Multi-dimensional automatic detection method and system for terminal equipment access of power internet of things

Abstract

The invention discloses a multi-dimensional automatic detection method and system for terminal equipment access of an electric power internet of things. The method comprises the steps that when it is detected that a device tries to access the power Internet of Things, a data packet sent by the device is captured in real time, the data packet comprises an initial access request and subsequent communication data, and key features of the data packet are extracted after analysis; carrying out feature preprocessing on the extracted key features; according to the preprocessed features, combining hardware parameters, power system configuration, software version and network configuration of the equipment to form a feature vector of a fixed dimension; and the generated feature vectors are input into a multi-dimensional detection module for detection, and final detection results are summarized into a comprehensive evaluation report of power Internet of Things access, including various detection scores, discovered potential problems and optimization suggestions. Uniform feature vectors are established, the root of the problem is quickly positioned through a multi-dimensional detection linkage mechanism, and the detection comprehensiveness and accuracy are improved.

Description

Technical Field

[0001] The present invention relates to the field of electric power Internet of Things, and in particular to a multi-dimensional automated detection method for access of electric power Internet of Things terminal equipment. Background Art

[0002] With the widespread application of IoT devices, the diversity of devices and the complexity of access environments make access detection particularly important. In the power grid environment, the access and security of IoT devices are particularly important because the power grid system needs to rely on a large number of IoT terminal devices such as sensors, actuators, and smart meters for real-time data collection and control. These devices are usually located in widely distributed areas and are affected by different network conditions and security threats. At present, IoT device detection methods mainly rely on manual rule setting and static detection methods. The detection process is inefficient and has limited coverage, making it difficult to adapt to dynamic changes in device configuration and environment. In addition, the existing data completion methods are not accurate, resulting in incomplete test cases that further affect the reliability of the detection results.

[0003] Especially in the access detection of power Internet of Things terminal devices, terminal devices need to deal with compatibility issues of various communication protocols and network environments (such as 4G, 5G, Wi-Fi, etc.), and at the same time meet industry standards for high security and high reliability. However, the current detection schemes are difficult to provide efficient and automated test case generation methods, and cannot comprehensively evaluate the performance and security of equipment under multi-dimensional conditions. Therefore, a new detection method is urgently needed to improve the comprehensiveness, accuracy and efficiency of access detection of power Internet of Things devices. Summary of the invention

[0004] Purpose of the invention: In order to solve the problems of low efficiency, insufficient coverage and incomplete feature analysis in the prior art of IoT terminal device access detection, the present invention proposes a multi-dimensional automated detection method and system for the access of power IoT terminal devices, which combines innovative feature vector construction and multi-dimensional detection technology to achieve fast, comprehensive and reliable detection and evaluation of device access, thereby improving the security, compatibility and performance stability of the IoT system.

[0005] Technical solution: In the first aspect, a multi-dimensional automated detection method for access to power Internet of Things terminal devices includes the following steps:

[0006] When a device is detected trying to access the power Internet of Things, the data packets sent by the device are captured in real time, including the initial access request and subsequent communication data. After parsing the captured data packets, the communication characteristics and status characteristics of the device are extracted, and combined with the hardware parameters, software version, power system configuration and network configuration of the device to form a basic feature set;

[0007] Perform feature preprocessing on the basic feature set, including: normalizing numerical features to a specified range; using one-hot encoding to convert discrete features into numerical representations; and using a generative adversarial network to complete missing features if some data packet features are missing;

[0008] Based on the preprocessed features, these features are combined to form a feature vector of fixed dimension: x = [protocol type, port number, encryption method, packet length, request header field, identity authentication information, battery power, device temperature, voltage level, power capacity, CPU model, memory size, operating system version, network configuration], and a reverse mapping mechanism is established to enable the features to retain their semantic information while being vectorized;

[0009] The generated feature vector is input into a multi-dimensional detection module for detection, and the multi-dimensional detection module includes: a security assessment module, which is used to detect possible security risks during the access and operation of the device. The module identifies abnormal behaviors, potential attacks and security risks by analyzing the generated feature vectors; a protocol compliance detection module, which verifies whether the communication of the device complies with the standard specifications of the protocol used by extracting the protocol type, field format and communication content in the features; a technical compatibility detection module, which evaluates the coordination of the device with the existing hardware, software and network environment by analyzing the feature vector of the device; and an access performance detection module, which evaluates the access efficiency and stability of the device by analyzing the network performance indicators in the data packet; and a detection system is formed between the modules through feature sharing and linkage mechanisms; and finally, the detection results of each module are summarized into a comprehensive evaluation report, which includes the scores of each detection, the potential problems found and the optimization suggestions.

[0010] Furthermore, we use generative adversarial networks to complete missing features, including:

[0011] The generative adversarial network model consists of a generator and a discriminator, where the generator is used to generate completed features and the discriminator is used to evaluate the authenticity of the generated features. During the training process, historical complete data is randomly simulated as incomplete features as the input of the generator, and the complete features are used as reference data for the discriminator. Through adversarial training of the generator and the discriminator, the generator gradually optimizes its ability to generate features, and finally generates features close to the real distribution.

[0012] The features marked as missing during the parsing process are input into the trained generator to generate the completed feature vector; the generated feature vector will be input into the discriminator together with the complete feature to determine whether the completed feature conforms to the true distribution. If the credibility score output by the discriminator exceeds the set threshold, the completed feature is considered valid; otherwise, the generator parameters are readjusted or other completion strategies are selected.

[0013] Furthermore, the security assessment module identifies abnormal behaviors, potential attacks, and security risks by analyzing the generated feature vectors, including:

[0014] Based on rule matching, the encryption method, port number, device temperature, voltage level, and power capacity in the feature vector x are quickly screened to identify whether the device uses an insecure communication protocol, whether the port is accessed illegally, whether the temperature exceeds a given safety threshold, and whether the voltage level and power capacity exceed the rated parameters of the power system;

[0015] The feature vector x is classified by using a support vector machine to identify normal or abnormal states. For abnormal states, the abnormal feature with the largest contribution in the feature vector is determined according to the decision function of the support vector machine.

[0016] Use deep learning models to learn the time variation patterns of feature vectors x, identify persistent threats including DoS attacks, data tampering, and identity theft, and determine the number of time series anomaly types;

[0017] The security score is determined based on the number of rule-matching anomalies, the number of classified anomaly features, and the number of time series anomaly types, and a security assessment report is generated based on the security score and threat analysis.

[0018] Furthermore, the deep learning model is used to learn the time variation pattern of the feature vector x and identify persistent threats including DoS attacks, data tampering, and identity theft, including:

[0019] Using the long short-term memory network LSTM, DoS attacks are identified based on the protocol type, port number, and packet length in the feature vector x; data tampering attacks are identified based on the encryption method, packet length, and request header field in the feature vector x; and identity fraud risks are identified based on the authentication information, protocol type, and network configuration in the feature vector x.

[0020] Furthermore, the protocol compliance detection module extracts the protocol type, field format, and communication content in the features to verify whether the device's communication complies with the standard specifications of the protocol used, including:

[0021] Use [protocol type, port number, request header field] in the feature vector x to extract the original field value through the reverse mapping mechanism and perform protocol field parsing; check whether the integrity and format of the protocol field meet the standard specifications, detect whether the actual value of the protocol specified field is set correctly, and verify whether the port mapping of the protocol communication meets the standard requirements based on the port number; check whether the protocol field contains encryption-related tags, simulate communication behavior, verify whether encryption is used in transmission, and verify whether the device behavior is consistent with the protocol standard;

[0022] The protocol consistency score is determined based on the number of field integrity missing items, the number of field format errors, and the number of behavioral deviations, and a compliance report is output based on the consistency score and non-conformance items.

[0023] Furthermore, the technical compatibility detection module analyzes the device's feature vectors and evaluates the compatibility of the device with existing hardware, software, and network environments, including:

[0024] Use [CPU model, memory size, operating system version, network configuration, voltage level, power capacity] in the feature vector x to restore the original information of the device parameters through the reverse mapping mechanism, and then perform environmental adaptation analysis to verify whether the device hardware supports the target system based on the CPU model, verify whether the device supports the target middleware or software environment based on the operating system version, verify whether the device is compatible with the target system hardware environment based on the voltage level and power capacity, and simulate environmental stress to detect device performance, including detecting whether the memory size and network configuration match the environment;

[0025] Output a compatibility report, including the supported hardware and software environment ranges and the parts that need to be optimized.

[0026] Furthermore, the access performance detection module analyzes the network performance indicators in the data packet and evaluates the access efficiency and stability of the device, including:

[0027] Use network packet analysis software to capture the traffic of the target device, calculate the average time from the initial request to the successful connection of the device, and evaluate the access speed of the device;

[0028] Determine a success flag according to the characteristics of the connection protocol, count the number of successful access attempts in multiple access attempts, and calculate the access success rate according to the number of successful connections and the total number of connection attempts;

[0029] Simulate network interference, capture recovery traffic, analyze recovery time, calculate recovery success rate and average recovery time, and evaluate connection stability.

[0030] In the second aspect, a multi-dimensional automatic detection system for access to power Internet of Things terminal devices includes:

[0031] The basic feature set building module is used to capture the data packets sent by the device in real time when it is detected that a device attempts to access the power Internet of Things, including the initial access request and subsequent communication data. After parsing the captured data packets, the communication characteristics and status characteristics of the device are extracted, and the basic feature set is formed by combining the hardware parameters, software version, power system configuration and network configuration of the device;

[0032] The feature preprocessing module is used to perform feature preprocessing on the basic feature set, including: normalizing the numerical features to a specified range; using one-hot encoding to convert discrete features into numerical representations; and using a generative adversarial network to complete the missing features if some data packet features are missing;

[0033] The feature vector construction module is used to combine the preprocessed features to form a feature vector of fixed dimension: x = [protocol type, port number, encryption method, packet length, request header field, identity authentication information, battery power, device temperature, voltage level, power capacity, CPU model, memory size, operating system version, network configuration], and establish a reverse mapping mechanism to enable the features to retain their semantic information while vectorizing them;

[0034] The multi-dimensional automatic detection module is used to automatically detect the security, compliance, compatibility and access performance of the device based on the generated feature vectors, including: a security assessment module, which is used to detect possible security risks during the access and operation of the device. This module identifies abnormal behaviors, potential attacks and security risks by analyzing the generated feature vectors; a protocol compliance detection module, which verifies whether the communication of the device complies with the standard specifications of the protocol used by extracting the protocol type, field format and communication content in the features; a technical compatibility detection module, which evaluates the coordination of the device with the existing hardware, software and network environment by analyzing the feature vectors of the device; and an access performance detection module, which evaluates the access efficiency and stability of the device by analyzing the network performance indicators in the data packet; and a detection system is formed between the modules through feature sharing and linkage mechanisms; and finally, the detection results of each module are summarized into a comprehensive evaluation report, including the scores of each detection, potential problems found and optimization suggestions.

[0035] In a third aspect, the present invention also provides a computer device, comprising: one or more processors; a memory; and one or more programs, wherein the one or more programs are stored in the memory and are configured to be executed by the one or more processors, and when the programs are executed by the processors, the steps of the multi-dimensional automated detection method for access to an Internet of Things terminal device as described above are implemented.

[0036] In a fourth aspect, the present invention further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the multi-dimensional automated detection method for access of IoT terminal devices as described above.

[0037] Beneficial effects: The present invention combines data packet features (such as protocol type, port number, encryption method, etc.), device hardware characteristics (such as CPU model, memory size, operating system version, etc.) and state features (such as battery power, device temperature) and power system configuration (such as voltage level, power capacity, etc.) to construct a unified fixed-dimensional feature vector, supporting multi-dimensional detection requirements such as security assessment, protocol compliance detection, technical compatibility detection and access performance detection, with a wider coverage and more comprehensive detection results. Generative adversarial network (GAN) is used to intelligently complete missing features, effectively improving data integrity and feature vector quality, thereby improving detection accuracy. Feature expression is optimized through preprocessing techniques such as standardization and unique hot encoding, reducing manual intervention, enhancing system operation efficiency and versatility of feature vectors. The present invention can dynamically adapt to the access requirements of various protocols and hardware environments, and exhibits higher robustness when data is incomplete or the scene is complex. The modular design of feature extraction, preprocessing, completion and multi-dimensional detection facilitates system integration and has good practicality and economy. Compared with traditional methods, the present invention significantly improves detection efficiency and accuracy, and provides an efficient, comprehensive and intelligent solution for IoT device access detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 It is a flow chart of a multi-dimensional automated detection method for IoT terminal device access;

[0039] Figure 2 It is the architecture of the Generative Adversarial Network;

[0040] Figure 3 It is a functional module diagram of multi-dimensional detection. DETAILED DESCRIPTION

[0041] In order to make the purpose, technical solutions and advantages of the present invention more clear, the present invention is further described in detail below through specific embodiments in conjunction with the accompanying drawings.

[0042] The present invention proposes a multi-dimensional automated detection method for the access of power Internet of Things terminal devices, which is used to perform multi-dimensional security and compatibility assessments during the access process of power Internet of Things terminal devices. The method extracts device communication characteristics and status characteristics by extracting and processing data packets, and combines them with device hardware, software and network characteristics to form a fixed-dimensional feature vector, and realizes efficient detection of Internet of Things device access based on a unified feature vector combined with multi-dimensional detection technology. The core technologies of the present invention include: data packet capture and parsing, feature preprocessing, intelligent completion of missing features, and the design and implementation of a multi-dimensional detection module (security assessment, protocol compliance detection, technical compatibility detection, access performance detection). Figure 1This is a general method flow chart of the IoT device access detection method proposed by the present invention, and the specific steps include:

[0043] S101: Packet capture and parsing.

[0044] The terminal devices that are specifically connected to the power system include smart meters, monitoring sensors, helmet sensors, camera devices, smart switches, etc. The access detection method needs to help the system face the characteristics and requirements of different devices. When the device is connected to the power Internet of Things, the data packets it sends are captured in real time, including the initial access request and subsequent communication data. By parsing the data packet, its key features are extracted, including communication features such as protocol type, port number, encryption method, data packet length, request header field, communication content and identity authentication information, as well as device status features such as device battery power and device temperature. Combined with the device hardware characteristics (such as CPU model, memory size), software characteristics (such as operating system version), power system configuration (such as voltage level, power capacity) and network configuration characteristics, a basic feature set with fixed dimensions is constructed.

[0045] S102: Feature preprocessing.

[0046] The communication features and other device features in the basic feature set are standardized and encoded. Continuous features such as port number and packet length are normalized to the range of [0,1]. Discrete features such as protocol type and encryption method are converted to numerical representation through one-hot encoding. The encoding example is described in the feature vector section below.

[0047] S103: Missing feature completion.

[0048] The extracted features are checked for completeness, missing parts are identified, and the features are divided into complete and missing parts. Complete features are directly used for subsequent analysis, while missing features enter the feature completion stage.

[0049] In the case of incomplete feature data, the present invention uses a generative adversarial network (GAN) to intelligently complete the feature vector to ensure the integrity and accuracy of the feature vector. First, a GAN model is constructed based on the historical complete data set of the power system Internet of Things. Figure 2As shown in the figure. The GAN model consists of a generator and a discriminator. The task of the generator is to generate a complete feature vector after completion based on the input incomplete feature vector, while the discriminator is used to evaluate the authenticity of the generated features and determine whether the completed features conform to the real data distribution. During the training process, the historical complete data is divided into two parts: one part is used as the input of the generator, in which the missing features are artificially simulated, and the other part is used as the reference of the discriminator to compare the difference between the generated features and the real features. The last two dotted arrows in the figure represent the feedback mechanism between the generator and the discriminator. Specifically, when the discriminator judges that the generated features are "true", the feedback signal will encourage the generator to generate data closer to the real features; when the discriminator judges that the generated features are "false", the feedback signal prompts the generator to adjust the generation strategy, thereby reducing the difference between the generated features and the real features. Through the adversarial training of the generator and the discriminator, the generator gradually optimizes its own capabilities and can generate data that is closer to the real features and complete, while the ability of the discriminator is also continuously improved during training to ensure the high quality of the generated features.

[0050] In the feature completion phase, the features marked as missing during the parsing process are input into the trained generator to generate a complete feature vector containing the completed features. The generated feature vector will be input into the discriminator together with the complete features to determine whether the completed features conform to the true distribution and whether they have sufficient credibility. If the credibility score output by the discriminator exceeds the set threshold, the completed features are considered valid, and the evaluated feature vector is directly used as the input for subsequent detection; otherwise, the generator parameters are readjusted or other completion strategies are selected for optimization.

[0051] Preferably, the completed feature vector is verified for consistency, including:

[0052] Statistical analysis: evaluate whether the distribution of completed features is consistent with the historical feature distribution, such as bias and variance analysis.

[0053] Rule matching: Verify that the completion features meet device-specific rules and constraints.

[0054] Manual review: For high-risk application scenarios, the completed features are manually reviewed in combination with domain expert knowledge.

[0055] Finally, the complete feature vector will be used as the input of multi-dimensional detection, which will comprehensively improve the coverage and analysis accuracy of the detection system. This method not only solves the problem of missing features, but also significantly enhances the intelligence and automation level of access detection of power Internet of Things devices.

[0056] The present invention effectively predicts and completes missing features through the GAN model, provides high-quality feature vectors for subsequent detection, and enhances the comprehensiveness and accuracy of the detection system.

[0057] S104: Feature vector construction.

[0058] The unified feature vector specifically constructed in the present invention includes the following features:

[0059] x = [protocol type, port number, encryption method, data packet length, request header field, authentication information, battery power, device temperature, voltage level, power capacity, CPU model, memory size, operating system version, network configuration].

[0060] Protocol type (discrete): describes the communication protocol used by the terminal device (such as MQTT, HTTP, CoAP, etc.), which is crucial to understanding the device's communication method and network compatibility. For the protocol type, use numeric encoding, such as: HTTP = 1, MQTT = 2, CoAP = 3. It can be further expressed as protocol type = [1, 0, 0] (HTTP is used as an example).

[0061] Port number (continuous): indicates the TCP or UDP port number used by the terminal device for communication, helping to identify specific services and applications, as well as possible network service vulnerabilities. Normalize the port number (such as scaling to [0,1]), for example: port number = actual port number / maximum port number 65535.

[0062] Encryption method (category): describes the encryption standard used during device communication (such as SSL / TLS version, symmetric / asymmetric encryption algorithm), which is a key feature for evaluating the security of device communication. Use digital encoding (AES=1, no encryption=0).

[0063] Packet length (continuous): Indicates the size of a single packet, which helps analyze network traffic patterns and detect abnormal communication behaviors such as denial of service attacks (DoS). Normalized to a specific range, packet length = actual length / maximum length.

[0064] Request header field (discrete): Contains HTTP request header information, such as user agent, content type, etc. This information helps identify the device type and request intent. Extract common fields (such as Host, Content-Type, User-Agent) from the request header field and one-hot encode them. For example, request header field = [1,0,1] (indicates whether the field exists).

[0065] Authentication information (discrete): includes data used for device authentication (such as certificates, tokens, passwords), which is critical to ensure that only authorized devices can access the network. Extract the authentication method (such as Basic, OAuth) and one-hot encode it. For example, authentication information = [0,1] (indicates the use of OAuth).

[0066] Battery level (continuous): Indicates the remaining battery level of the terminal device, which is an important indicator for judging the endurance and health of the device. The battery level is directly taken as the percentage of the remaining battery level of the device, ranging from 0 to 100. For example, if the battery level is 32%, the characteristic value is 0.32.

[0067] Device temperature (continuous): Provides information about the internal temperature of the device. Overheating may indicate device failure or improper use, affecting device reliability and life. Device temperature is usually expressed in degrees Celsius (℃). Depending on the environment or device operating conditions, the device temperature may vary. For example, if the device temperature is 30℃, the characteristic value is 30.

[0068] Voltage level (category): indicates the working voltage of the equipment. For power system equipment, the correct configuration of the voltage level is crucial to equipment safety and system stability. Encoding is performed according to the working voltage level of the power equipment, for example: 110V = [1,0,0], 220V = [0,1,0], 380V = [0,0,1]. It can also be encoded according to the voltage type of the power equipment.

[0069] Power capacity (continuous): describes the maximum power that a device can handle, which is critical for load management and fault prevention of power systems. Power capacity directly represents the power demand or capacity of the device (unit: watt W or kilowatt KW). Set a reasonable maximum power capacity and normalize the power capacity. The normalized power capacity = actual power capacity / maximum power capacity setting value. Set the maximum power capacity to 5KW. For example, the power capacity of the device is 500W, which is 0.1 after normalization.

[0070] CPU model (category): specifies the model of the device's processor, which affects the device's processing power and performance. Encode the CPU model according to the category. For example, if the device supports Intel i5 and i7, then CPU model = [1,0] (Intel i5 as an example).

[0071] Memory size (continuous): indicates the memory capacity of the device, which is directly related to the device's ability to handle complex tasks and data buffering capabilities. Directly use the device memory size in GB.

[0072] OS version (category): Provides detailed information about the device’s OS, which is important for security patch management and system compatibility analysis. Extract the version information and encode it. For example, for Windows 10 and Linux, OS version = [0, 1] (Linux is used as an example).

[0073] Network configuration (category): includes information such as IP address, subnet mask, gateway, etc., which helps determine the network location and configuration status of the device. Extract network-related features, such as supported protocols (IPv4 / IPv6), and encode them. For example, network configuration = [1,0] (for IPv4).

[0074] By combining features, a unified feature vector can be formed, for example:

[0075] x=[1,0,0,0.0012,1,0.32,1,0,0,0,1,0.32,30,0,1,0,0.1,1,0,8,0,1,1,0]

[0076] This example shows that the features are HTTP, port 80, AES encryption, 512-byte packet length (the maximum length of the data packet is set to 1600 bytes), Host field existence, OAuth authentication, battery power 32%, device temperature 30°C, voltage level 220V, power capacity 500W, Intel i5 processor, 8GB memory, Linux system, and IPv4 protocol.

[0077] The unified feature vector forms a multi-dimensional and highly interpretable data representation by integrating device communication and status information, which enables rapid identification of device identity and evaluation of operating conditions in power IoT terminal access detection, while ensuring the flexibility and accuracy of the detection process. The structured design of the feature vector makes it suitable for real-time monitoring and preprocessing, greatly improving the management efficiency and safety protection level of the power system for terminal devices.

[0078] In order to solve the problem that the feature vector may lose the field-level parsing capability after vectorization, the present invention proposes to build a reverse mapping mechanism to retain the semantic information of the feature while vectorizing it, and support the requirements of protocol field parsing, device parameter backtracking, etc. The design and implementation of the reverse mapping mechanism is based on the following mapping rules:

[0079] During the vectorization process, a mapping relationship between fields and coded values ​​is established for each feature:

[0080] Continuous features (such as port numbers): store the original value and normalization formula.

[0081] Discrete features (such as protocol type, encryption method): store the correspondence between the encoded value and the original category.

[0082] Complex features (such as request header fields): store both the existence of the field and the specific value of the field.

[0083] The mapping relationship is saved in a dictionary or other data structure for mapping storage.

[0084] For example: mapping = {

[0085] "Protocol type":{1:"HTTP",2:"MQTT",3:"CoAP"},

[0086] "Port Number":{"Original Value":80,"Normalized Value":0.00122},

[0087] "Request header fields": {

[0088] "Host":{"exists":1,"value":"example.com"},

[0089] "Content-Type":{"exists":1,"value":"application / json"}

[0090] }

[0091] }

[0092] When field-level operations are required, the vector is reverse parsed and restored to the original data through a mapping table to support further parsing or detection.

[0093] S105: Multi-dimensional detection.

[0094] The constructed complete feature vector or the completed complete feature vector is input into the multi-dimensional detection module, refer to Figure 3 , the multi-dimensional detection module includes a security assessment module, a protocol compliance detection module, a technical compatibility detection module and an access performance detection module. The security assessment module detects security threats faced by power grid system equipment, including security issues such as DDoS attacks, data tampering and identity fraud, as well as the equipment's own current overload risk, high temperature and other security risks; the protocol compliance detection module verifies the standardization of the communication protocol; the technical compatibility detection module evaluates the compatibility of the equipment with the target environment; the access performance detection module tests the access speed, success rate and stability of the equipment. Each module is linked through feature sharing and result feedback mechanism. Abnormalities in security assessment can be fed back to the protocol compliance detection module for further verification, and protocol deviation problems can indicate security risks and be fed back to the security assessment module; performance bottlenecks in technical compatibility detection can be passed to the access performance detection module for verification; delay anomalies in access performance detection can also be fed back to the security assessment module to analyze potential threats. The multi-dimensional detection linkage mechanism quickly locates the root cause of the problem and improves the comprehensiveness and accuracy of detection. The specific implementation method is as follows:

[0095] (I) Security assessment module: detects whether there are security risks during the access and operation of the device, and identifies abnormal behaviors, potential attacks and security risks by analyzing the generated feature vectors.

[0096] First, the feature vector x is quickly screened through rule matching to identify simple security risks, including unencrypted transmission detection and illegal port access detection. In unencrypted transmission detection, the encryption method field in the feature vector is checked to determine whether an unsafe communication protocol (such as HTTP) is used. In illegal port access detection, the port number field is analyzed and matched against a predefined list of illegal ports (such as 22, 23, and other common attack target ports). Rule matching can also be used to screen whether the status characteristics of the device and the power system configuration pose security risks. For example, if the product of the power capacity and voltage level of the device exceeds the maximum current carrying capacity of the circuit design, there may be a risk of current overload. The operating temperature of the device should be within the normal operating range. If the device temperature exceeds the safety threshold specified by the manufacturer, there may be a risk of device overheating. The specific matching rules depend on the actual use requirements. The screening results will mark the problematic features and provide preliminary information for subsequent processing.

[0097] Next, the support vector machine (SVM) model is used to classify the feature vector x and detect complex abnormal feature combinations. The SVM model is trained based on historical complete data samples, and the feature vector x is input into the classifier to output a "normal" or "abnormal" state. If the classification result is abnormal, the decision function of the SVM is analyzed to determine the abnormal feature with the largest contribution in the feature vector, and further describe the specific situation of the abnormal feature combination.

[0098] Subsequently, deep learning models (such as LSTM) are used to analyze the time series features to identify persistent threats and advanced abnormal patterns. Here, directly based on the time series of the original input feature vector x, the model detects persistent threats and advanced abnormal patterns of device behavior, including DoS attacks, data tampering, and identity fraud, by capturing the temporal changes of these features.

[0099] DoS attack: Identified by abnormally high packet frequency or communication delay.

[0100] Data tampering: Detects abnormal changes in data fields or encryption failures.

[0101] Identity fraud: Analyze whether the authentication information is consistent with the device's historical behavior.

[0102] (1) DoS attack detection

[0103] Input features: protocol type, port number, packet length.

[0104] Detection method:

[0105] Extract the switching frequency of protocol types and port numbers in the time series. If these features change frequently in a short period of time, such as port switching from 80 to 443 and then switching back to 80, it may be a manifestation of abnormal communication behavior.

[0106] Detects abnormal increases or decreases in packet length, such as receiving a large number of packets of maximum length (such as 1600 bytes) or very short length in a short period of time. This pattern is usually associated with DoS attacks.

[0107] Detection output: If the protocol switching frequency or packet length exceeds the set threshold, it is marked as a DoS attack. LSTM can automatically learn these abnormal patterns based on historical data.

[0108] (2) Data tampering detection

[0109] Input features: encryption method, packet length, request header fields.

[0110] Detection method:

[0111] Analyze the time series pattern of encryption methods. For example, if a device uses AES encryption for a long time but switches to no encryption for a period of time, this behavior may indicate that the security of data transmission is compromised.

[0112] Check whether there are any anomalies in the request header fields, such as the sudden disappearance or unexpected addition of certain common fields (such as Host and User-Agent), which is inconsistent with normal communication behavior.

[0113] Significant changes in the length of a data packet, such as a packet that is too short in the case of encryption, may indicate that the data content has been modified or truncated.

[0114] Detection output: Through anomaly detection of time series patterns, possible data tampering behaviors are marked. LSTM can effectively capture these subtle changes.

[0115] (3) Identity Fraud Detection

[0116] Input features: identity authentication information, protocol type, network configuration.

[0117] Detection method:

[0118] Compare identity authentication information with historical behavior patterns. For example, if a device normally uses OAuth authentication but suddenly switches to Basic authentication at some point in time, this mismatch may indicate identity theft.

[0119] An unusual combination of protocol type and network configuration, such as a device that has never used a certain protocol (such as CoAP) historically but suddenly frequently uses that protocol.

[0120] Combined with network configuration (such as IPv4 / IPv6 switching) and identity authentication information, the rationality of communication behavior is further analyzed.

[0121] Detection output: If the authentication mode or communication protocol is found to be inconsistent with historical behavior, it is marked as an identity theft risk.

[0122] Finally, based on the above test results, the safety score of the device is calculated and a safety assessment report is generated. The safety score is calculated by the formula: Safety score = 100-α 1 (Number of rule matching exceptions)-β 1 (Number of features for classification anomalies) - γ 1 (number of time series anomaly types) calculation, where α 1 ,β 1 ,γ 1 is the weight coefficient. Based on the score and threat analysis, a detailed security assessment report containing threat type, affected features and protection suggestions is generated to provide a basis for device security management.

[0123] (ii) Protocol compliance detection module: Verifies whether the device's communication complies with the specification requirements of the communication protocol.

[0124] Grid equipment must follow strict communication protocols and security standards to ensure the integrity and security of data transmission. This module can detect whether the device complies with the standard specifications of the grid communication protocol by extracting the device's protocol type, field format, and communication content, ensuring that the communication between the device and the grid system is secure and compliant. Specifically, by extracting the protocol type, field format, and communication content in the features, and comparing them with the behavioral model of the standard protocol, detect whether there are protocol deviations or implementation errors. At the same time, check the security configuration of the protocol, such as whether the recommended encrypted transmission method is used. The compliance report output by the module includes protocol consistency scores and non-conformities to ensure that the device meets the specification requirements at the communication protocol level.

[0125] The specific implementation method is as follows:

[0126] Use [protocol type, port number, request header fields] in the feature vector x.

[0127] Extract the original field values ​​(such as the specific content of Host and Content-Type) through the reverse mapping mechanism to parse the protocol fields, and check whether the integrity and format of the protocol fields comply with the standard specifications. For example, whether the HTTP request header contains the Host and Content-Type fields, and whether the field values ​​have the correct format (such as the Host value is a valid domain name or IP address, and the Content-Type value is a standard media type, such as application / json); whether the Token field of CoAP, the topic name and message structure of MQTT comply with the specifications. Check whether the actual values ​​of the protocol-specific fields are set correctly. For example, in the HTTP protocol, whether the User-Agent field clearly indicates the client type, and whether the Content-Length matches the actual transmission content; in the CoAP protocol, whether the Token field has a valid value to identify requests and responses.

[0128] Verify that the port mapping of protocol communication meets the standard requirements based on the port number: Check whether the port number is the port recommended by the protocol, for example, HTTP is usually on port 80 or 443, and MQTT is usually on port 1883 or 8883. Ensure that the device does not bind security protocols (such as HTTPS) to non-recommended ports, which may cause protocol deviation or communication vulnerabilities. This can also be counted as a field format consistency check.

[0129] Simulate protocol behavior and verify whether the device behavior is consistent with the protocol standard. For the HTTP protocol, simulate request-response, check whether the device correctly returns the required fields (such as Status-Code) and processes the request in the HTTP protocol order. For the MQTT protocol, simulate the publish-subscribe process, verify whether the message subject and content meet the protocol requirements, and check whether the device supports QoS configuration. For the CoAP protocol, simulate message interaction, check whether the use of the Token field meets the protocol standard, and ensure that the device can correctly handle ACK and retransmission behaviors.

[0130] Furthermore, perform encrypted transmission detection: Check whether the protocol field contains encryption-related tags, such as the TLS version of HTTPS, the DTLS configuration of CoAP, and the TLS connection configuration of MQTT. Simulate communication behavior to verify whether encryption is used in transmission. By testing whether the device communication accepts unencrypted connections or supports weak encryption protocols, the security of encrypted transmission can be determined. This is also a behavioral consistency test.

[0131] Generate a compliance report, including the protocol conformance score and a list of non-compliant items. Protocol conformance score = 100-α 2 (Number of missing items for field completeness)-β 2 (Number of field format errors) - γ2 (number of behavioral deviations), where α 2 ,β 2 ,γ 2 is the weight coefficient.

[0132] Furthermore, the protocol compliance detection module receives information from the security assessment module and further evaluates the rationality of the information from the perspective of protocol compliance:

[0133] Linkage information: The security assessment module transmits information about abnormal behavior (such as the detected protocol type and port number combination, communication encryption status, and abnormal conditions of request header fields).

[0134] Linkage judgment: The protocol compliance detection module verifies whether the device violates the protocol regulations based on this information, combined with the protocol type, port number and request header field in x. This is reflected in the compliance report. For example:

[0135] For encryption anomalies, check whether the recommended method (such as TLS1.2 or 1.3) is used for encrypted transmission.

[0136] For a combination of protocol type and port number, check whether it matches the standard mapping.

[0137] For exceptions in the request header field, further determine whether the field value complies with the protocol specification.

[0138] Through this linkage, the protocol compliance detection module can effectively supplement the analysis of the security assessment module and improve the accuracy and comprehensiveness of the overall assessment.

[0139] (III) Technical compatibility detection module: evaluates the compatibility of the equipment with the hardware, software and network environment of the existing power system.

[0140] By analyzing the device's feature vectors, it verifies its ability to operate in a specific environment and ensures that it can seamlessly connect with the target power system. At the same time, it simulates a variety of environmental conditions, including network load, signal interference, extreme temperature, high flow pressure, etc., to detect whether the device exhibits abnormal behavior or compatibility issues. This module outputs a compatibility report to clarify the scope of application of the device and the parts that need to be improved.

[0141] Specifically, [voltage level, power capacity, CPU model, memory size, operating system version, network configuration] in the feature vector x is used.

[0142] The original information of the device parameters is restored through the reverse mapping mechanism, and then the environmental adaptation analysis is performed. The adaptation analysis projects include: verifying whether the device operates stably within the specified voltage range; analyzing whether the power capacity of the device exceeds the power supply capacity of the power system; verifying whether the device hardware supports the target system (such as whether the CPU is compatible with the target hardware environment, whether the voltage level and power capacity match the hardware environment of the target system, including power supply, protection devices and other related hardware); and detecting whether the device operating system version supports the target middleware or software environment.

[0143] Simulate environmental stress (such as high load, high temperature, signal interference, high traffic pressure) and test device performance, including testing whether the voltage level and power capacity of the device will cause abnormal behavior or compatibility issues. Especially under extreme temperatures, test whether the device can maintain the stability of its power capacity and voltage level. In addition, memory size will be used to evaluate whether the device can handle the resource requirements in a specific operating environment, especially when multitasking and data processing. In different network environments, the device may need to support different communication protocols (such as IPv4, IPv6) or connection methods (such as Wi-Fi, Ethernet). Therefore, testing the network configuration of the device can help verify whether it can operate stably in the network environment of the target system. If the device needs to work in a network environment with high traffic, congestion or signal interference, the bandwidth, latency and transmission rate in the network configuration are important indicators for evaluating its compatibility. By testing the performance of the device under different network conditions, it can be ensured that the device can adapt to various network loads and communication requirements. The network configuration of the device also needs to be compatible with the security standards of the target system. For example, the device must support encrypted communication protocols (such as TLS / SSL) to ensure the security of data transmission.

[0144] Output a compatibility report, including the supported hardware / software environment range and the parts that need to be optimized.

[0145] (IV) Access performance detection module: tests the access speed, success rate and stability of the equipment.

[0146] Equipment in the power grid often needs to work in a high-concurrency, high-stability environment. Any delay or instability in the access of any device may affect the overall performance of the power grid. This module analyzes the network performance indicators of device access, evaluates the access efficiency and connection stability of the device, and helps power grid operation and maintenance personnel to promptly discover access performance problems and ensure stable operation of the equipment. Specifically, by analyzing the network performance indicators in the data packet (such as latency, packet loss rate, and data rate), the access success rate, response time, and maximum carrying capacity of the device under various network conditions are tested. The module also verifies the robustness of the device through boundary condition tests, such as extremely weak signals or high-load environments. Finally, a performance evaluation report is generated to help the device optimize the access process and improve the efficiency of network resource utilization. The specific implementation method is as follows:

[0147] The network packet analysis software Wireshark is used to measure performance indicators.

[0148] Select the target network interface in Wireshark and start capturing.

[0149] Use filtering rules (such as ip.addr == <device IP>) to ensure that only the traffic of the target device is captured.

[0150] To measure access speed, calculate the average time from the initial request to successful connection. First, mark the key data packets and record the timestamps of both, and find the initial connection request packet sent by the device (such as TCP SYN) and the connection confirmation packet returned by the server (such as TCP SYN-ACK).

[0151] Then, the time difference between multiple connections is counted to calculate the average access time, which reflects the access speed:

[0152]

[0153] Finally, the number of successful access attempts is counted.

[0154] During the device's multiple connection attempts, Wireshark is used to capture traffic to analyze the connection status, that is, to determine the success flag based on the characteristics of the connection protocol (such as TCP, MQTT).

[0155] TCP: Check whether the three-way handshake is completed.

[0156] MQTT: Verify that CONNACK message is returned.

[0157] Use filter rules to count the number of successful and failed packets.

[0158]

[0159] Stability testing simulates network outages or high-load conditions to test the device's ability to recover from a connection.

[0160] Perform simulated network interference and use a network simulation tool (such as tc or NetEm) to introduce interference by artificially increasing delay (such as tcqdisc add dev eth0 root netem delay 100ms) and simulating network packet loss (such as tc qdisc changedev eth0root netem loss 10%).

[0161] Recapture the recovery traffic. Capture the device's traffic during recovery in Wireshark and mark key packets (such as resent TCP SYN).

[0162] The next step is to analyze the recovery time, record the timestamps of the first reconnection request packet and connection confirmation packet after the network interruption, and calculate the recovery time.

[0163] Finally, evaluate the connection stability: count the recovery success rate and average recovery time, and generate a stability report.

[0164] Furthermore, the linkage mechanism between the access performance detection module and the technical compatibility detection module is reflected in the following: The information provided by the technical compatibility detection module, including the hardware specifications of the device (such as CPU model, memory size), operating system version and network configuration, plays a role in the preliminary evaluation of the access performance test. For example, the technical compatibility detection module evaluates whether the device supports a specific operating system or network protocol, and whether it is compatible with the voltage level and power capacity configuration of the power system. If the operating system or network configuration of the device is incompatible with the target environment (such as different supported protocol versions, incompatible voltage levels), the access performance detection may encounter failure or abnormal performance.

[0165] The access performance detection module adjusts the test environment parameters based on the output of the technical compatibility detection module. For example, if the technical compatibility detection module finds that the device's network configuration does not support the latest protocol or inefficient encryption methods, the access performance detection module may choose to perform more complex encryption protocol tests or use different protocol stacks for performance evaluation.

[0166] At the same time, the technical compatibility detection module can also provide the device's memory size and network configuration to help the access performance detection module determine whether the device can withstand specific load conditions in the target environment. If the device has small memory or poor network configuration, the access performance detection module may consider the device's possible performance bottleneck when simulating high load or network interference.

[0167] From the above description, it can be seen that there are characteristics of feature sharing and result linkage between multiple dimensions. Although each module of multi-dimensional detection operates independently for different detection targets, they form a closely connected detection system through feature sharing and result feedback linkage, thereby significantly improving the accuracy and efficiency of the overall detection. All modules are based on a unified feature vector x, which includes the device's communication characteristics (such as protocol type, port number, encryption method, etc.), hardware parameters (such as CPU model, memory size, etc.), status characteristics (such as battery power, device temperature, etc.), system configuration (such as voltage level, power capacity), software characteristics (such as operating system version) and network configuration information. This unified feature input not only ensures the consistency of information between modules, but also provides each module with sufficient information to support its own detection needs.

[0168] In terms of result feedback linkage, the connection between modules is reflected in multiple levels. For example, when the security assessment module finds unencrypted communication or illegal port access, it will feed back the detection results to the protocol compliance detection module to further verify whether the protocol specifications are violated. When the technical compatibility detection module detects that the device performs abnormally in a specific environment (such as signal interference, high load conditions), it will feed back the detection results to the access performance detection module to analyze whether these environmental adaptation issues affect the access success rate and stability of the device.

[0169] For another example, both security assessment and protocol compliance testing require the use of features such as protocol type, port number, encryption method, etc. Abnormalities in security assessment can be fed back to the protocol compliance testing module for further verification, and the results of protocol compliance testing (such as finding that protocol fields are incomplete or incorrect) may indicate security risks (such as tampering or unauthorized access).

[0170] In addition, technical compatibility detection and access performance detection also share features and link results. Technical compatibility detection analyzes the hardware and software environment of the device, while access speed and stability in access performance detection may be affected by hardware configuration. For example, in the technical compatibility detection module, hardware features such as the device's CPU model and memory size will affect the performance of the device when it accesses the network. These hardware features will be used by the access performance detection module as a reference for network performance testing. For example, if the device has a small memory or poor CPU performance, the access performance detection module may evaluate whether the device can maintain a stable connection under extreme conditions (such as high load or network interference) and whether it is prone to performance degradation or access failure. Therefore, the performance bottleneck in the technical compatibility detection can be passed to the access performance detection module for verification; in addition, the delay anomaly of the access performance detection can also be fed back to the security assessment module to analyze potential threats.

[0171] This multi-dimensional detection linkage mechanism can not only achieve cross-validation of the detection results of each module, but also quickly identify complex problems that cannot be discovered by isolated detection, providing a clear direction for equipment optimization and improvement.

[0172] S106: Test result output: Generates a comprehensive assessment report that includes security assessment, protocol compliance testing, technical compatibility testing, and access performance testing. The report includes scores for each test, potential problems found, and optimization suggestions, providing comprehensive guidance for device access testing.

[0173] The multi-dimensional detection linkage mechanism quickly locates the root cause of the problem and improves the comprehensiveness and accuracy of the detection. Through the above steps, the present invention realizes efficient, comprehensive and intelligent support for the access detection of IoT devices, and has a wide range of applications and reliable detection results, which provides a strong guarantee for the security and stability of the IoT system and provides strong support for the optimization of the IoT system.

[0174] Based on the same technical concept as the method embodiment, the embodiment of the present invention also provides a multi-dimensional automatic detection system for access to IoT terminal devices, which mainly includes:

[0175] The basic feature set building module is used to capture the data packets sent by the device in real time when it is detected that a device attempts to access the power Internet of Things, including the initial access request and subsequent communication data. After parsing the captured data packets, the communication characteristics and status characteristics of the device are extracted, and the basic feature set is formed by combining the hardware parameters, software version, power system configuration and network configuration of the device;

[0176] The feature preprocessing module is used to perform feature preprocessing on the basic feature set, including: normalizing the numerical features to a specified range; using one-hot encoding to convert discrete features into numerical representations; and using a generative adversarial network to complete the missing features if some data packet features are missing;

[0177] The feature vector construction module is used to combine the preprocessed features to form a feature vector of fixed dimension: x = [protocol type, port number, encryption method, packet length, request header field, identity authentication information, battery power, device temperature, voltage level, power capacity, CPU model, memory size, operating system version, network configuration], and establish a reverse mapping mechanism to enable the features to retain their semantic information while vectorizing them;

[0178] The multi-dimensional automatic detection module is used to automatically detect the security, compliance, compatibility and access performance of the device based on the generated feature vectors, including: a security assessment module, which is used to detect possible security risks during the access and operation of the device. This module identifies abnormal behaviors, potential attacks and security risks by analyzing the generated feature vectors; a protocol compliance detection module, which verifies whether the communication of the device complies with the standard specifications of the protocol used by extracting the protocol type, field format and communication content in the features; a technical compatibility detection module, which evaluates the coordination of the device with the existing hardware, software and network environment by analyzing the feature vectors of the device; and an access performance detection module, which evaluates the access efficiency and stability of the device by analyzing the network performance indicators in the data packet; and a detection system is formed between the modules through feature sharing and linkage mechanisms; and finally, the detection results of each module are summarized into a comprehensive evaluation report, including the scores of each detection, potential problems found and optimization suggestions.

[0179] It should be understood that the multi-dimensional automated detection system for access to IoT terminal devices in the embodiments of the present invention can implement all the technical solutions in the above method embodiments, and the functions of its various functional modules can be specifically implemented according to the methods in the above method embodiments. The specific implementation process can refer to the relevant description in the above embodiments, which will not be repeated here.

[0180] The present invention also provides a computer device, comprising: one or more processors; a memory; and one or more programs, wherein the one or more programs are stored in the memory and are configured to be executed by the one or more processors, and when the programs are executed by the processors, the steps of the multi-dimensional automated detection method for access to an Internet of Things terminal device as described above are implemented.

[0181] The present invention also provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of the multi-dimensional automated detection method for access of an Internet of Things terminal device as described above are implemented.

[0182] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, devices (systems), computer equipment or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0183] The present invention is described with reference to a flowchart of a method according to an embodiment of the present invention. It should be understood that each process in the flowchart and a combination of processes in the flowchart can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the process in the flowchart. Figure 1 A device that specifies functions in a process or multiple processes.

[0184] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A function specified in a process or multiple processes.

[0185] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 The steps of a specified function in a process or multiple processes.

Claims

1. A multi-dimensional automated detection method for access to power Internet of Things terminal devices, characterized in that: The following steps are involved: When a device is detected trying to access the power Internet of Things, the data packets sent by the device are captured in real time, including the initial access request and subsequent communication data. After parsing the captured data packets, the communication characteristics and status characteristics of the device are extracted, and combined with the hardware parameters, software version, power system configuration and network configuration of the device to form a basic feature set; Perform feature preprocessing on the basic feature set, including: normalizing numerical features to a specified range; using one-hot encoding to convert discrete features into numerical representations; and using a generative adversarial network to complete missing features if some data packet features are missing; Based on the preprocessed features, these features are combined to form a feature vector of fixed dimension: x = [protocol type, port number, encryption method, packet length, request header field, identity authentication information, battery power, device temperature, voltage level, power capacity, CPU model, memory size, operating system version, network configuration], and a reverse mapping mechanism is established to enable the features to retain their semantic information while being vectorized; The generated feature vector is input into a multi-dimensional detection module for detection, and the multi-dimensional detection module includes: a security assessment module, which is used to detect possible security risks during the access and operation of the device. The module identifies abnormal behaviors, potential attacks and security risks by analyzing the generated feature vectors; a protocol compliance detection module, which verifies whether the communication of the device complies with the standard specifications of the protocol used by extracting the protocol type, field format and communication content in the features; a technical compatibility detection module, which evaluates the coordination of the device with the existing hardware, software and network environment by analyzing the feature vector of the device; and an access performance detection module, which evaluates the access efficiency and stability of the device by analyzing the network performance indicators in the data packet; and a detection system is formed between the modules through feature sharing and linkage mechanisms; and finally, the detection results of each module are summarized into a comprehensive evaluation report, which includes the scores of each detection, the potential problems found and the optimization suggestions.

2. The method according to claim 1, characterized in that Use generative adversarial networks to complete missing features, including: The generative adversarial network model consists of a generator and a discriminator, where the generator is used to generate completed features and the discriminator is used to evaluate the authenticity of the generated features. During the training process, historical complete data is randomly simulated as incomplete features as the input of the generator, and the complete features are used as reference data for the discriminator. Through adversarial training of the generator and the discriminator, the generator gradually optimizes its ability to generate features, and finally generates features close to the real distribution. The features marked as missing during the parsing process are input into the trained generator to generate the completed feature vector; the generated feature vector will be input into the discriminator together with the complete feature to determine whether the completed feature conforms to the true distribution. If the credibility score output by the discriminator exceeds the set threshold, the completed feature is considered valid; otherwise, the generator parameters are readjusted or other completion strategies are selected.

3. The method according to claim 1, characterized in that The security assessment module analyzes the generated feature vectors to identify abnormal behaviors, potential attacks, and security risks, including: Based on rule matching, the encryption method, port number, device temperature, voltage level, and power capacity in the feature vector x are quickly screened to identify whether the device uses an insecure communication protocol, whether the port is accessed illegally, whether the temperature exceeds a given safety threshold, and whether the voltage level and power capacity exceed the rated parameters of the power system; The feature vector x is classified by using a support vector machine to identify normal or abnormal states. For abnormal states, the abnormal feature with the largest contribution in the feature vector is determined according to the decision function of the support vector machine. Use deep learning models to learn the time variation patterns of feature vectors x, identify persistent threats including DoS attacks, data tampering, and identity theft, and determine the number of time series anomaly types; The security score is determined based on the number of rule-matching anomalies, the number of classified anomaly features, and the number of time series anomaly types, and a security assessment report is generated based on the security score and threat analysis.

4. The method according to claim 3, characterized in that The deep learning model is used to learn the time variation pattern of the feature vector x and identify persistent threats including DoS attacks, data tampering, and identity theft, including: Using the long short-term memory network LSTM, DoS attacks are identified based on the protocol type, port number, and packet length in the feature vector x; data tampering attacks are identified based on the encryption method, packet length, and request header field in the feature vector x; and identity fraud risks are identified based on the authentication information, protocol type, and network configuration in the feature vector x.

5. The method according to claim 1, characterized in that The protocol compliance detection module extracts the protocol type, field format, and communication content in the signature to verify whether the device's communication complies with the standard specifications of the protocol used, including: Use [protocol type, port number, request header field] in the feature vector x to extract the original field value through the reverse mapping mechanism and perform protocol field parsing; check whether the integrity and format of the protocol field meet the standard specifications, detect whether the actual value of the protocol specified field is set correctly, and verify whether the port mapping of the protocol communication meets the standard requirements based on the port number; check whether the protocol field contains encryption-related tags, simulate communication behavior, verify whether encryption is used in transmission, and verify whether the device behavior is consistent with the protocol standard; The protocol consistency score is determined based on the number of field integrity missing items, the number of field format errors, and the number of behavioral deviations, and a compliance report is output based on the consistency score and non-conformance items.

6. The method according to claim 1, characterized in that The technology compatibility detection module analyzes the device's feature vectors and evaluates the compatibility of the device with existing hardware, software, and network environments, including: Use [CPU model, memory size, operating system version, network configuration, voltage level, power capacity] in the feature vector x to restore the original information of the device parameters through the reverse mapping mechanism, and then perform environmental adaptation analysis to verify whether the device hardware supports the target system based on the CPU model, verify whether the device supports the target middleware or software environment based on the operating system version, verify whether the device is compatible with the target system hardware environment based on the voltage level and power capacity, and simulate environmental stress to detect device performance, including detecting whether the memory size and network configuration match the environment; Output a compatibility report, including the supported hardware and software environment ranges and the parts that need to be optimized.

7. The method according to claim 1, characterized in that The access performance detection module analyzes the network performance indicators in the data packet and evaluates the access efficiency and stability of the device, including: Use network packet analysis software to capture the traffic of the target device, calculate the average time from the initial request to the successful connection of the device, and evaluate the access speed of the device; Determine a success flag according to the characteristics of the connection protocol, count the number of successful access attempts in multiple access attempts, and calculate the access success rate according to the number of successful connections and the total number of connection attempts; Simulate network interference, capture recovery traffic, analyze recovery time, calculate recovery success rate and average recovery time, and evaluate connection stability.

8. A multi-dimensional automatic detection system for access to power Internet of Things terminal equipment, characterized in that: include: The basic feature set building module is used to capture the data packets sent by the device in real time when it is detected that a device attempts to access the power Internet of Things, including the initial access request and subsequent communication data. After parsing the captured data packets, the communication characteristics and status characteristics of the device are extracted, and the basic feature set is formed by combining the hardware parameters, software version, power system configuration and network configuration of the device; The feature preprocessing module is used to perform feature preprocessing on the basic feature set, including: normalizing the numerical features to a specified range; using one-hot encoding to convert discrete features into numerical representations; and using a generative adversarial network to complete the missing features if some data packet features are missing; The feature vector construction module is used to combine the preprocessed features to form a feature vector of fixed dimension: x = [protocol type, port number, encryption method, packet length, request header field, identity authentication information, battery power, device temperature, voltage level, power capacity, CPU model, memory size, operating system version, network configuration], and establish a reverse mapping mechanism to enable the features to retain their semantic information while vectorizing them; The multi-dimensional automatic detection module is used to automatically detect the security, compliance, compatibility and access performance of the device based on the generated feature vectors, including: a security assessment module, which is used to detect possible security risks during the access and operation of the device. This module identifies abnormal behaviors, potential attacks and security risks by analyzing the generated feature vectors; a protocol compliance detection module, which verifies whether the communication of the device complies with the standard specifications of the protocol used by extracting the protocol type, field format and communication content in the features; a technical compatibility detection module, which evaluates the coordination of the device with the existing hardware, software and network environment by analyzing the feature vectors of the device; and an access performance detection module, which evaluates the access efficiency and stability of the device by analyzing the network performance indicators in the data packet; and a detection system is formed between the modules through feature sharing and linkage mechanisms; and finally, the detection results of each module are summarized into a comprehensive evaluation report, including the scores of each detection, potential problems found and optimization suggestions.

9. A computer device, characterized in that: include: one or more processors; Memory; And one or more programs, wherein the one or more programs are stored in the memory and are configured to be executed by the one or more processors, and when the programs are executed by the processors, the steps of the multi-dimensional automated detection method for access to power Internet of Things terminal devices as described in any one of claims 1-7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by the processor, the steps of the multi-dimensional automated detection method for access of power Internet of Things terminal devices as described in any one of claims 1 to 7 are implemented.

Images