Update anomaly detection method

Abstract

The invention relates to the technical field of network security, in particular to an update anomaly detection method. The method comprises the steps of receiving update data of a first time window; determining a plurality of abnormal feature values of the update data of the first time window, wherein the plurality of abnormal feature values are respectively used for representing data transmission states of the update data in a plurality of dimensions; processing the plurality of abnormal characteristic values based on an abnormal detection model, and determining whether the update data of the first time window is abnormal or not; wherein the anomaly detection model is obtained by performing multiple rounds of training based on a training sample set, training samples are obtained from the training sample set based on the maximum sample number in each round of training process, and each training sample comprises a feature sample of training data corresponding to a preset duration and an anomaly label; the maximum number of samples used in each round of training is determined based on the training samples used in the last round of training or the model error rate after the last round of training.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to an update anomaly detection method. Background Art

[0002] OTA updates are commonly used for devices such as smartphones and smart cars that need to receive regular feature updates, security patches, or configuration changes. This technology allows device manufacturers or service providers to remotely update devices without physical contact with the devices, thus simplifying the maintenance and management process of the devices.

[0003] When IoT devices are updated OTA, they need to receive a large amount of data, making the upgrade process vulnerable to security threats such as malicious attacks, data tampering, and man-in-the-middle attacks.

[0004] Therefore, how to improve the security of IoT device updates has become a technical problem that needs to be solved urgently. Summary of the invention

[0005] The present application provides an update anomaly detection method to improve the security of IoT device update processes.

[0006] In a first aspect, the present application provides an update anomaly detection method, the method comprising:

[0007] Receiving update data of a first time window; the duration of the first time window is a preset duration;

[0008] Determine a plurality of abnormal characteristic values ​​of the update data of the first time window, wherein the plurality of abnormal characteristic values ​​are respectively used to characterize data transmission states of the update data in a plurality of dimensions;

[0009] Processing the multiple abnormal feature values ​​based on an abnormality detection model to determine whether the updated data in the first time window is abnormal;

[0010] Among them, the anomaly detection model is obtained by performing multiple rounds of training based on the training sample set. In each round of training, training samples are obtained from the training sample set based on the maximum number of samples, and each training sample includes a feature sample of training data corresponding to a preset time length and an anomaly label; the maximum number of samples used in each round of training is determined based on the training samples used in the previous round of training or the model error rate after the previous round of training.

[0011] The above scheme extracts multiple abnormal feature values ​​from the update data to detect and monitor the unique network traffic characteristics during OTA updates, and combines the anomaly detection model to realize abnormal judgment during the update process. The anomaly detection model is obtained by adaptively adjusting the dynamic strategy of the maximum number of samples to improve the robustness and detection efficiency of the model.

[0012] In some optional implementations, the multiple abnormal feature values ​​include part or all of an expected offset feature value, a response duration feature value, a rate change feature value, and an integrity feature value;

[0013] The expected offset characteristic value is determined according to the integrity detection result of the data packet included in the update data of the first time window, the data volume of the update data of the first time window, and the expected data volume;

[0014] The response duration characteristic value is determined according to the data volume of the update data in the first time window and the data transmission duration of the update data in the first time window;

[0015] The rate change characteristic value is determined according to the data transmission rate of the update data of the first time window and the data transmission rate of the update data of the second time window; the receiving time of the update data of the second time window is earlier than the receiving time of the update data of the first time window;

[0016] The integrity feature value is the product of the integrity detection result of the data packet included in the update data of the first time window and the data volume of the first time window.

[0017] In some optional implementations, the maximum number of samples used in each round of training is determined in the following manner:

[0018] Determine a target abnormal state among multiple abnormal states based on the data volume of training samples used in the previous round of training and / or the model error rate after the previous round of training;

[0019] The maximum number of samples used in the previous round of training is adjusted based on the adjustment method corresponding to the target abnormal state to obtain the maximum number of samples used in the current round of training.

[0020] In some optional implementations, the multiple abnormal states include data volume abnormality, data complexity abnormality, data change abnormality and model detection abnormality; the target abnormal state is determined from the multiple abnormal states based on the data volume of the training samples used in the previous round of training and / or the model error rate after the previous round of training, including:

[0021] According to the priority order of multiple abnormal states, determine in turn whether the training samples used in the previous round of training meet the data volume abnormality, data complexity abnormality and data change abnormality; when it is determined that any abnormal state is met, use the any abnormal state as the target abnormal state;

[0022] If it does not meet the data volume anomaly, data complexity anomaly and data change anomaly, determine whether the model error rate after the previous round of training meets the model detection anomaly;

[0023] If the model detection anomaly is met, the model detection anomaly is used as the target abnormal state.

[0024] In some optional implementations, whether the data volume is abnormal is determined by:

[0025] The data volume of the training samples used in the previous round of training is compared with the preset data volume threshold; if it is greater than the first data volume threshold or less than the second data volume threshold, it is determined that the data volume anomaly is met, and the first data volume threshold is not less than the second data volume threshold.

[0026] In some optional implementations, whether the data complexity anomaly is met is determined by:

[0027] Compare the complexity of the training samples used in the previous round of training with the complexity threshold; if it is greater than the first complexity threshold or less than the second complexity threshold, it is determined to meet the data complexity anomaly, and the first complexity threshold is not less than the second complexity threshold; the complexity of the training samples is determined based on the data amount of the corresponding training samples.

[0028] In some optional implementations, whether the data change is abnormal is determined by:

[0029] Compare the data volumes of the training samples used in the first two rounds of training, or compare the data volumes of every two adjacent training samples used in the last round of training; if they are different, it is determined that the data change is abnormal.

[0030] In some optional implementations, whether the model detection anomaly is met is determined in the following manner:

[0031] The model error rate after the previous round of training is compared with the preset fault tolerance rate. If it is greater than the first fault tolerance rate or less than the second fault tolerance rate, it is determined that the model detection anomaly is met, and the first fault tolerance rate is not less than the second fault tolerance rate.

[0032] In some optional implementations, the adjusting the maximum number of samples used in the previous round of training based on the adjustment method corresponding to the target abnormal state includes:

[0033] When the target abnormal state is data volume abnormality, determining a first adjustment weight based on the difference between the data volumes of training samples used in the first two rounds of training; adjusting the maximum number of samples used in the previous round of training based on the first adjustment weight; or,

[0034] When the target abnormal state is data complexity abnormality, determining a second adjustment weight based on the difference between the complexity of the training samples used in the previous round of training and the complexity threshold; adjusting the maximum number of samples used in the previous round of training based on the second adjustment weight; or,

[0035] When the target abnormal state is abnormal data change, the data amount change is determined by comparing the data amounts of the training samples used in the first two rounds of training, or the data amount of each two adjacent training samples used in the previous round of training is compared to determine the data amount change of each two adjacent training samples, where the data amount change is an increase or no increase in the data amount; based on the third adjustment ratio corresponding to the data amount change, the maximum number of samples used in the previous round of training is adjusted; or,

[0036] When the target abnormal state is a model detection abnormality, the ratio of the model error rate after the previous round of training to the preset fault tolerance rate is used as the fourth adjustment ratio, and the maximum number of samples used in the previous round of training is adjusted based on the fourth adjustment ratio.

[0037] In some optional implementations, if the data amount change is the data amount change of every two adjacent training samples, then adjusting the maximum number of samples used in the previous round of training based on the third adjustment ratio corresponding to the data amount change includes:

[0038] According to the order of the training samples used in the previous round of training, perform the following operations for each training sample used in the previous round of training:

[0039] Determining a third adjustment ratio corresponding to the data volume change based on the data volume change between the training sample and a reference training sample; the reference training sample is a training sample in the training sample in the previous round of training that is located in the next adjacent order of the training sample;

[0040] The current maximum number of samples is adjusted based on the third adjustment ratio, where the current maximum number of samples is the maximum number of samples used in the previous round of training, or the current maximum number of samples is the maximum number of samples adjusted based on the change in data volume of at least two training samples among the training samples used in the previous round of training.

[0041] In a second aspect, an embodiment of the present application provides an update anomaly detection device, the device comprising:

[0042] A receiving module, configured to receive update data of a first time window; the duration of the first time window is a preset duration;

[0043] a determination module, configured to determine a plurality of abnormal characteristic values ​​of the update data of the first time window, wherein the plurality of abnormal characteristic values ​​are respectively used to characterize data transmission states of the update data in a plurality of dimensions;

[0044] A processing module is used to process the multiple abnormal feature values ​​based on an anomaly detection model to determine whether the updated data of the first time window is abnormal; wherein the anomaly detection model is obtained by performing multiple rounds of training based on a training sample set, and in each round of training, training samples are obtained from the training sample set based on a maximum number of samples, and each training sample includes a feature sample of the training data corresponding to a preset time length and an abnormal label; the maximum number of samples used in each round of training is determined based on the training samples used in the previous round of training or the model error rate after the previous round of training.

[0045] In a third aspect, an embodiment of the present application provides an electronic device, comprising at least one processor and at least one memory, wherein the memory stores a computer program, and when the program is executed by the processor, the processor executes the steps of any method described in the first aspect above.

[0046] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium storing a computer program executable by a processor, wherein when the program runs on the processor, the processor executes the steps of any of the methods described in the first aspect.

[0047] In a fifth aspect, an embodiment of the present application provides a computer program product, comprising a computer program, wherein the computer program is stored in a computer-readable storage medium; when a processor of an electronic device reads the computer program from the computer-readable storage medium, the processor executes the computer program, so that the electronic device performs the steps of any method described in the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0049] Figure 1 A schematic diagram of an application scenario of an update anomaly detection method provided in an embodiment of the present application;

[0050] Figure 2 A flowchart of an update anomaly detection method provided in an embodiment of the present application;

[0051] Figure 3A schematic diagram of the relationship between a training sample and training data provided in an embodiment of the present application;

[0052] Figure 4 A flowchart for determining the maximum number of samples used in each round of training provided in an embodiment of the present application;

[0053] Figure 5 A flowchart for determining an abnormal state of a target provided in an embodiment of the present application;

[0054] Figure 6 A flowchart for adjusting the maximum number of samples provided in an embodiment of the present application;

[0055] Figure 7 An overall flow chart provided for an embodiment of the present application;

[0056] Figure 8 A schematic diagram of an update anomaly detection device provided in an embodiment of the present application;

[0057] Fig. 9 An electronic device provided in an embodiment of the present application;

[0058] Fig.10 An electronic device is provided in an embodiment of the present application. DETAILED DESCRIPTION

[0059] In order to make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Among them, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0060] Furthermore, in the description of the embodiments of the present application, unless otherwise specified, “and” means or. For example, A / B can mean A or B. The “and / or” in the text is merely a description of the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone.

[0061] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features. In the description of this application, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0062] In the description of this application, it should be noted that, unless otherwise clearly specified and limited, the term "connection" should be understood in a broad sense, for example, it can be directly connected, or indirectly connected through an intermediate medium, or it can be the internal connection of two devices. For ordinary technicians in this field, the specific meanings of the above terms in this application can be understood according to specific circumstances.

[0063] In order to facilitate understanding of the method, device, and electronic device for obtaining user information by a microservice provided in an embodiment of the present application, some terms in the embodiments of the present application are explained below to facilitate understanding by those skilled in the art.

[0064] OTA (Over-the-Air) refers to the technology of remotely updating, configuring or managing the software, firmware or configuration information of a device through a wireless communication network. OTA updates are usually used for devices such as smartphones and smart cars that need to receive functional updates, security patches or configuration changes regularly. This technology allows device manufacturers or service providers to remotely update devices without physical contact with the devices, thereby simplifying the maintenance and management process of the devices.

[0065] Isolation Forest is an efficient unsupervised anomaly detection algorithm that recursively segments data and calculates the path length of data points to determine whether they are outliers. Due to its high computational efficiency, applicability to high-dimensional data, and the lack of pre-defined normal behavior, Isolation Forest has a wide range of applications in network security, financial fraud, industrial monitoring, and other fields.

[0066] max_samples: As a parameter of Isolation Forest that controls the maximum number of samples used by each tree, it determines the tree building speed and the detection accuracy of the model.

[0067] Reference Figure 1 , a schematic diagram of an application scenario of an update anomaly detection method according to an embodiment of the present application. Figure 1 As shown, the scenario includes a target IoT device 10 and a server 11.

[0068] Among them, the IoT devices are personal computers, smart phones, tablet computers, notebooks, e-book readers, intelligent voice interaction devices, smart homes, smart cars, vehicle-mounted terminals and other computer devices with certain computing capabilities and communication functions. The target IoT device 10 is an IoT device that needs to receive function updates, security patches or configuration changes. The server 11 can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides cloud services, cloud databases, cloud computing, cloud storage, cloud functions, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDN), as well as basic cloud computing services such as big data and artificial intelligence platforms.

[0069] It should be noted that Figure 1 The figure is only an example. In fact, the number of target IoT devices and servers is not limited and is not specifically limited in the embodiments of the present application.

[0070] The following describes the update anomaly detection method provided by the exemplary embodiment of the present application in combination with the application scenario described above and with reference to the accompanying drawings. It should be noted that the above application scenario is only shown to facilitate understanding of the spirit and principles of the present application, and the implementation of the present application is not limited in this respect.

[0071] See also Figure 2 FIG. 1 is a flowchart of an update anomaly detection method in an embodiment of the present application, and the specific steps are as follows:

[0072] Step S201, receiving update data of a first time window; the duration of the first time window is a preset duration.

[0073] It should be noted that during the update process of the target IoT device, the update data transmitted by the server will be received, so as to update the target IoT device according to the update data. When receiving the update data, the target IoT device divides the received update data into update data of different time windows based on the preset duration. The first time window is the latest time window.

[0074] The update data received by the target Internet of Things is divided into update data of different time windows based on the receiving time when the target Internet of Things receives the update data. The first time window is a time window including the latest update data received.

[0075] Step S202: determining a plurality of abnormal characteristic values ​​of the update data in the first time window, wherein the plurality of abnormal characteristic values ​​are respectively used to characterize data transmission states of the update data in a plurality of dimensions.

[0076] Optionally, the multiple abnormal feature values ​​in the embodiment of the present application include part or all of the expected offset feature value, the response time feature value, the rate change feature value and the integrity feature value.

[0077] The following embodiments of the present application are respectively introduced for each abnormal characteristic value:

[0078] 1. Expected offset eigenvalue.

[0079] Optionally, the expected offset characteristic value in the embodiment of the present application is determined based on the integrity detection result of the data packet contained in the updated data of the first time window, the data volume of the updated data of the first time window, and the expected data volume.

[0080] It should be noted that the update data in each time window includes at least one data packet.

[0081] In an optional implementation, the embodiment of the present application determines the expected offset characteristic value of the updated data in the first time window based on the integrity detection results of the data packets contained in the updated data in the first time window, and the difference between the data volume of the updated data in the first time window and the expected data volume.

[0082] It should be noted that the integrity detection result is used to indicate whether the data packets included in the update data of the first time window are complete.

[0083] Exemplarily, the embodiment of the present application checks the integrity of each data packet by means of packet_integrity_check to ensure that the data has not been tampered with.

[0084] Optionally, the embodiment of the present application performs weighted processing on the weight and the difference between the data volume of the updated data in the first time window and the expected data volume based on the integrity detection result of the data packet contained in the updated data in the first time window, to obtain the expected offset characteristic value.

[0085] In the embodiment of the present application, the expected offset characteristic value is used as an abnormal marking value to characterize the abnormality degree of the updated data in the first time window in the expected offset dimension during the transmission process.

[0086] Exemplarily, the calculation formula for determining the expected offset characteristic value in the embodiment of the present application is: expected offset characteristic value = integrity detection result * (1-first transmission data amount / expected transmission data amount).

[0087] The integrity detection result indicates the result of the data packet integrity check, indicating whether the data packet has passed the check, for example, 1 indicates that the check has passed, and 0 indicates that the check has not passed. That is, 1 indicates that all data packets included in the update data of the first time window are complete, and 0 indicates that at least one data packet included in the update data of the first time window is incomplete. The first transmission data volume indicates the actual data volume of the update data of the first time window. The expected transmission data volume indicates the expected data volume, which is based on a preset fixed value.

[0088] The present application embodiment uses the parameters shown in Table 1 to illustrate the process of predicting the offset characteristic value:

[0089]

[0090] Table 1

[0091] 2. Response duration characteristic value.

[0092] The response time characteristic value (also called the unit traffic response time characteristic) measures the time required to transmit each byte and evaluates the transmission efficiency. The average response time per byte is obtained by calculating the ratio of the total data transmission time to the amount of data transmitted.

[0093] The response duration characteristic value of the embodiment of the present application is used to characterize the abnormality of the updated data in the first time window during the transmission process in terms of network delay or transmission efficiency. When the value is large, it may indicate that there is network delay or low transmission efficiency.

[0094] Optionally, the response duration characteristic value in the embodiment of the present application is determined according to the data volume of the updated data in the first time window and the data transmission duration of the updated data in the first time window.

[0095] In an optional implementation, the embodiment of the present application uses the ratio of the data volume of the updated data in the first time window to the data transmission duration of the updated data in the first time window as the response duration characteristic value of the updated data in the first time window.

[0096] Exemplarily, the calculation formula for determining the expected offset characteristic value in the embodiment of the present application is: response duration characteristic value = first data transmission duration / first transmission data volume.

[0097] The response duration characteristic value indicates the unit flow response time, the first data transmission duration indicates the duration of transmitting the updated data in the first time window, and the first transmission data volume indicates the volume of the updated data in the first time window.

[0098] It should be noted that, since update data may be received intermittently within the preset duration of the first time window, the first data transmission duration is the duration of transmitting update data within the first time window.

[0099] In the embodiment of the present application, the process of determining the characteristic value of the response duration is exemplified by the parameters shown in Table 2:

[0100]

[0101] Table 2

[0102] 3. Rate change characteristic value.

[0103] The rate change characteristic value (also called rate fluctuation characteristic) reflects the rate change between two consecutive transmissions. The rate difference between the two transmissions is calculated by comparing the data volume and data transmission duration of the two transmissions.

[0104] The rate change characteristic value of the embodiment of the present application is used to characterize the abnormal degree of fluctuation of the data transmission rate in the first time window during the transmission process. When the rate fluctuation is large, it may indicate that the OTA update network is abnormal or there is a traffic attack.

[0105] Optionally, the rate change characteristic value in the embodiment of the present application is determined according to the data transmission rate of the updated data in the first time window and the data transmission rate of the updated data in the second time window.

[0106] It should be noted that the receiving time of the updated data in the second time window is earlier than the receiving time of the updated data in the first time window.

[0107] Exemplarily, the first time window is the latest time window, and the second time window is the previous time window of the first time window.

[0108] For example, if the first time window is the current Mth time window, then the second time window is the M-1th time window.

[0109] In an optional implementation, the embodiment of the present application uses the difference between the data transmission rate of the updated data in the first time window and the data transmission rate of the updated data in the second time window as the rate change characteristic value of the updated data in the first time window.

[0110] The data transmission rate of the updated data in each time window is determined according to the data volume and data transmission duration of the updated data in the corresponding time window.

[0111] Exemplarily, the calculation formula for determining the rate change characteristic value in the embodiment of the present application is: rate change characteristic value = ABS (second transmission data volume / second data transmission duration-first transmission data volume / first data transmission duration).

[0112] Wherein, ABS represents absolute value operation. The second transmission data volume represents the data volume of the updated data in the second time window. The second data transmission duration represents the data transmission duration of the updated data in the second time window, that is, the duration of transmitting the updated data in the second time window. The first transmission data volume represents the data volume of the updated data in the first time window. The first data transmission duration represents the duration of transmitting the updated data in the first time window.

[0113] The present application embodiment uses the parameters shown in Table 3 to illustrate the process of determining the rate change characteristic value:

[0114]

[0115] Table 3

[0116] 4. Integrity characteristic value.

[0117] The integrity feature value (also called the data integrity score feature) is used to characterize the integrity of the updated data being transmitted. When the data packet passes the integrity check, the integrity feature value is equal to the amount of data actually transmitted; if it fails the check, the integrity score is 0. The integrity feature value is used to indicate potential data tampering or transmission failure.

[0118] Optionally, the integrity feature value in the embodiment of the present application is the product of the integrity detection result of the data packet contained in the updated data of the first time window and the amount of data in the first time window.

[0119] It should be noted that the process of determining the integrity detection result of the data packet included in the updated data of the first time window can refer to the process introduced in 1. Expected offset characteristic value, and this application will not repeat it here.

[0120] Exemplarily, the calculation formula for determining the expected offset characteristic value in the embodiment of the present application is: integrity characteristic value = integrity detection result * first transmission data volume.

[0121] The integrity check result indicates the result of the data packet integrity check, indicating whether the data packet has passed the check, for example, 1 indicates that the check has passed, and 0 indicates that the check has not passed. In other words, 1 indicates that all data packets included in the update data of the first time window are complete, and 0 indicates that at least one data packet included in the update data of the first time window is incomplete. The first transmission data volume indicates the actual data volume of the update data of the first time window.

[0122] In this embodiment of the present application, the process of the integrity feature value is exemplified by the parameters shown in Table 4:

[0123]

[0124] Table 4

[0125] Based on the above process, a plurality of abnormal feature values ​​of the update data of the first time window are generated.

[0126] Step S203: Process the multiple abnormal feature values ​​based on the abnormality detection model to determine whether the updated data in the first time window is abnormal.

[0127] Optionally, the embodiment of the present application may further perform standardization processing on the multiple abnormal feature values ​​before processing the multiple abnormal feature values ​​through the abnormality detection model.

[0128] In an optional implementation, the determined multiple abnormal eigenvalues ​​are composed into a feature matrix, and the composed feature matrix is ​​standardized to obtain multiple abnormal eigenvalues ​​after the standardization.

[0129] The embodiment of the present application can scale multiple abnormal feature values ​​to a normal distribution with a mean of 0 and a variance of 1, which is suitable for situations where the data presents a normal distribution and the scale differences of different features are large.

[0130] Exemplarily, the obtained multiple abnormal feature values ​​may be shown in Table 5:

[0131]

[0132]

[0133] Table 5

[0134] After the standardization process, multiple abnormal characteristic values ​​after the standardization process can be shown in Table 6:

[0135] Expected offset characteristic value Response time characteristic value Rate change characteristic value Integrity Characteristic Value 0.75877241 0.03983137 -0.88285461 0.03314477 1.18686861 0.03983137 -0.69644115 -0.07331907 0.33067621 1.67921145 -0.17972765 0.13960861 -0.39152019 -1.19494116 1.75707847 -1.7865081 -1.88479705 0.03983137 -0.00194594 1.68707379

[0136] Table 6

[0137] In the embodiment of the present application, the multiple abnormal feature values ​​after standardization are input into the abnormality detection model, and the abnormality detection model detects the multiple abnormal feature values ​​and outputs the detection result, which indicates whether the updated data of the first time window is abnormal.

[0138] Among them, the anomaly detection model in the embodiment of the present application is obtained by performing multiple rounds of training based on the training sample set. In each round of training, training samples are obtained from the training sample set based on the maximum number of samples. Each training sample includes a feature sample of training data corresponding to a preset time length and an anomaly label; the maximum number of samples used in each round of training is determined based on the training samples used in the previous round of training or the model error rate after the previous round of training.

[0139] like Figure 3As shown, a schematic diagram of the relationship between a training sample and training data in an embodiment of the present application is shown. Taking the preset duration of 5 seconds as an example, training sample 1 includes feature samples of training data corresponding to 0 to 5 seconds, training sample 2 includes feature samples of training data corresponding to 1 to 6 seconds, training sample 3 includes feature samples of training data corresponding to 2 to 7 seconds, and so on.

[0140] It should be noted that the anomaly detection model in the embodiment of the present application can be trained on the target IoT device or on other devices, and the trained anomaly detection model can be deployed on the target IoT device. The present application does not impose any restrictions on this.

[0141] Before training the anomaly detection model, the embodiment of the present application first collects training data. The training data is the network traffic data and data information during the update process of the target IoT device. The data information includes all network activity records updated within a preset time period, such as data packet size, protocol type, data packet interval, connection duration, number of authentication failures, etc.

[0142] Secondly, after obtaining the training data, the embodiments of the present application can also clean and organize the collected training data, remove noise data and invalid records, correct outliers in the data, and process missing values ​​(such as using interpolation or mean filling).

[0143] Optionally, the embodiment of the present application determines feature samples of the training data corresponding to each preset duration based on the processed training data.

[0144] It should be noted that the feature sample of the training data corresponding to each preset duration in the embodiment of the present application is composed of the expected offset feature value, response duration feature value, rate change feature value and integrity feature value of the training data corresponding to the corresponding preset duration. The feature sample of the training data corresponding to each preset duration can be a feature matrix.

[0145] In the embodiment of the present application, the expected offset characteristic value, response duration characteristic value, rate change characteristic value and integrity characteristic value of the training data are respectively combined as unique abnormal markers to obtain a characteristic sample.

[0146] Among them, each preset time length is a time window. The process of determining the expected offset characteristic value, response time length characteristic value, rate change characteristic value and integrity characteristic value of the training data corresponding to each preset time length can refer to the process of determining the expected offset characteristic value, response time length characteristic value, rate change characteristic value and integrity characteristic value of the updated data of each time window introduced in the previous step S202, and this application will not repeat it here.

[0147] Exemplarily, the anomaly detection model used in the embodiment of the present application may be an isolation forest model. When training the isolation forest model, the standardized feature samples are used to train the isolation forest model based on the feature samples of the training sample set. The isolation forest constructs multiple decision trees to segment the data space and thus identify anomalies. The core of the model is to use path length to measure the degree of "isolation" of data points. Points that are easier to be isolated are more likely to be anomalies.

[0148] Optionally, in the embodiment of the present application, in multiple rounds of training of the anomaly detection model, training samples are obtained from the training sample set according to the maximum number of samples for training. The maximum number of samples used in each round of training is determined based on the training samples used in the previous round of training or the model error rate after the previous round of training.

[0149] It should be noted that the maximum number of samples used in the first round of training in the embodiment of the present application is pre-set, and the model training is performed based on the maximum number of samples in the first round of training, and the characteristics of the input training samples and the performance of the model are monitored during the training process.

[0150] Exemplarily, the characteristics of the monitored training samples may include the amount and complexity of data corresponding to the training samples, and the performance of the model may be the model error rate, such as the false alarm rate and the missed alarm rate.

[0151] Optional, such as Figure 4 As shown, a flowchart of determining the maximum number of samples used in each round of training according to an embodiment of the present application is shown in the following specific steps:

[0152] Step S401, determining a target abnormal state from a plurality of abnormal states based on the data volume of training samples used in the previous round of training and / or the model error rate after the previous round of training.

[0153] Optionally, the various abnormal states in the embodiments of the present application include data volume abnormality, data complexity abnormality, data change abnormality and model detection abnormality.

[0154] like Figure 5 As shown, the embodiment of the present application provides a flowchart for determining the abnormal state of a target, and the specific steps are as follows:

[0155] Step S501, according to the priority order of multiple abnormal states, determine in turn whether the training samples used in the previous round of training meet the data volume abnormality, data complexity abnormality and data change abnormality; when it is determined that any abnormal state is met, the abnormal state is used as the target abnormal state.

[0156] Exemplarily, the priority order of the multiple abnormal states may be: data volume abnormality, data complexity abnormality, data change abnormality, and model detection abnormality. Then, it is determined in sequence whether the data volume abnormality, data complexity abnormality, data change abnormality, and model detection abnormality are met. When it is determined that any abnormal state is met, any abnormal state is used as the target abnormal state.

[0157] The embodiment of the present application determines whether it meets the data volume anomaly, data complexity anomaly and data change anomaly based on the data volume of the training samples used in the previous round of training; and determines whether it meets the model detection anomaly based on the model error rate after the previous round of training.

[0158] Optionally, the embodiment of the present application can determine whether the data volume is abnormal, the data complexity is abnormal, and the data change is abnormal in the following ways.

[0159] Exemplarily, an embodiment of the present application determines whether the data volume anomaly is met in the following manner: comparing the data volume of the training samples used in the previous round of training with a preset data volume threshold, the preset data volume threshold includes a first data volume threshold and a second data volume threshold; if it is greater than the first data volume threshold or less than the second data volume threshold, it is determined that the data volume anomaly is met.

[0160] The first data volume threshold is not less than the second data volume threshold, and the first data volume threshold and the second data volume threshold may be values ​​preset based on experience.

[0161] Exemplarily, an embodiment of the present application determines whether it meets the data complexity anomaly in the following manner: comparing the complexity of the training samples used in the previous round of training with the complexity threshold, the complexity threshold includes a first complexity threshold and a second complexity threshold; if it is greater than the first complexity threshold or less than the second complexity threshold, it is determined that it meets the data complexity anomaly.

[0162] Among them, the first complexity threshold is not less than the second complexity threshold. The first complexity threshold and the second complexity threshold can be values ​​preset based on experience, or can be values ​​determined based on the complexity of the training samples used in the previous round of training; the complexity of each training sample is determined based on the amount of data of the training sample.

[0163] Exemplarily, the first complexity threshold and the second complexity threshold may be the complexity of training samples used in the previous round of training.

[0164] In the embodiment of the present application, the complexity of the training sample may be the variance or entropy of the data volume of the corresponding training sample.

[0165] Exemplarily, the embodiments of the present application determine whether the data change is abnormal by the following method: comparing the data volume of the training samples used in the first two rounds of training, or comparing the data volume of every two adjacent training samples used in the previous round of training; if they are not the same, it is determined that the data change is abnormal.

[0166] For example, if the fourth round of training is performed, the data volume of the training samples used in the second round of training and the data volume of the training samples used in the third round of training are compared.

[0167] It should be noted that if the data amounts of every two adjacent training samples used in the previous round of training are different, it is determined that the data change is abnormal.

[0168] The order of the training samples is determined according to the receiving time of the training samples, and the samples are arranged in order from the earliest to the latest receiving time.

[0169] The receiving time of the training sample may be the receiving time of the most recently received training data among the training data within a preset time period corresponding to the training sample.

[0170] Step S502: If it does not meet the data volume anomaly, data complexity anomaly and data change anomaly, determine whether the model error rate after the previous round of training meets the model detection anomaly.

[0171] Exemplarily, an embodiment of the present application determines whether it meets the model detection anomaly in the following manner: comparing the model error rate after the previous round of training with a preset fault tolerance rate, the preset fault tolerance rate includes a first fault tolerance rate and a second fault tolerance rate. If it is greater than the first fault tolerance rate or less than the second fault tolerance rate, it is determined that it meets the model detection anomaly.

[0172] Among them, the first fault tolerance rate is not less than the second fault tolerance rate, and the first fault tolerance rate and the second fault tolerance rate can be values ​​preset based on experience.

[0173] Optionally, the model error rate in the embodiment of the present application includes a false alarm rate and a missed alarm rate, the first fault tolerance rate includes a first false alarm fault tolerance rate and a second missed alarm fault tolerance rate, the second fault tolerance rate includes a first missed alarm fault tolerance rate and a second missed alarm fault tolerance rate, and the model detection anomaly includes a false alarm rate anomaly and a missed alarm rate anomaly. The judgment is made according to the priority order between the false alarm rate anomaly and the missed alarm rate anomaly, and when it is determined that the false alarm rate anomaly or the missed alarm rate anomaly is met, it is determined that the model detection anomaly is met.

[0174] For example, taking the example that the priority of the false alarm rate anomaly is higher than the missed alarm rate anomaly, it is determined whether the false alarm rate is greater than the first false alarm tolerance rate or less than the second false alarm tolerance rate; if it is greater than the first false alarm tolerance rate or less than the second false alarm tolerance rate, it is determined that it meets the false alarm rate anomaly; if it is less than or equal to the first false alarm tolerance rate and greater than or equal to the second false alarm tolerance rate, it is determined that it does not meet the false alarm rate anomaly. If it does not meet the false alarm rate anomaly, it is determined whether the missed alarm rate is greater than the first missed alarm tolerance rate or less than the second missed alarm tolerance rate; if it is greater than the first missed alarm tolerance rate or less than the second missed alarm tolerance rate, it is determined that it meets the missed alarm rate anomaly; if it is less than or equal to the first missed alarm tolerance rate and greater than or equal to the second missed alarm tolerance rate, it is determined that it does not meet the missed alarm rate anomaly.

[0175] Among them, when the first false alarm tolerance rate in the embodiment of the present application is the same as the second false alarm tolerance rate, then when the false alarm rate is equal to the first false alarm tolerance rate, it is determined that the false alarm rate exception is not met. When the first missed alarm tolerance rate in the embodiment of the present application is the same as the second missed alarm tolerance rate, then when the missed alarm rate is equal to the first missed alarm tolerance rate, it is determined that the missed alarm rate exception is not met.

[0176] Step S503: If the model detection anomaly is met, the model detection anomaly is used as the target abnormal state.

[0177] Exemplarily, the priority order of the various abnormal states may also be: model detection abnormality, data volume abnormality, data complexity abnormality, and data change abnormality.

[0178] Then determine whether it meets the model detection anomaly, data volume anomaly, data complexity anomaly and data change anomaly in turn. When it is determined that it meets any abnormal state, any abnormal state is used as the target abnormal state.

[0179] The target abnormal state is determined based on the above process.

[0180] Step S402, adjusting the maximum number of samples used in the previous round of training based on the adjustment method corresponding to the target abnormal state, to obtain the maximum number of samples used in the current round of training.

[0181] Different adjustment methods are implemented for different target abnormal states, and the embodiments of the present application are respectively introduced as follows:

[0182] 1. When the target abnormal state is abnormal data volume.

[0183] During the OTA update process, the transmission data packet size and update frequency will fluctuate with the device status or network conditions. When the amount of data is small, reduce max_samples (maximum number of samples) to improve calculation efficiency. When the amount of data is large, increase max_samples to make full use of more samples to build the tree and improve the detection accuracy of the model.

[0184] Optionally, an embodiment of the present application determines a first adjustment weight based on a difference between the data amounts of training samples used in the first two rounds of training; and adjusts the maximum number of samples used in the previous round of training based on the first adjustment weight.

[0185] Exemplarily, the embodiment of the present application obtains the adjusted maximum number of samples through Formula 1:

[0186]

[0187] Among them, max_samples new Indicates the maximum number of samples after adjustment, that is, the maximum number of samples used in the current round of training, such as the Nth round, where N is a positive integer; max_samples_current indicates the current maximum number of samples, that is, the maximum number of samples used in the previous round of training, such as the N-1th round;

[0188] is the first adjustment weight. Wherein, α represents the adjustment coefficient, which can be set based on experience and is used to control the variation range of the maximum number of samples; Indicates the amount of training sample data used in the previous round of training, such as the N-1 round; Indicates the amount of training sample data used in the N-2 round of training.

[0189] It should be noted that if at least one training sample is used in the previous round of training, the data volume of the training samples used in the previous round of training can be the sum of the data volume of at least one training sample used in the previous round of training, or can also be the mean of the data volume of at least one training sample used in the previous round of training, and this application does not limit this. The calculation method for calculating the data volume of the training samples used in the first two rounds of training is the same.

[0190] 2. When the target abnormal state is data complexity abnormality.

[0191] Sometimes the update data packets in OTA update data are complex, and sometimes they are simple. When the data is complex, increase max_samples to ensure that the model can capture the diversity and complex patterns of the data; when the data is simple, reduce max_samples to avoid overfitting and increase training speed.

[0192] Optionally, an embodiment of the present application determines a second adjustment weight based on a difference between the complexity of training samples used in a previous round of training and a complexity threshold; and adjusts the maximum number of samples used in the previous round of training based on the second adjustment weight.

[0193] Exemplarily, the embodiment of the present application obtains the adjusted maximum number of samples through Formula 2:

[0194]

[0195] Among them, max_samples new Indicates the maximum number of samples after adjustment, that is, the maximum number of samples used in the current round of training, such as the Nth round, where N is a positive integer; max_samples_current indicates the current maximum number of samples, that is, the maximum number of samples used in the previous round of training, such as the N-1th round;

[0196] is the second adjustment weight. Where k represents the coefficient that controls the adjustment range. The larger the value, the more sensitive the adjustment. Indicates the complexity of the training samples used in the previous round of training, such as the N-1 round; Indicates the complexity threshold.

[0197] It should be noted that if at least one training sample was used in the previous round of training, the complexity of the training sample used in the previous round of training may be the sum of the complexity of at least one training sample used in the previous round of training, or may be the mean of the complexity of at least one training sample used in the previous round of training, and this application does not limit this. The complexity threshold is set based on the complexity calculation method.

[0198] 3. When the target abnormal state is abnormal data change.

[0199] The embodiment of the present application detects abnormal data changes based on a sliding window mechanism. If the amount of data in the current window increases compared to the amount of data in the previous window, max_samples is increased; if it decreases, max_samples is reduced. This is suitable for making simple rule adjustments when the amount of window data changes dramatically.

[0200] In an optional implementation, the embodiment of the present application can regard the amount of data used in a round of training as the amount of data in a window. If the Nth round of training is currently being performed, the amount of data of the training samples used in the N-1th round (previous round) of training is compared with the amount of data of the training samples used in the N-2th round of training to determine the change in the amount of data. That is, by comparing the amount of data of the training samples used in the first two rounds of training, the change in the amount of data is determined. The change in the amount of data is an increase or no increase in the amount of data.

[0201] Based on the third adjustment ratio corresponding to the change in data volume, the maximum number of samples used in the previous round of training is adjusted.

[0202] Exemplarily, the embodiment of the present application obtains the adjusted maximum number of samples through Formula 3:

[0203]

[0204] Among them, max_samples new Indicates the maximum number of samples after adjustment, that is, the maximum number of samples used in the current round of training, such as the Nth round, where N is a positive integer; max_samples_current indicates the current maximum number of samples, that is, the maximum number of samples used in the previous round of training, such as the N-1th round;

[0205] current_window_size indicates the data size of the training samples used in the previous round of training, for example, the N-1th round; previous_window_size indicates the data size of the training samples used in the N-2th round of training.

[0206] Among them, current_window_size>previous_window_size means that the data amount of training samples used in the N-1th round of training is greater than the data amount of training samples used in the N-2th round of training. The change in data volume is an increase in data volume. The third adjustment ratio 1.2 corresponding to the increase in data volume is used to adjust the maximum number of samples used in the previous round of training.

[0207] current_window_size≤previous_window_size means that the data amount of the training samples used in the N-1th round of training is less than or equal to the data amount of the training samples used in the N-2th round of training. If the change in the data amount is that the data amount has not increased, the third adjustment weight 0.8 corresponding to the situation where the data amount has not increased is used to adjust the maximum number of samples used in the previous round of training.

[0208] In another optional implementation, the embodiment of the present application can regard the nth training sample used in the previous round of training as the data volume of a time window, and then compare the data volume of the nth training sample used with the data volume of the n+1th training sample to determine the change in data volume. That is, by comparing the data volume of every two adjacent training samples used in the previous round of training, the change in data volume of every two adjacent training samples is determined, and the change in data volume is whether the data volume has increased or not increased.

[0209] Based on the third adjustment ratio corresponding to the change in data volume, the maximum number of samples used in the previous round of training is adjusted.

[0210] Optionally, for an implementation method of adjusting the maximum number of samples based on the data amount of every two adjacent training samples used in the previous round of training, the embodiment of the present application adjusts the maximum number of samples used in the previous round of training through steps A1-A2, including:

[0211] According to the order of the training samples used in the previous round of training, perform the following operations for each training sample used in the previous round of training:

[0212] Step A1: based on the data amount change between the training sample and the reference training sample, determine a third adjustment ratio corresponding to the data amount change.

[0213] The reference training sample is a training sample that is located in the next adjacent order of the training sample in the previous round of training.

[0214] Exemplarily, taking the training sample being the nth training sample among the training samples used in the previous round of training as an example, the reference training sample is the n+1th training sample among the training samples used in the previous round of training.

[0215] Step A2: adjusting the current maximum number of samples based on the third adjustment weight.

[0216] The current maximum number of samples is the maximum number of samples used in the previous round of training, or the current maximum number of samples is the maximum number of samples adjusted based on the change in data volume of at least two training samples among the training samples used in the previous round of training.

[0217] Exemplarily, if n is 1, the third adjustment weight is determined based on the change in the amount of data between the first training sample and the second training sample in the training samples used in the previous round of training, and the current maximum number of samples is adjusted based on the third adjustment weight. The current maximum number of samples is the maximum number of samples used in the previous round of training. For example, if the current training is the Nth round, the maximum number of samples used in the N-1th round of training is adjusted based on the third adjustment weight.

[0218] If n is 2, the third adjustment weight is determined based on the change in data volume between the second training sample and the third training sample in the training samples used in the previous round of training, and the current maximum number of samples is adjusted based on the third adjustment weight. The current maximum number of samples is the maximum number of samples adjusted according to the change in data volume between the first training sample and the second training sample.

[0219] If n is 3, the third adjustment weight is determined based on the change in data volume between the third training sample and the fourth training sample in the training samples used in the previous round of training, and the current maximum number of samples is adjusted based on the third adjustment weight. The current maximum number of samples is the maximum number of samples adjusted according to the change in data volume between the second training sample and the third training sample.

[0220] For this implementation, the embodiment of the present application can also obtain the adjusted maximum number of samples through Formula 3. Then current_window_size represents the data volume of the n+1th training sample in the training samples used in the previous round of training; previous_window_size represents the data volume of the nth training sample in the training samples used in the previous round of training.

[0221] Among them, current_window_size>previous_window_size means that the data volume of the n+1th training sample is greater than the data volume of the nth training sample, and the change in data volume is an increase in data volume. The third adjustment ratio 1.2 corresponding to the increase in data volume is used to adjust the current maximum number of samples.

[0222] current_window_size≤previous_window_size indicates that the data volume of the n+1th training sample is less than or equal to the data volume of the nth training sample, and the data volume change is that the data volume has not increased. Therefore, the third adjustment ratio 0.8 corresponding to the data volume has not increased is used to adjust the current maximum number of samples.

[0223] 4. When the target abnormal state is model detection abnormality.

[0224] Model performance can fluctuate over time, such as malicious data injection detection in OTA updates. If the model error rate of the model is detected to increase, increase max_samples to improve the robustness of the model. If the model error rate of the model is low and the detection efficiency can be improved, reduce max_samples to reduce computing resource consumption.

[0225] Optionally, the model error rate in the embodiment of the present application includes a false alarm rate and a false negative rate.

[0226] Optionally, an embodiment of the present application uses the ratio of the model error rate after the previous round of training to a preset fault tolerance rate as a fourth adjustment ratio, and adjusts the maximum number of samples used in the previous round of training based on the fourth adjustment ratio.

[0227] Exemplarily, the embodiment of the present application obtains the adjusted maximum number of samples through Formula 4:

[0228]

[0229] Among them, max_samples new Indicates the maximum number of samples after adjustment, that is, the maximum number of samples used in the current round of training, such as the Nth round, where N is a positive integer; max_samples_current indicates the current maximum number of samples, that is, the maximum number of samples used in the previous round of training, such as the N-1th round;

[0230] The fourth adjustment weight is as follows. Error_rate_current represents the model error rate of the current model, that is, the model error rate of the model after the last round of training, for example, the model error rate is the false alarm rate or the missed alarm rate; error_rate_target represents the preset fault tolerance rate, which can be pre-set based on an experience value, and the preset fault tolerance rate is the preset false alarm fault tolerance rate or the preset missed alarm fault tolerance rate.

[0231] When the model error rate is the false alarm rate, the preset fault tolerance rate is the preset false alarm fault tolerance rate; when the model error rate is the missed alarm rate, the preset fault tolerance rate is the preset missed alarm fault tolerance rate.

[0232] Based on the above process, the maximum number of samples used in the current round of training is obtained, and then training samples are obtained from the training sample set based on the maximum number of samples for the current round of training.

[0233] At the same time, the embodiment of the present application continuously monitors the changes in training samples and model performance during the training process, repeatedly iteratively optimizes the max_samples parameter for multiple rounds of training, and finally obtains a trained anomaly detection model. The application process of the anomaly detection model can be found in Figure 2 Flowchart shown.

[0234] like Figure 6 As shown, a flowchart of adjusting the maximum number of samples in an embodiment of the present application is shown, and the specific steps are as follows:

[0235] Step S601, start model training.

[0236] Step S602, monitoring the data volume and model error rate of input training samples.

[0237] It should be noted that the data volume of the training samples is calculated by the model based on the feature samples of the input training samples.

[0238] Step S603, based on the data volume of the input training sample, determine whether the data change is abnormal. If so, execute step S604; if not, execute step S605.

[0239] Step S604, adjusting the maximum number of samples used in the previous round using an adjustment method corresponding to abnormal data changes.

[0240] Step S605, based on the data volume of the input training sample, determine whether it meets the data complexity anomaly; if so, execute step S606; if not, execute step S607.

[0241] Step S606, adjusting the maximum number of samples used in the previous round using an adjustment method corresponding to the data complexity anomaly.

[0242] Step S607, based on the data volume of the input training sample, determine whether the data change is abnormal; if so, execute step S608; if not, execute step S609.

[0243] Step S608, adjusting the maximum number of samples used in the previous round using an adjustment method corresponding to the abnormal data change.

[0244] Step S609, based on the model error rate of the current model, determine whether it meets the model detection anomaly; if so, execute step S6010; if not, execute step S6011.

[0245] It should be noted that the model error rate of the current model is the model error rate after the model has undergone the last round of training.

[0246] Step S6010, using the adjustment method corresponding to the model detection anomaly to adjust the maximum number of samples used in the previous round.

[0247] Step S6011, taking the maximum number of samples used in the previous round as the maximum number of samples used in the current round.

[0248] like Figure 7 As shown, an overall flow chart of an embodiment of the present application, the specific steps are as follows:

[0249] Step S701, collecting training data.

[0250] The embodiment of the present application collects training data based on the network traffic during the update process of the target IoT device.

[0251] Step S702: data preprocessing.

[0252] For example, the collected training data will be cleaned and organized to remove noisy data and invalid records, correct outliers in the data, and handle missing values ​​(such as using interpolation or mean filling).

[0253] Step S703: extract features from the training data to obtain feature samples.

[0254] Step S704, performing data standardization processing on the feature samples.

[0255] Step S705, using the dynamic strategy adjustment of the maximum number of samples of the isolation forest to perform isolation forest model training.

[0256] Step S706, deploying the trained isolation forest model.

[0257] After verification, the Isolation Forest model is deployed to the production environment (target IoT devices). The deployed model will perform anomaly detection on real-time traffic data to ensure timely identification of potential network threats or security risks.

[0258] The following process is the process of applying the isolation forest model:

[0259] Step S707: collecting update data for updating the target IoT device in real time.

[0260] The target IoT device continuously collects network traffic data (update data) during OTA updates in real time. This data will be used to extract features within a fixed time window and input into the deployed isolation forest model for detection.

[0261] Step S708: extract features from the updated data collected in real time to obtain multiple abnormal feature values.

[0262] Step S709: performing data standardization processing on the obtained multiple abnormal feature values.

[0263] Standardize the real-time feature data to make it conform to the feature distribution when training the model so that the model can correctly process and detect anomalies.

[0264] Step S7010, inputting the standardized multiple abnormal feature values ​​into the isolation forest model.

[0265] Isolation forest model anomaly detection: Use the isolation forest model to detect anomalies on standardized real-time feature data. The model will calculate the anomaly score of each sample and classify the samples according to the score and the set threshold. Samples with higher scores are considered abnormal.

[0266] Step S7011, the isolation forest model outputs the detection result.

[0267] Optionally, the embodiments of the present application can determine whether the security threat pattern is met based on the detection results. If so, an alarm prompt can be triggered and a predefined response mechanism can be triggered, such as notifying a security operation center, isolating infected processors, or automatically performing further security scans.

[0268] If the target IoT device is a smart car, the security operation center can be notified, the infected vehicle card can be isolated, or further security scans can be automatically performed.

[0269] Anomaly detection result analysis: Analyze the detected anomaly data to determine whether these anomalies conform to the expected security threat pattern or whether further investigation and response are required. Alarms can be generated based on anomaly detection results and predefined response mechanisms can be triggered. Response measures may include notifying the security operation center, isolating the infected vehicle card, or automatically conducting further security scans.

[0270] It should be noted that max_samples controls the maximum number of samples used by each tree, which directly affects the model's training time, memory usage, and detection performance:

[0271] Small sample size: Faster training but may affect the accuracy of the model, especially when the dataset is large and contains complex patterns.

[0272] Large sample size: The model's detection effect is usually better and it can capture complex data patterns more accurately, but the training time and resource consumption will also increase.

[0273] The iterative update of the model in the embodiment of the present application means that when new data arrives, the model dynamically adjusts the max_samples parameter according to the characteristics of the data (such as data volume, abnormal distribution, data complexity, etc.), and retrains or updates the model to maintain its detection capability. This is particularly important in environments with large changes in data volume or real-time data streams.

[0274] Advantages include: 1. Strong adaptability: Through iterative updates and dynamic adjustment of max_samples, the model can adapt to changes in data and improve the detection accuracy of data sets of different sizes. 2. Resource optimization: When computing resources are limited, reducing max_samples can improve operating efficiency; when higher accuracy is required, increasing the number of samples can improve detection accuracy.

[0275] max_samples determines the maximum number of samples used by each isolated tree, which is crucial for large-scale data sets and high-frequency data flow environments (such as OTA update scenarios). By dynamically adjusting max_samples, the isolation forest can adaptively optimize according to changes in data volume and complexity, improving the accuracy and computational efficiency of anomaly detection.

[0276] The embodiment of the present application proposes a method for detecting anomalies in OTA updates of target IoT devices based on network traffic characteristics and in combination with an isolation forest algorithm. The present application has the following advantages and effects over the prior art:

[0277] 1. Abnormal traffic marking feature: During the OTA update process, the integrity of the data packet is first checked (via packet_integrity_check) to ensure that the data has not been tampered with. Then the difference between the actual amount of data transmitted and the expected amount of data transmitted is calculated as an abnormality mark. Specifically, packet_integrity_check is used as a weight and combined with the difference between the actual amount of data transmitted and the expected amount of data transmitted to obtain an abnormal marking value for each transmission. Finally, this abnormal marking value is used as a unique combined input feature to indicate the degree of abnormality that may exist during the transmission process.

[0278] 2. Unit traffic response time feature: Unit traffic response time measures the time required to transmit each byte and evaluates the transmission efficiency. By calculating the ratio of the total transmission time to the amount of data transmitted, the average response time per byte is obtained as a unique combined input feature. When this value is large, it may indicate network delay or low transmission efficiency.

[0279] 3. Rate fluctuation feature: reflects the rate change between two consecutive transmissions. By comparing the data volume and transmission time of the two transmissions, the rate difference between the two transmissions is calculated as a unique combined input feature. If the rate fluctuation is large, it may indicate an OTA update network anomaly or a traffic attack.

[0280] 4. Data integrity score feature: used to evaluate the integrity of transmitted data. This feature combines the integrity check result of the data packet with the actual amount of data transmitted as a unique combined input feature. If the data packet passes the integrity check, the integrity score is equal to the actual amount of data transmitted; if it fails the check, the integrity score is 0. This feature is used to identify potential data tampering or transmission failure.

[0281] 5. A unique dynamic strategy model is proposed to adjust the max_samples parameter value of the isolation forest, which improves the robustness and detection efficiency of the model. In different scenarios, according to data characteristics, business needs and real-time changes, the appropriate dynamic adjustment strategy can effectively improve the performance and efficiency of the isolation forest model.

[0282] Technical effects combined with OTA update scenarios:

[0283] 1. Dealing with dynamic changes in data flow

[0284] During the OTA update process, network traffic, the size and frequency of transmitted data packets may fluctuate over time. The fixed max_samples parameter may not be able to adapt to these dynamic changes, but through model iterative updates, max_samples can be dynamically adjusted according to the amount of data in each time window, so that the model can use more samples when the amount of data is large, and reduce the use of samples when the amount of data is small, ensuring computational efficiency.

[0285] Technical effect: Real-time adaptation to changes in data volume: During the OTA update process, as the device and network conditions change, the model can be flexibly adjusted to avoid resource waste or loss of accuracy. Reduced computing overhead: When the data volume is small, reducing max_samples can reduce computing costs and improve system response speed.

[0286] 2. Improve anomaly detection accuracy

[0287] By iteratively updating max_samples based on the complexity of OTA transmission data, the characteristics of abnormal behavior, and historical data, Isolation Forest can better capture abnormal behaviors in different time periods, especially when data transmission fluctuates greatly or anomalies occur in a short period of time, and can quickly detect potential attacks or abnormal transmissions.

[0288] Technical Effect: Enhanced anomaly detection capability: During the OTA update process, the model is able to improve the accuracy of anomaly detection and reduce missed and false positives through more refined sample selection and updates. Flexible adaptation to complex data patterns: As the complexity of OTA update data changes, dynamic adjustment of max_samples helps to better capture potential abnormal patterns in complex scenarios.

[0289] 3. Respond to security threats in real time

[0290] In OTA updates, security threats (such as malware injection, packet tampering, etc.) need to be responded to quickly. By iteratively updating the max_samples parameter, the Isolation Forest model can monitor and adjust abnormal behaviors in network traffic in real time, ensuring a quick response to sudden anomalies.

[0291] Technical Effect: Timely detection and response to anomalies: Through iterative updates, Isolation Forest can quickly capture potential security threats in real-time traffic monitoring, issue alerts in a timely manner, and avoid the spread of security risks. Improve security and stability: Real-time monitoring and dynamic adjustment of OTA updates help ensure the security of the software update process of vehicles or equipment and improve system stability.

[0292] 4. Optimize model resource utilization

[0293] For large-scale OTA update scenarios, dynamically adjusting max_samples can avoid excessive use of computing resources. Through iterative updates, the number of samples is adjusted in a timely manner according to traffic or data packet size to optimize the resource utilization efficiency of the system.

[0294] Technical effect: Save computing resources: Adjust the number of samples according to the amount of data and the needs of anomaly detection, effectively reducing the waste of computing resources, especially in the case of large-scale updates or high data transmission load. Improve model efficiency: By reasonably adjusting max_samples, reduce unnecessary computing consumption and make system resource allocation more efficient.

[0295] 5. Enhanced model adaptability

[0296] Through the sliding window mechanism or iterative updates based on real-time performance feedback, the Isolation Forest Model can continuously adapt to new data features during the OTA update process. By monitoring network traffic, transmission rate and other indicators, the max_samples can be dynamically adjusted to ensure that the model can maintain efficient and stable performance in different environments.

[0297] Technical Effect: Strong adaptability: The model can automatically optimize according to data changes to improve the continuous performance of detection. Reduce model overfitting: Dynamic adjustment avoids the overfitting problem caused by fixed parameters of the model, ensuring that the model is suitable for the ever-changing data environment.

[0298] like Figure 8 As shown, an update anomaly detection device according to an embodiment of the present application includes:

[0299] The receiving module 801 is used to receive update data of a first time window; the duration of the first time window is a preset duration;

[0300] A determination module 802 is used to determine a plurality of abnormal feature values ​​of the update data in the first time window, wherein the plurality of abnormal feature values ​​are used to represent data transmission states of the update data in a plurality of dimensions respectively;

[0301] Processing module 803 is used to process the multiple abnormal feature values ​​based on an anomaly detection model to determine whether the updated data of the first time window is abnormal; wherein the anomaly detection model is obtained by performing multiple rounds of training based on a training sample set, and in each round of training, training samples are obtained from the training sample set based on a maximum number of samples, and each training sample includes a feature sample of training data corresponding to a preset time length and an abnormal label; the maximum number of samples used in each round of training is determined based on the training samples used in the previous round of training or the model error rate after the previous round of training.

[0302] Based on the same inventive concept as the above-mentioned method embodiment, an electronic device is also provided in the embodiment of the present application. The principle of solving the problem by the electronic device is similar to the method of the above-mentioned embodiment. Therefore, the implementation of the electronic device can refer to the implementation of the above-mentioned method, and the repeated parts will not be repeated.

[0303] See also Fig. 9 As shown, the electronic device 90 may include at least a processor 91 and a memory 92. The memory 92 stores program codes, and when the program codes are executed by the processor 91, the processor 91 executes the steps of the update anomaly detection method in the above embodiment of the present application.

[0304] Refer to the following Fig.10 The electronic device 100 according to this embodiment of the present application is described. Fig.10 The electronic device 100 is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0305] like Fig.10 The electronic device 100 is presented in the form of a general electronic device. The components of the electronic device 100 may include but are not limited to: at least one processing unit 101, at least one storage unit 102, and a bus 103 connecting different system components (including the storage unit 102 and the processing unit 101).

[0306] Bus 103 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, and a processor or local bus using any of a variety of bus architectures.

[0307] The storage unit 102 may include a readable medium in the form of a volatile memory, such as a random access memory (RAM) 1021 and / or a cache memory 1022 , and may further include a read-only memory (ROM) 1010 .

[0308] The storage unit 102 may also include a program / utility 1010 having a set (at least one) of program modules 1024, such program modules 1024 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0309] The electronic device 100 may also communicate with one or more external devices 104 (e.g., keyboards, pointing devices, etc.), may also communicate with one or more devices that enable an object to interact with the electronic device 100, and / or communicate with any device that enables the electronic device 100 to communicate with one or more other electronic devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 105. Furthermore, the electronic device 100 may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via a network adapter 106. As shown, the network adapter 106 communicates with other modules for the electronic device 100 via a bus 103. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 100, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, etc.

[0310] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0311] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0312] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0313] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0314] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A method for detecting an update anomaly, characterized in that: include: receiving updated data of the first time window; The duration of the first time window is a preset duration; Determine a plurality of abnormal characteristic values ​​of the update data of the first time window, wherein the plurality of abnormal characteristic values ​​are respectively used to characterize data transmission states of the update data in a plurality of dimensions; Processing the multiple abnormal feature values ​​based on an abnormality detection model to determine whether the updated data in the first time window is abnormal; The anomaly detection model is obtained by performing multiple rounds of training based on a training sample set. In each round of training, training samples are obtained from the training sample set based on the maximum number of samples. Each training sample includes a feature sample of training data corresponding to a preset time length and an anomaly label. The maximum number of samples used in each round of training is determined based on the training samples used in the previous round of training or the model error rate after the previous round of training.

2. The method according to claim 1, characterized in that The multiple abnormal feature values ​​include part or all of the expected deviation feature value, the response time feature value, the rate change feature value and the integrity feature value; The expected offset characteristic value is determined according to the integrity detection result of the data packet included in the update data of the first time window, the data volume of the update data of the first time window, and the expected data volume; The response duration characteristic value is determined according to the data volume of the update data in the first time window and the data transmission duration of the update data in the first time window; The rate change characteristic value is determined according to the data transmission rate of the update data of the first time window and the data transmission rate of the update data of the second time window; the receiving time of the update data of the second time window is earlier than the receiving time of the update data of the first time window; The integrity feature value is the product of the integrity detection result of the data packet included in the update data of the first time window and the data volume of the first time window.

3. The method according to claim 1, characterized in that The maximum number of samples used in each round of training is determined by: Determine a target abnormal state among multiple abnormal states based on the data volume of training samples used in the previous round of training and / or the model error rate after the previous round of training; The maximum number of samples used in the previous round of training is adjusted based on the adjustment method corresponding to the target abnormal state to obtain the maximum number of samples used in the current round of training.

4. The method according to claim 3, characterized in that The multiple abnormal states include data volume abnormality, data complexity abnormality, data change abnormality and model detection abnormality; the target abnormal state is determined from the multiple abnormal states based on the data volume of the training samples used in the previous round of training and / or the model error rate after the previous round of training, including: According to the priority order of multiple abnormal states, determine in turn whether the training samples used in the previous round of training meet the data volume abnormality, data complexity abnormality and data change abnormality; when it is determined that any abnormal state is met, use the any abnormal state as the target abnormal state; If it does not meet the data volume anomaly, data complexity anomaly and data change anomaly, determine whether the model error rate after the previous round of training meets the model detection anomaly; If the model detection anomaly is met, the model detection anomaly is used as the target abnormal state.

5. The method according to claim 4, characterized in that Determine whether the data volume is abnormal in the following ways: The data volume of the training samples used in the previous round of training is compared with the preset data volume threshold; if it is greater than the first data volume threshold or less than the second data volume threshold, it is determined that the data volume anomaly is met, and the first data volume threshold is not less than the second data volume threshold.

6. The method according to claim 4, characterized in that Determine whether the data complexity exception is met by the following methods: Compare the complexity of the training samples used in the previous round of training with the complexity threshold; if it is greater than the first complexity threshold or less than the second complexity threshold, it is determined to meet the data complexity anomaly, and the first complexity threshold is not less than the second complexity threshold; the complexity of the training samples is determined based on the data amount of the corresponding training samples.

7. The method according to claim 4, characterized in that Determine whether the data change is abnormal by the following methods: Compare the data volumes of the training samples used in the first two rounds of training, or compare the data volumes of every two adjacent training samples used in the last round of training; if they are different, it is determined that the data change is abnormal.

8. The method according to claim 4, characterized in that The following methods are used to determine whether the model detects anomalies: The model error rate after the previous round of training is compared with the preset fault tolerance rate. If it is greater than the first fault tolerance rate or less than the second fault tolerance rate, it is determined that the model detection anomaly is met, and the first fault tolerance rate is not less than the second fault tolerance rate.

9. The method according to claim 4, characterized in that The adjusting the maximum number of samples used in the previous round of training based on the adjustment method corresponding to the target abnormal state includes: When the target abnormal state is data volume abnormality, determining a first adjustment weight based on the difference between the data volumes of training samples used in the first two rounds of training; adjusting the maximum number of samples used in the previous round of training based on the first adjustment weight; or, When the target abnormal state is data complexity abnormality, determining a second adjustment weight based on the difference between the complexity of the training samples used in the previous round of training and the complexity threshold; adjusting the maximum number of samples used in the previous round of training based on the second adjustment weight; or, When the target abnormal state is abnormal data change, the data amount change is determined by comparing the data amounts of the training samples used in the first two rounds of training, or the data amount of each two adjacent training samples used in the previous round of training is compared to determine the data amount change of each two adjacent training samples, where the data amount change is an increase or no increase in the data amount; based on the third adjustment ratio corresponding to the data amount change, the maximum number of samples used in the previous round of training is adjusted; or, When the target abnormal state is a model detection abnormality, the ratio of the model error rate after the previous round of training to the preset fault tolerance rate is used as the fourth adjustment ratio, and the maximum number of samples used in the previous round of training is adjusted based on the fourth adjustment ratio.

10. The method according to claim 9, characterized in that If the data amount change is the data amount change of every two adjacent training samples, then adjusting the maximum number of samples used in the previous round of training based on the third adjustment ratio corresponding to the data amount change includes: According to the order of the training samples used in the previous round of training, perform the following operations for each training sample used in the previous round of training: Determining a third adjustment ratio corresponding to the data volume change based on the data volume change between the training sample and a reference training sample; the reference training sample is a training sample in the training sample in the previous round of training that is located in the next adjacent order of the training sample; The current maximum number of samples is adjusted based on the third adjustment ratio, where the current maximum number of samples is the maximum number of samples used in the previous round of training, or the current maximum number of samples is the maximum number of samples adjusted based on the change in data volume of at least two training samples among the training samples used in the previous round of training.

Images