Abnormality monitoring method, device and system for edge device

Abstract

The invention discloses an anomaly monitoring method, device and system for edge equipment. The method comprises the following steps: acquiring a network protocol feature vector and a visual physical feature vector related to the edge equipment; inputting the network protocol feature vector and the visual physical feature vector into a preset Transform model for cross-modal feature fusion to obtain vector representations of the network protocol feature vector and the visual physical feature vector in a shared vector space; calculating to obtain a target similarity score based on the vector representation of the network protocol feature vector in the shared vector space and the vector representation of the visual physical feature vector in the shared vector space; the target similarity score is input into a preset reinforcement learning model, the reinforcement learning model judges the target similarity score based on a dynamic threshold mechanism, and when the target similarity score is smaller than or equal to a dynamic threshold, it is determined that the edge device is in an abnormal state. Therefore, the capability of monitoring the abnormal behavior of the edge device can be enhanced.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method, device, and system for monitoring abnormalities in edge devices. Background Art

[0002] With the rapid development of next-generation information technology, edge computing has been widely deployed in scenarios such as the Industrial Internet, smart cities, and data center user domains. As key nodes close to data sources, edge devices play a vital role in enabling real-time perception, local computing, intelligent scheduling, and multi-source collaboration. As application scenarios continue to expand and task complexity increases, the demand for high reliability and security for edge devices is growing.

[0003] Current edge device anomaly detection methods primarily rely on analyzing network protocol signatures, detecting unusual behavior in network traffic to identify unauthorized access or attacks. However, in practice, attackers can forge the protocol fingerprint of edge devices, disguising illegal devices as legitimate ones and thereby bypassing these anomaly detection mechanisms based on network protocol signatures. While the network protocol signatures may appear normal, the edge device itself may have been illegally controlled or replaced, preventing timely detection of abnormal behavior and reducing the ability to monitor abnormal behavior. Summary of the Invention

[0004] The embodiments of the present application provide a method, apparatus, and system for monitoring abnormalities in edge devices, the purpose of which is to comprehensively evaluate the status of edge devices from two dimensions: the network layer and the physical layer, so as to enhance the ability to monitor abnormal behavior of edge devices.

[0005] In a first aspect, an embodiment of the present application provides a method for monitoring abnormalities of an edge device, the method comprising:

[0006] Obtaining network protocol feature vectors and visual physical feature vectors related to edge devices;

[0007] Inputting the network protocol feature vector and the visual-physical feature vector into a preset Transformer model for cross-modal feature fusion to obtain vector representations of the network protocol feature vector and the visual-physical feature vector in a shared vector space, wherein the Transformer model is trained by a federated learning method;

[0008] Calculating a target similarity score based on a vector representation of the network protocol feature vector in the shared vector space and a vector representation of the visual-physical feature vector in the shared vector space, wherein the target similarity score is used to reflect the degree of matching between the network layer and the physical layer of the edge device;

[0009] The target similarity score is input into a preset reinforcement learning model, and the reinforcement learning model judges the target similarity score based on a dynamic threshold mechanism. When the target similarity score is less than or equal to the dynamic threshold, it is determined that the edge device is in an abnormal state.

[0010] Optionally, obtaining a network protocol feature vector and a visual physical feature vector related to the edge device includes:

[0011] Acquire network protocol features and visual physical features related to the edge device, wherein the network protocol features are used to characterize the behavior state of the edge device at the network layer, and the visual physical features are used to characterize the external performance of the edge device at the physical layer;

[0012] Vectorization processing is performed on the network protocol feature and the visual physical feature respectively to obtain the network protocol feature vector and the visual physical feature vector.

[0013] Optionally, the step of inputting the network protocol feature vector and the visual-physical feature vector into a preset Transformer model for cross-modal feature fusion includes:

[0014] Based on a preset four-dimensional matching matrix, performing preliminary rule matching on the network protocol feature vector and the visual physical feature vector;

[0015] When the preliminary rule matching is successful, the network protocol feature vector and the visual physical feature vector are input into a preset Transformer model for cross-modal feature fusion.

[0016] Optionally, the method further includes:

[0017] In the case that the preliminary rule matching fails, it is determined that the edge device is in an abnormal state, and a corresponding abnormal alarm strategy is triggered.

[0018] Optionally, the dynamic threshold mechanism is constructed by dynamically adjusting the sliding window duration based on CPU utilization, and the calculation formula of the sliding window duration is:

[0019]

[0020] Wherein, w represents the duration of the sliding window, A represents the maximum duration of the sliding window, B represents the window reduction coefficient that is dynamically adjusted as the CPU utilization changes, and the CPU utilization represents the usage of the edge device processor.

[0021] Optionally, the network protocol characteristics include transmission control protocol window parameters, synchronization control message sending interval variance, security transport layer protocol session reuse rate, hypertext transfer protocol request header information entropy value and port access frequency Shannon entropy;

[0022] The visual physical features include the port plug status, the port indicator light status, the device appearance image and the optical character recognition result of the port position.

[0023] Optionally, the method further includes:

[0024] When the target similarity score is greater than the dynamic threshold, it is determined that the edge device is in a normal state.

[0025] In a second aspect, an embodiment of the present application provides an abnormality monitoring device for an edge device, comprising:

[0026] A vector acquisition module is used to obtain network protocol feature vectors and visual physical feature vectors related to edge devices;

[0027] a vector fusion module, configured to input the network protocol feature vector and the visual-physical feature vector into a preset Transformer model for cross-modal feature fusion, thereby obtaining vector representations of the network protocol feature vector and the visual-physical feature vector in a shared vector space, wherein the Transformer model is trained using a federated learning approach;

[0028] a similarity calculation module, configured to calculate a target similarity score based on a vector representation of the network protocol feature vector in the shared vector space and a vector representation of the visual-physical feature vector in the shared vector space, wherein the target similarity score is used to reflect a degree of matching between the network layer and the physical layer of the edge device;

[0029] A similarity judgment module is used to input the target similarity score into a preset reinforcement learning model. The reinforcement learning model judges the target similarity score based on a dynamic threshold mechanism. When the target similarity score is less than or equal to the dynamic threshold, it is determined that the edge device is in an abnormal state.

[0030] In a third aspect, an embodiment of the present application provides an abnormality monitoring system for edge devices, the system comprising an edge layer and a cloud computing layer;

[0031] The edge layer includes a dynamic perception and device identification module, and a multi-agent collaborative detection engine;

[0032] The cloud computing layer includes a federated learning module;

[0033] The dynamic perception and device identification module is used to perform the method according to any one of claims 1 to 7;

[0034] The multi-agent collaborative detection engine includes a perception agent, an analysis agent and a decision-making agent;

[0035] The perception agent is used to collect and preprocess data from the edge device;

[0036] The analysis agent is used to perform protocol compliance checks and encrypted traffic behavior analysis on the data collected by the perception agent;

[0037] The decision agent is configured to implement a hierarchical response to the edge device based on a proximal policy optimization algorithm;

[0038] The federated learning module is used to train the Transformer model based on a federated learning approach.

[0039] Optionally, the cloud computing layer further includes a ledger generation module and a visualization response module;

[0040] The ledger generation module is used to automatically maintain the dynamic archive of the edge device and predict the anomaly of the edge device based on a multimodal large model.

[0041] The visualization response module is used to visualize the abnormality of the edge device based on the three-dimensional heat map and adjust the response action of the edge device according to the level of the abnormality.

[0042] In a fourth aspect, an embodiment of the present application provides an electronic device, the device comprising: a processor, a memory, and a system bus;

[0043] The processor and the memory are connected via the system bus;

[0044] The memory is used to store a program, which includes instructions. When the instructions are executed by the processor, the processor executes the steps of the edge device abnormality monitoring method introduced in any implementation of the first aspect above.

[0045] In the fifth aspect, an embodiment of the present application provides a computer-readable storage medium, which is used to store a computer program. When the computer program is executed by a terminal device, it implements the steps of the edge device abnormality monitoring method introduced in any implementation method of the above-mentioned first aspect.

[0046] It can be seen from the above technical solutions that the embodiments of the present application have the following advantages:

[0047] In an embodiment of the present application, first, the network protocol feature vector and the visual physical feature vector related to the edge device are obtained. Then, the network protocol feature vector and the visual physical feature vector are input into the preset Transformer model for cross-modal feature fusion to obtain the vector representation of the network protocol feature vector and the visual physical feature vector in the shared vector space, and the Transformer model is trained by federated learning. Subsequently, based on the vector representation of the network protocol feature vector in the shared vector space and the vector representation of the visual physical feature vector in the shared vector space, the target similarity score is calculated, and the target similarity score is used to reflect the degree of matching between the edge device at the network layer and the physical layer. Finally, the target similarity score is input into the preset reinforcement learning model, and the reinforcement learning model judges the target similarity score based on the dynamic threshold mechanism. When the target similarity score is less than or equal to the dynamic threshold, it means that the edge device is in an abnormal state.

[0048] It can be seen that this solution can comprehensively evaluate the matching degree of edge devices from the network layer and physical layer by fusing network protocol feature vectors and visual physical feature vectors through multi-modal feature fusion, thereby obtaining the vector representation of the two types of features in the shared vector space, and calculating the target similarity score based on this. The target similarity score is compared with the dynamic threshold set in the reinforcement learning model. When the target similarity score is less than or equal to the dynamic threshold, it can be determined that the edge device is in an abnormal state. Compared with the existing technology that relies solely on network protocol features to monitor edge device anomalies, this solution introduces visual physical feature vectors. By comprehensively evaluating the matching degree between the network layer and the physical layer of edge devices, it can effectively identify hidden anomalies such as device disguise and illegal replacement that cannot be discovered by network protocol features alone. The traditional solution only recognizes 85% of edge device anomalies, while this solution can recognize 95% of edge device anomalies, significantly improving the ability to monitor abnormal behavior of edge devices. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1 A flowchart of a method for monitoring abnormalities in an edge device provided in an embodiment of the present application;

[0050] Figure 2 A schematic diagram of the structure of an abnormality monitoring device for an edge device provided in an embodiment of the present application;

[0051] Figure 3 A schematic diagram of an abnormality monitoring system for edge devices provided in an embodiment of the present application. DETAILED DESCRIPTION

[0052] Currently, in scenarios such as data center user domains, the Industrial Internet of Things, and smart cities, a new attack model exists in which rogue devices access the network through physical camouflage. Attackers clone MAC addresses or spoof Modbus protocols to create a protocol fingerprint identical to legitimate devices, thereby bypassing traditional network protocol signature detection. They then physically replace the devices and exploit the visual similarity of edge devices to evade manual inspections.

[0053] Therefore, existing edge device anomaly monitoring methods primarily analyze network protocol features or visual-physical features from a single modality, while ignoring the correlation between these two features. This leads to a disconnect between network and physical layer information. This allows attackers to forge the protocol fingerprint of edge devices, disguising illegal devices as legitimate ones. Although the network protocol features appear normal, the edge device itself may have been illegally controlled or replaced, preventing timely detection of abnormal behavior and reducing the ability to monitor abnormal behavior in edge devices.

[0054] Furthermore, traditional edge device anomaly monitoring methods generally use static thresholds for judgment, but when network load surges, their false alarm rate rises sharply from 5% to 25%. This phenomenon is mainly due to the strain on system resources caused by sudden network traffic, making it difficult for static thresholds to achieve a dynamic balance between monitoring accuracy and system performance, further reducing the ability to detect abnormal edge device behavior.

[0055] At the same time, existing technologies for edge device anomaly monitoring typically rely on dedicated security chips or hardware modules to collect hardware fingerprints of edge devices. These hardware fingerprints provide unique visual and physical characteristics of edge devices. This results in high cost for single-node modification of each edge device. Furthermore, given the wide variety of edge devices in the Industrial Internet, some older Programmable Logic Controllers (PLCs) lack hardware fingerprint collection interfaces or are incompatible with dedicated security chips, making hardware modification of these older devices very difficult.

[0056] Based on this, in order to solve the above problems, an embodiment of the present application provides an abnormality monitoring method for edge devices. First, the network protocol feature vector and visual physical feature vector related to the edge device are obtained. Then, the network protocol feature vector and the visual physical feature vector are input into a preset Transformer model for cross-modal feature fusion to obtain the vector representation of the network protocol feature vector and the visual physical feature vector in the shared vector space, and the Transformer model is trained by federated learning. Subsequently, based on the vector representation of the network protocol feature vector in the shared vector space and the vector representation of the visual physical feature vector in the shared vector space, a target similarity score is calculated, and the target similarity score is used to reflect the degree of matching between the edge device at the network layer and the physical layer. Finally, the target similarity score is input into a preset reinforcement learning model, and the reinforcement learning model judges the target similarity score based on a dynamic threshold mechanism. When the target similarity score is less than or equal to the dynamic threshold, it means that the edge device is in an abnormal state.

[0057] It can be seen that this solution can comprehensively evaluate the matching degree of edge devices from the network layer and the physical layer by cross-modal feature fusion of network protocol feature vectors and visual physical feature vectors, thereby obtaining the vector representation of the two types of features in the shared vector space, and calculating the target similarity score based on this. The target similarity score is compared with the dynamic threshold set in the reinforcement learning model. When the target similarity score is less than or equal to the dynamic threshold, it can be determined that the edge device is in an abnormal state. Compared with the existing technology that relies solely on network protocol features to monitor edge device anomalies, this solution introduces visual physical feature vectors and dynamic threshold mechanisms. By comprehensively evaluating the matching degree of edge devices between the network layer and the physical layer, and flexibly adjusting the dynamic threshold, it can effectively identify hidden anomalies such as device disguise and illegal replacement that cannot be discovered by network protocol features alone, significantly improving the monitoring ability of abnormal behavior of edge devices.

[0058] In addition, to address the high cost and compatibility issues caused by the existing technology's reliance on dedicated security chips to collect hardware fingerprints, this solution introduces a method of cross-modal feature fusion by introducing visual physical feature vectors to obtain the physical characteristics of edge devices and combining them with network protocol feature vectors. This method collects visual information and network data from edge devices, thus enabling high-precision monitoring of abnormal behavior without the need for hardware modifications to edge devices. At the same time, when the network load fluctuates between 10% and 90%, the increase in CPU occupancy does not exceed 15%, demonstrating that this solution has good dynamic adaptability and resource control capabilities.

[0059] It should be noted that the embodiments of the present application do not limit the execution entity of the abnormality monitoring method for edge devices. For example, the abnormality monitoring method for edge devices in the embodiments of the present application can be applied to information processing devices such as servers or terminal devices. The server can be a standalone server, a cluster server, or a cloud server. The terminal device can be an electronic device such as a smartphone, a computer, a personal digital assistant (PDA), or a tablet computer.

[0060] In order to make the purpose, technical solutions and advantages of the embodiments of this application more clear, the technical solutions in the embodiments of this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0061] Figure 1 A flowchart of an abnormality monitoring method for edge devices provided in an embodiment of the present application. Figure 1 As shown, the abnormality monitoring method of the edge device may include the following steps S101 to S104.

[0062] S101: Obtain a network protocol feature vector and a visual physical feature vector related to an edge device.

[0063] In an embodiment of the present application, network protocol features and visual physical features related to the edge device are obtained, wherein the network protocol features are mainly used to characterize the behavioral status of the edge device at the network layer, while the visual physical features are mainly used to characterize the external performance of the edge device at the physical layer.

[0064] Specifically, the acquisition of network protocol features in the embodiments of the present application relies on the network traffic capture function, which is deployed on the mirror port of the edge device. It can collect bidirectional traffic and use zero-copy technology to improve throughput, achieving efficient capture of 10Gbps line-speed traffic. The network protocol features include the transmission control protocol window parameters of the edge device, the variance of the synchronization control message sending interval, the security transport layer protocol session reuse rate, the entropy value of the hypertext transfer protocol request header information, and the Shannon entropy of the port access frequency.

[0065] It should be noted that the transmission control protocol window parameters reflect the network adaptability and data transmission strategy of the edge device, mainly including key indicators such as the initial window size, window scaling factor, receive window and congestion window, which are used to measure the traffic regulation and congestion control behavior of the edge device under different network conditions; the synchronization control message sending interval variance is used to measure the standard deviation of the sending interval when the edge device continuously sends synchronization control messages; the security transport layer protocol session reuse rate can be used to detect the reuse of edge device session identifiers. For example, the session reuse rate of normal edge devices is usually higher than 70%, while that of maliciously cloned edge devices is often lower than 30%; the entropy value of the hypertext transfer protocol request header information is used to calculate the character distribution entropy value of the edge device user agent field. The entropy value of normal edge devices is stable in the range of 4.2±0.3; the Shannon entropy of the port access frequency is the distribution characteristic of the edge device port access frequency calculated based on the sliding window, and its calculation formula is:

[0066] H=-∑ i (p i ×log2(p i ));

[0067] Where H represents the Shannon entropy of the access frequency of the edge device port, p i Indicates the traffic proportion of port i.

[0068] In addition, network protocol characteristics also include the timing characteristics of Dynamic Host Configuration Protocol interactions, which are reflected by counting the frequency of IP lease updates on edge devices. Typically, the standard deviation of the update interval for normal edge devices is less than 5 seconds, while the standard deviation of the update interval for malicious edge devices is greater than 20 seconds.

[0069] In this embodiment of the present application, a perspective transformation is first performed on an input image with a resolution of 640×480 to correct the image's tilt angle. Subsequently, a homography matrix is ​​used to map the image to a standard perspective. Finally, an improved lightweight convolutional neural network is used to extract the image's visual physical features. These visual physical features include the edge device's port plug-in status, port indicator status, device appearance image, and optical character recognition results of the port location.

[0070] Specifically, the port plug-in status of the edge device can be detected by the YOLOv5-Ghost neural network to detect the position of the RJ45 plug and port. The average accuracy of the neural network model in detecting the RJ45 plug can reach 92%. By calculating the intersection-and-union ratio between the plug and the port, when the intersection-and-union ratio is greater than or equal to 0.8, it can be determined that the plug has been inserted into the port, indicating that the port is in a connected state. In addition, the embodiment of the present application can use FPGA to accelerate the YOLOv5-Ghost model to improve detection efficiency; the port indicator light status is extracted by HSV color space segmentation. The region of interest (ROI) of the indicator light, where the hue H corresponds to red, has a value range of 0 to 50, the saturation S is greater than 0.4, and the lightness V is greater than 0.6, is used to accurately locate the red indicator light area. On this basis, a sequence of brightness changes in 10 consecutive frames of the area is obtained and input into the Long Short-Term Memory (LSTM) network for time series modeling to classify and judge the flicker frequency. Generally speaking, when the flicker frequency is greater than 2 Hz, it can be determined as a data transmission state; the device appearance image can be used to realize multi-perspective edge device model recognition through the lightweight MobileNetV3 model, and combined with dynamic calibration technology, it can accurately adapt to the mapping of network ports and physical ports in hot-swappable scenarios; the optical character recognition results of the port position can be used to combine the Convolutional Recurrent Neural Network (CRNN) and the Connectionist Temporal Classification (CTC) model to identify port labels containing numbers and letters, and dynamically maintain the correspondence between network ports and physical ports to achieve accurate management of port information.

[0071] Furthermore, after obtaining the network protocol features and the visual physical features, the network protocol features and the visual physical features are respectively vectorized to obtain a network protocol feature vector and a visual physical feature vector.

[0072] S102: Input the network protocol feature vector and the visual physical feature vector into a preset Transformer model for cross-modal feature fusion to obtain vector representations of the network protocol feature vector and the visual physical feature vector in a shared vector space. The Transformer model is trained through federated learning.

[0073] Before inputting the network protocol feature vector and the visual-physical feature vector into the preset Transformer model, a preliminary rule matching is performed on the network protocol feature vector and the visual-physical feature vector based on a preset four-dimensional matching matrix. Only if the preliminary rule matching is successful can the network protocol feature vector and the visual-physical feature vector be input into the Transformer model for cross-modal feature fusion. If the preliminary rule matching fails, it can be determined that the edge device is in an abnormal state, thereby triggering the corresponding abnormal alarm strategy.

[0074] It should be noted that the Transformer model in the embodiment of the present application is trained through federated learning. Compared with the federated learning method in the prior art that does not consider dynamic resource scheduling, the embodiment of the present application performs distributed training based on local data at each node of the edge device, and optimizes the weight distribution of the network protocol feature vector and the visual physical feature vector by considering dynamic indicators such as CPU utilization. In the federated learning process, the loss function can be set as:

[0075] L = α1 × (1-TPR) + α2 × FPR + α3 × CPU utilization;

[0076] Where L is the loss function, α1, α2, and α3 are weight coefficients, TPR is the true positive rate, FPR is the false positive rate, and CPU utilization represents the usage of the edge device processor.

[0077] For example, α1, α2, and α3 can be set to 0.6, 0.3, and 0.1, respectively. In this case, the loss function is:

[0078] L = 0.6 × (1-TPR) + 0.3 × FPR + 0.1 × CPU utilization;

[0079] Subsequently, the gradients calculated by each node of the edge device are encrypted using the Paillier homomorphic encryption algorithm with a 2048-bit key, and the encrypted gradients are aggregated by the cloud central server using the federated averaging algorithm. The security of sensitive parameters in the aggregation process is protected by the software protection extension enclave. At the same time, the updated global model is set to be pushed to each node of the edge device every 24 hours, effectively solving the problem of data silos.

[0080] Furthermore, the embodiment of the present application distributes the weights of network protocol features and visual physical features through the Transformer model. Among them, the dimensions of the network protocol feature vector and the visual physical feature vector are both 128 dimensions. On this basis, the two types of feature vectors are input into the Transformer model for cross-modal feature fusion, and the semantic association between the two types of feature vectors is deeply mined with the help of the attention mechanism of the Transformer model, and finally a unified vector representation of the two in the shared vector space is obtained.

[0081] S103: Based on the vector representation of the network protocol feature vector in the shared vector space and the vector representation of the visual physical feature vector in the shared vector space, a target similarity score is calculated. The target similarity score is used to reflect the degree of matching between the network layer and the physical layer of the edge device.

[0082] In the embodiment of the present application, the vector representation of the network protocol feature vector in the shared vector space is used as the query vector (Query, Q), and the vector representation of the visual physical feature vector in the shared vector space is used as the key vector (Key, K) and the value vector (Value, V). The target similarity score of the two is calculated using the following attention mechanism formula:

[0083]

[0084] Among them, S is the target similarity score, d k is the vector dimension, which is consistent with the dimension of the network protocol feature vector and the visual physical feature vector.

[0085] It should be noted that the target similarity score is used to reflect the degree of matching between the network layer and the physical layer of the edge device. The higher the target similarity score, the closer the correlation between the network protocol characteristics and the visual physical characteristics, which means that the edge device has a stronger consistency between the network layer and the physical layer; conversely, the lower the target similarity score, the more obvious the deviation between the two, which means that the edge device may have an abnormality.

[0086] S104: Input the target similarity score into a preset reinforcement learning model. The reinforcement learning model judges the target similarity score based on a dynamic threshold mechanism. When the target similarity score is less than or equal to the dynamic threshold, it is determined that the edge device is in an abnormal state.

[0087] In the embodiment of the present application, the target similarity score is input into a preset reinforcement learning model, and the reinforcement learning judges the target similarity score based on a dynamic threshold mechanism. It should be noted that the dynamic threshold mechanism is constructed by dynamically adjusting the sliding window duration based on CPU utilization. The calculation formula for the sliding window duration is:

[0088]

[0089] Among them, w represents the sliding window duration, A is the maximum duration of the sliding window, that is, the upper limit of the historical data time range referenced when calculating the dynamic threshold, and B is the window reduction coefficient, which is used to quantify the impact of changes in CPU utilization on the window duration. CPU utilization reflects the real-time usage of the edge device processor.

[0090] For example, when the sliding window duration w is between 10 seconds and 60 seconds, you can set parameters A to 60 and B to 50. In this case, the calculation formula for the sliding window duration is:

[0091]

[0092] It can be seen from this that the sliding window length in the embodiment of the present application will be dynamically adjusted according to the real-time CPU utilization of the edge device. When the CPU utilization increases, the sliding window length w will decrease accordingly, which means that when the dynamic threshold is calculated, the time range of historical data referenced is reduced. At this time, the reinforcement learning model can quickly respond to the state changes of the edge device and is more sensitive to small fluctuations in the target similarity score; when the CPU utilization decreases, the sliding window length w will increase accordingly. When the dynamic threshold is calculated, the time range of historical data referenced is expanded accordingly, which helps to improve the judgment stability of the reinforcement learning model, thereby reducing misjudgments caused by accidental fluctuations.

[0093] In the embodiment of the present application, when the target similarity score is less than or equal to the dynamic threshold, the edge device is determined to be in an abnormal state, and when the target similarity score is greater than the dynamic threshold, the edge device is determined to be in a normal state.

[0094] Based on the relevant contents of the above steps S101 to S104, it can be known that in an embodiment of the present application, by obtaining the network protocol feature vector and the visual physical feature vector related to the edge device. Then, the network protocol feature vector and the visual physical feature vector are input into the preset Transformer model for cross-modal feature fusion, and the vector representation of the network protocol feature vector and the visual physical feature vector in the shared vector space is obtained, and the Transformer model is trained by federated learning. Subsequently, based on the vector representation of the network protocol feature vector in the shared vector space and the vector representation of the visual physical feature vector in the shared vector space, the target similarity score is calculated, and the target similarity score is used to reflect the degree of matching between the edge device at the network layer and the physical layer. Finally, the target similarity score is input into the preset reinforcement learning model, and the reinforcement learning model judges the target similarity score based on the dynamic threshold mechanism. When the target similarity score is less than or equal to the dynamic threshold, it means that the edge device is in an abnormal state.

[0095] It can be seen that this solution can comprehensively evaluate the matching degree of edge devices from the network layer and the physical layer by fusing the network protocol feature vector and the visual physical feature vector for multimodal features, thereby obtaining the vector representation of the two types of features in the shared vector space, and calculating the target similarity score accordingly. The target similarity score is compared with the dynamic threshold set in the reinforcement learning model. When the target similarity score is less than or equal to the dynamic threshold, it can be determined that the edge device is in an abnormal state. Compared with the existing technology that relies solely on network protocol features to monitor edge device anomalies, this solution introduces visual physical feature vectors. By comprehensively evaluating the matching degree of edge devices between the network layer and the physical layer, it can effectively identify hidden anomalies such as device disguise and illegal replacement that cannot be discovered by network protocol features alone, significantly improving the monitoring ability of abnormal behavior of edge devices.

[0096] Furthermore, based on the edge device anomaly monitoring method provided in the above embodiment, the present application embodiment can also provide an edge device anomaly monitoring device. The edge device anomaly monitoring device is described below in conjunction with the embodiments and drawings.

[0097] Figure 2 A schematic diagram of the structure of an abnormality monitoring device for an edge device provided in an embodiment of the present application. Figure 2 As shown, the abnormality monitoring device 200 of the edge device provided in the embodiment of the present application may include:

[0098] A vector acquisition module 201 is used to acquire network protocol feature vectors and visual physical feature vectors related to edge devices;

[0099] a vector fusion module 202 for inputting the network protocol feature vector and the visual-physical feature vector into a preset Transformer model for cross-modal feature fusion to obtain vector representations of the network protocol feature vector and the visual-physical feature vector in a shared vector space, wherein the Transformer model is trained using a federated learning approach;

[0100] A similarity calculation module 203 is configured to calculate a target similarity score based on the vector representation of the network protocol feature vector in the shared vector space and the vector representation of the visual-physical feature vector in the shared vector space, wherein the target similarity score is used to reflect the degree of matching between the network layer and the physical layer of the edge device;

[0101] The similarity judgment module 204 is used to input the target similarity score into a preset reinforcement learning model. The reinforcement learning model judges the target similarity score based on a dynamic threshold mechanism. When the target similarity score is less than or equal to the dynamic threshold, it is determined that the edge device is in an abnormal state.

[0102] Optionally, the vector acquisition module 201 is specifically configured to:

[0103] Acquire network protocol features and visual physical features related to the edge device, wherein the network protocol features are used to characterize the behavior state of the edge device at the network layer, and the visual physical features are used to characterize the external performance of the edge device at the physical layer;

[0104] Vectorization processing is performed on the network protocol feature and the visual physical feature respectively to obtain the network protocol feature vector and the visual physical feature vector.

[0105] Optionally, the vector fusion module 202 is specifically configured to:

[0106] Based on a preset four-dimensional matching matrix, performing preliminary rule matching on the network protocol feature vector and the visual physical feature vector;

[0107] When the preliminary rule matching is successful, the network protocol feature vector and the visual physical feature vector are input into a preset Transformer model for cross-modal feature fusion.

[0108] Optionally, the abnormality monitoring device 200 of the edge device may include:

[0109] The matching failure module is used to determine that the edge device is in an abnormal state and trigger a corresponding abnormal alarm strategy when the preliminary rule matching fails.

[0110] Optionally, the dynamic threshold mechanism is constructed by dynamically adjusting the sliding window duration based on CPU utilization, and the calculation formula of the sliding window duration is:

[0111]

[0112] Wherein, w represents the duration of the sliding window, A represents the maximum duration of the sliding window, B represents the window reduction coefficient that is dynamically adjusted as the CPU utilization changes, and the CPU utilization represents the usage of the edge device processor.

[0113] Optionally, the network protocol characteristics include transmission control protocol window parameters, synchronization control message sending interval variance, security transport layer protocol session reuse rate, hypertext transfer protocol request header information entropy value and port access frequency Shannon entropy;

[0114] The visual physical features include the port plug status, the port indicator light status, the device appearance image and the optical character recognition result of the port position.

[0115] Optionally, the abnormality monitoring device 200 of the edge device may include:

[0116] A threshold comparison module is used to determine that the edge device is in a normal state when the target similarity score is greater than the dynamic threshold.

[0117] Furthermore, an embodiment of the present application also provides an electronic device, comprising: a processor, a memory, and a system bus;

[0118] The processor and the memory are connected via the system bus;

[0119] The memory is used to store one or more programs, and the one or more programs include instructions. When the instructions are executed by the processor, the processor performs any implementation step of the above-mentioned edge device exception method.

[0120] Furthermore, an embodiment of the present application also provides a computer-readable storage medium, which is used to store a computer program. When the computer program is executed by a terminal device, it implements any implementation step in the above-mentioned edge device exception method.

[0121] Based on the edge device anomaly monitoring device provided in the above embodiment, the present application embodiment can also provide an edge device anomaly monitoring system. The edge device anomaly monitoring system is described below in conjunction with the embodiments and drawings.

[0122] Figure 3 A schematic diagram of an abnormality monitoring system for edge devices provided in an embodiment of the present application. Figure 3 As shown, the edge device anomaly monitoring system provided by the embodiment of the present application may include an edge layer and a cloud computing layer. The edge layer includes a dynamic perception and device identification module and a multi-agent collaborative detection engine; while the cloud computing layer includes a federated learning module.

[0123] It should be noted that the dynamic perception and device identification module is used to execute the edge device anomaly detection method in the above embodiment. The multi-agent collaborative detection engine includes a perception agent, an analysis agent, and a decision agent.

[0124] Specifically, the perception agent configures the network traffic sampling frequency and visual frame rate of the edge device to collect network data and image data from the edge device. For example, the network traffic sampling frequency can be set to 1 second / time. When the load of the edge device exceeds 80%, it is automatically reduced to 5 seconds / time to reduce resource usage. The visual frame rate can be set to 15 frames per second (FPS), that is, 15 frames of image are collected or played per second. In the case of insufficient light, it automatically switches to infrared mode to ensure the continuity and stability of image data collection.

[0125] Next, the perception agent performs preprocessing operations such as feature compression and standardization on the collected data. For network data, the principal component analysis (PCA) method can be used to reduce the dimension of the protocol fingerprint features to 32 dimensions to reduce redundant information; the image data is normalized so that the mean of the visual features is 0.5 and the variance is 0.25.

[0126] The analysis agent is used to perform protocol compliance checks and encrypted traffic penetration analysis on the data collected by the perception agent. The protocol compliance check verifies the communication protocol through a function code whitelist, which only allows instructions with function code values ​​less than or equal to 15 to pass; at the same time, the Transmission Control Protocol (TCP) flag is detected for anomalies. For example, when it is detected that the proportion of synchronous messages exceeds 90%, it can be determined that a synchronous flooding attack exists. In addition, the analysis agent can also use JA3 / JA3S fingerprint technology to identify the transmission security protocol handshake process, and then analyze the characteristics of the encrypted traffic. By matching the certificate subject alternative name (SAN) field with the edge device model, the optical character recognition results of the edge device are compared with the declaration information in the certificate to improve the accuracy of abnormal traffic detection.

[0127] The decision-making agent implements a hierarchical response to edge devices based on a proximal policy optimization algorithm. By rationally configuring the state space, action space, and reward function, a hierarchical response capability to abnormal conditions of edge devices can be achieved. Specifically, the state space covers network load, threat level, and device type distribution. The action space includes operations such as blocking ports, speed limiting, and generating alarms. The reward function comprehensively considers the true positive rate, false positive rate, and CPU utilization. The weight coefficient of the true positive rate can be 10, the weight coefficient of the false positive rate can be 5, and the weight coefficient of the CPU utilization can be 2. The reward function is calculated as follows:

[0128] R = 10 × TPR - 5 × FPR - 2 × CPU utilization;

[0129] Here, R represents the reward function, TPR represents the true positive rate, and FPR represents the false positive rate.

[0130] Next, the graded response can be divided into two categories: severe threat and moderate threat. When the anomaly level is a severe threat, the operation of the edge device can be physically blocked immediately. When the anomaly level is a moderate threat, the operating speed of the edge device is limited to 1Mbps and a system log alarm is generated.

[0131] In the embodiment of the present application, the cloud computing layer includes a federated learning module, which is used to train the Transformer model based on a federated learning approach. The training process has been described in detail in the above embodiment and will not be repeated here. In addition, the cloud computing layer also includes a ledger generation module and a visualization response module.

[0132] Specifically, the ledger generation module is used to automatically record the rules of edge devices and generate a basic profile for the edge device when the edge device is first connected. This profile contains the protocol fingerprint and visual feature snapshot of the edge device; when the protocol fingerprint similarity is less than 85% or the visual feature deviation exceeds 15%, the profile change record is triggered. The change tracking function of the edge device continuously records the historical status of the edge device and uses the time series database (Influx Database, InfluxDB) for storage, while also associating threat intelligence, such as matching the edge device firmware version through the Common Vulnerabilities and Exposures (CVE) library.

[0133] In addition, the ledger generation module can also predict abnormalities of edge devices through a multimodal large model. The protocol behavior sequence is encoded through LSTM, and the visual features are encoded through a convolutional neural network and input into the multimodal large model. A joint embedding vector is generated through the fusion layer of the cross-attention mechanism, thereby predicting the output, including the probability of the edge device being attacked by a distributed denial of service (DDoS) attack within the next hour. When the probability value reaches or exceeds 0.7, an early warning is triggered, and confidence ranking recommendations for handling strategies such as blocking, isolation, and speed limiting are given.

[0134] The visual response module is based on a three-dimensional heat map to intuitively display the abnormal conditions of edge devices. This module maps the physical coordinates obtained based on visual positioning data to the X-axis or Y-axis, maps the real-time traffic rate to the Z-axis, and uses a color gradient for visualization, where blue indicates a traffic flow below 1Mbps and red indicates a traffic flow above 1Gbps, thereby achieving a clear visual display of the network status of edge devices and improving the intuitiveness and efficiency of abnormal monitoring. At the same time, the Web Graphics Library (WebGL) is used to accelerate the rendering of graphics. It should be noted that the WebGL technology supports real-time updates of hundreds of thousands of nodes and can highlight abnormal communication paths. For example, the lateral movement path can be marked in red to improve the efficiency and visualization of identifying abnormal behaviors of edge devices.

[0135] In addition, the visual response module can also implement closed-loop response processing for abnormal behaviors based on the automation engine. Specifically, the priority of the blocking rule is dynamically adjusted through the Q-value learning algorithm, where the learning rate of the Q-value learning algorithm can be set to 0.01, and the corresponding response action is performed according to the abnormality level of the edge device and the matching matrix. For example, when the abnormality level of the edge device is level 5, a blocking operation can be triggered and an alarm email can be sent; when the abnormality level is level 3 to 4, speed limit measures are implemented and a system log alarm is generated. At the same time, the module also has a feedback closed-loop mechanism. After the false alarm case is manually marked and confirmed, it automatically triggers the incremental update of the federated learning model, and the update delay is controlled within 1 hour, thereby continuously improving the accuracy of the response to abnormal processing.

[0136] It can be seen from the description of the above implementation methods that those skilled in the art can clearly understand that all or part of the steps in the above-mentioned embodiment methods can be implemented by means of software plus the necessary general hardware platform. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art can be embodied in the form of a software product. The computer software product can be stored in a storage medium, such as ROM / RAM, a disk, an optical disk, etc., and includes a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network communication device such as a media gateway, etc.) to execute the methods described in each embodiment of the present application or certain parts of the embodiments. It should be noted that the various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same and similar parts between the various embodiments can be referred to each other.

[0137] As for the system disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the description of the method part.

[0138] It should also be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or device comprising the element.

[0139] The above description of the disclosed embodiments is intended to enable one skilled in the art to implement or use the present application. Various modifications to these embodiments will be readily apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application is not limited to the embodiments shown herein, but is intended to conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for monitoring abnormalities of edge devices, characterized in that: The method comprises: Obtaining network protocol feature vectors and visual physical feature vectors related to edge devices; Inputting the network protocol feature vector and the visual-physical feature vector into a preset Transformer model for cross-modal feature fusion to obtain vector representations of the network protocol feature vector and the visual-physical feature vector in a shared vector space, wherein the Transformer model is trained by a federated learning method; Calculating a target similarity score based on a vector representation of the network protocol feature vector in the shared vector space and a vector representation of the visual-physical feature vector in the shared vector space, wherein the target similarity score is used to reflect the degree of matching between the network layer and the physical layer of the edge device; The target similarity score is input into a preset reinforcement learning model, and the reinforcement learning model judges the target similarity score based on a dynamic threshold mechanism. When the target similarity score is less than or equal to the dynamic threshold, it is determined that the edge device is in an abnormal state.

2. The method according to claim 1, characterized in that The obtaining of the network protocol feature vector and the visual physical feature vector related to the edge device includes: Acquire network protocol features and visual physical features related to the edge device, wherein the network protocol features are used to characterize the behavior state of the edge device at the network layer, and the visual physical features are used to characterize the external performance of the edge device at the physical layer; Vectorization processing is performed on the network protocol feature and the visual physical feature respectively to obtain the network protocol feature vector and the visual physical feature vector.

3. The method according to claim 1, characterized in that Inputting the network protocol feature vector and the visual physical feature vector into a preset Transformer model for cross-modal feature fusion includes: Based on a preset four-dimensional matching matrix, performing preliminary rule matching on the network protocol feature vector and the visual physical feature vector; When the preliminary rule matching is successful, the network protocol feature vector and the visual physical feature vector are input into a preset Transformer model for cross-modal feature fusion.

4. The method according to claim 3, characterized in that The method further comprises: In the case that the preliminary rule matching fails, it is determined that the edge device is in an abnormal state, and a corresponding abnormal alarm strategy is triggered.

5. The method according to claim 1, wherein The dynamic threshold mechanism is constructed by dynamically adjusting the sliding window duration based on CPU utilization. The calculation formula for the sliding window duration is: Wherein, w represents the duration of the sliding window, A represents the maximum duration of the sliding window, B represents the window reduction coefficient that is dynamically adjusted as the CPU utilization changes, and the CPU utilization represents the usage of the edge device processor.

6. The method according to claim 2, characterized in that The network protocol characteristics include transmission control protocol window parameters, synchronization control message sending interval variance, security transport layer protocol session reuse rate, hypertext transfer protocol request header information entropy value and port access frequency Shannon entropy; The visual physical features include the port plug status, the port indicator light status, the device appearance image and the optical character recognition result of the port position.

7. The method according to claim 1, characterized in that The method further comprises: When the target similarity score is greater than the dynamic threshold, it is determined that the edge device is in a normal state.

8. An abnormality monitoring device for edge devices, characterized in that: include: A vector acquisition module is used to obtain network protocol feature vectors and visual physical feature vectors related to edge devices; a vector fusion module, configured to input the network protocol feature vector and the visual-physical feature vector into a preset Transformer model for cross-modal feature fusion, thereby obtaining vector representations of the network protocol feature vector and the visual-physical feature vector in a shared vector space, wherein the Transformer model is trained using a federated learning approach; a similarity calculation module, configured to calculate a target similarity score based on a vector representation of the network protocol feature vector in the shared vector space and a vector representation of the visual-physical feature vector in the shared vector space, wherein the target similarity score is used to reflect a degree of matching between the network layer and the physical layer of the edge device; A similarity judgment module is used to input the target similarity score into a preset reinforcement learning model. The reinforcement learning model judges the target similarity score based on a dynamic threshold mechanism. When the target similarity score is less than or equal to the dynamic threshold, it is determined that the edge device is in an abnormal state.

9. An abnormality monitoring system for edge devices, characterized in that: The system includes an edge layer and a cloud computing layer; The edge layer includes a dynamic perception and device identification module, and a multi-agent collaborative detection engine; The cloud computing layer includes a federated learning module; The dynamic perception and device identification module is used to perform the method according to any one of claims 1 to 7; The multi-agent collaborative detection engine includes a perception agent, an analysis agent and a decision-making agent; The perception agent is used to collect and preprocess data from the edge device; The analysis agent is used to perform protocol compliance checks and encrypted traffic behavior analysis on the data collected by the perception agent; The decision agent is configured to implement a hierarchical response to the edge device based on a proximal policy optimization algorithm; The federated learning module is used to train the Transformer model based on a federated learning approach.

10. The system according to claim 9, characterized in that The cloud computing layer also includes a ledger generation module and a visual response module; The ledger generation module is used to automatically maintain the dynamic archive of the edge device and predict the abnormality of the edge device based on the multimodal large model; The visualization response module is used to visualize the abnormality of the edge device based on the three-dimensional heat map and adjust the response action of the edge device according to the level of the abnormality.

Images