A data prediction processing system based on internet of things security

Abstract

The application discloses a kind of data prediction processing systems based on Internet of Things security, it is related to data processing technical field, comprising the following steps: step one: data pre-processing;Step two: data stabilization;Step three: ARIMA modeling and residual extraction;Step four: LSTM residual modeling;Step five: prediction result fusion, in the application: ARIMA modeling and residual extraction, LSTM residual modeling and prediction result fusion, ARIMA is responsible for extracting the explicit linear law in time sequence, LSTM focuses on learning the residual sequence after ARIMA prediction, realizes the double-layer modeling of "linear base model+nonlinear correction", effectively aims at complex time series data processing in Internet of Things security data;In prediction result fusion, join alpha t Dynamic weight coefficient, control ARIMA and the contribution proportion of LSTM prediction result, beta sensitivity adjustment factor, determine the steepness of weight change with residual, can be flexibly adjusted according to actual situation, improve the flexibility of system.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and more specifically to a data prediction and processing system based on Internet of Things security. Background Technology

[0002] The data prediction and processing system is a platform that integrates data acquisition, preprocessing, algorithm modeling, and result application. It aims to extract patterns from historical and real-time data to form scientific predictions of future trends or events.

[0003] According to application publication number CN117574948A - A Data Prediction Processing Method and System Based on Neural Networks (hereinafter referred to as the Reference Patent), the patent describes a method for "constructing a basic BP neural network model by determining the number of nodes in the input and output layers, the number of layers and nodes in the hidden layers; obtaining a particle swarm optimization algorithm; optimizing the basic BP neural network model based on the particle swarm optimization algorithm to generate an optimized BP neural network model; obtaining the collected result value; obtaining the predicted value based on the optimized BP neural network model; comparing the collected result value with the predicted value; and processing the result based on the comparison. This method can obtain the predicted value through the optimized BP neural network model, accurately determine whether there is data anomaly by comparing it with the collected result value, without increasing the hardware cost of the device or affecting the safe operation of the device." Those skilled in the art will understand that this patent uses an optimized model to obtain the predicted value and compare it with the collected result value to accurately determine whether there is data anomaly. This model is based on the optimization of a BP neural network and a particle swarm optimization algorithm.

[0004] In the field of IoT security, there are many types of IoT devices and a wide range of data sources, including sensors, cameras, and smart terminals. As a result, there is complex time-series data, and the algorithm in the reference patent cannot process complex time-series data.

[0005] In summary, a data prediction and processing system based on Internet of Things security is designed. Summary of the Invention

[0006] To overcome the above-mentioned shortcomings, the present invention provides a data prediction and processing system based on Internet of Things security.

[0007] The present invention achieves the above objectives through the following technical solutions:

[0008] A data prediction and processing system based on Internet of Things security includes the following steps:

[0009] Step 1: Data preprocessing, unifying the timestamps of multi-source data, using linear interpolation or forward padding for missing values, and ensuring that the clocks of IoT devices are not synchronized, so they need to be aligned to the same time base (such as UTC) to ensure the continuity of time sequence.

[0010] Step 2: Data stationarization. Use the ADF test to determine the stationarity of the data. If necessary, perform differencing or logarithmic transformation. ARIMA requires that the data meet the weak stationarity requirement (mean, variance, and covariance do not change over time).

[0011] Step 3: ARIMA modeling and residual extraction;

[0012] Step 4: LSTM residual modeling;

[0013] Step 5: Prediction results are fused. ARIMA generates baseline predictions, LSTM predicts the parameter sequences, and the two are superimposed to obtain the final result.

[0014] Step Six: Evaluation metrics are used to quantify the model's predictive ability;

[0015] Step three includes the following steps:

[0016] S31. Parameter definition: Define the parameters in ARIMA(p,d,q): p: Autoregression order (the length of the influence of historical values ​​on the current value), d: Difference order (the minimum number of operations to make the data stable), q: Moving average order (the number of times historical errors are corrected for the current value).

[0017] S32. Parameter determination, ACF / PACF plot analysis, including ACF tailing, PACF truncation, and k-order... AR(k), if ACF is truncated and m-order, PACF has a trailing tail MA(m) minimizes either AIC or BIC. , k is the total number of model parameters, L is the likelihood transformation value, and n is the sample size;

[0018] S33. Model training, ARIMA equation is:

[0019]

[0020] L is the lag operator. ;

[0021] These are the autoregressive coefficients. The moving average coefficient is... ;

[0022] S34. Residual extraction and white noise test, the residual sequence is: The Ljung-Box test was used to test for white noise (if the p-value > 0.05, it indicates that the residuals have no autocorrelation). , is the autocorrelation coefficient with lag order k, and m is the maximum lag order.

[0023] Preferably, the following formula is used in step one:

[0024]

[0025] in, The interpolation weight is usually set to 0.5 to balance the influence of the values ​​before and after the interpolation.

[0026] Preferably, step two uses the following formula:

[0027] difference: - d is the difference order;

[0028] Logarithmic transformation: , It is a small constant to prevent zero overflow.

[0029] Preferably, step four includes the following steps:

[0030] S41. Time window division, dividing the residual sequence { Convert to supervised learning format:

[0031] Y= T is the length of the time window, which is usually a multiple of the periodicity, such as 24 hours or 7 days.

[0032] S42. Normalization processing: Min-Max scaled to the [-1,1] interval. E represents all data in the residual sequence;

[0033] S43, Internal operations within the unit;

[0034] S44. Network topology design, including input layer, which is T×1 (time step × number of features); hidden layer, which is 2-layer LSTM, each layer has 64 neurons (Dropout=0.2 to prevent overfitting); output layer, which is Dense(1)+ linear activation (regression prediction).

[0035] Preferably, the internal computation steps of the unit include:

[0036] S431, Forgot Gate: Determines which historical data to discard. ;

[0037] S432, the input gate, is used to update the cell state. , ;

[0038] S433, Cell State Update ;

[0039] S434, Output Gate, generates the current hidden state. , ( ),in For the weight matrix and bias terms, For the Sigmoid function, For Hadamard products.

[0040] Preferably, the fusion is performed using a superposition formula in step five.

[0041] The superposition formula is , , This is a sensitivity coefficient, whose weights are adaptively adjusted according to the absolute value of the residual. The value ranges from 0 to 1, representing a dynamic weighting coefficient that controls the contribution ratio of ARIMA and LSTM prediction results. Physical meaning: When historical residuals... Larger (e.g., a DDoS attack is detected). →0, LSTM dominates the correction; otherwise, ARIMA maintains the baseline prediction.

[0042] Preferably, in step six, the evaluation indicators include mean absolute error (MAE), which directly reflects the average deviation between the predicted and actual values. It is non-directional and suitable for scenarios insensitive to outliers (such as temperature forecasting), but cannot distinguish the weight differences between large and small errors. The mean absolute percentage error (MASE) measures relative error as a percentage, which is intuitive and easy to understand, suitable for horizontal comparisons of data with different dimensions (such as sales revenue and inventory forecasting). When it approaches zero, the mean absolute percentage error will infinitely amplify the error and the root mean square error, amplifying the impact of larger errors, reflecting the stability of the prediction, and penalizing predictions that deviate significantly (such as avoiding extreme losses in financial risk control). The dimensions are consistent with the original data, making it highly comparable. The symmetrical mean absolute percentage error solves the asymmetry of the mean absolute percentage error near zero and avoids the problem of the denominator being zero.

[0043] The beneficial effects of this invention are: In this IoT-based secure data prediction and processing system:

[0044] 1. ARIMA modeling and residual extraction, LSTM residual modeling and prediction result fusion: ARIMA is responsible for extracting the explicit linear patterns in the time series, and LSTM focuses on learning the residual sequence after ARIMA prediction, realizing a two-layer modeling of "linear fundamental mode + nonlinear correction", which is effective for processing complex time series data in IoT security data.

[0045] 2. In the prediction result fusion, add The dynamic weighting coefficient controls the contribution ratio of ARIMA and LSTM prediction results, while the β sensitivity adjustment factor determines the steepness of the weight change with the residual. It can be flexibly adjusted according to the actual situation, improving the flexibility of the system. Attached Figure Description

[0046] The present invention will be described by way of example and with reference to the accompanying drawings, wherein:

[0047] Figure 1 This is a step diagram of the present invention;

[0048] Figure 2 This is a flowchart illustrating the steps of ARIMA modeling and residual extraction in this invention;

[0049] Figure 3 This is a flowchart illustrating the steps of LSTM residual modeling in this invention;

[0050] Figure 4 This is a flowchart illustrating the steps of the internal operations of the unit in this invention. Detailed Implementation

[0051] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0052] like Figures 1-4 As shown, a data prediction and processing system based on Internet of Things security includes the following steps:

[0053] Step 1: Data preprocessing, unifying the timestamps of multi-source data, using linear interpolation or forward padding for missing values, and ensuring that the clocks of IoT devices are not synchronized, so they need to be aligned to the same time base (such as UTC) to ensure the continuity of time sequence.

[0054] Step 2: Data stationarization. Use the ADF test to determine the stationarity of the data. If necessary, perform differencing or logarithmic transformation. ARIMA requires that the data meet the weak stationarity requirement (mean, variance, and covariance do not change over time).

[0055] Step 3: ARIMA modeling and residual extraction;

[0056] Step 4: LSTM residual modeling;

[0057] Step 5: Prediction results are fused. ARIMA generates baseline predictions, LSTM predicts the parameter sequences, and the two are superimposed to obtain the final result.

[0058] Step Six: Evaluation metrics are used to quantify the model's predictive ability;

[0059] Step three includes the following steps:

[0060] S31. Parameter definition: Define the parameters in ARIMA(p,d,q): p: Autoregression order (the length of the influence of historical values ​​on the current value), d: Difference order (the minimum number of operations to make the data stable), q: Moving average order (the number of times historical errors are corrected for the current value).

[0061] S32. Parameter determination, ACF / PACF plot analysis, including ACF tailing, PACF truncation, and k-order... AR(k), if ACF is truncated and m-order, PACF has a trailing tail MA(m) minimizes either AIC or BIC. , k is the total number of model parameters, L is the likelihood transformation value, and n is the sample size;

[0062] S33. Model training, ARIMA equation is:

[0063]

[0064] L is the lag operator. ;

[0065] These are the autoregressive coefficients. The moving average coefficient is... ;

[0066] S34. Residual extraction and white noise test, the residual sequence is: The Ljung-Box test was used to test for white noise (if the p-value > 0.05, it indicates that the residuals have no autocorrelation). , is the autocorrelation coefficient with lag order k, and m is the maximum lag order.

[0067] Specifically, the following formula is used in step one:

[0068]

[0069] in, The interpolation weight is usually set to 0.5 to balance the influence of the values ​​before and after the interpolation.

[0070] Specifically, step two uses the following formula:

[0071] difference: - d is the difference order;

[0072] Logarithmic transformation: , It is a small constant to prevent zero overflow.

[0073] Specifically, step four includes the following steps:

[0074] S41. Time window division, dividing the residual sequence { Convert to supervised learning format:

[0075] Y= T is the length of the time window, which is usually a multiple of the periodicity, such as 24 hours or 7 days.

[0076] S42. Normalization processing: Min-Max scaled to the [-1,1] interval. E represents all data in the residual sequence;

[0077] S43, Internal operations within the unit;

[0078] S44. Network topology design, including input layer, which is T×1 (time step × number of features); hidden layer, which is 2-layer LSTM, each layer has 64 neurons (Dropout=0.2 to prevent overfitting); output layer, which is Dense(1)+ linear activation (regression prediction).

[0079] Specifically, the internal calculation steps of the unit include:

[0080] S431, Forgot Gate: Determines which historical data to discard. ;

[0081] S432, the input gate, is used to update the cell state. , ;

[0082] S433, Cell State Update ;

[0083] S434, Output Gate, generates the current hidden state. , ( ),in For the weight matrix and bias terms, For the Sigmoid function, For Hadamard products.

[0084] Specifically, in step five, fusion is performed using a superposition formula.

[0085] The superposition formula is , , This is a sensitivity coefficient, whose weights are adaptively adjusted according to the absolute value of the residual. The value ranges from 0 to 1, representing a dynamic weighting coefficient that controls the contribution ratio of ARIMA and LSTM prediction results. Physical meaning: When historical residuals... Larger (e.g., a DDoS attack is detected). →0, LSTM dominates the correction; otherwise, ARIMA maintains the baseline prediction.

[0086] The dynamic generation logic is: based on the absolute value of the residual at the previous time step. This reflects the cumulative effect of short-term prediction errors in the model. In IoT edge computing, the mean residual can be calculated using a sliding window (such as a 5-second window) to enhance robustness.

[0087] As a specific example:

[0088] When monitoring electricity meter data using the Internet of Things (IoT), if a smart meter's prediction error at the previous moment... =10%, take β=1.0, then: .52 indicates that the contributions of ARIMA and LSTM are approximately balanced, which is suitable for mildly fluctuating scenarios (such as alternating day and night loads).

[0089] β tuning strategy

[0090] β is dynamically adjusted using a PID controller. ,

[0091] in , , These represent the proportional, integral, and differential coefficients, respectively.

[0092] Specifically, in step six, the evaluation indicators include mean absolute error (MAE), which directly reflects the average deviation between the predicted and actual values. It is non-directional and suitable for scenarios insensitive to outliers (such as temperature forecasting), but cannot distinguish the weight differences between large and small errors. The mean absolute percentage error (MASE) measures relative error as a percentage, which is intuitive and easy to understand, suitable for horizontal comparisons of data with different dimensions (such as sales revenue and inventory forecasting). When the actual value... When it approaches zero, the mean absolute percentage error will infinitely amplify the error and the root mean square error, amplifying the impact of larger errors, reflecting the stability of the prediction, and penalizing predictions that deviate significantly (such as avoiding extreme losses in financial risk control). The dimensions are consistent with the original data, making it highly comparable. The symmetrical mean absolute percentage error solves the asymmetry of the mean absolute percentage error near zero and avoids the problem of the denominator being zero.

[0093] As a specific embodiment one,

[0094] The steps for DDoS attack detection are as follows:

[0095] 1. ARIMA modeling, parameters p=3, d=1, q=2 (based on historical flow ACF / PACF analysis), output predicted normal flow. ;

[0096] 2. LSTM residual analysis, input =Actual traffic- Threshold trigger: when The traffic was identified as abnormal.

[0097] 3. Dynamic defense response: If the threshold is triggered for 5 consecutive time points, traffic scrubbing and source IP blocking will be initiated.

[0098] As a specific embodiment two,

[0099] Industrial IoT device abnormal operation detection

[0100] In smart manufacturing scenarios, attackers may hijack critical equipment such as PLCs (Programmable Logic Controllers) and tamper with production processes by issuing illegal commands, resulting in equipment damage or production line shutdowns.

[0101] 1. Data sources: Device operation logs (command type, execution frequency), sensor data (current, temperature);

[0102] 2. ARIMA modeling: Construct a normal instruction cycle model based on historical data (e.g., executing a control signal once every 5 seconds);

[0103] 3. LSTM residual analysis: detects sudden high-frequency commands (such as 10 commands issued in succession within 1 second) or abnormal parameter combinations (such as heating still starting when the temperature exceeds the limit).

[0104] 4. Dynamic defense: If the residual exceeds 3 times the standard deviation, the device operation will be locked and the device fingerprint verification (based on MAC address and firmware hash value) will be initiated.

[0105] As a specific embodiment three,

[0106] Medical IoT Vital Sign Data Tampering Detection

[0107] Data tampering attacks targeting patient monitors, insulin pumps, and other devices (such as falsifying heart rate data to conceal the patient's condition or maliciously adjusting drug injection dosages).

[0108] 1. Data source: Time series data of vital signs (ECG, blood oxygen saturation), device communication latency;

[0109] 2. ARIMA physiological baseline: Construct individualized ranges of fluctuations in health indicators for patients (e.g., resting heart rate 60-100 bpm).

[0110] 3. LSTM multivariate correlation: Detecting contradictory signals (such as a sudden drop in blood oxygen but a failure of respiratory rate to rise synchronously);

[0111] In case of safety issues, redundant verification is initiated (e.g., comparing the data consistency between the bedside monitor and the central system).

[0112] Based on the above description, those skilled in the art can make various changes and modifications without departing from the technical concept of this invention. The technical scope of this invention is not limited to the contents of the specification, but must be determined according to the scope of the claims.

Claims

1. A data prediction and processing system based on Internet of Things security, characterized in that: Includes the following steps: Step 1: Data preprocessing, including unifying the timestamps of multi-source data and using linear interpolation or forward filling for missing values. The data includes the device's operation logs and sensor data. Step 2: Data stationarization, including determining data stationarity through the ADF test and performing differencing or logarithmic transformation; Step 3: ARIMA modeling and residual extraction; Step 4: LSTM residual modeling; Step 5: Prediction results fusion. ARIMA generates baseline predictions, LSTM predicts the parameter sequences, and the two are superimposed to obtain the final result. In step five, fusion is performed using a superposition formula. The superposition formula is: , ,in This is a sensitivity coefficient, whose weights are adaptively adjusted according to the absolute value of the residual. The value is between 0 and 1, representing a dynamic weighting coefficient. β tuning strategies; β is dynamically adjusted using a PID controller, and the adjustment formula is as follows: ,in , , These represent the proportional, integral, and differential coefficients, respectively. Step Six: Evaluation metrics are used to quantify the model's predictive ability; Step three includes the following steps: S31. Parameter definition: Define the parameters in ARIMA(p,d,q), where p is the autoregression order, d is the difference order, and q is the moving average order. S32. Parameter determination, ACF / PACF plot analysis, including ACF tailing, PACF truncation, and k-order... AR(k), if ACF is truncated and m-order, PACF has a trailing tail MA(m) minimizes either AIC or BIC. , k is the total number of model parameters, L is the likelihood transformation value, and n is the sample size; S33. Model training, the ARIMA equation is: L is the lag operator. ; These are the autoregressive coefficients. The moving average coefficient is... ; S34. Residual extraction and white noise test, the residual sequence is: The Ljung-Box test was used to test for white noise. , is the autocorrelation coefficient with lag order k, and m is the maximum lag order.

2. The data prediction and processing system based on IoT security according to claim 1, characterized in that: The following formula is used in step one: in, Interpolation weight is set to 0.5 to balance the influence of the values ​​before and after.

3. The data prediction and processing system based on IoT security according to claim 1, characterized in that: Step two uses the following formula: difference: d is the difference order; Logarithmic transformation: , It is a small constant to prevent zero overflow.

4. The data prediction and processing system based on IoT security according to claim 1, characterized in that: Step four includes the following steps: S41. Time window division, dividing the residual sequence { Convert to supervised learning format: T is the length of the time window, a periodic integer multiple; S42. Normalization processing: Min-Max scaled to the [-1,1] interval. E represents all data in the residual sequence; S43, Internal operations within the unit; S44. Network topology design, including input layer, hidden layer and output layer.

5. The data prediction and processing system based on IoT security according to claim 4, characterized in that: The internal computation steps of the unit include: S431, Gate of Oblivion ; S432, Input Gate, , ; S433, Cell State Update ; S434, Output Gate, generates the current hidden state. , ,in For the weight matrix and bias terms, For the Sigmoid function, For Hadamard products.

6. The data prediction and processing system based on IoT security according to claim 1, characterized in that: In step six, the evaluation indicators include mean absolute error, mean absolute percentage error, root mean square error, and symmetrical mean absolute percentage error.

Images