An Internet of Things system, device and medium based on fifth-generation mobile communication technology

Abstract

The present invention provides an Internet of Things (IoT) system, device, and medium based on fifth-generation mobile communication technology, relating to the field of IoT technology. The system includes a 5G connection module and an anomaly detection module; the 5G connection module connects to a terminal device and obtains device data of the terminal device; the anomaly detection module is used to generate predicted reporting time data for the next moment based on historical reporting time data and environmental data, and to generate a data timeout anomaly judgment result based on the predicted reporting time data and the actual reporting time data; the system is used to analyze the statistical characteristic values ​​of each window of the time series data and the weights corresponding to the statistical characteristic values, and to determine the extreme value anomaly probability based on the time series data and the statistical characteristic values, and to generate an extreme value anomaly judgment result based on the statistical characteristic values, the weights, and the extreme value anomaly probability; and the system is also used to generate an extreme value proportion anomaly judgment result. The present invention can analyze abnormal connection situations.

Description

Technical Field

[0001] The present invention relates to the field of Internet of Things technology, and in particular to an Internet of Things system, device, and medium based on fifth-generation mobile communication technology. Background Art

[0002] The Internet of Things (IoT) refers to a set of software solutions designed to enable connectivity between objects and between them and the internet. IoT systems allow devices, sensors, and appliances to exchange data over a network and perform specific tasks or provide services based on the collected data.

[0003] In related technologies, most IoT systems can only view the normal connection status of devices when connecting devices, but cannot analyze abnormal connection status of devices. Summary of the Invention

[0004] The problem solved by the present invention is how to analyze abnormal connection conditions of IoT devices.

[0005] To solve the above problems, the present invention provides an Internet of Things system, device and medium based on fifth-generation mobile communication technology.

[0006] In a first aspect, the present invention provides an Internet of Things system based on fifth-generation mobile communication technology, including a 5G connection module and an anomaly detection module;

[0007] The 5G connection module is based on the fifth generation mobile communication technology, connects to the terminal device, and obtains the device data of the terminal device, wherein the device data includes historical reporting time data, actual reporting time data, environmental data, and time series data;

[0008] The anomaly detection module includes a data timeout unit and an extreme value unit. The data timeout unit is used to use a bidirectional LSTM model to generate predicted reporting time data for the next moment based on the historical reporting time data and the environmental data, and generate a data timeout anomaly judgment result based on the predicted reporting time data and the actual reporting time data;

[0009] The extreme value unit is used to use a multi-scale sliding window to analyze the statistical characteristic values ​​of each window of the time series data and the weights corresponding to the statistical characteristic values, and use a hidden Markov model to determine the extreme value anomaly probability based on the time series data and the statistical characteristic values, generate an extreme value comprehensive anomaly score based on the statistical characteristic values, the weights and the extreme value anomaly probability, and generate an extreme value anomaly judgment result based on the extreme value comprehensive anomaly score, wherein the statistical characteristic values ​​include a mean and a variance;

[0010] The extreme value unit is further used to generate a fitting mean and a fitting variance based on the time series data using a maximum likelihood estimation method, and based on the fitting mean and the fitting variance, use a cumulative distribution function to determine the theoretical proportion of extreme values, determine the actual proportion of extreme values ​​based on the mean and the variance, and generate an extreme value proportion abnormality judgment result based on the theoretical proportion of extreme values ​​and the actual proportion of extreme values.

[0011] Optionally, the bidirectional LSTM model is used to generate the predicted reporting time data at the next moment according to the historical reporting time data and the environmental data, including:

[0012] The bidirectional LSTM model is used to generate preliminary forecast data based on the historical reporting time data and the preliminary forecast formula. The preliminary forecast formula includes:

[0013] ;

[0014] ;

[0015] Among them, h t is the output of the hidden layer of the bidirectional LSTM model, is the historical reporting time data, n is n moments, t is t moments, BiLSTM is the calculation rule of the hidden layer of the bidirectional LSTM model, are the trainable parameters of the bidirectional LSTM model, including the weight matrix and bias term, is the preliminary forecast data, To map the hidden layer output of the bidirectional LSTM model to the weight matrix of the prediction time, is the bias term for prediction time;

[0016] The attention mechanism is used to weight the environmental data and sum them according to the importance weight formula to generate environmental impact data. The importance weight formula includes:

[0017] ;

[0018] ;

[0019] in, is the importance weight of the environmental data, softmax is the attention calculation rule, is the environmental data, is the weight matrix that maps the environmental data to the attention weight space, is the bias term of the attention mechanism, The environmental impact data, is the importance weight of the i-th environmental data, is the i-th environmental data;

[0020] The preliminary prediction data and the environmental impact degree data are fused using a fusion formula to generate the prediction reporting time data. The fusion formula includes:

[0021] T = f ( T t+1 , ct ; θ f )

[0022] in, T is the prediction reporting time data, f is the fusion rule, θ f are the trainable parameters of the fusion, including the weight matrix and bias terms.

[0023] Optionally, generating a data timeout exception judgment result according to the predicted reporting time data and the actual reporting time data includes:

[0024] According to the predicted reporting time data and the environmental data, a dynamic timeout threshold formula is used to determine a dynamic timeout threshold, wherein the dynamic timeout threshold formula includes:

[0025] ;

[0026] in, is the dynamic timeout threshold, reporting time data for said prediction, is the safety buffer factor, is the standard deviation of the historical reported time data, is the weight coefficient, is the degree of change of the environmental data;

[0027] The data timeout abnormality judgment result is generated according to the actual reporting time data and the dynamic timeout threshold.

[0028] Optionally, the adopting of a multi-scale sliding window to analyze the statistical characteristic values ​​of each window of the time series data and the weights corresponding to the statistical characteristic values ​​includes:

[0029] Using the multi-scale sliding window, analyzing the statistical characteristic values ​​of each window of the time series data and the uncertainty entropy value of the statistical characteristic values ​​of each window;

[0030] The weight is determined according to the uncertainty entropy value, wherein the uncertainty entropy value is inversely proportional to the corresponding weight.

[0031] Optionally, generating an extreme value comprehensive anomaly score according to the statistical characteristic value, the weight, and the extreme value anomaly probability includes:

[0032] According to the statistical characteristic value, the weight and the extreme value anomaly probability, a comprehensive formula is used to generate the extreme value comprehensive anomaly score, and the comprehensive formula includes:

[0033] ;

[0034] in, is the extreme value comprehensive anomaly score, is the weight, is the time series data, is the mean value, The variance, To adjust the parameters, is the extreme value abnormal probability.

[0035] Optionally, the terminal device includes a camera, the device data includes historical video data and current video data corresponding to the camera, and the anomaly detection module further includes an occlusion detection unit;

[0036] The occlusion detection unit is used to extract the unobstructed background features of the historical video data using a deep learning model, and based on the unobstructed background features, use an adversarial network to construct an unobstructed virtual model, input the current video data into the trained unobstructed virtual model, and generate an occlusion detection result.

[0037] Optionally, the anomaly detection module further includes a screen distortion detection unit;

[0038] The distorted screen detection unit is used to convert the current video data into a Lab color space, and use wavelet transform to analyze the video data in the Lab color space to generate a distorted screen detection result.

[0039] Optionally, the anomaly detection module further includes a fuzzy detection unit;

[0040] The blur detection unit is used to perform frequency domain analysis on the current video data using fast Fourier transform to generate a blur detection result.

[0041] In a second aspect, the present invention provides an electronic device comprising a memory and a processor;

[0042] The memory is used to store computer programs;

[0043] The processor is configured to implement the following steps when executing the computer program:

[0044] Based on fifth-generation mobile communication technology, connecting to a terminal device and obtaining device data of the terminal device, wherein the device data includes historical reporting time data, actual reporting time data, environmental data, and time series data;

[0045] A bidirectional LSTM model is used to generate predicted reporting time data for the next moment based on the historical reporting time data and the environmental data, and a data timeout abnormality judgment result is generated based on the predicted reporting time data and the actual reporting time data;

[0046] Using a multi-scale sliding window, analyzing the statistical characteristic values ​​of each window of the time series data and the weights corresponding to the statistical characteristic values, and using a hidden Markov model based on the time series data and the statistical characteristic values, determining the extreme value anomaly probability, generating an extreme value comprehensive anomaly score based on the statistical characteristic values, the weights, and the extreme value anomaly probability, and generating an extreme value anomaly judgment result based on the extreme value comprehensive anomaly score, wherein the statistical characteristic values ​​include a mean and a variance;

[0047] According to the time series data, the maximum likelihood estimation method is adopted to generate a fitting mean and a fitting variance, and based on the fitting mean and the fitting variance, the cumulative distribution function is adopted to determine the theoretical proportion of extreme values, and according to the mean and the variance, the actual proportion of extreme values ​​is determined, and according to the theoretical proportion of extreme values ​​and the actual proportion of extreme values, an extreme value proportion abnormality judgment result is generated.

[0048] In a third aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the following steps are implemented:

[0049] Based on fifth-generation mobile communication technology, connecting to a terminal device and obtaining device data of the terminal device, wherein the device data includes historical reporting time data, actual reporting time data, environmental data, and time series data;

[0050] A bidirectional LSTM model is used to generate predicted reporting time data for the next moment based on the historical reporting time data and the environmental data, and a data timeout abnormality judgment result is generated based on the predicted reporting time data and the actual reporting time data;

[0051] Using a multi-scale sliding window, analyzing the statistical characteristic values ​​of each window of the time series data and the weights corresponding to the statistical characteristic values, and using a hidden Markov model based on the time series data and the statistical characteristic values, determining the extreme value anomaly probability, generating an extreme value comprehensive anomaly score based on the statistical characteristic values, the weights, and the extreme value anomaly probability, and generating an extreme value anomaly judgment result based on the extreme value comprehensive anomaly score, wherein the statistical characteristic values ​​include a mean and a variance;

[0052] According to the time series data, the maximum likelihood estimation method is adopted to generate a fitting mean and a fitting variance, and based on the fitting mean and the fitting variance, the cumulative distribution function is adopted to determine the theoretical proportion of extreme values, and according to the mean and the variance, the actual proportion of extreme values ​​is determined, and according to the theoretical proportion of extreme values ​​and the actual proportion of extreme values, an extreme value proportion abnormality judgment result is generated.

[0053] The beneficial effects of the Internet of Things system, device and medium based on the fifth generation mobile communication technology of the present invention are:

[0054] The present invention connects terminal devices through the 5G connection module based on the fifth generation mobile communication technology, and can provide a stable connection channel and a fast data transmission channel, so as to obtain the device data of the terminal device stably and quickly. Through the data timeout unit of the anomaly detection module, a bidirectional LSTM model is used for forward and reverse propagation to capture the long-term dependency of the time series of historical reporting time data, and considering the influence of environmental data, accurate predicted reporting time data, that is, the normal reporting time of the terminal device, is generated, so that the actual actual reporting time data is compared with the predicted reporting time data, and whether the data upload of the terminal device connected to the Internet of Things is accurately judged. Then, through the extreme value unit of the anomaly detection module, a multi-scale sliding window is used to analyze the statistical characteristic value of each window of the time series data and the weight corresponding to the statistical characteristic value , the statistical characteristic values ​​at different time scales can be captured through multiple window sizes, that is, the mean and variance, so as to fully describe the distribution characteristics of the data, and through the corresponding weights, the model can pay more attention to the windows with high certainty, and then according to the time series data and the statistical characteristic values, the hidden Markov model is used to determine the extreme value anomaly probability of the extreme value in the time series data, so as to facilitate the subsequent judgment of whether the extreme value in the current data belongs to an abnormal state, and finally comprehensively consider the statistical characteristic values, weights and extreme value anomaly probability to reasonably judge whether the extreme value of the terminal device connected to the Internet of Things is abnormal. The extreme value unit also uses the maximum likelihood estimation method and the cumulative distribution function to determine the proportion of extreme values ​​under theoretical conditions, that is, the extreme value theoretical proportion, and then compares the extreme value theoretical proportion with the extreme value actual proportion, so as to judge whether the extreme value proportion of the terminal device connected to the Internet of Things is abnormal. The present invention can further analyze whether the connection of the terminal device is abnormal by analyzing and judging the data upload time, extreme value and extreme value proportion of the terminal device connected to the Internet of Things. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] Figure 1 A schematic diagram of the structure of an Internet of Things system based on fifth-generation mobile communication technology provided by an embodiment of the present invention;

[0056] Figure 2 A schematic structural diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0057] To make the above-mentioned objects, features, and advantages of the present invention more clearly understood, specific embodiments of the present invention are described in detail below with reference to the accompanying drawings. Although certain embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be construed as being limited to the embodiments described herein. Instead, these embodiments are provided to provide a more thorough and complete understanding of the present invention. It should be understood that the drawings and embodiments of the present invention are for illustrative purposes only and are not intended to limit the scope of protection of the present invention.

[0058] It should be understood that the various steps described in the method embodiments of the present invention may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present invention is not limited in this respect.

[0059] The term "including" and its variations used in this document are open inclusions, that is, "including but not limited to"; the term "based on" means "based at least in part on"; the term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one other embodiment"; the term "some embodiments" means "at least some embodiments"; the term "optionally" means "optional embodiments". The relevant definitions of other terms will be given in the following description. It should be noted that the concepts of "first", "second", etc. mentioned in the present invention are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0060] It should be noted that the modifications of "one" and "multiple" mentioned in the present invention are illustrative rather than restrictive. Those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0061] The names of the messages or information exchanged between multiple devices in the embodiments of the present invention are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0062] In response to the problems existing in the above-mentioned related technologies, this embodiment provides an Internet of Things system, device and medium based on fifth-generation mobile communication technology.

[0063] like Figure 1 As shown, an embodiment of the present invention provides an Internet of Things system based on the fifth generation mobile communication technology, including a 5G connection module and an anomaly detection module;

[0064] The 5G connection module is based on the fifth generation mobile communication technology, connects to the terminal device, and obtains the device data of the terminal device, wherein the device data includes historical reporting time data, actual reporting time data, environmental data and time series data.

[0065] Specifically, the 5G connection module is based on the fifth generation of mobile communication technology and connects terminal devices to provide a stable connection channel and a fast data transmission channel, thereby stably and quickly obtaining the device data of the terminal device. The device data includes historical reporting time data, actual reporting time data, environmental data, and time series data. Terminal devices may include mobile phones, computers, sensors, monitors, and cameras. Environmental data refers to data about the environment of the terminal device, such as network latency, packet loss rate, and device power. Time series data refers to data related to the time dimension, such as sensor data, device performance data, behavior data, and timestamp data.

[0066] The anomaly detection module includes a data timeout unit and an extreme value unit. The data timeout unit is used to adopt a bidirectional LSTM model to generate the predicted reporting time data of the next moment based on the historical reporting time data and the environmental data, and generate a data timeout anomaly judgment result based on the predicted reporting time data and the actual reporting time data.

[0067] Specifically, the bidirectional LSTM model, namely the BiLSTM model, combines forward LSTM and backward LSTM, and can simultaneously capture past and future contextual information in time series data. At the same time, it introduces the influence of environmental variables (such as network delay, packet loss rate, etc.) on the prediction results, improves the model's adaptability to complex scenarios, and obtains the predicted reporting time data for the next moment of the historical reporting time data. The predicted reporting time data is compared with the actual reporting time data. If the predicted reporting time data and the actual reporting time data are different, the data timeout anomaly judgment result is data reporting timeout and reporting time anomaly. If the predicted reporting time data and the actual reporting time data are the same, the data timeout anomaly judgment result is data reporting not timed out and reporting time is normal. Among them, the minimum unit of the predicted reporting time data and the actual reporting time data is seconds, and the difference between the predicted reporting time data and the actual reporting time data is within 1 second. By default, the predicted reporting time data and the actual reporting time data are the same.

[0068] The extreme value unit is used to use a multi-scale sliding window to analyze the statistical characteristic values ​​of each window of the time series data and the weights corresponding to the statistical characteristic values, and use a hidden Markov model based on the time series data and the statistical characteristic values ​​to determine the extreme value anomaly probability, generate an extreme value comprehensive anomaly score based on the statistical characteristic values, the weights and the extreme value anomaly probability, and generate an extreme value anomaly judgment result based on the extreme value comprehensive anomaly score, wherein the statistical characteristic values ​​include mean and variance.

[0069] Specifically, the extreme value unit uses a multi-scale sliding window to capture statistical features at different time scales, such as mean and variance, through multiple window sizes to comprehensively describe the data distribution. The multi-scale sliding window also determines weights corresponding to statistical features, ensuring the rational use of multi-scale information. A hidden Markov model (HMM) is then used to identify potential abnormal patterns, facilitating subsequent determination of whether extreme values ​​in the current data are abnormal. The HMM is trained to learn the transition probability matrix and observation probability matrix under normal conditions. The Bayesian formula is then used to calculate the probability of an extreme value being an abnormal state, resulting in an extreme value anomaly probability. The hidden Markov model (HMM) is a statistical model, and its use for identifying potential abnormal patterns is well-known and will not be further described here. The statistical features, weights, and extreme value anomaly probability are then combined to generate an extreme value composite anomaly score. If the extreme value composite anomaly score is greater than a preset extreme value threshold, the extreme value anomaly is considered abnormal. If the extreme value composite anomaly score is less than or equal to the preset extreme value threshold, the extreme value anomaly is considered normal. The preset extreme value threshold can be determined based on actual experiments.

[0070] The extreme value unit is further used to generate a fitting mean and a fitting variance based on the time series data using a maximum likelihood estimation method, and based on the fitting mean and the fitting variance, use a cumulative distribution function to determine the theoretical proportion of extreme values, determine the actual proportion of extreme values ​​based on the mean and the variance, and generate an extreme value proportion abnormality judgment result based on the theoretical proportion of extreme values ​​and the actual proportion of extreme values.

[0071] Specifically, the extreme value unit is also used to assume that the time series data follows a normal distribution, using the maximum likelihood estimation method to fit the distribution parameters and solve them to obtain the fitted mean and fitted variance. Based on the fitted mean and fitted variance, the cumulative distribution function (CDF) is then used to determine the theoretical extreme value proportion. Calculating the extreme value proportion using the cumulative distribution function (CDF) is an existing and widely used technique and will not be discussed in detail here. The theoretical extreme value proportion is then compared with the actual extreme value proportion. If the actual extreme value proportion is within a preset range of the theoretical extreme value proportion, the abnormal extreme value proportion judgment result is normal. If the actual extreme value proportion is not within the preset range of the theoretical extreme value proportion, the abnormal extreme value proportion judgment result is abnormal. The preset range can be obtained based on actual experiments.

[0072] In this embodiment, the present invention connects the terminal device through the 5G connection module based on the fifth generation mobile communication technology, and can provide a stable connection channel and a fast data transmission channel, so as to stably and quickly obtain the device data of the terminal device. Through the data timeout unit of the anomaly detection module, a bidirectional LSTM model is used for forward and backward propagation to capture the long-term dependency of the time series of historical reporting time data, and considering the influence of environmental data, accurate predicted reporting time data, that is, the normal reporting time of the terminal device, can be generated, so as to compare the actual actual reporting time data with the predicted reporting time data, and accurately judge whether the data upload of the terminal device connected to the Internet of Things is normal. Then, through the extreme value unit of the anomaly detection module, a multi-scale sliding window is used to analyze the statistical characteristic values ​​of each window of the time series data and the comparison with the statistical characteristic values. The corresponding weights can capture statistical characteristic values ​​at different time scales through multiple window sizes, that is, mean and variance, so as to fully describe the distribution characteristics of the data, and through the corresponding weights, make the model pay more attention to the windows with high certainty, and then use the hidden Markov model according to the time series data and statistical characteristic values ​​to determine the extreme value anomaly probability of the extreme value in the time series data, so as to facilitate the subsequent judgment of whether the extreme value in the current data belongs to an abnormal state, and finally comprehensively consider the statistical characteristic values, weights and extreme value anomaly probability to reasonably judge whether the extreme value of the terminal device connected to the Internet of Things is abnormal. The extreme value unit also uses the maximum likelihood estimation method and the cumulative distribution function to determine the proportion of extreme values ​​under theoretical conditions, that is, the extreme value theoretical proportion, and then compares the extreme value theoretical proportion with the extreme value actual proportion, so as to judge whether the extreme value proportion of the terminal device connected to the Internet of Things is abnormal. The present invention can further analyze whether the connection of the terminal device is abnormal by analyzing and judging the data upload time, extreme value and extreme value proportion of the terminal device connected to the Internet of Things.

[0073] Optionally, the bidirectional LSTM model is used to generate the predicted reporting time data at the next moment according to the historical reporting time data and the environmental data, including:

[0074] The bidirectional LSTM model is used to generate preliminary forecast data based on the historical reporting time data and the preliminary forecast formula. The preliminary forecast formula includes:

[0075] ;

[0076] ;

[0077] Among them, h t is the output of the hidden layer of the bidirectional LSTM model, is the historical reporting time data, n is n moments, t is t moments, BiLSTM is the calculation rule of the hidden layer of the bidirectional LSTM model, are the trainable parameters of the bidirectional LSTM model, including the weight matrix and bias term, is the preliminary forecast data, To map the hidden layer output of the bidirectional LSTM model to the weight matrix of the prediction time, is the bias term for prediction time;

[0078] The attention mechanism is used to weight the environmental data and sum them according to the importance weight formula to generate environmental impact data. The importance weight formula includes:

[0079] ;

[0080] ;

[0081] in, is the importance weight of the environmental data, softmax is the attention calculation rule, is the environmental data, is the weight matrix that maps the environmental data to the attention weight space, is the bias term of the attention mechanism, The environmental impact data, is the importance weight of the i-th environmental data, is the i-th environmental data;

[0082] The preliminary prediction data and the environmental impact degree data are fused using a fusion formula to generate the prediction reporting time data. The fusion formula includes:

[0083] T = f ( T t+1 , ct ; θ f )

[0084] in, T is the prediction reporting time data, f is the fusion rule, θ f are the trainable parameters of the fusion, including the weight matrix and bias terms.

[0085] Specifically, a bidirectional LSTM model is used to make preliminary predictions based on historical reporting time data and preliminary prediction formulas to generate preliminary prediction data. The impact of environmental variables (such as network delay, packet loss rate, etc.) on the prediction results is then considered to improve the model's adaptability to complex scenarios. The attention mechanism is used to calculate the importance weight of each environmental data, and all environmental data are weightedly summed to obtain environmental impact degree data. Finally, a fusion formula is used to fuse the preliminary prediction data and the environmental impact degree data to generate more accurate prediction reporting time data.

[0086] Optionally, generating a data timeout exception judgment result according to the predicted reporting time data and the actual reporting time data includes:

[0087] According to the predicted reporting time data and the environmental data, a dynamic timeout threshold formula is used to determine a dynamic timeout threshold, wherein the dynamic timeout threshold formula includes:

[0088] ;

[0089] in, is the dynamic timeout threshold, reporting time data for said prediction, is the safety buffer factor, is the standard deviation of the historical reported time data, is the weight coefficient, is the degree of change of the environmental data;

[0090] The data timeout abnormality judgment result is generated according to the actual reporting time data and the dynamic timeout threshold.

[0091] Specifically, a dynamic timeout threshold formula is used based on predicted reporting time data, historical reporting time data, and environmental data. The timeout threshold is dynamically adjusted to account for the impact of various situations, allowing for accurate timeout determination. If the actual reporting time data does not exceed the dynamic timeout threshold, the abnormality determination is that the data reporting did not time out and the reporting time was normal. If the actual reporting time data exceeds the dynamic timeout threshold, the abnormality determination is that the data reporting timed out and the reporting time was abnormal. The safety buffer coefficient refers to a safety buffer set based on the volatility of historical data. The degree of variability in environmental data can be determined through actual testing.

[0092] Optionally, the adopting of a multi-scale sliding window to analyze the statistical characteristic values ​​of each window of the time series data and the weights corresponding to the statistical characteristic values ​​includes:

[0093] Using the multi-scale sliding window, analyzing the statistical characteristic values ​​of each window of the time series data and the uncertainty entropy value of the statistical characteristic values ​​of each window;

[0094] The weight is determined according to the uncertainty entropy value, wherein the uncertainty entropy value is inversely proportional to the corresponding weight.

[0095] Specifically, a multi-scale sliding window is used to analyze the statistical eigenvalues ​​of each window of the time series data and the uncertainty entropy value of the statistical eigenvalue of each window; the weight is determined according to the uncertainty entropy value, where the uncertainty entropy value is inversely proportional to the corresponding weight, that is, the lower the uncertainty entropy value, the more stable the data, and the higher the weight, and the higher the uncertainty entropy value, the more unstable the data, and the lower the weight.

[0096] Optionally, generating an extreme value comprehensive anomaly score according to the statistical characteristic value, the weight, and the extreme value anomaly probability includes:

[0097] According to the statistical characteristic value, the weight and the extreme value anomaly probability, a comprehensive formula is used to generate the extreme value comprehensive anomaly score, and the comprehensive formula includes:

[0098] ;

[0099] in, is the extreme value comprehensive anomaly score, is the weight, is the time series data, is the mean value, The variance, To adjust the parameters, is the extreme value abnormal probability.

[0100] Specifically, the first term in the comprehensive formula can measure the degree of deviation between the extreme value and the window mean, and the second term introduces the extreme value anomaly probability for anomaly identification, increasing the focus on abnormal states, thereby obtaining a more comprehensive extreme value comprehensive anomaly score for the final judgment.

[0101] Optionally, the terminal device includes a camera, the device data includes historical video data and current video data corresponding to the camera, and the anomaly detection module further includes an occlusion detection unit;

[0102] The occlusion detection unit is used to extract the unobstructed background features of the historical video data using a deep learning model, and based on the unobstructed background features, use an adversarial network to construct an unobstructed virtual model, input the current video data into the trained unobstructed virtual model, and generate an occlusion detection result.

[0103] Specifically, the occlusion detection unit adopts a deep learning model, such as a convolutional neural network, to extract the unobstructed background features of the historical video data. The unobstructed background features include background and foreground features. Based on the unobstructed background features, an adversarial network is used to build a high-resolution unobstructed virtual model for a normal unobstructed scene. The current video data is input into the trained unobstructed virtual model, and the difference between the image in the unobstructed virtual model and the video frame in the current video data is compared to determine whether occlusion occurs and generate an occlusion detection result.

[0104] Optionally, the anomaly detection module further includes a screen distortion detection unit;

[0105] The distorted screen detection unit is used to convert the current video data into a Lab color space, and use wavelet transform to analyze the video data in the Lab color space to generate a distorted screen detection result.

[0106] Specifically, the flower screen detection unit converts the current video data into the Lab color space to reduce the impact of lighting, and uses wavelet transform to analyze the video data in the Lab color space to identify noise or distorted areas, thereby performing flower screen detection and generating flower screen detection results.

[0107] Optionally, the anomaly detection module further includes a fuzzy detection unit;

[0108] The blur detection unit is used to perform frequency domain analysis on the current video data using fast Fourier transform to generate a blur detection result.

[0109] Specifically, the blur detection unit uses fast Fourier transform (FFT) to perform frequency domain analysis on the image, identify blur caused by excessive low-frequency components, and generate a blur detection result.

[0110] like Figure 2 As shown, an electronic device 200 provided by an embodiment of the present invention includes a memory 210 and a processor 220; the memory 210 is used to store a computer program; the processor 220 is used to implement the following steps when executing the computer program:

[0111] Based on fifth-generation mobile communication technology, connecting to a terminal device and obtaining device data of the terminal device, wherein the device data includes historical reporting time data, actual reporting time data, environmental data, and time series data;

[0112] A bidirectional LSTM model is used to generate predicted reporting time data for the next moment based on the historical reporting time data and the environmental data, and a data timeout abnormality judgment result is generated based on the predicted reporting time data and the actual reporting time data;

[0113] Using a multi-scale sliding window, analyzing the statistical characteristic values ​​of each window of the time series data and the weights corresponding to the statistical characteristic values, and using a hidden Markov model based on the time series data and the statistical characteristic values, determining the extreme value anomaly probability, generating an extreme value comprehensive anomaly score based on the statistical characteristic values, the weights, and the extreme value anomaly probability, and generating an extreme value anomaly judgment result based on the extreme value comprehensive anomaly score, wherein the statistical characteristic values ​​include a mean and a variance;

[0114] According to the time series data, the maximum likelihood estimation method is adopted to generate a fitting mean and a fitting variance, and based on the fitting mean and the fitting variance, the cumulative distribution function is adopted to determine the theoretical proportion of extreme values, and according to the mean and the variance, the actual proportion of extreme values ​​is determined, and according to the theoretical proportion of extreme values ​​and the actual proportion of extreme values, an extreme value proportion abnormality judgment result is generated.

[0115] An embodiment of the present invention provides a computer-readable storage medium, wherein a computer program is stored on the storage medium. When the computer program is executed by a processor, the following steps are implemented:

[0116] Based on fifth-generation mobile communication technology, connecting to a terminal device and obtaining device data of the terminal device, wherein the device data includes historical reporting time data, actual reporting time data, environmental data, and time series data;

[0117] A bidirectional LSTM model is used to generate predicted reporting time data for the next moment based on the historical reporting time data and the environmental data, and a data timeout abnormality judgment result is generated based on the predicted reporting time data and the actual reporting time data;

[0118] Using a multi-scale sliding window, analyzing the statistical characteristic values ​​of each window of the time series data and the weights corresponding to the statistical characteristic values, and using a hidden Markov model based on the time series data and the statistical characteristic values, determining the extreme value anomaly probability, generating an extreme value comprehensive anomaly score based on the statistical characteristic values, the weights, and the extreme value anomaly probability, and generating an extreme value anomaly judgment result based on the extreme value comprehensive anomaly score, wherein the statistical characteristic values ​​include a mean and a variance;

[0119] According to the time series data, the maximum likelihood estimation method is adopted to generate a fitting mean and a fitting variance, and based on the fitting mean and the fitting variance, the cumulative distribution function is adopted to determine the theoretical proportion of extreme values, and according to the mean and the variance, the actual proportion of extreme values ​​is determined, and according to the theoretical proportion of extreme values ​​and the actual proportion of extreme values, an extreme value proportion abnormality judgment result is generated.

[0120] An electronic device 200 that can serve as a server or client of the present invention will now be described, which is an example of a hardware device that can be applied to various aspects of the present invention. The electronic device 200 is intended to represent various forms of digital electronic computer devices, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device 200 can also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0121] Electronic device 200 includes a computing unit that can perform various appropriate actions and processes based on a computer program stored in a read-only memory (ROM) or loaded from a storage unit into a random access memory (RAM). The RAM can also store various programs and data required for device operation. The computing unit, ROM, and RAM are interconnected via a bus. An input / output (I / O) interface is also connected to the bus.

[0122] Those skilled in the art will appreciate that all or part of the processes in the above-described method embodiments can be implemented by instructing the relevant hardware through a computer program. The program can be stored in a computer-readable storage medium. When executed, the program can include the processes in the above-described method embodiments. The storage medium can be a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM). In this application, the units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e., they may be located in one location or distributed across multiple network elements. Some or all of these units can be selected based on actual needs to achieve the objectives of the embodiments of the present invention. Furthermore, the functional units in the various embodiments of the present invention can be integrated into a single processing unit, each unit can exist physically separately, or two or more units can be integrated into a single unit. These integrated units can be implemented in either hardware or software functional units.

[0123] Although the present invention is disclosed as above, the protection scope of the present invention is not limited thereto. Those skilled in the art may make various changes and modifications without departing from the spirit and scope of the present invention, and these changes and modifications will fall within the protection scope of the present invention.

Claims

1. An Internet of Things system based on the fifth generation mobile communication technology, characterized in that: Includes 5G connection module and anomaly detection module; The 5G connection module is based on the fifth generation mobile communication technology, connects to the terminal device, and obtains the device data of the terminal device, wherein the device data includes historical reporting time data, actual reporting time data, environmental data, and time series data; The anomaly detection module includes a data timeout unit and an extreme value unit. The data timeout unit is used to use a bidirectional LSTM model to generate predicted reporting time data for the next moment based on the historical reporting time data and the environmental data, and generate a data timeout anomaly judgment result based on the predicted reporting time data and the actual reporting time data; The extreme value unit is used to use a multi-scale sliding window to analyze the statistical characteristic values ​​of each window of the time series data and the weights corresponding to the statistical characteristic values, and use a hidden Markov model to determine the extreme value anomaly probability based on the time series data and the statistical characteristic values, generate an extreme value comprehensive anomaly score based on the statistical characteristic values, the weights and the extreme value anomaly probability, and generate an extreme value anomaly judgment result based on the extreme value comprehensive anomaly score, wherein the statistical characteristic values ​​include a mean and a variance; The extreme value unit is further configured to generate a fitting mean and a fitting variance based on the time series data using a maximum likelihood estimation method, and determine a theoretical extreme value proportion based on the fitting mean and the fitting variance using a cumulative distribution function, determine an actual extreme value proportion based on the mean and the variance, and generate an extreme value proportion abnormality judgment result based on the theoretical extreme value proportion and the actual extreme value proportion; The bidirectional LSTM model is used to generate the predicted reporting time data at the next moment based on the historical reporting time data and the environmental data, including: The bidirectional LSTM model is used to generate preliminary forecast data based on the historical reporting time data and the preliminary forecast formula. The preliminary forecast formula includes: ； ； Among them, h t is the output of the hidden layer of the bidirectional LSTM model, is the historical reporting time data, n is n moments, t is t moments, BiLSTM is the calculation rule of the hidden layer of the bidirectional LSTM model, are the trainable parameters of the bidirectional LSTM model, including the weight matrix and bias term, is the preliminary forecast data, To map the hidden layer output of the bidirectional LSTM model to the weight matrix of the prediction time, is the bias term for prediction time; The attention mechanism is used to weight the environmental data and sum them according to the importance weight formula to generate environmental impact data. The importance weight formula includes: ； ； in, is the importance weight of the environmental data, softmax is the attention calculation rule, is the environmental data, is the weight matrix that maps the environmental data to the attention weight space, is the bias term of the attention mechanism, The environmental impact data, is the importance weight of the i-th environmental data, is the i-th environmental data; The preliminary prediction data and the environmental impact degree data are fused using a fusion formula to generate the prediction reporting time data. The fusion formula includes: T = f ( T t+1 , ct ; θ f ) in, T is the prediction reporting time data, f is the fusion rule, θ f are the trainable parameters of the fusion, including the weight matrix and bias terms.

2. The Internet of Things system based on the fifth generation mobile communication technology according to claim 1, characterized in that: The generating a data timeout abnormality judgment result according to the predicted reporting time data and the actual reporting time data includes: According to the predicted reporting time data and the environmental data, a dynamic timeout threshold formula is used to determine a dynamic timeout threshold, wherein the dynamic timeout threshold formula includes: ； in, is the dynamic timeout threshold, reporting time data for said prediction, is the safety buffer factor, is the standard deviation of the historical reported time data, is the weight coefficient, is the degree of change of the environmental data; The data timeout abnormality judgment result is generated according to the actual reporting time data and the dynamic timeout threshold.

3. The Internet of Things system based on the fifth generation mobile communication technology according to claim 1, characterized in that: The adopting of a multi-scale sliding window to analyze the statistical characteristic values ​​of each window of the time series data and the weights corresponding to the statistical characteristic values ​​includes: Using the multi-scale sliding window, analyzing the statistical characteristic values ​​of each window of the time series data and the uncertainty entropy value of the statistical characteristic values ​​of each window; The weight is determined according to the uncertainty entropy value, wherein the uncertainty entropy value is inversely proportional to the corresponding weight.

4. The Internet of Things system based on the fifth generation mobile communication technology according to claim 1, characterized in that: Generating an extreme value comprehensive anomaly score according to the statistical characteristic value, the weight, and the extreme value anomaly probability includes: According to the statistical characteristic value, the weight and the extreme value anomaly probability, a comprehensive formula is used to generate the extreme value comprehensive anomaly score, and the comprehensive formula includes: ； in, is the extreme value comprehensive anomaly score, is the weight, is the time series data, is the mean value, The variance, To adjust the parameters, is the extreme value abnormal probability.

5. The Internet of Things system based on the fifth generation mobile communication technology according to claim 1, characterized in that: The terminal device includes a camera, the device data includes historical video data and current video data corresponding to the camera, and the anomaly detection module further includes an occlusion detection unit; The occlusion detection unit is used to extract the unobstructed background features of the historical video data using a deep learning model, and based on the unobstructed background features, use an adversarial network to construct an unobstructed virtual model, input the current video data into the trained unobstructed virtual model, and generate an occlusion detection result.

6. The Internet of Things system based on the fifth generation mobile communication technology according to claim 5, characterized in that: The anomaly detection module also includes a screen distortion detection unit; The distorted screen detection unit is used to convert the current video data into a Lab color space, and use wavelet transform to analyze the video data in the Lab color space to generate a distorted screen detection result.

7. The Internet of Things system based on fifth-generation mobile communication technology according to claim 5, characterized in that: The anomaly detection module also includes a fuzzy detection unit; The blur detection unit is used to perform frequency domain analysis on the current video data using fast Fourier transform to generate a blur detection result.

8. An electronic device, characterized in that: including memory and processor; The memory is used to store computer programs; The processor is configured to implement the following steps when executing the computer program: Based on fifth-generation mobile communication technology, connecting to a terminal device and obtaining device data of the terminal device, wherein the device data includes historical reporting time data, actual reporting time data, environmental data, and time series data; A bidirectional LSTM model is used to generate predicted reporting time data for the next moment based on the historical reporting time data and the environmental data, and a data timeout abnormality judgment result is generated based on the predicted reporting time data and the actual reporting time data; Using a multi-scale sliding window, analyzing the statistical characteristic values ​​of each window of the time series data and the weights corresponding to the statistical characteristic values, and using a hidden Markov model based on the time series data and the statistical characteristic values, determining the extreme value anomaly probability, generating an extreme value comprehensive anomaly score based on the statistical characteristic values, the weights, and the extreme value anomaly probability, and generating an extreme value anomaly judgment result based on the extreme value comprehensive anomaly score, wherein the statistical characteristic values ​​include a mean and a variance; Based on the time series data, a maximum likelihood estimation method is used to generate a fitted mean and a fitted variance, and based on the fitted mean and the fitted variance, a cumulative distribution function is used to determine a theoretical proportion of extreme values, and based on the mean and the variance, an actual proportion of extreme values ​​is determined, and based on the theoretical proportion of extreme values ​​and the actual proportion of extreme values, an abnormal determination result of the extreme value proportion is generated; The bidirectional LSTM model is used to generate the predicted reporting time data at the next moment based on the historical reporting time data and the environmental data, including: The bidirectional LSTM model is used to generate preliminary forecast data based on the historical reporting time data and the preliminary forecast formula. The preliminary forecast formula includes: ； ； Among them, h t is the output of the hidden layer of the bidirectional LSTM model, is the historical reporting time data, n is n moments, t is t moments, BiLSTM is the calculation rule of the hidden layer of the bidirectional LSTM model, are the trainable parameters of the bidirectional LSTM model, including the weight matrix and bias term, is the preliminary forecast data, To map the hidden layer output of the bidirectional LSTM model to the weight matrix of the prediction time, is the bias term for prediction time; The attention mechanism is used to weight the environmental data and sum them according to the importance weight formula to generate environmental impact data. The importance weight formula includes: ； ； in, is the importance weight of the environmental data, softmax is the attention calculation rule, is the environmental data, is the weight matrix that maps the environmental data to the attention weight space, is the bias term of the attention mechanism, The environmental impact data, is the importance weight of the i-th environmental data, is the i-th environmental data; The preliminary prediction data and the environmental impact degree data are fused using a fusion formula to generate the prediction reporting time data. The fusion formula includes: T = f ( T t+1 , ct ; θ f ) in, T is the prediction reporting time data, f is the fusion rule, θ f are the trainable parameters of the fusion, including the weight matrix and bias terms.

9. A computer-readable storage medium, characterized in that The storage medium stores a computer program, and when the computer program is executed by the processor, the following steps are implemented: Based on fifth-generation mobile communication technology, connecting to a terminal device and obtaining device data of the terminal device, wherein the device data includes historical reporting time data, actual reporting time data, environmental data, and time series data; A bidirectional LSTM model is used to generate predicted reporting time data for the next moment based on the historical reporting time data and the environmental data, and a data timeout abnormality judgment result is generated based on the predicted reporting time data and the actual reporting time data; Using a multi-scale sliding window, analyzing the statistical characteristic values ​​of each window of the time series data and the weights corresponding to the statistical characteristic values, and using a hidden Markov model based on the time series data and the statistical characteristic values, determining the extreme value anomaly probability, generating an extreme value comprehensive anomaly score based on the statistical characteristic values, the weights, and the extreme value anomaly probability, and generating an extreme value anomaly judgment result based on the extreme value comprehensive anomaly score, wherein the statistical characteristic values ​​include a mean and a variance; Based on the time series data, a maximum likelihood estimation method is used to generate a fitted mean and a fitted variance, and based on the fitted mean and the fitted variance, a cumulative distribution function is used to determine a theoretical proportion of extreme values, and based on the mean and the variance, an actual proportion of extreme values ​​is determined, and based on the theoretical proportion of extreme values ​​and the actual proportion of extreme values, an abnormal determination result of the extreme value proportion is generated; The bidirectional LSTM model is used to generate the predicted reporting time data at the next moment based on the historical reporting time data and the environmental data, including: The bidirectional LSTM model is used to generate preliminary forecast data based on the historical reporting time data and the preliminary forecast formula. The preliminary forecast formula includes: ； ； Among them, h t is the output of the hidden layer of the bidirectional LSTM model, is the historical reporting time data, n is n moments, t is t moments, BiLSTM is the calculation rule of the hidden layer of the bidirectional LSTM model, are the trainable parameters of the bidirectional LSTM model, including the weight matrix and bias term, is the preliminary forecast data, To map the hidden layer output of the bidirectional LSTM model to the weight matrix of the prediction time, is the bias term for prediction time; The attention mechanism is used to weight the environmental data and sum them according to the importance weight formula to generate environmental impact data. The importance weight formula includes: ； ； in, is the importance weight of the environmental data, softmax is the attention calculation rule, is the environmental data, is the weight matrix that maps the environmental data to the attention weight space, is the bias term of the attention mechanism, The environmental impact data, is the importance weight of the i-th environmental data, is the i-th environmental data; The preliminary prediction data and the environmental impact degree data are fused using a fusion formula to generate the prediction reporting time data. The fusion formula includes: T = f ( T t+1 , ct ; θ f ) in, T is the prediction reporting time data, f is the fusion rule, θ f are the trainable parameters of the fusion, including the weight matrix and bias terms.

Images