Function election-based situation awareness method and system, terminal and storage medium

Abstract

The invention discloses a situation awareness method and system based on function election, a terminal and a storage medium, and relates to the technical field of situation awareness. Through a function election algorithm, based on the state data corresponding to each device in the device group, screening out a device serving as a detection server; acquiring acquired data of each device through a detection server, determining a data analysis node according to the acquired data of each device, the data analysis node being a detection server or an auxiliary computing node; and generating transverse analysis data and longitudinal analysis data according to all the collected data through a data analysis node, and identifying abnormal equipment to obtain a situation awareness result. According to the invention, idle equipment resources in the system are fully utilized for situation awareness, so that the utilization rate of the system resources can be improved; and the response time can be effectively guaranteed by dynamically adjusting the data analysis nodes. The problem that system resources and response time of the Internet of Things are difficult to consider at the same time in the prior art is solved.

Description

Technical Field

[0001] The present invention relates to the technical field of situation awareness, and in particular to a situation awareness method, system, terminal and storage medium based on functional election. Background Art

[0002] Situational awareness is the perception of environmental elements within a certain time and space, and the understanding of the meaning of these elements, and ultimately predicting the future development status of these elements. Using big data analysis technology, situational awareness can classify and comprehensively analyze attack events, threat alerts, and attack sources, and improve the ability to discover, identify, understand, analyze, respond to, and deal with security threats from a global perspective.

[0003] The current situational awareness methods are mainly divided into two modes: single-client mode, that is, all functions are on the client, which has high resource requirements and affects device performance; client-server mode, that is, some functions are handed over to the server, so that the client resource requirements are reduced, but because the server needs to process all client data, the response time is greatly extended. At present, it is difficult for these two modes to take into account both system resources and response time at the same time.

[0004] Therefore, the existing technology still needs to be improved and developed. Summary of the invention

[0005] The technical problem to be solved by the present invention is that, in view of the above-mentioned defects of the prior art, a situational awareness method, system, terminal and storage medium based on functional election are provided, aiming to solve the problem that the situational awareness method in the prior art is difficult to take into account both the system resources and the response time of the Internet of Things at the same time.

[0006] The technical solution adopted by the present invention to solve the problem is as follows:

[0007] In a first aspect, an embodiment of the present invention provides a situation awareness method based on functional election, the method comprising:

[0008] Determine a device group to be sensed, and select a device as a detection server based on the status data corresponding to each device in the device group through a role election algorithm; wherein the status data includes at least one status value of computing resources, credibility, and service priority;

[0009] Acquire the collected data of each device through the detection server, and determine the data analysis node according to the collected data of each device; wherein the data analysis node is the detection server or the auxiliary computing node;

[0010] The data analysis node generates horizontal analysis data and vertical analysis data based on all the collected data, and identifies abnormal devices in the device group based on the horizontal analysis data and the vertical analysis data to obtain situation awareness results.

[0011] In one implementation method, the function selection algorithm is used to select a device as a detection server based on the status data corresponding to each device in the device group, including:

[0012] When the state data includes multiple types of state values, predetermine the weight values ​​corresponding to the state values ​​of each type;

[0013] For each device, determine the vote value corresponding to the device according to the weighted sum of all status values ​​corresponding to the device;

[0014] According to the vote values ​​corresponding to each device, the device serving as the detection server is selected.

[0015] In one implementation method, determining the data analysis node according to the collected data of each device includes:

[0016] Calculate the data processing volume based on the collected data of each device;

[0017] Calculating a predicted response time based on the data processing amount;

[0018] When the predicted response time is greater than a preset time threshold, the auxiliary computing node is used as a data analysis node; wherein the auxiliary computing node is an edge device or a cloud;

[0019] When the predicted response time is less than or equal to the preset duration threshold, the detection server is used as a data analysis node.

[0020] In one implementation method, the method for generating the horizontal analysis data includes:

[0021] Classifying the collected data of each device to obtain a plurality of data groups; wherein each of the data groups corresponds to a different data type;

[0022] For each of the data groups, all data contained in the data group are compared, and similar deviating data are identified through the comparison results;

[0023] Based on all the homogeneous deviation data, horizontal analysis data are generated.

[0024] In one implementation method, the method for generating longitudinal analysis data includes:

[0025] For the collected data of each device, all data contained in the collected data are compared, and deviating data of the same device is identified through the comparison result;

[0026] Based on all the same-device deviation data, longitudinal analysis data are generated.

[0027] In an implementation method, the identifying abnormal devices in the device group according to the horizontal analysis data and the vertical analysis data includes:

[0028] Calculate the proportion of deviation data in the collected data of each device according to the horizontal analysis data and the vertical analysis data; wherein the deviation data includes the same type deviation data and the same device deviation data;

[0029] Abnormal devices in the device group are determined according to the proportion of the deviation data of each device.

[0030] In one implementation method, the method further includes:

[0031] determining a backup device from the remaining devices except the abnormal device;

[0032] The business of the abnormal device is transferred to the backup device for processing.

[0033] In a second aspect, an embodiment of the present invention further provides a situation awareness system based on functional election, the system comprising:

[0034] The device election module is used to determine the device group to be sensed, and select the device as the detection server based on the status data corresponding to each device in the device group through a functional election algorithm; wherein the status data includes at least one status value of computing resources, credibility, and service priority;

[0035] A data acquisition module, used to acquire the collected data of each device through the detection server, and determine a data analysis node according to the collected data of each device; wherein the data analysis node is the detection server or an auxiliary computing node;

[0036] The situation awareness module is used to generate horizontal analysis data and vertical analysis data according to all the collected data through the data analysis node, identify abnormal devices in the device group according to the horizontal analysis data and the vertical analysis data, and obtain situation awareness results.

[0037] In a third aspect, an embodiment of the present invention further provides a terminal comprising a memory and at least one processor; the memory stores a program; the program includes instructions for executing any of the functional election-based situational awareness methods described above; and the processor is used to execute the program.

[0038] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium on which a plurality of instructions are stored, wherein the instructions are suitable for being loaded and executed by a processor to implement the steps of the situational awareness method based on functional election as described in any of the above.

[0039] Beneficial effects of the present invention: The embodiment of the present invention determines the device group to be sensed, and selects the device as the detection server based on the status data corresponding to each device in the device group through the function election algorithm; wherein the status data includes at least one status value of computing resources, credibility, and service priority; the collected data of each device is obtained through the detection server, and the data analysis node is determined according to the collected data of each device; wherein the data analysis node is the detection server or the auxiliary computing node; the data analysis node generates horizontal analysis data and vertical analysis data according to all the collected data, and identifies abnormal devices in the device group according to the horizontal analysis data and the vertical analysis data to obtain the situation awareness result. The present invention makes full use of the idle device resources in the system for situation awareness, which can improve the utilization rate of system resources; and by dynamically adjusting the data analysis nodes, the response time can be effectively guaranteed. It solves the problem in the prior art that it is difficult to take into account both the system resources and the response time of the Internet of Things at the same time. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0041] Figure 1 It is a flow chart of a situation awareness method based on functional election provided in an embodiment of the present invention.

[0042] Figure 2 It is a schematic diagram of a process of collecting data by a device provided in an embodiment of the present invention.

[0043] Figure 3 It is a schematic diagram of the types of data obtained by the detection server provided in an embodiment of the present invention.

[0044] Figure 4 It is a schematic diagram of the business flow provided by an embodiment of the present invention.

[0045] Figure 5 It is a schematic diagram of the functional modules of the situation awareness system based on functional election provided by an embodiment of the present invention.

[0046] Figure 6 It is a principle block diagram of a terminal provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0047] The present invention discloses a situation awareness method, system, terminal and storage medium based on functional election. In order to make the purpose, technical solution and effect of the present invention clearer and more specific, the present invention is further described in detail with reference to the accompanying drawings and examples. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0048] It will be understood by those skilled in the art that, unless expressly stated, the singular forms "one", "said", and "the" used herein may also include plural forms. It should be further understood that the term "comprising" used in the specification of the present invention refers to the presence of the features, integers, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or groups thereof. It should be understood that when we refer to an element as being "connected" or "coupled" to another element, it may be directly connected or coupled to the other element, or there may be intermediate elements. In addition, the "connection" or "coupling" used herein may include wireless connection or wireless coupling. The term "and / or" used herein includes all or any unit and all combinations of one or more associated listed items.

[0049] It will be understood by those skilled in the art that, unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as generally understood by those skilled in the art in the art to which the present invention belongs. It should also be understood that terms such as those defined in general dictionaries should be understood to have meanings consistent with the meanings in the context of the prior art, and will not be interpreted with idealized or overly formal meanings unless specifically defined as herein.

[0050] Situational awareness is the perception of environmental elements within a certain time and space, and the understanding of the meaning of these elements, and ultimately predicting the future development status of these elements. Using big data analysis technology, situational awareness can classify and comprehensively analyze attack events, threat alerts, and attack sources, and improve the ability to discover, identify, understand, analyze, respond to, and deal with security threats from a global perspective.

[0051] The current situational awareness methods are mainly divided into two modes: single agent mode, that is, all functions are on the agent, which has high resource requirements and affects device performance; agent and server mode, that is, some functions are handed over to the server, so that the resource requirements of the agent are reduced, but because the server needs to process all the data of the agent, the response time is greatly extended. At present, it is difficult for these two modes to take into account both system resources and response time at the same time.

[0052] In view of the above-mentioned defects of the prior art, the present invention provides a situation awareness method based on functional election. The method determines the device group to be sensed, and selects the device as the detection server based on the status data corresponding to each device in the device group through the functional election algorithm; wherein the status data includes at least one status value of computing resources, credibility, and service priority; the detection server obtains the collected data of each device, and determines the data analysis node according to the collected data of each device; wherein the data analysis node is the detection server or the auxiliary computing node; the data analysis node generates horizontal analysis data and vertical analysis data according to all the collected data, and identifies the abnormal devices in the device group according to the horizontal analysis data and the vertical analysis data to obtain the situation awareness result. The present invention makes full use of the idle device resources in the system for situation awareness, which can improve the utilization rate of system resources; and by dynamically adjusting the data analysis nodes, the response time can be effectively guaranteed. It solves the problem that it is difficult to take into account both the system resources and the response time of the Internet of Things in the prior art.

[0053] like Figure 1 As shown, the method specifically includes:

[0054] Step S100, determine the device group to be sensed, and select the device as the detection server based on the status data corresponding to each device in the device group through a functional election algorithm; wherein the status data includes at least one status value of computing resources, credibility, and service priority.

[0055] Specifically, first, a specific device group is defined in the system, and for each device in the group, their status data is collected, and the status data may include multiple types. For example: computing resources, which are used to reflect the computing power of the device; credibility, which is used to evaluate the reliability of the device; service priority: the priority assigned to the device according to business needs or management policies, and high-priority devices may have more advantages in resource allocation or task execution. The function election algorithm selects the device that is most suitable for performing data analysis tasks from multiple devices. In actual application, the function election algorithm will evaluate the suitability of each device as a detection server based on the collected status data of each device, such as whether the computing power of the device is strong enough to undertake data analysis tasks, whether the credibility of the device is high enough to ensure data security, and whether the priority of the device is suitable as a detection server, etc. After calculation and comparison by the function election algorithm, the most suitable device will be selected as the detection server, and the device will undertake subsequent data analysis tasks. This embodiment is an automated device selection mechanism that can dynamically determine the most suitable device as a detection server according to the real-time status of each device in the device group, without the need to set up an additional detection server. This embodiment can make full use of idle device resources in the system for situational awareness, thereby improving the utilization rate of system resources.

[0056] For example, computing resources include: device processor speed, memory size, storage capacity, etc.; credibility includes: device security score, historical behavior records, etc. (such as whether it has been attacked or violated); service priority can be divided into three categories: low, medium, and high. Low-priority devices have weak performance and do not participate in detection; medium-priority devices are general devices that can process data with low complexity; high-priority devices are usually high-performance devices that can process data with high complexity. In actual applications, if necessary, the priority can be further subdivided.

[0057] In one implementation, the selecting a device as the detection server based on the status data corresponding to each device in the device group through a role election algorithm includes:

[0058] When the state data includes multiple types of state values, predetermine the weight values ​​corresponding to the state values ​​of each type;

[0059] For each device, determine the vote value corresponding to the device according to the weighted sum of all status values ​​corresponding to the device;

[0060] According to the vote values ​​corresponding to each device, the device serving as the detection server is selected.

[0061] Specifically, when the status data contains multiple types of status values, it is necessary to comprehensively consider the impact of various status values ​​on device screening, and finally determine a suitable device as the detection server. In actual application, since different status values ​​have different impacts on the suitability of the device as a detection server, it is necessary to assign a weight value to each status value. The weight value can be set according to business needs, user experience, and a preset optimization algorithm. The weight value reflects the relative importance of each status value in the comprehensive evaluation. Taking a device as an example, all status values ​​of the device are collected, each status value is multiplied by its corresponding weight value to obtain the weighted value of the state, and the weighted values ​​of all status values ​​are added to obtain the weighted sum of the device. The weighted sum can be directly used as the vote value of the device, or it can be further generated by a preset conversion function (such as a normalization function) to generate the final vote value. The height of the vote value can be used to quantitatively evaluate the suitability of each device as a detection server, compare the vote values ​​of each device, and select one or more devices with the highest vote value as the detection server.

[0062] Step S200: acquiring collected data of each device through the detection server, and determining a data analysis node according to the collected data of each device; wherein the data analysis node is the detection server or an auxiliary computing node.

[0063] Specifically, Figure 2 As shown, in this embodiment, the device other than the detection server is used as an agent. After each agent is started, it is initialized and loaded with the acquisition module according to the configuration. After establishing a connection with the detection server, it enters a waiting loop, waits for the instructions of the detection server and collects and reports data. Each device sends the collected data to the detection server for data analysis. The detection server determines the complexity of the data analysis task based on the received collected data, and then determines whether to forward the data analysis task to the auxiliary computing node. If not, the detection server executes the data analysis task. For example, the detection server calculates the complexity of the received collected data. If the collected data is time series data, the complexity of the data is high, and the data analysis task is sent to the auxiliary computing node. When the detection server needs to process complex and time-consuming data analysis tasks, it forwards the data analysis tasks to the auxiliary computing nodes, which can effectively provide expansion capabilities and thus ensure the response time.

[0064] In one implementation, determining the data analysis node according to the collected data of each device includes:

[0065] Calculate the data processing volume based on the collected data of each device;

[0066] Calculating a predicted response time based on the data processing amount;

[0067] When the predicted response time is greater than a preset time threshold, the auxiliary computing node is used as a data analysis node; wherein the auxiliary computing node is an edge device or a cloud;

[0068] When the predicted response time is less than or equal to the preset duration threshold, the detection server is used as a data analysis node.

[0069] Specifically, the detection server will evaluate the size, complexity and processing requirements of the collected data of each device to calculate the possible total data processing volume, such as the time and resources required for data storage, transmission and processing. Then, based on the total data processing volume, the detection server's own performance is combined to predict the response time required to complete the data analysis task. The predicted response time can reflect whether the detection server can quickly complete the current data analysis task. If the predicted response time exceeds the acceptable preset time threshold, it means that the detection server may not be able to process the data analysis tasks of each collected data in time. In this case, the system will include auxiliary computing nodes in the data analysis process to share the computing load and thus shorten the response time. In view of the fact that the edge device is close to the data source, it can process data analysis tasks faster and reduce delays, and the cloud server can provide powerful computing power and storage resources. Therefore, this embodiment uses the two as alternative auxiliary computing nodes. If the predicted response time does not exceed the preset time threshold, it means that the detection server itself is sufficient to process the current data analysis task without the need for additional auxiliary computing resources, then the system will give priority to using the detection server to perform the data analysis task.

[0070] Step S300: Generate horizontal analysis data and vertical analysis data according to all the collected data through the data analysis node, identify abnormal devices in the device group according to the horizontal analysis data and the vertical analysis data, and obtain situation awareness results.

[0071] Specifically, the data analysis node will perform data analysis tasks from two dimensions. Horizontal analysis refers to the comparison and analysis of the same type of data collected from multiple devices; vertical analysis refers to the comparison and analysis of multiple types of data collected from the same device. Then, the horizontal analysis data and the vertical analysis data are comprehensively analyzed to more accurately identify abnormal devices in the device group that may pose potential threats. Such devices may be attacked, malfunction, or have configuration problems.

[0072] In one implementation, the method for generating the horizontal analysis data includes:

[0073] Classifying the collected data of each device to obtain a plurality of data groups; wherein each of the data groups corresponds to a different data type;

[0074] For each of the data groups, all data contained in the data group are compared, and similar deviating data are identified through the comparison results;

[0075] Based on all the homogeneous deviation data, horizontal analysis data are generated.

[0076] Specifically, the collected data of each device is first classified. The purpose of classification is to group the same / similar types of data into one group for subsequent processing and analysis. The classification standard can be determined based on one or more indicators such as the source, type, format, and purpose of the data. Each group of data obtained after classification is a data group. Each data group contains the same type of data from different devices. Different data groups correspond to different data types. The data types may include temperature data, function data, CPU data, memory data, etc. (e.g. Figure 3 As shown). For each data group, all data contained in the data group are compared. The purpose of the comparison is to identify data that is significantly different from other data, and define such deviating data as similar deviating data. The horizontal analysis results are obtained based on all similar deviating data. In practical applications, the comparison process of the horizontal analysis can adopt one or more comparison methods, such as statistical analysis methods and machine learning algorithms. Taking the statistical analysis method as an example, the mean and / or standard deviation can be used to identify data that deviates from the normal range.

[0077] In one implementation, the method for generating longitudinal analysis data includes:

[0078] For the collected data of each device, all data contained in the collected data are compared, and deviating data of the same device is identified through the comparison result;

[0079] Based on all the same-device deviation data, longitudinal analysis data are generated.

[0080] Specifically, longitudinal analysis is performed independently on the collected data of each device, rather than mixing the collected data of multiple devices for analysis. For each device, all the collected data are compared internally to identify data that is significantly different from the generation / change trend of other data of the device, and such deviation data is defined as same-device deviation data. The longitudinal analysis results are obtained based on all the same-device deviation data. In actual applications, the comparison process of longitudinal analysis can adopt one or more comparison methods, such as statistical analysis methods, time series analysis methods, and machine learning algorithms.

[0081] In one implementation, the identifying abnormal devices in the device group according to the horizontal analysis data and the vertical analysis data includes:

[0082] Calculate the proportion of deviation data in the collected data of each device according to the horizontal analysis data and the vertical analysis data; wherein the deviation data includes the same type deviation data and the same device deviation data;

[0083] Abnormal devices in the device group are determined according to the proportion of the deviation data of each device.

[0084] Specifically, firstly, the proportion of deviation data in the collected data of each device is calculated using the previously generated horizontal analysis data and vertical analysis data, where the same type of deviation data and the same device deviation data are both deviation data. The proportion of deviation data can be determined by the ratio of the number of deviation data to the total amount of data. In practical applications, a deviation threshold can be set in advance to determine whether the device is abnormal. Taking a device as an example, if the proportion of deviation data of the device exceeds the set deviation threshold, the device is considered to be an abnormal device and requires further monitoring and attention.

[0085] In one implementation, the method further includes:

[0086] determining a backup device from the remaining devices except the abnormal device;

[0087] The business of the abnormal device is transferred to the backup device for processing.

[0088] Specifically, Figure 4 As shown, in order to ensure data security and the normal operation of the business, this embodiment needs to take suppression or blocking measures on the abnormal device, and transfer the business on the abnormal device in time. In actual application, first obtain the business processing information on the abnormal device, which may include business type, business priority (the urgency and importance of the business), business dependency (the dependency of the business on the business on other devices), and current business status (the current status of the business, such as in progress, paused, and completed). Through the obtained business processing information, one or more normal devices in the device group are selected as backup devices. When selecting a backup device, the following factors can be considered: device performance, that is, whether the processing capacity of the backup device can meet the business requirements; device status, that is, whether the backup device is operating normally without faults or performance problems; business compatibility, that is, whether the backup device supports the type and processing requirements of the current business; network bandwidth, that is, whether the network connection between the backup device and the abnormal device or the business-related device of the abnormal device is stable and whether the bandwidth is sufficient. Finally, the business on the abnormal device is transferred to the selected backup device for processing, thereby ensuring the safe and uninterrupted operation of the device business. After the abnormal device returns to normal / the risk is eliminated, the transferred business flow is transferred back to the original device.

[0089] The advantages of the present invention are:

[0090] By separating the functions of data collection and data analysis and utilizing the communication capability of the operating system's distributed soft bus to send data to the data analysis device for data analysis, we can fully utilize the idle device resources in the system for situational awareness, solve the problem of low-performance devices being unable to perform situational awareness, and ensure response time.

[0091] Based on the above embodiments, the present invention also provides a situation awareness system based on functional election, such as Figure 5 As shown, the system comprises:

[0092] The device election module 01 is used to determine the device group to be sensed, and select the device as the detection server based on the status data corresponding to each device in the device group through the function election algorithm; wherein the status data includes at least one status value of computing resources, credibility, and service priority;

[0093] The data acquisition module 02 is used to acquire the collected data of each device through the detection server, and determine the data analysis node according to the collected data of each device; wherein the data analysis node is the detection server or the auxiliary computing node;

[0094] The situation awareness module 03 is used to generate horizontal analysis data and vertical analysis data according to all the collected data through the data analysis node, identify abnormal devices in the device group according to the horizontal analysis data and the vertical analysis data, and obtain situation awareness results.

[0095] Specifically, the equipment of the situation awareness system of this embodiment is mainly divided into an agent for collecting data and a detection service for performing analysis / detection services. The agent is responsible for collecting system data, and its main functions are reporting data and receiving instructions. The reported data can be autonomously reported data or data reported in response to instructions; the received instructions can be collection instructions or response instructions. There are two ways to collect data: periodic collection and real-time collection. Periodic collection is performed by the detection service regularly sending fixed collection instructions, and real-time collection is performed by the probe actively collecting and reporting data.

[0096] In actual construction, the Agent can include a communication module, a management module, a collection probe module, a command module, and a response module. The detection server is responsible for real-time detection of threats through the collected data of the Agent, that is, situational awareness.

[0097] The functional modules of the situation awareness system mainly include three modules:

[0098] The device selection module is used to select devices in the device group to serve as the detection server;

[0099] The data acquisition module is mainly run by the selected detection server to obtain the collected data of other devices;

[0100] The situation awareness module is mainly executed by the selected detection server or auxiliary computing node to identify abnormal devices and achieve situation awareness.

[0101] Based on the above embodiment, the present invention further provides a terminal, whose principle block diagram can be shown as follows: Figure 6 As shown. The terminal includes a processor, a memory, a network interface, and a display screen connected through a system bus. Among them, the processor of the terminal is used to provide computing and control capabilities. The memory of the terminal includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the terminal is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a situational awareness method based on functional election is implemented;

[0102] Determine a device group to be sensed, and select a device as a detection server based on the status data corresponding to each device in the device group through a role election algorithm; wherein the status data includes at least one status value of computing resources, credibility, and service priority;

[0103] Acquire the collected data of each device through the detection server, and determine the data analysis node according to the collected data of each device; wherein the data analysis node is the detection server or the auxiliary computing node;

[0104] The data analysis node generates horizontal analysis data and vertical analysis data based on all the collected data, and identifies abnormal devices in the device group based on the horizontal analysis data and the vertical analysis data to obtain situation awareness results.

[0105] The display screen of the terminal may be a liquid crystal display screen or an electronic ink display screen.

[0106] Those skilled in the art will understand that Figure 6 The principle block diagram shown in the figure is only a block diagram of a partial structure related to the scheme of the present invention, and does not constitute a limitation on the terminal to which the scheme of the present invention is applied. The specific terminal may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0107] In one implementation, the memory of the terminal stores one or more programs, and is configured to be executed by one or more processors. The one or more programs include instructions for performing a situation awareness method based on functional election:

[0108] Determine a device group to be sensed, and select a device as a detection server based on the status data corresponding to each device in the device group through a role election algorithm; wherein the status data includes at least one status value of computing resources, credibility, and service priority;

[0109] Acquire the collected data of each device through the detection server, and determine the data analysis node according to the collected data of each device; wherein the data analysis node is the detection server or the auxiliary computing node;

[0110] The data analysis node generates horizontal analysis data and vertical analysis data based on all the collected data, and identifies abnormal devices in the device group based on the horizontal analysis data and the vertical analysis data to obtain situation awareness results.

[0111] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided by the present invention can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0112] In summary, the present invention discloses a situation awareness method, system, terminal and storage medium based on functional election, and relates to the technical field of situation awareness. The method determines the device group to be perceived, and selects the device as the detection server based on the status data corresponding to each device in the device group through the functional election algorithm; wherein the status data includes at least one status value of computing resources, credibility, and service priority; the detection server obtains the collected data of each device, and determines the data analysis node according to the collected data of each device; wherein the data analysis node is the detection server or the auxiliary computing node; the data analysis node generates horizontal analysis data and vertical analysis data according to all the collected data, and identifies the abnormal devices in the device group according to the horizontal analysis data and the vertical analysis data, and obtains the situation awareness result. The present invention makes full use of the idle device resources in the system for situation awareness, which can improve the utilization rate of system resources; and by dynamically adjusting the data analysis nodes, the response time can be effectively guaranteed. It solves the problem that it is difficult to take into account both the system resources and the response time of the Internet of Things in the prior art.

[0113] It should be understood that the application of the present invention is not limited to the above examples. For ordinary technicians in this field, improvements or changes can be made based on the above description. All these improvements and changes should fall within the scope of protection of the claims attached to the present invention.

Claims

1. A situation awareness method based on functional election, characterized in that: The method comprises: Determine a device group to be sensed, and select a device as a detection server based on the status data corresponding to each device in the device group through a role election algorithm; wherein the status data includes at least one status value of computing resources, credibility, and service priority; Acquire the collected data of each device through the detection server, and determine the data analysis node according to the collected data of each device; wherein the data analysis node is the detection server or the auxiliary computing node; The data analysis node generates horizontal analysis data and vertical analysis data based on all the collected data, and identifies abnormal devices in the device group based on the horizontal analysis data and the vertical analysis data to obtain situation awareness results.

2. The situation awareness method based on functional election according to claim 1 is characterized in that: The function selection algorithm is used to select a device as a detection server based on the status data corresponding to each device in the device group, including: When the state data includes multiple types of state values, predetermine the weight values ​​corresponding to the state values ​​of each type; For each device, determine the vote value corresponding to the device according to the weighted sum of all status values ​​corresponding to the device; According to the vote values ​​corresponding to each device, the device serving as the detection server is selected.

3. The situation awareness method based on functional election according to claim 1 is characterized in that: Determining the data analysis node according to the collected data of each device includes: Calculate the data processing volume based on the collected data of each device; Calculating a predicted response time based on the data processing amount; When the predicted response time is greater than a preset time threshold, the auxiliary computing node is used as a data analysis node; wherein the auxiliary computing node is an edge device or a cloud; When the predicted response time is less than or equal to the preset duration threshold, the detection server is used as a data analysis node.

4. The situation awareness method based on functional election according to claim 1 is characterized in that: The method for generating the horizontal analysis data comprises: Classifying the collected data of each device to obtain a plurality of data groups; wherein each of the data groups corresponds to a different data type; For each of the data groups, all data contained in the data group are compared, and similar deviating data are identified through the comparison results; Based on all the homogeneous deviation data, horizontal analysis data are generated.

5. The situation awareness method based on functional election according to claim 4 is characterized in that: The method for generating the longitudinal analysis data comprises: For the collected data of each device, all data contained in the collected data are compared, and deviating data of the same device is identified through the comparison result; Based on all the same-device deviation data, longitudinal analysis data are generated.

6. The situation awareness method based on functional election according to claim 5 is characterized in that: The step of identifying abnormal devices in the device group according to the horizontal analysis data and the vertical analysis data includes: Calculate the proportion of deviation data in the collected data of each device according to the horizontal analysis data and the vertical analysis data; wherein the deviation data includes the same type deviation data and the same device deviation data; Abnormal devices in the device group are determined according to the proportion of the deviation data of each device.

7. The situation awareness method based on functional election according to claim 1 is characterized in that: The method further comprises: determining a backup device from the remaining devices except the abnormal device; The business of the abnormal device is transferred to the backup device for processing.

8. A situation awareness system based on functional election, characterized in that: The system comprises: The device election module is used to determine the device group to be sensed, and select the device as the detection server based on the status data corresponding to each device in the device group through a functional election algorithm; wherein the status data includes at least one status value of computing resources, credibility, and service priority; A data acquisition module, used to acquire the collected data of each device through the detection server, and determine a data analysis node according to the collected data of each device; wherein the data analysis node is the detection server or an auxiliary computing node; The situation awareness module is used to generate horizontal analysis data and vertical analysis data according to all the collected data through the data analysis node, identify abnormal devices in the device group according to the horizontal analysis data and the vertical analysis data, and obtain situation awareness results.

9. A terminal, characterized in that: The terminal includes a memory and at least one processor; the memory stores a program; the program contains instructions for executing the situational awareness method based on functional election as described in any one of claims 1-7; and the processor is used to execute the program.

10. A computer-readable storage medium having a plurality of instructions stored thereon, characterized in that: The instructions are suitable for being loaded and executed by a processor to implement the steps of the situation awareness method based on functional election as described in any one of claims 1-7.

Images