An artificial intelligence-based internet of things device hidden danger risk analysis method and system

Abstract

The application discloses an Internet of Things equipment hidden danger risk analysis method and system based on artificial intelligence, and particularly relates to the technical field of data processing; operation data of Internet of Things equipment is collected, feature extraction is performed, an input feature set of an AI model is constructed, the degree of change of data distribution in a short time window and a long time window is analyzed, a data distribution drift rate is calculated, a prediction stability analysis of current data is performed in combination with the AI model, a confidence change condition is calculated, a concept drift prediction model is constructed, a data distribution drift rate and model confidence fluctuation are comprehensively calculated, a concept drift index is generated, and when the concept drift index exceeds a preset threshold, an AI model dynamic adjustment mechanism is automatically triggered; the application can effectively reduce the false positive rate and the false negative rate of new attacks, ensure the long-term stability and safety detection capability of the AI model in the Internet of Things environment, and improve the safety, intelligent level and risk prevention and control capability of the Internet of Things system.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data processing, in particular to an Internet of Things device hidden danger risk analysis method and system based on artificial intelligence. BACKGROUND

[0002] With the wide application of Internet of Things (IoT) technology, the number of device connections in the fields of smart home, industrial control, intelligent medical treatment, and Internet of Vehicles is growing exponentially. However, due to the limited computing resources of IoT devices, the lack of perfect security mechanisms, and the long-term exposure to complex network environments, IoT devices are vulnerable to network attacks, data breaches, and abnormal failures. Traditional security protection technologies mainly rely on rule matching and feature library detection, which are difficult to effectively cope with new attacks and unknown security risks. In recent years, the application of artificial intelligence (AI) technology in the field of network security has gradually emerged, especially the intelligent analysis method based on machine learning and deep learning, which can be used to identify abnormal behavior, detect malicious traffic, and predict potential risks.

[0003] The prior art has the following deficiencies:

[0004] In the hidden danger risk analysis of IoT devices, AI models are usually trained based on historical data to identify abnormal behavior or attack patterns. However, due to the highly dynamic nature of the Internet of Things environment, the normal behavior, communication patterns, and attack methods of devices are constantly evolving, leading to the concept drift problem of AI models, i.e., the security rules learned by the model during training gradually become ineffective. When concept drift occurs, AI may misjudge new normal behavior as abnormal, increasing the false positive rate, or fail to identify new attack patterns, resulting in false negatives. Especially in the scenario of zero-day attacks or advanced persistent threats (APTs), attackers will continuously adjust their strategies, making their behavior gradually approach normal traffic, inducing AI models to adapt to the wrong classification standards, and ultimately rendering the detection system useless. In addition, since concept drift usually occurs gradually and is difficult to detect in the early stages, it can easily lead to the accumulation of long-term security risks, causing serious security risks to the Internet of Things system. SUMMARY

[0005] The purpose of the present application is to provide an Internet of Things device hidden danger risk analysis method and system based on artificial intelligence to solve the problems in the background art.

[0006] In order to achieve the above-mentioned purpose, the present application provides the following technical solution: an Internet of Things device hidden danger risk analysis method based on artificial intelligence, comprising:

[0007] Collecting the running data of the Internet of Things device, including network traffic, system logs, and device behavior patterns, and performing feature extraction on the collected data to construct an AI model input feature set;

[0008] Analyze the degree of change of data distribution in short and long time windows, judge the drift rate of data distribution change, and analyze the prediction stability of the AI model for the current data to judge the change of AI model confidence;

[0009] Build a concept drift prediction model to comprehensively calculate the drift rate of data distribution change and the change of AI model confidence to obtain the concept drift index of the AI model in the Internet of Things environment.

[0010] Compare the calculated concept drift index with the pre-set concept drift threshold value. When the concept drift index is greater than or equal to the concept drift threshold value, trigger the AI model dynamic adjustment mechanism, including adjusting the weight parameters of the AI model to optimize the drift detection accuracy.

[0011] Preferably, the collected operation data of the Internet of Things device includes: collecting network traffic data, and the data sources include Internet of Things gateway, switch / router, port mirroring and deep packet inspection system; collecting system log data, and the data sources include device operating system, IoT device firmware log, event management system and remote log server; collecting device behavior pattern data, and the data sources include device end sensor data, device operation log and device access control record.

[0012] Preferably, the data distribution drift rate value is generated according to the drift rate of data distribution change, and the method for obtaining the data distribution drift rate value is:

[0013] Set to calculate the probability distribution of network traffic distribution characteristics, and construct the probability distribution in the short time window and the long time window respectively: short time window distribution: ; long time window distribution: ; wherein: n is the number of categories in the distribution, represents the probability of the nth type of data in the short time window, and the expression is: ; represents the probability of the nth type of data in the long time window, and the expression is: ; calculate the difference between the two probability distributions P and Q , and the calculation formula is: ; calculate the data distribution drift rate value , and the expression is: ; wherein: is the time span of the short time window.

[0014] Preferably, the confidence fluctuation index is generated after analyzing the confidence change of the AI model when processing the current input data, and the method for obtaining the confidence fluctuation index is:

[0015] For the same input sample x, T times of forward propagation are performed, and part of the neurons are randomly discarded each time. The output probability distribution of each forward propagation is recorded, denoted as: ; wherein: is the output probability distribution of the t-th forward propagation; T is the total number of Monte Carlo simulation; the predicted mean is calculated, and the expression is: ; wherein: represents the average prediction probability of each category after T times of reasoning; the prediction variance is calculated: ; wherein: is the prediction variance, which represents the degree of change of the prediction confidence of the model for the input data. The confidence fluctuation index CFI is defined as the weighted sum of the confidence variance of all categories, and the calculation formula is: ; wherein: CFI represents the confidence fluctuation index, and N is the total number of categories.

[0016] Preferably, a concept drift prediction model is constructed to comprehensively calculate the drift rate of data distribution and the change of AI model confidence, and obtain the concept drift index of the AI model in the Internet of Things environment, which specifically includes: normalizing the data distribution drift rate value and the confidence fluctuation index so that they are both in the range of [0, 1], and calculating the concept drift index according to the normalized data distribution drift rate value and the confidence fluctuation index.

[0017] Preferably, the calculated concept drift index is compared with a pre-set concept drift threshold value; when the concept drift index is less than the concept drift threshold value, it indicates that the concept drift has little influence, and the AI model can still effectively detect the security risks of Internet of Things devices without additional adjustment; when the concept drift index is greater than or equal to the concept drift threshold value, it indicates that the concept drift has a great influence, and dynamic adjustment is needed to reduce the false positive rate and the false negative rate of new attacks.

[0018] Preferably, the AI model dynamic adjustment mechanism is triggered, including adjusting the weight parameters of the AI model to optimize the drift detection accuracy, including: the formula for adjusting the weight parameters of the AI model is: ; wherein: ΔW is the adjustment amount of the weight parameters of the AI model, and η is the learning rate, which controls the step size of weight adjustment; represents the gradient change of the data distribution drift rate to the model weight, represents the gradient change of the confidence fluctuation index to the model weight, and α, β are weight adjustment factors;

[0019] After each concept drift detection, the weight is adjusted according to the gradient: ; wherein: is the updated AI model weight matrix, is the weight matrix of the current AI model, and ΔW is the calculated weight adjustment amount;

[0020] Increase eta, speed up model adaptation: ; Wherein, Lambda is the adjustment factor, The adjusted learning rate.

[0021] The application also provides an Internet of Things equipment hidden danger risk analysis system based on artificial intelligence, comprising a data acquisition module, a data analysis module, a calculation module and an adjustment module.

[0022] The data acquisition module acquires the running data of the Internet of Things equipment, including network traffic, system logs and device behavior patterns, and performs feature extraction on the collected data to construct an AI model input feature set.

[0023] The data analysis module analyzes the degree of change of data distribution in short and long time windows, judges the drift rate of data distribution change, and analyzes the prediction stability of the AI model to the current data to judge the change of AI model confidence.

[0024] The calculation module constructs a concept drift prediction model, comprehensively calculates the drift rate of data distribution change and the change of AI model confidence, and obtains the concept drift index of the AI model in the Internet of Things environment.

[0025] The adjustment module compares the calculated concept drift index with the pre-set concept drift threshold value, and when the concept drift index is greater than or equal to the concept drift threshold value, triggers the AI model dynamic adjustment mechanism, including adjusting the weight parameters of the AI model to optimize the drift detection accuracy.

[0026] In the above technical solution, the application provides technical effects and advantages:

[0027] 1、The application can comprehensively analyze the running state of the equipment by collecting the network traffic, system logs and device behavior patterns of the Internet of Things equipment and performing feature extraction. Further, the application uses a combination of short and long time windows to calculate the drift rate of data distribution change, and uses the Monte Carlo method to analyze the prediction stability of the AI model to the current data to calculate the confidence fluctuation index CFI, thereby constructing a concept drift prediction model. The application generates a concept drift index CDI by comprehensively calculating the data distribution drift rate and the change of AI model confidence, and compares it with the pre-set concept drift threshold value to realize real-time evaluation of the adaptability of the AI model.

[0028] 2、The application automatically triggers the AI model dynamic adjustment mechanism when the concept drift index exceeds the threshold, including optimizing the weight parameters of the AI model, adjusting the learning rate, adopting incremental learning and transfer learning strategies, ensuring that the AI model can adapt to new data patterns, thereby improving the accuracy of security detection, reducing the false positive rate and the false negative rate of new attacks. BRIEF DESCRIPTION OF DRAWINGS

[0029] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings needed in the embodiments will be briefly introduced as follows. Obviously, the drawings described below are only some embodiments described in the present application, and other drawings can also be obtained by those skilled in the art based on these drawings.

[0030] Figure 1 The method flowchart of the present application.

[0031] Figure 2 The system module diagram of the present application. DETAILED DESCRIPTION

[0032] In order to make the purpose, technical scheme and advantages of the embodiments of the present application more clear, the technical scheme in the embodiments of the present application will be described clearly and completely below in combination with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0033] Embodiment 1, please refer to Figure 1 The AI-based IoT device risk analysis method described in this embodiment includes:

[0034] Collecting the running data of the IoT device, including network traffic, system logs and device behavior patterns, and performing feature extraction on the collected data to construct an AI model input feature set;

[0035] Analyzing the degree of change of data distribution in short and long time windows, judging the drift rate of data distribution change, and analyzing the prediction stability of the AI model to the current data, and judging the change of AI model confidence;

[0036] Building a concept drift prediction model, comprehensively calculating the drift rate of data distribution change and the change of AI model confidence, and obtaining the concept drift index of the AI model in the IoT environment;

[0037] The calculated concept drift index is compared with a pre-set concept drift threshold. When the concept drift index is greater than or equal to the concept drift threshold, the AI model dynamic adjustment mechanism is triggered, including adjusting the weight parameters of the AI model to optimize the drift detection accuracy.

[0038] To improve the accuracy and real-time performance of artificial intelligence (AI) models in Internet of Things (IoT) device risk analysis, first, the running data of IoT devices, including network traffic, system logs, and device behavior patterns, need to be collected and feature extraction is performed, and finally the input feature set of the AI model is constructed.

[0039] Data collection is the basis of AI analysis, involving the collection of relevant data from IoT devices, network environments, and log systems.

[0040] Collect network traffic data, data sources: IoT gateway, switch / router, device port mirroring (PortMirroring), DPI (Deep Packet Inspection) system;

[0041] Collection method: Passive monitoring: mirror traffic on IoT gateway or switch ports, collect all passing data packets in real time. Flow log recording: store traffic data in NetFlow, sFlow or PCAP (Wireshark) format. Protocol analysis: analyze the communication mode of common IoT protocols such as TCP / IP, MQTT, CoAP, HTTP, DNS, Modbus, etc.

[0042] Collect system log data, data sources: device operating system (Linux, Windows, RTOS), IoT device firmware log, event management system (SIEM), remote log server (Syslog), collection method: collect device logs through Syslog protocol, parse JSON / XML format log files, get log information through API call (such as cloud IoT device). Collect device behavior pattern data, data sources: device end sensor data (temperature, humidity, acceleration, etc.), device operation log (user operation, automatic control log), device access control record (user identity authentication, permission management); Collection method: collect data through IoT device API interface or sensor data bus, get device status information through MQTT / CoAP protocol, collect user access behavior combined with identity management system (IAM).

[0043] Raw data usually contains noise, redundant information and inconsistent formats, which need to be cleaned, converted and formatted to ensure the quality of AI model input data.

[0044] Removing invalid data: such as null values, incomplete logs, incorrectly formatted data; deduplication: removing duplicate traffic records or log entries; outlier detection: identifying and correcting abnormal data points, such as extremely large traffic spike values.

[0045] Uniform timestamp format (ISO 8601: YYYY-MM-DD HH:MM:SS), uniform IP address format (IPv4 / IPv6 standard), convert categorical data (protocol type, log level) to numerical representation (such as one-hot encoding). Numerical normalization: map numerical data to the [0,1] interval. Time series alignment: align traffic data, log data, and device behavior data on the time axis to form a multi-dimensional time series data set.

[0046] The purpose of feature extraction is to extract key information from raw data that is most helpful for AI model analysis, to improve the recognition ability and computational efficiency of the model.

[0047] Network traffic feature extraction: based on statistics: traffic packet size mean, variance, peak, traffic rate, etc.; based on time: session duration, burst traffic detection (such as DDoS); based on traffic pattern: access frequency of specific ports, abnormal protocol combination (such as DNS tunnel).

[0048] System log feature extraction: error code pattern: analyze the most frequent error codes to detect device anomalies. User behavior analysis: calculate the access frequency of different users, the number of login failures. Permission change record: whether there are unauthorized user privilege escalations.

[0049] Device behavior pattern feature extraction: sensor data pattern: temperature, vibration, and other trends in the device's operating environment. Operation log sequence analysis: time interval of user command input, detect if it is abnormal. Automatic control pattern: whether the device has unexpected automatic control instructions.

[0050] Building AI model input feature set: construct a time series feature matrix, synchronize features from different sources (traffic, logs, behavior) by time; use feature selection algorithms (such as PCA, Lasso regression) to select the most critical features, reduce dimensionality, and improve AI model computational efficiency. Normalization processing: ensure that all feature values have consistent dimensions, improve the training stability of the AI model.

[0051] In order to analyze the degree of change in data distribution, short and long time windows need to be defined:

[0052] Short-Term Window (STW): used to capture recent data trends, window length is usually set to a few minutes to a few hours (such as 1 hour).

[0053] Long-Term Window (LTW): used to reflect the overall data distribution pattern, the window length is usually set to several days to several weeks (such as 7 days).

[0054] The following feature data is collected within each window: network traffic features (traffic rate, port usage distribution, protocol distribution, etc.); log features (event frequency, error code distribution, user access pattern, etc.); device behavior features (sensor data trends, device state changes, etc.).

[0055] According to the drift rate of data distribution change, a data distribution drift rate value is generated, and the method for obtaining the data distribution drift rate value is:

[0056] Set the probability distribution calculation for network traffic distribution features, and construct the probability distribution in the short-term window and the long-term window respectively: short-term window distribution: ; Long-term window distribution: ; Wherein: n is the number of categories in the distribution, such as different port numbers, different protocol types, different log events, etc. represents the probability of the nth type of data in the short-term window, and the expression is: ; represents the probability of the nth type of data in the long-term window, and the expression is: ; Calculate the difference between the two probability distributions P and Q , the calculation formula is: ; Wherein: if =0, then =0 (to avoid calculation error of logarithm). If >0, then define as infinity, indicating that the short-term window has new patterns that do not appear in the long-term window, and there is a serious drift. Calculate the data distribution drift rate value , the expression is: ; Wherein: is the time span of the short-term window (such as 1 hour, 10 minutes, etc.), the unit is second.

[0057] In order to detect the severity of concept drift, set a threshold DRthreshold, and make the following judgments:

[0058] If DR<DRthreshold: the data distribution change is small, and the AI model is still applicable; if DR≥DRthreshold: the data distribution change is large, indicating that concept drift has occurred, and the AI model needs to be adjusted (such as retraining, parameter updating).

[0059] The prediction stability of the AI model on the current data can be analyzed through model uncertainty (MU), which measures the change in the model's confidence when processing the current input data. If the model's prediction results for similar input samples fluctuate greatly, it indicates that the model's stability in this data environment is poor and may be affected by concept drift or changes in data distribution. Common analysis methods include Bayesian neural networks (BNN) and Monte Carlo Dropout (MC Dropout), which calculate the variance of the prediction distribution through multiple forward propagations to evaluate the model's stability. In addition, confidence entropy can be used to measure the uncertainty of the prediction distribution. The higher the entropy value, the lower the model's confidence in the current data, indicating a higher risk of misjudgment. When the model's uncertainty exceeds a certain threshold, learning parameters need to be adjusted, training data needs to be updated, or transfer learning needs to be used to enhance the model's adaptability to new data environments and improve the accuracy and reliability of IoT device risk analysis.

[0060] After analyzing the change in the model's confidence when processing the current input data, a confidence fluctuation index (CFI) is generated. The method for obtaining the CFI is as follows:

[0061] For the same input sample x, perform T forward propagations, each time randomly dropping some neurons (using Dropout). Record the output probability distribution of each forward propagation, denoted as: ; where: is the output probability distribution of the t-th forward propagation (for classification tasks); T is the total number of Monte Carlo simulations (usually 20-100).

[0062] Calculate the prediction mean (average confidence), expressed as: ; where: represents the average prediction probability of each class after T inferences; calculate the prediction variance (confidence fluctuation degree): ; where: is the prediction variance, which represents the degree of change in the model's prediction confidence for the input data. If the variance is large, it indicates that the model's prediction stability is low and may be affected by concept drift. Define the confidence fluctuation index (CFI) as the weighted sum of the confidence variances of all classes, calculated as: ; where: CFI represents the confidence fluctuation index, which measures the model's prediction stability on the input data, and N is the total number of classes (e.g., for binary classification tasks N = 2, for multi-classification tasks N > 2).

[0063] A confidence fluctuation threshold CFIthreshold is set to determine whether the model has a prediction instability problem: if CFI < CFIthreshold, it means that the model prediction confidence is stable, and the AI system is still applicable to the current data environment; if CFI ≥ CFIthreshold, it means that the model prediction confidence fluctuates greatly, which may be affected by concept drift, and the dynamic adjustment mechanism of the AI model (such as retraining, parameter adjustment, transfer learning, etc.) needs to be triggered.

[0064] A concept drift prediction model is constructed to comprehensively calculate the drift rate of data distribution and the change of AI model confidence, and obtain the concept drift index of the AI model in the Internet of Things environment, which specifically includes: normalizing the data distribution drift rate value and the confidence fluctuation index to make them both in the range of [0, 1], and calculating the concept drift index according to the normalized data distribution drift rate value and the confidence fluctuation index.

[0065] For example, the concept drift prediction model of the application can use the following calculation formula to calculate the concept drift index, and the calculation expression is: ; in the formula, is the concept drift index, is the data distribution drift rate value, is the confidence fluctuation index, is the weight coefficient of the data distribution drift rate value and the confidence fluctuation index (which can be optimized according to experimental experience or machine learning), and all are greater than 0.

[0066] The calculated concept drift index is compared with the pre-set concept drift threshold; when the concept drift index is less than the concept drift threshold, it means that the concept drift has little effect, and the AI model can still effectively detect the security risks of Internet of Things devices without additional adjustment; when the concept drift index is greater than or equal to the concept drift threshold, it means that the concept drift has a great effect, and dynamic adjustment is needed to reduce the false positive rate and the false negative rate of new attacks.

[0067] In order to make the AI model adapt to the new data distribution and confidence fluctuation, the weight parameter W of the AI model needs to be adjusted according to the data distribution drift rate value DR and the confidence fluctuation index CFI to optimize the drift detection accuracy.

[0068] The formula for adjusting the weight parameter of the AI model is: ; wherein: ΔW is the adjustment amount (matrix / vector form) of the weight parameter of the AI model; η is the learning rate, which controls the step size of weight adjustment, and the value range is usually [0.001, 0.1].

[0069] represents the gradient change of the confidence fluctuation index to the model weight, indicating the influence of the model prediction confidence on the weight. α, β are weight adjustment factors, which can be determined according to experimental experience or optimization algorithm (such as adjusting by Bayesian optimization or grid search). represents the gradient change of the confidence fluctuation index to the model weight, indicating the influence of the model prediction confidence on the weight. α, β are weight adjustment factors, which can be determined according to experimental experience or optimization algorithm (such as adjusting by Bayesian optimization or grid search). and Gradient descent method can be used to calculate by back propagation.

[0070] After each concept drift detection, adjust the weight according to the gradient: ; Wherein: is the updated AI model weight matrix, is the weight matrix of the current AI model, and ΔW is the calculated weight adjustment amount.

[0071] If CDI is greater than or equal to the set threshold , it means that the AI model needs to be adjusted greatly, and the adjustment strategy is as follows:

[0072] Increase η to speed up the model adaptation: ; Wherein, λ is the adjustment factor, is the adjusted learning rate, and adaptive learning rate (such as Adam or RMSProp) is enabled to adjust the model weight more finely.

[0073] When CDI is greater than or equal to the set threshold , the AI model may be outdated and needs to be adjusted more greatly, such as: training the model with new data in small batches. Fine-tune the high-level parameters of the model with new data to improve adaptability. Recalculate the feature importance and eliminate obsolete features to improve the generalization ability of the model. Recalculate the optimal decision boundary to avoid false classification.

[0074] Embodiment 2, please refer to Figure 2 The AI-based Internet of Things device risk analysis system described in this embodiment includes a data acquisition module, a data analysis module, a calculation module, and an adjustment module.

[0075] Data acquisition module: collect the running data of Internet of Things devices, including network traffic, system logs and device behavior patterns, and perform feature extraction on the collected data to build an AI model input feature set.

[0076] Data analysis module: analyze the degree of change of data distribution in short and long time windows, judge the drift rate of data distribution change, and analyze the prediction stability of AI model to current data, and judge the change of AI model confidence;

[0077] The calculation module: build a concept drift prediction model, and comprehensively calculate the drift rate of data distribution change and the change of AI model confidence to obtain the concept drift index of the AI model in the Internet of Things environment.

[0078] The adjustment module: compare the calculated concept drift index with the pre-set concept drift threshold value, when the concept drift index is greater than or equal to the concept drift threshold value, trigger the AI model dynamic adjustment mechanism, including adjusting the weight parameter of the AI model to optimize the drift detection accuracy.

[0079] The above formulas are all dimensionless numerical calculations, the formula is obtained by software simulation of a large amount of data to obtain the latest real situation, and the pre-set parameters in the formula are set by the person skilled in the art according to the actual situation.

[0080] It should be understood that the term "and / or" herein is only a description of the association relationship between the associated objects, which means that there can be three relationships, for example, A and / or B can represent: A exists alone, A and B exist together, and B exists alone, where A and B can be singular or plural. In addition, the character " / " herein generally represents an "or" relationship between the associated objects before and after it, but it can also represent an "and / or" relationship, which can be understood in combination with the context before and after it.

[0081] Those skilled in the art can realize that the units and algorithm steps of each example described in combination with the embodiments disclosed herein can be realized by electronic hardware or a combination of computer software and electronic hardware. Whether the functions are realized in hardware or software depends on the specific application and design constraints of the technical solution. A person skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0082] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto, any person skilled in the art can easily think of changes or replacements within the technical scope disclosed in the present application, which should be covered within the protection scope of the present application.

Claims

1. An artificial intelligence-based Internet of Things device hazard risk analysis method, characterized in that: The application comprises the following steps: Collecting running data of Internet of Things devices, including network traffic, system logs and device behavior patterns, and performing feature extraction on the collected data to construct an AI model input feature set; Analyzing the degree of change in data distribution in short and long time windows, judging the drift rate of data distribution change, and analyzing the prediction stability of the AI model for the current data to judge the change in AI model confidence; Building a concept drift prediction model to comprehensively calculate the drift rate of data distribution change and the change in AI model confidence to obtain a concept drift index of the AI model in the Internet of Things environment; Comparing the calculated concept drift index with a pre-set concept drift threshold value, and when the concept drift index is greater than or equal to the concept drift threshold value, triggering the AI model dynamic adjustment mechanism, including adjusting the weight parameters of the AI model to optimize the drift detection accuracy. The trigger AI model dynamic adjustment mechanism comprises adjusting the weight parameters of the AI model to optimize the drift detection accuracy, and the formula for adjusting the weight parameters of the AI model is: ; wherein: ΔW is the adjustment amount of the weight parameters of the AI model, η is the learning rate, and the step length of controlling the weight adjustment; represents the gradient change of the data distribution drift rate to the model weight, represents the gradient change of the confidence fluctuation index to the model weight, and α, β are weight adjustment factors. After each concept drift detection, the weights are adjusted according to the gradient: ; wherein: is the updated weight matrix of the AI model, is the weight matrix of the current AI model, and ΔW is the calculated weight adjustment amount. Increasing η, accelerating the model adaptation speed: ; wherein λ is an adjustment factor, is the adjusted learning rate; wherein, is a concept drift index, the expression for which is: ; in which, is a data distribution drift rate value, is a confidence fluctuation index, is a weight coefficient for the data distribution drift rate value, the confidence fluctuation index.

2. The method of claim 1, wherein the method further comprises: The collected running data of Internet of Things devices includes: collecting network traffic data, and the data sources include Internet of Things gateways, switches / routers, port mirroring and deep packet inspection systems; collecting system log data, and the data sources include device operating systems, IoT device firmware logs, event management systems and remote log servers; collecting device behavior pattern data, and the data sources include device end sensor data, device operation logs and device access control records. 3.The AI-based IoT device hazard risk analysis method of claim 1, wherein: Generating a data distribution drift rate value according to the drift rate of data distribution change, and the method for obtaining the data distribution drift rate value is: Set the probability distribution calculation of network traffic distribution characteristics, construct the probability distribution in short time window and long time window respectively: short time window distribution: ; long time window distribution: ; Wherein: n is the number of categories in the distribution, represents the probability of the nth category data in the short time window, the expression is: ; represents the probability of the nth category data in the long time window, the expression is: ; Calculate the difference between the two probability distributions P and Q , the calculation formula is: ; Calculate the data distribution drift rate value , the expression is: ; Wherein: is the time span of the short time window.

4. The method of claim 3, wherein the method further comprises: Analyzing the change in confidence of the AI model when processing the current input data to generate a confidence fluctuation index, and the method for obtaining the confidence fluctuation index is: For the same input sample x, T forward propagations are performed, each time randomly dropping some neurons, and the output probability distribution of each forward propagation is recorded, denoted as: ; wherein: is the output probability distribution of the t-th forward propagation; T is the total number of Monte Carlo simulations; the predicted mean is calculated, and the expression is: ; wherein: represents the average prediction probability of each class after T inferences; the prediction variance is calculated: ; wherein: is the prediction variance, which represents the degree of change in the prediction confidence of the model for the input data, and the confidence fluctuation index CFI is defined as the weighted sum of the confidence variances of all classes, and the calculation formula is: ; wherein: CFI represents the confidence fluctuation index, and N is the total number of classes.

5. The method of claim 4, wherein the method further comprises: Building a concept drift prediction model to comprehensively calculate the drift rate of data distribution change and the change in AI model confidence to obtain a concept drift index of the AI model in the Internet of Things environment, specifically including: normalizing the data distribution drift rate value and the confidence fluctuation index to make them both within [0, 1], and calculating the concept drift index according to the normalized data distribution drift rate value and the confidence fluctuation index.

6. The method of claim 5, wherein the method further comprises: Comparing the calculated concept drift index with a pre-set concept drift threshold value; when the concept drift index is less than the concept drift threshold value, it means that the concept drift has little impact, and the AI model can still effectively detect the security risks of Internet of Things devices without additional adjustment; when the concept drift index is greater than or equal to the concept drift threshold value, it means that the concept drift has a great impact, and dynamic adjustment is needed to reduce the false positive rate and the false negative rate of new attacks.

7. An artificial intelligence-based Internet of Things device hidden danger risk analysis system for implementing an artificial intelligence-based Internet of Things device hidden danger risk analysis method according to any one of claims 1-6, characterized in that: The application comprises a data collection module, a data analysis module, a calculation module and an adjustment module. The data collection module collects running data of Internet of Things devices, including network traffic, system logs and device behavior patterns, and performs feature extraction on the collected data to construct an AI model input feature set. The data analysis module analyzes the degree of change in data distribution in short and long time windows, judges the drift rate of data distribution change, and analyzes the prediction stability of the AI model for the current data to judge the change in AI model confidence. The computing module: build a concept drift prediction model, comprehensively calculate the drift rate of data distribution change and the change of AI model confidence, and obtain the concept drift index of the AI model in the Internet of Things environment; The adjusting module: compare the concept drift index calculated with the pre-set concept drift threshold value, when the concept drift index is greater than or equal to the concept drift threshold value, trigger the AI model dynamic adjustment mechanism, including adjusting the weight parameter of the AI model, to optimize the drift detection accuracy.

Images