Equipment exception determination method and device, equipment and readable storage medium

Abstract

The embodiment of the invention provides an equipment exception determination method and device, equipment and a readable storage medium. The method comprises the following steps: obtaining access data of a target gateway, the access data comprising traffic data corresponding to an access device accessing the target gateway; multiple rounds of candidate equipment screening operation are executed, and target candidate equipment obtained through screening of the last candidate equipment screening operation is determined; calculating the similarity between the traffic data of the target candidate device and the traffic data of other access devices in a preset time period; inputting the similarity into a trained confidence network model, and determining the confidence of the target candidate equipment through the confidence network model; and according to the confidence of the target candidate device, determining the device state of the target candidate device, the device state including an abnormal state and a normal state. According to the invention, the equipment abnormity determination efficiency can be improved.

Description

Technical Field

[0001] The present invention belongs to the field of data processing technology, and in particular, relates to a method, device, equipment and readable storage medium for determining device abnormality. Background Art

[0002] With the development of communication technology, terminal devices have been widely used in all walks of life. Due to the openness and unsupervisability of terminal device usage scenarios, terminal devices bring convenience to users, but also pose a serious threat to privacy and security. Whether in public places or private scenes, cameras may be installed actively or passively for monitoring, which brings great privacy and security violations to people. In particular, wireless cameras are easier to hide because they do not require wiring, causing more serious privacy violations.

[0003] In the relevant technology, traditional detection methods often rely on physical inspections or manual inspections. This method is not only inefficient, but also difficult to fully cover all possible hidden camera devices and cannot efficiently identify the shooting devices. Summary of the invention

[0004] The present invention provides a method, device, equipment and readable storage medium for determining device abnormality to solve the problems in the related art of low detection efficiency, difficulty in comprehensively covering all possible hidden camera devices, and inability to efficiently identify the camera devices.

[0005] In a first aspect, the present invention provides a method for determining an abnormality of a device, the method comprising:

[0006] Acquire access data of a target gateway, wherein the access data includes flow data corresponding to an access device accessing the target gateway;

[0007] Perform multiple rounds of candidate device screening operations, and determine the target candidate device obtained by the last candidate device screening operation; wherein each candidate device screening operation is used to screen new candidate devices from the candidate devices obtained in the previous round according to the traffic data and screening conditions in the corresponding execution time period of the current round, and in the first round, the candidate devices are screened from the access devices;

[0008] Calculate the similarity between the traffic data of the target candidate device and the traffic data of other access devices within a preset time period;

[0009] Inputting the similarity into a trained confidence network model, and determining the confidence of the target candidate device through the confidence network model; the confidence represents the degree of certainty that the target candidate device is in an abnormal state;

[0010] According to the confidence level of the target candidate device, a device state of the target candidate device is determined, where the device state includes an abnormal state and a normal state.

[0011] In a second aspect, the present invention provides a device for determining an abnormality of an equipment, the device comprising:

[0012] An acquisition module is used to acquire access data of a target gateway, wherein the access data includes flow data corresponding to an access device accessing the target gateway;

[0013] A first determination module is used to perform multiple rounds of candidate device screening operations and determine the target candidate device obtained by the last candidate device screening operation; wherein each candidate device screening operation is used to screen new candidate devices from the candidate devices obtained in the previous round according to the traffic data and the screening conditions in the corresponding execution time period of the current round, and in the first round, the candidate devices are screened from the access devices;

[0014] A calculation module, used to calculate the similarity between the flow data of the target candidate device and the flow data of other access devices within a preset time period;

[0015] An input module, used to input the similarity into a trained confidence network model, and determine the confidence of the target candidate device through the confidence network model; the confidence represents the degree of certainty that the target candidate device is in an abnormal state;

[0016] The second determination module is used to determine the device state of the target candidate device according to the confidence of the target candidate device, and the device state includes an abnormal state and a normal state.

[0017] In a third aspect, the present invention provides an electronic device comprising: a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method described in the first aspect when executing the program.

[0018] In a fourth aspect, the present invention provides a readable storage medium, which, when instructions in the storage medium are executed by a processor of an electronic device, enables the electronic device to execute the method described in the first aspect.

[0019] The technical solution provided by the embodiments of the present disclosure may have the following beneficial effects:

[0020] By acquiring access data of a target gateway, wherein the access data includes flow data corresponding to an access device accessing the target gateway; performing multiple rounds of candidate device screening operations, and determining a target candidate device screened out by the last candidate device screening operation; wherein each candidate device screening operation is used to screen out new candidate devices from candidate devices obtained in the previous round according to flow data and screening conditions in a corresponding execution time period of this round, and in the first round, candidate devices are screened out from the access devices; calculating the similarity between flow data of the target candidate device and flow data of other access devices within a preset time period; inputting the similarity into a trained confidence network model, and determining the confidence of the target candidate device through the confidence network model; the confidence represents the degree of certainty that the target candidate device is in an abnormal state; determining the device state of the target candidate device according to the confidence of the target candidate device, and the device state includes an abnormal state and a normal state. In this way, the traffic data of the access gateway can be used to automatically identify target candidate devices with suspected abnormal status, and the device status of the target candidate devices can be directly output through the trained confidence network model. This can comprehensively cover all connected devices based on traffic data, automatically identify the device status, and improve the efficiency of detecting whether the device status is abnormal, avoiding the problems of low detection efficiency and lack of comprehensive coverage caused by traditional detection methods that rely on physical inspections or manual inspections. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or related technologies, the following briefly introduces the drawings required for use in the embodiments or related technical descriptions. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0022] Figure 1 is a flow chart of a method for determining device abnormality provided by an embodiment of the present application;

[0023] Figure 2 is a flow chart of another method for determining device abnormality provided by an embodiment of the present application;

[0024] Figure 3 is a block diagram of a device abnormality determination apparatus provided in an embodiment of the present application;

[0025] Figure 4 It is a structural diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0026] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0027] Before introducing the device abnormality determination method, apparatus, device and storage medium provided by the present disclosure, the application scenarios involved in each embodiment of the present disclosure are first introduced. The present disclosure can be applied to the scenario of detecting a device connected to a gateway, and the device abnormality determination method provided by the embodiment of the present disclosure can be applied to a gateway device, wherein the gateway device is used to provide network services for the connected electronic device.

[0028] At present, with the development of communication technology, terminal devices have been widely used in all walks of life. Due to the openness and unsupervisability of terminal device usage scenarios, terminal devices bring convenience to users, but also pose a serious threat to privacy and security. Whether in public places or private scenes, cameras may be installed actively or passively for monitoring, which brings great privacy and security violations to people. In particular, wireless cameras are easier to hide because they do not require wiring, causing more serious privacy violations.

[0029] However, in related technologies, traditional monitoring methods often rely on physical inspections or manual patrols, which is not only inefficient, but also difficult to fully cover all possible hidden cameras. With the popularization of camera equipment and the continuous advancement of technology, camera equipment is becoming more and more hidden and more difficult to detect directly with the naked eye, which poses a serious threat to the privacy and security of users.

[0030] In order to solve the above problems, the present disclosure provides a device abnormality determination method, apparatus, device and readable storage medium, which can automatically identify target candidate devices with suspected abnormal status through the traffic data of the access gateway, and further directly output the device status of the target candidate devices through a trained confidence network model. In this way, all connected devices can be fully covered based on the traffic data, and the device status can be automatically identified, which can improve the detection efficiency of whether the device status is abnormal, and avoid the problems of low detection efficiency and lack of comprehensive coverage caused by traditional detection methods that rely on physical inspections or manual inspections.

[0031] The touch area correction method provided by the embodiment of the present application is described in detail below through specific embodiments and application scenarios in conjunction with the accompanying drawings.

[0032] Figure 1 is a flow chart of a method for determining device abnormality provided by an embodiment of the present application, such as Figure 1 As shown, the method may include the following steps.

[0033] In step S101, access data of a target gateway is obtained.

[0034] The access data includes traffic data corresponding to the access device accessing the target gateway. The target gateway may include an edge gateway, wherein the edge gateway may be understood as a gateway connected to the access device.

[0035] Optionally, the edge side gateway may be a router. The number of edge side gateways may be one, two, or more than two. The correspondence between the edge side gateway and the terminal device may be one-to-one, one-to-many, or many-to-many, which is not limited in the present disclosure.

[0036] Considering that after the camera captures the video data, it usually needs to access the network to upload and share the captured video data, therefore, in the area to be investigated, the traffic data of the gateway devices connected to the area can be detected and analyzed. In this way, the network activities in the area can be detected, especially the abnormal network traffic patterns, which may be related to the network communication behavior of the hidden camera device.

[0037] Specifically, after the access device generates network traffic data, the network traffic data generated by the access device can be used as the access data of the target gateway. In other words, after obtaining the network traffic data generated by the access device, the network traffic data can be sent to the edge gateway corresponding to the access device.

[0038] Therefore, in this step, when an access device successfully accesses the target gateway, the post-access traffic data of the access device can be collected through the target gateway, wherein the post-access device traffic data includes but is not limited to the number of preset data packet types transmitted between the access device and the target gateway, the accumulated data traffic, and the broadband usage rate.

[0039] Specifically, the target gateway may collect the traffic data after the access device is connected according to a preset frequency. For example, the target gateway may collect the traffic data after the device is connected every 5 seconds.

[0040] For example, the traffic data corresponding to the access device connected to the target gateway can be obtained in the following way:

[0041] Method 1: Monitoring technology based on hardware probes.

[0042] Specifically, a hardware probe is a hardware device used to obtain network traffic. When in use, it is connected in series in the link where traffic needs to be captured, and traffic information is obtained by diverting the digital signal on the link.

[0043] Among them, a hardware probe monitors the traffic information of a subnet (usually a link). For the monitoring of the whole network traffic, a distributed solution is needed, deploying a probe on each link, and then collecting the data of all probes through the background server and database to perform traffic analysis and long-term reporting for the whole network.

[0044] Method 2: Traffic monitoring technology based on SNMP (Simple Network Management Protocol).

[0045] Specifically, the flow information collection based on SNMP is essentially that the test instrument collects some variables related to specific devices and flow information from the MIB (Management Information Base) provided by the network device.

[0046] Among them, the network traffic information collected based on SNMP may include: the number of input bytes, the number of input non-broadcast packets, the number of input broadcast packets, the number of input packet discards, the number of input packet errors, the number of input unknown protocol packets, the number of output bytes, the number of output non-broadcast packets, the number of output broadcast packets, the number of output packet discards, the number of output packet errors, the number of output team leaders, etc.

[0047] Method 3: Traffic monitoring technology based on Netflow (Network Flow, network traffic analysis).

[0048] Specifically, Netflow traffic information collection is based on the Netflow mechanism provided by network devices to achieve network traffic information collection. Netflow is performed by routers and switches themselves to count network traffic and send the results to third-party traffic report generators and long-term databases. Once the detailed traffic data on routers and switches is collected, it can provide counting basis for network traffic statistics, network usage pricing, network planning, virus traffic analysis, network monitoring and other applications.

[0049] By adopting the above technical solution, network traffic can be effectively monitored and managed.

[0050] In step S102, multiple rounds of candidate device screening operations are performed, and a target candidate device obtained by the last candidate device screening operation is determined.

[0051] Each candidate device screening operation is used to screen new candidate devices from the candidate devices obtained in the previous round according to the traffic data and screening conditions in the corresponding execution time period of this round, and in the first round, the candidate devices are screened from the access device.

[0052] In some embodiments, the traffic data of the access device connected to the target gateway can be first collected over a longer period of time. If it is detected that the access data includes downlink traffic, it can be determined that a user has stayed in the room where the target gateway is set up during the period of time. If it is determined that a user has stayed in the room, multiple rounds of candidate device screening operations can be performed, and the target candidate device obtained by the last candidate device screening operation can be determined.

[0053] Optionally, if downlink traffic that lasts for a first preset period of time is detected in the traffic data within the first time period for the first time, it is determined that there is a first device connected to the target gateway, and the network address of the first device is obtained; then multiple rounds of candidate device screening operations are performed, and the candidate device screened by the last candidate device screening operation is determined to be the target candidate device.

[0054] Among them, each candidate device screening operation is used to: in the traffic data obtained within the corresponding execution time period of this round, if candidate traffic data that lasts for a preset time period and is greater than or equal to a preset traffic threshold is detected, obtain the candidate network address of the device corresponding to the candidate traffic data; and when the candidate network address corresponding to the candidate traffic data is consistent with the candidate network address screened in the previous round, use the candidate device obtained from the previous round as the new candidate device screened in this round, and in the first round, it is the candidate device screened from the first device.

[0055] For example, when the access data of the target gateway is obtained, for example, when all the traffic data of the target gateway in the time period from 12:00 on the same day to 12:00 on the next day is obtained, the time period from 18:00 on the same day to 11:00 on the next day can be taken as the first time period, and then based on the access data in the first time period, when it is detected that the access data includes downlink traffic, it can be determined that a user is staying in the room where the target gateway is set.

[0056] Then, when it is determined that a user has checked into the room where the target gateway is set, a candidate device screening operation can be performed based on the access data in the first time period to filter out candidate devices from the access devices according to the screening conditions. Then, all traffic data of the target gateway in the time period from 12:00 on the second day of the user's check-in day to 12:00 the next day can be obtained, and the candidate device screening operation can be repeated to filter out new candidate devices from the candidate devices determined on the previous day according to the screening conditions. In addition, the candidate device screening operation can be repeated in the following days according to the above steps, and after repeating the preset rounds of candidate device screening operations, the candidate device obtained by the last candidate device screening operation can be used as the target candidate device.

[0057] Among them, the target candidate device can be used as an access device that is highly suspected of being in an abnormal state.

[0058] In another possible implementation, when the access data of the target gateway is obtained, the access data of the target gateway can be divided into access data corresponding to multiple time periods according to preset time intervals. For example, all traffic data of the target gateway in the time period from 12:00 on the day of the user's check-in to 12:00 on the fourth day after the check-in date can be divided into a first time period from 18:00 on the day to 11:00 on the next day, a second time period from 12:00 on the next day to 12:00 on the third day after the check-in date, and a third time period from 12:00 on the third day after the check-in date to 12:00 on the fourth day after the check-in date, and so on. Then, based on the access data in the first time period, first determine whether there is a user staying in the room where the target gateway is set, and if it is determined that there is a user staying in the room, based on the first time period, The access data in the first time period is used to perform a candidate device screening operation, so as to obtain a candidate device from the access device according to the screening condition, and then the access data in the second time period is used to perform a candidate device screening operation, so as to obtain a new candidate device from the candidate device determined on the previous day according to the screening condition, and the candidate device screening operation is repeated in the next few time periods, and after repeating the preset rounds of candidate device screening operation, the candidate device obtained by the last candidate device screening operation can be used as a target candidate device, wherein the target candidate device can be used as an access device that is highly suspected of being in an abnormal state.

[0059] In this way, the time window and traffic characteristics can be combined to perform hierarchical detection on the devices connected to the gateway, gradually enhancing the detection accuracy, reducing the false alarm rate, and improving the accuracy of device anomaly identification.

[0060] In step S103, the similarity between the traffic data of the target candidate device and the traffic data of other access devices within a preset time period is calculated.

[0061] After performing the above-mentioned graded detection on the access devices accessing the target gateway, the target candidate devices that are highly suspected of being in an abnormal state can be determined based on the analysis of the traffic data. However, considering that the room where the target gateway is located is equipped with a variety of access devices, in order to avoid detection errors and mistaking normal access devices in the room for target candidate devices, it is possible to further determine whether the device state of the target candidate device is abnormal by calculating the similarity between the traffic data of the target candidate device and the traffic data of other access devices within a preset time period.

[0062] Optionally, within the preset time period, the traffic sequence corresponding to the target candidate device can be determined based on the traffic value corresponding to the target candidate device at each moment, and the traffic sequence corresponding to the other access device can be determined based on the traffic value corresponding to the other access device at each moment.

[0063] The flow sequence includes the flow value corresponding to each moment.

[0064] Then, the edit distance of each traffic sequence matrix can be calculated.

[0065] The traffic sequence matrix includes any two different traffic sequences, the traffic sequences between each traffic sequence matrix are not repeated, and the edit distance is used to represent the similarity between two traffic sequences in the traffic sequence matrix.

[0066] In some embodiments, considering that the traffic sequence lengths of different networked devices may be different, the calculated edit distance may be normalized, which can improve the output efficiency of the confidence network model in subsequent steps.

[0067] Therefore, the sequence lengths of the two traffic sequences in the traffic sequence matrix can be obtained respectively first; then the ratio of the edit distance and the maximum sequence length can be used as the normalized edit distance.

[0068] The maximum sequence length is the maximum length of the two sequence lengths.

[0069] In step S104, the similarity is input into a trained confidence network model, and the confidence of the target candidate device is determined by the confidence network model.

[0070] Among them, the confidence represents the degree of certainty that the target candidate device is in an abnormal state. After the devices connected to the gateway are graded and detected through the above steps, the traffic data of the target candidate device and the traffic data of other access devices can be further calculated. The similarity within a preset time period can be used to determine the difference between the traffic data of the target candidate device and the traffic data of other access devices within the same time period through the trained confidence network model. In this way, the edit distance clustering analysis can be used to achieve rapid positioning and marking of potential unknown hidden camera devices, and all connected devices can be fully covered based on traffic data. The device status can be automatically identified, which can improve the detection efficiency of whether the device status is abnormal.

[0071] In step S105, the device state of the target candidate device is determined according to the confidence level of the target candidate device.

[0072] The device status includes an abnormal status and a normal status.

[0073] The above technical scheme is adopted, by obtaining the access data of the target gateway, wherein the access data includes the flow data corresponding to the access device accessing the target gateway; performing multiple rounds of candidate device screening operations, and determining the target candidate device obtained by the last candidate device screening operation; wherein each candidate device screening operation is used to screen new candidate devices from the candidate devices obtained in the previous round according to the flow data and screening conditions in the corresponding execution time period of this round, and in the first round, the candidate device is screened from the access device; calculating the similarity between the flow data of the target candidate device and the flow data of other access devices within a preset time period; inputting the similarity into a trained confidence network model, and determining the confidence of the target candidate device through the confidence network model; the confidence represents the degree of certainty that the target candidate device is in an abnormal state; and determining the device state of the target candidate device according to the confidence of the target candidate device, wherein the device state includes an abnormal state and a normal state.

[0074] In this way, the traffic data of the access gateway can be used to automatically identify target candidate devices with suspected abnormal status, and the device status of the target candidate devices can be directly output through the trained confidence network model. This can comprehensively cover all connected devices based on traffic data, automatically identify the device status, and improve the efficiency of detecting whether the device status is abnormal, avoiding the problems of low detection efficiency and lack of comprehensive coverage caused by traditional detection methods that rely on physical inspections or manual inspections.

[0075] Figure 2 is a flow chart of another method for determining device abnormality provided by an embodiment of the present application, such as Figure 2 As shown, the method may include the following steps.

[0076] In step S201, access data of a target gateway is obtained.

[0077] Among them, the access data includes traffic data corresponding to the access device accessing the target gateway. The target gateway may include an edge gateway, wherein the edge gateway can be understood as a gateway connected to the access device. Optionally, the edge gateway may be a router. The number of edge gateways may be one, two, or more than two. The correspondence between the edge gateway and the terminal device may be one-to-one, one-to-many, or many-to-many, which is not limited in this disclosure.

[0078] Considering that after the camera captures the video data, it usually needs to access the network to upload and share the captured video data, therefore, in the area to be investigated, the traffic data of the gateway devices connected to the area can be detected and analyzed. In this way, the network activities in the area can be detected, especially the abnormal network traffic patterns, which may be related to the network communication behavior of the hidden camera device.

[0079] Therefore, in this step, when an access device successfully accesses the target gateway, the post-access traffic data of the access device can be collected through the target gateway, wherein the post-access device traffic data includes but is not limited to the number of preset data packet types transmitted between the access device and the target gateway, the accumulated data traffic, and the broadband usage rate.

[0080] Specifically, the target gateway may collect the traffic data after the access device is connected according to a preset frequency. For example, the target gateway may collect the traffic data after the device is connected every 5 seconds.

[0081] In step S202, in the traffic data within the first time period, if downlink traffic that lasts for a first preset time period is detected, it is determined that there is a first device connected to the target gateway, and the network address of the first device is obtained.

[0082] Taking into account the scenario of hotel check-in, since there are multiple networked devices installed in the hotel room itself, which have been connected to the target gateway, if the detection of this solution is performed on all the rooms in the hotel, there will be false detections, resulting in low detection efficiency. Therefore, it is possible to first determine whether the target gateway has other devices except the networked devices installed in the room itself in the following way, and when it is determined that the downlink traffic is detected for a first preset time period, it can be considered that a user has checked in. At this time, performing the detection of this solution can effectively improve the detection efficiency.

[0083] In this step, when the access data of the target gateway is obtained, the access data of the target gateway can be divided into access data corresponding to multiple time periods according to preset time intervals. For example, all traffic data of the target gateway in the time period from 12:00 on the user's check-in day to 12:00 on the fourth day after the check-in day can be divided into a first time period from 18:00 on the same day to 11:00 on the next day, a second time period from 12:00 on the same day to 12:00 on the next day, a third time period from 12:00 on the next day to 12:00 on the third day after the check-in day, and a fourth time period from 12:00 on the third day after the check-in day to 12:00 on the fourth day after the check-in day, etc. Then, according to the access data in the first time period, a candidate device screening operation is performed to screen the candidate devices from the access devices according to the screening conditions.

[0084] Specifically, the traffic data of the first time period may be detected, and when it is detected that there is at least 5 minutes of downlink traffic, it may be determined that there is a first device connected to the target gateway.

[0085] Then, the network address of the first device may be obtained.

[0086] The network address may be represented by a URL (Uniform Resource Locator) address.

[0087] In step S203, multiple rounds of candidate device screening operations are performed, and the candidate device screened out in the last candidate device screening operation is determined as the target candidate device.

[0088] Among them, each candidate device screening operation is used to: in the traffic data obtained within the corresponding execution time period of this round, if candidate traffic data that lasts for a preset time period and is greater than or equal to a preset traffic threshold is detected, obtain the candidate network address of the device corresponding to the candidate traffic data; and when the candidate network address corresponding to the candidate traffic data is consistent with the candidate network address screened in the previous round, use the candidate device obtained from the previous round as the new candidate device screened in this round, and in the first round, it is the candidate device screened from the first device.

[0089] In a possible implementation, the execution time period may include a first time period, a second time period, a third time period, and a fourth time period, and the target candidate device may be determined through the following steps.

[0090] S1. Determine that a first device is connected to the target gateway, and obtain a network address of the first device.

[0091] For example, in the traffic data within the first time period, if downlink traffic lasting at least 5 minutes is detected, it can be preliminarily determined that the room where the target gateway is located is occupied by a guest, and the network address of the first device corresponding to the downlink traffic is obtained.

[0092] S2. Perform traffic analysis on the traffic data within the first time period, and if a first uplink traffic that lasts for a second preset time period and is greater than or equal to a first preset traffic threshold is detected in the traffic data within the first time period, obtain a first network address of a device corresponding to the first uplink traffic.

[0093] In this step, when it is determined that the room where the target gateway is located is occupied by a guest, traffic analysis can be performed on the traffic data within the first time period. When it is determined that the first uplink traffic is detected to last for more than 30 minutes and the data volume reaches 30MB within the first time period, the first network address of the device corresponding to the first uplink traffic can be obtained.

[0094] S3: When the first network address is consistent with the network address of the first device, the first device is used as a candidate device.

[0095] In this step, if the first network address is consistent with the network address of the first device, the first device can be regarded as a slightly suspected candidate device.

[0096] S4. Perform traffic analysis on the traffic data within the second time period, and if a second uplink traffic that lasts for a second preset time period and is greater than or equal to a second preset traffic threshold is detected in the traffic data within the second time period, obtain a second network address of a device corresponding to the second uplink traffic.

[0097] In this step, in the traffic data within the second time period, if the second upstream traffic is detected to last for more than 30 minutes and the data volume reaches 50MB, the second network address of the device corresponding to the second upstream traffic can be obtained.

[0098] S5: When the second network address is consistent with the first network address, continue to use the first device as a candidate device.

[0099] In this step, if the second network address is consistent with the first network address, the first device can be regarded as a moderately suspected candidate device.

[0100] S6. Perform traffic analysis on the traffic data within the third time period, and if a third uplink traffic that lasts for a second preset time period and is greater than or equal to a third preset traffic threshold is detected in the traffic data within the third time period, obtain a third network address of a device corresponding to the third uplink traffic.

[0101] In this step, in the traffic data within the third time period, if the third uplink traffic is detected to last for more than 30 minutes and the data volume reaches 80MB, the third network address of the device corresponding to the third uplink traffic can be obtained.

[0102] S7: When the third network address is consistent with the second network address, continue to use the first device as a candidate device.

[0103] In this step, if the third network address is consistent with the second network address, the first device can be regarded as a highly suspected candidate device.

[0104] S8. Perform traffic analysis on the traffic data within the fourth time period, and if a fourth uplink traffic that lasts for a third preset time period and is greater than or equal to a first preset traffic threshold is detected in the traffic data within the fourth time period, obtain a fourth network address of a device corresponding to the fourth uplink traffic.

[0105] The fourth time period may be a time period including the first time period, the second time period, and the third time period, and the corresponding traffic data may be the total access data acquired by the target gateway.

[0106] In this step, in the traffic data within the fourth time period, if the fourth uplink traffic is detected to last for 2 hours and the data volume reaches 30MB, the fourth network address of the device corresponding to the fourth uplink traffic can be obtained.

[0107] S9: When the fourth network address is consistent with the third network address, use the first device as a target candidate device.

[0108] In this step, if the fourth network address is consistent with the third network address, the first device may be used as a target candidate device.

[0109] By adopting the above technical solution, the time window and traffic characteristics can be combined to perform hierarchical detection on the devices connected to the gateway, gradually enhance the detection accuracy, reduce the false alarm rate, and improve the accuracy of device anomaly identification.

[0110] In step S204, within the preset time period, the traffic sequence corresponding to the target candidate device is determined according to the traffic value corresponding to the target candidate device at each moment, and the traffic sequence corresponding to the other access device is determined according to the traffic value corresponding to the other access device at each moment.

[0111] The flow sequence includes the flow value corresponding to each moment.

[0112] In step S205 , the edit distance of each traffic sequence matrix is ​​calculated.

[0113] The traffic sequence matrix includes any two different traffic sequences, the traffic sequences between each traffic sequence matrix are not repeated, and the edit distance is used to represent the similarity between two traffic sequences in the traffic sequence matrix.

[0114] Specifically, an example of calculating the edit distance of each traffic sequence matrix can be provided:

[0115] D1, m=length(sequenceA), n=length(sequenceB);

[0116] D2, create matrix D[0..m,0..n];

[0117] D3. if sequenceA[i-1]==sequenceB[j-1]:substitutionCost=0;

[0118] else:substitutionCost=1D[i,j]=minimum(D[i-1,j]+1,D[i,j-1]+1,D[i-1,j-1]+substitutionCost);

[0119] D4, return D[m,n];

[0120] Among them, the lengths of the two traffic sequences can be obtained through step D1, and then a traffic sequence matrix D with (m+1) rows and (n+1) columns can be created through step D2. Then, the traffic sequence matrix D can be filled through step D3 to convert one sequence into another sequence and obtain the minimum number of operations required, wherein the operations can include insertion, deletion, replacement and the like. Finally, the value of the lower right corner of the filled traffic sequence matrix D is obtained, i.e., the edit distance.

[0121] In another possible implementation, considering that the traffic sequence lengths of different networked devices may be different, the calculated edit distance may be normalized, which can improve the output efficiency of the confidence network model in subsequent steps.

[0122] Therefore, the sequence lengths of the two traffic sequences in the traffic sequence matrix can be obtained respectively first; then the ratio of the edit distance and the maximum sequence length can be used as the normalized edit distance.

[0123] The maximum sequence length is the maximum length of the two sequence lengths.

[0124] Specifically, the normalized edit distance can be calculated by the following formula:

[0125] EDR(A,B)=ED(A,B) / max(len(A),len(B));

[0126] Among them, ED(A,B) is the edit distance between traffic sequence A and traffic sequence B, len(A) and len(B) are the sequence lengths of traffic sequence A and traffic sequence B respectively, and EDR(A,B) is the normalized edit distance between traffic sequence A and traffic sequence B.

[0127] Specifically, an example of obtaining the edit distance of all traffic sequence matrices according to the traffic sequence of each device can be provided:

[0128] F1. NetworkedDevices = getAllNetworkedDeviceTrafficSequences(); n = length(NetworkedDevices);

[0129] F2. create matrix distanceMatrix[1..n,1..n];

[0130] F3. deviceA=Networked Devices[i]; deviceB=Networked Devices[j]; editDistance=calculateEditDistance(deviceA.trafficSequence, deviceB.trafficSequence); distanceMatrix[i,j]=editDistance; distanceMatrix[j,i]=editDistance;

[0131] F4, return distanceMatrix;

[0132] Among them, the traffic sequences of all access devices can be obtained through step F1, and then the traffic sequence matrices of all access devices can be obtained through step F2. Then, the edit distances between all traffic sequence matrices can be calculated through step F3, and finally the edit distance matrix of all traffic sequence matrices can be obtained through step F4.

[0133] In step S206, the similarity is input into a trained confidence network model, and the confidence of the target candidate device is determined by the confidence network model.

[0134] The confidence level represents the degree of certainty that the target candidate device is in an abnormal state.

[0135] Optionally, the identifier of the traffic sequence matrix corresponding to the edit distance and the edit distance can be used as input of a trained confidence network model to obtain multiple confidences output by the confidence network model, wherein the confidence probability value includes the identifier of the corresponding traffic sequence matrix; and when the target candidate device is included in the device corresponding to the traffic sequence matrix, the confidence corresponding to the traffic sequence matrix is ​​used as the confidence of the target candidate device.

[0136] In this step, the HDBSCAN (Hierachical Density-Based Spatial Clustering of Applications with Noise) algorithm can be first used for clustering to obtain multiple device categories and probability values ​​corresponding to the device categories, wherein the device category can characterize the risk level of determining that the device is in an abnormal state, and the probability value corresponding to the device category is used to characterize the possibility of the device being at this risk level.

[0137] Specifically, the device group identifier corresponding to each traffic sequence matrix and each traffic sequence matrix can be input into the HDBSCAN algorithm model to obtain multiple device categories output by the HDBSCAN algorithm model and probability values ​​corresponding to the device categories.

[0138] Since each device category may include multiple device groups, the ratio of the probability value corresponding to the device category to the number of device groups included in the device category can be used as the confidence of the device group.

[0139] In step S207, the device state of the target candidate device is determined according to the confidence level of the target candidate device.

[0140] The device status includes an abnormal status and a normal status.

[0141] Specifically, when the confidence of the target candidate device is greater than or equal to a preset threshold, the device state of the target candidate device is determined to be an abnormal state; and when the confidence of the target candidate device is less than the preset threshold, the device state of the target candidate device is determined to be a normal state.

[0142] Optionally, since each device group includes two devices, when the confidence of the target candidate device is determined by the confidence of the device group, the confidence of the device group to which the target candidate device belongs may be used as the confidence of the target candidate device.

[0143] By adopting the above technical solution, it is possible to automatically identify target candidate devices with suspected abnormal status through the traffic data of the access gateway, and further directly output the device status of the target candidate devices through the trained confidence network model. In this way, all connected devices can be fully covered based on the traffic data, and the device status can be automatically identified, which can improve the detection efficiency of whether the device status is abnormal, and avoid the traditional detection methods that rely on physical inspections or manual inspections, resulting in low detection efficiency and inability to fully cover the problem.

[0144] Figure 3 is a block diagram of a device abnormality determination apparatus provided in an embodiment of the present application, such as Figure 3 As shown, the device 300 includes:

[0145] The acquisition module 301 acquires access data of a target gateway, wherein the access data includes flow data corresponding to an access device accessing the target gateway;

[0146] The first determination module 302 is used to perform multiple rounds of candidate device screening operations and determine the target candidate device obtained by the last candidate device screening operation; wherein each candidate device screening operation is used to screen new candidate devices from the candidate devices obtained in the previous round according to the traffic data and the screening conditions in the corresponding execution time period of the current round, and in the first round, the candidate device is screened from the access device;

[0147] A calculation module 303, used to calculate the similarity between the flow data of the target candidate device and the flow data of other access devices within a preset time period;

[0148] An input module 304 is used to input the similarity into a trained confidence network model, and determine the confidence of the target candidate device through the confidence network model; the confidence represents the degree of certainty that the target candidate device is in an abnormal state;

[0149] The second determination module 305 is used to determine the device state of the target candidate device according to the confidence of the target candidate device, and the device state includes an abnormal state and a normal state.

[0150] Optionally, the first determining module 302 includes:

[0151] A first determination submodule is configured to determine that a first device is connected to the target gateway if downlink traffic that lasts for a first preset time period is detected in the traffic data within a first time period, and obtain a network address of the first device;

[0152] A second determination submodule is used to perform multiple rounds of candidate device screening operations, and determine that the candidate device screened out by the last candidate device screening operation is the target candidate device;

[0153] Among them, each candidate device screening operation is used to: in the traffic data obtained within the corresponding execution time period of this round, if candidate traffic data that lasts for a preset time period and is greater than or equal to a preset traffic threshold is detected, obtain the candidate network address of the device corresponding to the candidate traffic data; and when the candidate network address corresponding to the candidate traffic data is consistent with the candidate network address screened in the previous round, use the candidate device obtained from the previous round as the new candidate device screened in this round, and in the first round, it is the candidate device screened from the first device.

[0154] Optionally, the execution time period includes a first time period, a second time period, a third time period and a fourth time period; and the second determination submodule is used to:

[0155] In the traffic data within the first time period, if a first uplink traffic that lasts for a second preset time period and is greater than or equal to a first preset traffic threshold is detected, a first network address of a device corresponding to the first uplink traffic is obtained, and if the first network address is consistent with the network address of the first device, the first device is used as a candidate device;

[0156] In the traffic data within the second time period, if a second uplink traffic that lasts for a second preset time and is greater than or equal to a second preset traffic threshold is detected, a second network address of a device corresponding to the second uplink traffic is obtained, and if the second network address is consistent with the first network address, the first device continues to be used as a candidate device;

[0157] In the traffic data within the third time period, if a third uplink traffic that lasts for a second preset time and is greater than or equal to a third preset traffic threshold is detected, a third network address of a device corresponding to the third uplink traffic is obtained, and if the third network address is consistent with the second network address, the first device continues to be used as a candidate device;

[0158] In the traffic data within the fourth time period, if a fourth uplink traffic is detected that lasts for a third preset time period and is greater than or equal to a first preset traffic threshold, the fourth network address of the device corresponding to the fourth uplink traffic is obtained. If the fourth network address is consistent with the third network address, the first device is used as a target candidate device.

[0159] Optionally, the calculation module 303 includes:

[0160] A third determination submodule is used to determine, within the preset time period, a flow sequence corresponding to the target candidate device according to the flow value corresponding to the target candidate device at each moment, and to determine a flow sequence corresponding to the other access device according to the flow value corresponding to the other access device at each moment; the flow sequence includes the flow value corresponding to each moment;

[0161] The calculation submodule is used to calculate the edit distance of each traffic sequence matrix, which includes any two different traffic sequences. The traffic sequences between each traffic sequence matrix are not repeated. The edit distance is used to represent the similarity between two traffic sequences in the traffic sequence matrix.

[0162] Optionally, the calculation module 303 further includes:

[0163] An acquisition submodule, used to respectively acquire the sequence lengths of two traffic sequences in the traffic sequence matrix;

[0164] The fourth determination submodule is used to use the ratio of the edit distance to the maximum sequence length as the normalized edit distance, and the maximum sequence length is the maximum length of the two sequence lengths.

[0165] Optionally, the similarity includes an edit distance; the input module 304 includes:

[0166] A fifth determination submodule is used to use the identifier of the traffic sequence matrix corresponding to the edit distance and the edit distance as inputs of the trained confidence network model to obtain multiple confidences output by the confidence network model, wherein the confidence probability value includes the identifier of the corresponding traffic sequence matrix;

[0167] The sixth determination submodule is configured to, when the target candidate device is included in the devices corresponding to the traffic sequence matrix, use the confidence corresponding to the traffic sequence matrix as the confidence of the target candidate device.

[0168] Optionally, the second determining module 305 includes:

[0169] a seventh determination submodule, configured to determine that the device state of the target candidate device is an abnormal state when the confidence level of the target candidate device is greater than or equal to a preset threshold;

[0170] The eighth determination submodule is configured to determine that the device state of the target candidate device is a normal state when the confidence level of the target candidate device is less than the preset threshold.

[0171] By adopting the above-mentioned device, it is possible to automatically identify target candidate devices with suspected abnormal status through the traffic data of the access gateway, and further directly output the device status of the target candidate devices through the trained confidence network model. In this way, all connected devices can be fully covered based on the traffic data, and the device status can be automatically identified, which can improve the detection efficiency of whether the device status is abnormal, and avoid the problems of low detection efficiency and lack of comprehensive coverage caused by traditional detection methods that rely on physical inspections or manual inspections.

[0172] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0173] The present invention also provides an electronic device, see Figure 4 , including: a processor 401, a memory 402, and a computer program 4021 stored in the memory and executable on the processor, wherein when the processor executes the program, the device abnormality determination apparatus of the aforementioned embodiment is implemented.

[0174] The present invention also provides a readable storage medium, when the instructions in the storage medium are executed by a processor of an electronic device, the electronic device can execute the device abnormality determination apparatus of the aforementioned embodiment.

[0175] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0176] It should be noted that the various information and data obtained in the embodiments of the present invention are all obtained with the authorization of the information / data holder.

[0177] The algorithm and display provided herein are not inherently related to any particular computer, virtual system or other device. Various general purpose systems can also be used together with the teachings based on this. According to the above description, it is obvious that the structure required for constructing such systems. In addition, the present invention is not directed to any specific programming voice. It should be understood that various programming voices can be utilized to realize the content of the present invention described herein, and the description of the above specific voices is for the purpose of disclosing the best mode of the present invention.

[0178] In the description provided herein, a large number of specific details are described. However, it is understood that embodiments of the present invention can be practiced without these specific details. In some instances, well-known methods, structures and techniques are not shown in detail so as not to obscure the understanding of this description.

[0179] Similarly, it should be understood that in order to streamline the present invention and aid in understanding one or more of the various inventive aspects, in the above description of exemplary embodiments of the present invention, the various features of the present invention are sometimes grouped together into a single embodiment, figure, or description thereof. However, this disclosed method should not be interpreted as reflecting the following intention: that the claimed invention requires more features than the features explicitly recited in each claim. More specifically, as reflected in the claims below, inventive aspects lie in less than all the features of the individual embodiments disclosed above. Therefore, the claims that follow the specific embodiment are hereby expressly incorporated into the specific embodiment, with each claim itself serving as a separate embodiment of the present invention.

[0180] Those skilled in the art will appreciate that the modules in the devices in the embodiments may be adaptively changed and arranged in one or more devices different from the embodiments. The modules or units or components in the embodiments may be combined into one module or unit or component, and in addition they may be divided into a plurality of submodules or subunits or subcomponents. Except that at least some of such features and / or processes or units are mutually exclusive, all features disclosed in this specification (including the accompanying claims, abstracts and drawings) and all processes or units of any method or device disclosed in this manner may be combined in any combination. Unless otherwise expressly stated, each feature disclosed in this specification (including the accompanying claims, abstracts and drawings) may be replaced by an alternative feature providing the same, equivalent or similar purpose.

[0181] The various component embodiments of the present invention may be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. It should be understood by those skilled in the art that a microprocessor or digital signal processor (DSP) may be used in practice to implement some or all of the functions of some or all of the components in the sorting device according to the present invention. The present invention may also be implemented as a device or apparatus program for executing part or all of the methods described herein. Such a program for implementing the present invention may be stored on a computer-readable medium, or may be in the form of one or more signals. Such a signal may be downloaded from an Internet website, or provided on a carrier signal, or provided in any other form.

[0182] It should be noted that the above embodiments illustrate the present invention rather than limit it, and that those skilled in the art may devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference symbol between brackets shall not be construed as a limitation on the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "one" or "an" preceding an element does not exclude the presence of a plurality of such elements. The present invention may be implemented by means of hardware comprising a number of different elements and by means of a suitably programmed computer. In a unit claim enumerating a number of devices, several of these devices may be embodied by the same hardware item. The use of the words first, second, and third, etc., does not indicate any order. These words may be interpreted as names.

[0183] The user information (including but not limited to the user's device information, user personal information, etc.) and related data involved in the present invention are all information authorized by the user or by all parties.

[0184] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0185] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

[0186] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A method for determining device abnormality, characterized in that: The method comprises: Acquire access data of a target gateway, wherein the access data includes flow data corresponding to an access device accessing the target gateway; Perform multiple rounds of candidate device screening operations, and determine the target candidate device obtained by the last candidate device screening operation; wherein each candidate device screening operation is used to screen new candidate devices from the candidate devices obtained in the previous round according to the traffic data and screening conditions in the corresponding execution time period of the current round, and in the first round, the candidate devices are screened from the access devices; Calculate the similarity between the traffic data of the target candidate device and the traffic data of other access devices within a preset time period; Inputting the similarity into a trained confidence network model, and determining the confidence of the target candidate device through the confidence network model; the confidence represents the degree of certainty that the target candidate device is in an abnormal state; According to the confidence level of the target candidate device, a device state of the target candidate device is determined, where the device state includes an abnormal state and a normal state.

2. The method according to claim 1, characterized in that The performing of multiple rounds of candidate device screening operations and determining the target candidate device screened by the last candidate device screening operation includes: In the traffic data within the first time period, if downlink traffic that lasts for a first preset time period is detected, it is determined that there is a first device connected to the target gateway, and the network address of the first device is obtained; Perform multiple rounds of candidate device screening operations, and determine that the candidate device screened out by the last candidate device screening operation is the target candidate device; Among them, each candidate device screening operation is used to: in the traffic data obtained within the corresponding execution time period of this round, if candidate traffic data that lasts for a preset time period and is greater than or equal to a preset traffic threshold is detected, obtain the candidate network address of the device corresponding to the candidate traffic data; and when the candidate network address corresponding to the candidate traffic data is consistent with the candidate network address screened in the previous round, use the candidate device obtained from the previous round as the new candidate device screened in this round, and in the first round, it is the candidate device screened from the first device.

3. The method according to claim 2, characterized in that The execution time period includes a first time period, a second time period, a third time period and a fourth time period; The performing of multiple rounds of candidate device screening operations and determining the candidate device screened out in the last candidate device screening operation as the target candidate device includes: In the traffic data within the first time period, if a first uplink traffic that lasts for a second preset time period and is greater than or equal to a first preset traffic threshold is detected, a first network address of a device corresponding to the first uplink traffic is obtained, and if the first network address is consistent with the network address of the first device, the first device is used as a candidate device; In the traffic data within the second time period, if a second uplink traffic that lasts for a second preset time and is greater than or equal to a second preset traffic threshold is detected, a second network address of a device corresponding to the second uplink traffic is obtained, and if the second network address is consistent with the first network address, the first device continues to be used as a candidate device; In the traffic data within the third time period, if a third uplink traffic that lasts for a second preset time period and is greater than or equal to a third preset traffic threshold is detected, a third network address of a device corresponding to the third uplink traffic is obtained, and if the third network address is consistent with the second network address, the first device continues to be used as a candidate device; In the traffic data within the fourth time period, if a fourth uplink traffic is detected that lasts for a third preset time period and is greater than or equal to a first preset traffic threshold, a fourth network address of a device corresponding to the fourth uplink traffic is obtained, and if the fourth network address is consistent with the third network address, the first device is used as a target candidate device.

4. The method according to claim 1, characterized in that: The calculating of the similarity between the traffic data of the target candidate device and the traffic data of other access devices within a preset time period includes: Within the preset time period, according to the flow value corresponding to the target candidate device at each moment, the flow sequence corresponding to the target candidate device is determined, and according to the flow value corresponding to the other access devices at each moment, the flow sequence corresponding to the other access devices is determined; the flow sequence includes the flow value corresponding to each moment; The edit distance of each traffic sequence matrix is ​​calculated, wherein the traffic sequence matrix includes any two different traffic sequences, and the traffic sequences between each traffic sequence matrix are not repeated. The edit distance is used to represent the similarity between two traffic sequences in the traffic sequence matrix.

5. The method according to claim 4, characterized in that The method further comprises: Respectively obtain the sequence lengths of two traffic sequences in the traffic sequence matrix; The ratio of the edit distance to the maximum sequence length is used as the normalized edit distance, and the maximum sequence length is the maximum length of the two sequence lengths.

6. The method according to claim 1, characterized in that The similarity includes edit distance; The similarity is input into a trained confidence network model, and the confidence of the target candidate device is determined by the confidence network model; The confidence level representing the degree of certainty that the target candidate device is in an abnormal state includes: Using the identifier of the traffic sequence matrix corresponding to the edit distance and the edit distance as inputs of the trained confidence network model, obtaining multiple confidences output by the confidence network model, wherein the confidence probability value includes the identifier of the corresponding traffic sequence matrix; In a case where the target candidate device is included in the devices corresponding to the traffic sequence matrix, the confidence corresponding to the traffic sequence matrix is ​​used as the confidence of the target candidate device.

7. The method according to any one of claims 1 to 6, characterized in that The determining, according to the confidence level of the target candidate device, whether the target candidate device is an abnormal device comprises: When the confidence level of the target candidate device is greater than or equal to a preset threshold, determining that the device state of the target candidate device is an abnormal state; When the confidence level of the target candidate device is less than the preset threshold, it is determined that the device state of the target candidate device is a normal state.

8. A device for determining equipment abnormality, characterized in that: The device comprises: An acquisition module is used to acquire access data of a target gateway, wherein the access data includes flow data corresponding to an access device accessing the target gateway; A first determination module is used to perform multiple rounds of candidate device screening operations and determine the target candidate device obtained by the last candidate device screening operation; wherein each candidate device screening operation is used to screen new candidate devices from the candidate devices obtained in the previous round according to the traffic data and the screening conditions in the corresponding execution time period of the current round, and in the first round, the candidate devices are screened from the access devices; A calculation module, used to calculate the similarity between the flow data of the target candidate device and the flow data of other access devices within a preset time period; An input module, used to input the similarity into a trained confidence network model, and determine the confidence of the target candidate device through the confidence network model; the confidence represents the degree of certainty that the target candidate device is in an abnormal state; The second determination module is used to determine the device state of the target candidate device according to the confidence of the target candidate device, and the device state includes an abnormal state and a normal state.

9. An electronic device, characterized in that: include: A processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method according to any one of claims 1 to 7 when executing the program.

10. A readable storage medium, characterized in that: When the instructions in the storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute any one of the methods described in claims 1-7.

Images