Smart home behavior classification and anomaly detection method and device

Abstract

The application relates to a smart home behavior classification and anomaly detection method and device, wherein the method comprises the following steps: dividing smart home event logs according to time and space relations, forming different event sequence segments, that is, different user behavior instances, and carrying out noise reduction processing; representing the user behavior instances as graph structures to describe the complex interaction relationship between events in one behavior; mapping the behavior graph of a benign behavior instance to a vector space through a translation-based embedding model to obtain a benign behavior cluster with similar semantics through clustering; for a to-be-detected behavior, representing the to-be-detected behavior as a graph structure and mapping the to-be-detected behavior to the vector space, detecting whether the to-be-detected behavior vector falls in the benign behavior cluster, manually checking and abnormally judging outliers, and updating and feeding back the benign behavior cluster. Thus, the problems in the prior art, such as limited feature expression of a traditional method, lack of high-order semantic understanding, and difficulty in capturing key semantics of behaviors while tolerating non-key subtle changes, are solved.

Description

Technical Field

[0001] This application relates to the fields of computer and information security technology, and in particular to a method and device for classifying and detecting abnormal behavior in smart homes. Background Technology

[0002] By deploying various sensors, controllers, and automation devices in the home, users can remotely manage and control devices such as lights, air conditioners, and door locks, achieving highly intelligent home management. These devices and sensors not only complete tasks according to predetermined automation rules but also collect and generate large amounts of log data in real time based on user behavior and environmental changes. The log data includes multi-dimensional information such as device operating status, user interactions, and environmental parameters, meticulously recording complex operational processes and user habits within the home. As the number of devices and sensors continues to increase, these logs exhibit complex and diverse characteristics.

[0003] Furthermore, in smart home scenarios, different users often set various personalized automation rules based on their own needs and preferences. For example, users can set specific time periods to automatically adjust light brightness or automatically control the operation of air conditioners based on changes in indoor and outdoor temperatures. These personalized automation rules and diverse user behavior patterns make log data more complex and difficult to analyze. Faced with this complex data environment, how to efficiently analyze and utilize this massive amount of log data, especially accurately interpreting users' daily behavior patterns and promptly identifying potential anomalies such as device malfunctions and unauthorized intrusions, has become an important topic and challenge in current smart home research.

[0004] Existing research on anomaly or intrusion detection in smart homes is mainly divided into event-relationship-based methods and user behavior-based methods. Event-relationship-based methods can effectively capture attacks that directly control devices by detecting causal relationships between events; however, these methods may be bypassed when attackers inject a series of logically plausible false events into the network, leading to missed detections. At the same time, event-relationship-based methods cannot extract more complex behavioral context semantics, resulting in poor anomaly detection performance.

[0005] User behavior-based methods learn the system's historical behavior patterns to predict future event sequences and detect anomalies based on whether the actual event sequences match the predictions. However, smart home systems have complex and varied behavior patterns, and similar but not identical event sequences may represent the same user behavior. Therefore, existing user behavior-based methods often lead to a high false alarm rate, which urgently needs to be addressed. Summary of the Invention

[0006] This application provides a method and apparatus for classifying and detecting abnormal behavior in smart homes, in order to solve the problems of limited feature expression, lack of high-order semantic understanding, and difficulty in capturing key semantics of behavior while tolerating non-critical subtle changes in the existing technology.

[0007] The first aspect of this application provides a method for classifying and detecting anomalies in smart home behavior, comprising the following steps: dividing the target smart home event logs corresponding to the target smart home system to obtain multiple user behavior instances, and denoising the multiple user behavior instances to generate multiple denoised user behavior instances; constructing a behavior graph corresponding to each of the multiple denoised user behavior instances, and mapping the benign behavior graph corresponding to each benign denoised user behavior instance in the multiple denoised user behavior instances to a vector space based on a preset translation embedding model, and clustering the benign behavior graph corresponding to each benign denoised user behavior instance in the vector space to generate multiple benign behavior clusters that meet preset semantic requirements; constructing a test behavior graph corresponding to the target test behavior, and mapping the test behavior graph to the vector space, and detecting whether the multiple test behavior vectors corresponding to the test behavior graph in the vector space are in the benign behavior clusters, so as to perform manual inspection and anomaly judgment operations on the test behavior instances corresponding to the test behavior vectors that are not in the benign behavior clusters, so as to obtain anomaly judgment results, and update the benign behavior clusters based on the anomaly judgment results.

[0008] Optionally, in one embodiment of this application, the step of dividing the target smart home event log corresponding to the target smart home system to obtain multiple user behavior instances, and denoising the multiple user behavior instances to generate multiple denoised user behavior instances, includes: acquiring a smart home event log containing state change entries of the target smart home system based on a preset cloud platform, wherein the state change entries of the target smart home system include timestamps, device names, and device states; acquiring a smart home device floor plan corresponding to the target smart home system, constructing a distance matrix with location semantic relationships based on the smart home device floor plan, and determining a division time threshold corresponding to the target smart home event log; determining an initial event window corresponding to the smart home event log, and dynamically expanding and denoising the initial event window based on the distance matrix and the division time threshold to generate the multiple denoised user behavior instances.

[0009] Optionally, in one embodiment of this application, constructing the behavior graph corresponding to each of the plurality of noise-reduced user behavior instances includes: determining the node information of the behavior graph based on the target smart home system and the device state, and obtaining the event relationships in each noise-reduced user behavior instance to determine the edge information of the behavior graph through the event relationships; and constructing the behavior graph corresponding to each noise-reduced user behavior instance based on the node information and the edge information.

[0010] Optionally, in one embodiment of this application, the step of mapping the benign behavior graph corresponding to each benign noise-reduced user behavior instance among the plurality of noise-reduced user behavior instances to a vector space based on a preset translation embedding model, and clustering the benign behavior graph corresponding to each benign noise-reduced user behavior instance in the vector space to generate a plurality of benign behavior clusters that meet preset semantic requirements, includes: traversing the benign behavior graph corresponding to each benign noise-reduced user behavior instance to obtain a set of triples corresponding to each benign behavior graph; mapping the set of triples to the vector space based on the translation embedding model, and performing a weighted summation operation on the set of triples to obtain a benign behavior instance vector corresponding to each benign behavior graph; and clustering the benign behavior instance vector corresponding to each benign noise-reduced user behavior instance to generate the plurality of benign behavior clusters.

[0011] Optionally, in one embodiment of this application, the step of constructing a test behavior graph corresponding to the target test behavior, mapping the test behavior graph to the vector space, and detecting whether multiple test behavior vectors corresponding to the test behavior graph in the vector space are in the benign behavior cluster, so as to perform manual inspection and anomaly judgment operations on the test behavior instances corresponding to the test behavior vectors not in the benign behavior cluster, to obtain anomaly judgment results, and based on the anomaly judgment results, to update the benign behavior cluster, includes: obtaining log information corresponding to the target test behavior, and dividing the log information to generate multiple test user behavior instances corresponding to the target test behavior, and denoising the multiple test user behavior instances to generate multiple denoised test user behavior instances; constructing a test behavior graph corresponding to each denoised test user behavior instance in the multiple denoised test user behavior instances, and mapping the test behavior graph to the vector space to obtain the test behavior instance vector corresponding to each denoised test user behavior instance; calculating each The cosine distance between the vector of the behavior to be tested and the centroid of each of the multiple benign behavior clusters is determined, and it is determined whether the cosine distance between each vector of the behavior to be tested and the centroid of all benign behavior clusters is greater than a preset distance threshold. If the cosine distance between the vector of the behavior to be tested and the centroid of all benign behavior clusters is greater than the distance threshold, then the behavior to be tested corresponding to the vector of the behavior to be tested is manually checked and an anomaly is determined to obtain the anomaly determination result. When the anomaly determination result of the behavior to be tested is benign, the behavior to be tested is updated to the benign behavior cluster to generate a new benign behavior cluster. If there is at least one target cosine distance less than or equal to the distance threshold among the cosine distances between the vector of the behavior to be tested and the centroid of all benign behavior clusters, then the minimum target cosine distance among all target cosine distances and the target benign behavior cluster corresponding to the minimum target cosine distance are determined, and the behavior to be tested corresponding to the vector of the behavior to be tested is determined to be the benign behavior corresponding to the target benign behavior cluster.

[0012] A second aspect of this application provides a smart home behavior classification and anomaly detection device, comprising: a segmentation module, used to segment target smart home event logs corresponding to a target smart home system to obtain multiple user behavior instances, and to denoise the multiple user behavior instances to generate multiple denoised user behavior instances; and a clustering module, used to construct a behavior graph corresponding to each denoised user behavior instance among the multiple denoised user behavior instances, and based on a preset translation embedding model, to map the benign behavior graph corresponding to each benign denoised user behavior instance among the multiple denoised user behavior instances to a vector space, and to cluster the vector... The benign behavior graph corresponding to each benign noise reduction user behavior instance in the space is clustered to generate multiple benign behavior clusters that meet preset semantic requirements; the detection module is used to construct the test behavior graph corresponding to the target test behavior, and map the test behavior graph to the vector space, and detect whether multiple test behavior vectors corresponding to the test behavior graph in the vector space are in the benign behavior clusters, so as to perform manual inspection and anomaly judgment operation on the test behavior instances corresponding to the test behavior vectors that are not in the benign behavior clusters, so as to obtain anomaly judgment results, and based on the anomaly judgment results, update the benign behavior clusters.

[0013] Optionally, in one embodiment of this application, the segmentation module includes: a first acquisition unit, configured to acquire a smart home event log containing state change entries of a target smart home system based on a preset cloud platform, wherein the state change entries of the target smart home system include a timestamp, device name, and device status; a second acquisition unit, configured to acquire a smart home device floor plan corresponding to the target smart home system, construct a distance matrix with location semantic relationships based on the smart home device floor plan, and determine a segmentation time threshold corresponding to the target smart home event log; and a generation unit, configured to determine an initial event window corresponding to the smart home event log, and dynamically expand and denoise the initial event window based on the distance matrix and the segmentation time threshold to generate the plurality of denoised user behavior instances.

[0014] Optionally, in one embodiment of this application, the clustering module includes: a determining unit, configured to determine the node information of the behavior graph based on the target smart home system and the device state, and obtain the event relationships in each noise-reduced user behavior instance, so as to determine the edge information of the behavior graph through the event relationships; and a graphing unit, configured to construct the behavior graph corresponding to each noise-reduced user behavior instance based on the node information and the edge information.

[0015] Optionally, in one embodiment of this application, the clustering module further includes: a traversal unit, configured to traverse the benign behavior graph corresponding to each benign noise reduction user behavior instance to obtain a set of triples corresponding to each benign behavior graph; a weighted summation unit, configured to map the set of triples to the vector space based on the translation embedding model, and perform a weighted summation operation on the set of triples to obtain a benign behavior instance vector corresponding to each benign behavior graph; and a clustering unit, configured to cluster the benign behavior instance vector corresponding to each benign noise reduction user behavior instance to generate the plurality of benign behavior clusters.

[0016] Optionally, in one embodiment of this application, the detection module includes: a noise reduction unit, configured to acquire log information corresponding to the target test behavior, and segment the log information to generate multiple test user behavior instances corresponding to the target test behavior, and perform noise reduction on the multiple test user behavior instances to generate multiple noise-reduced test user behavior instances; a mapping unit, configured to construct a test behavior graph corresponding to each of the multiple noise-reduced test user behavior instances, and map the test behavior graph to the vector space to obtain a test behavior instance vector corresponding to each noise-reduced test user behavior instance; and a calculation unit, configured to calculate the cosine distance between each test behavior instance vector and the centroid of each benign behavior cluster in the multiple benign behavior clusters, and determine whether the cosine distance between each test behavior instance vector and the centroids of all benign behavior clusters is greater than a preset value. The system comprises: a distance threshold; a first analysis unit, configured to perform manual inspection and anomaly determination on the behavior instance corresponding to the behavior instance vector if the cosine distance between the behavior instance vector to be tested and the centroids of all benign behavior clusters is greater than the distance threshold, to obtain the anomaly determination result, and to update the behavior instance to be tested into the benign behavior cluster when the anomaly determination result of the behavior instance to be tested is benign, thereby generating a new benign behavior cluster; and a second analysis unit, configured to determine the minimum target cosine distance and the target benign behavior cluster corresponding to the minimum target cosine distance among all target cosine distances if there is at least one target cosine distance less than or equal to the distance threshold among the cosine distances between the behavior instance vector to be tested and the centroids of all benign behavior clusters, and to determine that the behavior instance to be tested corresponding to the behavior instance vector to be tested is the benign behavior corresponding to the target benign behavior cluster.

[0017] A third aspect of this application provides an electronic device, including: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the smart home behavior classification and anomaly detection method as described in the above embodiments.

[0018] A fourth aspect of this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described smart home behavior classification and anomaly detection method.

[0019] A fifth aspect of this application provides a computer program product, including a computer program that is executed to implement the above-described smart home behavior classification and anomaly detection method.

[0020] Therefore, the embodiments of this application have the following beneficial effects: The embodiments of this application can obtain multiple user behavior instances by dividing the target smart home event logs corresponding to the target smart home system, and denoise the multiple user behavior instances to generate multiple denoised user behavior instances; construct a behavior graph corresponding to each denoised user behavior instance in the multiple denoised user behavior instances, and based on a preset translation embedding model, map the benign behavior graph corresponding to each benign denoised user behavior instance in the multiple denoised user behavior instances to a vector space, and cluster the benign behavior graph corresponding to each benign denoised user behavior instance in the vector space to generate multiple benign behavior clusters that meet preset semantic requirements; construct a test behavior graph corresponding to the target test behavior, and map the test behavior graph to the vector space, and detect whether the multiple test behavior vectors corresponding to the test behavior graph in the vector space are in benign behavior clusters, so as to perform manual inspection and anomaly judgment operations on the test behavior instances corresponding to the test behavior vectors that are not in benign behavior clusters, and update and feed back the benign behavior clusters. This application models and represents smart home systems at the user behavior level and utilizes behavioral context information to improve the accuracy of classification and anomaly detection, thus enabling effective application in security scenarios such as log auditing and anomaly detection. This solves the problems of limited feature representation, lack of high-order semantic understanding, and difficulty in capturing key behavioral semantics while tolerating non-critical subtle changes in existing technologies.

[0021] Additional aspects and advantages of this application will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of this application. Attached Figure Description

[0022] The above and / or additional aspects and advantages of this application will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein: Figure 1 This is a flowchart of a smart home behavior classification and anomaly detection method provided according to an embodiment of this application; Figure 2 A schematic diagram illustrating the execution flow of a behavior segmentation and noise reduction algorithm provided in one embodiment of this application; Figure 3A schematic diagram of the execution flow of a numerical device interval partitioning algorithm is provided as an embodiment of this application; Figure 4 A schematic diagram of a behavior graph example provided for one embodiment of this application; Figure 5 A schematic diagram illustrating the execution logic of a smart home behavior classification and anomaly detection method provided in one embodiment of this application; Figure 6 This is an example diagram of a smart home behavior classification and anomaly detection device according to an embodiment of this application; Figure 7 The present application provides a schematic diagram of the structure of an electronic device.

[0023] Among them, 10-Smart home behavior classification and anomaly detection device; 100-Division module, 200-Clustering module, 300-Detection module; 701-Memory, 702-Processor, 703-Communication interface. Detailed Implementation

[0024] The embodiments of this application are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain this application, and should not be construed as limiting this application.

[0025] The following describes a method and apparatus for classifying and detecting abnormal behavior in smart homes, based on embodiments of this application, with reference to the accompanying drawings. To address the problems mentioned in the background technology, this application provides a method for smart home behavior classification and anomaly detection. In this method, multiple user behavior instances are obtained by dividing the target smart home event logs corresponding to the target smart home system. These instances are then denoised to generate multiple denoised user behavior instances. A behavior graph is constructed for each denoised user behavior instance. Based on a preset translation embedding model, the benign behavior graph corresponding to each benign denoised user behavior instance is mapped to a vector space. The benign behavior graphs corresponding to each benign denoised user behavior instance in the vector space are then clustered to generate multiple benign behavior clusters that meet preset semantic requirements. A test behavior graph is constructed corresponding to the target test behavior, and this graph is mapped to the vector space. The method then detects whether multiple test behavior vectors corresponding to the test behavior graph in the vector space are within benign behavior clusters. Test behavior instances corresponding to test behavior vectors not within benign behavior clusters are manually checked and anomaly determined, and the benign behavior clusters are updated and fed back. This application models and represents smart home systems at the user behavior level and utilizes behavioral context information to improve the accuracy of classification and anomaly detection, thus enabling effective application in security scenarios such as log auditing and anomaly detection. This solves the problems of limited feature representation, lack of high-order semantic understanding, and difficulty in capturing key behavioral semantics while tolerating non-critical subtle changes in existing technologies.

[0026] Specifically, Figure 1 This is a flowchart illustrating a smart home behavior classification and anomaly detection method provided in an embodiment of this application.

[0027] like Figure 1 As shown, the smart home behavior classification and anomaly detection method includes the following steps: In step S101, the target smart home event log corresponding to the target smart home system is divided to obtain multiple user behavior instances, and the multiple user behavior instances are denoised to generate multiple denoised user behavior instances.

[0028] Those skilled in the art should understand that smart home systems can continuously monitor and record various activities and states in the home by integrating multiple devices and sensors. Logs, as an important data source for smart home systems, can reflect the daily behavioral characteristics of users.

[0029] Therefore, embodiments of this application can take the smart home environment and logs as the research object, and divide the smart home event logs according to the relationship between time and space to form different event sequence segments, i.e. different user behavior instances, and perform noise reduction processing on them to generate multiple noise-reduced user behavior instances.

[0030] Therefore, the embodiments of this application provide reliable data support for the modeling and analysis of user behavior reflected in the logs by dividing the smart home event logs and combining them with corresponding noise reduction processing strategies.

[0031] Optionally, in one embodiment of this application, the target smart home event log corresponding to the target smart home system is segmented to obtain multiple user behavior instances, and the multiple user behavior instances are denoised to generate multiple denoised user behavior instances. This includes: obtaining smart home event logs containing state change entries of the target smart home system based on a preset cloud platform, wherein the state change entries of the target smart home system include timestamps, device names, and device states; obtaining a smart home device floor plan corresponding to the target smart home system, constructing a distance matrix with location semantic relationships based on the smart home device floor plan, and determining a segmentation time threshold corresponding to the target smart home event logs; determining an initial event window corresponding to the smart home event logs, and dynamically expanding and denoising the initial event window based on the distance matrix and the segmentation time threshold to generate multiple denoised user behavior instances.

[0032] It should be noted that the embodiments of this application can export smart home event logs containing state change entries of the target smart home system from the cloud platform. The state change entries of the smart home system mainly include attributes such as timestamp, device name, and device status. The device status can be a binary state of "on" or "off", or a real-valued state with continuous space.

[0033] For a complete smart home log, embodiments of this application first need to divide it into different behavioral segments. In actual implementation, embodiments of this application can construct a spatial location matrix (i.e., a distance matrix) with location semantic relationships using a smart home floor plan. And select the time threshold for partitioning behavior instances, where, This indicates the total number of devices in the smart home environment. and equipment If adjacent or in the same area, then ;on the contrary, .

[0034] Secondly, such as Figure 2 As shown, embodiments of this application can select the initial window size of the initial event window, find the main device entities in the window, and utilize the distance matrix. Irrelevant sensor readings are removed as noise, and the initial event window is dynamically expanded using spatiotemporal information, with the window size expanding line by line. If the time difference between the preceding and following logs is greater than the time threshold or the location of the main device entity changes, it is divided into event sequence segments of varying lengths, i.e., different noise-reduced user behavior instances.

[0035] In step S102, a behavior graph corresponding to each noise-reduced user behavior instance in multiple noise-reduced user behavior instances is constructed. Based on a preset translation embedding model, the benign behavior graph corresponding to each benign noise-reduced user behavior instance in multiple noise-reduced user behavior instances is mapped to a vector space. Furthermore, the benign behavior graph corresponding to each benign noise-reduced user behavior instance in the vector space is clustered to generate multiple benign behavior clusters that meet preset semantic requirements.

[0036] Furthermore, embodiments of this application also require representing user behavior instances as graph structures to describe the complex interaction relationships between events in a single behavior; subsequently, embodiments of this application also require mapping the benign behavior graph of each benign denoised user behavior instance to a vector space based on the translation embedding model, and obtaining multiple benign behavior clusters with similar semantics through clustering operations.

[0037] Optionally, in one embodiment of this application, constructing a behavior graph corresponding to each noise-reduced user behavior instance among multiple noise-reduced user behavior instances includes: determining the node information of the behavior graph based on the target smart home system and device status, and obtaining the event relationships in each noise-reduced user behavior instance to determine the edge information of the behavior graph through the event relationships; and constructing a behavior graph corresponding to each noise-reduced user behavior instance based on the node information and edge information.

[0038] In the embodiments of this application, the behavior graph corresponding to the above-mentioned noise reduction user behavior instance represents the graph structure of a behavior instance, which mainly includes nodes composed of devices and state values ​​and edges representing the relationship between events.

[0039] It should be noted that if the device state space is numerical, then the numerical values ​​are mapped to finite states through density estimation and interval partitioning; the semantics of the edges not only include the outgoing node device and state, but also the relationship between outgoing and incoming nodes triggered by rules or actively changed by the user.

[0040] In specific implementation, embodiments of this application can treat "a change in the state of a device" in the smart home log as an event, using a triplet. To indicate, that is, in time ,equipment The state has changed to Therefore, this application defines a behavior as a combination of a series of event sequences in the log within a specific time period, and utilizes a directed graph. Describe a behavior, and Let these represent the sets of nodes and edges, respectively. Each edge is mapped to two ordered nodes; in this embodiment of the application, nodes are used as the basis for mapping. An edge represents an event in a behavior. Edges describe the relationship between two nodes. Based on the relationship between the ingress and egress nodes, edges are divided into two categories: edges triggered by rules and edges that occur in sequence. Edges triggered by rules indicate that the occurrence of an ingress node event leads to the occurrence of an egress node event through an automated rule. Edges that occur in sequence indicate that the ingress and egress nodes of the edge have a sequential relationship, that is, the order of different events in the user behavior.

[0041] Optionally, in one embodiment of this application, based on a preset translation embedding model, the benign behavior graph corresponding to each benign noise-reduced user behavior instance in multiple noise-reduced user behavior instances is mapped to a vector space, and the benign behavior graph corresponding to each benign noise-reduced user behavior instance in the vector space is clustered to generate multiple benign behavior clusters that meet preset semantic requirements. This includes: traversing the benign behavior graph corresponding to each benign noise-reduced user behavior instance to obtain a set of triples corresponding to each benign behavior graph; based on the translation embedding model, mapping the set of triples to a vector space, and performing a weighted summation operation on the set of triples to obtain a benign behavior instance vector corresponding to each benign behavior graph; and clustering the benign behavior instance vector corresponding to each benign noise-reduced user behavior instance to generate multiple benign behavior clusters.

[0042] In actual implementation, to prevent the state space from exploding during the subsequent node embedding stage, this application embodiment needs to map the numerical device values ​​in the log to a finite state space.

[0043] Specifically, for each numerical device value in the log, its probability distribution curve is plotted using kernel density estimation, and the valley point is found as the initial interval partitioning point. Then, each group of adjacent intervals is traversed. If the average density of neighboring intervals is similar and their ranges are both small, they can be merged into one interval. The numerical interval partitioning algorithm is as follows: Figure 3 As shown. Therefore, the values ​​of numerical devices can be mapped to a finite space; for example, the value range of a temperature sensor's state is... This algorithm can map its state to a set. middle.

[0044] It's important to note that the initial node of the behavior graph marks the start of a behavior, and subsequent nodes are divided into different "channels" to enhance semantic representation. For example, events such as a user actively turning a device on or off, triggering a motion sensor, are classified as a "physical channel," while changes in temperature are classified as a "temperature channel," and similarly, there is a "humidity channel," etc. Nodes within each channel are connected by edges, representing the sequence of events. Channels are also connected by edges due to interactions between rules or the environment. For instance, the smart home automation rule reflected in the logs: "If the temperature is above 30 degrees, turn on the air conditioner," connects the physical channel node (air conditioner, on) and the temperature channel node (temperature sensor, high) with the edge "trigger-turn on air conditioner." An example of a behavior graph is... Figure 4 As shown, this behavior graph represents an instance of a user taking a shower, where the smart home entities involved include: bathroom light ( ), motion sensor ( ), temperature sensor ( ), humidity sensor ( ), vanity light ( ), exhaust fan ( )wait.

[0045] For each benign behavior diagram The embodiments of this application can use triples ( , ) serves as the primitive of each behavior graph, where, and These are the head node and tail node of the primitive, respectively. An edge connecting these two nodes represents the relationship between the head and tail nodes, such as... Figure 4 As shown in the dashed box. A depth-first search of the graph is used to obtain all triples appearing in each graph. A translation-based embedding (TransE) model is then used to map entities (nodes) and relations (edges) in the behavioral graph to a low-dimensional vector space. TransE assumes that each triple... The following relationship is satisfied in the vector space:

[0046] in, , and Head nodes ,side Tail node The embedding vector.

[0047] Specifically, in this embodiment, the types of nodes and edges appearing in all behavioral graphs are first counted, and one-hot encoding is used to initialize all nodes and edges. For example, if all graphs contain two triples... There are a total of 5 types of nodes and edges, so let And so on; to obtain the final embedding representation of nodes and edges, iteratively optimize the following objective function:

[0048] in, A collection of behavioral graphs. For entities in the diagram The embedding vectors corresponding to each node or edge are ultimately generated from this optimization result. An embedding vector of dimension, that is, a triple can be represented by concatenation as dimensional vector .

[0049] Furthermore, considering that events in a behavior contribute differently to its importance, a behavior graph can be represented by the embedding vectors of all triples appearing in a weighted cumulative graph. Therefore, in this embodiment, inverse text frequency can be used as the weighting coefficient, as shown in the following formula:

[0050] in, Represents a triplet The number of times the corresponding event appears in the entire log. The embedding vector represents the total number of events in the entire log, hence the embedding vector corresponding to a behavior graph. It can be represented as:

[0051] Subsequently, embodiments of this application can be based on all benign behavior embedding vectors. The agglomerative hierarchical clustering method is used to aggregate vectors that are close in distance in space into different classes to represent benign behaviors with similar semantics. The specific process is as follows: 1. Starting with each behavior vector point as an independent cluster, calculate the distance between each cluster; find the two closest clusters and merge them into a new cluster; 2. Calculate the centroid of the new cluster and recalculate the distance between the new cluster and other clusters until the distance between any two clusters is less than the threshold or the maximum number of clusters is reached.

[0052] In specific implementation, embodiments of this application may use cosine distance as an index for evaluating the similarity of behavioral vectors, as shown in the following formula:

[0053] in, and These are the embedding vectors corresponding to the two behavior instances.

[0054] Understandably, the smaller the cosine distance, the higher the similarity between the two behavior vectors, meaning their semantics are closer. After obtaining multiple clusters of benign behaviors, the centroid of each cluster is recorded and used as a representative instance of that benign behavior for anomaly detection. The formula for calculating the cluster centroid is as follows:

[0055] in, Cluster The center of mass; For clusters The middle row is a vector representation of an instance.

[0056] In summary, the embodiments of this application can traverse the set of triples (node, edge, node) of each benign behavior graph, and map the triples to a vector space using a translation-based embedding model based on all nodes and edges that have appeared in the behavior graph. The vector representation of the behavior is obtained by weighted summation, and then a clustering method is used to divide the behavior instance vectors into different clusters based on distance. Each cluster contains all benign behavior instances with similar semantics and context, representing the same behavior. Thus, for each benign behavior cluster, its centroid is calculated as its representative behavior instance.

[0057] In step S103, a test behavior graph corresponding to the target test behavior is constructed, and the test behavior graph is mapped to a vector space. The test behavior vectors corresponding to the test behavior graph in the vector space are detected to see if they are in the benign behavior cluster. Manual inspection and anomaly judgment operations are performed on the test behavior instances corresponding to the test behavior vectors that are not in the benign behavior cluster to obtain the anomaly judgment result. Based on the anomaly judgment result, the benign behavior cluster is updated.

[0058] Furthermore, embodiments of this application can perform steps such as segmentation, noise reduction, graphing, and embedding on logs containing the behavior to be tested to obtain an embedded vector representation of the behavior instance to be tested. If a certain behavior vector to be tested is far from the centroid of any benign cluster, it is an outlier and will be manually checked: if it is a benign behavior, a new cluster will be added; otherwise, the behavior will be considered abnormal.

[0059] Therefore, the embodiments of this application can model and represent smart home systems at the user behavior level, and can be applied to security scenarios such as log auditing and anomaly detection. In addition, the embodiments of this application utilize behavioral context information to improve the accuracy of classification and anomaly detection, overcoming the difficulties of limited feature expression and lack of high-order semantic understanding in traditional methods. It can capture key semantics of behavior while tolerating subtle changes in "non-critical" aspects, and has the advantages of efficient anomaly identification, strong robustness, and strong adaptability.

[0060] Optionally, in one embodiment of this application, a test behavior graph corresponding to the target test behavior is constructed, and the test behavior graph is mapped to a vector space. The multiple test behavior vectors corresponding to the test behavior graph in the vector space are detected to see if they are in a benign behavior cluster. Manual checks and anomaly judgment operations are performed on the test behavior instances corresponding to test behavior vectors not in a benign behavior cluster to obtain anomaly judgment results. Based on the anomaly judgment results, the benign behavior cluster is updated. This includes: obtaining log information corresponding to the target test behavior, dividing the log information to generate multiple test user behavior instances corresponding to the target test behavior, and denoising the multiple test user behavior instances to generate multiple denoised test user behavior instances; constructing a test behavior graph corresponding to each denoised test user behavior instance in the multiple denoised test user behavior instances, and mapping the test behavior graph to a vector space to obtain a test behavior instance vector corresponding to each denoised test user behavior instance; calculating the test behavior instance vector for each denoised test user behavior instance; and calculating the test behavior instance vector for each denoised test user behavior instance. The test behavior instance vector is calculated to determine the cosine distance between itself and the centroid of each benign behavior cluster. It is then determined whether the cosine distance between each test behavior instance vector and the centroids of all benign behavior clusters is greater than a preset distance threshold. If the cosine distance between the test behavior instance vector and the centroids of all benign behavior clusters is greater than the distance threshold, the test behavior instance corresponding to the test behavior instance vector is manually inspected and anomaly determined to obtain an anomaly determination result. If the anomaly determination result of the test behavior instance is benign, the test behavior instance is updated to a benign behavior cluster to generate a new benign behavior cluster. If there is at least one target cosine distance less than or equal to the distance threshold among the cosine distances between the test behavior instance vector and the centroids of all benign behavior clusters, the minimum target cosine distance and the target benign behavior cluster corresponding to the minimum target cosine distance are determined, and the test behavior instance corresponding to the test behavior instance vector is determined to be a benign behavior corresponding to the target benign behavior cluster.

[0061] In actual implementation, this embodiment uses logs containing the behavior to be tested as input. After dividing, denoising, and representing them as a graph structure according to the aforementioned steps and mapping them to a vector space, the embedding vector of each behavior to be tested is compared with the centroid of a benign cluster. If the cosine distance between a certain instance vector of the behavior to be tested and the centroid of any benign cluster is greater than a distance threshold, then the corresponding instance of the behavior to be tested is marked as a suspicious behavior. Since the behavior represented by graph modeling and embedding is traceable, after manual review of the logs corresponding to suspicious behaviors, if the behavior is benign, it is recorded as a legitimate new cluster; otherwise, it is judged as abnormal.

[0062] Therefore, the embodiments of this application model user behavior in smart homes as a graph structure representation, and use a translation-based embedding model to obtain the embedding vector of the behavior. Finally, the behavior vectors are clustered according to distance, which can be well used for scenarios such as behavior auditing and anomaly detection.

[0063] The execution logic of the smart home behavior classification and anomaly detection method of this application is explained below with reference to the accompanying drawings.

[0064] Figure 5 This is a schematic diagram illustrating the execution logic of the smart home behavior classification and anomaly detection method of this application. Figure 5 As shown, the execution logic of the smart home behavior classification and anomaly detection method of this application is as follows: S501: Divide smart home event logs according to time and space relationships to form different event sequence segments, i.e. different user behavior instances, and perform noise reduction processing on them; S502: Represent user behavior instances as a graph structure to describe the complex interactive relationships between events in a single behavior; S503: Map the “behavior graph” of benign behavior instances to a vector space through a translation-based embedding model, and cluster them to obtain clusters of benign behaviors with similar semantics; S504: For the behavior to be tested, it is also represented as a graph structure and mapped to a vector space. Then, it is detected whether the vector of the behavior to be tested falls into the benign behavior cluster. Outliers are manually detected and anomalies are judged. Based on the anomaly judgment results, the benign behavior cluster is updated.

[0065] According to the smart home behavior classification and anomaly detection method proposed in this application, multiple user behavior instances are obtained by dividing the target smart home event logs corresponding to the target smart home system, and the multiple user behavior instances are denoised to generate multiple denoised user behavior instances; a behavior graph corresponding to each denoised user behavior instance is constructed, and based on a preset translation embedding model, the benign behavior graph corresponding to each benign denoised user behavior instance is mapped to a vector space, and the benign behavior graph corresponding to each benign denoised user behavior instance in the vector space is clustered to generate multiple benign behavior clusters that meet preset semantic requirements; a test behavior graph corresponding to the target test behavior is constructed, and the test behavior graph is mapped to the vector space, and it is detected whether the multiple test behavior vectors corresponding to the test behavior graph in the vector space are in benign behavior clusters, so that the test behavior instances corresponding to the test behavior vectors that are not in benign behavior clusters are manually checked and anomaly judged, and the benign behavior clusters are updated based on the anomaly judgment results. This application models and represents smart home systems at the user behavior level and utilizes behavioral context information to improve the accuracy of classification and anomaly detection, thereby making it effective for security scenarios such as log auditing and anomaly detection.

[0066] Secondly, the smart home behavior classification and anomaly detection device proposed according to the embodiments of this application is described with reference to the accompanying drawings.

[0067] Figure 6 This is a block diagram of a smart home behavior classification and anomaly detection device according to an embodiment of this application.

[0068] like Figure 6 As shown, the smart home behavior classification and anomaly detection device 10 includes: a segmentation module 100, a clustering module 200, and a detection module 300.

[0069] The segmentation module 100 is used to segment the target smart home event logs corresponding to the target smart home system to obtain multiple user behavior instances, and to denoise the multiple user behavior instances to generate multiple denoised user behavior instances.

[0070] The clustering module 200 is used to construct a behavior graph corresponding to each noise-reduced user behavior instance among multiple noise-reduced user behavior instances, and based on a preset translation embedding model, to map the benign behavior graph corresponding to each benign noise-reduced user behavior instance among multiple noise-reduced user behavior instances to a vector space, and to cluster the benign behavior graph corresponding to each benign noise-reduced user behavior instance in the vector space to generate multiple benign behavior clusters that meet preset semantic requirements.

[0071] The detection module 300 is used to construct a test behavior graph corresponding to the target test behavior, map the test behavior graph to a vector space, and detect whether multiple test behavior vectors corresponding to the test behavior graph in the vector space are in the benign behavior cluster. The test behavior instances corresponding to the test behavior vectors that are not in the benign behavior cluster are manually checked and anomaly judged to obtain anomaly judgment results. Based on the anomaly judgment results, the benign behavior cluster is updated.

[0072] Optionally, in one embodiment of this application, the partitioning module 100 includes: a first acquisition unit, a second acquisition unit, and a generation unit.

[0073] The first acquisition unit is used to acquire smart home event logs containing entries of state changes of the target smart home system based on a preset cloud platform. The entries of state changes of the target smart home system include timestamps, device names, and device status.

[0074] The second acquisition unit is used to acquire a floor plan of smart home devices corresponding to the target smart home system, construct a distance matrix with location semantic relationships based on the floor plan of smart home devices, and determine the segmentation time threshold corresponding to the event log of the target smart home.

[0075] The generation unit is used to determine the initial event window corresponding to the smart home event log, and to dynamically expand and denoise the initial event window based on the distance matrix and the time division threshold to generate multiple denoised user behavior instances.

[0076] Optionally, in one embodiment of this application, the clustering module 200 includes: a determination unit and a mapping unit.

[0077] The determining unit is used to determine the node information of the behavior graph based on the target smart home system and device status, and to obtain the event relationships in each noise-reduced user behavior instance, so as to determine the edge information of the behavior graph through the event relationships.

[0078] The graph construction unit is used to construct the behavior graph corresponding to each noise-reduced user behavior instance based on node and edge information.

[0079] Optionally, in one embodiment of this application, the clustering module 200 further includes: a traversal unit, a weighted summation unit, and a clustering unit.

[0080] The traversal unit is used to traverse the benign behavior graph corresponding to each benign noise reduction user behavior instance to obtain the set of triples corresponding to each benign behavior graph.

[0081] The weighted summation unit is used to map the set of triples to a vector space based on the translation embedding model, and to perform a weighted summation operation on the set of triples to obtain the benign behavior instance vector corresponding to each benign behavior graph.

[0082] Clustering units are used to cluster the benign behavior instance vectors corresponding to each benign noise reduction user behavior instance to generate multiple benign behavior clusters.

[0083] Optionally, in one embodiment of this application, the detection module 300 includes: a noise reduction unit, a mapping unit, a calculation unit, a first analysis unit, and a second analysis unit.

[0084] The noise reduction unit is used to acquire log information corresponding to the target behavior to be tested, divide the log information to generate multiple user behavior instances corresponding to the target behavior to be tested, and perform noise reduction on the multiple user behavior instances to be tested to generate multiple noise-reduced user behavior instances to be tested.

[0085] The mapping unit is used to construct the test behavior graph corresponding to each of the multiple denoised test user behavior instances, and map the test behavior graph to the vector space to obtain the test behavior instance vector corresponding to each denoised test user behavior instance.

[0086] The calculation unit is used to calculate the cosine distance between each instance vector of the behavior to be tested and the centroid of each benign behavior cluster in multiple benign behavior clusters, and to determine whether the cosine distance between each instance vector of the behavior to be tested and the centroid of all benign behavior clusters is greater than a preset distance threshold.

[0087] The first analysis unit is used to perform manual inspection and anomaly judgment operations on the behavior instance corresponding to the behavior instance vector if the cosine distance between the behavior instance vector to be tested and the centroid of all benign behavior clusters is greater than the distance threshold, so as to obtain the anomaly judgment result. When the anomaly judgment result of the behavior instance to be tested is benign, the behavior instance to be tested is updated to benign behavior cluster to generate a new benign behavior cluster.

[0088] The second analysis unit is used to determine the minimum target cosine distance and the target benign behavior cluster corresponding to the minimum target cosine distance among all target cosine distances if there is at least one target cosine distance less than or equal to the distance threshold among the cosine distances between the test behavior instance vector and the centroids of all benign behavior clusters, and to determine that the test behavior instance corresponding to the test behavior instance vector is the benign behavior corresponding to the target benign behavior cluster.

[0089] It should be noted that the foregoing explanation of the embodiments of the smart home behavior classification and anomaly detection method also applies to the smart home behavior classification and anomaly detection device of this embodiment, and will not be repeated here.

[0090] The smart home behavior classification and anomaly detection device proposed in this application includes a segmentation module, used to segment the target smart home event logs corresponding to the target smart home system to obtain multiple user behavior instances, and to denoise the multiple user behavior instances to generate multiple denoised user behavior instances; a clustering module, used to construct a behavior graph corresponding to each denoised user behavior instance in the multiple denoised user behavior instances, and based on a preset translation embedding model, to map the benign behavior graph corresponding to each benign denoised user behavior instance in the multiple denoised user behavior instances to a vector space, and to cluster the benign behavior graph corresponding to each benign denoised user behavior instance in the vector space to generate multiple benign behavior clusters that meet preset semantic requirements; and a detection module, used to construct a test behavior graph corresponding to the target test behavior, and to map the test behavior graph to a vector space, and to detect whether the multiple test behavior vectors corresponding to the test behavior graph in the vector space are in benign behavior clusters, so as to perform manual inspection and anomaly judgment operations on the test behavior instances corresponding to the test behavior vectors that are not in benign behavior clusters, and to update and feedback the benign behavior clusters. This application models and represents smart home systems at the user behavior level and utilizes behavioral context information to improve the accuracy of classification and anomaly detection, thereby making it effective for security scenarios such as log auditing and anomaly detection.

[0091] Figure 7 A schematic diagram of the structure of an electronic device provided in an embodiment of this application. The electronic device may include: The memory 701, the processor 702, and the computer program stored on the memory 701 and executable on the processor 702.

[0092] When the processor 702 executes the program, it implements the smart home behavior classification and anomaly detection method provided in the above embodiments.

[0093] Furthermore, electronic devices also include: Communication interface 703 is used for communication between memory 701 and processor 702.

[0094] The memory 701 is used to store computer programs that can run on the processor 702.

[0095] The memory 701 may include high-speed RAM memory, and may also include non-volatile memory, such as at least one disk storage device.

[0096] If the memory 701, processor 702, and communication interface 703 are implemented independently, then the communication interface 703, memory 701, and processor 702 can be interconnected via a bus to complete communication between them. The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of representation, Figure 7 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0097] Optionally, in a specific implementation, if the memory 701, processor 702, and communication interface 703 are integrated on a single chip, then the memory 701, processor 702, and communication interface 703 can communicate with each other through an internal interface.

[0098] The processor 702 may be a central processing unit (CPU), an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of this application.

[0099] This application also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the above-described smart home behavior classification and anomaly detection method.

[0100] This application also provides a computer program product, including a computer program, which, when executed, is used to implement the above-described smart home behavior classification and anomaly detection method.

[0101] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0102] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this application, "N" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0103] Any process or method described in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or N executable instructions for implementing custom logic functions or processes, and the scope of the preferred embodiments of this application includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved, as should be understood by those skilled in the art to which embodiments of this application pertain.

[0104] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of computer-readable media include: an electrical connection having one or more wires (electronic device), a portable computer disk drive (magnetic device), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Alternatively, the computer-readable medium may be paper or other suitable media on which the program can be printed, since the program can be obtained electronically by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in a computer memory.

[0105] It should be understood that the various parts of this application can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiments, the N steps or methods can be implemented using software or firmware stored in memory and executed by a suitable instruction execution system. If implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0106] Those skilled in the art will understand that all or part of the steps of the methods in the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, the program includes one or a combination of the steps of the method embodiments.

[0107] Furthermore, the functional units in the various embodiments of this application can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into a module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium.

[0108] The storage medium mentioned above can be a read-only memory, a disk, or an optical disk, etc. Although embodiments of this application have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting this application. Those skilled in the art can make changes, modifications, substitutions, and variations to the above embodiments within the scope of this application.

Claims

1. A method for classifying and detecting abnormal behavior in smart homes, characterized in that, Includes the following steps: The target smart home event logs corresponding to the target smart home system are divided to obtain multiple user behavior instances, and the multiple user behavior instances are denoised to generate multiple denoised user behavior instances. Construct a behavior graph corresponding to each of the multiple noise-reduced user behavior instances, and based on a preset translation embedding model, map the benign behavior graph corresponding to each benign noise-reduced user behavior instance to a vector space, and cluster the benign behavior graph corresponding to each benign noise-reduced user behavior instance in the vector space to generate multiple benign behavior clusters that meet preset semantic requirements. A test behavior graph corresponding to the target test behavior is constructed, and the test behavior graph is mapped to the vector space. The test behavior vectors corresponding to the test behavior graph in the vector space are detected to see if they are in the benign behavior cluster. Test behavior instances corresponding to test behavior vectors that are not in the benign behavior cluster are manually checked and anomaly judged to obtain anomaly judgment results. Based on the anomaly judgment results, the benign behavior cluster is updated. The process of dividing the target smart home system into target smart home event logs to obtain multiple user behavior instances, and then denoising these multiple user behavior instances to generate multiple denoised user behavior instances, includes: Based on a preset cloud platform, obtain smart home event logs containing entries for changes in the status of the target smart home system, wherein the entries for changes in the status of the target smart home system include timestamps, device names, and device status. Obtain a floor plan of the smart home devices corresponding to the target smart home system, construct a distance matrix with location semantic relationships based on the floor plan of the smart home devices, and determine the segmentation time threshold corresponding to the event log of the target smart home. The initial event window corresponding to the smart home event log is determined, and the initial event window is dynamically expanded and denoised based on the distance matrix and the time segmentation threshold to generate the multiple denoised user behavior instances; The construction of the behavior graph corresponding to each of the plurality of noise-reduced user behavior instances includes: Based on the target smart home system and the device status, the node information of the behavior graph is determined, and the event relationships in each noise-reduced user behavior instance are obtained to determine the edge information of the behavior graph through the event relationships. The edge information includes edge types, wherein the edge types include rule-triggered edges and time-sequential edges. Rule-triggered edges indicate that the occurrence of an in-node event leads to the occurrence of an out-node event through an automated rule; time-sequential edges indicate that there is a temporal relationship between the in-node and out-node of the edge. Construct a behavior graph corresponding to each noise reduction user behavior instance based on the node information and the edge information; The preset translation embedding model maps the benign behavior graph corresponding to each benign denoised user behavior instance in the plurality of denoised user behavior instances to a vector space, and clusters the benign behavior graph corresponding to each benign denoised user behavior instance in the vector space to generate multiple benign behavior clusters that meet preset semantic requirements, including: Traverse the benign behavior graph corresponding to each instance of benign noise reduction user behavior to obtain the set of triples corresponding to each benign behavior graph; Based on the translation embedding model, the preset objective function is iteratively optimized until the preset iteration termination condition is met to obtain the corresponding optimization result. Based on the optimization result, a triplet embedding vector is generated for each node and edge to map the triplet set to the vector space. The number of times the event corresponding to the triplet appears in the entire log and the total number of events in the entire log are determined to calculate the corresponding inverse text frequency. The corresponding weight coefficient is determined by the inverse text frequency, and a weighted summation operation is performed on the triplet set based on the weight coefficient to obtain the benign behavior instance vector corresponding to each benign behavior graph. Cluster the benign behavior instance vector corresponding to each benign noise reduction user behavior instance to generate the multiple benign behavior clusters; The mathematical expression for the objective function is: in, A collection of diagrams illustrating positive behaviors; Represents the L1 norm function; Indicates the interval hyperparameter; The embedding vector corresponding to the entity; In the graph set The effective triplet in and These are the head nodes of the effective triples. ,side Tail node The embedding vector; Indicates a set not in the graph Invalid triples in; , and The head nodes of the invalid triples are respectively ,side Tail node The embedding vector; The mathematical expression for the inverse text frequency is: in, Represents a triplet The number of times the corresponding event appears in the entire log; This indicates the total number of events in the entire log; The mathematical expression for the benign behavior instance vector is: ； Cluster the benign behavior instance vector corresponding to each benign noise reduction user behavior instance to generate multiple benign behavior clusters, record the cluster centroid of each benign behavior cluster, and use the cluster centroid as a representative instance of the corresponding benign behavior for anomaly detection. The formula for calculating the centroid of the cluster is: in, Cluster The center of mass; For clusters The middle row is a vector representation of an instance; The process involves constructing a target behavior graph corresponding to the target behavior to be tested, mapping the target behavior graph to the vector space, and detecting whether multiple target behavior vectors corresponding to the target behavior graph in the vector space are in the benign behavior cluster. For target behavior instances corresponding to target behavior vectors not in the benign behavior cluster, manual inspection and anomaly judgment operations are performed to obtain anomaly judgment results. Based on the anomaly judgment results, the benign behavior cluster is updated, including: Obtain the log information corresponding to the target behavior to be tested, and divide the log information to generate multiple user behavior instances to be tested corresponding to the target behavior to be tested, and reduce the noise of the multiple user behavior instances to generate multiple denoised user behavior instances to be tested. Construct a test behavior graph corresponding to each of the plurality of noise-reduced test user behavior instances, and map the test behavior graph to the vector space to obtain the test behavior instance vector corresponding to each noise-reduced test user behavior instance; Calculate the cosine distance between each instance vector of the behavior to be tested and the centroid of each benign behavior cluster in the plurality of benign behavior clusters, and determine whether the cosine distance between each instance vector of the behavior to be tested and the centroid of all benign behavior clusters is greater than a preset distance threshold. If the cosine distance between the vector of the behavior to be tested and the centroids of all the benign behavior clusters is greater than the distance threshold, then the behavior instance corresponding to the vector of the behavior to be tested is marked as a suspicious behavior. The suspicious behavior is manually checked and anomaly is determined to obtain the anomaly determination result. When the anomaly determination result of the behavior instance to be tested is benign, the behavior instance to be tested is updated to the benign behavior cluster to generate a new benign behavior cluster. If there is at least one target cosine distance less than or equal to the distance threshold among the cosine distances between the vector of the behavior to be tested and the centroids of all benign behavior clusters, then the minimum target cosine distance among all target cosine distances and the target benign behavior cluster corresponding to the minimum target cosine distance are determined, and the behavior instance to be tested corresponding to the vector of the behavior to be tested is determined to be the benign behavior corresponding to the target benign behavior cluster.

2. A smart home behavior classification and anomaly detection device, used to implement the smart home behavior classification and anomaly detection method as described in claim 1, characterized in that, include: The segmentation module is used to segment the target smart home event logs corresponding to the target smart home system to obtain multiple user behavior instances, and to denoise the multiple user behavior instances to generate multiple denoised user behavior instances. The clustering module is used to construct a behavior graph corresponding to each of the multiple noise-reduced user behavior instances, and based on a preset translation embedding model, to map the benign behavior graph corresponding to each benign noise-reduced user behavior instance to a vector space, and to cluster the benign behavior graph corresponding to each benign noise-reduced user behavior instance in the vector space to generate multiple benign behavior clusters that meet preset semantic requirements. The detection module is used to construct a target behavior graph corresponding to the target behavior to be tested, and map the target behavior graph to the vector space, and detect whether multiple target behavior vectors corresponding to the target behavior graph in the vector space are in the benign behavior cluster, so as to perform manual inspection and anomaly judgment operation on the target behavior instances corresponding to the target behavior vectors that are not in the benign behavior cluster, so as to obtain anomaly judgment results, and based on the anomaly judgment results, update the benign behavior cluster.

3. The apparatus according to claim 2, characterized in that, The partitioning module includes: The first acquisition unit is used to acquire smart home event logs containing state change entries of the target smart home system based on a preset cloud platform, wherein the state change entries of the target smart home system include timestamps, device names, and device status. The second acquisition unit is used to acquire a smart home device floor plan corresponding to the target smart home system, construct a distance matrix with location semantic relationship based on the smart home device floor plan, and determine the segmentation time threshold corresponding to the target smart home event log. The generation unit is used to determine the initial event window corresponding to the smart home event log, and to dynamically expand and denoise the initial event window based on the distance matrix and the time division threshold, so as to generate the multiple denoised user behavior instances.

4. An electronic device, characterized in that, include: The system includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the smart home behavior classification and anomaly detection method as described in claim 1.

5. A computer-readable storage medium having a computer program stored thereon, characterized in that, The program is executed by the processor to implement the smart home behavior classification and anomaly detection method as described in claim 1.

6. A computer program product, comprising a computer program, characterized in that, The computer program is executed by a processor to implement the smart home behavior classification and anomaly detection method as described in claim 1.

Images