A method and apparatus for handling local area network anomalies in home devices.

Abstract

This invention discloses a method and apparatus for handling local area network (LAN) anomalies in home appliances. The method includes: acquiring LAN data information of the home appliances; the LAN data information of the home appliances includes several LAN data information to be processed; preprocessing the LAN data information of the home appliances to obtain first LAN data information; the first LAN data information includes several first processed LAN data information; each first processed LAN data information includes at least one sequentially distributed first target LAN data information; and performing detection and analysis processing on the first LAN data information to obtain target anomaly detection result information.

Description

Technical Field

[0001] This invention relates to the field of network technology, and in particular to a method and apparatus for handling local area network anomalies in home devices. Background Technology

[0002] In actual communication, various anomalies may occur, requiring handling. These anomalies include how to handle token expiration and message retry mechanisms for unresponsive messages. For example, during communication, messages may be sent but not responded to due to network issues or packet loss. Therefore, this paper provides a method and device for handling local area network (LAN) anomalies in home devices. This method monitors LAN anomalies, improves the accuracy of network status monitoring, enhances the efficiency of network anomaly monitoring and repair, and improves the user experience of network communication. Summary of the Invention

[0003] The technical problem to be solved by the present invention is to provide a method and device for handling local area network anomalies in home devices, which is beneficial to monitoring local area network anomalies, improving the accuracy of network status monitoring, thereby improving the efficiency of network anomaly monitoring and repair, and improving the user experience of network communication.

[0004] To address the aforementioned technical problems, a first aspect of the present invention discloses a method for handling local area network (LAN) anomalies in home devices, the method comprising:

[0005] Acquire local area network (LAN) data information of home devices; the LAN data information of home devices includes several LAN data information to be processed;

[0006] The local area network (LAN) data information of the home device is preprocessed to obtain first LAN data information; the first LAN data information includes a plurality of first processed LAN data information; each of the first processed LAN data information includes at least one sequentially distributed first target LAN data information.

[0007] The data information from the first local area network is detected, analyzed, and processed to obtain the target anomaly detection result information.

[0008] A second aspect of this invention discloses a local area network (LAN) anomaly handling device for home appliances, the device comprising:

[0009] The acquisition module is used to acquire local area network (LAN) data information of home devices; the LAN data information of home devices includes several LAN data information to be processed;

[0010] The first processing module is used to preprocess the local area network data information of the home device to obtain first local area network data information; the first local area network data information includes a plurality of first processed local area network data information; each first processed local area network data information includes at least one first target local area network data information distributed in sequence.

[0011] The second processing module is used to detect and analyze the data information of the first local area network to obtain the target anomaly detection result information.

[0012] A third aspect of the present invention discloses another local area network (LAN) anomaly handling device for home appliances, the device comprising:

[0013] Memory containing executable program code;

[0014] A processor coupled to memory;

[0015] The processor calls the executable program code stored in the memory to execute some or all of the steps in the local area network anomaly handling method for home devices disclosed in the first aspect of the present invention.

[0016] The fourth aspect of the present invention discloses a computer-readable storage medium storing computer instructions, which, when invoked, are used to execute some or all of the steps in the local area network anomaly handling method for home devices disclosed in the first aspect of the present invention. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a schematic diagram of a local area network anomaly handling system for home devices provided in an embodiment of the present invention;

[0019] Figure 2 This is a flowchart illustrating a method for handling local area network anomalies in home devices, as disclosed in an embodiment of the present invention.

[0020] Figure 3 This is a schematic diagram of the structure of a local area network anomaly handling device for home appliances disclosed in an embodiment of the present invention;

[0021] Figure 4 This is a schematic diagram of another local area network anomaly handling device for home appliances disclosed in an embodiment of the present invention;

[0022] Figure 5 This is a schematic diagram of the structure of a target anomaly detection model disclosed in an embodiment of the present invention. Detailed Implementation

[0023] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0024] The terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this invention are used to distinguish different objects, not to describe a specific order. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, apparatus, product, or device that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to these processes, methods, products, or devices.

[0025] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of the invention. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0026] In this application, the term "exemplary" is used to mean "used as an example, illustration, or description." Any embodiment described as "exemplary" in this application is not necessarily to be construed as being more preferred or advantageous than other embodiments. The following description is provided to enable any person skilled in the art to make and use this application. Details are set forth in the following description for purposes of explanation. It should be understood that those skilled in the art will recognize that this application can be made without using these specific details. In other instances, well-known structures and processes are not described in detail to avoid obscuring the description of this application with unnecessary detail. Therefore, this application is not intended to be limited to the embodiments shown, but is consistent with the broadest scope of the principles and features disclosed in this application.

[0027] It should be noted that since the method in this application embodiment is executed in a computer device, the processing objects of each computer device exist in the form of data or information, such as time, which is essentially time information. It is understood that if size, quantity, position, etc. are mentioned in subsequent embodiments, they are all corresponding data that exist so that the computer device can process them. Specific details will not be elaborated here.

[0028] It should be noted that the artificial intelligence-related technologies that may be involved in this application will be briefly described. Artificial intelligence (AI) is the theory, method, technology, and application system that uses digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use that knowledge to obtain optimal results. In other words, artificial intelligence is a comprehensive technology in computer science that attempts to understand the essence of intelligence and produce a new kind of intelligent machine that can react in a way similar to human intelligence. Artificial intelligence is the study of the design principles and implementation methods of various intelligent machines, enabling machines to have the functions of perception, reasoning, and decision-making.

[0029] Artificial intelligence (AI) is a comprehensive discipline encompassing a wide range of fields, including both hardware and software technologies. Fundamental AI technologies generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing, operating / interactive systems, and mechatronics. AI software technologies primarily include computer vision, speech processing, natural language processing, and machine learning / deep learning.

[0030] Computer vision (CV) is a science that studies how to enable machines to "see." More specifically, it refers to machine vision, which uses cameras and computers to replace human eyes in recognizing and measuring targets, and then performs image processing to create images more suitable for human observation or transmission to instruments. As a scientific discipline, computer vision studies related theories and technologies, attempting to build artificial intelligence systems capable of extracting information from images or multidimensional data. Computer vision technologies typically include image processing, image recognition, image semantic understanding, image retrieval, OCR, video processing, video semantic understanding, video content / behavior recognition, 3D object reconstruction, 3D technology, virtual reality, augmented reality, simultaneous localization and mapping (SLAM), and common biometric recognition technologies such as facial recognition and fingerprint recognition.

[0031] Monomodal information refers to data of only one type, such as text, images, audio, video, or electromagnetic signals. Multimodal information refers to data that includes at least two types of monomodal information. Furthermore, multimodal information is suitable for complex tasks that require the integration of multiple information sources, such as sentiment analysis, robot interaction, and autonomous driving. By integrating information from multiple modalities, higher performance and accuracy can usually be achieved in these tasks.

[0032] Large models refer to artificial neural network models with a very large number of parameters. In the field of artificial intelligence, large models typically refer to models with hundreds of millions to trillions of parameters. These models usually need to be trained on large-scale datasets and require a significant amount of computing resources for optimization and tuning. Large models are commonly used to solve complex tasks such as natural language processing, computer vision, and speech recognition. Generative AI is a type of AI that can create new content and ideas, including dialogues, stories, images, videos, and music. In this embodiment, the large model can be a language model of the scale of ChatGPT, BERT, XLNet, Zhipu model, Claude, Moonshot AI model, ChatGLM model, Qianyitongwen model, MiniMax model, Xinghuo model, Llama model, 360GPT model, Qwen model, Baichuan model, Yunque model, vivoLM model, and Wenxin Yiyan, etc., and this embodiment does not limit the scope of the large model.

[0033] This application provides a method, apparatus, computer device, and computer-readable storage medium for handling local area network anomalies in home devices, which will be described in detail below.

[0034] Please see Figure 1 , Figure 1 This is a schematic diagram of a local area network (LAN) anomaly handling system for home appliances provided in an embodiment of this application. The LAN anomaly handling system for home appliances may include a computer device 100, which integrates a LAN anomaly handling device for home appliances, such as... Figure 1 Computer equipment in the country.

[0035] In this embodiment, the computer device 100 is mainly used to acquire local area network (LAN) data information of home devices; the LAN data information of home devices includes several LAN data information to be processed;

[0036] The local area network (LAN) data of the home devices is preprocessed to obtain the first LAN data information; the first LAN data information includes several first processed LAN data information; each first processed LAN data information includes at least one first target LAN data information distributed in sequence.

[0037] The data information of the first local area network is detected, analyzed and processed to obtain the target anomaly detection results.

[0038] It can monitor abnormal conditions in the local area network, improve the accuracy of network status monitoring, thereby improving the efficiency of network anomaly monitoring and repair, and enhancing the user experience of network communication.

[0039] In this embodiment, the computer device 100 can be a standalone server, a server network, or a server cluster. For example, the computer device 100 described in this embodiment includes, but is not limited to, a computer, a network host, a single network server, a set of multiple network servers, or a cloud server composed of multiple servers. The cloud server is composed of a large number of computers or network servers based on cloud computing.

[0040] It is understood that the computer device 100 used in the embodiments of this application can be a device that includes both receiving and transmitting hardware, that is, a device having receiving and transmitting hardware capable of performing bidirectional communication on a bidirectional communication link. Such a device may include: cellular or other communication devices having a single-line display, a multi-line display, or a cellular or other communication device without a multi-line display. Specifically, the computer device 100 may be a desktop terminal or a mobile terminal, and may also be one of a mobile phone, tablet computer, laptop computer, etc.

[0041] Those skilled in the art will understand that Figure 1 The application environment shown is merely one application scenario of the solution in this application and does not constitute a limitation on the application scenario of the solution in this application. Other application environments may include those that are more specific to this application. Figure 1 The number of computer devices shown is more or less, for example Figure 1 Only one computer device is shown in the diagram. It is understood that the LAN anomaly handling system for home devices may also include one or more other services, which are not limited here.

[0042] In addition, such as Figure 1 As shown, the local area network anomaly handling system for home devices may also include a memory 200 for storing data, such as image data, location information, etc.

[0043] It should be noted that, Figure 1The schematic diagram of the local area network (LAN) anomaly handling system for home devices shown is merely an example. The LAN anomaly handling system and scenario described in this application are intended to more clearly illustrate the technical solutions of this application and do not constitute a limitation on the technical solutions provided in this application. As those skilled in the art will know, with the evolution of LAN anomaly handling systems for home devices and the emergence of new business scenarios, the technical solutions provided in this application are also applicable to similar technical problems.

[0044] This invention discloses a method and apparatus for handling local area network (LAN) anomalies in home devices. This method facilitates the monitoring of LAN anomalies, improves the accuracy of network status monitoring, thereby increasing the efficiency of network anomaly monitoring and repair, and enhancing the user experience of network communication. Detailed descriptions follow.

[0045] Example 1

[0046] Please see Figure 2 , Figure 2 This is a flowchart illustrating a method for handling local area network (LAN) anomalies in home devices, as disclosed in an embodiment of the present invention. Figure 2 The described method for handling local area network anomalies in home devices is applied in a management system, such as a local server or cloud server for management, and this embodiment of the invention is not limited thereto. Figure 2 As shown, the method for handling local area network anomalies for home devices may include the following operations:

[0047] 101. Obtain local area network data information for home devices.

[0048] In this embodiment of the invention, the local area network data information of the home device includes several local area network data information to be processed.

[0049] 102. Preprocess the local area network data information of the home devices to obtain the first local area network data information.

[0050] In this embodiment of the invention, the first local area network data information includes a plurality of first processed local area network data information; each first processed local area network data information includes at least one first target local area network data information distributed in sequence.

[0051] 103. Detect and analyze the data information of the first local area network to obtain the target anomaly detection result information.

[0052] It should be noted that the aforementioned local area network (LAN) data information to be processed represents packet information collected under the TCP / IP / MPLS communication mechanism from a home LAN composed of smart home devices (smart TVs, smart air conditioners, smart speakers, smart fans, etc.) and switches, routers, etc., and this embodiment of the invention does not impose limitations on this. Furthermore, the aforementioned packet information can be obtained through crawled network traffic packets. Furthermore, the aforementioned network traffic packets can be crawled using a Prob probe method or a Wireshark method, and this embodiment of the invention does not impose limitations on this.

[0053] It should be noted that the data in the aforementioned local area network data information to be processed can be information such as network protocols and device types, and this embodiment of the invention does not limit it.

[0054] It is evident that implementing the local area network anomaly handling method for home devices described in the embodiments of the present invention is beneficial for monitoring local area network anomalies, improving the accuracy of network status monitoring, thereby improving the efficiency of network anomaly monitoring and repair, and enhancing the user experience of network communication.

[0055] In an optional embodiment, the above-described detection and analysis of the first local area network data information to obtain target anomaly detection result information includes:

[0056] The target anomaly detection model is used to detect and process the data information of the first local area network to obtain data detection result information; the data detection result information includes data detection result information of several local area networks;

[0057] The data detection results are categorized and analyzed to obtain the target anomaly detection results.

[0058] It should be noted that the above-mentioned LAN data detection result information represents the data analysis category corresponding to each LAN data information to be processed, and this embodiment of the invention does not limit this category. Furthermore, the above-mentioned data analysis categories include normal data, abnormal data, data intrusion, and unknown data, and this embodiment of the invention does not limit this category. Furthermore, the above-mentioned normal data indicates that this type of LAN data is a normally flowing data stream, and this embodiment of the invention does not limit this category. Furthermore, the above-mentioned abnormal data indicates that this type of LAN data has anomalies, but not serious data intrusion, and this embodiment of the invention does not limit this category. Furthermore, the above-mentioned data intrusion indicates that the LAN has encountered intrusion by abnormal functions such as Trojans, and this embodiment of the invention does not limit this category. Furthermore, the above-mentioned unknown data indicates a problem with the inability to identify the data, requiring further identification and authentication by the user, and this embodiment of the invention does not limit this category.

[0059] It should be noted that the above-mentioned target anomaly detection result information includes data detection classification result information and data detection alarm information, which are not limited in this embodiment of the invention. Furthermore, the above-mentioned data detection classification result information is a vector representing the data analysis category, which can be [x1,x2,x3,x4] (x1,x2,x3,x4 respectively represent the data detection statistics of normal data, abnormal data, unclear data, and data intrusion), which are not limited in this embodiment of the invention.

[0060] In this optional embodiment, as an optional implementation method, the above-described classification and analysis of data detection results to obtain target anomaly detection results includes:

[0061] The local area network data detection results are classified and statistically analyzed according to the data analysis category to obtain the data detection statistical results. The data detection statistical results include four data detection statistical values.

[0062] The data detection and statistical results are populated according to a preset category vector to obtain the data detection and classification results.

[0063] Determine whether the data detection statistics value corresponding to the fourth vector element in the data detection classification result information is greater than the first detection threshold, and obtain the first detection judgment result;

[0064] When the first detection judgment result is yes, determine whether the data detection statistics value corresponding to the third vector element in the data detection classification result information is greater than the second detection threshold, and obtain the second detection judgment result.

[0065] When the second detection result is yes, a significant local area network anomaly will be used as a data detection alarm message;

[0066] When the second detection result is negative, the intrusion warning will be used as a data detection alarm message;

[0067] When the first detection judgment result is negative, determine whether the data detection statistics value corresponding to the third vector element in the data detection classification result information is greater than the second detection threshold, and obtain the third detection judgment result.

[0068] When the third detection result is yes, the requirement for security detection will be used as a data detection alarm message;

[0069] When the third detection judgment result is negative, determine whether the data detection statistics value corresponding to the second vector element in the data detection classification result information is greater than the third detection threshold, and obtain the fourth detection judgment result.

[0070] When the result of the fourth detection is yes, the security detection will be used as a data detection alarm message;

[0071] If the fourth detection result is negative, network security will be identified as a data detection alarm message.

[0072] It should be noted that the aforementioned first, second, and third detection thresholds can be set by the user, default values ​​given by the system, averaged based on historical first, second, and third detection thresholds, or obtained through data regression or clustering based on empirical data. This embodiment of the invention does not impose any limitations on these thresholds. Furthermore, the fact that the first detection threshold is lower than the second and third detection thresholds indicates that the detection of the home LAN focuses more on the issue of data intrusion, thereby improving the sensitivity of data intrusion detection and ensuring the security of the home LAN. That is, data anomalies and unclear data can be considered minor data problems, but data intrusion can cause serious home LAN failures. Therefore, lowering the judgment threshold increases the system's detection sensitivity. This embodiment of the invention does not impose any limitations on these thresholds.

[0073] It should be noted that the above-mentioned significant anomalies in the local area network indicate that there are serious data communication problems in the local area network, requiring timely intervention to ensure the secure communication of home devices. This embodiment of the invention does not limit this.

[0074] It should be noted that the above intrusion warning indicates that the home LAN may have been invaded by a Trojan horse, requiring antivirus and other treatments to ensure the communication security of the home LAN. This embodiment of the invention does not limit this.

[0075] It should be noted that security testing is required to indicate potential anomalies in the home LAN, and hardware testing needs to be arranged to ensure normal communication between the various device nodes in the home LAN. This embodiment of the invention does not impose any limitations on this.

[0076] It should be noted that the above-mentioned network security characteristics indicate normal communication on the home LAN, and this embodiment of the invention does not limit this.

[0077] It is evident that implementing the local area network anomaly handling method for home devices described in the embodiments of the present invention is beneficial for monitoring local area network anomalies, improving the accuracy of network status monitoring, thereby improving the efficiency of network anomaly monitoring and repair, and enhancing the user experience of network communication.

[0078] In another optional embodiment, the target anomaly detection model includes a first feature extraction module for spatial feature extraction, a second feature extraction module for temporal feature extraction, a feature fusion module, a connection module, and an activation module; wherein,

[0079] The input terminals of the first feature extraction module and the second feature extraction module are configured to receive model input information of the target anomaly detection model; the output terminals of the first feature extraction module and the second feature extraction module are both connected to the input terminal of the feature fusion module; the output terminal of the feature fusion module is connected to the input terminal of the connection module; the output terminal of the connection module is connected to the input terminal of the activation module; the output terminal of the activation module is configured to output the model output information of the target anomaly detection model.

[0080] It should be noted that the target anomaly detection model of this application uses the first feature extraction module and the second feature extraction module to extract information features from local area network data information from both spatial and temporal dimensions. This enables in-depth feature extraction of the two continuous features of data information in both spatial and temporal dimensions, avoiding the problem of insufficient information utilization caused by traditional models that only analyze single-dimensional features. This further enhances the representation ability of features in this application and improves the model's ability to identify abnormal information in local area networks. The embodiments of this invention are not limited.

[0081] It should be noted that the aforementioned first feature extraction module represents a model that extracts features from the spatial dimension, and this embodiment of the invention is not limited thereto. Furthermore, the aforementioned first feature extraction module can be a model built on CNN (used to capture spatial correlations in sequence data, extracting features from local regions by sliding convolutional kernels across the input data; this helps detect local patterns and features in the input sequence; pooling layers are typically added after the CNN layers to reduce the spatial dimension of the data and thus reduce computational complexity), or a model built on graph convolutional neural networks, and this embodiment of the invention is not limited thereto.

[0082] It should be noted that the aforementioned second feature extraction module represents a model that extracts features from the time dimension to mine the contextual temporal information of the time series and further extract feature information. This embodiment of the invention does not impose any limitations on this. Furthermore, the aforementioned first feature extraction module can be a model built with LSTM (used to process the temporal correlation of sequence data, which is a recurrent neural network that can remember and learn the long-term dependencies of the input sequence. The LSTM layer manages the flow and memory of information through gating units, which enables the model to adapt to input data of different time steps), or a model built based on the Autoregressive Integral Moving Average (ARIMA) model. This embodiment of the invention does not impose any limitations on this.

[0083] It should be noted that the above-mentioned connection module is built on a fully connected layer, and this embodiment of the invention does not limit it.

[0084] It should be noted that the above activation module can be constructed based on the softmax activation function or the ReLU activation function, and the embodiments of the present invention are not limited thereto.

[0085] It is evident that implementing the local area network anomaly handling method for home devices described in the embodiments of the present invention is beneficial for monitoring local area network anomalies, improving the accuracy of network status monitoring, thereby improving the efficiency of network anomaly monitoring and repair, and enhancing the user experience of network communication.

[0086] In yet another optional embodiment, the feature fusion module includes a first sampling unit, a first pooling unit, a second pooling unit, a multi-head attention unit, a first fusion unit, a second fusion unit, and a third fusion unit; wherein,

[0087] The input terminals of the first sampling unit and the second fusion unit are both connected to the output terminal of the first feature extraction module; the output terminal of the first sampling unit is connected to the input terminal of the first pooling unit; the output terminal of the first pooling unit is connected to the input terminal of the multi-head attention unit; the input terminals of the second pooling unit and the first fusion unit are both connected to the input terminal of the second feature extraction module; the output terminal of the second pooling unit is connected to the input terminal of the multi-head attention unit; the output terminals of the multi-head attention unit are respectively connected to the input terminals of the first fusion unit, the second fusion unit, and the third fusion unit; the output terminal of the first fusion unit is connected to the input terminal of the third fusion unit; the output terminal of the second fusion unit is connected to the input terminal of the third fusion unit; the output terminal of the third fusion unit is connected to the input terminal of the connection module.

[0088] It should be noted that the first fusion unit and the second fusion unit mentioned above are computation modules constructed based on element-wise multiplication operations, and this embodiment of the invention does not limit them.

[0089] It should be noted that the third fusion unit mentioned above is a calculation module built based on element-wise addition operations, and this embodiment of the invention does not limit it.

[0090] It should be noted that the first pooling unit and the second pooling unit mentioned above are both constructed based on the average pooling operation, so as to facilitate the integration of feature data of different dimensions by the multi-head attention unit. This embodiment of the invention does not limit this.

[0091] It should be noted that the aforementioned multi-head attention unit is constructed based on the cross-attention module, and this embodiment of the invention is not limited thereto. Furthermore, the output of the first pooling unit is connected to the K and V keys of the multi-head attention unit, and the output of the second pooling unit is connected to the Q key of the multi-head attention unit, and this embodiment of the invention is not limited thereto, thereby realizing multi-head attention analysis of the associated semantics in both spatial and temporal dimensions, and this embodiment of the invention is not limited thereto.

[0092] It should be noted that the first sampling unit described above is constructed based on downsampling operations, and this embodiment of the invention does not impose limitations on it. Furthermore, the processing by the first sampling unit can ensure that the spatial dimension feature data extracted by the first feature extraction module remains the same size as the temporal dimension feature data extracted by the second feature extraction module, and this embodiment of the invention does not impose limitations on it.

[0093] It should be noted that the above-mentioned processing through the feature fusion module can achieve dynamic fusion of spatial and temporal features, so as to facilitate more in-depth feature extraction and analysis of local area network data information. This embodiment of the invention does not limit the scope of the invention.

[0094] It is evident that implementing the local area network anomaly handling method for home devices described in the embodiments of the present invention is beneficial for monitoring local area network anomalies, improving the accuracy of network status monitoring, thereby improving the efficiency of network anomaly monitoring and repair, and enhancing the user experience of network communication.

[0095] In another alternative embodiment, the target anomaly detection model is obtained by training the basic anomaly detection model based on the loss function model;

[0096] The loss function model is as follows:

[0097] ;

[0098] In the formula, Characterize the value of the loss function; and These respectively characterize the coefficients of the first loss function and the coefficients of the second loss function; The true labels corresponding to the training samples of the input basic anomaly detection model; Characterize the predicted labels output by the basic anomaly detection model.

[0099] It should be noted that the model architecture of the basic anomaly detection model and the target anomaly detection model described above is consistent, and this embodiment of the invention does not impose any limitations on them. Furthermore, the target anomaly detection model described above is obtained by optimizing the parameters of the basic anomaly detection model after training it, and this embodiment of the invention does not impose any limitations on it.

[0100] It should be noted that the above-mentioned real labels represent the actual labeled values ​​of network anomalies in the training samples, and this embodiment of the invention does not limit the scope of the examples. Furthermore, the above-mentioned training samples can be user-annotated traffic packets, or they can be composed of general datasets consisting of Normal, U2R, and other traffic data, such as those selected from the NSL-KDD dataset, and this embodiment of the invention does not limit the scope of the examples.

[0101] It should be noted that the above-mentioned predicted labels represent the anomaly prediction probability of local area network detection output by the basic anomaly detection model, and this embodiment of the invention does not limit the scope of the anomaly prediction.

[0102] It should be noted that the above loss function value is used to analyze and determine whether the basic anomaly detection model has been trained. It can be analyzed and determined whether the model has been trained by whether the data composed of the loss function value and the historical loss function value converges. If the data converges, it can be determined that the model has been trained and the target anomaly detection model can be obtained. This embodiment of the invention does not limit the scope of the invention.

[0103] It should be noted that the sum of the first loss function coefficient and the second loss function coefficient is 1, which is not limited in this embodiment of the invention. Furthermore, the first loss function coefficient is a positive number between 0 and 0.5, which is not limited in this embodiment of the invention.

[0104] It is evident that implementing the local area network anomaly handling method for home devices described in the embodiments of the present invention is beneficial for monitoring local area network anomalies, improving the accuracy of network status monitoring, thereby improving the efficiency of network anomaly monitoring and repair, and enhancing the user experience of network communication.

[0105] In an optional embodiment, the above-described preprocessing of the home device LAN data information to obtain the first LAN data information includes:

[0106] Obtain the segmentation conversion threshold and conversion sign;

[0107] For any local area network (LAN) data information to be processed in the LAN data information of home devices, the LAN data information to be processed is segmented and transformed using a segmentation and transformation threshold and a transformation symbol to obtain the LAN data information to be used corresponding to the LAN data information to be processed; the LAN data information to be used includes at least one LAN sub-data information to be used in a sequentially distributed manner.

[0108] The local area network (LAN) data information to be processed is vectorized to obtain the first processed LAN data information corresponding to the LAN data information to be processed.

[0109] It should be noted that the above conversion symbols represent binary symbols, which can be 0 or 1, and can be set by the user according to actual needs. This embodiment of the invention does not limit this.

[0110] It should be noted that the above segmentation and transformation threshold represents the length of vector data that the target anomaly detection model can process, and it is usually an integer multiple of 8. This embodiment of the invention does not limit this.

[0111] It should be noted that the above-mentioned vectorization processing of the local area network data information to be used is to vectorize the local area network sub-data information representing the text type. This can be implemented based on the Doc2Vec model or based on a fine-tuned large model. This embodiment of the invention does not limit the specific implementation.

[0112] It is evident that implementing the local area network anomaly handling method for home devices described in the embodiments of the present invention is beneficial for monitoring local area network anomalies, improving the accuracy of network status monitoring, thereby improving the efficiency of network anomaly monitoring and repair, and enhancing the user experience of network communication.

[0113] In another optional embodiment, the local area network (LAN) data information to be processed is segmented and transformed using a segmentation and transformation threshold and a transformation symbol to obtain the LAN data information to be used corresponding to the LAN data information to be processed, including:

[0114] Determine whether the length of the local area network data information corresponding to the local area network data information to be processed is less than the segmentation and conversion threshold, and obtain the first length judgment result;

[0115] When the first length judgment result is yes, the conversion symbol is filled into the front end of the local area network data information to be processed, and the local area network sub-data information to be used corresponding to the local area network data information to be processed is obtained.

[0116] If the first length judgment result is negative, determine whether the length of the local area network data information is equal to the segmentation and conversion threshold, and obtain the second length judgment result.

[0117] When the second length determination result is yes, the local area network data information to be processed is determined as the local area network sub-data information to be used corresponding to the local area network data information to be processed.

[0118] When the second length judgment result is negative, the local area network data information to be processed is segmented from left to right based on the segmentation and conversion threshold to obtain several sequentially distributed local area network sub-data information to be used.

[0119] Determine whether the length of the local area network data information corresponding to the last sorted local area network sub-data information is less than the segmentation and conversion threshold to obtain the third length judgment result;

[0120] When the result of the third length judgment is yes, the conversion symbol is filled into the front of the last sorted local area network sub-data information to obtain the new last sorted local area network sub-data information.

[0121] If the result of the third length determination is negative, the segmentation and conversion process corresponding to the local area network data information to be processed ends.

[0122] It should be noted that the above-mentioned segmentation and transformation processing of the local area network data information to be processed using segmentation and transformation threshold and transformation symbol is to convert the data into a data sequence of a specific length that can be processed by the target anomaly detection model. This embodiment of the invention does not limit this.

[0123] It should be noted that, when the data length is less than the segmentation and conversion threshold, this application pads the conversion symbol before the data so that the data length reaches the segmentation and conversion threshold, so that the target anomaly detection model can perform effective processing. This embodiment of the invention does not limit this.

[0124] It should be noted that, when the data length is greater than the segmentation and conversion threshold, the data is divided into equal length segments (data length = segmentation and conversion threshold) from left to right according to the segmentation and conversion threshold to obtain the corresponding local area network sub-data information to be used. The data length of the last local area network sub-data information to be used is analyzed to determine whether to add conversion symbols, thereby ensuring that the data can be effectively processed by the target anomaly detection model, and thus achieving effective detection of anomalies in the local area network. This embodiment of the invention does not limit the scope of the invention.

[0125] It is evident that implementing the local area network anomaly handling method for home devices described in the embodiments of the present invention is beneficial for monitoring local area network anomalies, improving the accuracy of network status monitoring, thereby improving the efficiency of network anomaly monitoring and repair, and enhancing the user experience of network communication.

[0126] Example 2

[0127] Please see Figure 3 , Figure 3 This is a schematic diagram of a local area network (LAN) anomaly handling device for home appliances disclosed in an embodiment of the present invention. Figure 3 The described apparatus can be applied in management systems, such as local servers or cloud servers for management, and the embodiments of the present invention are not limited thereto. Figure 3 As shown, the device may include:

[0128] The acquisition module 201 is used to acquire local area network (LAN) data information of home devices; the LAN data information of home devices includes several LAN data information to be processed;

[0129] The first processing module 202 is used to preprocess the local area network data information of the home device to obtain the first local area network data information; the first local area network data information includes a number of first processed local area network data information; each first processed local area network data information includes at least one first target local area network data information distributed in sequence.

[0130] The second processing module 203 is used to detect, analyze and process the data information of the first local area network to obtain the target anomaly detection result information.

[0131] It is evident that implementation Figure 3 The described local area network (LAN) anomaly handling device for home appliances is beneficial for monitoring LAN anomalies, improving the accuracy of network status monitoring, thereby increasing the efficiency of network anomaly monitoring and repair, and enhancing the user experience of network communication.

[0132] In another alternative embodiment, such as Figure 3 As shown, the first processing module 202 performs detection and analysis on the first local area network data information to obtain target anomaly detection result information, including:

[0133] The target anomaly detection model is used to detect and process the data information of the first local area network to obtain data detection result information; the data detection result information includes data detection result information of several local area networks;

[0134] The data detection results are categorized and analyzed to obtain the target anomaly detection results.

[0135] It is evident that implementation Figure 3 The described local area network (LAN) anomaly handling device for home appliances is beneficial for monitoring LAN anomalies, improving the accuracy of network status monitoring, thereby increasing the efficiency of network anomaly monitoring and repair, and enhancing the user experience of network communication.

[0136] In yet another alternative embodiment, such as Figure 3 As shown, the target anomaly detection model includes a first feature extraction module for spatial feature extraction, a second feature extraction module for temporal feature extraction, a feature fusion module, a connection module, and an activation module; among which,

[0137] The input terminals of the first feature extraction module and the second feature extraction module are configured to receive model input information of the target anomaly detection model; the output terminals of the first feature extraction module and the second feature extraction module are both connected to the input terminal of the feature fusion module; the output terminal of the feature fusion module is connected to the input terminal of the connection module; the output terminal of the connection module is connected to the input terminal of the activation module; the output terminal of the activation module is configured to output the model output information of the target anomaly detection model.

[0138] It is evident that implementation Figure 3 The described local area network (LAN) anomaly handling device for home appliances is beneficial for monitoring LAN anomalies, improving the accuracy of network status monitoring, thereby increasing the efficiency of network anomaly monitoring and repair, and enhancing the user experience of network communication.

[0139] In yet another alternative embodiment, such as Figure 3As shown, the feature fusion module includes a first sampling unit, a first pooling unit, a second pooling unit, a multi-head attention unit, a first fusion unit, a second fusion unit, and a third fusion unit; wherein,

[0140] The input terminals of the first sampling unit and the second fusion unit are both connected to the output terminal of the first feature extraction module; the output terminal of the first sampling unit is connected to the input terminal of the first pooling unit; the output terminal of the first pooling unit is connected to the input terminal of the multi-head attention unit; the input terminals of the second pooling unit and the first fusion unit are both connected to the input terminal of the second feature extraction module; the output terminal of the second pooling unit is connected to the input terminal of the multi-head attention unit; the output terminals of the multi-head attention unit are respectively connected to the input terminals of the first fusion unit, the second fusion unit, and the third fusion unit; the output terminal of the first fusion unit is connected to the input terminal of the third fusion unit; the output terminal of the second fusion unit is connected to the input terminal of the third fusion unit; the output terminal of the third fusion unit is connected to the input terminal of the connection module.

[0141] It is evident that implementation Figure 3 The described local area network (LAN) anomaly handling device for home appliances is beneficial for monitoring LAN anomalies, improving the accuracy of network status monitoring, thereby increasing the efficiency of network anomaly monitoring and repair, and enhancing the user experience of network communication.

[0142] In yet another alternative embodiment, such as Figure 3 As shown, the target anomaly detection model is obtained by training the basic anomaly detection model based on the loss function model;

[0143] The loss function model is as follows:

[0144] ;

[0145] In the formula, Characterize the value of the loss function; and These respectively characterize the coefficients of the first loss function and the coefficients of the second loss function; The true labels corresponding to the training samples of the input basic anomaly detection model; Characterize the predicted labels output by the basic anomaly detection model.

[0146] It is evident that implementation Figure 3 The described local area network (LAN) anomaly handling device for home appliances is beneficial for monitoring LAN anomalies, improving the accuracy of network status monitoring, thereby increasing the efficiency of network anomaly monitoring and repair, and enhancing the user experience of network communication.

[0147] In yet another alternative embodiment, such as Figure 3As shown, the second processing module 203 preprocesses the home appliance LAN data information to obtain the first LAN data information, including:

[0148] Obtain the segmentation conversion threshold and conversion sign;

[0149] For any local area network (LAN) data information to be processed in the LAN data information of home devices, the LAN data information to be processed is segmented and transformed using a segmentation and transformation threshold and a transformation symbol to obtain the LAN data information to be used corresponding to the LAN data information to be processed; the LAN data information to be used includes at least one LAN sub-data information to be used in a sequentially distributed manner.

[0150] The local area network (LAN) data information to be processed is vectorized to obtain the first processed LAN data information corresponding to the LAN data information to be processed.

[0151] It is evident that implementation Figure 3 The described local area network (LAN) anomaly handling device for home appliances is beneficial for monitoring LAN anomalies, improving the accuracy of network status monitoring, thereby increasing the efficiency of network anomaly monitoring and repair, and enhancing the user experience of network communication.

[0152] In yet another alternative embodiment, such as Figure 3 As shown, the second processing module 203 uses a segmentation and conversion threshold and a conversion symbol to perform segmentation and conversion processing on the local area network data information to be processed, to obtain the local area network data information to be used corresponding to the local area network data information to be processed, including:

[0153] Determine whether the length of the local area network data information corresponding to the local area network data information to be processed is less than the segmentation and conversion threshold, and obtain the first length judgment result;

[0154] When the first length judgment result is yes, the conversion symbol is filled into the front end of the local area network data information to be processed, and the local area network sub-data information to be used corresponding to the local area network data information to be processed is obtained.

[0155] If the first length judgment result is negative, determine whether the length of the local area network data information is equal to the segmentation and conversion threshold, and obtain the second length judgment result.

[0156] When the second length determination result is yes, the local area network data information to be processed is determined as the local area network sub-data information to be used corresponding to the local area network data information to be processed.

[0157] When the second length judgment result is negative, the local area network data information to be processed is segmented from left to right based on the segmentation and conversion threshold to obtain several sequentially distributed local area network sub-data information to be used.

[0158] Determine whether the length of the local area network data information corresponding to the last sorted local area network sub-data information is less than the segmentation and conversion threshold to obtain the third length judgment result;

[0159] When the result of the third length judgment is yes, the conversion symbol is filled into the front of the last sorted local area network sub-data information to obtain the new last sorted local area network sub-data information.

[0160] If the result of the third length determination is negative, the segmentation and conversion process corresponding to the local area network data information to be processed ends.

[0161] It is evident that implementation Figure 3 The described local area network (LAN) anomaly handling device for home appliances is beneficial for monitoring LAN anomalies, improving the accuracy of network status monitoring, thereby increasing the efficiency of network anomaly monitoring and repair, and enhancing the user experience of network communication.

[0162] Example 3

[0163] Please see Figure 4 , Figure 4 This is a schematic diagram of another local area network (LAN) anomaly handling device for home appliances disclosed in an embodiment of the present invention. Figure 4 The described apparatus can be applied in management systems, such as local servers or cloud servers for management, and the embodiments of the present invention are not limited thereto. Figure 4 As shown, the device may include:

[0164] Memory 301 storing executable program code;

[0165] Processor 302 coupled to memory 301;

[0166] The processor 302 calls the executable program code stored in the memory 301 to execute the steps in the local area network anomaly handling method for home devices described in Embodiment 1.

[0167] Example 4

[0168] This invention discloses a computer-readable storage medium storing a computer program for electronic data interchange, wherein the computer program causes a computer to execute the steps in the method for handling local area network anomalies for home devices described in Embodiment 1.

[0169] Example 5

[0170] This invention discloses a computer program product, which includes a non-transitory computer-readable storage medium storing a computer program, and the computer program is operable to cause a computer to perform the steps in the local area network anomaly handling method for home devices described in Embodiment 1.

[0171] The device embodiments described above are merely illustrative. The modules described as separate components may or may not be physically separate, and the components shown as modules may or may not be physical modules; that is, they may be located in one place or distributed across multiple network modules. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0172] Through the detailed description of the above embodiments, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, including read-only memory (ROM), random access memory (RAM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), one-time programmable read-only memory (OTPROM), electrically-Erasable Programmable Read-Only Memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disc storage, disk storage, magnetic tape storage, or any other computer-readable medium that can be used to carry or store data.

[0173] Finally, it should be noted that the method and apparatus for handling local area network anomalies in home devices disclosed in the embodiments of the present invention are merely preferred embodiments of the present invention and are only used to illustrate the technical solutions of the present invention, not to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for handling local area network anomalies in home devices, characterized in that, The method includes: Acquire local area network (LAN) data information of home devices; the LAN data information of home devices includes several LAN data information to be processed; The home appliance local area network (LAN) data information is preprocessed to obtain first LAN data information; the first LAN data information includes several first processed LAN data information; each first processed LAN data information includes at least one sequentially distributed first target LAN data information; the preprocessing of the home appliance LAN data information to obtain the first LAN data information includes: Obtain the segmentation conversion threshold and conversion sign; For any of the local area network data information to be processed in the home device local area network data information, the local area network data information to be processed is segmented and transformed using the segmentation and transformation threshold and the transformation symbol to obtain the local area network data information to be used corresponding to the local area network data information to be processed; the local area network data information to be used includes at least one sequentially distributed local area network sub-data information to be used. The step of segmenting and converting the local area network (LAN) data information to be processed using the segmentation and conversion threshold and the conversion symbol to obtain the LAN data information to be used corresponding to the LAN data information to be processed includes: Determine whether the length of the local area network data information corresponding to the local area network data information to be processed is less than the segmentation and conversion threshold, and obtain the first length determination result; When the first length determination result is yes, the conversion symbol is filled into the front end of the local area network data information to be processed to obtain the local area network sub-data information to be used corresponding to the local area network data information to be processed. When the first length determination result is negative, determine whether the length of the local area network data information is equal to the segmentation and conversion threshold to obtain the second length determination result; When the second length determination result is yes, the local area network data information to be processed is determined as the local area network sub-data information to be used corresponding to the local area network data information to be processed. When the second length judgment result is negative, based on the segmentation and conversion threshold, the local area network data information to be processed is segmented from left to right to obtain several sequentially distributed local area network sub-data information to be used corresponding to the local area network data information to be processed. Determine whether the length of the local area network data information corresponding to the last sorted local area network sub-data information is less than the segmentation and conversion threshold to obtain the third length judgment result; When the third length determination result is yes, the conversion symbol is filled into the front of the last sorted local area network sub-data information to obtain the new last sorted local area network sub-data information; When the third length determination result is negative, the segmentation and conversion processing flow corresponding to the local area network data information to be processed ends; the local area network data information to be processed includes at least one sequentially distributed local area network sub-data information; The local area network data information to be used is vectorized to obtain the first processed local area network data information corresponding to the local area network data information to be processed; The target anomaly detection model is used to detect and process the data information of the first local area network to obtain the target anomaly detection result information; the target anomaly detection model includes a first feature extraction module for feature extraction from the spatial dimension, a second feature extraction module for feature extraction from the temporal dimension, a feature fusion module, a connection module, and an activation module.

2. The method for handling local area network anomalies for home devices according to claim 1, characterized in that, The step of using a target anomaly detection model to detect and process the data information of the first local area network to obtain target anomaly detection result information includes: The target anomaly detection model is used to detect and process the data information of the first local area network to obtain data detection result information; the data detection result information includes several local area network data detection result information. The data detection results are categorized and analyzed to obtain target anomaly detection results.

3. The method for handling local area network anomalies for home devices according to claim 2, characterized in that, The input terminals of the first feature extraction module and the second feature extraction module are configured to receive model input information of the target anomaly detection model; the output terminals of the first feature extraction module and the second feature extraction module are both connected to the input terminal of the feature fusion module; the output terminal of the feature fusion module is connected to the input terminal of the connection module; the output terminal of the connection module is connected to the input terminal of the activation module; the output terminal of the activation module is configured to output the model output information of the target anomaly detection model.

4. The method for handling local area network anomalies for home devices according to claim 3, characterized in that, The feature fusion module includes a first sampling unit, a first pooling unit, a second pooling unit, a multi-head attention unit, a first fusion unit, a second fusion unit, and a third fusion unit; wherein, The input terminals of the first sampling unit and the second fusion unit are both connected to the output terminal of the first feature extraction module; the output terminal of the first sampling unit is connected to the input terminal of the first pooling unit; the output terminal of the first pooling unit is connected to the input terminal of the multi-head attention unit; the input terminals of the second pooling unit and the first fusion unit are both connected to the input terminal of the second feature extraction module; the output terminal of the second pooling unit is connected to the input terminal of the multi-head attention unit; the output terminal of the multi-head attention unit is connected to the input terminals of the first fusion unit, the second fusion unit, and the third fusion unit, respectively; the output terminal of the first fusion unit is connected to the input terminal of the third fusion unit; the output terminal of the second fusion unit is connected to the input terminal of the third fusion unit; and the output terminal of the third fusion unit is connected to the input terminal of the connection module.

5. The method for handling local area network anomalies for home devices according to claim 2, characterized in that, The target anomaly detection model is obtained by training the basic anomaly detection model based on the loss function model; The loss function model is as follows: ； In the formula, Characterize the value of the loss function; and These respectively characterize the coefficients of the first loss function and the coefficients of the second loss function; The true labels corresponding to the training samples input into the basic anomaly detection model; The predicted label is characterized by the output of the basic anomaly detection model.

6. A local area network anomaly handling device for home appliances, characterized in that, The device includes: The acquisition module is used to acquire local area network (LAN) data information of home devices; the LAN data information of home devices includes several LAN data information to be processed; A first processing module is used to preprocess the home device local area network (LAN) data information to obtain first LAN data information; the first LAN data information includes a plurality of first processed LAN data information; each first processed LAN data information includes at least one sequentially distributed first target LAN data information; the specific method by which the first processing module preprocesses the home device LAN data information to obtain the first LAN data information includes: Obtain the segmentation conversion threshold and conversion sign; For any of the local area network data information to be processed in the home device local area network data information, the local area network data information to be processed is segmented and transformed using the segmentation and transformation threshold and the transformation symbol to obtain the local area network data information to be used corresponding to the local area network data information to be processed; the local area network data information to be used includes at least one sequentially distributed local area network sub-data information to be used. The first processing module uses the segmentation and conversion threshold and the conversion symbol to segment and convert the local area network data information to be processed, and obtains the corresponding local area network data information to be used in a specific way, including: Determine whether the length of the local area network data information corresponding to the local area network data information to be processed is less than the segmentation and conversion threshold, and obtain the first length determination result; When the first length determination result is yes, the conversion symbol is filled into the front end of the local area network data information to be processed to obtain the local area network sub-data information to be used corresponding to the local area network data information to be processed. When the first length determination result is negative, determine whether the length of the local area network data information is equal to the segmentation and conversion threshold to obtain the second length determination result; When the second length determination result is yes, the local area network data information to be processed is determined as the local area network sub-data information to be used corresponding to the local area network data information to be processed. When the second length judgment result is negative, based on the segmentation and conversion threshold, the local area network data information to be processed is segmented from left to right to obtain several sequentially distributed local area network sub-data information to be used corresponding to the local area network data information to be processed. Determine whether the length of the local area network data information corresponding to the last sorted local area network sub-data information is less than the segmentation and conversion threshold to obtain the third length judgment result; When the third length determination result is yes, the conversion symbol is filled into the front of the last sorted local area network sub-data information to obtain the new last sorted local area network sub-data information; When the third length determination result is negative, the segmentation and conversion processing flow corresponding to the local area network data information to be processed ends; the local area network data information to be processed includes at least one sequentially distributed local area network sub-data information; The local area network data information to be used is vectorized to obtain the first processed local area network data information corresponding to the local area network data information to be processed; The second processing module is used to detect and process the first local area network data information using the target anomaly detection model to obtain target anomaly detection result information; the target anomaly detection model includes a first feature extraction module for feature extraction from the spatial dimension, a second feature extraction module for feature extraction from the temporal dimension, a feature fusion module, a connection module, and an activation module.

7. A local area network anomaly handling device for home appliances, characterized in that, The device includes: Memory containing executable program code; A processor coupled to the memory; The processor calls the executable program code stored in the memory to execute the local area network anomaly handling method for home devices as described in any one of claims 1-5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions, which, when invoked, are used to execute the local area network anomaly handling method for home devices as described in any one of claims 1-5.

Images