Anomaly detection method, device and equipment of electric power internet of things operating system and storage medium

Abstract

The invention discloses an anomaly detection method, device and equipment for an electric power internet-of-things operation system and a storage medium. The method comprises the following steps: acquiring network behavior data volume and equipment access duration generated when terminal equipment accesses an electric power internet of things operating system; a target anomaly detection unit is determined based on the network behavior data volume and the equipment access duration, the target anomaly detection unit comprises a first anomaly detection unit and a second anomaly detection unit, and the network behavior data volume detected by the second anomaly detection unit is higher than that of the first anomaly detection unit; and performing anomaly detection on the network behavior based on a pre-constructed abnormal network behavior database through the target anomaly detection unit to obtain an anomaly detection result. And the efficiency and accuracy of anomaly detection are improved.

Description

Technical Field

[0001] The present invention relates to the field of data detection technology, and in particular to an abnormality detection method, device, equipment and storage medium for an electric power Internet of Things operating system. Background Art

[0002] In order to better protect network data, some abnormal network behaviors need to be detected, and abnormal network behavior detection can continuously monitor unusual events or trends in private networks. Network behavior anomaly detection is a major part of network behavior analysis, which provides security protection in addition to the security provided by traditional anti-threat applications (such as firewalls, antivirus software, and spyware detection software).

[0003] The Dianhong system is an electric Internet of Things operating system. At present, in the process of the development of the Dianhong system, more and more terminal devices will be connected to the Dianhong system. Due to the continuous access of terminal devices, a large amount of network behavior data is generated, and most of these large amounts of network behavior data are real-time network behavior data. Some of these network behavior data are abnormal network behavior data generated by the outside world attacking the access terminal devices through technical means, thereby attacking the Dianhong system. Some are network abnormal behavior data generated by directly attacking the Dianhong system through terminal devices. Due to the computing power of the Dianhong system itself and its difficulty in adaptively adjusting the abnormal network behavior detection strength, the difficulty of detecting abnormal network behavior of terminal devices has gradually increased. Summary of the invention

[0004] The present invention provides an abnormality detection method, device, equipment and storage medium for an electric power Internet of Things operating system to solve the problem that it is difficult to detect abnormal network behavior.

[0005] According to one aspect of the present invention, a method for detecting anomalies in a power IoT operating system is provided, the method comprising:

[0006] Obtain the amount of network behavior data and device access duration generated by terminal devices accessing the power IoT operating system;

[0007] Determine a target anomaly detection unit based on the amount of network behavior data and the device access duration, wherein the target anomaly detection unit includes a first anomaly detection unit and a second anomaly detection unit, and the amount of network behavior data detected by the second anomaly detection unit is higher than that of the first anomaly detection unit;

[0008] The target anomaly detection unit performs anomaly detection on the network behavior based on the pre-built abnormal network behavior database to obtain anomaly detection results.

[0009] According to another aspect of the present invention, there is provided an abnormality detection device for a power Internet of Things operating system, the device comprising:

[0010] A data acquisition module is used to obtain the network behavior data volume and device access duration generated by the terminal device accessing the power Internet of Things operating system;

[0011] a detection unit determination module, configured to determine a target anomaly detection unit based on the amount of network behavior data and the device access duration, wherein the target anomaly detection unit includes a first anomaly detection unit and a second anomaly detection unit, and the amount of network behavior data detected by the second anomaly detection unit is higher than that of the first anomaly detection unit;

[0012] The anomaly detection module is used to perform anomaly detection on the network behavior based on a pre-built abnormal network behavior database through the target anomaly detection unit to obtain an anomaly detection result.

[0013] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0014] at least one processor; and

[0015] a memory communicatively connected to the at least one processor; wherein,

[0016] The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the abnormality detection method of the power Internet of Things operating system described in any embodiment of the present invention.

[0017] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the abnormality detection method of the power Internet of Things operating system described in any embodiment of the present invention when executed.

[0018] The technical solution of the embodiment of the present invention obtains the amount of network behavior data and the device access time generated by the terminal device accessing the power Internet of Things operating system; by obtaining the data of the terminal device, real-time monitoring and analysis of the power grid operation status can be achieved, and a target abnormality detection unit is determined based on the amount of network behavior data and the device access time, wherein the target abnormality detection unit includes a first abnormality detection unit and a second abnormality detection unit, and the amount of network behavior data detected by the second abnormality detection unit is higher than that of the first abnormality detection unit; the abnormality detection unit is accurately selected, and finally the network behavior is detected abnormally based on a pre-built abnormal network behavior database by the target abnormality detection unit to obtain an abnormality detection result, thereby solving the problem of difficulty in detecting abnormal network behavior and achieving the beneficial effect of improving the accuracy and efficiency of abnormality detection.

[0019] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0021] Figure 1 This is a flow chart of an abnormality detection method for a power Internet of Things operating system provided according to the first embodiment of the present invention;

[0022] Figure 2 This is a flow chart of an abnormality detection method for a power Internet of Things operating system provided according to a second embodiment of the present invention;

[0023] Figure 3 2 is a schematic diagram of the structure of an abnormality detection device of a power Internet of Things operating system provided according to a third embodiment of the present invention;

[0024] Figure 4 It is a structural schematic diagram of an electronic device that implements the abnormality detection method of the power Internet of Things operating system according to an embodiment of the present invention. DETAILED DESCRIPTION

[0025] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0026] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0027] Embodiment 1

[0028] Figure 1 A flowchart of an abnormality detection method for an electric power Internet of Things operating system is provided for the first embodiment of the present invention. This embodiment is applicable to the case of abnormal behavior data detection of a power grid. The method can be executed by an abnormality detection device for an electric power Internet of Things operating system. The abnormality detection device for an electric power Internet of Things operating system can be implemented in the form of hardware and / or software. The abnormality detection device for an electric power Internet of Things operating system can be configured in an electronic device. Figure 1 As shown, the method includes:

[0029] S110, obtaining the amount of network behavior data and device access duration generated by the terminal device accessing the power Internet of Things operating system.

[0030] Among them, network behavior data may include device status data, operation data, and alarm data. The amount of network behavior data can be understood as the amount of network behavior data. The device access duration can be understood as the duration of the terminal device accessing the power Internet of Things operating system. The power Internet of Things operating system can be the Dianhong system.

[0031] Specifically, after the terminal device is connected to the power IoT operating system, various types of network behavior data will be generated, such as device status data, operation data, and alarm data. All network behavior data and device access time generated by the terminal device being connected to the power IoT operating system are obtained.

[0032] S120. Determine a target anomaly detection unit based on the amount of network behavior data and the device access duration, wherein the target anomaly detection unit includes a first anomaly detection unit and a second anomaly detection unit, and the amount of network behavior data detected by the second anomaly detection unit is higher than that of the first anomaly detection unit.

[0033] The first anomaly detection unit can be understood as a general anomaly detection unit, which is used to detect a small amount of network behavior data. The second anomaly detection unit can be understood as a strong anomaly detection unit, which is used to detect a large amount of network behavior data.

[0034] Specifically, based on the amount of network behavior data and the device access duration, it is determined that the target anomaly detection unit is a general anomaly detection unit or a strong anomaly detection unit.

[0035] Optionally, the target anomaly detection unit is determined based on the data volume of the network behavior and the device access duration, including: when the device access duration is less than a preset access duration threshold, determining the first anomaly detection unit as the target anomaly detection unit.

[0036] Specifically, in the early stage of detection, since the network behavior data and access time generated by the terminal device connected to the power Internet of Things operating system are relatively short, the first abnormality detection unit is determined as the target abnormality detection unit. Among them, the preset access time threshold can be pre-set based on experience, and this embodiment does not limit it.

[0037] Optionally, after determining the first abnormality detection unit as the target abnormality detection unit, it also includes: when performing a single abnormality detection through the first abnormality detection unit, determining a first detection duration of the first abnormality detection unit; determining a first target detection index based on the network behavior data volume, the first detection duration and a preset first weight; when the first target detection index is not less than a first abnormality detection threshold, switching the target abnormality detection unit to the second abnormality detection unit.

[0038] The first abnormality detection threshold may be preset based on experience, and this embodiment does not limit it.

[0039] Specifically, when a single anomaly detection is performed by the first anomaly detection unit, the first detection duration of the first anomaly detection unit is determined, and the first target detection index is determined based on the product of the amount of network behavior data, the first detection duration, and a preset first weight. When the first target detection index is not less than the first anomaly detection threshold, the target anomaly detection unit is switched to the second anomaly detection unit. When the first target detection index is less than the first anomaly detection threshold, the target anomaly detection unit continues to be determined as the first anomaly detection unit.

[0040] Optionally, in the case of a single anomaly detection performed by the second anomaly detection unit, a second detection duration of the second anomaly detection unit is determined; a second target detection index is determined based on the amount of network behavior data, the second detection duration and a preset second weight; when the second target detection index is not greater than a second anomaly detection threshold, the target anomaly detection unit is switched to the first anomaly detection unit.

[0041] Specifically, the second target detection index is determined based on the product of the network behavior data volume, the second detection duration, and a preset second weight.

[0042] The second abnormality detection threshold may be preset based on experience, and this embodiment does not limit it.

[0043] Exemplarily, the second abnormality detection threshold is set to Aa, the first abnormality detection threshold is set to Ab, the second target detection index of the terminal device accessing the telecom system when the second abnormality detection unit detects is recorded as Aaa, and the first target detection index of the terminal device accessing the telecom system when the first abnormality detection unit detects is recorded as Abb. When Aaa (the second target detection index) is greater than Aa (the second abnormality detection threshold), the second abnormality detection unit is kept for detection, and when Aaa (the second target detection index) is less than or equal to Aa (the second abnormality detection threshold), the second abnormality detection unit is switched to the first abnormality detection unit. When Abb (the first target detection index) is greater than or equal to Ab (the first abnormality detection threshold), the first abnormality detection unit is switched to the second abnormality detection unit, and when Abb (the first target detection index) is less than Ab (the first abnormality detection threshold), the first abnormality detection unit is kept in the state of detection.

[0044] It can be understood that when the network behavior data of the terminal device connected to the Dianhong system fluctuates greatly, resulting in the frequent switching between the first abnormality detection unit and the second abnormality detection unit, the first abnormality detection threshold or the second abnormality detection threshold can be set to a moderate adjustment state, that is, the second abnormality detection threshold is automatically adjusted to decrease by 5%, so as to maintain the state of the second abnormality detection unit, or the first abnormality detection threshold is automatically adjusted to increase by 15%, so as to maintain the detection state of the first abnormality detection unit.

[0045] Optionally, the first target detection index is determined based on the network behavior data volume, the first detection duration, and a preset first weight by the following formula:

[0046] Abb = B*X*t;

[0047] Among them, Abb represents the first target detection indicator, B represents the amount of network behavior data, X represents the preset first weight, and t represents the first detection duration.

[0048] S130. Performing anomaly detection on the network behavior based on a pre-built abnormal network behavior database by the target anomaly detection unit to obtain an anomaly detection result.

[0049] Specifically, the target anomaly detection unit identifies the network behavior data generated by the device and compares it with the abnormal network behavior database to obtain an anomaly detection result. Exemplarily, the received data stream is matched with the features in the abnormal network behavior database to determine whether there is abnormal behavior. The anomaly detection result is output, and the anomaly detection result may include information such as the type, occurrence time, and source of the abnormal behavior. When abnormal behavior is detected, prompt information is issued in a timely manner to remind the user to take safety countermeasures.

[0050] Optionally, after determining the first abnormality detection unit as the target abnormality detection unit, it also includes: in the case of performing multiple abnormality detections through the first abnormality detection unit, respectively determining a first initial detection indicator corresponding to each abnormality detection; and averaging multiple first initial indicators to obtain the first target detection indicator.

[0051] Specifically, when the first anomaly detection unit performs multiple consecutive anomaly detections, a first initial detection index is determined based on the product of the amount of network behavior data detected by the first anomaly detection unit each time, the detection time, and a preset first weight; all first initial detection indicators are summed and averaged to obtain a first target detection index.

[0052] Optionally, when multiple anomaly detections are performed by the second anomaly detection unit, a second initial detection index corresponding to each anomaly detection is determined respectively; and multiple first initial indexes are averaged to obtain the second target detection index.

[0053] Specifically, when the second anomaly detection unit performs multiple consecutive anomaly detections, the second initial detection index is determined based on the product of the amount of network behavior data detected by the second anomaly detection unit each time, the detection time, and a preset second weight; all the second initial detection indicators are summed and averaged to obtain a second target detection index.

[0054] Optionally, the performing anomaly detection on the network behavior based on a pre-built abnormal network behavior database by the target anomaly detection unit includes: when the target anomaly detection unit is a first anomaly detection unit, performing anomaly detection on the network behavior based on a first detection time interval and a pre-built abnormal network behavior database; when the target anomaly detection unit is a second anomaly detection unit, performing anomaly detection on the network behavior based on a second detection time interval and a pre-built abnormal network behavior database; wherein the second detection time interval is smaller than the first detection time interval.

[0055] The first detection time interval may be minutes or hours, and the second detection time interval may be seconds or minutes.

[0056] Specifically, each detection interval of the second abnormality detection unit is set to the second detection time interval T1, so that after each interval T1, the second abnormality detection unit performs detection, and the value unit of T1 is seconds or minutes. Each detection interval of the first abnormality detection unit is set to the first detection time interval T2, so that after each interval T2, the first abnormality detection unit performs detection, and the value unit of T2 is minutes or hours.

[0057] The technical solution of the embodiment of the present invention obtains the amount of network behavior data and the device access time generated by the terminal device accessing the power Internet of Things operating system; by obtaining the data of the terminal device, real-time monitoring and analysis of the power grid operation status can be achieved, and a target abnormality detection unit is determined based on the amount of network behavior data and the device access time, wherein the target abnormality detection unit includes a first abnormality detection unit and a second abnormality detection unit, and the amount of network behavior data detected by the second abnormality detection unit is higher than that of the first abnormality detection unit; the abnormality detection unit is accurately selected, and finally the network behavior is detected abnormally based on a pre-built abnormal network behavior database by the target abnormality detection unit to obtain an abnormality detection result, thereby solving the problem of difficulty in detecting abnormal network behavior and achieving the beneficial effect of improving the accuracy and efficiency of abnormality detection.

[0058] Embodiment 2

[0059] Figure 2 This is a flowchart of an abnormality detection method for a power IoT operating system provided by the second embodiment of the present invention. The relationship between this embodiment and the above embodiments is how to obtain the network behavior data volume and device access duration generated by the terminal device accessing the power IoT operating system for further optimization. Figure 2 As shown, the method includes:

[0060] S210. Collect historical abnormal network behavior data during the historical operation of the power Internet of Things operating system, and establish an abnormal network behavior database based on the historical abnormal network behavior data.

[0061] Specifically, collect historical abnormal network behavior data of various abnormal types, including network attacks, data transmission anomalies, and device communication failures. Clean the collected data to remove duplicate, invalid, or redundant data. Format the data to meet the requirements of database storage. Import the collected historical abnormal network behavior data into the abnormal network behavior database.

[0062] S220. Obtain the amount of network behavior data and device access duration generated when the terminal device is connected to the power Internet of Things operating system.

[0063] S230. Determine a target anomaly detection unit based on the amount of network behavior data and the device access duration, wherein the target anomaly detection unit includes a first anomaly detection unit and a second anomaly detection unit, and the amount of network behavior data detected by the second anomaly detection unit is higher than that of the first anomaly detection unit.

[0064] S240: Perform anomaly detection on the network behavior based on a pre-built abnormal network behavior database by the target anomaly detection unit to obtain an anomaly detection result.

[0065] The technical solution of the embodiment of the present invention collects historical abnormal network behavior data during the historical operation of the power Internet of Things operating system, establishes an abnormal network behavior database based on the historical abnormal network behavior data, stores and analyzes the historical abnormal data, and helps to quickly identify abnormal patterns in current network behavior.

[0066] As an optional example of an embodiment of the present invention, the abnormality detection method of the power Internet of Things operating system of this embodiment specifically includes the following steps:

[0067] Step 1: Collect historical abnormal network behavior data that occurs during the operation of all Dianhong systems and establish an abnormal network behavior database;

[0068] Step 2: Detect the network behavior data generated by the terminal devices connected to the Dianhong system through the target anomaly detection unit.

[0069] In the initial stage of detection, since the network behavior data generated by the terminal devices connected to the Dianhong system and the detection time of the target abnormality detection unit are very short, the target abnormality detection unit is the first abnormality detection unit for detection. When the network behavior data continuously generated by the terminal devices connected to the Dianhong system suddenly increases, the detection time of the first abnormality detection unit will also increase. When the detection time of the first abnormality detection unit is too long, that is, the detection time of the target abnormality detection unit is too long, the first detection time of the first abnormality detection unit is determined; the first target detection index is determined based on the network behavior data volume, the first detection time and the preset first weight.

[0070] Step three: when the first target detection index is not less than the first abnormality detection threshold, switch the target abnormality detection unit to the second abnormality detection unit; when the first target detection index is less than the first abnormality detection threshold, keep the first abnormality detection unit in the detection state.

[0071] Step 4: After switching the target anomaly detection unit to the second anomaly detection unit, determine the second detection duration of the second anomaly detection unit; determine the second target detection index based on the network behavior data volume, the second detection duration and a preset second weight.

[0072] Step 5. When Aaa (the second target detection index) is greater than Aa (the second abnormality detection threshold), the second abnormality detection unit is kept for detection; when Aaa (the second target detection index) is less than or equal to Aa (the second abnormality detection threshold), the second abnormality detection unit is switched to the first abnormality detection unit.

[0073] Preferably, in step 2, when the target anomaly detection unit is used for detection n times, when multiple anomaly detections are performed by the first anomaly detection unit, a first initial detection index corresponding to each anomaly detection is determined respectively; and the multiple first initial indexes are averaged to obtain the first target detection index.

[0074] Optionally, when multiple anomaly detections are performed by the second anomaly detection unit, a second initial detection index corresponding to each anomaly detection is determined respectively; and multiple first initial indexes are averaged to obtain the second target detection index.

[0075] Specifically, when the second anomaly detection unit performs multiple consecutive anomaly detections, the second initial detection index is determined based on the product of the amount of network behavior data detected by the second anomaly detection unit each time, the detection time, and a preset second weight; all the second initial detection indicators are summed and averaged to obtain a second target detection index.

[0076] It can be understood that when the network behavior data of the terminal device connected to the Dianhong system fluctuates greatly, resulting in the frequent switching between the first abnormality detection unit and the second abnormality detection unit, the first abnormality detection threshold or the second abnormality detection threshold can be set to a moderate adjustment state, that is, the second abnormality detection threshold is automatically adjusted to decrease by 5%, so as to maintain the state of the second abnormality detection unit, or the first abnormality detection threshold is automatically adjusted to increase by 15%, so as to maintain the detection state of the first abnormality detection unit.

[0077] The technical solution of the embodiment of the present invention utilizes the first anomaly detection unit or the second anomaly detection unit to detect the network behavior data of the terminal device, and cooperates with the abnormal network behavior identification module for identification, so as to determine whether there is abnormal network behavior, and can switch the target anomaly detection unit, so as to utilize the detection items more comprehensively, thereby more quickly and comprehensively detecting the network behavior data generated by the terminal device, thereby detecting the abnormal network behavior in a targeted manner, reducing the occupation of computing resources, and reducing the difficulty of detection, while also having a good detection effect; by setting up multiple consecutive target anomaly detection units for detection, the detection time and number of abnormal network behavior detection can be extended to avoid frequent switching, and at the same time it can also accurately grasp whether switching is needed to avoid frequent switching caused by temporary changes in network behavior data.

[0078] Embodiment 3

[0079] Figure 3 This is a schematic diagram of the structure of an abnormality detection device for a power Internet of Things operating system provided in the third embodiment of the present invention. Figure 3 As shown, the device includes: a data acquisition module 310, a detection unit determination module 320 and an abnormality detection module 330.

[0080] Among them, the data acquisition module 310 is used to obtain the amount of network behavior data and the device access duration generated by the terminal device accessing the power Internet of Things operating system; the detection unit determination module 320 is used to determine the target abnormality detection unit based on the amount of network behavior data and the device access duration, wherein the target abnormality detection unit includes a first abnormality detection unit and a second abnormality detection unit, and the amount of network behavior data detected by the second abnormality detection unit is higher than that of the first abnormality detection unit; the abnormality detection module 330 is used to perform abnormality detection on the network behavior based on a pre-built abnormal network behavior database through the target abnormality detection unit to obtain an abnormality detection result.

[0081] Optionally, the detection unit determination module is used to:

[0082] When the access duration of the device is less than a preset access duration threshold, the first abnormality detection unit is determined as a target abnormality detection unit.

[0083] Optionally, the device further comprises:

[0084] A first duration determination module is used to determine a first detection duration of the first abnormality detection unit when a single abnormality detection is performed by the first abnormality detection unit after the first abnormality detection unit is determined as a target abnormality detection unit;

[0085] A detection index determination module, used to determine a first target detection index based on the amount of network behavior data, the first detection duration and a preset first weight;

[0086] A detection unit switching module is used to switch the target abnormality detection unit to the second abnormality detection unit when the first target detection index is not less than a first abnormality detection threshold.

[0087] Optionally, the detection index determination module is specifically used to:

[0088] The first target detection index is determined based on the network behavior data volume, the first detection duration, and a preset first weight by the following formula:

[0089] Abb = B*X*t;

[0090] Among them, Abb represents the first target detection indicator, B represents the amount of network behavior data, X represents the preset first weight, and t represents the first detection duration.

[0091] Optionally, the device further comprises:

[0092] A first initial indicator determination module is used to determine a first initial detection indicator corresponding to each abnormality detection respectively when multiple abnormality detections are performed by the first abnormality detection unit after the first abnormality detection unit is determined as a target abnormality detection unit;

[0093] The first target indicator determination module is used to average the multiple first initial indicators to obtain the first target detection indicator.

[0094] Optionally, the anomaly detection module includes:

[0095] A first anomaly detection unit, configured to, when the target anomaly detection unit is the first anomaly detection unit, perform anomaly detection on the network behavior based on a first detection time interval and a pre-constructed abnormal network behavior database;

[0096] A second anomaly detection unit, configured to, when the target anomaly detection unit is the second anomaly detection unit, perform anomaly detection on the network behavior based on a second detection time interval and a pre-constructed abnormal network behavior database;

[0097] The second detection time interval is smaller than the first detection time interval.

[0098] Optionally, the device further comprises:

[0099] The database establishment module is used to collect historical abnormal network behavior data during the historical operation of the power Internet of Things operating system before obtaining the network behavior data volume and device access duration generated by the terminal device accessing the power Internet of Things operating system, and establish an abnormal network behavior database based on the historical abnormal network behavior data.

[0100] The abnormality detection device for the power Internet of Things operating system provided in the embodiment of the present invention can execute the abnormality detection method for the power Internet of Things operating system provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0101] Embodiment 4

[0102] Figure 4 A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0103] like Figure 4 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0104] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0105] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The processor 11 executes the various methods and processes described above, such as the method for abnormal detection of the power Internet of Things operating system.

[0106] In some embodiments, the method for abnormality detection of the power Internet of Things operating system may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the method for abnormality detection of the power Internet of Things operating system described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to perform the method for abnormality detection of the power Internet of Things operating system in any other appropriate manner (e.g., by means of firmware).

[0107] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0108] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0109] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0110] To provide interaction with a service acquirer, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the service acquirer; and a keyboard and a pointing device (e.g., a mouse or a trackball), through which the service acquirer can provide input to the electronic device. Other types of devices may also be used to provide interaction with a service acquirer; for example, the feedback provided to the service acquirer may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the service acquirer may be received in any form (including acoustic input, voice input, or tactile input).

[0111] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a service acquirer computer having a graphical service acquirer interface or a web browser through which the service acquirer can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0112] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0113] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0114] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for detecting anomalies in an electric power IoT operating system, characterized in that: include: Obtain the amount of network behavior data and device access duration generated by terminal devices accessing the power IoT operating system; Determine a target anomaly detection unit based on the amount of network behavior data and the device access duration, wherein the target anomaly detection unit includes a first anomaly detection unit and a second anomaly detection unit, and the amount of network behavior data detected by the second anomaly detection unit is higher than that of the first anomaly detection unit; The target anomaly detection unit performs anomaly detection on the network behavior based on the pre-built abnormal network behavior database to obtain anomaly detection results.

2. The method according to claim 1, characterized in that: The target anomaly detection unit is determined based on the data volume of the network behavior and the device access duration, including: When the access duration of the device is less than a preset access duration threshold, the first abnormality detection unit is determined as a target abnormality detection unit.

3. The method according to claim 2, characterized in that After determining the first abnormality detection unit as a target abnormality detection unit, the method further includes: In the case of performing a single abnormality detection by the first abnormality detection unit, determining a first detection duration of the first abnormality detection unit; Determine a first target detection indicator based on the amount of network behavior data, the first detection duration, and a preset first weight; When the first target detection index is not less than a first abnormality detection threshold, the target abnormality detection unit is switched to the second abnormality detection unit.

4. The method according to claim 3, characterized in that The first target detection index is determined based on the network behavior data volume, the first detection duration, and a preset first weight by the following formula: Abb = B*X*t; Among them, Abb represents the first target detection indicator, B represents the amount of network behavior data, X represents the preset first weight, and t represents the first detection duration.

5. The method according to claim 3, characterized in that: After determining the first abnormality detection unit as a target abnormality detection unit, the method further includes: In the case where the first abnormality detection unit performs multiple abnormality detections, respectively determining a first initial detection indicator corresponding to each abnormality detection; Averaging a plurality of the first initial indicators to obtain the first target detection indicator.

6. The method according to claim 1, characterized in that The performing anomaly detection on the network behavior based on the pre-built abnormal network behavior database by the target anomaly detection unit includes: In a case where the target anomaly detection unit is a first anomaly detection unit, performing anomaly detection on the network behavior based on a first detection time interval and a pre-constructed abnormal network behavior database; In a case where the target anomaly detection unit is a second anomaly detection unit, performing anomaly detection on the network behavior based on a second detection time interval and a pre-constructed abnormal network behavior database; The second detection time interval is smaller than the first detection time interval.

7. The method according to claim 1, characterized in that Before obtaining the network behavior data volume and device access duration generated by the terminal device accessing the power IoT operating system, it also includes: Collect historical abnormal network behavior data during the historical operation of the power Internet of Things operating system, and establish an abnormal network behavior database based on the historical abnormal network behavior data.

8. An abnormality detection device for an electric power Internet of Things operating system, characterized in that: include: A data acquisition module is used to obtain the network behavior data volume and device access duration generated by the terminal device accessing the power Internet of Things operating system; a detection unit determination module, configured to determine a target anomaly detection unit based on the amount of network behavior data and the device access duration, wherein the target anomaly detection unit includes a first anomaly detection unit and a second anomaly detection unit, and the amount of network behavior data detected by the second anomaly detection unit is higher than that of the first anomaly detection unit; The anomaly detection module is used to perform anomaly detection on the network behavior based on a pre-built abnormal network behavior database through the target anomaly detection unit to obtain an anomaly detection result.

9. An electronic device, characterized in that: include: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the anomaly detection method of the power Internet of Things operating system described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the abnormality detection method of the power Internet of Things operating system according to any one of claims 1 to 7 when executed.

Images