Function-based election based situation awareness method, system, terminal and storage medium

Abstract

The application discloses a function election-based situation awareness method and system, a terminal and a storage medium, and relates to the technical field of situation awareness. A function election algorithm is used to select a device as a detection server based on state data corresponding to each device in a device group. The detection server is used to acquire collection data of each device, determine a data analysis node according to the collection data of each device, and the data analysis node is the detection server or an auxiliary calculation node. The data analysis node is used to generate horizontal analysis data and vertical analysis data according to all the collection data, identify an abnormal device, and obtain a situation awareness result. The application can improve the utilization rate of system resources by fully utilizing idle device resources for situation awareness, and can effectively guarantee the response time by dynamically adjusting the data analysis node. The application solves the problem that the system resources and the response time of the Internet of Things cannot be considered simultaneously in the prior art.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of situation awareness, and particularly relates to a situation awareness method and system based on function election, a terminal and a storage medium. BACKGROUND

[0002] Situation awareness is to perceive the environmental elements within a certain time and space, understand the meaning of the elements, and finally predict the development state of the elements in the future. By using big data analysis technology, situation awareness can classify, count and comprehensively analyze attack events, threat warnings and attack sources, and improve the discovery, identification, understanding, analysis and response and disposal capabilities of security threats from a global perspective.

[0003] Current situation awareness methods mainly include two modes: a single client mode, in which all functions are on the client, and the resource requirement is high, affecting the device performance; and a client and server mode, in which part of the functions are given to the server, so that the resource requirement of the client is reduced, but the response time is greatly prolonged because the server needs to process the data of all clients. At present, both modes are difficult to simultaneously consider system resources and response time.

[0004] Therefore, the prior art still needs to be improved and developed. SUMMARY

[0005] The technical problem solved by the present application is to provide a situation awareness method and system based on function election, a terminal and a storage medium, aiming at solving the problem that the existing situation awareness method is difficult to simultaneously consider the system resources and response time of the Internet of Things.

[0006] The technical scheme adopted by the present application to solve the problem is as follows:

[0007] In a first aspect, the present application provides a situation awareness method based on function election, which comprises:

[0008] determining a device group to be perceived, and selecting a device as a detection server based on state data corresponding to each device in the device group by a function election algorithm; wherein the state data comprises at least one of a computing resource, a credibility and a service priority;

[0009] obtaining collection data of each device through the detection server, and determining a data analysis node according to the collection data of each device; wherein the data analysis node is the detection server or an auxiliary computing node;

[0010] The data analysis node generates horizontal analysis data and longitudinal analysis data according to all the collected data, identifies abnormal devices in the device group according to the horizontal analysis data and the longitudinal analysis data, and obtains a situational awareness result.

[0011] In an implementation method, the function election algorithm filters a device as a detection server based on state data corresponding to each device in the device group.

[0012] When the state data contains multiple types of state values, the weight values corresponding to each type of state value are determined in advance.

[0013] For each device, the vote value corresponding to the device is determined according to the weighted sum of all state values corresponding to the device.

[0014] According to the vote value corresponding to each device, the device as the detection server is filtered.

[0015] In an implementation method, the data analysis node is determined according to the collected data of each device, including:

[0016] According to the collected data of each device, the data processing amount is calculated.

[0017] According to the data processing amount, the predicted response time is calculated.

[0018] When the predicted response time is greater than a preset time threshold, an auxiliary computing node is used as a data analysis node; wherein the auxiliary computing node is an edge device or a cloud.

[0019] When the predicted response time is less than or equal to the preset time threshold, the detection server is used as a data analysis node.

[0020] In an implementation method, the horizontal analysis data generation method includes:

[0021] The collected data of each device is classified to obtain a plurality of data groups; wherein each data group corresponds to a different data type.

[0022] For each data group, all data included in the data group are compared, and the same type of deviated data is identified through the comparison result.

[0023] The horizontal analysis data is generated according to all the same type of deviated data.

[0024] In an implementation method, the longitudinal analysis data generation method includes:

[0025] The same-device deviating data is identified by comparing all data contained in the collected data of each device;

[0026] The longitudinal analysis data is generated according to all the same-device deviating data.

[0027] In an implementation method, the abnormal device in the device group is identified according to the transverse analysis data and the longitudinal analysis data, including:

[0028] The proportion of deviating data in the collected data of each device is calculated according to the transverse analysis data and the longitudinal analysis data; wherein the deviating data includes the same-type deviating data and the same-device deviating data;

[0029] The abnormal device in the device group is determined according to the proportion of deviating data of each device.

[0030] In an implementation method, the method further includes:

[0031] A backup device is determined from the remaining devices except the abnormal device;

[0032] The service of the abnormal device is transferred to the backup device for processing.

[0033] In a second aspect, the embodiments of the present application further provide a situation awareness system based on function election, and the system includes:

[0034] A device election module is configured to determine a device group to be perceived, and filter out a device as a detection server based on state data respectively corresponding to each device in the device group by a function election algorithm; wherein the state data includes at least one state value in computing resource, credibility and service priority.

[0035] A data acquisition module is configured to acquire collected data of each device through the detection server, and determine a data analysis node according to the collected data of each device; wherein the data analysis node is the detection server or an auxiliary computing node.

[0036] A situation awareness module is configured to generate transverse analysis data and longitudinal analysis data according to all the collected data through the data analysis node, identify an abnormal device in the device group according to the transverse analysis data and the longitudinal analysis data, and obtain a situation awareness result.

[0037] In a third aspect, the embodiments of the present application further provide a terminal, including a memory and at least one processor; the memory stores a program; the program includes instructions for executing the function election-based situation awareness method described in any of the above aspects; and the processor is configured to execute the program.

[0038] In a fourth aspect, the embodiments of the present application further provide a computer readable storage medium, which stores a plurality of instructions, the instructions being suitable for being loaded and executed by a processor to implement the steps of the function election based situation awareness method according to any one of the above.

[0039] The present application has the following beneficial effects: The embodiments of the present application determine a device group to be perceived, filter out a device as a detection server based on state data respectively corresponding to each device in the device group through a function election algorithm, wherein the state data comprises at least one of a computing resource, a credibility and a service priority, acquire collection data of each device through the detection server, determine a data analysis node according to the collection data of each device, wherein the data analysis node is the detection server or an auxiliary computing node, generate horizontal analysis data and vertical analysis data according to all the collection data through the data analysis node, identify an abnormal device in the device group according to the horizontal analysis data and the vertical analysis data, and obtain a situation awareness result. The present application makes full use of idle device resources in a system to perform situation awareness, and can improve the utilization rate of system resources, and can effectively guarantee a response time through dynamic adjustment of the data analysis node. The problem that system resources and a response time of the Internet of Things are difficult to be considered simultaneously in the prior art is solved. BRIEF DESCRIPTION OF DRAWINGS

[0040] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or the prior art description. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without any creative effort on the basis of these drawings.

[0041] Figure 1 is a flowchart of the function election based situation awareness method provided by the embodiments of the present application.

[0042] Figure 2 is a flowchart of device collection data provided by the embodiments of the present application.

[0043] Figure 3 is a data type diagram of data acquired by the detection server provided by the embodiments of the present application.

[0044] Figure 4 is a business flow diagram provided by the embodiments of the present application.

[0045] Figure 5 is a functional module diagram of the function election based situation awareness system provided by the embodiments of the present application.

[0046] Figure 6 is a principle block diagram of a terminal provided by an embodiment of the present application. DETAILED DESCRIPTION

[0047] The present application discloses a function election-based situation awareness method and system, a terminal and a storage medium. To make the purpose, technical solution and effects of the present application clearer and more explicit, the present application is further described in detail below with reference to the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and do not limit the present application.

[0048] Those skilled in the art can understand that the singular forms "a", "an" and "the" used herein include plural forms unless specifically stated otherwise. It should be further understood that the use of the term "include" in the specification of the present application means that the stated features, integers, steps, operations, elements and / or components exist, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or groups thereof. It should be understood that when we say that an element is "connected" or "coupled" to another element, it can be directly connected or coupled to the other element, or there can be intermediate elements. In addition, "connected" or "coupled" used herein can include wireless connection or wireless coupling. The term "and / or" used herein includes all or any single unit and all combinations of the associated listed items.

[0049] Those skilled in the art can understand that unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as that generally understood by those skilled in the art to which the present application belongs. It should also be understood that terms such as those defined in a general dictionary should be understood to have meanings consistent with those in the context of the prior art, and should not be interpreted in an idealized or overly formal sense unless specifically defined as such.

[0050] Situation awareness is to perceive the environmental elements within a certain time and space, understand the meaning of the elements, and finally predict the development state of the elements in the future. Using big data analysis technology, situation awareness can classify, count and comprehensively analyze attack events, threat warnings and attack sources, and improve the discovery, identification, understanding, analysis and response and disposal capabilities of security threats from a global perspective.

[0051] Current situation awareness methods mainly include two modes: single agent mode, in which all functions are on the agent side, requiring high resources and affecting device performance; and agent and server mode, in which part of the functions are given to the server, so that the resource requirements of the agent are reduced, but the response time is greatly prolonged because the server needs to process data of all agents. Both of the two modes are difficult to balance system resources and response time.

[0052] In view of the above defects of the prior art, the present application provides a situation awareness method based on function election. The method determines a device group to be perceived, and selects a device as a detection server based on state data corresponding to each device in the device group through a function election algorithm; wherein the state data includes at least one of a computing resource, a credibility, and a service priority; the detection server obtains collection data of each device, and determines a data analysis node according to the collection data of each device; wherein the data analysis node is the detection server or an auxiliary computing node; the data analysis node generates horizontal analysis data and vertical analysis data according to all the collection data, identifies an abnormal device in the device group according to the horizontal analysis data and the vertical analysis data, and obtains a situation awareness result. The present application makes full use of idle device resources in the system for situation awareness, which can improve the utilization rate of system resources; and by dynamically adjusting the data analysis node, the response time can be effectively guaranteed. The problem that system resources and response time of the Internet of Things are difficult to balance in the prior art is solved.

[0053] As shown in Figure 1 , the method specifically includes:

[0054] Step S100, determining a device group to be perceived, and selecting a device as a detection server based on state data corresponding to each device in the device group through a function election algorithm; wherein the state data includes at least one of a computing resource, a credibility, and a service priority.

[0055] Specifically, first, a specific device group is defined in the system, for each device in the group, their state data is collected, which can include multiple types. For example: computing resources, to reflect the computing power of the device; credibility, to assess the reliability of the device; service priority: the priority assigned to the device according to business needs or management policies, high-priority devices may have more advantages in resource allocation or task execution. The function election algorithm selects the most suitable device from multiple devices to perform data analysis tasks. In actual application, the function election algorithm will evaluate the suitability of each device as a detection server based on the collected state data of each device, such as whether the computing power of the device is strong enough to undertake data analysis tasks, whether the credibility of the device is high enough to ensure data security, and whether the priority of the device is suitable as a detection server, etc. After calculation and comparison by the function election algorithm, the most suitable device will be selected as the detection server, which will undertake subsequent data analysis tasks. This embodiment is an automatic device selection mechanism that can dynamically determine the most suitable device as a detection server based on the real-time state of each device in the device group, without the need to set an additional detection server. This embodiment can make full use of idle device resources in the system for situation awareness, improving the utilization of system resources.

[0056] For example, computing resources include: processor speed, memory size, storage capacity, etc. of the device; credibility includes: security score, historical behavior record, etc. of the device (such as whether it has been attacked or violated operation); service priority can be divided into low, medium and high three categories, low-priority devices have weak performance and do not participate in detection; medium-priority devices are general ordinary devices and can handle data with low complexity; high-priority devices are usually high-performance devices and can handle data with high complexity. In actual application, if necessary, the priority can also be subdivided.

[0057] In one implementation, the function election algorithm based on the state data corresponding to each device in the device group to select a device as a detection server includes:

[0058] When the state data contains multiple types of state values, the weight values corresponding to each type of state value are determined in advance;

[0059] For each device, the vote value corresponding to the device is determined according to the weighted sum of all state values corresponding to the device;

[0060] According to the vote value corresponding to each device, the device as the detection server is selected.

[0061] Specifically, when the status data contains multiple types of status values, it is necessary to comprehensively consider the impact of various status values ​​on device screening and ultimately determine a suitable device as a detection server. In actual applications, since different status values ​​have different impacts on the suitability of a device as a detection server, it is necessary to assign a weight value to each status value. The weight value can be set based on business needs, user experience, and a preset optimization algorithm. The high or low weight value reflects the relative importance of each status value in the comprehensive evaluation. Taking a device as an example, all status values ​​of the device are collected, each status value is multiplied by its corresponding weight value to obtain the weighted value of the state, and the weighted values ​​of all status values ​​are added together to obtain the weighted sum of the device. This weighted sum can be directly used as the vote value of the device, or it can be further generated through a preset conversion function (such as a normalization function) to generate the final vote value. The high or low vote value can be used to quantitatively evaluate the suitability of each device as a detection server. The vote values ​​of each device are compared, and one or more devices with the highest vote value are selected as the detection server.

[0062] Step S200: Acquire the collected data of each device through the detection server, and determine a data analysis node according to the collected data of each device; wherein the data analysis node is the detection server or an auxiliary computing node.

[0063] Specifically, if Figure 2 As shown, in this embodiment, the device other than the detection server is used as an agent. After each agent is started, it is initialized and loaded with the acquisition module according to the configuration. After establishing a connection with the detection server, it enters a waiting loop, waits for the detection server's instructions and collects and reports data. Each device sends the collected data to the detection server for data analysis. The detection server determines the complexity of the data analysis task based on the received collected data, and then determines whether to forward the data analysis task to the auxiliary computing node. If not, the detection server performs the data analysis task. For example, the detection server calculates the complexity of the received collected data. If the collected data is time series data, the complexity of the data is high, and the data analysis task is sent to the auxiliary computing node. When the detection server needs to process complex and time-consuming data analysis tasks, it forwards the data analysis task to the auxiliary computing node, which can effectively provide expansion capabilities and thus ensure response time.

[0064] In one implementation, determining the data analysis node based on the collected data of each device includes:

[0065] Calculate the data processing capacity based on the collected data of each device;

[0066] Calculating a predicted response time based on the data processing volume;

[0067] When the predicted response time is greater than a preset time threshold, an auxiliary computing node is used as a data analysis node; wherein the auxiliary computing node is an edge device or a cloud server.

[0068] When the predicted response time is less than or equal to the preset time threshold, the detection server is used as a data analysis node.

[0069] Specifically, the detection server will evaluate the size, complexity and processing requirements of the collected data of each device to calculate the total data processing capacity, such as the time and resources required for data storage, transmission and processing. Then, according to the total data processing capacity, the detection server predicts the response time required to complete the data analysis task in combination with its own performance. The predicted response time can reflect whether the detection server can quickly execute the current data analysis task. If the predicted response time exceeds the acceptable preset time threshold, it means that the detection server may not be able to process the data analysis task of each collected data in time. In this case, the system will involve an auxiliary computing node in the data analysis process to share the computing load and thus shorten the response time. Since the edge device is close to the data source, it can process the data analysis task faster and reduce the delay, and the cloud server can provide powerful computing power and storage resources, so the two are used as alternative auxiliary computing nodes. If the predicted response time does not exceed the preset time threshold, it means that the detection server itself is sufficient to process the current data analysis task and no additional auxiliary computing resources are needed, so the system will preferentially use the detection server to execute the data analysis task.

[0070] Step S300, generating horizontal analysis data and vertical analysis data according to all the collected data by the data analysis node, identifying abnormal devices in the device group according to the horizontal analysis data and the vertical analysis data, and obtaining a situation awareness result.

[0071] Specifically, the data analysis node will perform data analysis tasks from two dimensions. Horizontal analysis refers to comparing and analyzing the same kind of data collected by multiple devices; vertical analysis refers to comparing and analyzing multiple kinds of data collected by the same device. Then, the horizontal analysis data and the vertical analysis data are comprehensively analyzed to more accurately identify abnormal devices that may pose potential threats in the device group. Such devices may be attacked, malfunctioning, or have configuration problems.

[0072] In an implementation manner, the method for generating the horizontal analysis data comprises:

[0073] performing data classification on the collected data of each device to obtain a plurality of data groups; wherein each data group corresponds to a different data type;

[0074] For each data group, all data contained in the data group are compared, and the same type of deviated data is identified through the comparison result;

[0075] According to all the same type of deviated data, transverse analysis data is generated.

[0076] Specifically, the collected data of each device is first classified, and the classification purpose is to group the same / similar type of data to facilitate subsequent processing and analysis. The classification standard can be determined based on one or more indicators such as the source, type, format, and purpose of the data. Each group of data obtained after classification is a data group, and each data group contains the same type of data from different devices. Different data groups correspond to different data types, which can include temperature data, function data, CPU data, memory data, and the like (as shown in FIG. 1). Figure 3 For each data group, all data contained in the data group are compared, and the same type of deviated data is identified through the comparison result;

[0077] In an implementation manner, the generation method of the longitudinal analysis data includes:

[0078] For each device, all data contained in the collected data of the device are compared, and the same device deviated data is identified through the comparison result;

[0079] According to all the same device deviated data, longitudinal analysis data is generated.

[0080] Specifically, the longitudinal analysis is performed independently for the collected data of each device, rather than mixed analysis of the collected data of multiple devices. For each device, all data collected by the device are compared internally to identify data that is significantly different from the generation / variation trend of other data of the device, and such deviated data is defined as the same device deviated data. According to all the same device deviated data, the longitudinal analysis result is obtained. In actual application, the comparison process of the longitudinal analysis can adopt one or more comparison methods, such as a statistical analysis method, a time series analysis method, and a machine learning algorithm.

[0081] In an implementation manner, the identification of the abnormal device in the device group according to the transverse analysis data and the longitudinal analysis data includes:

[0082] According to the crosswise analysis data and the longitudinal analysis data, a proportion of deviated data in the collection data of each device is calculated; wherein the deviated data comprises the same-type deviated data and the same-device deviated data;

[0083] According to the proportion of the deviated data of each device, an abnormal device in the device group is determined.

[0084] Specifically, first, the proportion of deviated data in the collection data of each device is calculated by using the previously generated crosswise analysis data and the longitudinal analysis data, wherein the same-type deviated data and the same-device deviated data both belong to the deviated data. The proportion of deviated data can be determined by the ratio of the number of deviated data to the total data amount. In actual application, a deviated threshold can be preset to determine whether a device is abnormal. Taking a device as an example, if the proportion of deviated data of the device exceeds the preset deviated threshold, the device is considered to be an abnormal device, which needs to be further monitored and concerned.

[0085] In an implementation manner, the method further comprises:

[0086] determining a backup device from the remaining devices except the abnormal device;

[0087] transferring the service of the abnormal device to the backup device for processing.

[0088] Specifically, as shown in the figure, Figure 4 In order to ensure data security and normal operation of the service, the embodiment needs to take suppression or ban measures on the abnormal device and timely transfer the service of the abnormal device. In actual application, service processing information on the abnormal device is first acquired, which can include service type, service priority (urgency and importance of the service), service dependency relationship (dependency relationship of the service with services on other devices), and current service state (current state of the service, such as in progress, pause, or completed). By the acquired service processing information, one or more normal devices in the device group are selected as backup devices. The following factors can be considered when selecting the backup devices: device performance, that is, whether the processing capacity of the backup device can meet the service requirement; device state, that is, whether the backup device is normally running without fault or performance problem; service compatibility, that is, whether the backup device supports the type and processing requirement of the current service; network bandwidth, that is, whether the network connection between the backup device and the abnormal device or the service-related device of the abnormal device is stable and whether the bandwidth is sufficient. Finally, the service on the abnormal device is transferred to the selected backup device for processing, thereby ensuring safe and uninterrupted operation of the device service. After the abnormal device recovers normally or the risk is eliminated, the transferred service flow is transferred back to the original device.

[0089] The present application has the following advantages:

[0090] By separating the functions of data collection and data analysis and utilizing the communication capabilities of the operating system's distributed soft bus to send data to the data analysis device for data analysis, we can fully utilize the idle device resources in the system for situational awareness, solve the problem of low-performance devices being unable to perform situational awareness, and ensure response time.

[0091] Based on the above embodiments, the present invention also provides a situation awareness system based on functional election, such as Figure 5 As shown, the system includes:

[0092] Device election module 01 is used to determine a device group to be sensed and select a device to be used as a detection server based on the status data corresponding to each device in the device group using a role election algorithm. The status data includes at least one status value of computing resources, credibility, and service priority.

[0093] Data acquisition module 02, used to acquire the collected data of each device through the detection server, and determine the data analysis node according to the collected data of each device; wherein the data analysis node is the detection server or the auxiliary computing node;

[0094] The situation awareness module 03 is used to generate horizontal analysis data and vertical analysis data based on all the collected data through the data analysis node, identify abnormal devices in the device group based on the horizontal analysis data and the vertical analysis data, and obtain situation awareness results.

[0095] Specifically, the devices of the situational awareness system of this embodiment are mainly divided into an agent for collecting data and a detection server for performing analysis / detection services. The agent is responsible for collecting system data, and its main functions are reporting data and receiving instructions. The reported data can be autonomously reported data or data reported in response to instructions; the received instructions can be collection instructions or response instructions. There are two ways to collect data: periodic collection and real-time collection. Periodic collection is performed by the detection service regularly sending fixed collection instructions, while real-time collection is performed by the probe actively collecting and reporting data.

[0096] In actual construction, the Agent can include a communication module, a management module, a collection probe module, a command module, and a response module. The detection server is responsible for real-time threat detection through the collected data of the Agent, which is also called situational awareness.

[0097] The functional modules of the situational awareness system mainly include three modules:

[0098] The device selection module is used to select devices in the device group to serve as detection servers;

[0099] The data acquisition module is mainly run by the screened detection server, and is used for acquiring the collection data of other devices.

[0100] The situation awareness module is mainly executed by the screened detection server or the auxiliary computing node, and is used for identifying the abnormal device and realizing situation awareness.

[0101] Based on the above embodiment, the application further provides a terminal, and a principle block diagram of the terminal can be as shown in the figure. Figure 6 The terminal includes a processor, a memory, a network interface and a display screen connected through a system bus. The processor of the terminal is used to provide computing and control capabilities. The memory of the terminal includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operating system and the computer program in the non-volatile storage medium. The network interface of the terminal is used to communicate with external terminals through network connection. The computer program is executed by the processor to realize the situation awareness method based on function election;

[0102] A device group to be sensed is determined, and a device serving as a detection server is screened out based on state data respectively corresponding to each device in the device group through a function election algorithm. The state data includes at least one state value in a computing resource, a credibility and a service priority.

[0103] Collection data of each device is acquired through the detection server, and a data analysis node is determined according to the collection data of each device. The data analysis node is the detection server or an auxiliary computing node.

[0104] Horizontal analysis data and vertical analysis data are generated through the data analysis node according to all the collection data, and an abnormal device in the device group is identified according to the horizontal analysis data and the vertical analysis data, so as to obtain a situation awareness result.

[0105] The display screen of the terminal can be a liquid crystal display screen or an electronic ink display screen.

[0106] Those skilled in the art can understand that, Figure 6 The principle block diagram shown in the figure is only a block diagram of part of the structure related to the application scheme, and does not constitute a limitation on the terminal to which the application scheme is applied. The specific terminal can include more or fewer components than those shown in the figure, or combine certain components, or have a different component arrangement.

[0107] In an implementation manner, the memory of the terminal stores more than one program, and is configured to execute the more than one program by more than one processor, and the more than one program includes instructions for performing the situation awareness method based on function election.

[0108] determining a device group to be perceived, and selecting a device as a detection server based on state data of each device in the device group by a function election algorithm, wherein the state data comprises at least one of a computing resource, a credibility, and a service priority;

[0109] obtaining collection data of each device through the detection server, and determining a data analysis node according to the collection data of each device, wherein the data analysis node is the detection server or an auxiliary computing node;

[0110] generating horizontal analysis data and vertical analysis data according to all the collection data through the data analysis node, identifying an abnormal device in the device group according to the horizontal analysis data and the vertical analysis data, and obtaining a situation awareness result.

[0111] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiments can be completed by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer readable storage medium. When the computer program is executed, it can include the processes of the above-mentioned embodiments. Any reference to memory, storage, database or other medium in each embodiment of the present application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration but not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0112] In summary, the application discloses a function election-based situation awareness method and system, a terminal and a storage medium, and relates to the technical field of situation awareness. The method determines a device group to be sensed, selects a device as a detection server based on state data corresponding to each device in the device group through a function election algorithm, wherein the state data includes at least one of a computing resource, a credibility and a service priority, obtains collection data of each device through the detection server, determines a data analysis node according to the collection data of each device, wherein the data analysis node is the detection server or an auxiliary computing node, generates horizontal analysis data and vertical analysis data according to all the collection data through the data analysis node, identifies an abnormal device in the device group according to the horizontal analysis data and the vertical analysis data, and obtains a situation awareness result. The application makes full use of idle device resources in a system to perform situation awareness, and can improve the utilization rate of system resources, and can effectively guarantee a response time through dynamic adjustment of the data analysis node. The application solves the problem that system resources and a response time of the Internet of Things cannot be considered simultaneously in the prior art.

[0113] It should be understood that the application of the present application is not limited to the above examples, and can be improved or changed according to the above description for those skilled in the art, and all these improvements and changes shall belong to the protection scope of the claims of the present application.

Claims

1. A situation awareness method based on functional election, characterized in that: The method comprises: Determine a device group to be sensed, and select a device to serve as a detection server based on status data corresponding to each device in the device group using a role election algorithm; wherein the status data includes at least one status value of computing resources, credibility, and service priority; Acquire the collected data of each device through the detection server, and determine the data analysis node according to the collected data of each device, wherein the data analysis node is the detection server or the auxiliary computing node, including: calculating the data processing amount according to the collected data of each device; calculating the predicted response time according to the data processing amount; when the predicted response time is greater than a preset time threshold, use the auxiliary computing node as the data analysis node; wherein the auxiliary computing node is an edge device or a cloud; when the predicted response time is less than or equal to the preset time threshold, use the detection server as the data analysis node; The data analysis node generates horizontal analysis data and vertical analysis data based on all the collected data, and identifies abnormal devices in the device group based on the horizontal analysis data and the vertical analysis data to obtain situation awareness results.

2. The situation awareness method based on functional election according to claim 1 is characterized in that: The function selection algorithm is used to select a device as a detection server based on the status data corresponding to each device in the device group, including: When the status data includes multiple types of status values, predetermine the weight values ​​corresponding to each type of status value; For each device, determine the vote value corresponding to the device based on the weighted sum of all status values ​​corresponding to the device; According to the vote values ​​corresponding to the respective devices, the devices serving as the detection server are selected.

3. The situation awareness method based on functional election according to claim 1 is characterized in that: The method for generating the horizontal analysis data includes: Classifying the collected data of each device to obtain a plurality of data groups; wherein each of the data groups corresponds to a different data type; For each of the data groups, all data contained in the data group are compared, and similar deviating data are identified through the comparison results; Based on all the homogeneous deviation data, horizontal analysis data are generated.

4. The situation awareness method based on functional election according to claim 3 is characterized in that: The method for generating the longitudinal analysis data includes: For each device's collected data, all data included in the collected data are compared, and deviating data from the same device is identified through the comparison results; Based on all the same-device deviation data, longitudinal analysis data are generated.

5. The situation awareness method based on functional election according to claim 4 is characterized in that: The identifying abnormal devices in the device group according to the horizontal analysis data and the vertical analysis data includes: Calculate the proportion of deviation data in the collected data of each device based on the horizontal analysis data and the vertical analysis data; wherein the deviation data includes the deviation data of the same type and the deviation data of the same device; Abnormal devices in the device group are determined according to the proportion of the deviation data of each device.

6. The situation awareness method based on functional election according to claim 1 is characterized in that: The method further comprises: determining a backup device from the remaining devices except the abnormal device; The business of the abnormal device is transferred to the backup device for processing.

7. A situational awareness system based on functional election, characterized in that: The system comprises: A device selection module is configured to determine a device group to be sensed and select a device to serve as a detection server based on the status data corresponding to each device in the device group using a role selection algorithm; wherein the status data includes at least one status value of computing resources, credibility, and service priority; A data acquisition module is configured to acquire collected data from each device through the detection server, and determine a data analysis node based on the collected data from each device, wherein the data analysis node is the detection server or an auxiliary computing node, including: calculating a data processing amount based on the collected data from each device; calculating a predicted response time based on the data processing amount; when the predicted response time is greater than a preset time threshold, using the auxiliary computing node as a data analysis node; wherein the auxiliary computing node is an edge device or a cloud; when the predicted response time is less than or equal to the preset time threshold, using the detection server as a data analysis node; The situation awareness module is used to generate horizontal analysis data and vertical analysis data based on all the collected data through the data analysis node, identify abnormal devices in the device group based on the horizontal analysis data and the vertical analysis data, and obtain situation awareness results.

8. A terminal, characterized in that: The terminal includes a memory and at least one processor; the memory stores a program; the program includes instructions for executing the situational awareness method based on functional election as described in any one of claims 1-6; and the processor is used to execute the program.

9. A computer-readable storage medium having a plurality of instructions stored thereon, characterized in that: The instructions are suitable for being loaded and executed by a processor to implement the steps of the situation awareness method based on function election as described in any one of claims 1 to 6.

Images