Data security anomaly detection method and system based on deep learning

Abstract

The invention relates to the technical field of sensor data analysis, and discloses a data security anomaly detection method and system based on deep learning, and the method comprises the following steps: collecting sensing information; generating two-dimensional structure data based on the sensing information; inputting the two-dimensional structure data into an environment anomaly model, and outputting a result representing environment anomaly; inputting the two-dimensional structure data and the environment anomaly data into a security anomaly model, and outputting a result representing security anomaly; inputting the two-dimensional structure data, the environment abnormal data and the security abnormal data into a positioning model, and outputting a result representing abnormal positioning; according to the method, the environmental anomaly data of each sensor is obtained by analyzing the data of different sensors, so that security anomaly detection is carried out, the accuracy of security anomaly judgment in an extreme environment is improved, the position of an abnormal event is further positioned, and compared with only assessment of security anomaly, the method can provide the abnormal event occurrence position with high accuracy.

Description

Technical Field

[0001] The present invention relates to the field of sensor data analysis technology, and more specifically, to a data security anomaly detection method and system based on deep learning. Background Art

[0002] With the rapid development of marine engineering, maritime transportation, underwater ecological monitoring and other fields in recent years, underwater sensor networks have received widespread attention; underwater sensor networks can obtain multi-source heterogeneous data of the marine environment in real time, which is of great significance to marine environment monitoring, marine resource exploration, military defense and other fields; using deep learning technology, integrating multi-source heterogeneous data collected by different nodes, timely discovering and warning underwater noise anomalies, underwater communication anomalies, underwater event anomalies, underwater sensor anomalies; but in severe weather such as typhoons and tsunamis, the amount of abnormal data will surge, affecting the identification of real underwater abnormal situations; at the same time, multi-sensor data should be used to accurately locate the location of abnormal events. Summary of the invention

[0003] The purpose of the present invention is to provide a data security anomaly detection method and system based on deep learning in order to solve the above problems.

[0004] The present invention provides a data security anomaly detection method based on deep learning, comprising the following steps: Step 100, collecting sensor information. The sensor information is collected once at each time sampling point, including information of various types of sensors and environmental information. There are three types of sensors, including acoustic sensors, temperature sensors and pressure sensors; The time sampling point refers to the moment when data is collected at a predetermined time interval; Step 200, generating two-dimensional structure data based on the sensor information, the two-dimensional structure data includes a data matrix and a relationship matrix, one unit of the data matrix represents one-dimensional structure data of an independent object, the independent object includes an acoustic sensor, a temperature sensor, a pressure sensor and an environment, and one unit of the data matrix only contains the sensor information of the independent object represented by it; The element in the i-th row and j-th column of the relationship matrix represents the association between the i-th unit of the data matrix and the independent object represented by the j-th unit. If there is an association, the value of this element of the relationship matrix is ​​1, otherwise it is 0; The one-dimensional structure data includes n one-dimensional data items ordered by time, and the t-th one-dimensional data item represents the sensor information collected at the t-th moment; Step 300, inputting the two-dimensional structure data into an environmental anomaly model, the environmental anomaly model comprising a first intermediate layer, a second intermediate layer and a first output layer, and the environmental anomaly model outputs results indicating environmental anomalies of each sensor; Step 400, inputting the two-dimensional structure data and the environmental anomaly data into a security anomaly model, the security anomaly model comprising a third intermediate layer, a fourth intermediate layer, a fifth intermediate layer, a first feature fusion layer and a second output layer, the security anomaly model outputting a result indicating the security anomaly; Step 500, input the two-dimensional structure data, environmental anomaly data and safety anomaly data into the positioning model, the positioning model includes a sixth intermediate layer, a seventh intermediate layer, an eighth intermediate layer, a ninth intermediate layer, a second feature fusion layer and a third output layer, and the positioning model outputs the result representing the anomaly positioning.

[0005] Furthermore, the acoustic sensor information includes sensor ID, sensor type, spatial coordinates, collected real-time data value, and data timestamp. The spatial coordinates include longitude coordinates, latitude coordinates, and depth coordinates. The longitude coordinates and latitude coordinates represent longitude and latitude information, respectively. The unit of the depth coordinate is meter. The depth coordinate at the water surface position is 0. The larger the depth coordinate value, the greater the depth. Temperature sensor information includes sensor ID, sensor type, spatial coordinates, collected real-time data value, and data timestamp; The pressure sensor information includes sensor ID, sensor type, spatial coordinates, collected real-time data value, and data timestamp; Environmental information includes temperature, salinity, ocean current speed, wind speed, weather type, and spatial coordinates.

[0006] Furthermore, the existence of an association between the acoustic sensor, the temperature sensor, and the pressure sensor means that: the acoustic sensor, the temperature sensor, and the pressure sensor are adjacent in spatial position; The acoustic sensor, the temperature sensor, the pressure sensor and the environment are associated with each other, which means that the spatial coordinates of the acoustic sensor, the temperature sensor and the pressure sensor are the same as the spatial coordinates of the environment.

[0007] Furthermore, in the environmental anomaly model, the one-dimensional structure data No. 1 is input into the first intermediate layer, the first intermediate layer outputs the first intermediate representation data to the second intermediate layer, the second intermediate layer also inputs the relationship matrix, the second intermediate layer outputs the second intermediate representation data to the first output layer, and the first output layer outputs the results representing the environmental anomalies of each sensor.

[0008] Furthermore, the loss function calculation method of the environmental anomaly model is: ; in Indicates the loss value of environmental anomaly, represents the total number of environmental abnormal samples, It is The true environmental anomaly label of an environmental anomaly sample has a value of 0 or 1, where 1 indicates that the environmental anomaly sample is affected by the extreme environment, and 0 indicates that the environmental anomaly sample is not affected by the extreme environment. It is the first The environmental anomaly labels of environmental anomaly samples, Represents the logarithmic function with the natural constant e as the base.

[0009] Furthermore, in the security anomaly model, the one-dimensional structure data No. 1 is input into the third intermediate layer, the third intermediate layer outputs the third intermediate representation data to the first feature fusion layer, the one-dimensional structure data No. 2 is input into the fourth intermediate layer, the one-dimensional structure data No. 2 is encoded by the environmental anomaly data, the one-dimensional structure data No. 2 includes A No. 2 data items sorted by time, the y-th No. 2 data item represents the environmental anomaly data output by the environmental anomaly model at the z-th moment, the fourth intermediate layer outputs the fourth intermediate representation data to the first feature fusion layer, the first feature fusion layer outputs the first fusion representation data to the fifth intermediate layer, the fifth intermediate layer also inputs the relationship matrix, the fifth intermediate layer outputs the fifth intermediate representation data to the second output layer, and the second output layer outputs the result representing the security anomaly.

[0010] Furthermore, the loss function calculation method of the security anomaly model is: ; in represents the loss value of the security anomaly model, represents the total number of safety samples, Indicates the total number of security exception types, The default value is 4, including noise anomaly, communication anomaly, event anomaly and sensor anomaly. It is The symbol value of the security sample, if the true security anomaly type of the security sample is The value of the security exception type is 1, otherwise the value is 0. It is the first The safety samples belong to The probability of a security anomaly type, Represents the logarithmic function with the natural constant e as the base.

[0011] Furthermore, in the positioning model, the one-dimensional structure data No. 1 is input into the sixth intermediate layer, the sixth intermediate layer outputs the sixth intermediate representation data to the second feature fusion layer, the one-dimensional structure data No. 2 is input into the seventh intermediate layer, the seventh intermediate layer outputs the seventh intermediate representation data to the second feature fusion layer, the one-dimensional structure data No. 3 is input into the eighth intermediate layer, the one-dimensional structure data No. 3 is encoded by security anomaly data; the one-dimensional structure data No. 3 includes B data items No. 3 sorted by time, the zth data item No. 3 represents the security anomaly data output by the security anomaly model at the zth moment, the eighth intermediate layer outputs the eighth intermediate representation data to the second feature fusion layer, the second feature fusion layer outputs the second fusion representation data to the ninth intermediate layer, the ninth intermediate layer also inputs the relationship matrix, the ninth intermediate layer outputs the ninth intermediate representation data to the third output layer, and the third output layer outputs the result of representing the anomaly positioning.

[0012] Furthermore, the loss function calculation method of the positioning model is: ; in Represents the positioning model loss value, represents the total number of positioning samples, Indicates the total number of security exception types, The default value is 4, including noise anomaly, communication anomaly, event anomaly and sensor anomaly. , , Indicates The first positioning sample The real longitude, latitude and depth coordinates of each security anomaly type. , , Represents the output of the positioning model The first positioning sample The longitude, latitude, and depth coordinates of each security anomaly type prediction.

[0013] The present invention provides a data security anomaly detection system based on deep learning, which is used to store computer-readable instructions. When the computer-readable instructions are read, the aforementioned data security anomaly detection method based on deep learning can be executed.

[0014] The beneficial effects of the present invention are as follows: the present invention obtains environmental anomaly data of each sensor by analyzing data from different sensors, thereby performing safety anomaly detection, improving the accuracy of safety anomaly judgment in extreme environments, and further locating the location of abnormal events. Compared with only evaluating safety anomalies, this method can provide the location of abnormal events with high accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1It is a flow chart of a data security anomaly detection method based on deep learning of the present invention. DETAILED DESCRIPTION

[0016] The subject matter described herein will now be discussed with reference to example embodiments. It should be understood that the discussion of these embodiments is only to enable those skilled in the art to better understand and implement the subject matter described herein, and the functions and arrangements of the elements discussed may be changed without departing from the scope of protection of the contents of this specification. Each example may omit, replace or add various processes or components as needed. In addition, the features described relative to some examples may also be combined in other examples.

[0017] At least one embodiment of the present invention discloses a data security anomaly detection method based on deep learning, such as Figure 1 As shown, the following steps are included: Step 100, collecting sensor information, the sensor information is collected once at each time sampling point, including information of various types of sensors and environmental information; In one embodiment of the present invention, there are three types of sensors, including acoustic sensors, temperature sensors and pressure sensors.

[0018] Acoustic sensor information includes sensor ID, sensor type, spatial coordinates, collected real-time data value, and data timestamp; Temperature sensor information includes sensor ID, sensor type, spatial coordinates, collected real-time data value, and data timestamp; The pressure sensor information includes sensor ID, sensor type, spatial coordinates, collected real-time data value, and data timestamp; Environmental information includes temperature, salinity, ocean current speed, wind speed, weather type, and spatial coordinates; In one embodiment of the present invention, the spatial coordinates include longitude coordinates, latitude coordinates and depth coordinates. The longitude coordinates and latitude coordinates respectively represent longitude and latitude information. The unit of the depth coordinate is meter. The depth coordinate at the water surface position is 0. The larger the depth coordinate value, the greater the depth.

[0019] In one embodiment of the present invention, environmental information is generated by numerical simulation. Based on regional meteorological information such as temperature, salinity, ocean current speed, wind speed, weather type, etc. released by the meteorological department, the environmental information of the spatial coordinates of each sensor is calculated using a fluid mechanics model and an acoustic propagation model.

[0020] The time sampling point refers to the moment when data is collected at a predetermined time interval; In one embodiment of the present invention, the default value of the predetermined time interval is 60 seconds.

[0021] Step 200, generating two-dimensional structure data based on the sensor information, the two-dimensional structure data includes a data matrix and a relationship matrix, one unit of the data matrix represents one-dimensional structure data of an independent object, the independent object includes an acoustic sensor, a temperature sensor, a pressure sensor and an environment, and one unit of the data matrix only contains the sensor information of the independent object represented by it; The element in the i-th row and j-th column of the relationship matrix represents the association between the i-th unit of the data matrix and the independent object represented by the j-th unit. If there is an association, the value of this element of the relationship matrix is ​​1, otherwise it is 0; The association between the acoustic sensor, the temperature sensor, and the pressure sensor means that: the acoustic sensor, the temperature sensor, and the pressure sensor are adjacent in space (adjacent above and below or adjacent in all directions); The acoustic sensor, the temperature sensor, the pressure sensor and the environment are associated with each other, which means that the spatial coordinates of the acoustic sensor, the temperature sensor and the pressure sensor are the same as the spatial coordinates of the environment; The one-dimensional structure data includes n one-dimensional data items ordered by time, and the t-th one-dimensional data item represents the sensor information collected at the t-th moment; Step 300, inputting the two-dimensional structure data into the environmental anomaly model, the environmental anomaly model comprising a first intermediate layer, a second intermediate layer and a first output layer, wherein the one-dimensional structure data No. 1 is input into the first intermediate layer, the first intermediate layer outputs the first intermediate representation data to the second intermediate layer, the second intermediate layer also inputs the relationship matrix, the second intermediate layer outputs the second intermediate representation data to the first output layer, and the first output layer outputs the result indicating the environmental anomaly of each sensor; In one embodiment of the present invention, the formula of the first intermediate layer is as follows:

[0022] in Represents the first Unit The first intermediate representation data, Represents the first Unit The first intermediate representation data, Represents the first The first one-dimensional structure data corresponding to the unit Number one data item, and are the first and second weight parameters of the first intermediate layer, is the bias parameter of the first intermediate layer, is the hyperbolic tangent function.

[0023] In one embodiment of the present invention, the formula of the second intermediate layer is as follows:

[0024] in Represents the data matrix The second intermediate representation data of the units, is the first The set of cells of the data matrix where there are associations between cells, , , and Represents the first and The first unit represents the independent object The first intermediate representation data, is a learnable scalar parameter, represents the two-dimensional recognition weight parameter of the second intermediate layer, Represents a multi-layer perceptron.

[0025] In one embodiment of the present invention, the formula of the first output layer is as follows:

[0026] in Represents an environmental anomaly vector. The cth component value of the environmental anomaly vector represents the probability that the cth sensor is affected by the extreme environment. If the probability is greater than 0.5, it means that the sensor is affected by the extreme environment. Otherwise, it means that it is not affected by the extreme environment. Represents the data matrix The second intermediate representation data of the units, represents the set of cells of all data matrices, is the weight parameter of the first output layer, is the bias parameter of the first output layer, Represents the sigmoid function.

[0027] In one embodiment of the present invention, the loss function calculation method of the environmental anomaly model is:

[0028] in Indicates the loss value of environmental anomaly, represents the total number of environmental abnormal samples, It is The true environmental anomaly label of an environmental anomaly sample has a value of 0 or 1, where 1 indicates that the environmental anomaly sample is affected by the extreme environment, and 0 indicates that the environmental anomaly sample is not affected by the extreme environment. It is the first The environmental anomaly labels of environmental anomaly samples, Represents the logarithmic function with the natural constant e as the base.

[0029] Step 400, input the two-dimensional structure data into the security anomaly model, the security anomaly model includes a third intermediate layer, a fourth intermediate layer, a fifth intermediate layer, a first feature fusion layer and a second output layer, wherein the first one-dimensional structure data is input into the third intermediate layer, the third intermediate layer outputs the third intermediate representation data to the first feature fusion layer, the second one-dimensional structure data is input into the fourth intermediate layer, the fourth intermediate layer outputs the fourth intermediate representation data to the first feature fusion layer, the first feature fusion layer outputs the first fusion representation data to the fifth intermediate layer, the fifth intermediate layer also inputs the relationship matrix, the fifth intermediate layer outputs the fifth intermediate representation data to the second output layer, and the second output layer outputs the result representing the security anomaly; In one embodiment of the present invention, the environmental anomaly data is encoded into second-dimensional one-dimensional structure data; the second-dimensional one-dimensional structure data includes A second-data items sorted by time, and the yth second-data item represents the environmental anomaly data output by the environmental anomaly model at the zth moment.

[0030] In one embodiment of the present invention, the formula of the third intermediate layer is as follows:

[0031] in Represents the first Unit A third intermediate representation data, Represents the first Unit A third intermediate representation data, Represents the first The first one-dimensional structure data corresponding to the unit Number one data item, and are the first and second weight parameters of the third intermediate layer, is the bias parameter of the third middle layer, is the hyperbolic tangent function.

[0032] In one embodiment of the present invention, the formula of the fourth intermediate layer is as follows:

[0033] in Indicates A fourth intermediate representation data, Indicates A fourth intermediate representation data, The first one-dimensional structure data The second data item, and are the first and second weight parameters of the fourth intermediate layer, is the bias parameter of the fourth intermediate layer, is the hyperbolic tangent function.

[0034] In one embodiment of the present invention, the formula of the first feature fusion layer is as follows:

[0035] in, Represents the first The first fusion of units represents the data, represents the fusion function (concatenation function or summation function), Represents the first Unit A third intermediate representation data, The total number of data items No. 1 representing the one-dimensional structure data No. 1, Indicates A fourth intermediate representation data, The total number of data items No. 2 representing the one-dimensional structure data No. 2, represents the sum weight matrix of the first feature fusion layer, Represents the summed bias parameter of the first feature fusion layer.

[0036] In one embodiment of the present invention, the formula of the fifth intermediate layer is as follows:

[0037]

[0038]

[0039] in Represents the data matrix The fifth intermediate representation data of the units, , , and Represents the first and The first fusion representation data of independent objects represented by units, Indicates the fifth intermediate layer and The attention coefficient of each unit, Indicates the fifth intermediate layer and The attention coefficient of each unit, Indicates the fifth intermediate layer and The normalized attention coefficient of each unit, Represents the first The set of cells of the data matrix where there are associations between cells, represents an exponential function with a natural constant as base, represents the trainable attention vector parameters, Represents a splicing operation, represents transpose, represents the two-dimensional recognition weight parameter of the fifth intermediate layer, yes Activation function.

[0040] In one embodiment of the present invention, the formula of the second output layer is as follows:

[0041] in represents a safety anomaly vector, the dth component value of the vector represents the safety anomaly type of the dth sensor, and the safety anomaly types include underwater noise anomaly, communication anomaly, event anomaly and sensor anomaly; Represents the data matrix The fifth intermediate representation data of the units, represents the set of cells of all data matrices, is the weight parameter of the second output layer, is the bias parameter of the second output layer, Represents the sigmoid function.

[0042] In one embodiment of the present invention, the loss function calculation method of the security anomaly model is:

[0043] in represents the loss value of the security anomaly model, represents the total number of safety samples, Indicates the total number of security exception types, The default value is 4, including noise anomaly, communication anomaly, event anomaly and sensor anomaly. It is The symbol value of the security sample, if the The actual security anomaly type of the security sample is The value of the security exception type is 1, otherwise the value is 0. It is the first The safety samples belong to The probability of a security anomaly type, Represents the logarithmic function with the natural constant e as the base.

[0044] Step 500, input the two-dimensional structure data into the positioning model, the positioning model includes a sixth intermediate layer, a seventh intermediate layer, an eighth intermediate layer, a ninth intermediate layer, a second feature fusion layer and a third output layer, wherein the one-dimensional structure data No. 1 is input into the sixth intermediate layer, the sixth intermediate layer outputs the sixth intermediate representation data to the second feature fusion layer, the one-dimensional structure data No. 2 is input into the seventh intermediate layer, the seventh intermediate layer outputs the seventh intermediate representation data to the second feature fusion layer, the one-dimensional structure data No. 3 is input into the eighth intermediate layer, the eighth intermediate layer outputs the eighth intermediate representation data to the second feature fusion layer, the second feature fusion layer outputs the second fusion representation data to the ninth intermediate layer, the ninth intermediate layer also inputs a relationship matrix, the ninth intermediate layer outputs the ninth intermediate representation data to the third output layer, and the third output layer outputs the result representing abnormality positioning.

[0045] In one embodiment of the present invention, the security anomaly data is encoded into three-dimensional structure data; the three-dimensional structure data includes B three-data items sorted by time, and the z-th three-data item represents the security anomaly data output by the security anomaly model at the z-th moment.

[0046] In one embodiment of the present invention, the formula of the sixth intermediate layer is as follows:

[0047]

[0048]

[0049]

[0050] in, , , represents the first, second, and third weight parameters of the sixth intermediate layer, , , represents the first, second, and third bias parameters of the sixth intermediate layer, represents the dot product, , and They represent the first The first, second, and third intermediate states of the unit, Represents the first The first one-dimensional structure data corresponding to the unit Number one data item, and They represent the first Unit and The sixth intermediate representation data, , The total number of data items No. 1 representing the one-dimensional structure data No. 1, hour , is the hyperbolic tangent function, Represents the sigmoid function.

[0051] In one embodiment of the present invention, the formula of the seventh intermediate layer is as follows:

[0052] in Indicates The seventh intermediate representation data, Indicates The seventh intermediate representation data, The first one-dimensional structure data The second data item, and are the first and second weight parameters of the seventh intermediate layer, is the bias parameter of the seventh intermediate layer, is the hyperbolic tangent function.

[0053] In one embodiment of the present invention, the formula of the eighth intermediate layer is as follows:

[0054] in Indicates The eighth intermediate representation data, Indicates The eighth intermediate representation data, The third one-dimensional structure data The third data item, and are the first and second weight parameters of the eighth intermediate layer, is the bias parameter of the eighth intermediate layer, is the hyperbolic tangent function.

[0055] In one embodiment of the present invention, the formula of the second feature fusion layer is as follows:

[0056] in, Represents the first The second fusion of units represents the data, represents the fusion function (concatenation function or summation function), Represents the first Unit The sixth intermediate representation data, The total number of data items No. 1 representing the one-dimensional structure data No. 1, Indicates The seventh intermediate representation data, The total number of data items No. 2 representing the one-dimensional structure data No. 2, Indicates The eighth intermediate representation data, The total number of data items No. 3 representing the No. 3 one-dimensional structure data, represents the sum weight matrix of the second feature fusion layer, Represents the summed bias parameter of the second feature fusion layer.

[0057] In one embodiment of the present invention, the formula of the ninth intermediate layer is as follows:

[0058]

[0059]

[0060] in Represents the data matrix The ninth intermediate representation data of the unit, , , and Represents the first and The second fusion representation data of the independent objects represented by the units, Indicates the ninth intermediate layer and The attention coefficient of each unit, Indicates the ninth intermediate layer and The attention coefficient of each unit, Indicates the ninth intermediate layer and The normalized attention coefficient of each unit, Represents the first The set of cells of the data matrix where there are associations between cells, represents an exponential function with a natural constant as base, represents the trainable attention vector parameters, Represents a splicing operation, represents transpose, represents the two-dimensional recognition weight parameter of the ninth intermediate layer, yes Activation function.

[0061] In one embodiment of the present invention, the formula of the third output layer is as follows:

[0062] in Represents a positioning vector. The fth component value of the positioning vector represents the occurrence position of the fth security anomaly type. The occurrence position is a spatial coordinate value. Represents the data matrix The ninth intermediate representation data of the unit, represents the set of cells of all data matrices, is the weight parameter of the third output layer, is the bias parameter of the third output layer, Represents the sigmoid function.

[0063] In one embodiment of the present invention, the loss function calculation method of the positioning model is:

[0064] in Represents the positioning model loss value, represents the total number of positioning samples, Indicates the total number of security exception types, The default value is 4, including noise anomaly, communication anomaly, event anomaly and sensor anomaly. , , Indicates The first positioning sample The real longitude, latitude and depth coordinates of each security anomaly type. , , Represents the output of the positioning model The first positioning sample The longitude, latitude, and depth coordinates of each security anomaly type prediction.

[0065] In at least one embodiment of the present invention, a deep learning-based data security anomaly detection system is provided, which is used to store computer-readable instructions, and when the computer-readable instructions are read, the aforementioned deep learning-based data security anomaly detection method can be executed.

[0066] The above describes an embodiment of the present invention, but this embodiment is not limited to the above-mentioned specific implementation mode. The above-mentioned specific implementation mode is merely illustrative and not restrictive. Under the guidance of this embodiment, ordinary technicians in this field can also make more forms of equivalent embodiments, all of which are within the protection of this embodiment.

Claims

1. A data security anomaly detection method based on deep learning, characterized in that: The following steps are involved: Step 100, collecting sensor information. The sensor information is collected once at each time sampling point, including information of various types of sensors and environmental information. There are three types of sensors, including acoustic sensors, temperature sensors and pressure sensors; The time sampling point refers to the moment when data is collected at a predetermined time interval; Step 200, generating two-dimensional structure data based on the sensor information, the two-dimensional structure data includes a data matrix and a relationship matrix, one unit of the data matrix represents one-dimensional structure data of an independent object, the independent object includes an acoustic sensor, a temperature sensor, a pressure sensor and an environment, and one unit of the data matrix only contains the sensor information of the independent object represented by it; The element in the i-th row and j-th column of the relationship matrix represents the association between the i-th unit of the data matrix and the independent object represented by the j-th unit. If there is an association, the value of this element of the relationship matrix is ​​1, otherwise it is 0; The one-dimensional structure data includes n one-dimensional data items ordered by time, and the t-th one-dimensional data item represents the sensor information collected at the t-th moment; Step 300, inputting the two-dimensional structure data into an environmental anomaly model, the environmental anomaly model comprising a first intermediate layer, a second intermediate layer and a first output layer, and the environmental anomaly model outputs results indicating environmental anomalies of each sensor; Step 400, inputting the two-dimensional structure data and the environmental anomaly data into a security anomaly model, the security anomaly model comprising a third intermediate layer, a fourth intermediate layer, a fifth intermediate layer, a first feature fusion layer and a second output layer, the security anomaly model outputting a result indicating the security anomaly; Step 500, input the two-dimensional structure data, environmental anomaly data and safety anomaly data into the positioning model, the positioning model includes a sixth intermediate layer, a seventh intermediate layer, an eighth intermediate layer, a ninth intermediate layer, a second feature fusion layer and a third output layer, and the positioning model outputs the result representing the anomaly positioning.

2. According to a data security anomaly detection method based on deep learning according to claim 1, it is characterized in that: Acoustic sensor information includes sensor ID, sensor type, spatial coordinates, collected real-time data value, and data timestamp. Spatial coordinates include longitude coordinates, latitude coordinates, and depth coordinates. Longitude coordinates and latitude coordinates represent longitude and latitude information, respectively. The unit of depth coordinates is meter. The depth coordinate at the water surface is 0. The larger the depth coordinate value, the greater the depth. Temperature sensor information includes sensor ID, sensor type, spatial coordinates, collected real-time data value, and data timestamp; The pressure sensor information includes sensor ID, sensor type, spatial coordinates, collected real-time data value, and data timestamp; Environmental information includes temperature, salinity, ocean current speed, wind speed, weather type, and spatial coordinates.

3. According to a method for data security anomaly detection based on deep learning according to claim 1, it is characterized in that: The existence of an association between the acoustic sensor, the temperature sensor, and the pressure sensor means that: the acoustic sensor, the temperature sensor, and the pressure sensor are adjacent in spatial position; The acoustic sensor, the temperature sensor, the pressure sensor and the environment are associated with each other, which means that the spatial coordinates of the acoustic sensor, the temperature sensor and the pressure sensor are the same as the spatial coordinates of the environment.

4. According to a method for detecting data security anomalies based on deep learning according to claim 1, it is characterized in that: In the environmental anomaly model, the one-dimensional structure data No. 1 is input into the first intermediate layer, the first intermediate layer outputs the first intermediate representation data to the second intermediate layer, the second intermediate layer also inputs the relationship matrix, the second intermediate layer outputs the second intermediate representation data to the first output layer, and the first output layer outputs the results representing the environmental anomalies of each sensor.

5. According to the method of data security anomaly detection based on deep learning in claim 4, it is characterized in that: The loss function calculation method of the environmental anomaly model is: ； in Indicates the loss value of environmental anomaly, represents the total number of environmental abnormal samples, It is The true environmental anomaly label of an environmental anomaly sample has a value of 0 or 1, where 1 indicates that the environmental anomaly sample is affected by the extreme environment, and 0 indicates that the environmental anomaly sample is not affected by the extreme environment. It is the first The environmental anomaly labels of environmental anomaly samples, Represents the logarithmic function with the natural constant e as the base.

6. According to a method for data security anomaly detection based on deep learning according to claim 1, it is characterized in that: In the security anomaly model, the one-dimensional structure data No. 1 is input into the third intermediate layer, the third intermediate layer outputs the third intermediate representation data to the first feature fusion layer, the one-dimensional structure data No. 2 is input into the fourth intermediate layer, the one-dimensional structure data No. 2 is encoded by the environmental anomaly data, the one-dimensional structure data No. 2 includes A No. 2 data items sorted by time, the y-th No. 2 data item represents the environmental anomaly data output by the environmental anomaly model at the z-th moment, the fourth intermediate layer outputs the fourth intermediate representation data to the first feature fusion layer, the first feature fusion layer outputs the first fusion representation data to the fifth intermediate layer, the fifth intermediate layer also inputs the relationship matrix, the fifth intermediate layer outputs the fifth intermediate representation data to the second output layer, and the second output layer outputs the result representing the security anomaly.

7. The method for data security anomaly detection based on deep learning according to claim 6 is characterized in that: The loss function calculation method of the security anomaly model is: ； in represents the loss value of the security anomaly model, represents the total number of safety samples, Indicates the total number of security exception types, The default value is 4, including noise anomaly, communication anomaly, event anomaly and sensor anomaly. It is The symbol value of the security sample, if the The actual security anomaly type of the security sample is The value of the security exception type is 1, otherwise the value is 0. It is the first The safety samples belong to The probability of a security anomaly type, Represents the logarithmic function with the natural constant e as the base.

8. The data security anomaly detection method based on deep learning according to claim 1 is characterized in that: In the positioning model, the one-dimensional structure data No. 1 is input into the sixth intermediate layer, the sixth intermediate layer outputs the sixth intermediate representation data to the second feature fusion layer, the one-dimensional structure data No. 2 is input into the seventh intermediate layer, the seventh intermediate layer outputs the seventh intermediate representation data to the second feature fusion layer, the one-dimensional structure data No. 3 is input into the eighth intermediate layer, the one-dimensional structure data No. 3 is encoded by security anomaly data; the one-dimensional structure data No. 3 includes B data items No. 3 sorted by time, the zth data item No. 3 represents the security anomaly data output by the security anomaly model at the zth moment, the eighth intermediate layer outputs the eighth intermediate representation data to the second feature fusion layer, the second feature fusion layer outputs the second fusion representation data to the ninth intermediate layer, the ninth intermediate layer also inputs the relationship matrix, the ninth intermediate layer outputs the ninth intermediate representation data to the third output layer, and the third output layer outputs the result of representing anomaly positioning.

9. The method for data security anomaly detection based on deep learning according to claim 8, characterized in that: The loss function calculation method of the positioning model is: ； in Represents the positioning model loss value, represents the total number of positioning samples, Indicates the total number of security exception types, The default value is 4, including noise anomaly, communication anomaly, event anomaly and sensor anomaly. , , Indicates The first positioning sample The real longitude, latitude and depth coordinates of each security anomaly type. , , Represents the output of the positioning model The first positioning sample The longitude, latitude, and depth coordinates of each security anomaly type prediction.

10. A data security anomaly detection system based on deep learning, characterized in that: It is used to store computer-readable instructions, which, when read, can execute a data security anomaly detection method based on deep learning as described in any one of claims 1-9.

Images