Multi-dimensional automation detection method and system for power internet of things terminal device access

Abstract

The application discloses a kind of multi-dimension automated detection methods and systems for power internet of things terminal equipment access.The method includes: when detecting that there is equipment trying to access power internet of things, real-time capture the data packet sent by equipment, including initial access request and subsequent communication data, extract its key features after analysis;The extracted key features are preprocessed;According to the preprocessed features, combined with the hardware parameters of the equipment, power system configuration, software version and network configuration, a fixed dimension feature vector is formed;The generated feature vector is input into the multi-dimension detection module for detection, and the final detection result is summarized into a comprehensive evaluation report of power internet of things access, including various detection scores, potential problems found and optimization suggestions.The application establishes a unified feature vector and quickly locates the root cause of the problem through multi-dimension detection linkage mechanism, improves the comprehensiveness and accuracy of detection.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of power Internet of Things, and in particular to a multi-dimensional automatic detection for power Internet of Things terminal device access. BACKGROUND

[0002] With the wide application of Internet of Things devices, the diversification of devices and the complexity of access environment make access detection particularly important. In the power grid environment, the access and security of Internet of Things devices are particularly important, because the power grid system needs to rely on a large number of sensors, actuators, smart meters and other Internet of Things terminal devices for real-time data collection and control. These devices are usually located in widely distributed areas and are affected by different network conditions and security threats. Currently, the detection method of Internet of Things devices mainly relies on manual rule setting and static detection means, and the detection process is low in efficiency and limited in coverage, making it difficult to adapt to the dynamic changes of device configuration and environment. In addition, the existing data completion method has low accuracy, which further affects the reliability of the detection result due to the incompleteness of the test case.

[0003] Especially in the detection of power Internet of Things terminal device access, the terminal device needs to cope with the compatibility problems of multiple communication protocols and network environments (such as 4G, 5G, Wi-Fi, etc.), and at the same time needs to meet the industry standards of high security and high reliability. However, the current detection scheme cannot provide an efficient and automated test case generation method, and cannot comprehensively evaluate the performance and security of the device under multi-dimensional conditions. Therefore, a new detection method is needed to improve the comprehensiveness, accuracy and efficiency of the detection of power Internet of Things device access. SUMMARY

[0004] The purpose of the present application is to solve the problems of low detection efficiency, insufficient coverage and incomplete feature analysis of Internet of Things terminal device access in the prior art. The present application proposes a multi-dimensional automatic detection method and system for power Internet of Things terminal device access, which combines innovative feature vector construction and multi-dimensional detection technology to realize fast, comprehensive and reliable detection and evaluation of the device access process, and improves the security, compatibility and performance stability of the Internet of Things system.

[0005] Technical solution: In a first aspect, a multi-dimensional automatic detection method for power Internet of Things terminal device access includes the following steps:

[0006] When it is detected that a device attempts to access the power Internet of Things, the data packets sent by the device are captured in real time, including the initial access request and the subsequent communication data. After analyzing the captured data packets, the device communication features and state features are extracted, combined with the device's hardware parameters, software version, power system configuration and network configuration, to form a basic feature set;

[0007] The feature preprocessing is performed on the basic feature set, including: normalizing the numerical features to a specified range; for discrete features, using one-hot encoding to convert to numerical representation; and if some data packet features are missing, using a generative adversarial network to complete the missing features;

[0008] According to the preprocessed features, the features are combined to form a fixed-dimensional feature vector: x = [protocol type, port number, encryption method, packet length, request header field, identity authentication information, battery power, device temperature, voltage level, power capacity, CPU model, memory size, operating system version, network configuration], and a reverse mapping mechanism is established, so that the features retain semantic information while being vectorized;

[0009] The generated feature vector is input into a multi-dimensional detection module for detection, which includes: a security evaluation module for detecting potential security risks of the device during access and operation, which identifies abnormal behavior, potential attacks and security risks by analyzing the generated feature vector; a protocol compliance detection module that verifies whether the device communication complies with the standard specifications of the used protocol by extracting the protocol type, field format and communication content from the features; a technical compatibility detection module that evaluates the coordination of the device with existing hardware, software and network environment by analyzing the feature vector of the device; and an access performance detection module that evaluates the access efficiency and stability of the device by analyzing the network performance indicators in the data packet; and the modules form a detection system through feature sharing and linkage mechanism; the detection results of each module are finally summarized into a comprehensive evaluation report, including detection scores, potential problems found and optimization suggestions.

[0010] Further, the missing features are completed using a generative adversarial network, including:

[0011] The generative adversarial network model consists of a generator and a discriminator, where the generator is used to generate completed features, and the discriminator is used to evaluate the authenticity of the generated features. In the training process, the historical complete data is randomly simulated as incomplete features as input to the generator, and the complete features are used as reference data for the discriminator; through the adversarial training of the generator and the discriminator, the generator gradually optimizes the ability to generate features, and finally generates features close to the real distribution;

[0012] The features marked as missing in the analysis process are input into the trained generator to generate the completed feature vector; the generated feature vector is input into the discriminator together with the complete feature to determine whether the completed feature conforms to the real distribution. If the credibility score output by the discriminator exceeds the set threshold, the completed feature is considered valid; otherwise, the generator parameters are adjusted or other completion strategies are selected.

[0013] Further, the security evaluation module identifies abnormal behavior, potential attacks and security risks by analyzing the generated feature vector, including:

[0014] Based on rule matching, the encryption method, port number, device temperature, voltage level, power capacity in the feature vector x are quickly screened to identify whether the device uses an unsafe communication protocol, whether it is illegal port access, whether the temperature exceeds the given safety threshold, and whether the voltage level and power capacity exceed the rated parameters of the power system;

[0015] The feature vector x is classified using a support vector machine to identify normal or abnormal states. For abnormal states, the most contributing abnormal features in the feature vector are determined according to the decision function of the support vector machine.

[0016] The time variation of the feature vector x is learned using a deep learning model to identify persistent threats including DoS attacks, data tampering, and identity impersonation, and to determine the number of time series anomaly types.

[0017] The security score is determined according to the number of rule matching exceptions, the number of classified abnormal features, and the number of time series anomaly types, and a security evaluation report is generated based on the security score and threat analysis.

[0018] Further, the time variation of the feature vector x is learned using a deep learning model to identify persistent threats including DoS attacks, data tampering, and identity impersonation, including:

[0019] Using a long short-term memory network (LSTM), the protocol type, port number, and data packet length in the feature vector x are used to identify DoS attacks; the encryption method, data packet length, and request header field in the feature vector x are used to identify data tampering attacks; and the identity authentication information, protocol type, and network configuration in the feature vector x are used to identify identity impersonation risks.

[0020] Further, the protocol compliance detection module extracts the protocol type, field format and communication content in the feature to verify whether the device communication complies with the standard specification of the used protocol, including:

[0021] Using [protocol type, port number, request header field] in the feature vector x, the original field values are extracted through a reverse mapping mechanism for protocol field parsing; the integrity and format of the protocol field are checked to see if they comply with the standard specification, the actual value of the protocol specified field is checked to see if it is set correctly, and the port mapping of the protocol communication is verified according to the port number to see if it meets the standard requirements; it is checked whether the protocol field contains encryption-related markers, the communication behavior is simulated to verify whether encryption is used in transmission and whether the device behavior is consistent with the protocol standard;

[0022] According to the number of missing field integrity items, the number of field format error items, and the number of behavior deviation items, determine the protocol consistency score, and output the compliance report according to the consistency score and the non-compliance items.

[0023] Further, the technical compatibility detection module analyzes the feature vector of the device, evaluates the coordination of the device with the existing hardware, software and network environment, including:

[0024] Using [CPU model, memory size, operating system version, network configuration, voltage level, power capacity] in the feature vector x, the original information of the device parameters is restored through the reverse mapping mechanism, and then environment adaptation analysis is performed, according to the CPU model to verify whether the device hardware supports the target system, according to the operating system version to verify whether the device supports the target middleware or software environment, according to the voltage level and power capacity to verify whether the device is compatible with the target system hardware environment, and simulate environment stress to detect device performance, including detecting whether the memory size and network configuration match the environment;

[0025] Output compatibility report, including supported hardware, software environment range and parts to be optimized.

[0026] Further, the access performance detection module analyzes the network performance indicators in the data packet, evaluates the access efficiency and stability of the device, including:

[0027] Using network packet analysis software to capture the traffic of the target device, calculating the average time from initial request to successful connection, evaluating the access speed of the device;

[0028] Determine the success flag according to the characteristics of the connection protocol, count the number of successful attempts in multiple access attempts, and calculate the access success rate according to the number of successful connections and the total number of connection attempts;

[0029] Simulate network interference, capture recovery traffic, analyze recovery time, count recovery success rate and average recovery time, and evaluate connection stability.

[0030] Secondly, a multi-dimensional automatic detection system for power Internet of Things terminal device access, comprising:

[0031] The basic feature set construction module is used to capture the data packets sent by the device in real time when it is detected that the device tries to access the power Internet of Things, including initial access request and subsequent communication data, after analyzing the captured data packets, extracting device communication features and state features, combining hardware parameters, software versions, power system configurations and network configurations of the device, and forming a basic feature set;

[0032] The feature preprocessing module is configured to perform feature preprocessing on the basic feature set, including: normalizing numerical features to a specified range; for discrete features, converting them into numerical representations using one-hot encoding; and if some data packet features are missing, using a generative adversarial network to complete the missing features.

[0033] The feature vector construction module is configured to combine the preprocessed features to form a fixed-dimension feature vector: x = [protocol type, port number, encryption method, data packet length, request header field, identity authentication information, battery power, device temperature, voltage level, power capacity, CPU model, memory size, operating system version, network configuration], and establish a reverse mapping mechanism so that the features retain semantic information while being vectorized.

[0034] The multi-dimensional automatic detection module is configured to automatically detect the security, compliance, compatibility, and access performance of the device based on the generated feature vector, including: a security evaluation module configured to detect potential security risks of the device during access and operation, which analyzes the generated feature vector to identify abnormal behavior, potential attacks, and security risks; a protocol compliance detection module configured to verify whether the communication of the device complies with the standard specifications of the used protocol by extracting the protocol type, field format, and communication content from the features; a technical compatibility detection module configured to evaluate the coordination of the device with existing hardware, software, and network environment by analyzing the feature vector of the device; and an access performance detection module configured to evaluate the access efficiency and stability of the device by analyzing network performance indicators in the data packet; and the modules form a detection system through feature sharing and linkage mechanism; finally, the detection results of the modules are summarized into a comprehensive evaluation report containing detection scores, potential problems found, and optimization suggestions.

[0035] In a third aspect, the present application also provides a computer device, comprising: one or more processors; a memory; and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, and the programs, when executed by the processors, implement the steps of the multi-dimensional automatic detection method for Internet of Things terminal device access as described above.

[0036] In a fourth aspect, the present application also provides a computer-readable storage medium having a computer program stored thereon, and the computer program, when executed by a processor, implements the steps of the multi-dimensional automatic detection method for Internet of Things terminal device access as described above.

[0037] Beneficial effects: The application constructs a unified fixed-dimension feature vector by combining data packet features (such as protocol type, port number, encryption method, etc.), device hardware characteristics (such as CPU model, memory size, operating system version, etc.), and state features (such as battery power, device temperature), as well as power system configuration (such as voltage level, power capacity, etc.), supporting multi-dimensional detection needs such as security evaluation, protocol compliance detection, technical compatibility detection, and access performance detection, with a wider coverage and more comprehensive detection results. The use of generative adversarial networks (GAN) for intelligent completion of missing features effectively improves data integrity and feature vector quality, thereby improving detection accuracy. Through standardization, one-hot encoding, and other preprocessing techniques to optimize feature expression, manual intervention is reduced, system operation efficiency is enhanced, and the universality of the feature vector is enhanced. The application can dynamically adapt to the access needs of multiple protocols and hardware environments, and exhibits higher robustness in the case of incomplete data or complex scenarios. The modular design of feature extraction, preprocessing, completion, and multi-dimensional detection facilitates system integration, and has good practicality and economy. Compared with traditional methods, the application significantly improves detection efficiency and accuracy, providing an efficient, comprehensive, and intelligent solution for Internet of Things device access detection. BRIEF DESCRIPTION OF DRAWINGS

[0038] Figure 1 is a multi-dimensional automatic detection method flowchart for Internet of Things terminal device access;

[0039] Figure 2 is the architecture of a generative adversarial network;

[0040] Figure 3 is a functional module diagram of multi-dimensional detection. DETAILED DESCRIPTION

[0041] In order to make the purpose, technical solutions and advantages of the application more clear, the following will further detail the application through specific embodiments, and in conjunction with the drawings.

[0042] The application proposes a multi-dimensional automatic detection method for power Internet of Things terminal device access, which is used for multi-dimensional security and compatibility evaluation in the process of power Internet of Things terminal device access. The method extracts and processes data packets to extract device communication features and state features, combines with device hardware, software and network characteristics, forms a fixed-dimension feature vector, and realizes efficient detection of Internet of Things device access based on the unified feature vector combined with multi-dimensional detection technology. The core technologies of the application include: data packet capture and analysis, feature preprocessing, intelligent completion of missing features, and design and implementation of multi-dimensional detection modules (security evaluation, protocol compliance detection, technical compatibility detection, access performance detection). Figure 1It is the overall method flowchart of the Internet of Things device access detection method proposed by the application, and the specific steps include:

[0043] S101: data packet capture and analysis.

[0044] The terminal equipment accessing the power system includes smart meters, monitoring sensors, safety helmet sensors, camera equipment, intelligent switches, etc., and the access detection method needs to help the system face the characteristics and needs of different devices. When the device accesses the power Internet of Things, the data packets sent by it are captured in real time, including the initial access request and subsequent communication data. By analyzing the data packets, the key features are extracted, including protocol type, port number, encryption method, data packet length, request header field, communication content and identity authentication information, etc. Communication features and device state features such as device battery capacity and device temperature. Combined with device hardware characteristics (such as CPU model, memory size), software characteristics (such as operating system version), power system configuration (such as voltage level, power capacity) and network configuration characteristics, a fixed-dimension basic feature set is constructed.

[0045] S102: feature preprocessing.

[0046] The communication features and other features of the basic feature set are standardized and coded, and continuous features such as port number and data packet length are normalized to the range [0, 1]. Discrete features such as protocol type and encryption method are converted to numerical representation by one-hot encoding. The encoding examples are described in the feature vector section below.

[0047] S103: missing feature completion.

[0048] The extracted features are checked for completeness, missing parts are identified, and the features are divided into complete parts and missing parts. Complete features are directly used for subsequent analysis, while missing features are entered into the feature completion stage.

[0049] For the case of incomplete feature data, the application uses a generative adversarial network (GAN) for intelligent completion to ensure the integrity and accuracy of the feature vector. First, based on the historical complete data set of the power system Internet of Things, a GAN model is constructed, specifically as follows: Figure 2The GAN model is composed of a generator and a discriminator. The task of the generator is to generate a complete feature vector based on the incomplete feature vector input, while the task of the discriminator is to evaluate the authenticity of the generated feature and determine whether the completed feature conforms to the real data distribution. In the training process, the historical complete data is divided into two parts: one part is used as the input of the generator, in which the missing features are artificially simulated, and the other part is used as the reference of the discriminator to compare the differences between the generated features and the real features. The last two dashed arrows in the figure represent the feedback mechanism between the generator and the discriminator. Specifically, when the discriminator judges that the generated feature is "true", the feedback signal encourages the generator to generate data closer to the real feature; when the discriminator judges that the generated feature is "false", the feedback signal prompts the generator to adjust the generation strategy, thereby reducing the difference between the generated feature and the real feature. Through the adversarial training of the generator and the discriminator, the generator gradually optimizes its ability to generate more complete data closer to the real feature, while the ability of the discriminator is also continuously improved in the training to ensure the high quality of the generated features.

[0050] In the feature completion phase, the features marked as missing in the parsing process are input into the trained generator to generate a complete feature vector containing the completed features. The generated feature vector is input into the discriminator along with the complete features to determine whether the completed features conform to the real distribution and have sufficient credibility. If the credibility score output by the discriminator exceeds the set threshold, the completed features are considered valid, and the evaluated feature vector is directly used as the input for subsequent detection; otherwise, the generator parameters are adjusted or other completion strategies are selected for optimization.

[0051] Preferably, the completed feature vector is subjected to consistency verification, including:

[0052] Statistical analysis: evaluate whether the distribution of the completed features is consistent with the historical feature distribution, such as bias and variance analysis.

[0053] Rule matching: verify whether the completed features meet the device-specific rules and constraints.

[0054] Manual review: for high-risk application scenarios, manually review the completed features in combination with domain expert knowledge.

[0055] Finally, the complete feature vector will be used as the input for multi-dimensional detection, significantly improving the coverage and analysis accuracy of the detection system. This method not only solves the problem of missing features, but also significantly enhances the intelligence and automation level of power internet of things device access detection.

[0056] The present application effectively predicts and completes missing features through the GAN model, providing high-quality feature vectors for subsequent detection and enhancing the comprehensiveness and accuracy of the detection system.

[0057] S104: Feature vector construction.

[0058] The unified feature vector constructed in the present application includes the following features:

[0059] x = [protocol type, port number, encryption method, packet length, request header field, identity authentication information, battery capacity, device temperature, voltage level, power capacity, CPU model, memory size, operating system version, network configuration].

[0060] Protocol type (discrete): Describes the communication protocol used by the terminal device (such as MQTT, HTTP, CoAP, etc.), which is crucial for understanding the device's communication method and network compatibility. For protocol type, use numerical coding, such as: HTTP = 1, MQTT = 2, CoAP = 3. Further use one-hot encoding, represented as protocol type = [1, 0, 0] (HTTP as an example).

[0061] Port number (continuous): Indicates the TCP or UDP port number used by the terminal device for communication, helping to identify specific services and applications, and possible network service vulnerabilities. Normalize the port number (such as scaling to [0, 1]), for example: port number = actual port number / maximum port number 65535.

[0062] Encryption method (category): Describes the encryption standard used in the device's communication process (such as SSL / TLS version, symmetric / asymmetric encryption algorithm), which is a key feature for evaluating the security of device communication. Use numerical coding (AES = 1, no encryption = 0).

[0063] Packet length (continuous): Indicates the size of a single data packet, which helps analyze network traffic patterns and detect abnormal communication behavior, such as denial of service attacks (DoS). Normalize to a specific range, packet length = actual length / maximum length.

[0064] Request header field (discrete): Contains the header information of HTTP requests, such as user agent, content type, etc., which helps identify device types and request intentions. Extract common fields (such as Host, Content-Type, User-Agent) from the request header field and use one-hot encoding. For example, request header field = [1, 0, 1] (indicating the presence or absence of fields).

[0065] Identity authentication information (discrete): Includes data used for device identity verification (such as certificates, tokens, passwords), which is crucial for ensuring that only authorized devices can access the network. Extract identity authentication methods (such as Basic, OAuth), and use one-hot encoding. For example, identity authentication information = [0, 1] (indicating the use of OAuth).

[0066] Battery level (continuous): Indicates the remaining battery level of the terminal device, which is an important indicator for judging the device's endurance and health. The battery level directly takes the percentage of the device's remaining battery level, ranging from 0 to 100. For example, if the battery level is 32%, the feature value is 0.32.

[0067] Device temperature (continuous): Provides internal temperature information of the device, and overheating may indicate device failure or improper use, affecting device reliability and service life. Device temperature is usually expressed in degrees Celsius (℃), and device temperature may vary according to environmental or device working conditions. For example, if the device temperature is 30℃, the feature value is 30.

[0068] Voltage level (category): Indicates the working voltage of the device, and for power system devices, the correct configuration of voltage level is crucial for device safety and system stability. According to the working voltage level of power equipment, it is encoded, for example: 110V = [1, 0, 0], 220V = [0, 1, 0], 380V = [0, 0, 1], or according to the voltage type of power equipment.

[0069] Power capacity (continuous): Describes the maximum power that the device can handle, which is crucial for load management and fault prevention of power systems. Power capacity directly represents the power demand or capacity size of the device (unit: watt W or kilowatt KW). Set a reasonable maximum power capacity, and the normalized power capacity = actual power capacity / maximum power capacity set value, set the maximum power capacity to 5KW. For example, if the device power capacity is 500W, the normalized value is 0.1.

[0070] CPU model (category): Specifies the model of the device processor, which affects the processing capacity and performance of the device. Encode the CPU model according to the category. For example, assuming the device supports Intel i5 and i7, then CPU model = [1, 0] (Intel i5 as an example).

[0071] Memory size (continuous): Indicates the memory capacity of the device, which directly relates to the device's ability to handle complex tasks and data buffering capacity. Directly use the device's memory size, unit: GB.

[0072] Operating system version (category): Provides detailed information about the device's operating system, which is very important for security patch management and system compatibility analysis. Extract the version information and encode it. For example, Windows 10 and Linux, operating system version = [0, 1] (Linux as an example).

[0073] Network configuration (category): Includes IP address, subnet mask, gateway, etc. information, which helps determine the network location and configuration status of the device. Extract network-related features such as supported protocols (IPv4 / IPv6) and encode them. For example, network configuration = [1, 0] (IPv4 as an example).

[0074] Through feature combination, a unified feature vector can be formed, for example:

[0075] x = [1, 0, 0, 0.0012, 1, 0.32, 1, 0, 0, 0, 1, 0.32, 30, 0, 1, 0, 0.1, 1, 0, 8, 0, 1, 1, 0]

[0076] This example indicates that the features are HTTP, port 80, AES encryption, 512-byte packet length (the maximum packet length value is set to 1600 bytes), the Host field exists, OAuth authentication, battery power 32%, device temperature 30℃, voltage level 220V, power capacity 500W, Intel i5 processor, 8GB memory, Linux system, IPv4 protocol.

[0077] This unified feature vector integrates device communication and state information to form a multi-dimensional and highly interpretable data representation, enabling rapid identification of device identity and assessment of operating conditions in power Internet of Things terminal access detection, while ensuring the flexibility and accuracy of the detection process. The structured design of the feature vector makes it suitable for real-time monitoring and preprocessing, greatly improving the management efficiency and security protection level of the power system for terminal devices.

[0078] To solve the problem of possible loss of field-level analysis capability after feature vectorization, the present invention proposes to construct a reverse mapping mechanism to preserve the semantic information of the features while vectorizing, supporting protocol field parsing, device parameter backtracking, etc. The design and implementation of the reverse mapping mechanism is based on the following mapping rules:

[0079] In the vectorization process, a mapping relationship between the field and the encoded value is established for each feature:

[0080] Continuous features (such as port numbers): Store the original value and normalization formula.

[0081] Discrete features (such as protocol type, encryption method): Store the correspondence between the encoded value and the original category.

[0082] Complex features (such as request header fields): Store the field existence and field specific value.

[0083] Save the mapping relationship in a dictionary or other data structure for mapping storage.

[0084] For example: mapping = {

[0085] "protocol_type": {1: "HTTP", 2: "MQTT", 3: "CoAP"},

[0086] "port_number": {"original_value": 80, "normalized_value": 0.00122},

[0087] "request_header_field": {

[0088] "Host": {"exists": 1, "value": "example.com"},

[0089] "Content-Type": {"exists": 1, "value": "application / json"}

[0090] }

[0091] }

[0092] When field-level operations are required, the vector is reversed and restored to the original data through the mapping table, supporting further parsing or detection.

[0093] S105: Multi-dimensional detection.

[0094] The complete feature vector or the completed complete feature vector is input into the multi-dimensional detection module, referring to Figure 3 , The multi-dimensional detection module includes a security assessment module, a protocol compliance detection module, a technical compatibility detection module, and an access performance detection module. The security assessment module detects the security threats faced by the power grid system equipment, including DDoS attacks, data tampering, and identity impersonation, as well as the current overload risk of the device itself, temperature overload, and other security risks; The protocol compliance detection module verifies the normativity of the communication protocol; The technical compatibility detection module assesses the adaptability of the device to the target environment; The access performance detection module tests the access speed, success rate, and stability of the device. Each module is linked through feature sharing and result feedback mechanism. Abnormalities in security assessment can be fed back to the protocol compliance detection module for further verification, protocol deviation problems can prompt security risks and be fed back to the security assessment module; Performance bottlenecks in technical compatibility detection can be passed to the access performance detection module for verification; Delay abnormalities in access performance detection can also be fed back to the security assessment module to analyze potential threats. The multi-dimensional detection linkage mechanism quickly locates the problem source, improving the comprehensiveness and accuracy of detection. The specific implementation method is as follows:

[0095] (1) Security assessment module: detect whether there is a security risk in the process of device access and running, generate feature vectors through analysis, identify abnormal behavior, potential attacks and security risks.

[0096] First, a quick screening of the feature vector x is performed by rule matching to identify simple security risks, including unencrypted transmission detection and illegal port access detection. In unencrypted transmission detection, the encryption method field in the feature vector is checked to determine if an insecure communication protocol (such as HTTP) is being used. In illegal port access detection, the port number field is analyzed and matched against a predefined list of illegal ports (such as common attack target ports 22, 23, etc.). Rule matching can also screen the status characteristics of the device and the power system configuration for security risks, such as if the product of the device's power capacity and voltage level exceeds the maximum current carrying capacity of the circuit design, there may be a risk of current overload. The operating temperature of the device should be within the normal operating range. If the device temperature exceeds the manufacturer's specified safety threshold, there may be a risk of device overheating. The specific matching rules are determined by actual use requirements. The screening results will mark the features that have problems, providing preliminary information for subsequent processing.

[0097] Next, the feature vector x is classified using a support vector machine (SVM) model to detect complex abnormal feature combinations. The SVM model is trained based on historical complete data samples, and the feature vector x is input into the classifier, outputting "normal" or "abnormal" status. If the classification result is abnormal, the most contributing abnormal features in the feature vector are determined by analyzing the SVM decision function, further describing the specific situation of the abnormal feature combination.

[0098] Subsequently, a deep learning model (such as LSTM) is used to analyze time-sequenced features to identify persistent threats and advanced anomaly patterns. Here, based directly on the time series of the original input feature vector x, the model detects persistent threats and advanced anomaly patterns of device behavior, including DoS attacks, data tampering, and identity impersonation, by capturing the temporal variation of these features.

[0099] DoS attack: identified by abnormally high packet frequency or communication delay.

[0100] Data tampering: detects abnormal changes or encryption failures in data fields.

[0101] Identity impersonation: analyzes whether the authentication information is consistent with the device's historical behavior.

[0102] (1) DoS attack detection

[0103] Input features: protocol type, port number, packet length.

[0104] Detection method:

[0105] Extract the frequency of protocol type and port number switching in time series. If these features change frequently within a short time, such as switching from port 80 to 443 and then back to 80, it may be an abnormal communication behavior.

[0106] Detect abnormal increase or decrease in packet length, such as receiving a large number of maximum length (such as 1600 bytes) or extremely short length packets in a short time, which is usually associated with DoS attacks.

[0107] Detection output: If the protocol switching frequency or packet length exceeds the set threshold, mark it as a DoS attack. LSTM can automatically learn these abnormal patterns from historical data.

[0108] (2) Data tampering detection

[0109] Input features: encryption method, packet length, request header field.

[0110] Detection method:

[0111] Analyze the time series pattern of encryption method. For example, the device has been using AES encryption for a long time, but switches to no encryption for a certain period of time, which may indicate that the security of data transmission is threatened.

[0112] Check if the request header field is abnormal, such as the sudden disappearance or unexpected addition of some common fields (such as Host and User-Agent), which is inconsistent with normal communication behavior.

[0113] Significant changes in packet length, such as short packet length in the presence of encryption, which may indicate that the data content has been modified or truncated.

[0114] Detection output: Through abnormal detection of time series pattern, mark possible data tampering behavior. LSTM can effectively capture these subtle changes.

[0115] (3) Identity impersonation detection

[0116] Input features: identity authentication information, protocol type, network configuration.

[0117] Detection method:

[0118] Compare identity authentication information with historical behavior patterns. For example, the device usually uses OAuth authentication, but suddenly switches to Basic authentication for a certain period of time, which may indicate that the identity is impersonated.

[0119] Abnormal combination of protocol type and network configuration, such as a device that has never used a certain protocol (such as CoAP) suddenly appears frequently.

[0120] Combine network configuration (such as IPv4 / IPv6 switching) and identity authentication information to further analyze the rationality of communication behavior.

[0121] Detection output: If the identity authentication mode or communication protocol is found to be inconsistent with historical behavior, mark it as an identity impersonation risk.

[0122] Finally, according to the above detection results, the security score of the device is calculated and a security assessment report is generated. The security score is calculated by the formula: security score = 100 - α1 (number of rule matching exceptions) - β1 (number of classification abnormal features) - γ1 (number of time series abnormal types), where α1, β1, γ1 are weight coefficients. According to the score and threat analysis, a detailed security assessment report containing threat types, affected features and protection suggestions is generated, providing a basis for the security management of the device.

[0123] (II) Protocol compliance detection module: Verify whether the device's communication complies with the specification requirements of the communication protocol.

[0124] Power grid devices must follow strict communication protocols and security standards to ensure the integrity and security of data transmission. This module can detect whether the device complies with the standard specifications of the power grid communication protocol by extracting the device's protocol type, field format and communication content, ensuring that the device's communication with the power grid system is safe and compliant. Specifically, by extracting the protocol type, field format and communication content in the features, it is compared with the behavior model of the standard protocol to detect whether there are protocol deviations or implementation errors. At the same time, check the security configuration of the protocol, such as whether the recommended encrypted transmission method is used. The compliance report output by the module includes protocol consistency score and non-compliance items to ensure that the device meets the specification requirements at the communication protocol level.

[0125] The specific implementation method is as follows:

[0126] Use [protocol type, port number, request header field] in feature vector x.

[0127] Extract the original field values (such as Host, Content-Type specific content) through the reverse mapping mechanism to parse the protocol fields, check the integrity and format of the protocol fields, and whether they meet the standard specifications, for example, whether the HTTP request header contains the Host and Content-Type fields, and whether the field values have the correct format (such as the value of Host is a valid domain name or IP address, and the value of Content-Type is a standard media type such as application / json); whether the Token field of CoAP and the topic name and message structure of MQTT meet the specifications. Detect whether the actual value of the protocol-specific field is set correctly, for example, in the HTTP protocol, whether the User-Agent field explicitly indicates the client type, and whether the Content-Length matches the actual transmission content; in the CoAP protocol, whether the Token field has a valid value to identify requests and responses.

[0128] Verify whether the port mapping of the protocol communication conforms to the standard requirements according to the port number: detect whether the port number is the recommended port for the protocol, for example, HTTP usually uses port 80 or 443, and MQTT usually uses port 1883 or 8883. Ensure that the device does not bind a secure protocol (such as HTTPS) to a non-recommended port, which may cause the protocol to deviate or communication vulnerabilities. This can also be counted as a field format consistency detection.

[0129] Simulate protocol behavior and verify whether the device behavior conforms to the protocol standard. For the HTTP protocol, simulate request-response and check whether the device correctly returns the required fields (such as Status-Code) and processes the request in the order specified by the HTTP protocol. For the MQTT protocol, simulate the publish-subscribe process and verify whether the message topic and content meet the protocol requirements, and check whether the device supports QoS configuration. For the CoAP protocol, simulate message interaction and check whether the use of the Token field conforms to the protocol standard, ensuring that the device can correctly handle ACK and retransmission behavior.

[0130] Further, perform encryption transmission detection: check whether the protocol field contains encryption-related markers, such as the TLS version of HTTPS, the DTLS configuration of CoAP, and the TLS connection configuration of MQTT. Simulate communication behavior to verify whether encryption is used in transmission. By testing whether the device communication accepts unencrypted connections or supports weak encryption protocols, the security of encrypted transmission is judged, which is also a behavior consistency detection.

[0131] Generate a compliance report including protocol consistency score and non-compliance item list. Protocol consistency score = 100 - α2 (number of missing field integrity items) - β2 (number of field format error items) - γ2 (number of behavior deviation items), where α2, β2, γ2 are weight coefficients.

[0132] Further, the protocol compliance detection module receives information from the security assessment module and further assesses the rationality of these information from the perspective of protocol compliance:

[0133] Linkage information: The security assessment module transmits information about abnormal behavior (such as detected protocol type and port number combination, communication encryption state, abnormal situation of request header field).

[0134] Linkage judgment: The protocol compliance detection module verifies whether the device violates the protocol based on these information, combined with the protocol type, port number and request header field in x. And reflected in the compliance report. For example:

[0135] For encryption anomalies, detect whether encrypted transmission uses recommended methods (such as TLS1.2 or 1.3).

[0136] For the combination of protocol type and port number, check whether it meets the standard mapping.

[0137] For the abnormality of the request header field, further judge whether the field value meets the protocol specification.

[0138] Through this linkage, the protocol compliance detection module can effectively supplement the analysis of the security assessment module, and improve the accuracy and comprehensiveness of the overall evaluation.

[0139] (Three) Technical compatibility detection module: assess the adaptability of the device to the existing power system hardware, software and network environment.

[0140] By analyzing the feature vector of the device, verify its running ability in a specific environment, and ensure that it can be seamlessly connected with the target power system. At the same time, simulate a variety of environmental conditions, including network load, signal interference, extreme temperature, high flow pressure, etc., to detect whether the device shows abnormal behavior or compatibility problems. The module outputs a compatibility report, which clearly defines the scope of application of the device and the parts that need to be improved.

[0141] Specifically, use [voltage level, power capacity, CPU model, memory size, operating system version, network configuration] in feature vector x.

[0142] Restore the original information of the device parameters through the reverse mapping mechanism, and then perform environment adaptation analysis. Adaptation analysis items include: verify whether the device can run stably within the specified voltage range; analyze whether the power capacity of the device exceeds the power supply capacity of the power system; verify whether the device hardware supports the target system (such as whether the CPU is compatible with the target hardware environment, whether the voltage level and power capacity match the hardware environment of the target system, including power supply, protection device and other related hardware); detect whether the operating system version of the device supports the target middleware or software environment.

[0143] Simulate environmental stressors (e.g., high load, high temperature, signal interference, high flow pressure) and test device performance, including testing whether the device's voltage levels and power capacity will cause abnormal behavior or compatibility issues. In particular, test whether the device can maintain its power capacity and voltage levels under extreme temperatures. Additionally, memory size will be used to assess whether the device can handle resource demands in a particular operating environment, especially when multitasking and data processing. In different network environments, devices may need to support different communication protocols (e.g., IPv4, IPv6) or connection methods (e.g., Wi-Fi, Ethernet). Therefore, testing the device's network configuration can help verify whether it can operate stably in the target system's network environment. If the device needs to work in a network environment with high flow, congestion, or signal interference, bandwidth, latency, and transmission rate in the network configuration are important indicators for assessing its compatibility. By testing the device's performance under different network conditions, it can be ensured that the device can adapt to various network loads and communication demands. The device's network configuration also needs to be compatible with the target system's security standards. For example, the device must support encrypted communication protocols (e.g., TLS / SSL) to ensure the security of data transmission.

[0144] Output a compatibility report, including the range of supported hardware / software environments and parts that need optimization.

[0145] (IV) Access performance testing module: Test the device's access speed, success rate, and stability.

[0146] Devices in the power grid often need to work in a high-concurrency and high-stability environment, and any delay or instability in device access can affect the overall performance of the power grid. This module analyzes the network performance indicators of device access to evaluate the access efficiency and connection stability of the device, helping power grid operators to discover access performance problems in a timely manner and ensure stable operation of the device. Specifically, by analyzing network performance indicators (such as delay, packet loss rate, and data rate) in data packets, the module tests the device's access success rate, response time, and maximum carrying capacity under various network conditions. The module also tests the device's robustness through boundary condition tests, such as extremely weak signals or high load environments. Finally, a performance evaluation report is generated to help optimize the device's access process and improve network resource utilization efficiency. The specific implementation method is as follows:

[0147] Use the network packet analysis software Wireshark to measure performance indicators.

[0148] Select the target network interface in Wireshark and start capturing.

[0149] Use filtering rules (such as ip.addr==<device IP>) to ensure that only the target device's traffic is captured.

[0150] The access speed measurement is performed, and the average time from the initial request to the successful connection of the computing device is calculated. First, mark the key packets and record the timestamps of both, find the initial connection request packet (such as TCP SYN) sent by the device and the connection confirmation packet (such as TCP SYN-ACK) returned by the server.

[0151] Then, the time difference of multiple connections is counted, and the average access time is calculated, which represents the access speed:

[0152]

[0153] Finally, the number of successful attempts in multiple access attempts is counted.

[0154] During the process of multiple attempts of the device to connect, Wireshark is used to capture traffic to analyze the connection state, that is, to determine the success flag according to the characteristics of the connection protocol (such as TCP, MQTT).

[0155] TCP: Check if the three-way handshake is completed.

[0156] MQTT: Verify if the CONNACK message is returned.

[0157] Use filter rules to count the number of successful and failed packets.

[0158]

[0159] Stability detection simulates network interruption or high load conditions to detect the connection recovery capability of the device.

[0160] Simulate network interference, use network simulation tools (such as tc or NetEm) to introduce artificial delay (such as tc qdisc add dev eth0 root netem delay 100ms) and simulate network packet loss (such as tc qdisc change dev eth0 root netem loss 10%) interference.

[0161] Capture the recovery traffic, capture the traffic of the device during the recovery period in Wireshark, and mark the key packets (such as re-sent TCP SYN).

[0162] The next step is to analyze the recovery time, record the timestamps of the first reconnection request packet and the connection confirmation packet after network interruption, and calculate the recovery time.

[0163] Finally, evaluate the connection stability: count the recovery success rate and average recovery time, and generate a stability report.

[0164] Further, the access performance detection module and the technology compatibility detection module linkage mechanism is embodied in: the information provided by the technology compatibility detection module includes the hardware specifications of the device (such as CPU model, memory size), operating system version and network configuration, which plays a role in the pre-evaluation of access performance testing. For example, the technology compatibility detection module evaluates whether the device supports a specific operating system or network protocol, whether it is compatible with the voltage level and power capacity configuration of the power system. If the operating system or network configuration of the device is incompatible with the target environment (such as different supported protocol versions, incompatible voltage levels), the access performance detection may encounter failure or abnormal performance.

[0165] The access performance detection module adjusts the environmental parameters of the test according to the output of the technology compatibility detection module. For example, if the technology compatibility detection module finds that the network configuration of the device does not support the latest protocol or inefficient encryption method, the access performance detection module may choose to perform more complex encryption protocol testing or use a different protocol stack for performance evaluation.

[0166] At the same time, the technology compatibility detection module can also provide the memory size and network configuration of the device to help the access performance detection module determine whether the device can withstand specific load conditions in the target environment. If the device has a small memory or poor network configuration, the access performance detection module may consider the possible performance bottleneck of the device when simulating high load or network interference.

[0167] As can be seen from the above description, there is a feature sharing and result linkage between multiple dimensions. Although each module of multi-dimensional detection independently runs for different detection targets, they form a closely linked detection system through feature sharing and result feedback linkage, thereby significantly improving the accuracy and efficiency of the overall detection. All modules are based on a unified feature vector x, which includes the communication features of the device (such as protocol type, port number, encryption method), hardware parameters (such as CPU model, memory size), state features (such as battery level, device temperature), system configuration (such as voltage level, power capacity), software characteristics (such as operating system version) and network configuration. This unified feature input not only ensures the consistency of information between modules, but also provides each module with sufficient information to support its own detection needs.

[0168] In terms of result feedback linkage, the association between modules is reflected in multiple levels. For example, when the security evaluation module finds unencrypted communication or illegal port access, it will feed back the detection results to the protocol compliance detection module to further verify whether the protocol specification is violated. When the technology compatibility detection module detects that the device behaves abnormally in a specific environment (such as signal interference, high load conditions), it will feed back the detection results to the access performance detection module to analyze whether these environmental adaptation problems affect the device's access success rate and stability.

[0169] For another example, both security assessment and protocol compliance detection need to use features such as protocol type, port number, encryption method, etc. The anomaly of security assessment can be fed back to the protocol compliance detection module for further verification, and the result of protocol compliance detection (such as finding that the protocol field is incomplete or incorrect) may prompt security risks (such as tampering or unauthorized access).

[0170] In addition, technology compatibility detection and access performance detection are also feature sharing and result linkage. Technology compatibility detection analyzes the hardware and software environment of the device, while the access speed and stability in access performance detection may be affected by the hardware configuration. For example, in the technology compatibility detection module, the hardware features such as the CPU model and memory size of the device will affect the performance of the device when accessing the network. These hardware features will be used by the access performance detection module as a reference for network performance testing. For example, if the device has a small memory or poor CPU performance, the access performance detection module may evaluate whether the device can maintain a stable connection under extreme conditions (such as high load or network interference), whether it is prone to performance degradation or access failure, etc. Therefore, the performance bottleneck in technology compatibility detection can be passed to the access performance detection module for verification; in addition, the delay anomaly of access performance detection can also be fed back to the security assessment module for analysis of potential threats.

[0171] Through such a multi-dimensional detection linkage mechanism, not only can the cross-verification of the detection results of each module be realized, but also complex problems that cannot be discovered by isolated detection can be quickly identified, providing a clear direction for device optimization and improvement.

[0172] S106: Detection result output: generate a comprehensive evaluation report containing security assessment, protocol compliance detection, technology compatibility detection and access performance detection, etc. The report includes the detection scores, potential problems found and optimization suggestions, providing comprehensive guidance for device access detection.

[0173] The multi-dimensional detection linkage mechanism quickly locates the root cause of the problem and improves the comprehensiveness and accuracy of detection. Through the above steps, the present application realizes efficient, comprehensive and intelligent support for the access detection of Internet of Things devices, has a wide range of applications, and the detection result is reliable, which provides a strong guarantee for the security and stability of the Internet of Things system and provides strong support for the optimization of the Internet of Things system.

[0174] Based on the same technical concept as the method embodiment, the present application embodiment also provides a multi-dimensional automatic detection system for Internet of Things terminal device access, mainly comprising:

[0175] A basic feature set construction module is configured to capture data packets sent by a device in real time when it is detected that the device attempts to access the power Internet of Things, including initial access requests and subsequent communication data, and to extract device communication features and state features after analyzing the captured data packets, and to form a basic feature set in combination with hardware parameters, software versions, power system configurations and network configurations of the device;

[0176] A feature preprocessing module is configured to perform feature preprocessing on the basic feature set, including: normalizing numerical features to a specified range; using one-hot encoding to convert discrete features into numerical representations; and using a generative adversarial network to complete missing features if some data packet features are missing;

[0177] A feature vector construction module is configured to combine the preprocessed features to form a fixed-dimension feature vector: x = [protocol type, port number, encryption method, packet length, request header field, identity authentication information, battery capacity, device temperature, voltage level, power capacity, CPU model, memory size, operating system version, network configuration], and to establish a reverse mapping mechanism so that the features retain semantic information while being vectorized.

[0178] A multi-dimensional automatic detection module is configured to automatically detect the security, compliance, compatibility and access performance of the device based on the generated feature vector, including: a security evaluation module configured to detect potential security risks of the device during access and operation, which analyzes the generated feature vector to identify abnormal behavior, potential attacks and security risks; a protocol compliance detection module configured to verify whether the communication of the device complies with the standard specifications of the used protocol by extracting the protocol type, field format and communication content from the features; a technical compatibility detection module configured to evaluate the coordination of the device with existing hardware, software and network environment by analyzing the feature vector of the device; and an access performance detection module configured to evaluate the access efficiency and stability of the device by analyzing network performance indicators in the data packets; and the modules form a detection system through feature sharing and linkage mechanism; and the detection results of the modules are finally summarized into a comprehensive evaluation report containing detection scores, potential problems found and optimization suggestions.

[0179] It should be understood that the multi-dimensional automatic detection system for Internet of Things terminal device access in the embodiments of the present application can implement all the technical solutions in the above method embodiments, and the functions of each functional module can be implemented according to the methods in the above method embodiments, and the specific implementation process can be referred to the related description in the above embodiments, which will not be described here in detail.

[0180] The present invention also provides a computer device, comprising: one or more processors; a memory; and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, wherein when the programs are executed by the processors, they implement the steps of the multi-dimensional automated detection method for IoT terminal device access as described above.

[0181] The present invention also provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the multi-dimensional automated detection method for IoT terminal device access as described above.

[0182] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, apparatus (systems), computer devices, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0183] This invention is described with reference to a flowchart of a method according to embodiments of the invention. It should be understood that each step in the flowchart and combinations thereof can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing device, generate instructions for implementing the process. Figure 1 A device for a function specified in one or more processes.

[0184] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 The function specified in one or more processes.

[0185] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 Steps of a specified function in one or more processes.

Claims

1. A multi-dimensional automatic detection method for power Internet of Things terminal device access, characterized in that, The method comprises the following steps: When detecting that a device attempts to access the power Internet of Things, real-time capture of data packets sent by the device is performed, including initial access requests and subsequent communication data, after analysis of the captured data packets, extraction of device communication characteristics and state characteristics, combination of device hardware parameters, software versions, power system configurations and network configurations, and formation of a basic feature set; Feature preprocessing is performed on the basic feature set, including: standardization of numerical features to a specified range; for discrete features, using one-hot encoding to convert to numerical representation; and if some data packet features are missing, using a generative adversarial network to complete the missing features; According to the preprocessed features, the features are combined to form a fixed-dimensional feature vector: x=[protocol type, port number, encryption method, data packet length, request header field, identity authentication information, battery capacity, device temperature, voltage level, power capacity, CPU model, memory size, operating system version, network configuration], and a reverse mapping mechanism is established, so that the features retain semantic information while being vectorized; The generated feature vector is input into a multi-dimensional detection module for detection, the multi-dimensional detection module comprises: a security evaluation module for detecting possible security risks of the device during access and operation, which identifies abnormal behavior, potential attacks and security risks by analyzing the generated feature vector; a protocol compliance detection module for verifying whether the communication of the device complies with the standard specifications of the used protocol by extracting the protocol type, field format and communication content in the features; a technical compatibility detection module for evaluating the coordination of the device with existing hardware, software and network environment by analyzing the feature vector of the device; and an access performance detection module for evaluating the access efficiency and stability of the device by analyzing network performance indicators in the data packets; and the modules are connected through feature sharing and linkage mechanism to form a detection system; finally, the detection results of the modules are summarized into a comprehensive evaluation report, including detection scores, potential problems found and optimization suggestions.

2. The method of claim 1, wherein, The missing features are completed using a generative adversarial network, comprising: The generative adversarial network model is composed of a generator and a discriminator, wherein the generator is used to generate completed features, and the discriminator is used to evaluate the authenticity of the generated features; in the training process, historical complete data is randomly simulated as incomplete features as input to the generator, and complete features are used as reference data for the discriminator; through adversarial training of the generator and the discriminator, the generator gradually optimizes the ability to generate features, and finally the generated features approach the real distribution; The features marked as missing in the analysis process are input into the trained generator to generate a completed feature vector; the generated feature vector is input into the discriminator together with the complete features to determine whether the completed features conform to the real distribution; if the credibility score output by the discriminator exceeds the set threshold, the completed features are considered valid; otherwise, the generator parameters are adjusted or other completion strategies are selected.

3. The method of claim 1, wherein, The security evaluation module identifies abnormal behavior, potential attacks and security risks by analyzing the generated feature vector, comprising: Based on rule matching, the encryption method, port number, device temperature, voltage level, and power capacity in the feature vector x are quickly screened to identify whether the device uses an unsafe communication protocol, whether it accesses an illegal port, whether the temperature exceeds a given safety threshold, and whether the voltage level and power capacity exceed the rated parameters of the power system; Using a support vector machine to classify the feature vector x, the normal or abnormal state is identified. For the abnormal state, the most contributory abnormal feature in the feature vector is determined according to the decision function of the support vector machine. Using a deep learning model to learn the time variation of the feature vector x, persistent threats including DoS attacks, data tampering, and identity impersonation are identified, and the number of time series anomaly types is determined. Based on the number of rule matching exceptions, the number of classified abnormal features, and the number of time series anomaly types, a security score is determined, and a security assessment report is generated based on the security score and threat analysis.

4. The method of claim 3, wherein, Using a deep learning model to learn the time variation of the feature vector x, persistent threats including DoS attacks, data tampering, and identity impersonation are identified, including: Using a long short-term memory network (LSTM), the protocol type, port number, and data packet length in the feature vector x are used to identify DoS attacks. The encryption method, data packet length, and request header field in the feature vector x are used to identify data tampering attacks. The identity authentication information, protocol type, and network configuration in the feature vector x are used to identify identity impersonation risks.

5. The method of claim 1, wherein, The protocol compliance detection module extracts the protocol type, field format, and communication content from the features, verifies whether the device's communication complies with the standard specifications of the used protocol, including: Using [protocol type, port number, request header field] in the feature vector x, the original field values are extracted through a reverse mapping mechanism for protocol field parsing. The integrity and format of the protocol fields are checked to ensure they meet the standard specifications. The actual values of the protocol specified fields are checked to ensure they are set correctly. The port mapping of the protocol communication is verified to ensure it meets the standard requirements. The protocol fields are checked for encryption-related markers. The communication behavior is simulated to verify whether encryption is used during transmission and whether the device behavior conforms to the protocol standards. Based on the number of missing items in the field integrity, the number of field format errors, and the number of behavior deviations, a protocol consistency score is determined. A compliance report is output based on the consistency score and non-compliance items.

6. The method of claim 1, wherein, The technology compatibility detection module analyzes the feature vector of the device to evaluate its compatibility with existing hardware, software, and network environment, including: Using [CPU model, memory size, operating system version, network configuration, voltage level, and power capacity] in the feature vector x, the original information of the device parameters is restored through a reverse mapping mechanism, and then environment adaptation analysis is performed. The device hardware is verified to support the target system based on the CPU model. The device is verified to support the target middleware or software environment based on the operating system version. The device is verified to be compatible with the target system hardware environment based on the voltage level and power capacity. The device performance is detected under simulated environmental stress, including the detection of memory size and network configuration matching the environment. Output a compatibility report, including supported hardware, software environment range and parts to be optimized.

7. The method of claim 1, wherein, The access performance detection module analyzes the network performance indicators in the data packet, evaluates the access efficiency and stability of the device, including: Use network packet analysis software to capture the traffic of the target device, calculate the average time from initial request to successful connection, and evaluate the access speed of the device; Determine the success flag according to the characteristics of the connection protocol, count the number of successful attempts in multiple access attempts, and calculate the access success rate according to the number of successful connections and the total number of connection attempts; Simulate network interference, capture recovery traffic, analyze recovery time, count recovery success rate and average recovery time, and evaluate connection stability.

8. A multi-dimensional automation detection system for power Internet of Things terminal device access, characterized in that, Including: The basic feature set construction module is used to capture the data packets sent by the device in real time when it is detected that the device tries to access the power Internet of Things, including initial access request and subsequent communication data, and after analyzing the captured data packets, the device communication features and state features are extracted, combined with the device's hardware parameters, software version, power system configuration and network configuration, to form a basic feature set; The feature preprocessing module is used to preprocess the basic feature set, including: standardizing numerical features to a specified range; for discrete features, use one-hot encoding to convert to numerical representation; and if some data packet features are missing, use a generative adversarial network to complete the missing features; The feature vector construction module is used to combine the preprocessed features into a fixed-dimensional feature vector: x = [protocol type, port number, encryption method, packet length, request header field, identity authentication information, battery capacity, device temperature, voltage level, power capacity, CPU model, memory size, operating system version, network configuration], and a reverse mapping mechanism is established to preserve the semantic information of the features while vectorizing them; The multi-dimensional automatic detection module is used to automatically detect the security, compliance, compatibility and access performance of the device according to the generated feature vector, including: the security evaluation module is used to detect potential security risks during device access and operation, which analyzes the generated feature vector to identify abnormal behavior, potential attacks and security risks; the protocol compliance detection module verifies whether the device communication complies with the standard specifications of the used protocol by extracting the protocol type, field format and communication content in the features; the technical compatibility detection module evaluates the coordination of the device with existing hardware, software and network environment by analyzing the feature vector of the device; and the access performance detection module evaluates the access efficiency and stability of the device by analyzing the network performance indicators in the data packet; and the modules form a detection system through feature sharing and linkage mechanism; the detection results of each module are finally summarized into a comprehensive evaluation report, including detection scores, potential problems found and optimization suggestions.

9. A computer device, comprising: Including: One or more processors; Memory; and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, and the programs, when executed by the processor, implement the steps of the power internet of things terminal device access-oriented multi-dimensional automation detection method of any one of claims 1-7.

10. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program, when executed by the processor, implements the steps of the power internet of things terminal device access-oriented multi-dimensional automation detection method of any one of claims 1-7.

Images