Radio supervision device and system based on big data

Abstract

The invention relates to the technical field of radio supervision, in particular to a radio supervision device and system based on big data, and the device comprises a data collection and processing module, an equipment fingerprint database module, an equipment recognition model training module, and a user behavior analysis and anomaly detection module. The data acquisition and processing module is used for acquiring and preprocessing radio equipment data to obtain preprocessed data; the equipment fingerprint database module is used for extracting feature vectors of the preprocessed data and constructing a fingerprint database; therefore, the radio data are collected, the feature vectors are extracted, then the fingerprint database is constructed, each device is managed, and identification and classification of each radio device are completed based on the fingerprint database, so that the accuracy of data identification during radio supervision is greatly improved, different types of devices are effectively distinguished, and the efficiency of radio supervision is improved. The quality and the effect of radio supervision are obviously improved; and finally, user behavior analysis can be completed according to the classified equipment.

Description

Technical Field

[0001] The present invention relates to the technical field of radio supervision, and particularly to a radio supervision device and system based on big data. Background Art

[0002] With the rapid development of radio technology, the management and supervision of radio spectrum resources have become increasingly complex. Traditional radio supervision methods mainly rely on manual monitoring and fixed spectrum scanning devices. However, the limited radio spectrum resources and the rapid growth of the number of devices have posed severe challenges to radio supervision. Therefore, currently, big data analysis technology is used to construct a database by collecting a large amount of radio data, so as to supervise radio.

[0003] In the aforementioned prior art, traditional supervision usually identifies and analyzes the signals of radio devices in real time or regularly to supervise radio devices. However, the radio data is extremely large, and at the same time, the diversity of radio devices and the similarity of signal characteristics make the recognition accuracy of traditional methods relatively low, making it difficult to effectively distinguish different types of devices and being unfavorable for high-quality radio supervision. Summary of the Invention

[0004] The purpose of the present invention is to provide a radio supervision device and system based on big data, which solves the problem that in the prior art, traditional supervision usually identifies and analyzes the signals of radio devices in real time or regularly to supervise radio devices. However, the radio data is extremely large, and at the same time, the diversity of radio devices and the similarity of signal characteristics make the recognition accuracy of traditional methods relatively low, making it difficult to effectively distinguish different types of devices and being unfavorable for high-quality radio supervision.

[0005] To achieve the above purpose, the present invention provides a radio supervision device based on big data, including a data acquisition and processing module, a device fingerprint library module, a device recognition model training module, and a user behavior analysis and anomaly detection module. The data acquisition and processing module, the device fingerprint library module, the device recognition model training module, and the user behavior analysis and anomaly detection module are connected in sequence;

[0006] The data acquisition and processing module is used to collect radio device data and preprocess it to obtain preprocessed data;

[0007] The device fingerprint library module is used to extract the feature vectors of the preprocessed data and construct a fingerprint library;

[0008] The device recognition model training module is used to classify the feature vectors of the fingerprint library to complete device recognition;

[0009] The user behavior analysis and anomaly detection module is used to select appropriate time series analysis methods for behavior analysis of each classified device and determine whether there is abnormal behavior.

[0010] Among them, the data acquisition and processing module includes a data acquisition unit, a denoising unit, a normalization unit, and a segmentation unit, and the data acquisition unit, the denoising unit, the normalization unit, and the segmentation unit are connected in sequence;

[0011] The data acquisition unit is used to capture radio signals in the target frequency band using an SDR device;

[0012] The denoising unit is used to remove out-of-band noise of the radio signal using a digital filter to obtain a first processed electrical signal;

[0013] The normalization unit is used to perform normalization processing on the amplitude of the first processed electrical signal to eliminate the influence brought by device hardware differences and obtain a second processed electrical signal;

[0014] The segmentation unit is used to divide the continuous second processed signal into time domain segments of a fixed length to obtain preprocessed data.

[0015] Among them, the device fingerprint library module includes a feature extraction unit and a fingerprint library construction unit, and the feature extraction unit and the fingerprint library construction unit are connected in sequence;

[0016] The feature extraction unit is used to extract features from the preprocessed data to obtain feature vectors;

[0017] The fingerprint library construction unit is used to associate the extracted feature vectors with radio device information, store them as device fingerprints, and manage the fingerprint library using a distributed storage system.

[0018] Among them, the feature extraction unit includes a time domain feature extraction subunit, a frequency domain feature extraction subunit, and a modulation domain feature extraction subunit, and the time domain feature extraction subunit, the frequency domain feature extraction subunit, and the modulation domain feature extraction subunit are connected in sequence;

[0019] The time domain feature extraction subunit is used to calculate the instantaneous amplitude and instantaneous phase of the preprocessed data, extract the time domain features of the preprocessed data, and the time domain features include mean, variance, and kurtosis, to obtain a time domain feature vector;

[0020] The frequency domain feature extraction subunit is used to perform a fast Fourier transform on the preprocessed data to obtain a frequency spectrum, extract frequency spectrum features, and the frequency spectrum features include main frequency, bandwidth, and spectral entropy, to obtain a frequency domain feature vector;

[0021] The modulation domain feature extraction subunit is used to identify the modulation features of the preprocessed data using a modulation recognition algorithm, extract the modulation features, where the modulation features include symbol rate and carrier frequency offset, and obtain a modulation feature vector.

[0022] Among them, the device recognition model training module includes a feature selection unit, a dataset construction unit, a dataset division unit, a model training unit, and a model performance evaluation unit. The feature selection unit, the dataset construction unit, the dataset division unit, the model training unit, and the model performance evaluation unit are connected in sequence;

[0023] The feature selection unit is used to evaluate each feature vector in the fingerprint database using a feature selection algorithm, select the most discriminative feature vectors according to the evaluation results, and obtain the discriminative feature vectors and the device labels recorded in the fingerprint database;

[0024] The dataset construction unit is used to convert the discriminative feature vectors and their device labels into a structured dataset;

[0025] The dataset division unit is used to divide 80% of the structured dataset into a training set and 20% into a test set;

[0026] The model training unit is used to input the feature vectors in the training set into a CNN deep learning model and output the device type;

[0027] The model performance evaluation unit is used to input the feature vectors of the test set into the CNN deep learning model, perform model performance evaluation, calculate accuracy, recall, and F1 score metrics, and further optimize the model parameters through cross-validation.

[0028] Among them, the model training unit includes a feature vector loading subunit, a feature vector reshaping subunit, and a type output subunit. The feature vector loading subunit, the feature vector reshaping subunit, and the type output subunit are connected in sequence;

[0029] The feature vector loading subunit is used to load the feature vectors and the corresponding device labels from the fingerprint database;

[0030] The feature vector reshaping subunit is used to reshape the feature vectors into a format suitable for CNN input;

[0031] The type output subunit is used to input the shape of the feature vector through the CNN input layer, then use multiple convolutional layers to extract the local feature maps of the feature vector, flatten the local feature maps, input them into the fully connected layer, and finally use the Softmax activation function to output the device type.

[0032] Among them, the user behavior analysis and anomaly detection module includes a behavior modeling unit, an anomaly detection unit, and a security response unit, which are connected in sequence;

[0033] The behavior modeling unit is used to select a suitable time series analysis method based on the device type, perform behavior modeling of this type to obtain an analysis model, and perform behavior prediction through the analysis model;

[0034] The anomaly detection unit is used to monitor device behavior in real time, calculate the difference between the actual behavior and the model-predicted behavior, and use the isolation forest method to detect abnormal behavior;

[0035] The security response unit is used to trigger a security alarm after discovering abnormal behavior.

[0036] The present invention also provides a radio supervision system based on big data, which applies the radio supervision device based on big data.

[0037] For the radio supervision device and system based on big data of the present invention, the data acquisition and processing module is used to collect radio device data and preprocess it to obtain preprocessed data; the device fingerprint library module is used to extract the feature vectors of the preprocessed data and construct a fingerprint library; the device recognition model training module is used to classify the feature vectors of the fingerprint library to complete device recognition; the user behavior analysis and anomaly detection module is used to select a suitable time series analysis method for behavior analysis for each classified device to determine whether there is abnormal behavior;

[0038] Thus, by collecting radio data and extracting feature vectors, then constructing a fingerprint library, and further managing each device, based on the fingerprint library, the recognition and classification of each radio device are completed, thereby greatly improving the recognition accuracy of data during radio supervision, effectively distinguishing different types of devices, and significantly improving the quality and effect of radio supervision; finally, the analysis of user behavior can also be completed according to the classified devices. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings required for use in the description of the embodiments or the prior art.

[0040] Figure 1 is the schematic diagram of the radio supervision device based on big data of the present invention.

[0041] Figure 2 is the schematic diagram of the data acquisition and processing module of the present invention.

[0042] Figure 3This is the schematic diagram of the device fingerprint database module of the present invention.

[0043] Figure 4 This is the schematic diagram of the feature extraction unit of the present invention.

[0044] Figure 5 This is the schematic diagram of the device identification model training module of the present invention.

[0045] Figure 6 This is the schematic diagram of the model training unit of the present invention.

[0046] 1 - Data acquisition and processing module, 101 - Data acquisition unit, 102 - Denoising unit, 103 - Normalization unit, 104 - Segmentation unit, 2 - Device fingerprint database module, 201 - Feature extraction unit, 2011 - Time - domain feature extraction sub - unit, 2012 - Frequency - domain feature extraction sub - unit, 2013 - Modulation - domain feature extraction sub - unit, 202 - Fingerprint database construction unit, 3 - Device identification model training module, 301 - Feature selection unit, 302 - Dataset construction unit, 303 - Dataset division unit, 304 - Model training unit, 3041 - Feature vector loading sub - unit, 3042 - Feature vector reshaping sub - unit, 3043 - Type output sub - unit, 305 - Model performance evaluation unit, 4 - User behavior analysis and anomaly detection module, 401 - Behavior modeling unit, 402 - Anomaly detection unit, 403 - Security response unit. Detailed implementation manners

[0047] The embodiments of the present invention will be described in detail below. The examples of the embodiments are shown in the accompanying drawings. The embodiments described below by referring to the drawings are exemplary and are intended to explain the present invention, and should not be construed as a limitation to the present invention.

[0048] Please refer to Figures 1 to 6 , the present invention provides a radio supervision device based on big data, specifically including:

[0049] The data acquisition and processing module 1 is used to collect radio device data and pre - process it to obtain pre - processed data;

[0050] Specifically including:

[0051] The data acquisition unit 101 is used to use an SDR device to capture radio signals in the target frequency band;

[0052] The SDR device can capture radio signals in the target frequency band mainly because it can convert radio signals into digital signals and perform flexible processing on a computer platform; the SDR device can be used to monitor and eavesdrop on radio signals, helping regulatory agencies detect potential threats and attacks. In radio supervision, this helps to timely discover illegal or irregular radio communication activities.

[0053] The denoising unit 102 is configured to remove the out-of-band noise of the radio signal using a digital filter to obtain a first processed electrical signal;

[0054] Digital filters can effectively remove out-of-band noise in signals and improve signal quality. In radio regulation, this helps ensure that received radio signals are clear and accurate, thereby improving the efficiency and accuracy of regulation.

[0055] The normalization unit 103 is configured to normalize the amplitude of the first processed electrical signal to eliminate the influence caused by hardware differences of devices, thereby obtaining a second processed electrical signal;

[0056] By dividing each value of the signal by the maximum value in the signal, the signal amplitude is adjusted to the range of [0, 1] or [-1, 1]; through normalization processing, these differences can be eliminated, making the signals received by different devices comparable in amplitude.

[0057] The segmentation unit 104 is configured to segment the continuous second processed signal into time-domain segments of a fixed length to obtain preprocessed data.

[0058] In radio regulation, a continuous signal stream contains a large amount of information. However, for the convenience of subsequent processing and analysis, it is necessary to segment it into time-domain segments of a fixed length; after segmenting the continuous signal stream into time-domain segments of a fixed length, each segment can be processed and analyzed independently. This greatly reduces the complexity of data processing and makes the processing process more efficient.

[0059] The device fingerprint library module 2 is configured to extract the feature vectors of the preprocessed data and construct a fingerprint library;

[0060] Specifically, it includes:

[0061] The feature extraction unit 201 is configured to extract features from the preprocessed data to obtain feature vectors;

[0062] Specifically, it includes:

[0063] The time-domain feature extraction sub-unit 2011 is configured to calculate the instantaneous amplitude and instantaneous phase of the preprocessed data, extract the time-domain features of the preprocessed data, where the time-domain features include mean, variance, and kurtosis, to obtain a time-domain feature vector;

[0064] For narrowband signals, the instantaneous amplitude can be calculated by the envelope of the signal, which reflects the change in signal strength; the instantaneous phase is the phase shift of the signal waveform relative to a reference point, which provides information about the change of the signal waveform over time. These two parameters can reveal the dynamic characteristics and modulation mode of the signal, which are of great significance for the recognition and classification of radio signals.

[0065] Mean: reflects the average level of the signal, which helps to identify the DC component or overall trend of the signal; Variance: measures the degree of signal fluctuation, that is, the degree of deviation of the signal from its mean. The larger the variance, the more drastic the signal fluctuation; Kurtosis: describes the sharpness of the signal distribution. A kurtosis value greater than 3 means that the signal distribution is sharper than the normal distribution, and less than 3 means it is flatter. The kurtosis feature is very useful for identifying outliers or mutation points in the signal; thus, by calculating the instantaneous amplitude and instantaneous phase, the features related to the signal modulation method can be extracted, thereby realizing the recognition and classification of different modulated signals.

[0066] The frequency domain feature extraction subunit 2012 is used to perform fast Fourier transform on the pre-processed data to obtain a spectrum, extract spectrum features, the spectrum features include main frequency, bandwidth and spectrum entropy, and obtain a frequency domain feature vector;

[0067] Fast Fourier transform significantly improves signal processing efficiency by decomposing DFT into smaller sub-problems and reducing redundant calculations by using symmetry and periodicity. It can convert time domain signals into frequency domain representations and reveal the frequency components of the signal. This conversion process is based on the Fourier principle, that is, any continuously measured time series or signal can be represented as an infinite superposition of sinusoidal signals of different frequencies; the extracted main frequency is the frequency component with the largest amplitude in the signal spectrum, which reflects the main frequency component of the signal. In the spectrum diagram obtained by FFT, the main frequency usually corresponds to the largest spectral peak; the bandwidth is the range of frequency components in the signal spectrum, which represents the distribution width of the signal in the frequency domain. The calculation of bandwidth usually involves the frequency range of significant spectral peaks in the spectrum diagram; spectrum entropy is an indicator to measure the complexity of the signal spectrum. It is based on the concept of information entropy and reflects the distribution and uncertainty of different frequency components in the signal spectrum. The larger the spectrum entropy, the more complex the signal spectrum and the more dispersed the frequency components.

[0068] The modulation domain feature extraction subunit 2013 is used to identify the modulation features of the preprocessed data using a modulation recognition algorithm, extract the modulation features, the modulation features include symbol rate and carrier frequency offset, and obtain a modulation feature vector.

[0069] The modulation recognition algorithm determines the modulation method of a signal by analyzing the signal's characteristics, such as in the frequency domain, time domain, and spectrum. Different modulation methods vary in terms of the signal's anti-interference ability, transmission rate, and stability. The extracted symbol rate (also known as the code rate or baud rate) refers to the data transmission rate, which determines the communication efficiency. In radio communication, the symbol rate is related to the signal's bit rate and channel parameters. Through the modulation recognition algorithm, the symbol rate of the signal can be accurately extracted, which is crucial for subsequent signal processing. Carrier frequency offset refers to the deviation between the actual transmission frequency of the signal and the theoretical or expected frequency. Excessive frequency offset can seriously affect the performance of the communication system.

[0070] The fingerprint database construction unit 202 is used to associate the extracted feature vectors with radio device information, store them as device fingerprints, and manage the fingerprint database using a distributed storage system.

[0071] Radio signals exhibit various characteristics during transmission. These characteristics can be used to identify and classify different radio devices. By associating the characteristics with the devices, fingerprints are formed to facilitate identification by staff and subsequent device recognition.

[0072] The device recognition model training module 3 is used to classify the feature vectors in the fingerprint database to complete device recognition.

[0073] Specifically, it includes:

[0074] The feature selection unit 301 is used to evaluate each feature vector in the fingerprint database using a feature selection algorithm, select the most discriminative feature vectors based on the evaluation results, and obtain the discriminative feature vectors and the device labels recorded in the fingerprint database.

[0075] The feature selection algorithm selects the most relevant and discriminative feature subset from the original feature set. This subset contains features that can best describe the device characteristics and distinguish different devices, thus facilitating device identification and classification.

[0076] The dataset construction unit 302 is used to convert the discriminative feature vectors and their device labels into a structured dataset.

[0077] After conversion into a dataset, it is convenient for subsequent dataset partitioning to train the model.

[0078] The dataset partitioning unit 303 is used to divide 80% of the structured dataset into a training set and 20% into a test set.

[0079] The model training unit 304 is used to input the feature vectors in the training set into a CNN deep learning model and output the device type.

[0080] Specifically include:

[0081] The feature vector loading subunit 3041 is used to load the feature vectors and the corresponding device tags from the fingerprint database;

[0082] Find out the feature vectors of the fingerprint database and the corresponding device tags to prepare for subsequent input into the CNN deep learning model.

[0083] The feature vector reshaping subunit 3042 is used to reshape the feature vectors into a format suitable for CNN input;

[0084] In the feature extraction of radio supervision, the obtained feature vectors are usually one-dimensional, containing a series of numerical features extracted from the signals. In order to input these feature vectors into the CNN, they need to be reshaped into a shape suitable for CNN processing; by adjusting the dimensions and shape of the feature vectors, they are converted into a two-dimensional matrix or a higher-dimensional tensor.

[0085] The type output subunit 3043 is used to input the shape of the feature vectors through the input layer of the CNN, then use multiple convolutional layers to extract the local feature maps of the feature vectors, flatten the local feature maps, input them into the fully connected layer, and finally use the Softmax activation function to output the device type.

[0086] The model performance evaluation unit 305 is used to input the feature vectors of the test set into the CNN deep learning model for model performance evaluation, calculate the accuracy rate, recall rate, and F1 score metrics, and further optimize the model parameters through cross-validation.

[0087] Accuracy rate: It represents the ratio of the number of samples correctly predicted by the model to the total number of samples. It measures the overall performance of the model, but may be dominated by the majority class samples in the case of sample imbalance; Recall rate: It represents the ratio of the number of positive samples correctly predicted by the model to the actual number of positive samples. It measures the ability of the model to identify positive samples and is particularly suitable for evaluating the performance of the model when detecting specific radio signals (such as illegal signals); F1 score: It is the weighted average of the accuracy rate and the recall rate, comprehensively considering the prediction ability and recall rate of the model. The F1 score is particularly suitable for the case where the number of positive and negative samples is unbalanced because it is not as easily affected by the sample number distribution as the accuracy rate.

[0088] The user behavior analysis and anomaly detection module 4 is used to select appropriate time series analysis methods for behavior analysis for each classified device to determine whether there is abnormal behavior.

[0089] Specifically include:

[0090] The behavior modeling unit 401 is configured to select a suitable time series analysis method based on the device type, perform behavior modeling of this type to obtain an analysis model, and perform behavior prediction through the analysis model.

[0091] If the data has long-term dependencies, select the long short-term memory network; if the data is linear, select the autoregressive integrated moving average model; if the data has state transition characteristics, select the hidden Markov model.

[0092] The anomaly detection unit 402 is configured to monitor device behavior in real time, calculate the difference between the actual behavior and the model-predicted behavior, and use the isolation forest method to detect abnormal behavior.

[0093] The operating data and behavior information of the device are captured in real time through sensors and log records. These data include the operating status, performance metrics, network communication, etc. of the device, and are used to reflect the actual behavior of the device. In the anomaly detection task, the isolation forest algorithm regards normal data points as data points that need more random partitions to be "isolated", while abnormal data points are more easily "isolated", thus facilitating the staff to find abnormal behavior.

[0094] The security response unit 403 is configured to trigger a security alarm after detecting abnormal behavior.

[0095] The present invention also provides a radio supervision system based on big data, which applies the radio supervision device based on big data.

[0096] Among them, it includes a visualization device and a user permission management device, which provide a large-screen display function, display radio service data and on-site command and dispatch data in real time, support the input of video images in multiple formats, and the adjustment of parameters such as brightness, contrast, and saturation. Through data visualization technology, it helps users understand data and analysis results more intuitively; user management provides functions such as user registration, login, and permission allocation to ensure the security and controllability of the system, and assigns different access and operation permissions according to the roles and responsibilities of users, thereby better supervising radio.

[0097] The above-disclosed are only one or more preferred embodiments of the present application, and the scope of rights of the present application cannot be limited thereby. Those of ordinary skill in the art can understand all or part of the processes of implementing the above embodiments, and the equivalent changes made according to the claims of the present application still fall within the scope covered by the present application.

Claims

1. A radio monitoring device based on big data, characterized in that: It includes a data acquisition and processing module, a device fingerprint library module, a device identification model training module and a user behavior analysis and anomaly detection module, wherein the data acquisition and processing module, the device fingerprint library module, the device identification model training module and the user behavior analysis and anomaly detection module are connected in sequence; The data collection and processing module is used to collect and pre-process the radio equipment data to obtain pre-processed data; The device fingerprint library module is used to extract the feature vector of the preprocessed data and build a fingerprint library; The device identification model training module is used to classify the feature vectors of the fingerprint library to complete device identification; The user behavior analysis and anomaly detection module is used to select a suitable time series analysis method to perform behavior analysis for each classified device to determine whether there is abnormal behavior.

2. The radio monitoring device based on big data as claimed in claim 1, characterized in that: The data acquisition and processing module comprises a data acquisition unit, a denoising unit, a normalization unit and a segmentation unit, wherein the data acquisition unit, the denoising unit, the normalization unit and the segmentation unit are connected in sequence; The data acquisition unit is used to capture the radio signal of the target frequency band using the SDR device; The denoising unit is used to remove out-of-band noise of the radio signal using a digital filter to obtain a first processed electrical signal; The normalization unit is used to normalize the amplitude of the first processed electrical signal to eliminate the influence of the device hardware difference, and obtain the second processed electrical signal; The segmentation unit is used to segment the continuous second processed signal into time domain segments of fixed length to obtain preprocessed data.

3. The radio monitoring device based on big data as claimed in claim 2, characterized in that: The device fingerprint library module includes a feature extraction unit and a fingerprint library construction unit, and the feature extraction unit and the fingerprint library construction unit are connected in sequence; The feature extraction unit is used to extract features from the preprocessed data to obtain a feature vector; The fingerprint library construction unit is used to associate the extracted feature vector with the radio device information, store them as device fingerprints, and manage the fingerprint library using a distributed storage system.

4. The radio monitoring device based on big data as claimed in claim 3, characterized in that: The feature extraction unit comprises a time domain feature extraction subunit, a frequency domain feature extraction subunit and a modulation domain feature extraction subunit, and the time domain feature extraction subunit, the frequency domain feature extraction subunit and the modulation domain feature extraction subunit are connected in sequence; The time domain feature extraction subunit is used to calculate the instantaneous amplitude and instantaneous phase of the preprocessed data, extract the time domain features of the preprocessed data, the time domain features include mean, variance and kurtosis, and obtain a time domain feature vector; The frequency domain feature extraction subunit is used to perform fast Fourier transform on the pre-processed data to obtain a spectrum, extract spectrum features, the spectrum features include main frequency, bandwidth and spectrum entropy, and obtain a frequency domain feature vector; The modulation domain feature extraction subunit is used to identify the modulation features of the preprocessed data using a modulation recognition algorithm, extract the modulation features, the modulation features include symbol rate and carrier frequency offset, and obtain a modulation feature vector.

5. The radio monitoring device based on big data as claimed in claim 4, characterized in that: The device identification model training module includes a feature selection unit, a data set construction unit, a data set division unit, a model training unit and a model performance evaluation unit, wherein the feature selection unit, the data set construction unit, the data set division unit, the model training unit and the model performance evaluation unit are connected in sequence; The feature selection unit is used to evaluate each feature vector in the fingerprint library using a feature selection algorithm, select the most discriminative feature vector according to the evaluation result, and obtain the discriminative feature vector and the device label recorded in the fingerprint library; The data set construction unit is used to convert the discriminative feature vector and its device label into a structured data set; The data set division unit is used to divide 80 percent of the structured data set into a training set and 20 percent into a test set; The model training unit is used to input the feature vector in the training set into the CNN deep learning model, and output the device type; The model performance evaluation unit is used to use the feature vector of the test set to input into the CNN deep learning model, perform model performance evaluation, calculate accuracy, recall and F1 score indicators, and further optimize model parameters through cross-validation.

6. The radio monitoring device based on big data as claimed in claim 5, characterized in that: The model training unit comprises a feature vector loading subunit, a feature vector reshaping subunit and a type output subunit, wherein the feature vector loading subunit, the feature vector reshaping subunit and the type output subunit are connected in sequence; The feature vector loading subunit is used to load the feature vector and the corresponding device tag from the fingerprint library; The feature vector reshaping subunit is used to reshape the feature vector into a format suitable for CNN input; The type output subunit is used to input the shape of the feature vector through the CNN input layer, then use multiple convolutional layers to extract the local feature map of the feature vector, flatten the local feature map, input it into the fully connected layer, and finally use the Softmax activation function to output the device type.

7. The radio monitoring device based on big data as claimed in claim 6, characterized in that: The user behavior analysis and anomaly detection module includes a behavior modeling unit, an anomaly detection unit and a security response unit, wherein the behavior modeling unit, the anomaly detection unit and the security response unit are connected in sequence; The behavior modeling unit is used to select a suitable time series analysis method based on the device type, perform behavior modeling of the type, obtain an analysis model, and perform behavior prediction through the analysis model; The anomaly detection unit is used to monitor the device behavior in real time, calculate the difference between the actual behavior and the model predicted behavior, and use the isolation forest method to detect abnormal behavior; The security response unit is used to trigger a security alarm after discovering abnormal behavior.

8. A radio supervision system based on big data, characterized in that: Application of the radio monitoring device based on big data as described in claim 7.

Images