Equipment behavior analysis and anomaly detection method and system based on Internet of Things

Abstract

The invention discloses a behavior analysis and anomaly detection method and system based on Internet of Things equipment, and relates to the technical field of power Internet of Things, and the method comprises the steps: obtaining behavior data of power grid Internet of Things equipment, carrying out the preprocessing of the obtained behavior data, and carrying out the feature extraction of the preprocessed behavior data; analyzing the extracted features, and establishing an Internet of Things equipment behavior model; and identifying a device state based on the Internet of Things device behavior model, and outputting a corresponding defense means. According to the equipment behavior analysis and anomaly detection method based on the Internet of Things, the accuracy of abnormal behavior detection is improved, the reliability of a classification result and the comprehensiveness of detection are ensured through fusion and comprehensive analysis of various data sources and a multi-model verification method, various conditions of equipment faults, data anomalies and operation anomalies are covered, and the accuracy of abnormal behavior detection is improved. And a flexible protection means is provided, and efficient maintenance and stable operation of a power grid system are realized.

Description

Technical Field

[0001] The present invention relates to the technical field of electric power Internet of Things, and in particular to a method and system based on behavior analysis and anomaly detection of Internet of Things devices. Background Art

[0002] In modern power grid systems, the widespread use of IoT devices has significantly improved the efficiency, reliability and intelligence of power grids. Among these devices, such as smart metering devices, sensors, and automated control systems, they can monitor various aspects of the power grid in real time, thereby optimizing power distribution and consumption. However, the popularity of IoT devices has also brought new security challenges, especially in terms of device operability, data integrity, and system security.

[0003] With the intelligentization of power grids, IoT devices play an increasingly important role in power grids. These devices support the decision-making and operation of power grids by collecting and transmitting large amounts of critical data. However, IoT devices have become one of the main targets of cyber attacks due to their wide distribution and weak security measures. Attackers can gain control of these devices and conduct attacks such as data theft, tampering, or denial of service, thereby posing a serious threat to the stability and security of the power grid. Therefore, how to obtain the abnormal behavior of devices in real time and accurately determine the type of abnormal behavior to output corresponding protection measures is a technical problem that needs to be urgently solved to prevent stability and security problems in the power grid. Summary of the invention

[0004] In view of the above-mentioned problems, the present invention is proposed.

[0005] Therefore, the technical problem solved by the present invention is that the existing behavior analysis and anomaly detection methods of IoT devices have low detection accuracy and poor real-time performance, as well as the optimization problem of how to effectively distinguish different types of abnormal behaviors.

[0006] In order to solve the above technical problems, the present invention provides the following technical solutions: a method based on behavior analysis and anomaly detection of IoT devices, comprising:

[0007] Obtaining the behavior data of the power grid IoT devices, preprocessing the acquired behavior data, and extracting features from the preprocessed behavior data;

[0008] Analyze the extracted features and build a behavioral model for IoT devices;

[0009] Identify device status based on IoT device behavior model and output corresponding defense measures.

[0010] As a preferred solution of the method based on IoT device behavior analysis and anomaly detection described in the present invention, wherein: the behavior data includes current and voltage data;

[0011] The feature extraction includes extracting statistical features, extracting frequency domain features and correlation analysis.

[0012] As a preferred solution of the method based on IoT device behavior analysis and anomaly detection described in the present invention, the statistical feature extraction includes extracting the mean, standard deviation, maximum and minimum values ​​of the IoT device current, and obtaining the comprehensive current feature, which is expressed as:

[0013] S=w1μ I +w2σ I +w3Max I +w4Min I

[0014] Among them, w1, w2, w3, w4 are weights, μ I represents the mean value of the current, σ I Indicates the standard deviation of the current, Max I Indicates the maximum value of the current, Min I Indicates the minimum value of the current;

[0015] The extracted frequency domain features are expressed as:

[0016]

[0017] Among them, V n is the nth voltage data point, N is the number of samples, k is the frequency index, and i is the imaginary unit.

[0018] As a preferred solution of the method based on IoT device behavior analysis and anomaly detection described in the present invention, the correlation analysis uses the Pearson correlation coefficient to calculate the correlation coefficient between different variables, which is expressed as:

[0019]

[0020] in, is the Pearson correlation coefficient between the normalized current comprehensive characteristics and voltage frequency domain characteristics, is the i-th normalized current comprehensive characteristic value, is the average value of the normalized comprehensive current characteristics, is the ith normalized voltage frequency domain eigenvalue, is the average value of the normalized voltage frequency domain characteristics, n is the number of samples;

[0021] Compare the correlation analysis results with the correlation threshold. is greater than or equal to the correlation threshold, constructs the combined features, and constructs the first feature matrix. If If the correlation threshold is less than the correlation threshold, representative features are selected to construct the second feature matrix;

[0022] The feature matrix is ​​input into the random forest model for prediction, the prediction results are output, the prediction results are analyzed, and the behavior patterns are determined as normal behavior, equipment failure, data anomaly, and operation anomaly.

[0023] As a preferred solution of the method based on IoT device behavior analysis and anomaly detection described in the present invention, wherein: the construction of the first feature matrix is ​​expressed as,

[0024]

[0025]

[0026] Among them, C1 is the product feature of the current comprehensive feature and the voltage frequency domain feature, is the normalized comprehensive characteristic of current, is the normalized voltage frequency domain feature, C2 is the square sum feature of the current comprehensive feature and the voltage frequency domain feature, is the normalized comprehensive characteristic of current, is the normalized voltage frequency domain characteristic, is the i-th normalized current comprehensive characteristic value, is the ith normalized voltage frequency domain eigenvalue, C 1i is the product eigenvalue of the i-th sample, is the sum of squares eigenvalue of the i-th sample.

[0027] As a preferred solution of the method for behavior analysis and anomaly detection based on IoT devices described in the present invention, the second feature matrix is ​​constructed by dividing the data set into a training set and a test set, and performing the current comprehensive feature S and the voltage frequency domain feature X on the data set. V Perform normalization processing, select the K-fold cross-validation method, set the validation parameters, use the current comprehensive feature and voltage frequency domain feature to train the model, perform cross-validation, and record the performance indicators, calculate the average performance indicator of the cross-validation, compare the performance of the current comprehensive feature model and the voltage frequency domain feature model, and construct the second feature matrix based on the performance indicator comparison results;

[0028] If the cross-validation shows that the comprehensive current features improve the model performance by more than the preset threshold, the second feature matrix is ​​expressed as:

[0029]

[0030] in, is the i-th normalized comprehensive characteristic value of current;

[0031] If the cross-validation shows that the voltage frequency domain features improve the model performance beyond the preset threshold, the second feature matrix is ​​expressed as:

[0032]

[0033] in, is the ith normalized voltage frequency domain eigenvalue.

[0034] As a preferred solution of the method based on IoT device behavior analysis and anomaly detection described in the present invention, the output corresponding defense means includes: when the abnormal mode is determined to be a device failure, collecting current and voltage data samples every second in the past 24 hours, and performing trend analysis, using the data of the past 30 days for comparative analysis, identifying the fault mode, combining the operation log of the device, preliminarily judging the cause of the fault, using Fourier transform to perform frequency domain analysis on the voltage and current data, extracting the frequency component, comparing the frequency domain characteristics of the abnormal data with the normal data, identifying the frequency anomaly, and extracting fault characteristic indicators such as harmonic content and resonant frequency, using a decision tree model to perform multi-model verification on the data, selecting split features through information gain, gradually building a decision tree model, and comprehensively judging the fault type;

[0035] Based on the preliminary analysis and multi-model verification results, determine the hardware components that need to be checked, check the sensors, circuit boards, and power components, use fault diagnosis tools, perform hardware testing and verification, record the hardware inspection results and compare them with the model prediction results. If there is no obvious fault in the hardware inspection results, further perform software diagnosis, check the firmware and software versions of the device, confirm whether there are known bugs or vulnerabilities, run software diagnostic tools, check the program's running status and log files, compare the software diagnosis results with the hardware inspection results, and comprehensively analyze the possible causes of the fault;

[0036] Based on the hardware and software diagnosis results, determine the repair measures, prioritize hardware and software issues, determine the repair order, replace or repair damaged hardware components, update the device's firmware and software, fix known bugs, and perform software optimization and upgrades.

[0037] Another object of the present invention is to provide a system based on Internet of Things device behavior analysis and anomaly detection, which can solve the problems of inaccurate abnormal behavior detection, untimely response and unrefined classification in the existing power grid Internet of Things device monitoring system by constructing a comprehensive data analysis and multi-model verification system.

[0038] To solve the above technical problems, the present invention provides the following technical solutions: a system based on Internet of Things device behavior analysis and anomaly detection, comprising: a data acquisition module, a model building module and an anomaly control module; the data acquisition module is used to obtain the behavior data of the power grid Internet of Things devices, and pre-process the acquired behavior data, and perform feature extraction on the pre-processed behavior data; the model building module is used to analyze the extracted features and establish an Internet of Things device behavior model; the anomaly control module is used to identify the device status based on the Internet of Things device behavior model and output corresponding defense measures.

[0039] A computer device includes a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of the method based on behavior analysis and anomaly detection of Internet of Things devices are implemented as described above.

[0040] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the method for behavior analysis and anomaly detection based on IoT devices as described above.

[0041] Beneficial effects of the present invention: The method based on IoT device behavior analysis and anomaly detection provided by the present invention improves the accuracy of abnormal behavior detection, ensures the reliability of classification results and the comprehensiveness of detection through the integration and comprehensive analysis of multiple data sources and multi-model verification methods, covers a variety of situations such as equipment failure, data anomalies and operational anomalies, and provides flexible protection measures to achieve efficient maintenance and stable operation of the power grid system. At the same time, through the continuous optimization of data and operating processes, the probability of future anomalies is reduced. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0043] Figure 1 An overall flow chart of a method based on IoT device behavior analysis and anomaly detection provided by one embodiment of the present invention. DETAILED DESCRIPTION

[0044] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0045] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0046] Example 1

[0047] Reference Figure 1 , as an embodiment of the present invention, provides a method based on IoT device behavior analysis and anomaly detection, comprising:

[0048] Obtaining the behavior data of the power grid IoT devices, preprocessing the acquired behavior data, and extracting features from the preprocessed behavior data;

[0049] Analyze the extracted features and build a behavioral model for IoT devices;

[0050] Identify device status based on IoT device behavior model and output corresponding defense measures.

[0051] The behavior data includes current and voltage data;

[0052] The feature extraction includes extracting statistical features, extracting frequency domain features and correlation analysis.

[0053] The statistical feature extraction includes extracting the mean, standard deviation, maximum and minimum values ​​of the current of the IoT device to obtain the comprehensive current features, which are expressed as:

[0054] S=w1μ I +w2σ I +w3Max I +w4Min I

[0055] Among them, w1, w2, w3, w4 are weights, μ I represents the mean value of the current, σ I Indicates the standard deviation of the current, Max I Indicates the maximum value of the current, Min I Indicates the minimum value of the current;

[0056] The extracted frequency domain features are expressed as:

[0057]

[0058] Among them, V n is the nth voltage data point, N is the number of samples, k is the frequency index, and i is the imaginary unit.

[0059] The correlation analysis uses the Pearson correlation coefficient to calculate the correlation coefficient between different variables, expressed as:

[0060]

[0061] in, is the Pearson correlation coefficient between the normalized current comprehensive characteristics and voltage frequency domain characteristics, is the i-th normalized current comprehensive characteristic value, is the average value of the normalized comprehensive current characteristics, is the ith normalized voltage frequency domain eigenvalue, is the average value of the normalized voltage frequency domain characteristics, n is the number of samples;

[0062] Compare the correlation analysis results with the correlation threshold. is greater than or equal to the correlation threshold, constructs the combined features, and constructs the first feature matrix. If If the correlation threshold is less than the correlation threshold, representative features are selected to construct the second feature matrix;

[0063] The feature matrix is ​​input into the random forest model for prediction, the prediction results are output, the prediction results are analyzed, and the behavior patterns are determined as normal behavior, equipment failure, data anomaly, and operation anomaly.

[0064] The construction of the first feature matrix is ​​expressed as:

[0065]

[0066]

[0067] Among them, C1 is the product feature of the current comprehensive feature and the voltage frequency domain feature, is the normalized comprehensive characteristic of current, is the normalized voltage frequency domain feature, C2 is the square sum feature of the current comprehensive feature and the voltage frequency domain feature, is the normalized comprehensive characteristic of current, is the normalized voltage frequency domain characteristic, is the i-th normalized current comprehensive characteristic value, is the ith normalized voltage frequency domain eigenvalue, C1i is the product eigenvalue of the i-th sample, is the sum of squares eigenvalue of the i-th sample.

[0068] The second feature matrix is ​​constructed by dividing the data set into a training set and a test set, and performing the current comprehensive feature S and the voltage frequency domain feature X V Perform normalization processing, select the K-fold cross-validation method, set the validation parameters, use the current comprehensive feature and voltage frequency domain feature to train the model, perform cross-validation, and record the performance indicators, calculate the average performance indicator of the cross-validation, compare the performance of the current comprehensive feature model and the voltage frequency domain feature model, and construct the second feature matrix based on the performance indicator comparison results;

[0069] If the cross-validation shows that the comprehensive current features improve the model performance by more than the preset threshold, the second feature matrix is ​​expressed as:

[0070]

[0071] in, is the i-th normalized comprehensive characteristic value of current;

[0072] If the cross-validation shows that the voltage frequency domain features improve the model performance beyond the preset threshold, the second feature matrix is ​​expressed as:

[0073]

[0074] in, is the ith normalized voltage frequency domain eigenvalue.

[0075] The defense means corresponding to the output include: when the abnormal mode is determined to be a device failure, collecting current and voltage data samples every second in the past 24 hours, and performing trend analysis, using the data of the past 30 days for comparative analysis, identifying the fault mode, combining the operation log of the equipment, preliminarily judging the cause of the fault, using Fourier transform to perform frequency domain analysis on the voltage and current data, extracting frequency components (frequency range of 0-500Hz), comparing the frequency domain characteristics of abnormal data and normal data, identifying frequency anomalies, and extracting fault characteristic indicators such as harmonic content and resonant frequency, using a decision tree model to perform multi-model verification on the data, selecting split features through information gain, gradually building a decision tree model, and comprehensively judging the fault type;

[0076] Based on the preliminary analysis and multi-model verification results, determine the hardware components that need to be checked, check the sensors, circuit boards, and power components, use fault diagnosis tools, oscilloscopes, and multimeters to test and verify the hardware, record the hardware inspection results and compare them with the model prediction results. If there is no obvious fault in the hardware inspection results, further perform software diagnosis, check the firmware and software versions of the device, confirm whether there are known bugs or vulnerabilities, run software diagnostic tools, check the program's running status and log files, compare the software diagnosis results with the hardware inspection results, and comprehensively analyze the possible causes of the fault;

[0077] Based on the hardware and software diagnosis results, determine the repair measures, prioritize hardware and software issues, determine the repair order, replace or repair damaged hardware components, including sensors, circuit boards, and power supplies, perform comprehensive hardware maintenance, record each step and result, ensure that all operations are traceable, update the device's firmware and software, fix known bugs, and perform software optimization and upgrades.

[0078] After updating and optimizing, conduct a comprehensive system test to ensure that the equipment is operating normally. After the repair is completed, perform a system verification, using the same multi-model verification method as the diagnosis stage to confirm that the fault has been eliminated. Record the system verification results as a reference for subsequent maintenance and improvement.

[0079] When the abnormal pattern is determined to be data anomaly, collect current and voltage data samples every second in the past 24 hours, as well as operation data and environmental data, perform preliminary data cleaning, remove significant noise and erroneous data, use statistical analysis methods such as standard deviation, mean, maximum and minimum values ​​to identify abnormal points and patterns, apply moving average filtering and Gaussian filtering techniques to remove random noise in the data, and use clustering algorithms to group the data, identify abnormal groups and isolated points in the data, analyze the data source, determine the root cause of the data anomaly, combine environmental data and equipment operation status data, find out the external and internal factors that cause the data anomaly, use the Pearson correlation coefficient to calculate the correlation between current and voltage data and environmental variables, and identify variables with strong correlation. Analyze the equipment's operation log, identify possible operation errors or environmental changes, and find out the operation events related to data anomalies;

[0080] Use linear regression models to calibrate abnormal data, correct abnormal data, and restore the data to normal state. Use time series analysis models to fill and correct missing or abnormal data points to ensure data continuity and integrity. Use machine learning models to predict and compensate for abnormal data to ensure data accuracy. Compare and analyze calibrated data with normal data to confirm the calibration effect and ensure the accuracy of data recovery. Systematically verify the calibrated and recovered data, using the same statistical analysis and clustering algorithms to confirm that data anomalies have been repaired. Compare data features before and after calibration to ensure consistency and stability after data recovery. Record data anomalies and calibration processes as a reference for subsequent improvements. Optimize data collection and processing processes to reduce the probability of future data anomalies. Combine historical data and calibration experience to optimize the parameters of machine learning models to improve the accuracy of predictions and calibrations.

[0081] When the abnormal pattern is determined to be an abnormal operation, after the abnormal operation is determined, the device's operation log, user activity record, system event log and operation instruction data are first collected, covering all operation records in the past 24 hours. These data are cleaned to remove redundant information and invalid records, and the timestamp, operation type and operation result of each operation are extracted. Text mining technology is used to analyze the keywords and operation patterns in the operation log, and the specific operations related to the abnormal behavior are identified in combination with the timestamp. Compared with the normal operation mode, the characteristics and patterns of the abnormal operation are identified.

[0082] Conduct root cause analysis to identify the root cause of abnormal operation, which may be due to human error or lack of training. Analyze the operation process to find out the existing problems and improvement points. Combine correlation analysis to find out the relationship between abnormal operation and environmental variables and device status. Further check the operation records and system logs to confirm the specific circumstances of the abnormal operation.

[0083] Optimize the operation process to reduce the risk of misoperation and illegal operation. Design and implement the operation process optimization plan, use automation tools to improve operation efficiency, and reduce human intervention. Provide targeted training to improve the skills and operation specifications of operators. Develop detailed operation manuals and guidelines to ensure the standardization of operations. Through a comprehensive review of the operation process, identify the risky links, communicate with operators, and understand the problems and difficulties in the operation.

[0084] Record operational anomalies and optimization processes as a reference for subsequent improvements. Optimize operational records and processing procedures to reduce the probability of future operational anomalies. Combine historical data and operational experience to optimize training content and operational specifications to improve the accuracy and standardization of operations.

[0085] The training steps of the decision tree are as follows:

[0086] Data collection and preprocessing: Collect the operation data, log files, network traffic, errors and alarm information of power grid IoT devices; delete incomplete and erroneous data records in the collected data; and then classify and annotate the data obtained after deletion, including normal operation data, various abnormal behavior categories and attack modes;

[0087] Feature extraction: Extract features from preprocessed data to extract data that can distinguish different anomaly types and attack patterns;

[0088] Model training: Use the extracted features and labeled data to train the decision tree, using information gain as the splitting criterion:

[0089] IG(S,A)=H(S)-∑ t∈T p(t)H(t);

[0090] Where: IG(S,A) represents the information gain of feature A to data set S; H(S) represents the entropy of data set S; T represents the subset formed after data set S is divided according to feature A; p(t) represents the proportion of samples in subset t; H(t) represents the entropy of subset t;

[0091] H(S)=∑ x∈X p(x)log2p(x);

[0092] Where: X represents the set of all categories appearing in S; p(x) represents the probability of selecting category x;

[0093] The segmentation features of each node are selected based on information gain, and a decision tree is gradually constructed. Through the decision tree model, clear classification rules are defined in the training phase, and each decision node makes a classification decision based on data features until it reaches a leaf node and obtains the final classification result.

[0094] Monitor device behavior, compare device behavior with pre-established normal behavior models, and detect abnormal behaviors that deviate from normal patterns; identify attack patterns and abnormal behavior categories based on trained classification algorithms;

[0095] The attack mode based on abnormal behavior and the corresponding defense measures are output based on the abnormal behavior category.

[0096] The defense measures corresponding to the attack mode based on abnormal behavior and the abnormal behavior category output include:

[0097] Based on the abnormal behavior category and attack model, the pre-established defense measures database is queried, and the corresponding defense strategy is matched based on the attack type and abnormal behavior category;

[0098] Automatically deploy defense measures based on defense strategies;

[0099] The defense measures database includes attack patterns, abnormal behavior categories and corresponding defense measures.

[0100] By establishing a normal behavior prediction model, when implementing monitoring equipment behavior, the equipment behavior is compared with the established normal behavior model, abnormal behavior that deviates from the normal mode is detected, and then the attack mode and abnormal behavior category are identified based on the trained classification algorithm, and finally the corresponding defense means are output based on the attack mode and abnormal behavior category of the abnormal behavior; the present invention automatically identifies abnormal behavior, determines the category of abnormal behavior and the attack mode, and outputs the corresponding defense means, so that the defense means finally output by the present invention are targeted; different defense means can be output according to different abnormal behavior categories and attack modes.

[0101] Example 2

[0102] Reference Figure 1 , is an embodiment of the present invention, and provides a system based on IoT device behavior analysis and anomaly detection, including:

[0103] Data collection module, model building module and abnormality control module;

[0104] The data acquisition module is used to obtain the behavior data of the power grid Internet of Things device, pre-process the obtained behavior data, and extract features from the pre-processed behavior data;

[0105] The model building module is used to analyze the extracted features and establish an IoT device behavior model;

[0106] The abnormal control module is used to identify the device status based on the IoT device behavior model and output corresponding defense measures.

[0107] Example 3

[0108] An embodiment of the present invention is different from the first two embodiments in that:

[0109] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc., which can store program codes.

[0110] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0111] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.

[0112] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0113] Example 4

[0114] As an embodiment of the present invention, a method based on IoT device behavior analysis and anomaly detection is provided. In order to verify the beneficial effects of the present invention, a scientific demonstration is carried out through simulation experiments.

[0115] Experimental object: Internet of Things power grid equipment, mainly monitoring current and voltage data.

[0116] Experimental environment: Power grid Internet of Things test platform, which simulates the actual power grid operation environment and includes multiple sensors and data acquisition equipment.

[0117] The data collection frequency is set to once per second, and the experiment lasts for 24 hours. The traditional method is based on anomaly detection methods based on simple statistics and a single decision tree model. Our invention is an anomaly detection method based on comprehensive data analysis and multi-model verification. The power grid equipment is operated in the experimental environment, and sensors are used to collect current and voltage data every second for 24 hours. At the same time, the equipment's operating data, log files, network traffic, errors and alarm information are recorded. The collected data is cleaned to remove significant noise and invalid data to ensure data quality and consistency. The data is divided into a training set and a test set.

[0118] The traditional method performs simple statistical analysis (mean, standard deviation, maximum, minimum) on the training set and uses a single model for training. Our invented method extracts statistical features and frequency domain features from the training set, performs correlation analysis, builds a comprehensive data analysis system, and uses multiple models for training and verification.

[0119] Anomaly detection was performed on the test set, and the detection results, response time, and classification results of each method were recorded. The detected anomalies were refined and classified, and the degree of classification refinement was evaluated. The detection accuracy, response time, degree of classification refinement, number of detected anomalies, number of missed detections, and number of false detections of the two methods were calculated and compared. The experimental results are shown in Table 1.

[0120] Table 1 Comparison of experimental results

[0121]

[0122] Traditional methods perform anomaly detection based on simple statistics and a single model. This method first performs basic statistical analysis on the current and voltage data in the training set to extract basic features. Then, a decision tree model is used for training and detection. When dealing with a single feature, the decision tree model is prone to overfitting and insufficient generalization, resulting in low detection accuracy and long response time. In addition, due to the lack of multi-model verification, the classification results are not detailed enough and can only identify three basic types of anomalies. The limitations of a single model are also reflected in the high number of missed detections and false detections, and it cannot effectively deal with complex abnormal behaviors.

[0123] Our invented method adopts the strategy of comprehensive data analysis and multi-model verification, which significantly improves the performance of anomaly detection. First, the statistical features and frequency domain features of the collected current and voltage data are extracted, and correlation analysis is performed to construct a feature matrix containing multiple features. Then, the random forest model and decision tree model are used for joint training, and the generalization ability and accuracy of the model are ensured through cross-validation and multi-model verification. Multi-model verification not only reduces the overfitting problem of a single model, but also improves the detection accuracy through the complementarity of different models. This method can refine five types of anomalies, significantly improving the refinement of classification. In addition, through comprehensive data analysis and optimization algorithms, the response time of anomaly detection is greatly shortened, while the number of missed detections and false detections is significantly reduced, and the flexibility and robustness of the system are improved.

[0124] The results of this experiment show that our invented method is superior to traditional methods in all evaluation indicators, including detection accuracy increased to 95%, response time shortened to 1.2 seconds, classification refinement increased to five types, more anomalies detected, and fewer missed and false detections. These improvements are due to the use of comprehensive data analysis, multi-model verification, and feature optimization, which ensure the comprehensiveness, accuracy, and real-time nature of anomaly detection.

[0125] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A method based on IoT device behavior analysis and anomaly detection, characterized in that: include: Obtaining the behavior data of the power grid IoT devices, preprocessing the acquired behavior data, and extracting features from the preprocessed behavior data; Analyze the extracted features and build a behavioral model for IoT devices; Identify device status based on IoT device behavior model and output corresponding defense measures.

2. The method for behavior analysis and anomaly detection based on IoT devices according to claim 1, characterized in that: The behavior data includes current and voltage data; The feature extraction includes extracting statistical features, extracting frequency domain features and correlation analysis.

3. The method for behavior analysis and anomaly detection based on IoT devices as claimed in claim 2, characterized in that: The statistical feature extraction includes extracting the mean, standard deviation, maximum and minimum values ​​of the current of the IoT device to obtain the comprehensive current features, which are expressed as: S=w1μ I +w2σ I +w3Max I +w4Min I Among them, w1, w2, w3, w4 are weights, μ I represents the mean value of the current, σ I Indicates the standard deviation of the current, Max I Indicates the maximum value of the current, Min I Indicates the minimum value of the current; The extracted frequency domain features are expressed as: Among them, V n is the nth voltage data point, N is the number of samples, k is the frequency index, and i is the imaginary unit.

4. The method for behavior analysis and anomaly detection based on IoT devices as claimed in claim 3, characterized in that: The correlation analysis uses the Pearson correlation coefficient to calculate the correlation coefficient between different variables, expressed as: in, is the Pearson correlation coefficient between the normalized current comprehensive characteristics and voltage frequency domain characteristics, is the i-th normalized current comprehensive characteristic value, is the average value of the normalized comprehensive current characteristics, is the ith normalized voltage frequency domain eigenvalue, is the average value of the normalized voltage frequency domain characteristics, n is the number of samples; Compare the correlation analysis results with the correlation threshold. is greater than or equal to the correlation threshold, constructs the combined features, and constructs the first feature matrix. If If the correlation threshold is less than the correlation threshold, representative features are selected to construct the second feature matrix; The feature matrix is ​​input into the random forest model for prediction, the prediction results are output, the prediction results are analyzed, and the behavior patterns are determined as normal behavior, equipment failure, data anomaly, and operation anomaly.

5. The method for behavior analysis and anomaly detection based on IoT devices as claimed in claim 4, characterized in that: The construction of the first feature matrix is ​​expressed as: Among them, C1 is the product feature of the current comprehensive feature and the voltage frequency domain feature, is the normalized comprehensive characteristic of current, is the normalized voltage frequency domain feature, C2 is the square sum feature of the current comprehensive feature and the voltage frequency domain feature, is the normalized comprehensive characteristic of current, is the normalized voltage frequency domain characteristic, is the i-th normalized current comprehensive characteristic value, is the ith normalized voltage frequency domain eigenvalue, C 1i is the product eigenvalue of the i-th sample, C 2i is the sum of squares eigenvalue of the i-th sample.

6. The method for behavior analysis and anomaly detection based on IoT devices as claimed in claim 5, characterized in that: The second feature matrix is ​​constructed by dividing the data set into a training set and a test set, and performing the current comprehensive feature S and the voltage frequency domain feature X V Perform normalization processing, select the K-fold cross-validation method, set the validation parameters, use the current comprehensive feature and voltage frequency domain feature to train the model, perform cross-validation, and record the performance indicators, calculate the average performance indicator of the cross-validation, compare the performance of the current comprehensive feature model and the voltage frequency domain feature model, and construct the second feature matrix based on the performance indicator comparison results; If the cross-validation shows that the comprehensive current features improve the model performance by more than the preset threshold, the second feature matrix is ​​expressed as: in, is the i-th normalized comprehensive characteristic value of current; If the cross-validation shows that the voltage frequency domain features improve the model performance beyond the preset threshold, the second feature matrix is ​​expressed as: in, is the ith normalized voltage frequency domain eigenvalue.

7. The method based on IoT device behavior analysis and anomaly detection as claimed in claim 6, characterized in that: The defense measures corresponding to the output include, when the abnormal mode is determined to be a device failure, collecting current and voltage data samples every second in the past 24 hours, and performing trend analysis, using the data of the past 30 days for comparative analysis, identifying the fault mode, combining the operation log of the equipment, preliminarily judging the cause of the fault, using Fourier transform to perform frequency domain analysis on the voltage and current data, extracting frequency components, comparing the frequency domain characteristics of abnormal data and normal data, identifying frequency anomalies, and extracting fault characteristic indicators such as harmonic content and resonant frequency, using a decision tree model to perform multi-model verification on the data, selecting split features through information gain, gradually building a decision tree model, and comprehensively judging the fault type; Based on the preliminary analysis and multi-model verification results, determine the hardware components that need to be checked, check the sensors, circuit boards, and power components, use fault diagnosis tools, perform hardware testing and verification, record the hardware inspection results and compare them with the model prediction results. If there is no obvious fault in the hardware inspection results, further perform software diagnosis, check the firmware and software versions of the device, confirm whether there are known bugs or vulnerabilities, run software diagnostic tools, check the program's running status and log files, compare the software diagnosis results with the hardware inspection results, and comprehensively analyze the possible causes of the fault; Based on the hardware and software diagnosis results, determine the repair measures, prioritize hardware and software issues, determine the repair order, replace or repair damaged hardware components, update the device's firmware and software, fix known bugs, and perform software optimization and upgrades.

8. A system using the method based on IoT device behavior analysis and anomaly detection as described in any one of claims 1 to 7, characterized in that: include: Data collection module, model building module and abnormality control module; The data acquisition module is used to obtain the behavior data of the power grid Internet of Things device, pre-process the obtained behavior data, and extract features from the pre-processed behavior data; The model building module is used to analyze the extracted features and establish an IoT device behavior model; The abnormal control module is used to identify the device status based on the IoT device behavior model and output corresponding defense measures.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method based on Internet of Things device behavior analysis and anomaly detection described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method based on IoT device behavior analysis and anomaly detection according to any one of claims 1 to 7 are implemented.

Images