An iot terminal anomaly detection method and system fusing timing behavior

Abstract

The application provides a kind of fusion time sequence behavior's internet of things terminal exception detection method and system, it is related to internet of things technical field.The method includes: collecting the time sequence communication behavior data of multiple internet of things terminal devices, constructs the time sequence communication behavior matrix of each internet of things terminal device;Multiple internet of things terminal devices are carried out window behavior correlation analysis and construct multiple communication behavior correlation matrix;According to multiple sets of time sequence communication behavior data, construct multiple communication pressure intervals, extract the interval correlation sample set of each communication pressure interval;Communication behavior correlation clustering is carried out in each communication pressure interval to construct multiple behavior class clusters;The behavior class cluster of multiple communication pressure intervals is analyzed to construct class cluster structure migration path, and group behavior anomaly detection is carried out based on class cluster structure migration path to multiple internet of things terminal devices, and internet of things terminal exception detection result is generated.The application realizes the accuracy of improving internet of things terminal device group behavior anomaly detection.

Description

Technical Field

[0001] This invention relates to the field of Internet of Things (IoT) technology, and in particular to an IoT terminal anomaly detection method and system that integrates time-series behavior. Background Technology

[0002] With the development of IoT technology, more and more devices are being widely used in smart homes, industrial automation, and smart cities. These devices typically need to collaborate to complete tasks, and their communication and resource sharing are crucial to the overall system performance. Some IoT terminal device anomaly detection methods involve monitoring the abnormal behavior of individual devices, relying on the device's own state to identify faults or anomalies. While these methods are suitable for monitoring independent devices, they cannot effectively identify disruptions to group behavior patterns. For example, in some scenarios, a single device may still function normally, but the collaborative relationships and group behavior patterns between devices may change, changes that are difficult to identify using methods for detecting anomalies in individual devices.

[0003] Group behavior analysis of multiple devices, by monitoring the interrelationships between them, can reveal potential system problems when the behavioral patterns of some devices deviate from the expected behavior. The behavioral patterns of devices within a group typically exhibit certain regularities, and when these regularities are broken, it indicates a potential anomaly requiring attention. Furthermore, these regularities may dynamically change with varying communication loads. For example, under high communication loads, the collaborative relationships between devices may become closer, leading to changes in the group's behavioral patterns. In this case, the group's behavioral patterns evolve with load changes. Traditional individual device detection methods cannot capture these changes in group behavioral correlations caused by load variations, which are often precursors to system anomalies.

[0004] Therefore, there is an urgent need for an innovative method based on time-series behavior detection that combines communication load changes with the evolutionary analysis of group behavior. By monitoring the dynamic evolution of the collaborative relationship between devices as the load changes, the accuracy of anomaly detection in IoT terminal devices can be improved. Summary of the Invention

[0005] This invention proposes an IoT terminal anomaly detection method and system that integrates temporal behavior to solve at least one of the technical problems mentioned in the background art above.

[0006] To achieve the above objectives, the first aspect of the present invention provides an anomaly detection method for IoT terminals that integrates temporal behavior, comprising:

[0007] Collect time-series communication behavior data from multiple IoT terminal devices, and construct a time-series communication behavior matrix for each IoT terminal device based on the time-series communication behavior data;

[0008] Based on the time-series communication behavior matrix, window behavior correlation analysis is performed on multiple IoT terminal devices to construct multiple communication behavior correlation matrices for multiple IoT terminal devices;

[0009] A communication intensity time series curve is constructed based on multiple sets of time series communication behavior data. Multiple communication pressure intervals are constructed based on the communication intensity time series curve. The interval association sample set of each communication pressure interval is extracted from multiple communication behavior association matrices.

[0010] Based on multiple interval-related sample sets, communication behavior association clustering is performed in each communication pressure interval to construct multiple behavior clusters for each communication pressure interval;

[0011] Device migration analysis is performed on behavioral clusters in multiple communication pressure ranges to construct cluster structure migration paths. Based on the cluster structure migration paths, group behavior anomaly detection is performed on multiple IoT terminal devices to generate IoT terminal anomaly detection results.

[0012] Preferably, for the communication behavior correlation matrix and the communication strength time series curve, it further includes:

[0013] Multiple time-series communication behavior matrices are windowed to extract the window behavior matrix of each IoT terminal device under multiple time windows. Window behavior correlation analysis is performed on any two IoT terminal devices within the same time window to calculate the window behavior correlation parameters between the two IoT terminal devices. The communication behavior correlation matrix of multiple IoT terminal devices within each time window is then constructed.

[0014] The communication strength parameters within each time window are determined based on multiple sets of time-series communication behavior data, and a time-series curve of the communication strength of multiple IoT terminal devices is constructed based on multiple communication strength parameters.

[0015] Preferably, communication behavior association clustering is performed in each communication pressure interval based on multiple interval-related sample sets to construct multiple behavior clusters for each communication pressure interval, including:

[0016] For multiple interval-related sample sets, the global communication intensity range is determined based on the communication intensity time series curve. The global communication intensity range is then binned to generate multiple communication pressure intervals. The communication pressure interval to which each time window belongs is determined, and multiple communication behavior correlation matrices are assigned to intervals. The multiple communication behavior correlation matrices contained in each communication pressure interval are determined, and the interval-related sample set of each communication pressure interval is generated.

[0017] Multiple communication behavior association matrices in the interval association sample set are fused to generate a local association matrix for each communication pressure interval. In each communication pressure interval, multiple IoT terminal devices are clustered based on the local association matrix to obtain multiple behavior clusters for each communication pressure interval.

[0018] Preferably, device migration analysis is performed on behavioral clusters across multiple communication pressure ranges to construct cluster structure migration paths, including:

[0019] Determine the cluster impact parameters of each IoT terminal device in the behavior cluster, construct multiple device migration combinations based on multiple behavior clusters in two adjacent communication pressure intervals, determine the device coverage group of each device migration combination and calculate the device coverage parameters;

[0020] Based on the cluster impact parameters and the device coverage group, the device coverage parameters are optimized to generate the target migration index for each device migration combination. Based on the multiple target migration indices, multiple local migration combinations are determined for two communication pressure intervals. The multiple local migration combinations are then spliced ​​together to generate multiple cluster structure migration paths.

[0021] Preferably, based on the cluster structure migration path, the group behavior anomaly detection of multiple IoT terminal devices is performed, and the generated IoT terminal anomaly detection results include:

[0022] Based on multiple cluster structure migration paths, the group collaboration data of each IoT terminal device is determined, and multiple IoT terminal devices are divided into group collaboration devices and non-group collaboration devices according to the number of group collaborations.

[0023] After collecting real-time communication behavior data from multiple IoT terminal devices, the real-time status label of each IoT terminal device is determined based on the real-time communication behavior data, and the status deviation parameters of multiple IoT terminal devices are determined.

[0024] Anomaly detection of group collaboration among multiple IoT terminal devices is performed based on multiple behavioral clusters. This includes determining multiple real-time clusters based on real-time communication behavior data, calculating the group structure anomaly parameters for each real-time cluster, and fusing the group structure anomaly parameters and state deviation parameters to generate IoT terminal anomaly detection results.

[0025] Preferably, based on multiple communication behavior association matrices in the interval association sample set, multiple window behavior association parameters between any two IoT terminal devices are determined and local association parameters are calculated. Based on multiple local association parameters, a local association matrix for each communication pressure interval is constructed.

[0026] A second aspect of the present invention provides an IoT terminal anomaly detection system that integrates temporal behavior, for implementing the above-mentioned IoT terminal anomaly detection method that integrates temporal behavior, comprising:

[0027] The communication data acquisition module is used to collect time-series communication behavior data from multiple IoT terminal devices and construct a time-series communication behavior matrix for each IoT terminal device based on the time-series communication behavior data.

[0028] The communication correlation analysis module is used to perform window behavior correlation analysis on multiple IoT terminal devices based on the time-series communication behavior matrix, and to construct multiple communication behavior correlation matrices for multiple IoT terminal devices.

[0029] The interval sample construction module is used to construct communication intensity time series curves based on multiple sets of time series communication behavior data, construct multiple communication pressure intervals based on the communication intensity time series curves, and extract the interval association sample set of each communication pressure interval from multiple communication behavior association matrices.

[0030] The communication behavior clustering module is used to perform communication behavior association clustering in each communication pressure interval based on multiple interval association sample sets, and to construct multiple behavior clusters in each communication pressure interval;

[0031] The communication anomaly detection module is used to perform device migration analysis on behavioral clusters in multiple communication pressure ranges to construct cluster structure migration paths, and to perform group behavior anomaly detection on multiple IoT terminal devices based on the cluster structure migration paths, generating IoT terminal anomaly detection results.

[0032] The present invention has the following beneficial effects:

[0033] This invention constructs a time-series communication behavior matrix for different devices by collecting time-series communication behavior data from multiple IoT terminal devices and performs window behavior correlation analysis to form a multi-time-window communication behavior correlation matrix. It extracts time-series curves of communication intensity and divides the data into multiple communication pressure intervals. The invention then performs correlation clustering on the device group under different load conditions to generate behavioral clusters representing collaborative patterns. By analyzing the evolution of cluster structures in adjacent pressure intervals, it constructs cluster structure migration paths to capture the dynamic collaborative patterns of the device group under load changes. Finally, it calculates and integrates cluster structure anomaly parameters and device state deviation parameters based on real-time communication data to achieve cross-pressure scenario group behavior anomaly detection. This effectively identifies implicit group collaboration anomalies in scenarios with complex load changes, significantly improving the accuracy of IoT terminal anomaly detection. Attached Figure Description

[0034] Figure 1 This is a flowchart illustrating an IoT terminal anomaly detection method that integrates temporal behavior, as provided in an embodiment of the present invention. Detailed Implementation

[0035] To enable those skilled in the art to better understand the technical solutions of this invention, the technical solutions of the embodiments of this invention will be clearly and completely described below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are only for explaining the invention and are not intended to limit the invention.

[0036] like Figure 1 As shown, this embodiment of the invention provides an IoT terminal anomaly detection method that integrates temporal behavior, including the following steps:

[0037] Step S1: Collect time-series communication behavior data from multiple IoT terminal devices, and construct a time-series communication behavior matrix for each IoT terminal device based on the time-series communication behavior data.

[0038] Specifically, multiple IoT terminal devices can be a group of IoT terminals in scenarios such as smart home systems and industrial production environments. For example, in a smart home system, multiple devices in the home, such as temperature sensors, smart light bulbs, and door locks, need to work collaboratively in the same environment. Different devices upload data or receive control commands based on environmental changes or user needs. By collecting network communication data from multiple IoT terminal devices, time-series communication behavior data for each device is obtained, including network performance indicators such as the number of communication packets, data transmission volume, communication protocol type, connection latency, and communication frequency corresponding to communication behavior at different times. Specifically, this can be obtained by collecting relevant time-series communication behavior data of the devices in historical states, such as the most recent week. For the collected time-series data, a time-series communication behavior matrix is ​​constructed for each IoT terminal device, including the time change sequence of multiple network performance indicators, representing the dynamic change process of multiple network performance indicators of the device in different communication sessions.

[0039] Step S2: Perform window behavior correlation analysis on multiple IoT terminal devices based on the time-series communication behavior matrix to construct multiple communication behavior correlation matrices for multiple IoT terminal devices.

[0040] Specifically, after constructing a time-series communication behavior matrix for multiple devices, the correlation between communication behaviors of devices within different time windows is further analyzed, and multiple communication behavior correlation matrices are constructed to reveal the behavioral correlation characteristics between devices. For example, it is analyzed whether there is a significant correlation between the communication frequency, number of data packets, latency, and other characteristics of two devices within different time windows. By windowing multiple time-series communication behavior matrices, the window behavior matrix of each IoT terminal device under multiple time windows is extracted. Window behavior correlation analysis is performed on any two IoT terminal devices within the same time window to calculate the window behavior correlation parameters between the two IoT terminal devices, thus constructing a communication behavior correlation matrix for multiple IoT terminal devices within each time window.

[0041] In this process, the time-series communication behavior matrices of multiple IoT terminal devices are segmented into windows. Each device's time-series communication behavior matrix represents the temporal changes in its communication behavior characteristics over a period of time. These time-series data are divided into multiple time windows. Each window can be of a fixed length, such as 2 minutes or 5 minutes, and can be flexibly set by those skilled in the art according to the specific communication needs of the device. The data within each time window forms a windowed behavior matrix, recording the communication behavior characteristics of the device within a specific time period. For example, in a smart home scenario, the behavior of devices such as temperature sensors, smart light bulbs, and door locks will differ at different times.

[0042] For multiple IoT terminal devices within each time window, window behavior correlation analysis is performed. Specifically, any two IoT terminal devices within the same time window are compared to analyze whether there is a significant correlation between their communication behaviors. Window behavior correlation parameters between the two devices are calculated, and these parameters can be quantified using methods such as correlation coefficients, mutual information, and Euclidean distance. For example, the mutual information between the time-series communication behavior matrices of two IoT terminal devices within a certain time window is calculated to obtain the window behavior correlation parameters for the two devices within that time window. Finally, based on multiple window behavior correlation parameters, a communication behavior correlation matrix is ​​constructed for each time window, representing the behavioral correlation information between any two devices and revealing the collaborative state of different devices across multiple time windows.

[0043] Step S3: Construct a communication intensity time series curve based on multiple sets of time series communication behavior data, construct multiple communication pressure intervals based on the communication intensity time series curves, and extract the interval association sample set of each communication pressure interval from multiple communication behavior association matrices.

[0044] Specifically, communication strength time-series curves are used to describe the overall communication strength of multiple IoT terminal devices over time. This can be quantified by indicators such as the total amount of data transmitted, the number of communication packets, and bandwidth utilization of multiple devices within a certain time period. For example, the amount of data transmitted per unit time can be used as the communication strength, reflecting the change in communication load within the IoT system. By combining multiple communication strength values ​​in a time series, a communication strength time-series curve corresponding to the IoT system under multiple sets of time-series communication behavior data can be constructed.

[0045] Based on the communication intensity time-series curve, the global communication intensity range corresponding to multiple IoT terminal devices can be extracted. This range represents the maximum and minimum communication load within all time windows. Specifically, the maximum and minimum communication intensity values ​​are extracted from the communication intensity time-series curve and used as the upper and lower boundaries of the range, constituting the global communication intensity range for multiple IoT terminal devices. This range can be divided into multiple different communication pressure intervals using a binning method. Continuous communication intensity values ​​are divided into several categories according to preset interval boundaries. For example, for a global communication intensity range of 10M to 100M, it can be evenly divided with interval lengths of 5M, thus uniformly dividing the global communication intensity range into multiple communication pressure intervals, each interval representing a different communication load state.

[0046] Based on the division of multiple communication pressure intervals, each time window is classified. The mean of the communication intensity values ​​at multiple time steps within each time window is calculated according to the communication intensity time-series curve, yielding the average communication intensity for that time window. This average communication intensity is then matched with multiple communication pressure intervals to determine the communication pressure interval to which different time windows belong. Finally, the communication behavior correlation matrix for each time window is assigned to the corresponding communication pressure interval. The multiple communication behavior correlation matrices contained in each communication pressure interval constitute the interval correlation sample set for that communication pressure interval.

[0047] Step S4: Based on multiple interval-related sample sets, perform communication behavior association clustering in each communication pressure interval to construct multiple behavior clusters for each communication pressure interval.

[0048] Specifically, communication behavior association clustering is performed based on the associated sample set for each communication pressure interval. This process first fuses multiple communication behavior association matrices in the interval association sample set. Specifically, it calculates the mean of multiple window behavior association parameters between any two IoT terminal devices. That is, it first extracts the window behavior association parameters between two IoT devices from each communication behavior association matrix, then calculates the mean of multiple window behavior association parameters to obtain the local association parameters between the two IoT terminal devices. Finally, a comprehensive local association matrix is ​​constructed based on multiple local association parameters, representing the association state between any two IoT terminal devices in the current communication pressure interval. Then, within each communication pressure interval, clustering algorithms such as K-means and DBSCAN are used to divide the communication behavior association states between multiple IoT terminal devices into different behavior clusters. For example, using the local association parameters to represent the distance between two devices, the DBSCAN algorithm is used to cluster multiple IoT terminal devices. Finally, individuals with close distances are clustered into a cluster, and each cluster represents a group of devices exhibiting similar communication behavior patterns within the communication pressure interval.

[0049] Cluster analysis identifies the collaborative behavior patterns of multiple IoT terminal devices under different communication loads. For example, in low-load areas, the communication behavior of devices may be relatively independent, and the clustering results will show several smaller clusters; while in high-load areas, the collaborative work between devices increases, and the device correlation between clusters will strengthen, forming larger clusters. In this way, the group behavior patterns of devices under different loads can be clearly identified.

[0050] Step S5: Perform device migration analysis on the behavioral clusters of multiple communication pressure intervals to construct cluster structure migration paths. Based on the cluster structure migration paths, perform group behavior anomaly detection on multiple IoT terminal devices and generate IoT terminal anomaly detection results.

[0051] Specifically, cluster structure migration paths are used to reflect the behavioral changes of different IoT terminal devices within a group under varying communication pressure, revealing the evolutionary trend of device behavior within the group. Some devices may move from an independent cluster to a collaborative cluster after the load increases. As communication pressure increases, the need for collaboration between devices increases, especially under high load conditions, such as in smart home systems or industrial production systems. Multiple devices need to share real-time data for collaborative decision-making and environmental awareness, and the collaborative relationship between devices becomes closer when communication load increases. Based on these cluster structure migration paths, abnormal group behavior can be detected, promptly identifying inconsistencies or anomalies in device behavior within the group.

[0052] In one optional implementation, device migration analysis is performed on behavioral clusters across multiple communication pressure ranges to construct cluster structure migration paths, including:

[0053] Determine the cluster impact parameters of each IoT terminal device in the behavior cluster, construct multiple device migration combinations based on multiple behavior clusters in two adjacent communication pressure intervals, determine the device coverage group of each device migration combination, and calculate the device coverage parameters.

[0054] Specifically, the cluster influence parameter represents the overall collaborative capability of a device within a cluster. It can be quantified by calculating the average of multiple window behavior correlation parameters between the IoT terminal device and the other devices in the cluster. For any IoT device in a behavior cluster, the window behavior correlation parameters between that device and each device in the cluster are determined, and the average of these window behavior correlation parameters is calculated to obtain the cluster influence parameter for that IoT device. For two adjacent communication pressure intervals, the structure of the behavior cluster may change due to device migration. For example, as communication pressure increases, some new devices may join the current cluster to form a new behavior cluster. By combining multiple behavior clusters from two adjacent communication pressure intervals—that is, combining each behavior cluster from the current communication pressure interval with multiple behavior clusters from the next communication pressure interval—multiple device migration combinations are generated. For each device migration combination, the device coverage group is determined, which consists of IoT terminal devices appearing in both behavioral clusters. The device coverage parameter for the migration combination is calculated, specifically the ratio between the number of IoT terminal devices shared by both behavioral clusters and the total number of IoT terminal devices in the behavioral cluster with higher communication pressure. This parameter describes the proportion of devices affected by the current cluster in the next cluster after the cluster structure change. For example, consider a device migration combination containing cluster A and cluster B (cluster A belongs to the communication pressure range 20M-25M, and cluster B belongs to the communication pressure range 25M-30M). Clusters A and B share three common IoT terminal devices, and cluster B has a total of six IoT communication devices. In this case, the device coverage parameter for this migration combination is 0.5. A larger device coverage parameter indicates a greater impact of the cluster under lower communication pressure on the cluster under higher communication pressure after the cluster structure change.

[0055] Based on the cluster impact parameters and the device coverage group, the device coverage parameters are optimized to generate the target migration index for each device migration combination. Based on the multiple target migration indices, multiple local migration combinations are determined for two communication pressure intervals. The multiple local migration combinations are then spliced ​​together to generate multiple cluster structure migration paths.

[0056] Specifically, the device coverage parameters are optimized based on cluster influence parameters and the device coverage group. This includes calculating the mean of the cluster influence parameters of multiple IoT terminal devices within the device coverage group, and using this mean as a weight to adjust the device coverage parameters and generate a target migration index. The larger the mean of the cluster influence parameters of multiple IoT terminal devices within the device coverage group, the stronger the collaborative relationship between the device coverage group and other IoT terminal devices in the next cluster. The larger the target migration index, the more representative the device migration combination is. Finally, based on multiple target migration indices, several representative device migration combinations between two communication pressure intervals can be selected and recorded as local migration combinations. In this process, each behavioral cluster has multiple transition direction sets and multiple device transition combinations. That is, the cluster in the current communication pressure interval may transition to any cluster in the next communication pressure interval. The device migration combination corresponding to the maximum target migration index among the multiple device migration combinations to which the behavioral cluster belongs is selected as the local migration combination, representing the most likely merging behavior of the behavioral cluster after the communication pressure increases. By concatenating multiple local migration combinations end-to-end, a final cluster structure migration path is generated. The structure migration path contains a behavioral cluster corresponding to different communication pressure intervals, which is used to describe the dynamic changes in the coordination strength between devices as communication pressure changes.

[0057] In one optional implementation, anomaly detection of group behavior of multiple IoT terminal devices is performed based on the cluster structure migration path, generating IoT terminal anomaly detection results including:

[0058] Based on multiple cluster-structured migration paths, the group collaboration data of each IoT terminal device is determined. Multiple IoT terminal devices are then divided into group-collaborating devices and non-group-collaborating devices according to the number of group collaborations. This process analyzes the path coverage status of each IoT terminal device, specifically whether it has its own behavioral cluster in multiple communication pressure intervals and whether these behavioral clusters constitute a complete path. Specifically, the number of communication pressure intervals containing the behavioral cluster to which the IoT terminal device belongs, and the maximum path length that the behavioral cluster to which the IoT terminal device belongs can form, are counted. These two values ​​are normalized, and their product is taken as the group collaboration data of the IoT terminal device. A larger number of communication pressure intervals containing the behavioral cluster to which the IoT terminal device belongs indicates more group collaboration behavior under different communication states. A larger maximum path length that the behavioral cluster to which the IoT terminal device belongs indicates more representativeness of these stages. The larger the final group collaboration data, the more consistent it is with group collaboration, representing that a certain IoT terminal device exhibits similar communication behavior with a specific group of devices under various communication pressure states, and that these groups constitute relatively complete paths. IoT devices are categorized using a pre-defined group collaboration threshold. IoT terminal devices with group collaboration data exceeding the threshold are marked as group collaboration devices; otherwise, they are marked as non-group collaboration devices. The group collaboration threshold can be reasonably set based on the number of communication pressure intervals; this embodiment does not impose a specific limitation on it. Ultimately, multiple IoT terminal devices are classified into two types—group collaboration devices and non-group collaboration devices—based on their group collaboration data.

[0059] After collecting real-time communication behavior data from multiple IoT terminal devices, the real-time status tag of each IoT terminal device is determined based on the real-time communication behavior data, and the status deviation parameters of multiple IoT terminal devices are determined.

[0060] Specifically, real-time communication behavior data represents the behavioral data of multiple IoT devices over a period of time under the current state. In practical applications, for example, real-time communication behavior data is obtained by collecting real-time data within half an hour under the current state. Sliding window processing can be applied to the real-time communication behavior data to cluster it for different time periods, resulting in multiple real-time clusters. This determines whether each IoT terminal device belongs to a specific real-time cluster at different time periods. The percentage of time periods in which IoT terminal devices belong to a specific real-time cluster can be statistically analyzed. Considering that the greater the variation in communication pressure, the more representative the data becomes, the communication pressure intervals for different time periods can be determined to construct a pressure time-series vector. In this process, the same processing method as the aforementioned time window is used to calculate the data transmission volume of real-time communication behavior data within each time window, determine the real-time communication intensity of each time window, and determine the communication pressure interval to which each time window belongs based on the real-time communication intensity. Multiple communication pressure intervals can be sequentially numbered, for example, numbered 1, 2, 3, etc. in the direction of increasing communication intensity. The number corresponding to each time window in the real-time communication behavior data is determined and a pressure time series vector is constructed. The entropy value of the pressure time series vector is calculated and the time period proportion is corrected to obtain the real-time status parameters of the IoT terminal device. The larger the entropy value of the pressure time series vector, the greater the degree of change in communication pressure during this period, rather than maintaining a specific intensity level.

[0061] Finally, the real-time status label of the IoT terminal device is determined based on the real-time status parameters, such as whether it belongs to a group collaboration device or not. The specific classification threshold can be the same as the group collaboration threshold used in the process of classifying IoT terminal devices based on group collaboration data. Then, the percentage of multiple IoT terminal devices whose real-time status is inconsistent with the device type obtained from the previous classification is determined, thus obtaining the status deviation parameter of multiple IoT terminal devices.

[0062] Anomaly detection of group collaboration among multiple IoT terminal devices is performed based on multiple behavioral clusters. This includes determining multiple real-time clusters based on real-time communication behavior data, calculating the group structure anomaly parameters for each real-time cluster, and fusing the group structure anomaly parameters and state deviation parameters to generate IoT terminal anomaly detection results.

[0063] Specifically, for multiple real-time clusters, the communication pressure range to which each real-time cluster belongs is determined. Then, multiple behavioral clusters within each real-time cluster's communication pressure range are matched. After determining the behavioral cluster with the highest matching degree, the structural anomaly parameter of both is calculated. This is the ratio between the number of IoT terminal devices shared by the two clusters and the total number of IoT terminal devices in each cluster. Finally, the ratio of the group structural anomaly parameter to the state deviation parameter is used as the IoT terminal anomaly detection result. A larger group structural anomaly parameter indicates a greater number of IoT terminal devices in the real-time communication behavior data that do not conform to historical behavior. A smaller group structural anomaly parameter indicates a greater difference between the structure of the current real-time cluster and historical behavior. This method analyzes whether there are anomalies in the group behavior patterns of multiple IoT terminal devices, dynamically monitors the behavior changes of IoT terminal devices under different load conditions, and accurately detects potential anomalies in the IoT terminal device group when individual behavior conforms to a pre-set communication state.

[0064] Based on the aforementioned method for detecting anomalies in IoT terminals by incorporating temporal behavior, this invention also provides an IoT terminal anomaly detection system by incorporating temporal behavior, comprising:

[0065] The communication data acquisition module is used to collect time-series communication behavior data from multiple IoT terminal devices and construct a time-series communication behavior matrix for each IoT terminal device based on the time-series communication behavior data.

[0066] The communication correlation analysis module is used to perform window behavior correlation analysis on multiple IoT terminal devices based on the time-series communication behavior matrix, and to construct multiple communication behavior correlation matrices for multiple IoT terminal devices.

[0067] The interval sample construction module is used to construct communication intensity time series curves based on multiple sets of time series communication behavior data, construct multiple communication pressure intervals based on the communication intensity time series curves, and extract the interval association sample set of each communication pressure interval from multiple communication behavior association matrices.

[0068] The communication behavior clustering module is used to perform communication behavior association clustering in each communication pressure interval based on multiple interval association sample sets, and to construct multiple behavior clusters in each communication pressure interval;

[0069] The communication anomaly detection module is used to perform device migration analysis on behavioral clusters in multiple communication pressure ranges to construct cluster structure migration paths, and to perform group behavior anomaly detection on multiple IoT terminal devices based on the cluster structure migration paths, generating IoT terminal anomaly detection results.

[0070] The above are merely specific embodiments of the present invention, enabling those skilled in the art to understand or implement the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art. Parts not described in detail in this specification are prior art known to those skilled in the art.

Claims

1. A method for detecting anomalies in Internet of Things terminals with fusion of timing behavior, characterized in that, The method comprises the following steps: Collecting time sequence communication behavior data of a plurality of Internet of Things terminal devices, and constructing a time sequence communication behavior matrix of each Internet of Things terminal device based on the time sequence communication behavior data; Performing window behavior correlation analysis on the plurality of Internet of Things terminal devices based on the time sequence communication behavior matrix, and constructing a plurality of communication behavior correlation matrices about the plurality of Internet of Things terminal devices; Constructing a communication intensity time sequence curve according to a plurality of sets of time sequence communication behavior data, constructing a plurality of communication pressure intervals based on the communication intensity time sequence curve, and extracting an interval correlation sample set of each communication pressure interval from the plurality of communication behavior correlation matrices; For a plurality of interval correlation sample sets, determining a global communication intensity range according to the communication intensity time sequence curve, performing bin processing on the global communication intensity range to generate a plurality of communication pressure intervals, determining the communication pressure interval to which each time window belongs and performing interval allocation on the plurality of communication behavior correlation matrices, determining a plurality of communication behavior correlation matrices contained in each communication pressure interval, and generating an interval correlation sample set of each communication pressure interval; Fusing a plurality of communication behavior correlation matrices in the interval correlation sample set to generate a local correlation matrix of each communication pressure interval, performing communication behavior correlation clustering on the plurality of Internet of Things terminal devices based on the local correlation matrix in each communication pressure interval, and obtaining a plurality of behavior class clusters of each communication pressure interval; Determining a class cluster influence parameter of each Internet of Things terminal device in the behavior class cluster, constructing a plurality of device migration combinations according to a plurality of behavior class clusters of adjacent two communication pressure intervals, determining a device coverage population of each device migration combination and calculating a device coverage parameter; Optimizing the device coverage parameter based on the class cluster influence parameter and the device coverage population, generating a target migration index of each device migration combination, determining a plurality of local migration combinations of two communication pressure intervals according to a plurality of target migration indices, and splicing a plurality of local migration combinations to generate a plurality of cluster structure migration paths; Determining a group cooperation data of each Internet of Things terminal device based on a plurality of cluster structure migration paths, and dividing a plurality of Internet of Things terminal devices into group cooperation devices and non-group cooperation devices according to the group cooperation data; After collecting real-time communication behavior data of a plurality of Internet of Things terminal devices, determining a real-time state label of each Internet of Things terminal device according to the real-time communication behavior data, and determining a state deviation parameter of the plurality of Internet of Things terminal devices; Performing group cooperation anomaly detection on a plurality of Internet of Things terminal devices based on a plurality of behavior class clusters, including determining a plurality of real-time class clusters based on real-time communication behavior data, calculating a group structure anomaly parameter of each real-time class cluster, and fusing the group structure anomaly parameter and the state deviation parameter to generate an Internet of Things terminal anomaly detection result. 2.The method of claim 1, wherein, For the communication behavior correlation matrix and the communication intensity time sequence curve, the method further comprises the following steps: The plurality of time sequence communication behavior matrices are window cut, and a plurality of window behavior matrices of each Internet of Things terminal device under a plurality of time windows are extracted. Window behavior correlation analysis is performed on any two Internet of Things terminal devices in the same time window, and a window behavior correlation parameter between the two Internet of Things terminal devices is calculated to construct a communication behavior correlation matrix of the plurality of Internet of Things terminal devices in each time window. The communication intensity parameters in each time window are determined according to the plurality of groups of time sequence communication behavior data, and a communication intensity time sequence curve of the plurality of Internet of Things terminal devices is constructed according to the plurality of communication intensity parameters. 3.The method of claim 1, wherein, According to the plurality of communication behavior correlation matrices in the interval correlation sample set, a plurality of window behavior correlation parameters between any two Internet of Things terminal devices are determined and local correlation parameters are calculated, and a local correlation matrix of each communication pressure interval is constructed based on the plurality of local correlation parameters.

4. A system for detecting anomalies in Internet of Things terminals with fusion of timing behavior, characterized by, The system is used to implement the abnormal detection method of the Internet of Things terminal device according to any one of claims 1-3, and comprises: A communication data acquisition module is configured to acquire time sequence communication behavior data of a plurality of Internet of Things terminal devices, and construct a time sequence communication behavior matrix of each Internet of Things terminal device based on the time sequence communication behavior data. A communication correlation analysis module is configured to perform window behavior correlation analysis on the plurality of Internet of Things terminal devices based on the time sequence communication behavior matrix, and construct a plurality of communication behavior correlation matrices of the plurality of Internet of Things terminal devices. An interval sample construction module is configured to construct a communication intensity time sequence curve according to the plurality of groups of time sequence communication behavior data, construct a plurality of communication pressure intervals based on the communication intensity time sequence curve, and extract an interval correlation sample set of each communication pressure interval from the plurality of communication behavior correlation matrices. A communication behavior clustering module is configured to perform communication behavior correlation clustering in each communication pressure interval based on the plurality of interval correlation sample sets, and construct a plurality of behavior class clusters of each communication pressure interval. A communication anomaly detection module is configured to perform device migration analysis on the behavior class clusters of the plurality of communication pressure intervals to construct a class cluster structure migration path, perform group behavior anomaly detection on the plurality of Internet of Things terminal devices based on the class cluster structure migration path, and generate an Internet of Things terminal device anomaly detection result.

Images