Cloud end internet-of-things safety monitoring method and system with fault self-diagnosis function

Abstract

The application relates to the technical field of intelligent monitoring, and discloses a cloud-end internet-of-things safety monitoring method and system with a fault self-diagnosis function. The method comprises the following steps: an internet-of-things gateway generates first processing data after pre-processing environmental data; an edge computing device performs real-time calculation and processing on the first processing data to generate second processing data, performs fusion analysis on all the second processing data, and outputs a first analysis result; the internet-of-things gateway transmits the first processing data, the second processing data and the first analysis result to a cloud-end server; the cloud-end server stores and processes the received data, an abnormal state sensing model outputs a second analysis result, the second analysis result is displayed in a map level, and a real-time safety report is generated; the running state of the monitoring system is monitored in real time, and a real-time fault report is output; and the real-time safety report and the real-time fault report are transmitted to a terminal after being summarized. The application improves the efficiency and accuracy of cloud-end internet-of-things safety monitoring.

Description

Technical Field

[0001] This application relates to the field of intelligent monitoring technology, and in particular to a cloud-based IoT security monitoring method and system with fault self-diagnosis function. Background Technology

[0002] With the rapid development of the Internet of Things (IoT) and cloud computing technologies, traditional security monitoring systems are gradually transforming towards intelligence and digitalization. However, existing systems have shortcomings in fault diagnosis and abnormal state perception, making it difficult to achieve comprehensive monitoring and rapid response in complex environments.

[0003] A similar prior art is disclosed in Chinese patent application CN105677538A, which presents an adaptive monitoring method for cloud computing systems based on fault prediction. Principal component analysis (PCA) is used to calculate the eigenvectors of monitoring data to characterize the system's operating state. The degree of system anomaly is assessed by calculating the deviation between the eigenvectors of current and historical monitoring data. When the anomaly level of the monitored system is high, the monitoring cycle is shortened to closely track the system's operating state, thereby improving the accuracy and timeliness of error prediction and detection. Conversely, when the anomaly level of the monitored system is low, the monitoring cycle is extended to reduce monitoring overhead. Another Chinese patent application, CN119720011A, discloses a big data-based intelligent monitoring method for IoT device security, relating to the field of IoT device security technology. The method includes: deploying edge nodes near IoT devices to receive monitoring data; encrypting and preprocessing the monitoring data; transmitting the encrypted monitoring data to a big data platform via an encrypted channel; decrypting the data using a decryption key matched to the edge nodes; classifying the decrypted data according to different IoT device types and data sources, and storing it in a distributed database; fusing multimodal data from data sources from different devices; analyzing the data in the distributed database using an AI model to identify normal behavior patterns of the devices and predict potential abnormal behaviors; and classifying the severity of abnormal behavior when the AI ​​model predicts it, and providing corresponding response strategies.

[0004] The shortcomings of existing technologies are mainly reflected in the fact that they only predict and monitor the faults of cloud computing systems, without achieving comprehensive security monitoring. They rely solely on edge nodes and big data platforms for data processing and analysis, but do not fully consider the utilization of cloud computing resources. In practice, it is necessary to monitor the status and analyze the faults of a large number of IoT devices and utilize the advantages of the cloud for large-scale data processing and real-time analysis. Summary of the Invention

[0005] This application provides a cloud-based IoT security monitoring method and system with fault self-diagnosis function, which can improve the efficiency and accuracy of cloud-based IoT security monitoring.

[0006] Firstly, this application provides a cloud-based IoT security monitoring method with self-diagnosis function, the cloud-based IoT security monitoring method with self-diagnosis function includes:

[0007] Multiple monitoring devices are set up to collect environmental data in the monitored area. The Internet of Things gateway preprocesses the environmental data to generate first processed data. An edge computing device is deployed, and the edge computing device performs real-time calculation and processing on any of the first processed data to generate second processed data. Based on the deployment location of the monitoring device, all the second processed data are fused and analyzed to output a first analysis result.

[0008] The IoT gateway transmits the first processed data, the second processed data, and the first analysis result to the cloud server.

[0009] The cloud server stores and processes the received data in a distributed manner, establishes an anomaly perception model, identifies and analyzes the received data, outputs a second analysis result, displays the second analysis result on a map based on the deployment location, and generates a real-time security report corresponding to the monitoring area.

[0010] The system monitors the operating status of the monitoring system in real time. When an abnormality is detected in the monitoring system, it performs fault diagnosis and outputs a real-time fault report. The monitoring system includes the monitoring device, the IoT gateway, and the edge computing device.

[0011] The cloud server summarizes the real-time security report and the real-time fault report and then transmits them to the terminal.

[0012] In conjunction with the first aspect, the generation of the second processed data includes:

[0013] The timestamp of the first processed data is obtained, and the first processed data of different monitoring types are sorted based on the timestamp to generate a first sequence data. The first sequence data is segmented and converted into multiple first input vectors using a sliding window.

[0014] A reservoir computation model is constructed, which includes an input layer, a reservoir, and an output layer. The first input vector is input to the input layer. The state vector of each neuron in the reservoir is updated based on the connection weights and activation function of the reservoir. Based on the time step corresponding to the sliding window, the state vector and target output of the reservoir are collected.

[0015] The state vector is used as the input feature, the target output is used as the label, a first dataset is generated, a supervised learning algorithm is used to train the first dataset, the weight matrix of the output layer is calculated, and the trained reservoir computing model is deployed to the edge computing device based on the weight matrix.

[0016] The trained reservoir calculation model outputs a first prediction result based on the first processed data, and sets the first prediction result as the second processed data.

[0017] In conjunction with the first aspect, the output of the first analysis result includes:

[0018] Calculate the location distance between any two monitoring devices based on the deployment location. If the location distance is less than a first preset value, then aggregate the second processed data corresponding to any two monitoring devices into a first set.

[0019] Obtain the correlation degree between all the second processed data in the first set, and determine whether the first set meets the monitoring phenomenon based on the correlation degree. If it does not meet the monitoring phenomenon, remove the second processed data whose correlation degree is less than the second preset value, and set the remaining first set as the first subset.

[0020] This step is repeated until the second processing data corresponding to all the monitoring devices has been analyzed, generating multiple first subsets. All first subsets are then aggregated based on the location distance to generate the first analysis result.

[0021] In conjunction with the first aspect, the step of using the IoT gateway to transmit the first processed data, the second processed data, and the first analysis result to the cloud server includes:

[0022] The first processed data, the second processed data, and the first analysis result are all set as data to be transmitted, and the generation time and generation location of the data to be transmitted are marked.

[0023] The data to be transmitted is sorted based on the generation time and the generation location and then stored in a buffer. A transmission ratio is set, and the data to be transmitted is transmitted to the cloud server according to the transmission protocol based on the transmission ratio.

[0024] If the load on the cloud server exceeds a third preset value, the transmission ratio will be reduced.

[0025] In conjunction with the first aspect, the cloud server performs storage and processing of received data in a distributed manner, including:

[0026] The received data includes the first processed data, the second processed data, and the first analysis result. The data type of the received data is obtained, a target type is set based on the data type, and target data is extracted from the received data based on the target type.

[0027] A target threshold is set based on the target type, the target data is processed in a specific way based on the target threshold, and the processed target data is classified and stored based on the target type.

[0028] In conjunction with the first aspect, the output of the second analysis result includes:

[0029] In the received data after classification and storage, any set of data is obtained, and decision variables, objective functions and constraint functions are set based on the target threshold. Sub-data corresponding to each monitoring device in any set of data is mapped to spin variables, and the objective function and the constraint function are converted into the energy function of the abnormal state perception model.

[0030] Divide all the spin variables into multiple subarrays, obtain the correlation between any two subarrays in the group of data, and set the initial value of the spin state based on the correlation.

[0031] The abnormal state perception model calculates the energy change value of the subarray based on the energy function and the spin state, determines whether the spin state is flipped based on the energy change value, and if so, updates the spin state and converts the updated spin state into the decision variable. Based on the output result of the decision variable, it determines whether the monitoring area is abnormal.

[0032] Repeat this step until all received data has been determined, summarize all groups of data with anomalies, and generate the second analysis result.

[0033] In conjunction with the first aspect, generating a real-time security report corresponding to the monitored area includes:

[0034] The monitoring area is divided into multiple grid areas, and the deployment location is marked on the map based on the geographic information system to generate multiple monitoring points. The first processed data is associated with the monitoring points, and the status information of the monitoring points is marked based on preset tags.

[0035] Obtain the monitoring point corresponding to the second analysis result, set it as an anomaly monitoring point, scale the anomaly monitoring point based on the size of the grid area, and filter out the anomaly area;

[0036] The status information and the abnormal region are updated in real time based on timestamps. Descriptive content is extracted from the updated status information and the abnormal region based on natural language processing to generate the real-time security report.

[0037] In conjunction with the first aspect, the real-time monitoring of the operating status of the monitoring system includes:

[0038] The operation status and operation status data of the monitoring system are obtained, and the operation status data is preprocessed and then input into a deep learning model to extract feature values.

[0039] Clustering algorithms are used to perform cluster analysis on the feature quantities, dividing all the operation state data into multiple subcategories, corresponding each subcategory to the operation state, and labeling each subcategory with a category label;

[0040] The category labels determined in the cluster analysis are set as known labels, and a labeling model is built based on the known labels. The labeling model associates the feature quantity with the category label.

[0041] Multiple operational state data belonging to the same category label are input into a neural network model for learning and training to generate multiple anomaly detection models;

[0042] In any of the aforementioned category labels, the difference between the operation status data and the predicted data output by the anomaly detection model is calculated, and the parameters of the difference data are calculated and set as the anomaly detection benchmark based on the parameters.

[0043] Based on the magnitude of the difference, abnormal data is extracted from the operation status data, and the abnormal data is marked as faults and then input into the fault classification model for training.

[0044] New operation status data is collected in real time. The new operation status is classified and labeled based on the labeling model and then input into the corresponding anomaly judgment model. An anomaly degree is output based on the anomaly detection benchmark. If the anomaly degree is greater than a fourth preset value, the monitoring system is determined to be abnormal. The new operation status data is then input into the fault classification model, and the fault classification result is output.

[0045] Based on the device category corresponding to the new operational status data, all the fault classification results are summarized to generate the real-time fault report.

[0046] Secondly, this application provides a cloud-based IoT security monitoring system with self-diagnosis function, the cloud-based IoT security monitoring system with self-diagnosis function includes:

[0047] The data acquisition module is used to set up various monitoring devices to collect environmental data of the monitored area. The IoT gateway preprocesses the environmental data to generate first processed data. An edge computing device is deployed to perform real-time calculation and processing on any of the first processed data to generate second processed data. Based on the deployment location of the monitoring device, all the second processed data are fused and analyzed to output a first analysis result.

[0048] The transmission module is used by the IoT gateway to transmit the first processed data, the second processed data, and the first analysis result to the cloud server.

[0049] The monitoring module is used by the cloud server to store and process the received data in a distributed manner, establish an abnormal state perception model, identify and analyze the received data, output a second analysis result, display the second analysis result on a map based on the deployment location, and generate a real-time security report corresponding to the monitoring area.

[0050] The self-diagnosis module is used to monitor the operating status of the monitoring system in real time. When an abnormality is detected in the monitoring system, it performs fault diagnosis and outputs a real-time fault report. The monitoring system includes the monitoring device, the IoT gateway, and the edge computing device.

[0051] The feedback module is used by the cloud server to summarize the real-time security report and the real-time fault report and then transmit them to the terminal.

[0052] The technical solution provided in this application firstly employs a layered edge architecture, deploying multiple information processing systems sequentially from the sensor side to the cloud server. This architecture can process data from different types of sensors, different communication methods, and different transmission paths, improving data accuracy and reliability. It correlates time and location information with sensor data to achieve spatiotemporal correlation analysis, enabling more accurate identification and location of security events. Secondly, edge computing devices are deployed to perform real-time computational processing on the data, generating secondary processed data. The cloud server performs distributed storage and processing of data from edge nodes. Through the collaboration of edge computing and cloud computing, efficient processing and real-time response to massive amounts of data are achieved. Edge computing alleviates the computational pressure on the cloud server, optimizing system resource utilization. Finally, through real-time monitoring and analysis of the monitoring system's own operational status, the system can promptly detect and diagnose its own faults. The construction of anomaly perception and fault classification models enables the system to perform refined processing of different types of faults and provide accurate real-time fault reports. This achieves automated monitoring and fault diagnosis of the monitoring system's operational status, improving the accuracy of fault diagnosis by refining the processing of different types of faults. Attached Figure Description

[0053] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0054] Figure 1 This is a schematic diagram of an embodiment of a cloud-based IoT security monitoring method with fault self-diagnosis function in this application.

[0055] Figure 2 This is a schematic diagram of one embodiment of the process for generating a real-time security report in this application.

[0056] Figure 3 This is a schematic diagram of one embodiment of the fault self-diagnosis mechanism process in this application.

[0057] Figure 4 This is a schematic diagram of an embodiment of a cloud-based IoT security monitoring system with fault self-diagnosis function in this application. Detailed Implementation

[0058] This application provides a cloud-based IoT security monitoring method and system with fault self-diagnosis capabilities. The terms "first," "second," "third," "fourth," etc. (if present)," in the specification, claims, and accompanying drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments described herein can be implemented in a sequence other than that illustrated or described herein. Furthermore, the terms "comprising" or "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or device that includes a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or devices.

[0059] For ease of understanding, the specific process of the embodiments of this application is described below. Please refer to [link / reference]. Figure 1 One embodiment of the cloud-based IoT security monitoring method with fault self-diagnosis function in this application includes:

[0060] Step S101: Set up multiple monitoring devices to collect environmental data of the monitoring area. The IoT gateway preprocesses the environmental data to generate first processed data. Deploy edge computing devices. The edge computing devices perform real-time calculation and processing on any first processed data to generate second processed data. Based on the deployment location of the monitoring devices, perform fusion analysis on all second processed data and output the first analysis result.

[0061] It is understood that the executing entity of this application can be a cloud-based IoT security monitoring device with fault self-diagnosis function, or it can be a terminal or a server; the specifics are not limited here. This application's embodiments use a server as an example for illustration.

[0062] Specifically, monitoring equipment refers to various types of flame detectors with IoT communication capabilities, such as image-based flame detectors, fire alarm controllers, infrared flame detectors, and vehicle-mounted laser methane detectors. The monitoring area refers to the environmental area that needs to be monitored. Environmental data refers to the monitoring data collected by the monitoring equipment, such as ultraviolet image data and smoke gas concentration data. The IoT gateway is responsible for receiving environmental data from the monitoring equipment and performing preliminary processing, including data format conversion, data cleaning, and data compression. The IoT gateway is a hardware device or software system responsible for data exchange, processing, and management between IoT devices and cloud servers.

[0063] Edge computing devices refer to edge servers or gateway devices with computing capabilities, deployed via IoT gateways, used for real-time analysis, feature extraction, event prediction, and other computational processing of primary processed data. Deployment location refers to the coordinates of the distribution of each monitoring device. The primary analysis result refers to the correlation analysis of monitoring phenomena predicted by integrating multiple secondary processing results in the monitored area. For example, if there are secondary processed data corresponding to fire image data and gas concentration data, and the deployment locations are close, they match the monitoring phenomenon of "fire." Therefore, the two sets of secondary processed data are summarized to generate the primary analysis result, which serves as the data basis for later judgment of the fire situation.

[0064] Step S102: The IoT gateway transmits the first processed data, the second processed data, and the first analysis result to the cloud server.

[0065] Specifically, when transmitting data, IoT gateways need to adjust the data volume in real time to avoid overloading the cloud server.

[0066] Step S103: The cloud server stores and processes the received data in a distributed manner, establishes an anomaly perception model, identifies and analyzes the received data, outputs a second analysis result, displays the second analysis result on a map based on the deployment location, and generates a real-time security report corresponding to the monitoring area.

[0067] Specifically, the distributed approach refers to sequentially storing and processing specific data, allowing simultaneous processing of data from different monitoring devices. The anomaly perception model is a model built using an annealing machine to address environmental anomaly perception. This annealing machine is based on a simulated annealing algorithm, a probabilistic global optimization algorithm that simulates the physical annealing process. By controlling "environmental monitoring" parameters, it gradually reduces system energy, ultimately finding a state that minimizes energy, reflecting the correlation and detection characteristics between monitoring devices. The second analysis result refers to data indicating anomalies in the monitored area, such as "fire status." Map-level display refers to the real-time display of the monitored area's status information, including alarm information, on a map using a Geographic Information System (GIS). Real-time safety reports refer to environmental safety reports for the current monitored area.

[0068] Step S104: Monitor the operating status of the monitoring system in real time. When an abnormality is detected in the monitoring system, perform fault diagnosis and output a real-time fault report. The monitoring system includes monitoring equipment, IoT gateway and edge computing equipment.

[0069] Specifically, a monitoring system is a system that uses a cloud server to monitor the operational status of monitoring equipment, IoT gateways, and edge computing devices. Real-time fault reporting refers to a report that monitors and analyzes the operational status of any device within the monitoring system for faults.

[0070] Step S105: The cloud server summarizes the real-time security report and the real-time fault report and transmits them to the terminal.

[0071] Specifically, the cloud server will collect real-time security reports and real-time fault reports and send them to the terminal at preset time intervals. The terminal user can then perform security maintenance and equipment maintenance on the environment and monitoring system. The user can remotely control the monitoring system through the terminal device, such as adjusting the parameters of the monitoring equipment and activating emergency plans.

[0072] In one specific embodiment, generating second processed data includes:

[0073] (1) Obtain the timestamp of the first processing data, sort the first processing data of different monitoring types based on the timestamp, generate the first sequence data, and use a sliding window to segment and convert the first sequence data into multiple first input vectors.

[0074] (2) Construct a reservoir computing model. The reservoir computing model includes an input layer, a reservoir and an output layer. Input the first input vector into the input layer. Update the state vector of each neuron in the reservoir based on the connection weights and activation functions of the reservoir. Collect the state vector and target output of the reservoir based on the time step corresponding to the sliding window.

[0075] (3) The state vector is used as the input feature and the target output is used as the label to generate the first dataset. The first dataset is trained using a supervised learning algorithm. The weight matrix of the output layer is calculated. Based on the weight matrix, the trained reservoir computing model is deployed to the edge computing device.

[0076] (4) The trained reservoir calculation model outputs the first prediction result based on the first processed data, and sets the first prediction result as the second processed data.

[0077] Specifically, timestamp information can be generated by the monitoring device itself or marked by the IoT gateway based on the data arrival time. Monitoring type refers to the type of different environmental data. The sorting criteria include not only timestamps but also monitoring type; for example, first-processed data of the same type but at different locations can be sorted separately, such as gas concentration data from different areas. Using a sliding window technique, the first sequence of data is divided into multiple fixed-length time windows, and the data within each sliding window is converted into a first input vector. Vectorization can be achieved by arranging all data points within the time window sequentially into a vector.

[0078] The reservoir computational model is a neural network computational paradigm with unique advantages in processing time-series data. It can handle time-series data of various types, such as image sets and datasets with temporal relationships. Taking a first input vector as input, the reservoir consists of a large number of sparsely connected neurons, simulating the dynamic characteristics of biological neural networks. The connection weights and activation functions within the reservoir remain unchanged during training; only the weight matrix of the output layer needs to be trained. The reservoir's role is to map the input vector to a high-dimensional space and extract time-series features from the input data. The connection weights within the reservoir are typically initialized randomly, and the activation function can be a commonly used nonlinear function.

[0079] During the training of the reservoir computing model, the target output is the predicted value of the first sequence of data at the next time step. The reservoir computing model is trained on the first dataset using supervised learning algorithms (e.g., linear regression, support vector machines, etc.), with the training objective being to minimize the error between the output layer's predicted value and the target output. The weight matrix of the output layer is a key parameter connecting the reservoir and the output layer, mapping features extracted from the reservoir to the desired output space. Therefore, the reservoir computing model with the calculated weight matrix is ​​deployed to edge computing devices.

[0080] The first processed data is updated in real time. After the edge computing device receives the first processed data, the reservoir computing model performs calculations and outputs the first prediction result, which is used to predict the changing trend of the first processed data in the future, i.e., the second processed data.

[0081] In one specific embodiment, the first analysis result is output, including:

[0082] (1) Calculate the location distance between any two monitoring devices based on the deployment location. If the location distance is less than the first preset value, then summarize the second processing data corresponding to any two monitoring devices into the first set.

[0083] (2) Obtain the correlation degree between all second processing data in the first set, and determine whether the first set meets the monitoring phenomenon based on the correlation degree. If it does not meet the monitoring phenomenon, remove the second processing data with a correlation degree less than the second preset value, and set the remaining first set as the first subset.

[0084] (3) Repeat this step until the second processing data corresponding to all monitoring devices has been analyzed, generating multiple first subsets. All first subsets are summarized based on location distance to generate the first analysis result.

[0085] Specifically, location distance refers to the spatial distance between two monitoring devices. When the location distance is less than a first preset value, it indicates that the monitoring ranges of the two monitoring devices share a common area, and the second-processed data corresponding to the two monitoring devices can be aggregated into a first set. This step is repeated to aggregate all the second-processed data to generate multiple first sets, where each first set may contain multiple groups of second-processed data. If there is any second-processed data that has not been aggregated, then that second-processed data is treated as a separate first set.

[0086] Correlation refers to the numerical value of the linear correlation between any two second-processed data points, measured by the Pearson correlation coefficient. Based on correlation analysis, it is determined whether the data in the first set exhibits abnormal patterns or conforms to specific safety event characteristics. For example, if the correlation between temperature, smoke gas concentration, and flame sensor data is high, there may be a fire risk, consistent with monitoring phenomena; if the temperature and smoke gas concentration are low, but the flame sensor data shows infrared flame detection, it indicates that the second-processed data corresponding to the flame sensor has made incorrect predictions, inconsistent with monitoring phenomena. Second-processed data with a correlation less than a second preset value in the first set are then removed, generating the first subset.

[0087] By repeating this step, the predictive validity of all the second-processed data can be correlated to generate a first analysis result that is correlated with location distance.

[0088] In one specific embodiment, an IoT gateway is used to transmit the first processed data, the second processed data, and the first analysis result to a cloud server, including:

[0089] (1) Set the first processed data, the second processed data and the first analysis result as data to be transmitted, and mark the generation time and generation location of the data to be transmitted.

[0090] (2) Sort the data to be transmitted based on the generation time and generation location and store it in the buffer. Set the transmission ratio and transmit the data to be transmitted to the cloud server according to the transmission protocol based on the transmission ratio.

[0091] (3) If the load of the cloud server is greater than the third preset value, the transmission ratio will be reduced.

[0092] Specifically, each piece of data to be transmitted is marked with a precise timestamp and generation location information upon generation. For example, the generation time of the first processed data is a timestamp generated by the IoT gateway based on the arrival time of environmental data; the generation time of the second processed data refers to the timestamp generated by the edge computing device after processing the first processed data; and the generation time of the first analysis result refers to the timestamp of the edge computing device performing fusion analysis. The generation location refers to the spatial coordinates of the device from which the data to be transmitted originates.

[0093] Data to be transmitted from different generation locations is sorted according to its generation time. A buffer refers to a multi-level buffer system designed in the IoT gateway to handle sudden increases in data volume. The transmission ratio defines the proportion of data to be transmitted that will actually be transmitted; for example, an 80% transmission ratio means that 80% of the data in the buffer will be transmitted to the cloud server.

[0094] The cloud server monitors its own load in real time, including metrics such as memory usage and network bandwidth utilization. A third preset value is set as a load threshold to determine if the cloud server is under high load. When the cloud server load is detected to exceed the third preset value, the transmission ratio is reduced. Reducing the transmission ratio can effectively alleviate the pressure on the cloud server and prevent server overload.

[0095] In one specific embodiment, the cloud server performs storage processing on the received data in a distributed manner, including:

[0096] (1) The received data includes first processed data, second processed data and first analysis results. The data type of the received data is obtained, the target type is set based on the data type, and the target data is extracted from the received data based on the target type.

[0097] (2) Set target thresholds based on target type, perform specific processing on target data based on target thresholds, and classify and store the processed target data based on target type.

[0098] Specifically, the cloud server parses the received data, extracting the data type information for each piece of data. For example, it identifies the data type of the monitoring equipment (smoke and gas concentration, infrared images, etc.) and the data type of the processing (predicted values, feature quantities, etc.). The target type refers to the data type that requires focused attention and processing, such as data directly related to safety events, like fire alarms. The cloud server extracts data from the received data that matches the target type as the target data. For example, if the target type is set to "fire alarm," then all data corresponding to the "fire alarm" type will be extracted.

[0099] For different target types, corresponding target thresholds are set to determine whether the data is abnormal or to trigger specific processing procedures. For example, an upper limit for smoke gas concentration can be set, such as 100 ppm; exceeding this concentration will trigger a fire alarm. Specific processing refers to classifying target data according to target type and target threshold, assigning priorities, triggering corresponding processing procedures based on data classification and priority, and storing the processed target data according to target type.

[0100] In one specific embodiment, the second analysis result is output, including:

[0101] (1) Obtain any set of data from the received data after classification and storage, set decision variables, objective function and constraint function based on the target threshold, map the sub-data corresponding to each monitoring device in any set of data to spin variables, and convert the objective function and constraint function into the energy function of the abnormal state perception model.

[0102] (2) Divide all spin variables into multiple subarrays, obtain the correlation between any two subdata in the group data, and set the initial value of the spin state based on the correlation.

[0103] (3) The abnormal state perception model calculates the energy change value of the subarray based on the energy function and spin state, determines whether the spin state is flipped based on the energy change value, and if so, updates the spin state and converts the updated spin state into a decision variable. Based on the output of the decision variable, it determines whether the monitoring area is abnormal.

[0104] (4) Repeat this step until all received data is judged, summarize all group data with anomalies, and generate the second analysis result.

[0105] Specifically, group data refers to the data contained after the received data has been classified and stored. The target threshold is transformed into a decision variable to represent whether the group data is abnormal. For example, for smoke gas concentration data, a decision variable can be set. The objective function measures the overall degree of abnormality and can be set as a linear combination of decision variables. The constraint function represents the logical relationship or physical constraint between group data. For example, if both temperature and smoke gas concentration exceed the threshold, a fire is more likely to occur. Sub-data corresponding to each monitoring device is mapped to a spin variable s, which can take values ​​of +1 or -1. Sub-data refers to the data generated by any monitoring device; +1 indicates the corresponding data is normal, and -1 indicates the corresponding data is abnormal. The decision variables are mapped to the spin variables; for example, when the decision variable is greater than the target threshold, the spin variable is -1. The objective function and constraints are transformed into penalty terms in the energy function, such that the smaller the objective function value, the lower the energy function value. For example, the energy function is expressed as: ,in, Let be the objective function. For constraint functions, Let c be the energy function, and c represent different constraints. The penalty coefficient is... and All of them are decision variables.

[0106] The number of spin variables equals the number of monitoring devices. This can be determined based on the spatial location of the monitoring devices; for example, monitoring devices within the same area can be grouped into a sub-array. Initial values ​​for the spin states are set based on the correlation between the data. For instance, if two sub-data sets have a high correlation, their corresponding spin variables can be initialized to the same value.

[0107] The anomaly detection model uses an annealing machine to calculate the energy change value of each submatrix based on the energy function and the current spin state. If the energy change value is less than 0, the spin state is flipped, which reduces the total energy of the system. If the energy change value is greater than 0, the spin state is flipped according to a preset probability. Based on the result of this process, the spin state is updated, and the calculation of energy change value and spin state update are repeated until the system reaches a stable state or reaches a preset number of iterations. The updated spin state is converted into a decision variable, and the output of the decision variable is used to determine whether the monitored area is abnormal. For example, if a certain decision variable... If the number of abnormal decision variables exceeds the threshold, it indicates that the corresponding data is abnormal. A threshold can also be set. When the number of abnormal decision variables exceeds the threshold, it is considered that there is an anomaly in the monitored area.

[0108] Repeat the above steps to evaluate all received data, generate a second analysis result, and identify the types of abnormal events.

[0109] In one specific embodiment, generating a real-time security report corresponding to the monitored area includes:

[0110] (1) Divide the monitoring area into multiple grid areas, mark the deployment location on the map based on the geographic information system, generate multiple monitoring points, associate the first processing data with the monitoring points, and mark the status information of the monitoring points based on preset labels.

[0111] (2) Obtain the monitoring points corresponding to the second analysis results, set them as abnormal monitoring points, scale the abnormal monitoring points based on the size of the grid area, and filter out the abnormal areas.

[0112] (3) Update status information and abnormal areas in real time based on timestamps, and extract descriptive content from the updated status information and abnormal areas based on natural language processing to generate a real-time security report.

[0113] Specifically, Figure 2 This is a flowchart for generating real-time safety reports. The size of the grid area can be set according to monitoring accuracy and computing resources. After receiving data from the sensor side, the cloud server extracts the location information of each monitoring device and uses GIS technology to mark the location information of the monitoring devices on a digital map. Each grid area corresponds to a monitoring point, which is used to represent the safety status of the area and is associated with the actual location of the monitoring device. For multiple data associated with the same monitoring point, aggregation processing can be performed to assign a set of preset states to each monitoring point to describe its safety status, such as preset labels like "normal" and "fire". Based on the first processed data and preset rules or thresholds, the corresponding preset labels are assigned to each monitoring point.

[0114] The second analysis result is generated by fusing and analyzing second-processed data from multiple monitoring devices. It refers to data with anomalies. Therefore, the second analysis result is associated with corresponding monitoring points, which are then designated as anomaly monitoring points. If the grid area is large, the range of anomaly monitoring points can be appropriately expanded to more accurately reflect the extent of the anomaly area. Interpolation algorithms, such as Kriging interpolation, can be used to estimate the spatial distribution of the anomaly area. Based on the scaled anomaly monitoring points, the anomaly area is then selected.

[0115] Each data entry includes a timestamp to identify when it was generated. The status information of each monitoring point is updated in real time based on the latest received data. The location, extent, and status of abnormal areas are also updated in real time based on the latest secondary analysis results. Natural language processing technology is used to convert the status information into readable text descriptions, providing a more detailed description of the abnormal areas and generating real-time security reports.

[0116] In one specific embodiment, real-time monitoring of the operating status of the monitoring system includes:

[0117] (1) Obtain the operation status and operation status data of the monitoring system, preprocess the operation status data and input it into the deep learning model to extract feature quantities.

[0118] (2) Use clustering algorithms to perform cluster analysis on the feature quantities, divide all operation status data into multiple subcategories, correspond the subcategories to the operation statuses one by one, and label the subcategories with category labels.

[0119] (3) Set the category labels determined in the cluster analysis as known labels, build a labeling model based on the known labels, and associate the feature quantity with the category label in the labeling model.

[0120] (4) Input multiple operation state data belonging to the same category label into the neural network model for learning and training to generate multiple anomaly judgment models.

[0121] (5) In any category label, calculate the difference between the operation status data and the predicted data output by the anomaly detection model, and calculate the parameters of the difference data, and set the parameters as the anomaly detection benchmark.

[0122] (6) Extract abnormal data from the operation status data based on the size of the difference, mark the abnormal data as faults, and input them into the fault classification model for training.

[0123] (7) Collect new operation status data in real time, classify and label the new operation status based on the labeling model and input it into the corresponding anomaly judgment model, output the anomaly degree based on the anomaly detection benchmark, if the anomaly degree is greater than the fourth preset value, the monitoring system is judged to be abnormal, and the new operation status data is input into the fault classification model and the fault classification result is output.

[0124] (8) Based on the equipment category corresponding to the new operation status data, summarize all fault classification results and generate a real-time fault report.

[0125] Specifically, Figure 3 This is a flowchart of the fault self-diagnosis mechanism. Operational status refers to the running status of the monitoring system. Operational status data comes from various devices within the monitoring system, such as the operating status data of monitoring equipment (temperature, voltage, current, signal strength, etc.), the operating status data of IoT gateways (network connection status, data transmission rate, latency, etc.), and the operating status data of edge computing devices (CPU utilization, memory utilization, storage space utilization, etc.). After preprocessing such as data cleaning and standardization, the operational status data is input into a trained deep learning model (convolutional neural network). The deep learning model extracts high-dimensional features from the input data, such as image features, temporal features, and statistical features.

[0126] Clustering algorithms can group similar operational status data into the same category. The category label corresponding to each cluster center determined in the cluster analysis is set to a known label; for example, different operational status categories can be labeled as "normal," "slightly abnormal," and "severely abnormal." Operational status data belonging to the same cluster category can then be further divided into multiple subcategories.

[0127] A labeling model is built based on known category labels to classify new operational state data into the corresponding categories. The labeling model can be constructed using semi-supervised learning, trained by combining labeled and unlabeled data.

[0128] Multiple operational state data belonging to the same category label are input into a neural network model for learning and training. The training objective is to minimize the reconstruction error or the difference between the generated sample and the real sample. An anomaly detection model is generated for each operational state category. These models can detect abnormal data in the corresponding category. Each anomaly detection model reflects the characteristics of normal operational state data of the corresponding category label.

[0129] The parameters of the difference data include, but are not limited to, maximum value, average value, standard deviation and variance. The calculated parameters are set as the anomaly detection benchmark to determine whether the operation status data is abnormal.

[0130] Based on the labeling model, new operational status data is classified and labeled, assigned to corresponding categories. The classified new operational status data is then input into the corresponding anomaly detection model to calculate its anomaly degree. The anomaly degree can be calculated based on parameters of the difference or disparity data; for example, if the parameter of the disparity data exceeds the anomaly detection benchmark. If the anomaly degree is greater than a fourth preset value, the monitoring system corresponding to the operational status data is determined to be abnormal. The fault classification model can categorize different anomalies into different fault types, such as monitoring equipment faults, network faults, hardware faults, and software faults.

[0131] Based on the equipment categories corresponding to the new operational status data, all fault classification results are summarized to generate real-time fault reports. For example, the reports list all faulty equipment and their fault types, provide information such as the time, location, and severity of the fault, and offer suggested maintenance measures or emergency response plans.

[0132] The above describes the cloud-based IoT security monitoring method with fault self-diagnosis function in the embodiments of this application. The following describes the cloud-based IoT security monitoring system with fault self-diagnosis function in the embodiments of this application. Please refer to [link to relevant documentation]. Figure 4 One embodiment of the cloud-based IoT security monitoring system with fault self-diagnosis function in this application includes:

[0133] The acquisition module 201 is used to set up various monitoring devices to collect environmental data of the monitored area. The IoT gateway preprocesses the environmental data to generate first processed data. An edge computing device is deployed to perform real-time calculation and processing on any of the first processed data to generate second processed data. Based on the deployment location of the monitoring device, all the second processed data are fused and analyzed to output the first analysis result.

[0134] The transmission module 202 is used by the IoT gateway to transmit the first processed data, the second processed data, and the first analysis result to the cloud server.

[0135] The monitoring module 203 is used by the cloud server to store and process the received data in a distributed manner, establish an abnormal state perception model, identify and analyze the received data, output a second analysis result, display the second analysis result on a map based on the deployment location, and generate a real-time security report corresponding to the monitoring area.

[0136] The self-diagnosis module 204 is used to monitor the operating status of the monitoring system in real time. When an abnormality is detected in the monitoring system, it performs fault diagnosis and outputs a real-time fault report. The monitoring system includes monitoring equipment, IoT gateway and edge computing device.

[0137] Feedback module 205 is used by the cloud server to summarize real-time security reports and real-time fault reports and transmit them to the terminal.

[0138] Through the collaborative efforts of the aforementioned components, firstly, a layered edge architecture is adopted, deploying multiple information processing systems sequentially from the sensor side to the cloud server. This enables the processing of data from different types of sensors, different communication methods, and different transmission paths, improving data accuracy and reliability. Time and location information are correlated with sensor data to achieve spatiotemporal correlation analysis, allowing for more accurate identification and location of security events. Secondly, edge computing devices are deployed to perform real-time computational processing on the data, generating secondary processed data. The cloud server performs distributed storage and processing of data from edge nodes. Through the synergy of edge computing and cloud computing, efficient processing and real-time response to massive amounts of data are achieved. Edge computing alleviates the computational burden on the cloud server, optimizing system resource utilization. Finally, through real-time monitoring and analysis of the monitoring system's own operational status, the system can promptly detect and diagnose its own faults. The construction of anomaly perception and fault classification models enables the system to perform refined processing of different types of faults and provide accurate real-time fault reports, achieving automated monitoring and fault diagnosis of the monitoring system's operational status, and improving the accuracy of fault diagnosis by refining the processing of different types of faults.

[0139] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0140] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0141] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A cloud-based IoT security monitoring method with fault self-diagnosis function, characterized in that, Cloud-based IoT security monitoring methods with fault self-diagnosis capabilities include: Multiple monitoring devices are set up to collect environmental data in the monitored area. The IoT gateway preprocesses the environmental data to generate first-processed data. Edge computing devices are deployed to perform real-time calculations on any first-processed data to generate second-processed data. Based on the deployment location of the monitoring devices, all second-processed data are fused and analyzed to output the first analysis result. The IoT gateway transmits the first processed data, the second processed data, and the first analysis result to the cloud server; The cloud server stores and processes the received data in a distributed manner, establishes an anomaly perception model built by the annealing machine, identifies and analyzes the received data, outputs a second analysis result, displays the second analysis result on a map based on the deployment location, and generates a real-time security report corresponding to the monitoring area. The system monitors the operating status of the monitoring system in real time. When an abnormality is detected in the monitoring system, it performs fault diagnosis and outputs a real-time fault report. The monitoring system includes monitoring equipment, IoT gateways, and edge computing devices. The cloud server aggregates real-time security reports and real-time fault reports and transmits them to the terminal. The cloud server stores and processes the received data in a distributed manner, including: receiving data containing first processed data, second processed data, and first analysis results; obtaining the data type of the received data; setting a target type based on the data type; extracting target data from the received data based on the target type; setting a target threshold based on the target type; performing specific processing on the target data based on the target threshold; and classifying and storing the processed target data based on the target type. The second analysis result is output, including: obtaining any set of data from the classified and stored received data; setting decision variables, objective functions, and constraint functions based on the target threshold; mapping the sub-data corresponding to each monitoring device in the set of data to spin variables; converting the objective function and constraint functions into the energy function of the abnormal state perception model; dividing all spin variables into multiple sub-arrays; obtaining the correlation between any two sub-data in the set of data; setting the initial value of the spin state based on the correlation; the abnormal state perception model calculates the energy change value of the sub-array based on the energy function and spin state; judging whether the spin state has flipped based on the energy change value; if so, updating the spin state and converting the updated spin state into decision variables; judging whether the monitoring area is abnormal based on the output result of the decision variables; repeating this step until all received data has been judged; summarizing all sets of data with anomalies; and generating the second analysis result.

2. The cloud-based IoT security monitoring method with fault self-diagnosis function according to claim 1, characterized in that, Generate second-processed data, including: Obtain the timestamp of the first processed data, sort the first processed data of different monitoring types based on the timestamp, generate the first sequence data, and use a sliding window to segment and convert the first sequence data into multiple first input vectors; A reservoir computation model is constructed, which includes an input layer, a reservoir, and an output layer. The first input vector is input into the input layer. The state vector of each neuron in the reservoir is updated based on the connection weights and activation function of the reservoir. Based on the time step corresponding to the sliding window, the state vector and target output of the reservoir are collected. The first dataset is generated by using the state vector as input features and the target output as labels. The first dataset is trained using a supervised learning algorithm, the weight matrix of the output layer is calculated, and the trained reservoir computing model is deployed to an edge computing device based on the weight matrix. The trained reservoir computation model outputs a first prediction result based on the first processed data, and sets the first prediction result as the second processed data.

3. The cloud-based IoT security monitoring method with fault self-diagnosis function according to claim 1, characterized in that, The first analysis result is output, including: Calculate the location distance between any two monitoring devices based on their deployment locations. If the location distance is less than a first preset value, then the second processing data corresponding to any two monitoring devices are aggregated into a first set. Obtain the correlation degree between all second-processed data in the first set, and determine whether the first set meets the monitoring phenomenon based on the correlation degree. If it does not meet the monitoring phenomenon, remove the second-processed data with a correlation degree less than the second preset value, and set the remaining first set as the first subset. Repeat this step until the second processing data corresponding to all monitoring devices has been analyzed, generating multiple first subsets. All first subsets are then aggregated based on location distance to generate the first analysis result.

4. The cloud-based IoT security monitoring method with fault self-diagnosis function according to claim 1, characterized in that, The IoT gateway transmits the first processed data, the second processed data, and the first analysis result to the cloud server, including: The first processed data, the second processed data, and the first analysis result are all set as data to be transmitted, and the generation time and generation location of the data to be transmitted are marked. The data to be transmitted is sorted based on the generation time and generation location and then stored in a buffer. A transmission ratio is set, and the data to be transmitted is transmitted to the cloud server according to the transmission protocol based on the transmission ratio. If the load on the cloud server exceeds the third preset value, the transmission ratio will be reduced.

5. The cloud-based IoT security monitoring method with fault self-diagnosis function according to claim 1, characterized in that, Generate a real-time security report for the monitored area, including: The monitoring area is divided into multiple grid areas. Based on the geographic information system, the deployment location is marked on the map to generate multiple monitoring points. The first-processed data is associated with the monitoring points, and the status information of the monitoring points is marked based on preset labels. Obtain the monitoring points corresponding to the second analysis results, set them as anomaly monitoring points, scale the anomaly monitoring points based on the size of the grid area, and filter out the abnormal areas. The status information and abnormal areas are updated in real time based on timestamps. Natural language processing is used to extract descriptive content from the updated status information and abnormal areas to generate a real-time security report.

6. The cloud-based IoT security monitoring method with fault self-diagnosis function according to claim 1, characterized in that, Real-time monitoring of the operational status of the monitoring system, including: The system acquires the operational status and operational status data of the monitoring system, preprocesses the operational status data, and then inputs it into a deep learning model to extract features. Clustering algorithms are used to perform cluster analysis on the feature quantities, dividing all operation status data into multiple subcategories, mapping each subcategory to an operation status, and labeling each subcategory with a category label. The category labels determined in the cluster analysis are set as known labels, and a labeling model is built based on the known labels. The labeling model associates the feature values ​​with the category labels. Multiple operational state data belonging to the same category label are input into a neural network model for learning and training to generate multiple anomaly detection models; In any category label, calculate the difference between the operation status data and the predicted data output by the anomaly detection model, and calculate the parameters of the difference data, which are then used as the anomaly detection benchmark. Based on the magnitude of the difference, abnormal data is extracted from the operational status data. After the abnormal data is labeled with faults, it is input into the fault classification model for training. New operational status data is collected in real time. The new operational status is classified and labeled based on the labeling model and then input into the corresponding anomaly judgment model. The anomaly degree is output based on the anomaly detection benchmark. If the anomaly degree is greater than the fourth preset value, the monitoring system is judged to be abnormal. The new operational status data is then input into the fault classification model and the fault classification result is output. Based on the device category corresponding to the new operational status data, all fault classification results are summarized to generate a real-time fault report.

7. A cloud-based IoT security monitoring system with fault self-diagnosis function according to the cloud-based IoT security monitoring method of claim 1, characterized in that, Cloud-based IoT security monitoring systems with self-diagnostic capabilities include: The data acquisition module is used to set up various monitoring devices to collect environmental data of the monitored area. The IoT gateway preprocesses the environmental data to generate first-processed data. Edge computing devices are deployed to perform real-time calculation and processing on any first-processed data to generate second-processed data. Based on the deployment location of the monitoring devices, all second-processed data are fused and analyzed to output the first analysis result. The transmission module is used by the IoT gateway to transmit the first processed data, the second processed data, and the first analysis result to the cloud server. The monitoring module is used by the cloud server to store and process received data in a distributed manner, establish an anomaly perception model, identify and analyze the received data, output a second analysis result, display the second analysis result on a map based on the deployment location, and generate a real-time security report corresponding to the monitoring area. The self-diagnosis module is used to monitor the operating status of the monitoring system in real time. When an abnormality is detected in the monitoring system, it performs fault diagnosis and outputs a real-time fault report. The monitoring system includes monitoring equipment, IoT gateways and edge computing devices. The feedback module is used by the cloud server to summarize real-time security reports and real-time fault reports and transmit them to the terminal.

Images