Smart home behavior classification and anomaly detection method and device

Abstract

The invention relates to a smart home behavior classification and anomaly detection method and device, and the method comprises the steps: carrying out the division of a smart home event log according to the time and space relation, forming different event sequence segments, namely, different user behavior examples, and carrying out the noise reduction processing; expressing the user behavior instance as a graph structure to describe a complex interaction relationship between events in one behavior; mapping the behavior graph of the benign behavior instance to a vector space through a translation-based embedding model, and clustering to obtain a benign behavior cluster with similar semantics; and for a to-be-detected behavior, representing the to-be-detected behavior as a graph structure and mapping the to-be-detected behavior to a vector space, detecting whether a to-be-detected behavior vector falls into the benign behavior cluster, performing manual inspection and anomaly judgment on an outlier, and updating and feeding back the benign behavior cluster. Therefore, the problems that in the prior art, a traditional method is limited in feature expression, lacks high-order semantic understanding, and is difficult to tolerate non-key subtle changes while capturing behavior key semantics are solved.

Description

Technical Field

[0001] The present application relates to the field of computer and information security technology, and in particular to a smart home behavior classification and anomaly detection method and device. Background Art

[0002] By deploying various sensors, controllers, and automation devices at home, users can remotely manage and control devices such as lights, air conditioners, door locks, etc., and achieve highly intelligent home management. These devices and sensors can not only complete tasks according to predetermined automation rules, but also collect and generate a large amount of log data in real time according to user behavior habits and environmental changes. Log data contains multi-dimensional information such as the operating status of the device, user interaction behavior, and environmental parameters, and records in detail the complex operation process and user habits in the home. As the number of devices and sensors continues to increase, these logs show complex and diverse characteristics.

[0003] In addition, in smart home scenarios, different users often set up a variety of personalized automation rules based on their own needs and preferences. For example, users can set specific time periods to automatically adjust the brightness of lights, or automatically control the operation of air conditioners according to changes in indoor and outdoor temperatures. Such personalized automation rules and diverse user behavior patterns make log data more complex and difficult to analyze. In the face of this complex data environment, how to efficiently analyze and utilize these huge log data, especially accurately analyzing users' daily behavior patterns and promptly identifying potential abnormal situations, such as equipment failures and illegal intrusions, has become an important topic and challenge in current smart home research.

[0004] Existing research on anomaly or intrusion detection in smart homes is mainly divided into event-relationship-based methods and user behavior-based methods. Event-relationship-based methods can effectively capture attack behaviors that directly manipulate devices by detecting the causal relationship between events; however, when attackers use the network to inject a series of logical false events, such methods may be bypassed, resulting in missed reports; at the same time, event-relationship-based methods cannot extract more complex behavioral context semantics, and the anomaly detection effect is poor.

[0005] The user behavior-based method predicts future event sequences by learning the system's historical behavior patterns, and detects anomalies based on whether the actual event sequence matches the prediction. However, the behavior patterns of smart home systems are complex and changeable, and similar but not identical event sequences may represent the same user behavior. Therefore, existing user behavior-based methods often lead to a high false alarm rate, which needs to be solved urgently. Summary of the invention

[0006] The present application provides a smart home behavior classification and anomaly detection method and device to solve the problems of limited feature expression, lack of high-order semantic understanding, and difficulty in tolerating non-critical subtle changes while capturing the key semantics of the behavior in the traditional methods in the prior art.

[0007] The first aspect of the present application provides a smart home behavior classification and anomaly detection method, comprising the following steps: dividing a target smart home event log corresponding to a target smart home system to obtain multiple user behavior instances, and denoising the multiple user behavior instances to generate multiple denoised user behavior instances; constructing a behavior graph corresponding to each denoised user behavior instance in the multiple denoised user behavior instances, and based on a preset translation embedding model, mapping the benign behavior graph corresponding to each benign denoised user behavior instance in the multiple denoised user behavior instances to a vector space, and clustering the benign behavior graph corresponding to each benign denoised user behavior instance in the vector space to generate multiple benign behavior clusters that meet preset semantic requirements; constructing a target behavior to be tested corresponding to a behavior graph to be tested, and mapping the behavior graph to be tested to the vector space, and detecting whether multiple behavior vectors to be tested corresponding to the behavior graph to be tested in the vector space are in the benign behavior cluster, so as to perform manual inspection and abnormality determination operations on the behavior instances to be tested corresponding to the behavior vectors to be tested that are not in the benign behavior cluster to obtain abnormality determination results, and based on the abnormality determination results, feedback and update the benign behavior cluster.

[0008] Optionally, in one embodiment of the present application, the target smart home event log corresponding to the target smart home system is divided to obtain multiple user behavior instances, and the multiple user behavior instances are denoised to generate multiple denoised user behavior instances, including: based on a preset cloud platform, obtaining a smart home event log containing a target smart home system state change entry, wherein the target smart home system state change entry includes a timestamp, a device name, and a device status; obtaining a smart home device floor plan corresponding to the target smart home system, and constructing a distance matrix with a location semantic relationship based on the smart home device floor plan, and determining a division time threshold corresponding to the target smart home event log; determining an initial event window corresponding to the smart home event log, and based on the distance matrix and the division time threshold, dynamically expanding and denoising the initial event window to generate the multiple denoised user behavior instances.

[0009] Optionally, in an embodiment of the present application, constructing a behavior graph corresponding to each noise reduction user behavior instance among the multiple noise reduction user behavior instances includes: determining node information of the behavior graph based on the target smart home system and the device state, and obtaining an event relationship in each noise reduction user behavior instance, so as to determine edge information of the behavior graph through the event relationship; constructing a behavior graph corresponding to each noise reduction user behavior instance according to the node information and the edge information.

[0010] Optionally, in an embodiment of the present application, mapping a benign behavior graph corresponding to each benign noise reduction user behavior instance among the multiple noise reduction user behavior instances to a vector space based on a preset translation embedding model, and clustering the benign behavior graphs corresponding to each benign noise reduction user behavior instance in the vector space to generate multiple benign behavior clusters that meet preset semantic requirements, includes: traversing the benign behavior graph corresponding to each benign noise reduction user behavior instance to obtain a triple set corresponding to each benign behavior graph; mapping the triple set to the vector space based on the translation embedding model, and performing a weighted summation operation on the triple set to obtain a benign behavior instance vector corresponding to each benign behavior graph; clustering the benign behavior instance vectors corresponding to each benign noise reduction user behavior instance to generate the multiple benign behavior clusters.

[0011] Optionally, in one embodiment of the present application, the method of constructing a test behavior graph corresponding to the target test behavior, mapping the test behavior graph to the vector space, and detecting whether multiple test behavior vectors corresponding to the test behavior graph in the vector space are in the benign behavior cluster, so as to perform manual inspection and abnormality judgment operations on the test behavior instances corresponding to the test behavior vectors that are not in the benign behavior cluster to obtain abnormality judgment results, and based on the abnormality judgment results, feedback and update the benign behavior cluster, includes: obtaining log information corresponding to the target test behavior, and dividing the log information to generate multiple test user behavior instances corresponding to the target test behavior, and denoising the multiple test user behavior instances to generate multiple denoised test user behavior instances; constructing a test behavior graph corresponding to each denoised test user behavior instance in the multiple denoised test user behavior instances, and mapping the test behavior graph to the vector space to obtain the test behavior instance vector corresponding to each denoised test user behavior instance; calculating each The cosine distance between the behavior instance vector to be tested and the centroid of each benign behavior cluster in the multiple benign behavior clusters, and whether the cosine distance between each behavior instance vector to be tested and the centroid of all benign behavior clusters is greater than a preset distance threshold; if the cosine distances between the behavior instance vector to be tested and the centroids of all benign behavior clusters are greater than the distance threshold, then the behavior instance to be tested corresponding to the behavior instance vector to be tested is manually inspected and anomaly determined to obtain the anomaly determination result, and when the anomaly determination result of the behavior instance to be tested is benign, the behavior instance to be tested is updated to the benign behavior cluster to generate a new benign behavior cluster; if there is at least one target cosine distance less than or equal to the distance threshold in the cosine distances between the behavior instance vector to be tested and the centroids of all benign behavior clusters, then the minimum target cosine distance among all target cosine distances and the target benign behavior cluster corresponding to the minimum target cosine distance are determined, and the behavior instance to be tested corresponding to the behavior instance vector to be tested is determined to be the benign behavior corresponding to the target benign behavior cluster.

[0012] The second aspect of the present application provides a smart home behavior classification and anomaly detection device, including: a division module, used to divide the target smart home event log corresponding to the target smart home system to obtain multiple user behavior instances, and denoise the multiple user behavior instances to generate multiple denoised user behavior instances; a clustering module, used to construct a behavior graph corresponding to each denoised user behavior instance in the multiple denoised user behavior instances, and based on a preset translation embedding model, map the benign behavior graph corresponding to each benign denoised user behavior instance in the multiple denoised user behavior instances to a vector space, and cluster the vectors. The benign behavior graph corresponding to each benign noise reduction user behavior instance in the space is clustered to generate multiple benign behavior clusters that meet the preset semantic requirements; the detection module is used to construct a behavior graph to be tested corresponding to the target behavior to be tested, and map the behavior graph to be tested to the vector space, and detect whether the multiple behavior vectors to be tested corresponding to the behavior graph to be tested in the vector space are in the benign behavior cluster, so as to perform manual inspection and abnormal judgment operations on the behavior instances to be tested corresponding to the behavior vectors to be tested that are not in the benign behavior cluster, so as to obtain abnormal judgment results, and based on the abnormal judgment results, feedback to update the benign behavior cluster.

[0013] Optionally, in one embodiment of the present application, the division module includes: a first acquisition unit, used to acquire a smart home event log containing a target smart home system state change entry based on a preset cloud platform, wherein the target smart home system state change entry includes a timestamp, a device name, and a device status; a second acquisition unit, used to acquire a smart home device floor plan corresponding to the target smart home system, and construct a distance matrix with a location semantic relationship based on the smart home device floor plan, and determine a division time threshold corresponding to the target smart home event log; a generation unit, used to determine an initial event window corresponding to the smart home event log, and dynamically expand and denoise the initial event window based on the distance matrix and the division time threshold to generate the multiple denoised user behavior instances.

[0014] Optionally, in one embodiment of the present application, the clustering module includes: a determination unit, used to determine the node information of the behavior graph based on the target smart home system and the device status, and obtain the event relationship in each noise reduction user behavior instance to determine the edge information of the behavior graph through the event relationship; a composition unit, used to construct the behavior graph corresponding to each noise reduction user behavior instance according to the node information and the edge information.

[0015] Optionally, in one embodiment of the present application, the clustering module also includes: a traversal unit, used to traverse the benign behavior graph corresponding to each benign denoising user behavior instance to obtain a set of triples corresponding to each benign behavior graph; a weighted summation unit, used to map the set of triples to the vector space based on the translation embedding model, and perform a weighted summation operation on the set of triples to obtain a benign behavior instance vector corresponding to each benign behavior graph; and a clustering unit, used to cluster the benign behavior instance vectors corresponding to each benign denoising user behavior instance to generate the multiple benign behavior clusters.

[0016] Optionally, in one embodiment of the present application, the detection module includes: a denoising unit, used to obtain log information corresponding to the target behavior to be tested, and divide the log information to generate multiple user behavior instances to be tested corresponding to the target behavior to be tested, and denoise the multiple user behavior instances to be tested to generate multiple denoised user behavior instances to be tested; a mapping unit, used to construct a behavior graph to be tested corresponding to each denoised user behavior instance to be tested in the multiple denoised user behavior instances to be tested, and map the behavior graph to be tested to the vector space to obtain a behavior instance vector to be tested corresponding to each denoised user behavior instance to be tested; a calculation unit, used to respectively calculate the cosine distance between each behavior instance vector to be tested and the centroid of each benign behavior cluster in the multiple benign behavior clusters, and determine whether the cosine distance between each behavior instance vector to be tested and the centroid of all benign behavior clusters is greater than a preset distance. A distance threshold; a first analysis unit, used to perform manual inspection and abnormality determination operations on the behavior instance to be tested corresponding to the behavior instance vector to be tested, if the cosine distances between the behavior instance vector to be tested and the centroids of all benign behavior clusters are greater than the distance threshold, so as to obtain the abnormality determination result, and when the abnormality determination result of the behavior instance to be tested is benign, update the behavior instance to be tested to the benign behavior cluster to generate a new benign behavior cluster; a second analysis unit, used to determine the minimum target cosine distance among all target cosine distances and the target benign behavior cluster corresponding to the minimum target cosine distance, if there is at least one target cosine distance less than or equal to the distance threshold among the cosine distances between the behavior instance vector to be tested and the centroids of all benign behavior clusters, and determine that the behavior instance to be tested corresponding to the behavior instance vector to be tested is the benign behavior corresponding to the target benign behavior cluster.

[0017] The third aspect of the present application provides an electronic device, including: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the smart home behavior classification and anomaly detection method as described in the above embodiment.

[0018] The fourth aspect of the present application provides a computer-readable storage medium, which stores a computer program. When the program is executed by a processor, it implements the above smart home behavior classification and anomaly detection method.

[0019] The fifth aspect of the present application provides a computer program product, including a computer program, which is executed to implement the above-mentioned smart home behavior classification and anomaly detection method.

[0020] Therefore, the embodiments of the present application have the following beneficial effects:

[0021] The embodiments of the present application can obtain multiple user behavior instances by dividing the target smart home event log corresponding to the target smart home system, and denoise the multiple user behavior instances to generate multiple denoised user behavior instances; construct a behavior graph corresponding to each denoised user behavior instance in the multiple denoised user behavior instances, and based on a preset translation embedding model, map the benign behavior graph corresponding to each benign denoised user behavior instance in the multiple denoised user behavior instances to a vector space, and cluster the benign behavior graph corresponding to each benign denoised user behavior instance in the vector space to generate multiple benign behavior clusters that meet preset semantic requirements; construct a behavior graph to be tested corresponding to the target behavior to be tested, and map the behavior graph to be tested to the vector space, and detect whether multiple behavior vectors to be tested corresponding to the behavior graph to be tested in the vector space are in the benign behavior cluster, so as to perform manual inspection and abnormal judgment operations on the behavior instances to be tested corresponding to the behavior vectors to be tested that are not in the benign behavior cluster, and update the feedback benign behavior cluster. This application models and represents the smart home system at the user behavior level and uses behavioral context information to improve the accuracy of classification and anomaly detection, so that it can be effectively applied in security scenarios such as log auditing and anomaly detection. This solves the problems of limited feature expression, lack of high-level semantic understanding, and difficulty in tolerating non-critical subtle changes in traditional methods in the prior art.

[0022] Additional aspects and advantages of the present application will be given in part in the description below, and in part will become apparent from the description below, or will be learned through the practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which:

[0024] Figure 1 A flowchart of a smart home behavior classification and anomaly detection method provided according to an embodiment of the present application;

[0025] Figure 2A schematic diagram of an execution flow of a behavior partitioning and noise reduction algorithm provided for an embodiment of the present application;

[0026] Figure 3 A schematic diagram of an execution flow of a numerical device interval partitioning algorithm provided for one embodiment of the present application;

[0027] Figure 4 A schematic diagram of an example of a behavior diagram provided for an embodiment of the present application;

[0028] Figure 5 A schematic diagram of the execution logic of a smart home behavior classification and anomaly detection method provided for one embodiment of the present application;

[0029] Figure 6 This is an example diagram of a smart home behavior classification and anomaly detection device according to an embodiment of the present application;

[0030] Figure 7 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application.

[0031] Among them, 10-smart home behavior classification and anomaly detection device; 100-division module, 200-clustering module, 300-detection module; 701-memory, 702-processor, 703-communication interface. DETAILED DESCRIPTION

[0032] The embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present application, and should not be construed as limiting the present application.

[0033] The following describes the smart home behavior classification and anomaly detection method and device according to the embodiments of the present application with reference to the accompanying drawings. In response to the problems mentioned in the above background technology, the present application provides a smart home behavior classification and anomaly detection method, in which a target smart home event log corresponding to a target smart home system is divided to obtain multiple user behavior instances, and the multiple user behavior instances are denoised to generate multiple denoised user behavior instances; a behavior graph corresponding to each denoised user behavior instance in the multiple denoised user behavior instances is constructed, and based on a preset translation embedding model, the benign behavior graph corresponding to each benign denoised user behavior instance in the multiple denoised user behavior instances is mapped to a vector space, and the benign behavior graph corresponding to each benign denoised user behavior instance in the vector space is clustered to generate multiple benign behavior clusters that meet preset semantic requirements; a target behavior graph to be tested is constructed corresponding to the target behavior to be tested, and the behavior graph to be tested is mapped to the vector space, and it is detected whether the multiple behavior vectors to be tested corresponding to the behavior graph to be tested in the vector space are in the benign behavior cluster, so as to perform manual inspection and abnormality judgment operations on the behavior instances to be tested corresponding to the behavior vectors to be tested that are not in the benign behavior cluster, and update the feedback benign behavior cluster. This application models and represents the smart home system at the user behavior level and uses behavioral context information to improve the accuracy of classification and anomaly detection, so that it can be effectively applied in security scenarios such as log auditing and anomaly detection. This solves the problems of limited feature expression, lack of high-level semantic understanding, and difficulty in tolerating non-critical subtle changes in traditional methods in the prior art.

[0034] Specifically, Figure 1 A flowchart of a smart home behavior classification and anomaly detection method provided in an embodiment of the present application.

[0035] like Figure 1 As shown, the smart home behavior classification and anomaly detection method includes the following steps:

[0036] In step S101, a target smart home event log corresponding to a target smart home system is divided to obtain a plurality of user behavior instances, and noise reduction is performed on the plurality of user behavior instances to generate a plurality of noise-reduced user behavior instances.

[0037] Those skilled in the art should understand that a smart home system can continuously monitor and record various activities and status in a home by integrating a variety of devices and sensors. Logs, as an important data source for smart home systems, can reflect the daily behavioral characteristics of users.

[0038] Therefore, the embodiments of the present application can take the smart home environment and logs as research objects, and divide the smart home event logs according to the time and space relationship to form different event sequence fragments, that is, different user behavior instances, and perform noise reduction processing on them to generate multiple noise-reduced user behavior instances.

[0039] Therefore, the embodiments of the present application divide the smart home event logs and combine them with corresponding noise reduction processing strategies to provide reliable data support for the modeling and analysis of user behaviors reflected in subsequent logs.

[0040] Optionally, in one embodiment of the present application, a target smart home event log corresponding to a target smart home system is divided to obtain multiple user behavior instances, and the multiple user behavior instances are denoised to generate multiple denoised user behavior instances, including: based on a preset cloud platform, obtaining a smart home event log containing a target smart home system state change entry, wherein the target smart home system state change entry includes a timestamp, a device name, and a device status; obtaining a smart home device floor plan corresponding to the target smart home system, and constructing a distance matrix with a location semantic relationship based on the smart home device floor plan, and determining a division time threshold corresponding to the target smart home event log; determining an initial event window corresponding to the smart home event log, and dynamically expanding and denoising the initial event window based on the distance matrix and the division time threshold to generate multiple denoised user behavior instances.

[0041] It should be noted that the embodiments of the present application can export a smart home event log containing target smart home system state change entries from a cloud platform, and the smart home system state change entries mainly include attributes such as timestamp, device name, and device state, wherein the device state can be a binary state of "on" or "off", or a real-valued state with a continuous space.

[0042] For a complete smart home log, the embodiment of the present application first needs to divide it into different behavior segments. In the actual implementation process, the embodiment of the present application can construct a spatial position matrix (i.e., distance matrix) with position semantic relationship through the smart home floor plan M = {a ij |i,j∈{1,2,…,n}}, and select the division time threshold of the division behavior instance, where n represents the total number of devices in the smart home environment. If device i and device j are adjacent or in the same area, then a ij =1; otherwise, a ij =0.

[0043] Secondly, if Figure 2As shown, an embodiment of the present application can select an initial window size of an initial event window, find the main device entity in the window, and use the distance matrix M to eliminate irrelevant sensor readings as noise, and dynamically expand the initial event window through spatiotemporal information, expanding the window size row by row. If the time difference between the previous and next logs is greater than the time threshold or the position of the main device entity changes, it is divided into event sequence fragments of varying lengths, i.e., different noise reduction user behavior instances.

[0044] In step S102, a behavior graph corresponding to each of the multiple denoising user behavior instances is constructed, and based on a preset translation embedding model, the benign behavior graph corresponding to each benign denoising user behavior instance in the multiple denoising user behavior instances is mapped to a vector space, and the benign behavior graph corresponding to each benign denoising user behavior instance in the vector space is clustered to generate a plurality of benign behavior clusters that meet preset semantic requirements.

[0045] Furthermore, the embodiments of the present application also need to represent user behavior instances as graph structures to describe the complex interactive relationships between events in a behavior; thereafter, the embodiments of the present application also need to map the benign behavior graph of each benign denoising user behavior instance to a vector space based on a translation embedding model, and obtain multiple benign behavior clusters with similar semantics through clustering operations.

[0046] Optionally, in one embodiment of the present application, a behavior graph corresponding to each noise reduction user behavior instance in multiple noise reduction user behavior instances is constructed, including: determining the node information of the behavior graph based on the target smart home system and device status, and obtaining the event relationship in each noise reduction user behavior instance to determine the side information of the behavior graph through the event relationship; and constructing the behavior graph corresponding to each noise reduction user behavior instance based on the node information and the side information.

[0047] In an embodiment of the present application, the behavior graph corresponding to the above-mentioned noise reduction user behavior instance represents the graph structure of a behavior instance, which mainly includes nodes composed of devices and state values ​​and edges representing the relationship between events.

[0048] It should be noted that if the device state space is numerical, the numerical value is mapped to a finite state through density estimation and interval partitioning; the semantics in the edge not only includes the outgoing node device and state, but also includes the relationship between the outgoing node and the incoming node triggered by rules or actively changed by the user.

[0049] In the specific implementation process, the embodiment of the present application can take "a change in the state of a device" in the smart home log as an event, represented by a triple (T, D, S), that is, at time T, the state of device D changes to S. Therefore, the embodiment of the present application defines a behavior as a combination of a series of event sequences in the log within a specific time period, and uses a directed graph to represent the behavior. Describe a behavior. and denote the set of nodes and edges respectively, Φ: u≠v} maps each edge to two ordered nodes; in the embodiment of the present application, node v=(D,S) represents an event in the behavior, and edges are used to describe the relationship between the two nodes. According to the relationship between the ingress node and the egress node, the edges are divided into two categories: edges triggered by rules and edges that occur in time sequence, wherein the edges triggered by rules indicate that the occurrence of the ingress node event leads to the occurrence of the egress node event through automated rules; the edges that occur in time sequence indicate that the ingress node and the egress node of the edge have a time sequence relationship, that is, they indicate the order of different events in user behavior.

[0050] Optionally, in one embodiment of the present application, based on a preset translation embedding model, a benign behavior graph corresponding to each benign denoising user behavior instance in multiple denoising user behavior instances is mapped to a vector space, and the benign behavior graph corresponding to each benign denoising user behavior instance in the vector space is clustered to generate multiple benign behavior clusters that meet preset semantic requirements, including: traversing the benign behavior graph corresponding to each benign denoising user behavior instance to obtain a set of triples corresponding to each benign behavior graph; based on the translation embedding model, mapping the set of triples to the vector space, and performing a weighted sum operation on the set of triples to obtain a benign behavior instance vector corresponding to each benign behavior graph; clustering the benign behavior instance vector corresponding to each benign denoising user behavior instance to generate multiple benign behavior clusters.

[0051] In the actual execution process, in order to prevent the state space explosion problem in the subsequent node embedding stage, the embodiment of the present application needs to map the numerical device values ​​in the log to a limited state space.

[0052] Specifically, for the value of each numerical device in the log, the kernel density estimation is used to draw its probability distribution curve, and the valley point is found as the initial interval division point. Then, each group of adjacent intervals is traversed. If the average density of adjacent intervals is similar and the range is small, the two can be merged into one interval. The numerical interval division algorithm is as follows: Figure 3 As shown. Thus, the value of a numerical device can be mapped to a limited space. For example, the value range of a temperature sensor state is [0,100]. Through this algorithm, its state can be mapped to the set (Low, Medium, High).

[0053] It should be noted that the initial node of the behavior graph marks the beginning of a behavior, and divides subsequent nodes into different "channels" to enhance semantic representation. For example, events such as users actively turning on and off devices and triggering motion sensors are divided into "physical channels", and related changes in temperature sensors are divided into "temperature channels". Similarly, there are "humidity channels" and so on. The nodes of each channel are connected by edges, indicating the order in which events occur. Channels are also connected by edges due to the interaction of rules or environments. For example, the smart home automation rule reflected in the log: "If the temperature is higher than 30 degrees, turn on the air conditioner", then the node of the physical channel (air conditioner, on) and the node of the temperature channel (temperature sensor, high) are connected through the edge "trigger-turn on air conditioner". An example of a behavior graph is Figure 4 As shown, the behavior graph represents an example of a user's bathing behavior, in which the smart home entities involved include: bathroom light (L1), motion sensors (M1, M2), temperature sensor (T), humidity sensor (H), mirror light (L2), exhaust fan (F), etc.

[0054] For every good behavior graph G i , the present application embodiment can convert the triple As the primitive of each behavior graph, h and t are the head node and tail node of the primitive respectively, and r is the edge connecting the two nodes, indicating the relationship between the head and tail nodes, such as Figure 4 As shown in the dashed box. All triples appearing in each graph are obtained through a depth-first search of the graph. Using the translation-based embedding model (TransE), the entities (nodes) and relationships (edges) in the behavior graph are mapped to a low-dimensional vector space. Among them, TransE assumes that each triple (h, r, t) satisfies the following relationship in the vector space:

[0055] e h +e r ≈e t

[0056] Among them, e h 、e r and e t are the embedding vectors of the head node h, edge r and tail node t respectively.

[0057] Specifically, the embodiment of the present application can first count the types of nodes and edges appearing in all behavior graphs, and initialize all nodes and edges using one-hot encoding. For example, if all graphs contain two triples τ 1 =(v 1 ,r 1 ,v 2 ),τ 2 =(v 2,r 2 ,v 3 ), there are 5 types of nodes and edges, so let v 1 =(1,0,0,0,0), and so on; in order to obtain the final embedded representation of nodes and edges, the following objective function is iteratively optimized:

[0058]

[0059] in, is the set of behavior graphs, e x is the embedding vector corresponding to entity x (node ​​or edge) in the graph; finally, the optimization result generates an m-dimensional embedding vector for each node and edge, that is, through concatenation, a triple can be represented as a 3m-dimensional vector (e h ,e r ,e t ).

[0060] Furthermore, considering that events in a behavior contribute differently to the importance of the behavior, a behavior graph can be represented by weighted accumulation of all triplet embedding vectors appearing in the graph. Therefore, the embodiment of the present application can use the inverse text frequency as the weight coefficient, as shown in the following formula:

[0061]

[0062] Among them, n t represents the number of times the event corresponding to the triple τ appears in the entire log, and N represents the total number of events in the entire log. Therefore, the embedding vector corresponding to a behavior graph is It can be expressed as:

[0063]

[0064] Afterwards, the embodiment of the present application can embed the vector based on all benign behaviors The agglomerative hierarchical clustering method is used to aggregate vectors with similar distances in space into different classes to characterize benign behaviors with similar semantics. The specific process is as follows:

[0065] 1. Starting from each behavior vector point as an independent cluster, calculate the distance between each cluster; find the two closest clusters and merge them into a new cluster;

[0066] 2. Calculate the centroid of the new cluster and recalculate the distance between the new cluster and other clusters until the distance between any two clusters is less than the threshold or the maximum number of clusters is reached.

[0067] In the specific implementation process, the embodiment of the present application may use cosine distance as an indicator for judging the similarity of behavior vectors, as shown in the following formula:

[0068]

[0069] Among them, F m and F n are the embedding vectors corresponding to the two behavior instances.

[0070] It can be understood that the smaller the cosine distance is, the higher the similarity between the two behavior vectors is, that is, the closer the behavior semantics are. After obtaining multiple benign behavior clusters, the centroid of each behavior cluster is recorded and used as a representative example of the benign behavior for anomaly detection. The calculation formula of the cluster centroid is as follows:

[0071]

[0072] Among them, μ i Represents cluster C i The center of mass; F j (j=1,2,…,n i ) is cluster C i The middle row is the vector representation of the instance.

[0073] In summary, the embodiments of the present application can traverse the set of triplets (node, edge, node) of each benign behavior graph, and map the triplets to the vector space based on the nodes and edges that have appeared in all behavior graphs using a translation-based embedding model, and obtain the vector representation of the behavior by weighted summation. The clustering method is then used to divide the behavior instance vectors into different clusters based on distance. Each cluster contains all benign behavior instances with similar semantics and context, representing the same behavior, so that for each benign behavior cluster, its centroid is found as its representative behavior instance.

[0074] In step S103, a test behavior graph corresponding to the target test behavior is constructed, and the test behavior graph is mapped into the vector space, and it is detected whether multiple test behavior vectors corresponding to the test behavior graph in the vector space are in the benign behavior cluster, so as to perform manual inspection and abnormal judgment operations on the test behavior instances corresponding to the test behavior vectors that are not in the benign behavior cluster to obtain abnormal judgment results, and based on the abnormal judgment results, feedback is provided to update the benign behavior cluster.

[0075] Furthermore, the embodiments of the present application can perform division, noise reduction, composition, and embedding steps on the logs containing the behavior to be tested to obtain an embedded vector representation of the behavior instance to be tested. If a behavior vector to be tested is far away from the centroid of any benign cluster, it is an outlier and will be manually inspected: if it is a benign behavior, a new cluster will be added, otherwise the behavior will be considered abnormal.

[0076] Therefore, the embodiments of the present application can model and represent the smart home system at the user behavior level, and can be applied to security scenarios such as log auditing and anomaly detection; in addition, the embodiments of the present application use behavioral context information to improve the accuracy of classification and anomaly detection, overcoming the difficulties of traditional methods with limited feature expression and lack of high-order semantic understanding, and can tolerate "non-critical" subtle changes while capturing the key semantics of behavior, and has the advantages of efficient anomaly recognition, strong robustness, and strong adaptability.

[0077] Optionally, in one embodiment of the present application, a test behavior graph corresponding to the target test behavior is constructed, and the test behavior graph is mapped into a vector space, and it is detected whether multiple test behavior vectors corresponding to the test behavior graph in the vector space are in the benign behavior cluster, so as to perform manual inspection and abnormal judgment operations on the test behavior instances corresponding to the test behavior vectors that are not in the benign behavior cluster to obtain abnormal judgment results, and based on the abnormal judgment results, feedback is given to update the benign behavior cluster, including: obtaining log information corresponding to the target test behavior, and dividing the log information to generate multiple test user behavior instances corresponding to the target test behavior, and denoising the multiple test user behavior instances to generate multiple denoised test user behavior instances; constructing a test behavior graph corresponding to each denoised test user behavior instance in the multiple denoised test user behavior instances, and mapping the test behavior graph into the vector space to obtain a test behavior instance vector corresponding to each denoised test user behavior instance; calculating each test behavior instance respectively. The cosine distance between the tested behavior instance vector and the centroid of each benign behavior cluster in multiple benign behavior clusters is determined, and whether the cosine distance between each tested behavior instance vector and the centroid of all benign behavior clusters is greater than a preset distance threshold; if the cosine distances between the tested behavior instance vector and the centroids of all benign behavior clusters are greater than the distance threshold, then the tested behavior instance corresponding to the tested behavior instance vector is manually inspected and anomaly determined to obtain an anomaly determination result, and when the anomaly determination result of the tested behavior instance is benign, the tested behavior instance is updated to the benign behavior cluster to generate a new benign behavior cluster; if there is at least one target cosine distance less than or equal to the distance threshold among the cosine distances between the tested behavior instance vector and the centroids of all benign behavior clusters, then the minimum target cosine distance among all target cosine distances and the target benign behavior cluster corresponding to the minimum target cosine distance are determined, and the tested behavior instance corresponding to the tested behavior instance vector is determined to be the benign behavior corresponding to the target benign behavior cluster.

[0078] In the actual execution process, the embodiment of the present application takes the log containing the behavior to be tested as input, divides it according to the above steps, reduces noise, represents it as a graph structure and maps it to the vector space, and then compares each behavior to be tested embedding vector with the benign cluster centroid one by one. If the cosine distance between a certain behavior instance vector to be tested and the centroid of any benign cluster is greater than the distance threshold, the corresponding behavior instance to be tested is marked as suspicious behavior. Since the behavior represented by graph modeling and embedding is traceable, after manually reviewing the log corresponding to the suspicious behavior, if the behavior is benign, it will be recorded as a legal new cluster, otherwise it will be judged as abnormal.

[0079] Therefore, the embodiments of the present application model the user behavior in the smart home as a graph structure representation, use the translation-based embedding model to obtain the embedding vector of the behavior, and finally cluster the behavior vector according to the distance, so that it can be well used in scenarios such as behavior auditing and anomaly detection.

[0080] The following describes the execution logic of the smart home behavior classification and anomaly detection method of the present application in combination with the accompanying drawings.

[0081] Figure 5 This is a schematic diagram of the execution logic of the smart home behavior classification and anomaly detection method of this application. Figure 5 As shown, the execution logic of the smart home behavior classification and anomaly detection method of the present application is as follows:

[0082] S501: dividing the smart home event log according to the time and space relationship to form different event sequence fragments, that is, different user behavior instances, and performing noise reduction processing on them;

[0083] S502: Representing a user behavior instance as a graph structure to describe the complex interactive relationship between events in a behavior;

[0084] S503: Mapping the “behavior graph” of the benign behavior instance to the vector space through the translation-based embedding model, and clustering it to obtain benign behavior clusters with similar semantics;

[0085] S504: For the behavior to be tested, after it is represented as a graph structure and mapped to the vector space, it is detected whether the behavior vector to be tested falls into the benign behavior cluster, and the outliers are manually detected and abnormal judgment is performed. Based on the abnormal judgment result, the benign behavior cluster is fed back and updated.

[0086] According to the smart home behavior classification and anomaly detection method proposed in the embodiment of the present application, a target smart home event log corresponding to a target smart home system is divided to obtain multiple user behavior instances, and the multiple user behavior instances are denoised to generate multiple denoised user behavior instances; a behavior graph corresponding to each denoised user behavior instance in the multiple denoised user behavior instances is constructed, and based on a preset translation embedding model, the benign behavior graph corresponding to each benign denoised user behavior instance in the multiple denoised user behavior instances is mapped to a vector space, and the benign behavior graph corresponding to each benign denoised user behavior instance in the vector space is clustered to generate multiple benign behavior clusters that meet preset semantic requirements; a behavior graph to be tested corresponding to the target behavior to be tested is constructed, and the behavior graph to be tested is mapped to the vector space, and it is detected whether multiple behavior vectors to be tested corresponding to the behavior graph to be tested in the vector space are in the benign behavior cluster, so as to perform manual inspection and abnormal judgment operations on the behavior instances to be tested corresponding to the behavior vectors to be tested that are not in the benign behavior cluster, and based on the abnormal judgment results, the benign behavior cluster is fed back to update. This application models and represents the smart home system at the user behavior level and uses behavioral context information to improve the accuracy of classification and anomaly detection, so that it can be effectively applied in security scenarios such as log auditing and anomaly detection.

[0087] Secondly, the smart home behavior classification and anomaly detection device proposed according to the embodiment of the present application is described with reference to the accompanying drawings.

[0088] Figure 6 Schematic diagram of a smart home behavior classification and anomaly detection device according to an embodiment of the present application.

[0089] like Figure 6 As shown, the smart home behavior classification and anomaly detection device 10 includes: a division module 100, a clustering module 200 and a detection module 300.

[0090] Among them, the division module 100 is used to divide the target smart home event log corresponding to the target smart home system to obtain multiple user behavior instances, and denoise the multiple user behavior instances to generate multiple denoised user behavior instances.

[0091] The clustering module 200 is used to construct a behavior graph corresponding to each of the multiple denoising user behavior instances, and based on a preset translation embedding model, map the benign behavior graph corresponding to each benign denoising user behavior instance in the multiple denoising user behavior instances to a vector space, and cluster the benign behavior graph corresponding to each benign denoising user behavior instance in the vector space to generate a plurality of benign behavior clusters that meet preset semantic requirements.

[0092] The detection module 300 is used to construct a test behavior graph corresponding to the target test behavior, and map the test behavior graph to the vector space, and detect whether multiple test behavior vectors corresponding to the test behavior graph in the vector space are in the benign behavior cluster, so as to perform manual inspection and abnormality judgment operations on the test behavior instances corresponding to the test behavior vectors that are not in the benign behavior cluster to obtain abnormality judgment results, and based on the abnormality judgment results, feedback to update the benign behavior cluster.

[0093] Optionally, in one embodiment of the present application, the division module 100 includes: a first acquisition unit, a second acquisition unit and a generation unit.

[0094] The first acquisition unit is used to acquire a smart home event log including a target smart home system state change entry based on a preset cloud platform, wherein the target smart home system state change entry includes a timestamp, a device name, and a device state.

[0095] The second acquisition unit is used to acquire a smart home device plan view corresponding to the target smart home system, construct a distance matrix with position semantic relationship according to the smart home device plan view, and determine a division time threshold corresponding to the target smart home event log.

[0096] The generation unit is used to determine the initial event window corresponding to the smart home event log, and dynamically expand and denoise the initial event window based on the distance matrix and the division time threshold to generate multiple denoised user behavior instances.

[0097] Optionally, in one embodiment of the present application, the clustering module 200 includes: a determination unit and a composition unit.

[0098] Among them, the determination unit is used to determine the node information of the behavior graph based on the target smart home system and device status, and obtain the event relationship in each noise reduction user behavior instance to determine the edge information of the behavior graph through the event relationship.

[0099] A graph construction unit is used to construct a behavior graph corresponding to each denoising user behavior instance according to node information and edge information.

[0100] Optionally, in one embodiment of the present application, the clustering module 200 further includes: a traversal unit, a weighted summation unit and a clustering unit.

[0101] The traversal unit is used to traverse the benign behavior graph corresponding to each benign noise reduction user behavior instance to obtain a set of triples corresponding to each benign behavior graph.

[0102] The weighted summation unit is used to map the triple set into the vector space based on the translation embedding model, and perform a weighted summation operation on the triple set to obtain a benign behavior instance vector corresponding to each benign behavior graph.

[0103] The clustering unit is used to cluster the benign behavior instance vector corresponding to each benign denoising user behavior instance to generate multiple benign behavior clusters.

[0104] Optionally, in one embodiment of the present application, the detection module 300 includes: a noise reduction unit, a mapping unit, a calculation unit, a first analysis unit and a second analysis unit.

[0105] Among them, the noise reduction unit is used to obtain log information corresponding to the target behavior to be tested, and divide the log information to generate multiple user behavior instances to be tested corresponding to the target behavior to be tested, and denoise the multiple user behavior instances to be tested to generate multiple denoised user behavior instances to be tested.

[0106] A mapping unit is used to construct a behavior graph to be tested corresponding to each of the multiple noise reduction user behavior instances to be tested, and map the behavior graph to be tested into a vector space to obtain a behavior instance vector to be tested corresponding to each noise reduction user behavior instance to be tested.

[0107] The calculation unit is used to calculate the cosine distance between each behavior instance vector to be tested and the centroid of each benign behavior cluster in multiple benign behavior clusters, and determine whether the cosine distance between each behavior instance vector to be tested and the centroid of all benign behavior clusters is greater than a preset distance threshold.

[0108] The first analysis unit is used to perform manual inspection and abnormality determination operations on the behavior instance to be tested corresponding to the behavior instance vector to be tested if the cosine distance between the behavior instance vector to be tested and the centroids of all benign behavior clusters is greater than a distance threshold to obtain an abnormality determination result; and when the abnormality determination result of the behavior instance to be tested is benign, update the behavior instance to be tested to the benign behavior cluster to generate a new benign behavior cluster.

[0109] The second analysis unit is used to determine the minimum target cosine distance among all target cosine distances and the target benign behavior cluster corresponding to the minimum target cosine distance if there is at least one target cosine distance less than or equal to a distance threshold among the cosine distances between the behavior instance vector to be tested and the centroids of all benign behavior clusters, and determine that the behavior instance to be tested corresponding to the behavior instance vector to be tested is the benign behavior corresponding to the target benign behavior cluster.

[0110] It should be noted that the aforementioned explanation of the embodiment of the smart home behavior classification and anomaly detection method is also applicable to the smart home behavior classification and anomaly detection device of this embodiment, and will not be repeated here.

[0111] According to the smart home behavior classification and anomaly detection device proposed in the embodiment of the present application, it includes a division module, which is used to divide the target smart home event log corresponding to the target smart home system to obtain multiple user behavior instances, and denoise the multiple user behavior instances to generate multiple denoised user behavior instances; a clustering module, which is used to construct a behavior graph corresponding to each denoised user behavior instance in the multiple denoised user behavior instances, and based on a preset translation embedding model, map the benign behavior graph corresponding to each benign denoised user behavior instance in the multiple denoised user behavior instances to a vector space, and cluster the benign behavior graph corresponding to each benign denoised user behavior instance in the vector space to generate multiple benign behavior clusters that meet preset semantic requirements; a detection module, which is used to construct a target behavior graph corresponding to the target behavior to be tested, and map the behavior graph to be tested to the vector space, and detect whether the multiple behavior vectors to be tested corresponding to the behavior graph to be tested in the vector space are in the benign behavior cluster, so as to perform manual inspection and abnormality judgment operations on the behavior instances to be tested corresponding to the behavior vectors to be tested that are not in the benign behavior cluster, and update the feedback benign behavior cluster. This application models and represents the smart home system at the user behavior level and uses behavioral context information to improve the accuracy of classification and anomaly detection, so that it can be effectively applied in security scenarios such as log auditing and anomaly detection.

[0112] Figure 7 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. The electronic device may include:

[0113] A memory 701 , a processor 702 , and a computer program stored in the memory 701 and executable on the processor 702 .

[0114] When the processor 702 executes the program, the smart home behavior classification and anomaly detection method provided in the above embodiment is implemented.

[0115] Furthermore, the electronic device further comprises:

[0116] The communication interface 703 is used for communication between the memory 701 and the processor 702 .

[0117] The memory 701 is used to store computer programs that can be executed on the processor 702 .

[0118] The memory 701 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.

[0119] If the memory 701, the processor 702 and the communication interface 703 are implemented independently, the communication interface 703, the memory 701 and the processor 702 can be connected to each other through a bus and communicate with each other. The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component (PCI) bus or an Extended Industry Standard Architecture (EISA) bus. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 7 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0120] Optionally, in a specific implementation, if the memory 701, the processor 702 and the communication interface 703 are integrated on a chip, the memory 701, the processor 702 and the communication interface 703 can communicate with each other through an internal interface.

[0121] The processor 702 may be a central processing unit (CPU), or an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present application.

[0122] An embodiment of the present application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the above-mentioned smart home behavior classification and anomaly detection method.

[0123] An embodiment of the present application also provides a computer program product, including a computer program, which, when executed, is used to implement the above-mentioned smart home behavior classification and anomaly detection method.

[0124] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or N embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradiction.

[0125] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include at least one of the features. In the description of this application, "N" means at least two, such as two, three, etc., unless otherwise clearly and specifically defined.

[0126] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, fragment or portion of code comprising one or N executable instructions for implementing the steps of a custom logical function or process, and the scope of the preferred embodiments of the present application includes alternative implementations in which functions may not be performed in the order shown or discussed, including performing functions in a substantially simultaneous manner or in reverse order depending on the functions involved, which should be understood by technicians in the technical field to which the embodiments of the present application belong.

[0127] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in combination with these instruction execution systems, devices or apparatuses. For the purpose of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in combination with these instruction execution systems, devices or apparatuses. More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or N wirings (electronic devices), a portable computer disk box (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), a fiber optic device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically by optically scanning the paper or other medium and then editing, interpreting or processing in other suitable ways as necessary and then storing it in a computer memory.

[0128] It should be understood that the various parts of the present application can be implemented by hardware, software, firmware or a combination thereof. In the above embodiment, the N steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. If implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0129] A person skilled in the art may understand that all or part of the steps in the method for implementing the above-mentioned embodiment may be completed by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, which, when executed, includes one or a combination of the steps of the method embodiment.

[0130] In addition, each functional unit in each embodiment of the present application may be integrated into a processing module, or each unit may exist physically separately, or two or more units may be integrated into one module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of a software functional module. If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it may also be stored in a computer-readable storage medium.

[0131] The storage medium mentioned above may be a read-only memory, a magnetic disk or an optical disk, etc. Although the embodiments of the present application have been shown and described above, it can be understood that the above embodiments are exemplary and cannot be understood as limiting the present application. A person of ordinary skill in the art may change, modify, replace and modify the above embodiments within the scope of the present application.

Claims

1. A smart home behavior classification and anomaly detection method, characterized in that: The following steps are involved: Dividing a target smart home event log corresponding to a target smart home system to obtain a plurality of user behavior instances, and performing noise reduction on the plurality of user behavior instances to generate a plurality of noise-reduced user behavior instances; Constructing a behavior graph corresponding to each of the multiple denoising user behavior instances, and mapping the benign behavior graph corresponding to each benign denoising user behavior instance in the multiple denoising user behavior instances to a vector space based on a preset translation embedding model, and clustering the benign behavior graph corresponding to each benign denoising user behavior instance in the vector space to generate a plurality of benign behavior clusters that meet preset semantic requirements; A test behavior graph corresponding to the target test behavior is constructed, and the test behavior graph is mapped into the vector space, and it is detected whether a plurality of test behavior vectors corresponding to the test behavior graph in the vector space are in the benign behavior cluster, so as to perform manual inspection and abnormality determination operations on the test behavior instances corresponding to the test behavior vectors that are not in the benign behavior cluster, so as to obtain abnormality determination results, and based on the abnormality determination results, the benign behavior cluster is fed back and updated.

2. The method according to claim 1, characterized in that The step of dividing the target smart home event log corresponding to the target smart home system to obtain a plurality of user behavior instances, and performing noise reduction on the plurality of user behavior instances to generate a plurality of noise-reduced user behavior instances includes: Based on a preset cloud platform, a smart home event log including a target smart home system state change entry is obtained, wherein the target smart home system state change entry includes a timestamp, a device name, and a device state; Acquire a smart home device plan view corresponding to the target smart home system, construct a distance matrix with position semantic relationships according to the smart home device plan view, and determine a division time threshold corresponding to the target smart home event log; An initial event window corresponding to the smart home event log is determined, and based on the distance matrix and the division time threshold, the initial event window is dynamically expanded and denoised to generate the plurality of denoised user behavior instances.

3. The method according to claim 2, characterized in that The constructing a behavior graph corresponding to each noise reduction user behavior instance in the plurality of noise reduction user behavior instances includes: Based on the target smart home system and the device status, determining the node information of the behavior graph, and obtaining the event relationship in each noise reduction user behavior instance, so as to determine the edge information of the behavior graph through the event relationship; A behavior graph corresponding to each noise reduction user behavior instance is constructed according to the node information and the edge information.

4. The method according to claim 3, characterized in that The method based on the preset translation embedding model maps the benign behavior graph corresponding to each benign denoising user behavior instance in the multiple denoising user behavior instances to a vector space, and clusters the benign behavior graph corresponding to each benign denoising user behavior instance in the vector space to generate multiple benign behavior clusters that meet preset semantic requirements, including: Traversing the benign behavior graph corresponding to each benign noise reduction user behavior instance to obtain a set of triples corresponding to each benign behavior graph; Based on the translation embedding model, mapping the triple set to the vector space, and performing a weighted sum operation on the triple set to obtain a benign behavior instance vector corresponding to each benign behavior graph; The benign behavior instance vector corresponding to each benign noise reduction user behavior instance is clustered to generate the multiple benign behavior clusters.

5. The method according to claim 4, characterized in that The step of constructing a behavior graph to be tested corresponding to the target behavior to be tested, mapping the behavior graph to be tested into the vector space, and detecting whether a plurality of behavior vectors to be tested corresponding to the behavior graph to be tested in the vector space are in the benign behavior cluster, so as to manually check and perform abnormality determination operations on behavior instances to be tested corresponding to the behavior vectors to be tested that are not in the benign behavior cluster, so as to obtain abnormality determination results, and based on the abnormality determination results, providing feedback to update the benign behavior cluster, includes: Obtaining log information corresponding to the target behavior to be tested, dividing the log information to generate a plurality of user behavior instances to be tested corresponding to the target behavior to be tested, and performing noise reduction on the plurality of user behavior instances to be tested to generate a plurality of noise-reduced user behavior instances to be tested; Constructing a behavior graph to be tested corresponding to each noise reduction user behavior instance to be tested in the multiple noise reduction user behavior instances to be tested, and mapping the behavior graph to be tested to the vector space to obtain a behavior instance vector to be tested corresponding to each noise reduction user behavior instance to be tested; Calculating the cosine distance between each behavior instance vector to be tested and the centroid of each benign behavior cluster in the multiple benign behavior clusters, and determining whether the cosine distance between each behavior instance vector to be tested and the centroids of all benign behavior clusters is greater than a preset distance threshold; If the cosine distances between the behavior instance vector to be tested and the centroids of all benign behavior clusters are greater than the distance threshold, a manual inspection and abnormality determination operation is performed on the behavior instance to be tested corresponding to the behavior instance vector to obtain the abnormality determination result, and when the abnormality determination result of the behavior instance to be tested is benign, the behavior instance to be tested is updated to the benign behavior cluster to generate a new benign behavior cluster; If there is at least one target cosine distance less than or equal to the distance threshold among the cosine distances between the behavior instance vector to be tested and the centroids of all benign behavior clusters, the minimum target cosine distance among all target cosine distances and the target benign behavior cluster corresponding to the minimum target cosine distance are determined, and the behavior instance to be tested corresponding to the behavior instance vector to be tested is determined to be the benign behavior corresponding to the target benign behavior cluster.

6. A smart home behavior classification and anomaly detection device, characterized in that: include: A partitioning module, configured to partition a target smart home event log corresponding to a target smart home system to obtain a plurality of user behavior instances, and denoise the plurality of user behavior instances to generate a plurality of denoised user behavior instances; a clustering module, configured to construct a behavior graph corresponding to each of the multiple denoising user behavior instances, and based on a preset translation embedding model, map the benign behavior graph corresponding to each benign denoising user behavior instance in the multiple denoising user behavior instances to a vector space, and cluster the benign behavior graph corresponding to each benign denoising user behavior instance in the vector space to generate a plurality of benign behavior clusters that meet preset semantic requirements; A detection module is used to construct a test behavior graph corresponding to the target test behavior, and map the test behavior graph to the vector space, and detect whether a plurality of test behavior vectors corresponding to the test behavior graph in the vector space are in the benign behavior cluster, so as to perform manual inspection and abnormality determination operations on the test behavior instances corresponding to the test behavior vectors that are not in the benign behavior cluster, so as to obtain abnormality determination results, and based on the abnormality determination results, feedback to update the benign behavior cluster.

7. The device according to claim 6, characterized in that The division module comprises: A first acquisition unit is used to acquire a smart home event log including a target smart home system state change entry based on a preset cloud platform, wherein the target smart home system state change entry includes a timestamp, a device name, and a device state; A second acquisition unit is used to acquire a smart home device plan view corresponding to the target smart home system, and construct a distance matrix with position semantic relationship according to the smart home device plan view, and determine a division time threshold corresponding to the target smart home event log; A generating unit is used to determine an initial event window corresponding to the smart home event log, and dynamically expand and denoise the initial event window based on the distance matrix and the division time threshold to generate the multiple denoised user behavior instances.

8. An electronic device, characterized in that: include: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the smart home behavior classification and anomaly detection method as described in any one of claims 1 to 5.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: The program is executed by a processor to implement the smart home behavior classification and anomaly detection method as described in any one of claims 1 to 5.

10. A computer program product, comprising a computer program, characterized in that The computer program is executed to implement the smart home behavior classification and anomaly detection method as described in any one of claims 1-5.

Images