Internet of Things terminal anomaly clustering method based on graph neural network

Abstract

The invention discloses an Internet of Things terminal anomaly clustering method based on a graph neural network. The Internet of Things terminal anomaly clustering method comprises the following steps that data are collected and preprocessed to form time series data; constructing an Internet of Things terminal relation graph, and representing time sequence correlation, spatial proximity and protocol layer interaction characteristics by using a multi-scale edge weight factor; weighting by using a feature attention mechanism to generate an abnormal sensitive input vector; performing time modeling by adopting phase-aligned expansion causal time sequence convolution to obtain time channel representation; an edge-time double-attention coupling mechanism is introduced into the improved ST-GNN model, edge attention and time attention are calculated, and an embedded vector is generated; executing density clustering and correcting isolated nodes and small-scale clusters through semi-supervised label propagation to obtain a correction result; and carrying out dynamic evolution analysis, identifying growing, merging and disappearing abnormal clusters, and feeding back to optimize modeling. According to the invention, the precision and robustness of Internet of Things anomaly detection are improved, and the method is suitable for large-scale Internet of Things safety monitoring.

Description

Technical Field

[0001] This invention relates to the fields of Internet of Things (IoT) and artificial intelligence (AI) technology, and in particular to an IoT terminal anomaly clustering method based on graph neural networks. Background Technology

[0002] With the widespread adoption of IoT devices, the number of terminals and the complexity of connections are constantly increasing, highlighting the growing need for monitoring network security risks and operational anomalies. Existing IoT anomaly detection methods primarily rely on rule-based intrusion detection systems or single-point anomaly identification based on statistical features. These methods often identify abnormal behavior through fixed thresholds, traffic statistics, or simple clustering, but they generally suffer from the following problems in practical applications:

[0003] Most existing methods rely on single feature signals, such as communication frequency or log statistics, and cannot simultaneously utilize multi-source time-series data such as communication frequency distribution, power consumption fluctuations, packet entropy values, and abnormal logs. This results in insufficient dimensions for anomaly detection, making it prone to missed detections and false positives. Existing relationship modeling is usually based on static topology or simple adjacency relationships, lacking a multi-scale comprehensive characterization of temporal correlation, spatial proximity, and protocol interaction characteristics, making it difficult to accurately reflect the complex interaction relationships between IoT terminals. Traditional time-series modeling methods often use fixed-window statistics or standard convolution operations, which cannot effectively capture long-term dependencies and phase differences, resulting in low accuracy in anomaly pattern recognition under strong interference environments. In terms of clustering and correction, existing methods often directly use density clustering without targeted processing of isolated nodes and small-scale clusters, which easily leads to scattered anomaly results and insufficient clustering stability. Regarding the evolution process of anomalies, existing technologies mostly remain at the static detection stage, lacking dynamic tracking mechanisms for the growth, merging, and disappearance of anomaly clusters, making it difficult to reflect the evolution characteristics of anomalies in the IoT environment in a timely manner.

[0004] Therefore, how to provide an anomaly clustering method for IoT terminals based on graph neural networks is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0005] One objective of this invention is to propose an anomaly clustering method for IoT terminals based on graph neural networks. This invention comprehensively utilizes multi-source temporal data acquisition, relational graph construction, feature attention mechanism, phase-aligned dilated causal temporal convolution, and edge-temporal dual attention coupling mechanism to perform embedded representation learning on IoT terminals. It corrects isolated nodes and small-scale clusters through density clustering and semi-supervised label propagation, and identifies the growth, merging, and disappearance of anomalous clusters by combining dynamic evolution analysis. It has the advantages of high anomaly detection accuracy, strong stability of clustering results, and good anomaly evolution tracking ability.

[0006] An IoT terminal anomaly clustering method based on graph neural networks according to an embodiment of the present invention includes the following steps: Collect communication frequency distribution, power consumption fluctuation, data packet entropy value and abnormal logs, and preprocess them to form time series data; A relationship graph of IoT terminals is constructed based on time-series data. IoT terminals are used as nodes, and edges are established based on communication behavior, data similarity and spatial topology. Multi-scale edge weight factors are used to characterize time-series correlation, spatial proximity and protocol layer interaction features. The feature attention mechanism is used to weight the time series data to generate an anomaly-sensitive input vector; Phase-aligned dilated causal temporal convolution is used to perform temporal modeling on anomaly-sensitive input vectors to obtain a temporal channel representation; An edge-temporal dual attention coupling mechanism is introduced into the improved ST-GNN model. The edge attention is calculated based on the multi-scale edge weight factor in the IoT terminal relationship graph, and the temporal attention is calculated based on the temporal channel representation to generate the IoT terminal embedding vector. Density clustering is performed based on the embedded vectors of IoT terminals to obtain the initial clustering results. Clusters with isolated nodes and IoT terminals accounting for less than 1% of the total number of nodes are corrected by semi-supervised label propagation to generate corrected clustering results. Dynamic evolutionary analysis is performed on the corrected clustering results to identify anomalous clusters that grow, merge, and disappear, and the detection results are fed back to relation graph construction, feature attention mechanism, and dilated causal temporal convolution modeling.

[0007] Optionally, the collection of communication frequency distribution, power consumption fluctuations, data packet entropy values, and anomaly logs, followed by preprocessing to form time-series data, specifically includes: The number of communications by IoT terminals within a preset time window is statistically analyzed to form a communication frequency distribution vector. The power values ​​of IoT terminals are continuously sampled within the same time window to form a power consumption fluctuation sequence; A probability distribution is established for data packets sent and received by IoT terminals, and a sequence of data packet entropy values ​​is calculated based on information entropy. The system alarm information generated by IoT terminals is timestamped to form an abnormal log sequence; The communication frequency distribution vector, power consumption fluctuation sequence, data packet entropy sequence and abnormal log sequence are preprocessed, including removing missing values, duplicate values ​​and outliers, time alignment according to a uniform sampling period, mapping to a uniform time scale and normalizing by minimum and maximum value scaling. The preprocessed communication frequency distribution, power consumption fluctuations, data packet entropy values, and anomaly logs are combined in chronological order to obtain time-series data.

[0008] Optionally, the step of constructing an IoT terminal relationship graph based on time-series data, using IoT terminals as nodes, establishing edges based on communication behavior, data similarity, and spatial topological relationships, and characterizing temporal correlation, spatial proximity, and protocol layer interaction features with multi-scale edge weight factors, specifically includes: Each IoT terminal is defined as a node, forming a node set; When the number of data packets sent by node A to node B within a preset time window is greater than zero, a communication behavior edge is established between node A and node B. Calculate the Euclidean distance between node A and node B for communication frequency distribution, power consumption fluctuation, data packet entropy and abnormal logs within a preset time window. When all Euclidean distances are less than a preset threshold, establish a data similarity edge between node A and node B. When the straight-line distance between the geographical locations of node A and node B is less than a preset threshold or the number of network topology hops is less than a preset threshold, a spatial topology edge is established between node A and node B. Multi-scale edge weighting factors are calculated for communication behavior edges, data similarity edges, and spatial topology edges. The multi-scale edge weighting factors include temporal correlation weight, which is defined as the Pearson correlation coefficient of the temporal data sequences of node A and node B; spatial proximity weight, which is defined as the reciprocal of the straight-line distance between the geographical locations of node A and node B or the reciprocal of the network topology hop count; and protocol layer interaction weight, which is defined as the ratio of the number of protocol stack layer interactions between node A and node B within a preset time window to the maximum number of interactions. The relationship graph of IoT terminals is generated by combining the node set, communication behavior edges, data similarity edges, spatial topology edges, and corresponding multi-scale edge weight factors.

[0009] Optionally, the step of using a feature attention mechanism to weight the time-series data and generate an anomaly-sensitive input vector specifically includes: The time-series data is divided into four types of inputs: communication frequency distribution, power consumption fluctuation, data packet entropy value, and abnormal logs. The communication frequency distribution, power consumption fluctuation, data packet entropy value and abnormal log are respectively mapped to the corresponding feature vectors; In the feature attention mechanism, learnable attention weights are assigned to communication frequency distribution, power consumption fluctuation, data packet entropy value and abnormal log respectively. The attention weights are obtained by performing a dot product operation on each type of feature vector and a trainable parameter matrix and then normalizing them. Multiplying the communication frequency distribution feature vector with the corresponding attention weight yields the weighted communication frequency distribution representation; multiplying the power consumption fluctuation feature vector with the corresponding attention weight yields the weighted power consumption fluctuation representation; multiplying the data packet entropy feature vector with the corresponding attention weight yields the weighted data packet entropy representation; and multiplying the abnormal log feature vector with the corresponding attention weight yields the weighted abnormal log representation. The weighted communication frequency distribution representation, weighted power consumption fluctuation representation, weighted data packet entropy value representation, and weighted anomaly log representation are concatenated in chronological order to obtain the anomaly-sensitive input vector.

[0010] Optionally, the step of using phase-aligned dilated causal temporal convolution to perform temporal modeling on the anomaly-sensitive input vector to obtain a temporal channel representation specifically includes: Set the sliding window length and step size, and divide the abnormally sensitive input vector into a sliding window sequence in chronological order; Perform causal convolution on each sliding window, with the convolution kernel only applied to samples at the current time step and before. Define a set of dilation rates, construct multiple parallel convolutional branches, each parallel convolutional branch uses the same convolutional kernel length and uses one of the dilation rates in the set, and samples the input sequence at corresponding intervals on the time axis; Normalize the output of each parallel convolutional branch; The parallel convolution branch with the smallest dilation rate is selected as the reference branch. The normalized cross-correlation between each parallel convolution branch and the reference branch is calculated. The hysteresis corresponding to the maximum cross-correlation value is found within the preset hysteresis range, and the phase offset of the parallel convolution branch relative to the reference branch is obtained. The output of each parallel convolutional branch is aligned in time according to the phase offset. Integer phase offsets are performed using discrete-time shifting, while non-integer phase offsets are performed using fractional delay filtering or interpolation shifting. The outputs of the parallel convolutional branches that have completed phase alignment are concatenated along the channel dimension in order of increasing dilation rate to obtain the temporal channel representation. Perform fully connected mapping or one-dimensional convolution to reduce the dimensionality of the temporal channel representation, and output a fixed-dimensional temporal channel representation.

[0011] Optionally, the introduction of a side-time dual attention coupling mechanism in the improved ST-GNN model specifically includes: The edge-temporal dual attention coupling unit includes a spatial attention calculation module, a temporal attention calculation module, and a bidirectional modulation fusion module; The spatial attention calculation module receives the IoT terminal relationship graph, performs a dot product operation on each edge in the IoT terminal relationship graph based on the multi-scale edge weight factor and the node feature vectors at both ends of the edge, and obtains the edge attention through softmax normalization. The time attention calculation module receives the time channel representation, performs a dot product operation on the time feature vector of each IoT terminal at different time steps and the trainable parameter matrix, and obtains the time attention through softmax normalization. The bidirectional modulation fusion module applies side attention as a modulation factor to temporal attention, performing weighted correction on temporal attention, and simultaneously applies temporal attention as a modulation factor to side attention, performing weighted correction on side attention. The bidirectional modulation fusion module combines the corrected edge attention and temporal attention to apply to the neighbor node features and temporal features, performs a weighted aggregation operation, and outputs an IoT terminal embedding vector that includes spatial and temporal dependencies.

[0012] Optionally, the initial clustering result is obtained by performing density clustering based on the IoT terminal embedding vector, and the clusters with isolated nodes and IoT terminals accounting for less than 1% of the total number of nodes are corrected through semi-supervised label propagation to generate corrected clustering results, specifically including: In the embedding space, the similarity within the neighborhood of each IoT terminal is calculated. The similarity is measured by the Euclidean distance between the embedding vectors of the IoT terminals. When the Euclidean distance is less than the preset neighborhood radius threshold, they are determined to be neighbors. When the number of neighbors of a certain IoT terminal is greater than or equal to the preset minimum number of neighbors threshold, it is marked as a core point, and IoT terminals connected to the neighborhood of the core point are aggregated into the same cluster. Multiple core points and their neighborhoods are recursively expanded to form the initial clustering result. Identify isolated nodes in the initial clustering results; an isolated node is defined as an IoT terminal that fails to be assigned to any cluster. Small clusters were identified in the initial clustering results. Small clusters were defined as clusters containing fewer than one percent of the total number of IoT terminals. Identify large-scale clusters in the initial clustering results. A large-scale cluster is defined as a cluster containing more than or equal to one percent of the total number of IoT terminals. An adjacency matrix is ​​established by treating isolated nodes and IoT terminals in small clusters as objects of undetermined categories. The matrix elements are represented by the edge weights in the IoT terminal relationship graph. Using IoT terminals in a large-scale cluster as known category samples, the propagation probability between undetermined objects and known category samples is calculated based on the adjacency matrix, and the category label of undetermined objects is updated through iterative propagation. When the category label of an undetermined object converges to a large cluster, the object is merged into the corresponding cluster, thereby generating a corrected clustering result.

[0013] Optionally, the step of performing dynamic evolutionary analysis on the corrected clustering results to identify anomalous clusters that grow, merge, and disappear, and feeding the detection results back to relation graph construction, feature attention mechanism, and dilated causal temporal convolution modeling, specifically includes: Within each time window, a cluster label set, a cluster member set, and a cluster center vector set are generated, where the cluster center vector is defined as the average vector of all IoT terminal embedding vectors within the cluster. The correlation degree of clusters is calculated between adjacent time windows. The correlation degree takes into account the similarity of cluster member sets and the similarity of cluster center vectors. When the correlation degree is greater than or equal to a preset threshold, it is determined that there is a corresponding relationship between the two clusters. A cluster hierarchy diagram is constructed based on the correspondence between clusters, in which the cluster at the previous time point in the hierarchy diagram points to the corresponding cluster at the next time point; To determine a growth event, if there is an edge in the phylogenetic graph pointing from the previous cluster to the next cluster, and the increase in the number of members of the next cluster exceeds a preset threshold, the current cluster is marked as a growth event. To determine a merging event, if two or more clusters in the previous time step establish a correspondence with the same cluster in the next time step, and the member set of the cluster in the next time step has a high similarity to the union of all related clusters in the previous time step, then the current cluster is marked as a merging event. To determine a disappearance event, if a cluster fails to establish a correspondence with any cluster within a consecutive number of time windows, the current cluster is marked as a disappearance event. The cluster's anomaly strength is calculated by weighting and summing the deviations of communication frequency distribution, power consumption fluctuation, packet entropy value, and anomaly log according to the weights determined by the feature attention mechanism. The baseline strength is then generated by historical moving average. When the ratio of the current anomaly strength of the cluster to the baseline strength exceeds a preset threshold and the increase in the number of cluster members in the current window exceeds a preset threshold, the current cluster is marked as a sudden anomaly cluster. Output a dynamic evolution event set, which includes the identifier of each cluster, the set of members, the time window to which it belongs, and the event type. Feedback the event set to update the multi-scale edge weight factor of the IoT terminal relationship graph and the weight initialization of the feature attention mechanism.

[0014] The beneficial effects of this invention are: This invention addresses the problem of missed detections caused by relying on single features in existing methods by introducing multi-source temporal data acquisition and unified preprocessing. It overcomes the shortcomings of traditional static modeling in accurately reflecting the complexity of terminal interactions by constructing an IoT terminal relationship graph that integrates communication behavior, data similarity, and spatial topology, and characterizing temporal correlation, spatial proximity, and protocol layer interaction features with multi-scale edge weight factors. It improves the accuracy and robustness of anomaly pattern recognition by achieving accurate modeling of weighted and long-term dependencies of anomaly-sensitive features through feature attention mechanisms and phase-aligned extended causal temporal convolutions. The invention introduces an edge-temporal dual attention coupling mechanism in the improved ST-GNN model, enabling bidirectional modulation and fusion of spatial and temporal dependencies, effectively enhancing the discriminative power of the embedded representation. In the clustering stage, a semi-supervised label propagation method is used to correct isolated nodes and small clusters, avoiding the problems of scattered anomaly results and misjudgment of small clusters. In the analysis stage, a dynamic evolution mechanism is used to identify the growth, merging, and disappearance of anomaly clusters, compensating for the deficiency of existing technologies in continuously tracking the anomaly evolution process. In summary, this invention has the advantages of high anomaly detection accuracy, good clustering stability, and strong dynamic tracking capability, and can be widely applied to security monitoring and anomaly diagnosis scenarios of large-scale IoT terminals. Attached Figure Description

[0015] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:

[0016] Figure 1 This is a flowchart of an IoT terminal anomaly clustering method based on graph neural networks proposed in this invention; Figure 2 This is a schematic diagram of an IoT terminal anomaly clustering method based on graph neural networks proposed in this invention; Figure 3 This is a framework diagram of the improved ST-GNN model in the IoT terminal anomaly clustering method based on graph neural networks proposed in this invention. Detailed Implementation

[0017] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0018] refer to Figure 1-3 An IoT terminal anomaly clustering method based on graph neural networks includes the following steps: Collect communication frequency distribution, power consumption fluctuation, data packet entropy value and abnormal logs, and preprocess them to form time series data; A relationship graph of IoT terminals is constructed based on time-series data. IoT terminals are used as nodes, and edges are established based on communication behavior, data similarity and spatial topology. Multi-scale edge weight factors are used to characterize time-series correlation, spatial proximity and protocol layer interaction features. The feature attention mechanism is used to weight the time series data to generate an anomaly-sensitive input vector; Phase-aligned dilated causal temporal convolution is used to perform temporal modeling on anomaly-sensitive input vectors to obtain a temporal channel representation; An edge-temporal dual attention coupling mechanism is introduced into the improved ST-GNN model. The edge attention is calculated based on the multi-scale edge weight factor in the IoT terminal relationship graph, and the temporal attention is calculated based on the temporal channel representation to generate the IoT terminal embedding vector. Density clustering is performed based on the embedded vectors of IoT terminals to obtain the initial clustering results. Clusters with isolated nodes and IoT terminals accounting for less than 1% of the total number of nodes are corrected by semi-supervised label propagation to generate corrected clustering results. Dynamic evolutionary analysis is performed on the corrected clustering results to identify anomalous clusters that grow, merge, and disappear, and the detection results are fed back to relation graph construction, feature attention mechanism, and dilated causal temporal convolution modeling.

[0019] In this embodiment, the collection and preprocessing of communication frequency distribution, power consumption fluctuation, data packet entropy value, and abnormal logs to form time-series data specifically includes: The number of communications by IoT terminals within a preset time window is statistically analyzed to form a communication frequency distribution vector. The power values ​​of IoT terminals are continuously sampled within the same time window to form a power consumption fluctuation sequence; A probability distribution is established for data packets sent and received by IoT terminals, and a sequence of data packet entropy values ​​is calculated based on information entropy. The system alarm information generated by IoT terminals is timestamped to form an abnormal log sequence; The communication frequency distribution vector, power consumption fluctuation sequence, data packet entropy sequence and abnormal log sequence are preprocessed, including removing missing values, duplicate values ​​and outliers, time alignment according to a uniform sampling period, mapping to a uniform time scale and normalizing by minimum and maximum value scaling. The preprocessed communication frequency distribution, power consumption fluctuations, data packet entropy values, and anomaly logs are combined in chronological order to obtain time-series data.

[0020] This implementation preprocesses and aligns communication frequency distribution, power consumption fluctuations, data packet entropy values, and anomaly logs with time to obtain unified time-series data. This ensures accurate fusion of multi-source features on the same time scale, effectively reduces interference from missing data and outliers, and significantly improves the stability and accuracy of subsequent anomaly modeling.

[0021] In this embodiment, the construction of an IoT terminal relationship graph based on time-series data uses IoT terminals as nodes, establishes edges based on communication behavior, data similarity, and spatial topological relationships, and uses multi-scale edge weight factors to characterize time-series correlation, spatial proximity, and protocol layer interaction characteristics. Specifically, this includes: Each IoT terminal is defined as a node, forming a node set; When the number of data packets sent by node A to node B within a preset time window is greater than zero, a communication behavior edge is established between node A and node B. Calculate the Euclidean distance between node A and node B for communication frequency distribution, power consumption fluctuation, data packet entropy and abnormal logs within a preset time window. When all Euclidean distances are less than a preset threshold, establish a data similarity edge between node A and node B. When the straight-line distance between the geographical locations of node A and node B is less than a preset threshold or the number of network topology hops is less than a preset threshold, a spatial topology edge is established between node A and node B. Multi-scale edge weighting factors are calculated for communication behavior edges, data similarity edges, and spatial topology edges. The multi-scale edge weighting factors include temporal correlation weight, which is defined as the Pearson correlation coefficient of the temporal data sequences of node A and node B; spatial proximity weight, which is defined as the reciprocal of the straight-line distance between the geographical locations of node A and node B or the reciprocal of the network topology hop count; and protocol layer interaction weight, which is defined as the ratio of the number of protocol stack layer interactions between node A and node B within a preset time window to the maximum number of interactions. The relationship graph of IoT terminals is generated by combining the node set, communication behavior edges, data similarity edges, spatial topology edges, and corresponding multi-scale edge weight factors.

[0022] This implementation constructs an IoT terminal relationship graph that includes communication behavior, data similarity, and spatial topological relationships, and introduces multi-scale edge weight factors. This fully expresses the interaction patterns and spatial dependencies between terminals, avoids the one-sidedness of single relationship modeling, and improves the ability to characterize group anomalies in complex network environments.

[0023] In this embodiment, the step of using a feature attention mechanism to weight time-series data and generate an anomaly-sensitive input vector specifically includes: The time-series data is divided into four types of inputs: communication frequency distribution, power consumption fluctuation, data packet entropy value, and abnormal logs. The communication frequency distribution, power consumption fluctuation, data packet entropy value and abnormal log are respectively mapped to the corresponding feature vectors; In the feature attention mechanism, learnable attention weights are assigned to communication frequency distribution, power consumption fluctuation, data packet entropy value and abnormal log respectively. The attention weights are obtained by performing a dot product operation on each type of feature vector and a trainable parameter matrix and then normalizing them. Multiplying the communication frequency distribution feature vector with the corresponding attention weight yields the weighted communication frequency distribution representation; multiplying the power consumption fluctuation feature vector with the corresponding attention weight yields the weighted power consumption fluctuation representation; multiplying the data packet entropy feature vector with the corresponding attention weight yields the weighted data packet entropy representation; and multiplying the abnormal log feature vector with the corresponding attention weight yields the weighted abnormal log representation. The weighted communication frequency distribution representation, weighted power consumption fluctuation representation, weighted data packet entropy value representation, and weighted anomaly log representation are concatenated in chronological order to obtain the anomaly-sensitive input vector.

[0024] This implementation uses a feature attention mechanism to weight communication frequency distribution, power consumption fluctuations, data packet entropy, and anomaly logs, automatically highlighting feature types that are sensitive to anomalies. This avoids biases in weight allocation based on human experience and achieves adaptive fusion of multi-source features, thereby improving the ability of anomaly input vectors to identify diverse anomaly patterns.

[0025] In this embodiment, the step of using phase-aligned dilated causal temporal convolution to perform temporal modeling on the anomaly-sensitive input vector to obtain a temporal channel representation specifically includes: Set the sliding window length and step size, and divide the abnormally sensitive input vector into a sliding window sequence in chronological order; Perform causal convolution on each sliding window, with the convolution kernel only applied to samples at the current time step and before. Define a set of dilation rates, construct multiple parallel convolutional branches, each parallel convolutional branch uses the same convolutional kernel length and uses one of the dilation rates in the set, and samples the input sequence at corresponding intervals on the time axis; Normalize the output of each parallel convolutional branch; The parallel convolution branch with the smallest dilation rate is selected as the reference branch. The normalized cross-correlation between each parallel convolution branch and the reference branch is calculated. The hysteresis corresponding to the maximum cross-correlation value is found within the preset hysteresis range, and the phase offset of the parallel convolution branch relative to the reference branch is obtained. The output of each parallel convolutional branch is aligned in time according to the phase offset. Integer phase offsets are performed using discrete-time shifting, while non-integer phase offsets are performed using fractional delay filtering or interpolation shifting. The outputs of the parallel convolutional branches that have completed phase alignment are concatenated along the channel dimension in order of increasing dilation rate to obtain the temporal channel representation. Perform fully connected mapping or one-dimensional convolution to reduce the dimensionality of the temporal channel representation, and output a fixed-dimensional temporal channel representation.

[0026] This implementation uses phase-aligned extended causal temporal convolution to perform multi-scale temporal modeling of the input vector, which can effectively capture sudden anomalies and long-term trends. At the same time, it solves the problem of phase misalignment in conventional convolution, making the temporal channel representation more accurate and consistent, thereby enhancing the detection effect of complex temporal anomalies.

[0027] In this embodiment, the introduction of a side-time dual attention coupling mechanism in the improved ST-GNN model specifically includes: The edge-temporal dual attention coupling unit includes a spatial attention calculation module, a temporal attention calculation module, and a bidirectional modulation fusion module; The spatial attention calculation module receives the IoT terminal relationship graph, performs a dot product operation on each edge in the IoT terminal relationship graph based on the multi-scale edge weight factor and the node feature vectors at both ends of the edge, and obtains the edge attention through softmax normalization. The time attention calculation module receives the time channel representation, performs a dot product operation on the time feature vector of each IoT terminal at different time steps and the trainable parameter matrix, and obtains the time attention through softmax normalization. The bidirectional modulation fusion module applies side attention as a modulation factor to temporal attention, weighting and correcting the temporal attention to constrain the modeling of spatial structure on temporal dependence. At the same time, it applies temporal attention as a modulation factor to side attention, weighting and correcting the side attention to enable temporal dynamic features to influence the distribution of spatial interaction intensity. The bidirectional modulation fusion module combines the corrected edge attention and temporal attention to apply to the neighbor node features and temporal features, performs a weighted aggregation operation, and outputs an IoT terminal embedding vector that includes spatial and temporal dependencies.

[0028] This implementation introduces an edge-temporal dual attention coupling mechanism into the improved ST-GNN model, enabling edge attention and temporal attention to modulate each other and work together on the terminal embedding representation to achieve bidirectional enhancement of spatiotemporal dependence, avoid information loss, and improve the sensitivity of the embedding vector to spatial interaction and temporal evolution.

[0029] In this embodiment, the initial clustering result is obtained by performing density clustering based on the embedded vectors of IoT terminals, and the clusters with isolated nodes and IoT terminals accounting for less than 1% of the total number of nodes are corrected through semi-supervised label propagation to generate corrected clustering results. Specifically, this includes: In the embedding space, the similarity within the neighborhood of each IoT terminal is calculated. The similarity is measured by the Euclidean distance between the embedding vectors of the IoT terminals. When the Euclidean distance is less than the preset neighborhood radius threshold, they are determined to be neighbors. When the number of neighbors of a certain IoT terminal is greater than or equal to the preset minimum number of neighbors threshold, it is marked as a core point, and IoT terminals connected to the neighborhood of the core point are aggregated into the same cluster. Multiple core points and their neighborhoods are recursively expanded to form the initial clustering result. Identify isolated nodes in the initial clustering results; an isolated node is defined as an IoT terminal that fails to be assigned to any cluster. Small clusters were identified in the initial clustering results. Small clusters were defined as clusters containing fewer than one percent of the total number of IoT terminals. Identify large-scale clusters in the initial clustering results. A large-scale cluster is defined as a cluster containing more than or equal to one percent of the total number of IoT terminals. An adjacency matrix is ​​established by treating isolated nodes and IoT terminals in small clusters as objects of undetermined categories. The matrix elements are represented by the edge weights in the IoT terminal relationship graph. Using IoT terminals in a large-scale cluster as known category samples, the propagation probability between undetermined objects and known category samples is calculated based on the adjacency matrix, and the category label of undetermined objects is updated through iterative propagation. When the category label of an undetermined object converges to a large cluster, the object is merged into the corresponding cluster, thereby generating a corrected clustering result.

[0030] This implementation combines density clustering with semi-supervised label propagation, which can automatically correct isolated nodes and small clusters, avoid clustering results being distorted by noise points, ensure the stability of large-scale clusters, and thus obtain more reasonable corrected clustering results, significantly improving the reliability of abnormal clustering in large-scale IoT environments.

[0031] In this embodiment, the step of performing dynamic evolutionary analysis on the corrected clustering results to identify anomalous clusters that grow, merge, or disappear, and feeding the detection results back to relation graph construction, feature attention mechanism, and dilated causal temporal convolution modeling, specifically includes: Within each time window, a cluster label set, a cluster member set, and a cluster center vector set are generated, where the cluster center vector is defined as the average vector of all IoT terminal embedding vectors within the cluster. The correlation degree of clusters is calculated between adjacent time windows. The correlation degree takes into account the similarity of cluster member sets and the similarity of cluster center vectors. When the correlation degree is greater than or equal to a preset threshold, it is determined that there is a corresponding relationship between the two clusters. A cluster hierarchy diagram is constructed based on the correspondence between clusters, in which the cluster at the previous time point in the hierarchy diagram points to the corresponding cluster at the next time point; To determine a growth event, if there is an edge in the phylogenetic graph pointing from the previous cluster to the next cluster, and the increase in the number of members of the next cluster exceeds a preset threshold, the current cluster is marked as a growth event. To determine a merging event, if two or more clusters in the previous time step establish a correspondence with the same cluster in the next time step, and the member set of the cluster in the next time step has a high similarity to the union of all related clusters in the previous time step, then the current cluster is marked as a merging event. To determine a disappearance event, if a cluster fails to establish a correspondence with any cluster within a consecutive number of time windows, the current cluster is marked as a disappearance event. The cluster's anomaly strength is calculated by weighting and summing the deviations of communication frequency distribution, power consumption fluctuation, packet entropy value, and anomaly log according to the weights determined by the feature attention mechanism. The baseline strength is then generated by historical moving average. When the ratio of the current anomaly strength of the cluster to the baseline strength exceeds a preset threshold and the increase in the number of cluster members in the current window exceeds a preset threshold, the current cluster is marked as a sudden anomaly cluster. Output a dynamic evolution event set, which includes the identifier of each cluster, the set of members, the time window to which it belongs, and the event type. Feedback the event set to update the multi-scale edge weight factor of the IoT terminal relationship graph and the weight initialization of the feature attention mechanism.

[0032] This implementation method identifies the growth, merging, and disappearance events of abnormal clusters through dynamic evolutionary analysis, and provides early warning of sudden anomalies by comparing the anomaly intensity with the baseline. This enables continuous tracking and trend prediction of group anomalies, providing maintenance personnel with a basis for early intervention and significantly enhancing the foresight and practicality of the anomaly detection system.

[0033] Example 1: To verify the feasibility of this invention in practice, it was applied to an IoT monitoring system in a smart industrial park. The park deployed over three thousand IoT terminals, including smart meters, environmental sensors, industrial controllers, production line energy consumption monitoring modules, and security cameras. The park employed multiple access methods, including Wi-Fi-based local area network communication, low-power wide area network access based on LoRa and NB-IoT, and some core devices directly connected via Ethernet. Due to the large scale of the equipment and the significant differences in communication modes, traditional anomaly detection methods often failed to accurately identify collective abnormal behavior, especially with the rapid increase in the number of terminals; a single indicator often could not fully reflect potential risks. Therefore, the method of this invention was applied and verified in this scenario.

[0034] In actual operation, the data generated by IoT terminals includes communication frequency distribution, power consumption fluctuations, data packet entropy values, and anomaly logs. For example, some sensors report data once per minute under normal circumstances, but if a firmware bug or network anomaly occurs, the reporting frequency will shift; the power consumption fluctuations of some industrial controllers will be significantly amplified when mechanical jamming or motor overload occurs; data packet entropy values ​​can reflect the randomness of communication data, and when spoofed or duplicate packet attacks occur, the entropy value will usually decrease or show abnormal fluctuations; anomaly logs are alarm records generated by the diagnostic mechanism built into the terminal system and are an important reference for identifying anomalies.

[0035] In the experimental phase, all raw data were uniformly sampled to a one-minute granularity. Missing values ​​were imputed using forward padding, and extreme outliers were removed using the 3σ principle. Normalization was then used to compress different features to the range [0,1]. Subsequently, an IoT terminal relationship graph was constructed, with each terminal corresponding to a node. Edges were established based on communication behavior, data similarity, and spatial topological relationships. The final result was a heterogeneous graph structure containing 3248 nodes and nearly 20,000 edges. This graph not only depicts the interaction behavior between devices but also incorporates temporal correlation and spatial proximity, providing a reliable foundation for subsequent graph neural network modeling.

[0036] To more intuitively illustrate the experimental process, characteristic data from five typical terminals were selected as representatives. These terminals included typical normal devices, devices in a slightly abnormal state, devices with blurred edges, and high-risk devices. The statistical results after preprocessing and normalization are shown in Table 1.

[0037] Table 1. Representative IoT Terminal Multi-Source Feature Data

[0038] As can be seen from Table 1, T001 exhibits low communication frequency distribution and power consumption fluctuations, with packet entropy values ​​approaching a random normal distribution and anomaly log frequency almost zero, indicating that this device is a typical low-activity normal terminal. In contrast, T005 shows significantly increased communication frequency and power consumption fluctuations, with both entropy values ​​and log frequency being high, indicating that this device experiences significant abnormal fluctuations at certain times, classifying it as a mildly abnormal device. T007 and T013 are in a "fuzzy" state; their characteristic levels are higher than normal devices but not yet at the level of high-risk devices, making them easily misjudged using traditional methods. In comparison, T010 has high values ​​across all indicators, especially anomaly log frequency as high as 0.66, clearly indicating a serious potential risk to this device, likely due to malicious attacks or hardware malfunctions.

[0039] During model training, this invention automatically assigns importance weights to each feature through a feature attention mechanism. Results show that the weights for power consumption fluctuations and abnormal log frequency are significantly higher than those for communication frequency distribution, consistent with real-world experience. In this way, the model can focus on metrics that better represent abnormal patterns, rather than treating all features equally. Next, phase-aligned dilated causal temporal convolutions are used to model multi-scale temporal features, avoiding the bias issues of traditional convolutions in temporal series alignment. Finally, under the edge-temporal dual attention coupling mechanism, spatial and temporal dependencies are modeled simultaneously, thereby generating robust terminal embedding vectors.

[0040] During the clustering analysis phase, the density clustering algorithm first divides the five samples into three categories. T001 is classified as a normal cluster, T005, T007, and T013 are clustered together as a slightly anomalous cluster, while T010 forms a high-risk cluster on its own. Since T007 and T013 are marginal states, they initially appear as small clusters in the density clustering, but through semi-supervised label propagation, they are eventually merged into the slightly anomalous cluster, making the clustering results more reasonable.

[0041] Dynamic evolutionary analysis further revealed the changing trends of anomalous behavior. Over a four-week time window, the number of members in the mildly anomalous cluster, including T005, gradually increased from the initial three devices to nine, with the anomalous intensity continuously rising, ultimately being marked as a growth event. T013, however, returned to normal after two weeks, its eigenvalues ​​decreasing and becoming highly similar to the normal cluster, thus being marked as a disappearance event. The high-risk cluster, including T010, merged with two newly added devices in the third week, triggering a merger event. These results demonstrate that this invention can not only detect anomalies but also continuously track their evolution.

[0042] Comparative experiments show that, compared with traditional K-means clustering, the anomaly detection accuracy of this invention is improved by 13.2%, and the false alarm rate is reduced by 10.1%. Compared with a single LSTM model, the F1 score of this invention in identifying sudden anomalies is improved by more than 15%. Especially in the ability to identify group anomalies, this invention, through relationship graph modeling and dual attention coupling mechanism, significantly outperforms other methods. This invention can comprehensively capture abnormal behavior of equipment in complex and multi-source industrial IoT environments and accurately distinguish between normal, mildly abnormal, and high-risk equipment. Simultaneously, through dynamic evolutionary analysis, it can identify the growth trend and potential risks of group anomalies in advance, effectively assisting maintenance personnel in early warning and intervention.

[0043] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A graph neural network-based Internet of Things terminal anomaly clustering method, characterized in that, The method comprises the following steps: Collecting communication frequency distribution, power consumption fluctuation, data packet entropy value and abnormal log, and preprocessing to form time series data; Based on the time series data, a relationship graph of Internet of Things terminals is constructed, the Internet of Things terminals are taken as nodes, edges are established according to communication behavior, data similarity and spatial topological relationship, and a multi-scale edge weight factor is used to represent time series correlation, spatial proximity and protocol layer interaction characteristics; The feature attention mechanism is used to weight the time series data to generate an abnormal sensitive input vector; The phase alignment extended causal time series convolution is used for time modeling of the abnormal sensitive input vector to obtain a time channel representation; In the improved ST-GNN model, an edge-time dual attention coupling mechanism is introduced, the edge attention is calculated according to the multi-scale edge weight factor in the relationship graph of Internet of Things terminals, the time attention is calculated according to the time channel representation, and an Internet of Things terminal embedding vector is generated; Based on the Internet of Things terminal embedding vector, an initial clustering result is obtained by density clustering, and the isolated nodes and the clusters with the number of Internet of Things terminals less than 1% of the total number of nodes are corrected by semi-supervised label propagation to generate a revised clustering result; Dynamic evolution analysis is performed on the revised clustering result to identify growing, merging and disappearing abnormal clusters, and the detection result is fed back to the relationship graph construction, feature attention mechanism and extended causal time series convolution modeling.

2. The method of claim 1, wherein, The collecting of communication frequency distribution, power consumption fluctuation, data packet entropy value and abnormal log, and the preprocessing to form time series data specifically comprises: The number of communications of the Internet of Things terminal within a preset time window is counted to form a communication frequency distribution vector; The power values of the Internet of Things terminal within the same time window are continuously sampled to form a power consumption fluctuation sequence; The probability distribution of the data packets sent and received by the Internet of Things terminal is established, and the data packet entropy value sequence is calculated based on information entropy; The system alarm information generated by the Internet of Things terminal is timestamped to form an abnormal log sequence; The communication frequency distribution vector, power consumption fluctuation sequence, data packet entropy value sequence and abnormal log sequence are preprocessed, including deleting missing values, duplicate values and outliers, time aligning according to a unified sampling period, mapping to a unified time scale and normalizing by minimum and maximum scaling; The preprocessed communication frequency distribution, power consumption fluctuation, data packet entropy value and abnormal log are combined in chronological order to obtain time series data.

3. The method of claim 1, wherein, The relationship graph of Internet of Things terminals is constructed based on the time series data, the Internet of Things terminals are taken as nodes, edges are established according to communication behavior, data similarity and spatial topological relationship, and a multi-scale edge weight factor is used to represent time series correlation, spatial proximity and protocol layer interaction characteristics, specifically comprising: Each Internet of Things terminal is defined as a node to form a node set; When the number of data packets sent by node A to node B within a preset time window is greater than zero, a communication behavior edge is established between node A and node B; The Euclidean distances of the communication frequency distribution, power consumption fluctuation, data packet entropy value and abnormal log of node A and node B within a preset time window are calculated, and when all the Euclidean distances are less than a preset threshold, a data similarity edge is established between node A and node B; When a straight-line distance between a geographical position of node A and a geographical position of node B is less than a preset threshold or a network topology hop number between node A and node B is less than a preset threshold, a spatial topology edge is established between node A and node B; A multi-scale edge weight factor is calculated for the communication behavior edge, the data similarity edge and the spatial topology edge, the multi-scale edge weight factor including a time sequence correlation weight defined as a Pearson correlation coefficient of time sequence data of node A and node B, a spatial proximity weight defined as an inverse of the straight-line distance between the geographical positions of node A and node B or an inverse of the network topology hop number, and a protocol layer interaction weight defined as a ratio of a number of protocol stack layer interactions between node A and node B within a preset time window to a maximum interaction number; The node set, the communication behavior edge, the data similarity edge, the spatial topology edge and the corresponding multi-scale edge weight factor are combined to generate the Internet of Things terminal relationship graph.

4. The method of claim 1, wherein, The feature attention mechanism is used to weight the time sequence data to generate an anomaly-sensitive input vector, and specifically includes the following steps: The time sequence data is divided into four types of inputs, including communication frequency distribution, power consumption fluctuation, data packet entropy and anomaly log; The communication frequency distribution, the power consumption fluctuation, the data packet entropy and the anomaly log are respectively mapped into corresponding feature vectors; In the feature attention mechanism, the communication frequency distribution, the power consumption fluctuation, the data packet entropy and the anomaly log are respectively assigned with learnable attention weights, which are obtained by performing dot product operation on each type of feature vector and a trainable parameter matrix and then normalizing the result; The communication frequency distribution feature vector is multiplied by the corresponding attention weight to obtain a weighted communication frequency distribution representation, the power consumption fluctuation feature vector is multiplied by the corresponding attention weight to obtain a weighted power consumption fluctuation representation, the data packet entropy feature vector is multiplied by the corresponding attention weight to obtain a weighted data packet entropy representation, and the anomaly log feature vector is multiplied by the corresponding attention weight to obtain a weighted anomaly log representation; The weighted communication frequency distribution representation, the weighted power consumption fluctuation representation, the weighted data packet entropy representation and the weighted anomaly log representation are spliced in time sequence to obtain the anomaly-sensitive input vector.

5. The method of claim 1, wherein, The phase-aligned dilated causal time sequence convolution is used to perform time modeling on the anomaly-sensitive input vector to obtain a time channel representation, and specifically includes the following steps: A sliding window length and a step size are set, and the anomaly-sensitive input vector is divided into a sliding window sequence in time sequence; A causal convolution is performed on each sliding window, and the convolution kernel only acts on the samples at the current time and before; A set of inflation rates is set, and a plurality of parallel convolution branches are constructed, each parallel convolution branch using the same convolution kernel length and using one inflation rate in the set to sample the input sequence at a corresponding interval on the time axis; Normalization processing is performed on the output of each parallel convolution branch; The parallel convolution branch with the smallest inflation rate is selected as a reference branch, and a normalized cross-correlation is calculated between each parallel convolution branch other than the reference branch and the reference branch, and a lag value corresponding to a maximum cross-correlation value is found within a preset lag range to obtain a phase offset of the parallel convolution branch relative to the reference branch; The outputs of each parallel convolution branch are time-aligned according to the phase offset, the integer phase offset uses a discrete time shift, and the non-integer phase offset uses a fractional delay filter or an interpolation shift; The parallel convolution branch outputs after phase alignment are spliced in the channel dimension in order of increasing expansion rate to obtain a time channel representation; The time channel representation is subjected to full connection mapping or one-dimensional convolution dimension reduction to output a fixed-dimensional time channel representation.

6. The method of claim 1, wherein, The edge-time dual attention coupling mechanism is introduced into the improved ST-GNN model, and specifically includes: The edge-time dual attention coupling unit includes a spatial attention calculation module, a time attention calculation module, and a bidirectional modulation fusion module; The spatial attention calculation module receives the Internet of Things terminal relationship graph, performs a dot product operation on each edge in the Internet of Things terminal relationship graph based on a multi-scale edge weight factor and node feature vectors at both ends of the edge, and obtains edge attention through softmax normalization; The time attention calculation module receives the time channel representation, performs a dot product operation on the time feature vectors of each Internet of Things terminal at different time steps and a trainable parameter matrix, and obtains time attention through softmax normalization; The bidirectional modulation fusion module uses the edge attention as a modulation factor to weight and correct the time attention, and uses the time attention as a modulation factor to weight and correct the edge attention; The bidirectional modulation fusion module applies the corrected edge attention and time attention to the neighbor node features and time features to perform weighted aggregation operations and outputs Internet of Things terminal embedding vectors containing spatial and temporal dependencies.

7. The method of claim 1, wherein, Density clustering based on the Internet of Things terminal embedding vectors obtains an initial clustering result, and semi-supervised label propagation is used to correct isolated nodes and clusters with fewer than 1% of the total number of nodes, generating a corrected clustering result, specifically including: In the embedding space, the similarity within the neighborhood of each Internet of Things terminal is calculated, and the similarity is measured by the Euclidean distance between the Internet of Things terminal embedding vectors. When the Euclidean distance is less than a preset neighborhood radius threshold, it is determined to be a neighbor; When the number of neighbors of a certain Internet of Things terminal is greater than or equal to a preset minimum neighbor number threshold, it is marked as a core point, and the Internet of Things terminals connected to the neighborhood of the core point are aggregated into the same cluster, and multiple core points and their neighborhoods are recursively expanded to form an initial clustering result; Isolated nodes are identified in the initial clustering result. An isolated node is defined as an Internet of Things terminal that cannot be included in any cluster. Small-scale clusters are identified in the initial clustering result. A small-scale cluster is defined as a cluster containing fewer than 1% of the total number of nodes. Large-scale clusters are identified in the initial clustering result. A large-scale cluster is defined as a cluster containing more than or equal to 1% of the total number of nodes. The isolated nodes and Internet of Things terminals in the small-scale clusters are treated as objects of an undetermined class, and an adjacency relationship matrix is established, and the matrix elements are represented by the edge weights in the Internet of Things terminal relationship graph. The IoT terminal in a large-scale cluster is taken as a known category sample, a propagation probability between an uncertain object and the known category sample is calculated based on an adjacency relation matrix, and a category label of the uncertain object is updated through an iterative propagation mode; When the category label of the uncertain object converges to a large-scale cluster, the object is incorporated into the corresponding cluster, thereby generating a revised clustering result.

8. The method of claim 1, wherein, The revised clustering result is subjected to dynamic evolution analysis, abnormal clusters of growth, merger and disappearance are identified, and the detection result is fed back to relationship graph construction, feature attention mechanism and expanded causal temporal convolution modeling, specifically including: A clustering label set, a cluster member set and a cluster center vector set are generated in each time window, wherein the cluster center vector is defined as an average vector of embedding vectors of all IoT terminals in the cluster; A correlation degree of the cluster is calculated between adjacent time windows, the correlation degree comprehensively considers the similarity of the cluster member set and the similarity of the cluster center vector, and when the correlation degree is greater than or equal to a preset threshold, it is determined that there is a corresponding relationship between two clusters; A cluster pedigree graph is constructed based on the corresponding relationship between the clusters, and in the pedigree graph, the cluster at the previous moment is directed to the corresponding cluster at the next moment; A growth event is determined, when there is an edge from the cluster at the previous moment to the cluster at the next moment in the pedigree graph, and the increase value of the member number of the cluster at the next moment exceeds a preset threshold, the current cluster is marked as a growth event; A merger event is determined, when two or more clusters at the previous moment all establish a corresponding relationship with the same cluster at the next moment, and the member set of the cluster at the next moment has a high similarity with the union set of all related clusters at the previous moment, the current cluster is marked as a merger event; A disappearance event is determined, when a certain cluster fails to establish a corresponding relationship with any cluster in consecutive time windows, the current cluster is marked as a disappearance event; An abnormal strength of the cluster is calculated, the abnormal strength is obtained by weighted summation of the communication frequency distribution, the power consumption fluctuation, the data packet entropy value and the deviation degree of the abnormal log according to the weight determined by the feature attention mechanism, and then a baseline strength is generated through a historical sliding average, when the ratio of the current abnormal strength of the cluster to the baseline strength exceeds a preset threshold and the increase amount of the member number of the cluster in the current window exceeds a preset threshold, the current cluster is marked as a sudden abnormal cluster; A dynamic evolution event set is output, the event set includes the identification, the member set, the belonging time window and the event type of each cluster, and the event set is fed back to update the multi-scale edge weight factor of the IoT terminal relationship graph and the weight initialization of the feature attention mechanism.

Images