol Q z The number of packets within the detection window, N totalIndicates the total number of packets within the detection window:

[0033] In order to measure the intensity of protocol switching, the protocol change intensity coefficient is introduced to represent the intensity of each change from Q z Switch to The importance of the protocol can be assigned different weights according to factors such as the security of the protocol and expected stability. The calculation expression is as follows: In the formula, represents the protocol change strength coefficient, and Respectively represent Q z and Q z+1 The importance coefficient, T Δz represents the protocol switching time interval, where T Δz =t z+1 -t z , where t z Indicates the specific time point when the zth protocol switch occurs, t z+1 Indicates the specific time point when the z+1th protocol switch occurs;

[0034] The protocol switching complexity is introduced to quantify the diversity of protocol switching and measure whether the frequency and diversity of protocol switching increase abnormally within the detection window. The calculation expression is: Where K represents the complexity of protocol switching, H(Q z , Q z+1 ) indicates switching protocol Q z and The Sipoort distance between

[0035] Based on the extracted number of protocol switching events S(t) and weight Protocol Change Strength Factor And the protocol switching complexity K, generate the transmission protocol change rate index, the calculation expression is as follows: In the formula, R Q Indicates the transmission protocol change rate index.

[0036] In the above technical solution, the technical effects and advantages provided by the present invention are:

[0037] The present invention ensures that the data transmission process is always under security monitoring through multi-level security mechanisms, such as encryption processing in the transmission initialization module, real-time monitoring of the operating parameters of the transmission channel, and intelligent evaluation of the hidden danger coefficient of the transmission channel through a machine learning model. For possible man-in-the-middle attacks, data eavesdropping or data tampering, the system can quickly identify indicators such as the source IP address change rate index and the transmission protocol change rate index, and then take countermeasures to prevent the leakage or tampering of commercial confidential data (such as energy consumption data). This solution can effectively avoid corporate economic losses and reputation damage caused by data security issues.

[0038] Through the risk assessment and response module of the present invention, the system can generate a risk index according to the hidden danger coefficient of the transmission channel, and divide the abnormal state into three risk levels: low, medium and high. Under different risk levels, the system takes corresponding preventive or repair measures. Low-risk transmission anomalies only require slight optimization of transmission parameters, while medium and high risks can trigger more stringent security measures, such as switching backup channels or interrupting transmission. Such a hierarchical processing mechanism not only improves the system's response efficiency to threats, but also avoids unnecessary transmission interruptions, ensuring that data transmission can proceed smoothly under controllable risks. This intelligent hierarchical response effectively improves the security and stability of data transmission. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0040] Figure 1 This is a module schematic diagram of the intelligent analysis system for device energy consumption data based on the Internet of Things of the present invention. DETAILED DESCRIPTION

[0041] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the examples set forth herein; rather, these example embodiments are provided so that the description of the present disclosure will be more comprehensive and complete, and the concept of the example embodiments will be fully conveyed to those skilled in the art.

[0042] The present invention provides Figure 1 The IoT-based intelligent analysis system for equipment energy consumption data shown in the figure includes a transmission initialization module, an operation parameter collection and analysis module, a health status monitoring module, and a risk assessment and response module:

[0043] Transmission initialization module: before starting data transmission, the system first initializes the transmission environment, establishes a preliminary secure communication channel, and encrypts the data;

[0044] Before starting data transmission, the system needs to fully initialize the transmission environment to ensure the security and reliability of the data transmission process. The specific steps are as follows:

[0045] First, the system must identify the source (sender) and destination (receiver) of the data.

[0046] This step determines which devices or nodes will participate in the data transmission, ensuring that data is not sent to the wrong device or location;

[0047] The system needs to verify the identities of both parties to ensure that they are credible communication entities. This is usually achieved through digital certificates, identity authentication, etc.

[0048] The system selects the communication protocol for encryption and transmission management during data transmission;

[0049] The system will select a secure transport layer protocol (such as TLS or HTTPS) to ensure that data will not be eavesdropped or tampered with during transmission;

[0050] When selecting a protocol, you need to weigh the network environment and security requirements. For example, in scenarios with high security requirements, you may use a more complex encryption protocol.

[0051] After the communication protocol is determined, the system establishes a preliminary secure communication channel between the data source and the target;

[0052] This process involves the exchange of encryption keys between the two parties;

[0053] Through the handshake process (such as TLS handshake), both parties confirm the encryption method and key to ensure that the subsequently transmitted data is encrypted in the channel, thereby preventing man-in-the-middle attacks, eavesdropping, or data tampering;

[0054] The transmission environment is set up, and the system selects a suitable encryption method for the data to be transmitted;

[0055] Depending on the sensitivity of the data and the security requirements of the system, the system can choose symmetric encryption (such as AES) or asymmetric encryption (such as RSA);

[0056] Symmetric encryption is suitable for fast encryption of large amounts of data, while asymmetric encryption is more secure and suitable for transmission of small data segments. When selecting an encryption method, the system needs to find a balance between encryption strength and transmission performance;

[0057] Operation parameter collection and analysis module: When data transmission starts, the system collects the operation parameters in the transmission channel in real time, performs data analysis on the acquired operation parameters, and uses machine learning models to conduct a comprehensive evaluation of the analyzed data information to determine the abnormal state of the transmission channel;

[0058] Perform data analysis on the acquired operating parameters. The operating parameters in the transmission channel include network identity monitoring indicators and protocol integrity monitoring indicators. The network identity monitoring indicators and protocol integrity monitoring indicators are placed under the detection window. Anomaly analysis is performed on the network identity monitoring indicators and protocol integrity monitoring indicators. A source IP address change rate index and a transmission protocol change rate index are generated respectively. The source IP address change rate index and the transmission protocol change rate index are input into a pre-learned machine model. A transmission channel hidden danger coefficient is generated through the machine model. Based on the transmission channel hidden danger coefficient, an intelligent assessment of the transmission channel security status is performed.

[0059] The source IP address change rate refers to the frequency at which the IP address of the source device changes during data transmission. Normally, the source IP address in data communication should remain stable, representing the network identity of the communication initiator.

[0060] The change in the source IP address change rate indicates that the transmission channel is more likely to be subject to security threats, and may cause sensitive energy consumption data to be leaked or maliciously tampered with, thereby affecting the accuracy of data analysis. The source IP address is an identifier of the identities of both communicating parties. Under normal circumstances, it should remain stable. Any frequent changes usually mean that there is abnormal behavior in network communication. Attackers may hide their true identities by forging or tampering with IP addresses (such as IP address spoofing) to carry out man-in-the-middle attacks or packet replay attacks. By disguising themselves as legitimate communicating parties, attackers can steal or tamper with data in transit, especially energy consumption data involving commercial secrets. If sensitive data is intercepted and modified by attackers, companies may obtain incorrect energy consumption analysis results, affecting the accuracy of decision-making. In addition, data leakage may cause commercial secrets to be known to competitors, resulting in economic losses and legal risks.

[0061] In the detection window, the logic of generating the source IP address change rate index after analyzing the abnormality of the network identity monitoring indicators is as follows:

[0062] In the detection window, the system collects all source IP address data passing through the transmission channel and records them as a set IP(t), where IP(t) = {ip i (t)}={ip1(t), ip2(t),...,ip n (t)}, where ip i (t) represents the i-th source IP address detected at time t, and n represents the total number of source IP addresses detected within the detection window;

[0063] Source IP address data refers to the IP address information used to identify the sender of a data packet in network communications. Each data packet contains a source IP address when it is transmitted on the network, which represents the network location of the device or server that sent the data packet. Source IP address data is used to track and identify the initiator of communication to ensure the traceability and security of data transmission. It is also an important basis for judging whether network behavior is legal or abnormal in network monitoring and traffic analysis.

[0064] In the time window, the change frequency of the source IP address needs to be measured by the change weight. When the source IP address changes, a change weight is given. The value of the change weight is related to the time interval of the source IP address change. The exponential decay weight model is used to reduce the impact of long-term changes and enhance the importance of recent changes. The calculation expression is as follows: Where W(t) is the weight of the source IP address change, e represents a mathematical constant, λ is the exponential decay coefficient, which controls the speed of weight decay, and t i Indicates the time when the i-th IP address change occurs, t i-1 Indicates the time when the last IP address change occurred after the i-th IP address change, ipi +1 It is the source IP address data collected for the i+1th time;

[0065] It should be noted that:

[0066] The exponential decay weight model is a mathematical model used to reduce the impact of certain events over time. The core idea is that as the time interval between events (such as source IP address changes) increases, the impact of the event on the current system gradually decreases. Older events are given smaller weights, and newer events have larger weights. This model is widely used in network security, signal processing, and machine learning to ensure that the system can pay more attention to recent changes, while older events are gradually "forgotten" or faded, thereby increasing sensitivity to real-time risks.

[0067] The exponential decay coefficient λ is a key parameter in the exponential decay weight model, which controls the speed of weight decay. It determines how quickly the impact of an event on the system fades over time. A larger λ value means that the weight decays faster, which means that the system is insensitive to the impact of earlier events and focuses more on recent events; while a smaller λ value means that the weight decays slower and the system will remain more sensitive to events in the past for a longer period of time. Therefore, adjusting λ can control how the system balances the impact of historical events with recent events.

[0068] In addition to the frequency of change, it is also necessary to measure the magnitude of the change, that is, the degree of difference between each IP address change. The hash function distance is used to evaluate the difference in source IP addresses. Each IP address is hashed and the gap between the hash values ​​of adjacent IP addresses is calculated. The Hamming distance is used to quantify the degree of change of the IP address. The calculation expression is as follows: In the formula, D(ip i , ip i+1 ) is used to represent two adjacent source IP addresses ip i and ip i+1 The change range between i ) is the hash value obtained by applying the hash function H to the i-th source IP address. i+1 ) is the hash value obtained by applying the same hash function H to the i+1th source IP address, Represents the Hamming distance, which is used to calculate the bitwise XOR difference between two hash values;

[0069] Hash function distance refers to converting input data (such as IP addresses) into fixed-length binary or other format hash values ​​through a hash function, and then measuring the difference between input data by comparing the differences between these hash values. The hash function converts data input of any length into a fixed-length output (called a hash value or summary). This process is irreversible and produces different hash values ​​for different inputs. The hash function distance reflects the difference between two input data at the hash value level. If the two hash values ​​differ greatly, it means that the difference between the original input data is also large.

[0070] In network security and data transmission, hash function distance is used to detect data consistency, integrity, and fast comparison of data. For example, after two IP addresses are hashed, by calculating the difference in their hash values, it can be determined whether the two addresses have changed during network transmission. Hash function distance can effectively detect potential tampering, changes, or forgery by comparing hash values.

[0071] Hash function distance measures the degree of data change by converting the input data into hash values ​​and then comparing the differences between these hash values.

[0072] Hamming distance refers to the number of different corresponding bits between two strings (or binary sequences) of the same length. Specifically, Hamming distance measures how many bits are different between two binary numbers. This distance indicates the degree of difference between two data and is often used to measure the difference between binary codes or hash values.

[0073] For example, suppose there are two binary strings:

[0074] (A=1011101)

[0075] (B=1001001)

[0076] The Hamming distance is calculated by comparing A and B bit by bit. Here, only the second and fourth bits are different, so their Hamming distance is 2.

[0077] Hamming distance is used to calculate the number of different corresponding bits between two binary strings of the same length, indicating the difference between the data.

[0078] Hamming distance is used to calculate the number of different corresponding bits between two binary strings of the same length, indicating the difference between the data.

[0079] Hamming distance is widely used in network security, coding theory, data transmission and other fields. Its functions mainly include the following aspects:

[0080] 1. Data difference measurement: Hamming distance can be used to quantify the difference between two data. By calculating the Hamming distance between two hash values ​​or codes, it is possible to quickly determine whether the data has been tampered with or changed. In network monitoring, Hamming distance can help the system detect the degree of change in the source IP address or other key information.

[0081] 2. Error detection and correction: In coding theory, Hamming distance is widely used in error detection and correction. By adding redundant bits, Hamming distance can be used to detect and correct errors that occur during transmission. For example, in digital communication, Hamming code is a classic error correction code that can detect and correct up to 1 bit of error during transmission.

[0082] 3. Pattern recognition: In pattern recognition and machine learning, the Hamming distance is used to compare the similarity between two feature vectors or strings. A smaller Hamming distance indicates a higher similarity between the two patterns, while a larger distance indicates a greater difference between them.

[0083] 4. Network security and encryption: In network security, Hamming distance is used to detect abnormal behaviors in data transmission, such as forgery and tampering of IP addresses. By comparing the hash values ​​of IP addresses at adjacent time points, Hamming distance can help the system determine whether the source IP address has changed significantly, thereby identifying potential security threats.

[0084] The Hamming distance is used in areas such as data difference measurement, error detection and correction, pattern recognition, and network security monitoring to help the system evaluate data changes or errors.

[0085] Combine the source IP address change weight W(t) and the two adjacent source IP addresses ip i and ip i+1 The change range D(ip i , ip i+1 ), define the change intensity, which represents the total change intensity of the source IP address within the detection window, multiply the weight by the amplitude and normalize it to ensure that the index range is within the appropriate range. The calculation expression is as follows: Where S{t) represents the intensity index of source IP address change, W(t i ) represents the change weight of the i-th IP address change;

[0086] In order to obtain the final source IP address change rate index, the intensity index S(t) of the source IP address change is weighted and combined with the total number of changes in the detection window. At the same time, the false alarm rate that may be caused by network fluctuations during the transmission process is considered. By controlling the false alarm rate, unnecessary alarms are reduced. The calculation expression is as follows: In the formula, I IP Indicates the source IP address change rate index, T w It indicates the detection window duration, β indicates the false positive correction factor, and represents the legitimate source IP change, such as load balancing.

[0087] From the calculation expression of the source IP address change rate index, it can be seen that the larger the performance value of the source IP address change rate index generated after the abnormal analysis of the network identity monitoring indicators, the higher the frequency or the larger the change range of the source IP address within the detection window, which usually means that the transmission channel may be under security threats. Frequent changes in source IP addresses may be a signal of IP address spoofing, network hijacking or man-in-the-middle attacks. Attackers may intercept, steal or tamper with sensitive data, such as energy consumption data, by tampering with or forging source IP addresses. These behaviors will seriously affect the accuracy of data analysis and cause enterprises to make wrong decisions. On the contrary, if the performance value of the source IP address change rate index is smaller, it means that the frequency of IP address changes is low, the transmission channel is relatively stable, the security risk during data transmission is low, and the accuracy of data analysis can be guaranteed.

[0088] The transmission protocol change rate refers to the frequency at which the communication protocol used changes during the data transmission process. In normal network communications, the data transmission protocols (such as TCP, UDP, etc.) should usually remain consistent to ensure that the transmission process is stable and meets established standards.

[0089] The increase in the rate of transmission protocol changes during the operation of the transmission channel usually means a greater probability of security threats, which may lead to the leakage or malicious tampering of sensitive energy consumption data, thus affecting the accuracy of data analysis. The stability of the transmission protocol is crucial to secure transmission. Usually, during data transmission, the protocol used (such as TCP or UDP) should be consistent. If the transmission protocol changes frequently, it may be that the attacker exploits the protocol switching vulnerability or performs protocol hijacking to try to bypass the security mechanism or circumvent the firewall or intrusion detection system (IDS). In this case, the attacker may intercept, tamper with or forge the transmission data without being detected, especially the energy consumption data involving commercial secrets, which may lead to the theft or malicious modification of the data content. This abnormal behavior may affect the integrity and authenticity of the data, resulting in the unreliability of the results of the enterprise's energy consumption analysis, which in turn affects business decisions and energy management strategies. Therefore, frequent protocol changes are often early warning signs of potential attacks and must be taken seriously to prevent sensitive data from being leaked or maliciously tampered with.

[0090] In the detection window, the logic of generating the transmission protocol change rate index after abnormal analysis of the protocol integrity monitoring indicators is as follows:

[0091] Under the detection window, extract the change data of the relevant transmission protocol and mark the transmission protocol of each data packet in the monitored data stream as Q z , where Q z = {Q1, Q2, Q3, ..., Q m}, Q z Indicates the type of transport protocol used by the zth data packet, m indicates the total number of possible transport protocol types involved. In a communication network, different protocols are responsible for different communication functions, such as transport layer protocols (such as TCP, UDP), application layer protocols (such as HTTP, FTP), etc., and n is the number of these protocol types supported or monitored by the system;

[0092] During the network data transmission process, each data packet in the monitored data stream contains a field identifying the transmission protocol, which defines the communication method of the data packet at the network layer or application layer. Common transmission protocols include TCP (Transmission Control Protocol), UDP (User Datagram Protocol), etc., which are responsible for determining how to transmit data and how to ensure the integrity and reliability of data during the transmission process. The transmission protocol of each data packet will affect the data routing, transmission speed, reliability guarantee and other characteristics. For example, the TCP protocol provides a reliable transmission mechanism, ensuring the complete delivery of data through three-way handshakes and data packet confirmation, while UDP is a connectionless and fast transmission method, which is suitable for applications with high real-time requirements but low data integrity requirements. By monitoring the protocol field of each data packet, the system can understand the current data transmission strategy and communication method, thereby evaluating the security, stability and efficiency of the transmission.

[0093] For each protocol switch (i.e., switching from protocol Q z Switch to Q z+1 ), record the switching events, define the number of protocol switching events, that is, the number of protocol switching events that occur within the detection window, and z Switch to Q z+1 , the number of protocol switching events increases by 1, and the calculation expression is as follows: Where S(t) represents the number of protocol switching events, Q z+1 represents the type of transport protocol used by the z+1th data packet, δ(·) is the indicator function, if Q z ≠Q z+1 , then δ=1, otherwise δ=0;

[0094] The purpose of recording protocol switching events is to monitor and analyze the switching frequency and behavior between different transmission protocols during network data transmission to evaluate the stability and security of the transmission channel. Frequent protocol switching may mean abnormal activities in the network, such as potential attacks, protocol abuse, or security vulnerability exploits. By recording these switching events, the system can promptly detect whether there are abnormal patterns or threats in the transmission process and take corresponding protective measures to prevent data leakage, tampering, or interruption of network transmission. The record can also provide an important basis for subsequent network diagnosis and optimization.

[0095] Within the detection window, different transmission protocol types Q z The frequency of occurrence is different, so a weight is introduced to represent the probability of a protocol type appearing in the entire detection window. The calculation expression is as follows: In the formula, represents the weight, Represents protocol Q z The number of packets within the detection window, Ntotal Indicates the total number of packets within the detection window:

[0096] In order to measure the intensity of protocol switching, the protocol change intensity coefficient is introduced to represent the intensity of each change from Q z Switch to The importance of the protocol can be assigned different weights according to factors such as the security of the protocol and expected stability. The calculation expression is as follows: In the formula, represents the protocol change strength coefficient, and Respectively represent Q z and Q z+1 The importance coefficient, T Δz represents the protocol switching time interval. A longer interval indicates that the protocol is relatively stable and the change intensity is small, while frequent switching increases the change intensity. Δz =t z+1 -t z , where t z Indicates the specific time point when the zth protocol switch occurs, t z+1 Indicates the specific time point when the z+1th protocol switch occurs;

[0097] Protocol Change Strength Factor Used to quantify from a protocol Q z Switch to another protocol Q z+1 The coefficient takes into account the differences between the two protocols in terms of security, performance, stability, etc. The greater the difference, the higher the change intensity. In addition, the switching frequency is also a key factor in the change intensity. Frequent protocol switching will increase network instability. Through this coefficient, the system can determine the risk level of each protocol switch and identify potential threats that may lead to data leakage or tampering.

[0098] The protocol switching complexity is introduced to quantify the diversity of protocol switching and measure whether the frequency and diversity of protocol switching increase abnormally within the detection window. The calculation expression is: Where K represents the complexity of protocol switching, H(Q z , Q z+1 ) indicates switching protocol Q z and The Sieboldt distance between them is used to measure the similarity between two protocols. The larger the distance, the less common the protocol switching is.

[0099] Hilbert distance is a metric that measures the distance between two points in Hilbert space. Hilbert space is a complete vector space with an inner product (dot product) structure that can describe geometric and algebraic properties with infinite dimensions. In computing, Hilbert distance is often used to measure the similarity or difference between two vectors or functions. The Hilbert distance between two points can be calculated by their inner product, reflecting their geometric "distance".

[0100] The Hilbert distance is used to measure the "similarity" or "difference" between two different protocols. The larger the Hilbert distance between protocols, the more obvious the difference between them, that is, the greater the change when switching from one protocol to another. This is important in network transmission because protocol switching may bring different degrees of risk or performance impact. By using the Hilbert distance, the complexity of protocol switching can be quantified, thereby helping the system detect abnormal protocol change behavior and increase sensitivity to potential network attacks or unstable transmission.

[0101] Based on the extracted number of protocol switching events S(t) and weight Protocol Change Strength Factor And the protocol switching complexity K, generate the transmission protocol change rate index, the calculation expression is as follows: In the formula, R Q Indicates the transmission protocol change rate index;

[0102] In the detection window, the transmission protocol change rate index calculation expression shows that the larger the transmission protocol change rate index performance value generated after the abnormal analysis of the protocol integrity monitoring indicators, the greater the security threat to the transmission channel. In the detection window, the high change rate index generated after the analysis of the protocol integrity monitoring indicators indicates that the protocol is frequently switched, which may be a sign of abnormal behavior, such as attackers using protocol vulnerabilities to hijack, tamper with or eavesdrop on data, resulting in the leakage or malicious modification of sensitive energy consumption data, thereby affecting the accuracy of data analysis. Conversely, the smaller the transmission protocol change rate index performance value, the less or more stable the protocol switching, the transmission channel may be in a safe state, and the data integrity and transmission security are higher.

[0103] The machine model is not limited here, and the source IP address change rate index I IP and the transmission protocol change rate index R Q Any machine model that performs comprehensive analysis to generate a transmission channel hidden danger coefficient TCH may be used. In order to implement the technical solution of the present invention, the present invention provides a specific implementation method;

[0104] The calculation formula for the transmission channel hidden danger coefficient TCH is: TCH = S1*IIP -1 +S2*R Q -1 , where S1 and S2 are the source IP address change rate index I IP and the transmission protocol change rate index R Q The preset proportional coefficient, and S1 and S2 are both greater than 0;

[0105] It can be seen from the calculation expression of the transmission channel hidden danger coefficient that, under the detection window, the larger the source IP address change rate index performance value generated after the abnormal analysis of the network identity monitoring index, and the larger the transmission protocol change rate index performance value generated after the abnormal analysis of the protocol integrity monitoring index, the larger the transmission channel hidden danger coefficient performance value, indicating that the probability of security threats in the data transmission channel is greater, otherwise it means that the security channel is in a healthy state and data transmission can be carried out;

[0106] The generated transmission channel hidden danger coefficient is compared and analyzed with the preset transmission channel hidden danger coefficient reference threshold, and the analysis results are as follows:

[0107] If the transmission channel hidden danger coefficient is greater than or equal to the transmission channel hidden danger coefficient reference threshold, it is judged that the data transmission channel is in an unsafe state;

[0108] If the transmission channel hidden danger coefficient is less than the transmission channel hidden danger coefficient reference threshold, it is judged that the data transmission channel is in a safe state;

[0109] Health status monitoring module: the system monitors the health status of the transmission channel in real time to ensure that the transmission conditions meet safety standards;

[0110] The system monitors the health status of the transmission channel in real time to ensure that all conditions in the data transmission process meet the preset security standards to prevent potential network threats or data leakage. During the transmission process, the system will continuously collect various operating parameters, such as network latency, packet loss rate, source IP address change rate, transmission protocol change rate, encryption and decryption anomalies, etc. These parameters reflect the overall stability and security of the transmission channel. The system will monitor the changes in these parameters by setting thresholds, and any abnormal behavior that exceeds the preset standards will trigger an alarm. For example, frequent changes in the source IP address or abnormal changes in the transmission protocol may mean that the transmission process is under attack. In this case, the system will issue an alarm to remind the administrator to take corresponding measures. If the abnormal situation is serious and may cause data leakage or tampering, the system will automatically interrupt data transmission to prevent further expansion of security threats.

[0111] The risk assessment and response module further comprehensively analyzes the identified abnormal status of the transmission channel, determines the risk level of the abnormal status, and takes different response measures for abnormal status of the transmission channel with different risk levels.

[0112] When the data transmission channel is determined to be in an unsafe state, several transmission channel hidden danger coefficients generated by the data transmission channel during the operation of the fixed detection window are continuously obtained to establish an analysis set, and the transmission channel hidden danger coefficient in the analysis set is compared with the first-level reference threshold, the second-level reference threshold and the transmission channel hidden danger coefficient reference threshold, wherein the second-level reference threshold is greater than the first-level reference threshold, and the first-level reference threshold is greater than the transmission channel hidden danger coefficient reference threshold, and the transmission channel hidden danger coefficient is compared and analyzed with the second-level reference threshold, the first-level reference threshold and the transmission channel hidden danger coefficient reference threshold, and the number of transmission channel hidden danger coefficients that are less than the first-level reference threshold and greater than or equal to the transmission channel hidden danger coefficient reference threshold is calibrated as Ea, the number of transmission channel hidden danger coefficients that are less than the second-level reference threshold and greater than or equal to the first-level reference threshold is calibrated as Eb, and the number of transmission channel hidden danger coefficients that are greater than or equal to the second-level reference threshold is calibrated as Ec.

[0113] Comprehensively analyze Ea, Eb, and Ec to generate the risk index Risk Index , based on the formula: In the formula, w a 、w b 、w c are the weight coefficients of Ea, Eb, and Ec respectively, and w a 、w b 、w c All are greater than 0;

[0114] It can be seen from the risk index machine-selected expression that the larger the risk index performance value, the greater the probability of security threats occurring during data transmission. Conversely, it means that the data transmission process is in a safe transmission state.

[0115] The generated risk index is compared with the preset first risk index reference threshold and the second risk index reference threshold to determine the risk level of data transmission anomaly. The comparison and analysis results are as follows:

[0116] If the risk index is less than the first risk index reference threshold, the data transmission anomaly risk level is classified as low-risk transmission anomaly;

[0117] If the risk index is greater than or equal to the first risk level and less than the second risk level, the data transmission anomaly risk level is classified as medium-risk transmission anomaly;

[0118] If the risk index is greater than or equal to the second risk level, the data transmission anomaly risk level is classified as a high-risk transmission anomaly.

[0119] For transmission anomalies of different risk levels, the system needs to take different countermeasures to effectively deal with potential threats and maximize the security of data transmission. The following are detailed countermeasures for low-risk transmission anomalies, medium-risk transmission anomalies, and high-risk transmission anomalies:

[0120] When the risk index is less than the first risk index reference threshold, it is judged as a low-risk transmission anomaly. Such anomalies are usually slight network fluctuations or occasional parameter deviations, which do not pose a direct threat to data transmission. In this case, the system can take observation and optimization measures. First, the system will record the abnormal event and mark it in the log for subsequent review. Then, the system can automatically perform light optimization, such as adjusting the parameters of the transmission channel (for example, reducing the transmission rate or reallocating bandwidth) to stabilize the transmission quality. In addition, the system can increase the frequency of attention to the channel through monitoring tools to ensure that there are no further abnormal escalations in the future. In this case, there is no need to interrupt data transmission and the system can continue to operate normally.

[0121] When the risk index is greater than or equal to the first risk index reference threshold but less than the second risk index reference threshold, it is judged as a medium-risk transmission anomaly. Medium-risk transmission anomalies may reflect potential security threats or system configuration problems in the network. Although there is no immediate serious threat at present, it must be vigilant. For medium-risk transmission anomalies, the system should take preventive intervention measures. This includes reducing risks by automatically switching to backup transmission paths or temporary encrypted transmission channels without interrupting transmission. At the same time, the system can conduct in-depth analysis of current transmission behavior and initiate more stringent anomaly monitoring strategies, such as traffic analysis or behavior pattern matching of transmission channels to determine the source of the anomaly. In addition, the system should send early warning notifications to network administrators, indicating potential threats and suggesting manual inspection of transmission status to prevent further escalation of risks.

[0122] When the risk index is greater than or equal to the second risk index reference threshold, it is judged as a high-risk transmission anomaly. Such anomalies may indicate that the data transmission channel has been attacked or seriously threatened, and the risk of data leakage or tampering is extremely high. For high-risk transmission anomalies, the system must take emergency response measures. First, the system should immediately interrupt data transmission to prevent further data leakage or damage. Then, the system will start the emergency encryption mechanism to perform a higher level of encryption on the data that has not yet been transmitted, and block suspicious transmission paths. The system will generate a detailed anomaly report, record the details of the anomaly, and automatically trigger the security incident response process to notify the security team to intervene quickly. In addition, the system can lock the affected transmission nodes, isolate related equipment to prevent the problem from spreading, and conduct comprehensive security checks and repairs. In high-risk situations, rapid isolation and interruption of transmission are the key to protecting data security.

[0123] The above description is only by way of illustration of certain exemplary embodiments of the present invention. It is undoubted that those skilled in the art can modify the described embodiments in various ways without departing from the spirit and scope of the present invention. Therefore, the above drawings and descriptions are illustrative in nature and should not be construed as limiting the scope of protection of the claims of the present invention.

Claims

1. The intelligent analysis system of equipment energy consumption data based on the Internet of Things is characterized by: It includes transmission initialization module, operation parameter collection and analysis module, health status monitoring module and risk assessment and response module: Transmission initialization module: before starting data transmission, the system first initializes the transmission environment, establishes a preliminary secure communication channel, and encrypts the data; Operation parameter collection and analysis module: When data transmission starts, the system collects the operation parameters in the transmission channel in real time, performs data analysis on the acquired operation parameters, and uses machine learning models to conduct a comprehensive evaluation of the analyzed data information to determine the abnormal state of the transmission channel; Health status monitoring module: the system monitors the health status of the transmission channel in real time to ensure that the transmission conditions meet safety standards; The risk assessment and response module further comprehensively analyzes the identified abnormal status of the transmission channel, determines the risk level of the abnormal status, and takes different response measures for abnormal status of the transmission channel with different risk levels.

2. According to the IoT-based equipment energy consumption data intelligent analysis system of claim 1, it is characterized by: Before starting data transmission, the system needs to fully initialize the transmission environment to ensure the security and reliability of the data transmission process. The specific steps are as follows: First, the system must identify the source (sender) and destination (receiver) of the data. The system selects the communication protocol for encryption and transmission management during data transmission; After the communication protocol is determined, the system establishes a preliminary secure communication channel between the data source and the target; The transmission environment is set up and the system selects a suitable encryption method for the data to be transmitted.

3. The intelligent analysis system for equipment energy consumption data based on the Internet of Things according to claim 1 is characterized in that: Perform data analysis on the obtained operating parameters. The operating parameters in the transmission channel include network identity monitoring indicators and protocol integrity monitoring indicators. Place the network identity monitoring indicators and protocol integrity monitoring indicators under the detection window, perform abnormal analysis on the network identity monitoring indicators and protocol integrity monitoring indicators, generate a source IP address change rate index and a transmission protocol change rate index respectively, input the source IP address change rate index and the transmission protocol change rate index into a pre-learned machine model, generate a transmission channel hidden danger coefficient through the machine model, and perform an intelligent assessment of the security status of the transmission channel based on the transmission channel hidden danger coefficient.

4. The intelligent analysis system for equipment energy consumption data based on the Internet of Things according to claim 3 is characterized by: The generated transmission channel hidden danger coefficient is compared and analyzed with the preset transmission channel hidden danger coefficient reference threshold, and the analysis results are as follows: If the transmission channel hidden danger coefficient is greater than or equal to the transmission channel hidden danger coefficient reference threshold, it is judged that the data transmission channel is in an unsafe state; If the transmission channel hidden danger coefficient is less than the transmission channel hidden danger coefficient reference threshold, it is determined that the data transmission channel is in a safe state.

5. The intelligent analysis system for equipment energy consumption data based on the Internet of Things according to claim 4 is characterized in that: When the data transmission channel is determined to be in an unsafe state, several transmission channel hidden danger coefficients generated by the data transmission channel during the operation of the fixed detection window are continuously obtained to establish an analysis set, and the transmission channel hidden danger coefficient in the analysis set is compared with the first-level reference threshold, the second-level reference threshold and the transmission channel hidden danger coefficient reference threshold, wherein the second-level reference threshold is greater than the first-level reference threshold, and the first-level reference threshold is greater than the transmission channel hidden danger coefficient reference threshold, and the transmission channel hidden danger coefficient is compared and analyzed with the second-level reference threshold, the first-level reference threshold and the transmission channel hidden danger coefficient reference threshold, and the number of transmission channel hidden danger coefficients that are less than the first-level reference threshold and greater than or equal to the transmission channel hidden danger coefficient reference threshold is calibrated as Ea, the number of transmission channel hidden danger coefficients that are less than the second-level reference threshold and greater than or equal to the first-level reference threshold is calibrated as Eb, and the number of transmission channel hidden danger coefficients that are greater than or equal to the second-level reference threshold is calibrated as Ec.

6. The intelligent analysis system for equipment energy consumption data based on the Internet of Things according to claim 5 is characterized by: Comprehensively analyze Ea, Eb, and Ec to generate the risk index Risk Index , based on the formula: In the formula, w a 、w b 、w c are the weight coefficients of Ea, Eb, and Ec respectively, and w a 、w b 、w c Both are greater than 0.

7. The intelligent analysis system for equipment energy consumption data based on the Internet of Things according to claim 3 is characterized by: In the detection window, the logic for generating the source IP address change rate index after analyzing the abnormality of the network identity monitoring indicators is as follows: In the detection window, the system collects all source IP address data passing through the transmission channel and records them as a set IP(t), where IP(t) = {ip i (t)}={ip1(t), ip2(t),...,ip n (t)}, where ip i (t) represents the i-th source IP address detected at time t, and n represents the total number of source IP addresses detected within the detection window; In the time window, the change frequency of the source IP address needs to be measured by the change weight. When the source IP address changes, a change weight is given. The exponential decay weight model is used to reduce the impact of long-term changes and enhance the importance of recent changes. The calculation expression is as follows: Where W(t) is the source IP address change weight, e represents a mathematical constant, λ is the exponential decay coefficient, and t i Indicates the time when the i-th IP address change occurs, t i-1 Indicates the time when the last IP address change occurred for the ith IP address change, ip i+1 It is the source IP address data collected for the i+1th time; In addition to the frequency of change, it is also necessary to measure the magnitude of the change, that is, the degree of difference between each IP address change. The hash function distance is used to evaluate the difference in source IP addresses. Each IP address is hashed and the gap between the hash values ​​of adjacent IP addresses is calculated. The Hamming distance is used to quantify the degree of change of the IP address. The calculation expression is as follows: In the formula, D(ip i , ip i+1 ) is used to represent two adjacent source IP addresses ip i and ip i+1 The change range between i ) is the hash value obtained by applying the hash function H to the i-th source IP address. i+1 ) is the hash value obtained by applying the same hash function H to the i+1th source IP address, Represents the Hamming distance, which is used to calculate the bitwise XOR difference between two hash values; Combine the source IP address change weight W(t) and the two adjacent source IP addresses ip i and ip i+1 The change range D(ip i , ip i+1 ), define the change intensity, which represents the total change intensity of the source IP address within the detection window, multiply the weight by the amplitude and normalize it to ensure that the index range is within the appropriate range. The calculation expression is as follows: Where S(t) represents the intensity index of source IP address change, W(t i ) represents the change weight of the i-th IP address change; In order to obtain the final source IP address change rate index, the intensity index S(t) of the source IP address change is weighted and combined with the total number of changes in the detection window. At the same time, the false alarm rate that may be caused by network fluctuations during the transmission process is considered. By controlling the false alarm rate, unnecessary alarms are reduced. The calculation expression is as follows: In the formula, I IP Indicates the source IP address change rate index, T w It represents the detection window duration, and β represents the false alarm correction factor.

8. The intelligent analysis system for equipment energy consumption data based on the Internet of Things according to claim 3 is characterized by: In the detection window, the logic of generating the transmission protocol change rate index after abnormal analysis of the protocol integrity monitoring indicators is as follows: Under the detection window, extract the change data of the relevant transmission protocol and mark the transmission protocol of each data packet in the monitored data stream as Q z , where Q z = {Q1, Q2, Q3, ..., Q m }, Q z Indicates the transport protocol type used by the zth data packet, and m indicates the total number of transport protocol types that may be involved For each protocol switch, the switch event is recorded and the number of protocol switch events is defined, that is, the number of protocol switches that occur within the detection window. z Switch to Q z+1 , the number of protocol switching events increases by 1, and the calculation expression is as follows: Where S(t) represents the number of protocol switching events, Q z+1 represents the type of transport protocol used by the z+1th data packet, δ(·) is the indicator function, if Q z ≠Q z+1 , then δ=1, otherwise δ=0; Within the detection window, different transmission protocol types Q z The frequency of occurrence is different, so a weight is introduced to represent the probability of a protocol type appearing in the entire detection window. The calculation expression is as follows: In the formula, represents the weight, Represents protocol Q z The number of packets within the detection window, N total Indicates the total number of packets within the detection window: In order to measure the intensity of protocol switching, the protocol change intensity coefficient is introduced to represent the intensity of each change from Q z Switch to The importance of the protocol can be assigned different weights according to factors such as the security of the protocol and expected stability. The calculation expression is as follows: In the formula, represents the protocol change strength coefficient, and Respectively represent Q z and Q z+1 The importance coefficient, T Δz represents the protocol switching time interval, where T Δz =t z+1 -t z , where t z Indicates the specific time point when the zth protocol switch occurs, t z+1 Indicates the specific time point when the z+1th protocol switch occurs; The protocol switching complexity is introduced to quantify the diversity of protocol switching and measure whether the frequency and diversity of protocol switching increase abnormally within the detection window. The calculation expression is: Where K represents the complexity of protocol switching, H(Q z , Q z+1 ) indicates switching protocol Q z and Q z+1 The Sipoort distance between Based on the extracted number of protocol switching events S(t) and weight Protocol Change Strength Factor And the protocol switching complexity K, generate the transmission protocol change rate index, the calculation expression is as follows: In the formula, R Q Indicates the transmission protocol change rate index.

Images