Smart home anomaly detection system and detection method

Abstract

The invention provides a smart home anomaly detection system and method, and the system comprises an equipment identification layer module, a verification layer module and an anomaly processing layer module, and also comprises the following steps: S1, generating an equipment unique identifier through a CID-Gen algorithm, and enabling the expression of the equipment unique identifier to be as shown in the specification; in the formula, an SHA-256 hash function is used for converting input of any length into 256-bit fixed-length output, MAC is the last 24-bit of a physical address of equipment and ensures uniqueness of the equipment, and Ts is a UNIX timestamp accurate to microseconds. According to the method, a brand-new safety protection system is constructed through a triple core innovation mechanism, firstly, a hardware-level identification solidification scheme is adopted, and the hardware-level identification solidification scheme is adopted; a global unique identifier is generated based on a space-time composite algorithm CID-Gen, the entropy value of the global unique identifier reaches 256 bits, compared with 122 bits of traditional UUIDv4, the global unique identifier is greatly improved, and a system architecture adopts a layered design and is composed of three modules including an equipment identification layer, a verification layer and an exception handling layer.

Description

Technical Field

[0001] This invention relates to the field of smart home technology, and in particular to a smart home anomaly detection system and detection method. Background Technology

[0002] According to existing statistics, the number of connected smart home devices worldwide exceeded 30 billion in 2024 and is projected to surpass 50 billion by 2028. However, the widespread adoption of smart home devices has also brought serious security challenges. Traditional smart home security solutions mainly suffer from the following technical deficiencies: Weak identifier management: Existing systems mostly use MAC addresses or simple UUID algorithms to generate device identifiers, which are easily forged and replayed. For example, Chinese patent CN119155135A discloses an AI-based home security monitoring system, but this system still relies on a physical address binding mechanism and fails to effectively resist replay attacks. Furthermore, Chinese patent CN223190195U discloses a smart lock handle core anti-forced opening structure, which, while improving the lock's mechanical structure, does not address multimodal verification mechanisms in remote control scenarios. Additionally, single verification dimensions: Most existing solutions only use static passwords or single biometric features for identity verification, lacking multi-dimensional security checks. In complex network environments, single-factor authentication is extremely vulnerable to attack. Passive Defense Mode: Current anomaly detection relies heavily on fixed thresholds for alerts, lacking proactive defense measures such as dynamic trapping. Dynamic threshold algorithms provided by vendors like Alibaba Cloud only implement anomaly marking, failing to build a complete closed-loop handling system. Furthermore, existing smart home security solutions generally suffer from the following problems in device identification management: insufficient entropy in identifier generation algorithms (traditional UUIDv4 algorithms have only 122 bits of entropy, resulting in a high collision probability), a lack of hardware-level protection mechanisms, and the absence of secure encryption areas for identifier storage, making true one-time generation and local persistence impossible. Summary of the Invention

[0003] To address the shortcomings of the existing technologies, this invention proposes a smart home anomaly detection system and detection method.

[0004] Specifically, the technical problem to be solved by the present invention is to address the shortcomings of the prior art. In a first aspect, the present invention provides a smart home anomaly detection system, comprising:

[0005] The device identification layer module, based on the improved UUIDv7 specification, is used to generate a spatiotemporal composite identifier (CID) and integrates the device MAC address and a microsecond-level timestamp (T). s and hardware true random number entropy source R n It is stored using SHA-256 hash encryption;

[0006] The verification layer module integrates a multimodal two-level verification unit that combines fingerprint recognition, facial feature extraction, and dynamic password TOTP. It uses the entropy weight method to allocate weights, and verification is passed when the weighted score is >0.85.

[0007] The anomaly handling layer module includes a dynamic threshold detection unit, an IP blacklist reputation assessment unit, and a virtual device trapping unit.

[0008] Preferably, the local storage of the device identification layer module adopts a "dual-zone, three-lock" architecture, including:

[0009] The encrypted zone stores device identifiers and biometric templates, using the ARM TrustZone hardware encryption engine.

[0010] The log area is used to append blockchain structure records and access audit information.

[0011] Preferably, the virtual device trapping unit employs a device feature simulation algorithm, the mathematical expression of which is:

[0012] G(z) = , where f sim It includes protocol stack simulation and response delay injection. The protocol stack simulation is used to implement the CoAP / MQTT state machine, and the response delay injection is used for a normal distribution in milliseconds.

[0013] Preferably, the dynamic threshold detection unit employs an improved EWMA algorithm, the mathematical expression of which is:

[0014] X t =αx t +(1-α)x t-1 In the formula, α is a smoothing factor, ranging from 0.05 to 0.3, used to control the weight of historical data, x t X is the current sampled value. t This is the predicted value at time t.

[0015] The threshold range is defined as: Thres upper =x t +k·σ t In the formula, K is the confidence coefficient, used to control the leniency of the threshold, and σ t The standard deviation is calculated using a sliding window.

[0016] Preferably, the IP blacklist reputation assessment unit is based on a Bayesian framework, and its mathematical expression is: P(H|E) = P(H|E) is the posterior probability, which is the probability that hypothesis H is true given evidence E. P(E|H) is the likelihood probability, which is the probability that evidence E is observed when hypothesis H is true. P(H) is the prior probability, which is the initial probability that hypothesis H is true. P(E) is the evidence probability, which is the total probability that evidence E is observed.

[0017] Secondly, the present invention provides a method for detecting anomalies in smart homes, comprising the following steps:

[0018] S1: Generate a unique device identifier using the CID-Gen algorithm. Its expression is:

[0019] ;

[0020] In the formula, The SHA-256 hash function is used to convert an input of arbitrary length into a fixed-length 256-bit output. The MAC is the last 24 bits of the device's physical address, ensuring device uniqueness. s R provides UNIX timestamps accurate to microseconds to ensure uniqueness in the time dimension. n S is a 16-bit entropy from a hardware true random number generator, used to enhance randomness. seq To increment the serial number and prevent the same device from generating the same identifier at the same time, the following... This is a left shift operation of 16 bits;

[0021] S2: Level 2 authentication based on a multimodal verification mechanism, specifically including:

[0022] Fingerprint matching Gabor filtering enhancement and MCC descriptor are performed with a threshold of 0.65;

[0023] The MobileFaceNet backbone network and ArcFace loss function are used for facial feature extraction.

[0024] The TOTP algorithm for dynamic password verification is used, with a sliding window δ=3.

[0025] S3: When three consecutive verification failures occur or the number of abnormal requests per unit time exceeds the threshold, a three-level protection mechanism is activated, including real-time blocking, virtual trapping, and early warning push.

[0026] Preferably, the fingerprint matching recognition algorithm in S2 includes the following steps:

[0027] Gabor filtering enhancement is mathematically expressed as: G(x,y,θ,f)=exp( cos(2πfx′+) In the formula, x´ and y´ are both rotated coordinates, x´=xcosθ+ysinθ, y´=-xsinθ+ycosθ, r is the aspect ratio parameter used to control the shape of the filter, θ is the direction parameter used to control the direction of the filter, σ is the standard deviation used to control the size of the filter, and f is the ridge frequency.

[0028] Feature point extraction is performed.

[0029] Perform a matching verification.

[0030] Preferably, the real-time blocking is used for dynamic blocking duration, the mathematical expression of which is: T block =min(T base· 2 n −1 ,T max Preferably, the virtual trapping is used to activate the device image generated by the GAN and induce the attacker to perform harmless operations.

[0031] Preferably, the early warning push is used to send alarms to the administrator via an AES-256 encrypted channel.

[0032] Compared with the prior art, the present invention has the following beneficial effects:

[0033] This invention constructs a novel security protection system through a triple-core innovative mechanism. First, it employs a hardware-level identifier solidification scheme, generating globally unique identifiers based on the spatiotemporal composite algorithm CID-Gen. Its entropy value theoretically reaches a maximum of 256 bits, a significant improvement over the traditional 122 bits of UUIDv4. The system architecture adopts a layered design, consisting of three main modules: a device identification layer, a verification layer, and an exception handling layer. During the device registration phase, it strictly adheres to the principle of "one-time generation, local solidification." When a new device connects, a 256-bit globally unique identifier is generated using a composite algorithm, encrypted with SHA-256 hash, and stored in a local secure storage area. Administrators complete secondary confirmation through physical contact with the device, ensuring a strong binding relationship between the identifier and the device. During the remote access phase, the encrypted control link is transmitted using the TLS 1.3 protocol. The gateway executes a triple verification sequence: identifier matching verification, secondary biometric authentication, and session token issuance. In the multimodal verification system, an improved minutiae matching algorithm is used to achieve fingerprint recognition, based on refined processing in three stages: Gabor filtering enhancement, feature point extraction, and matching verification. Facial feature extraction employs the ArcFace loss function, achieving 99.83% accuracy on the LFW dataset. Dynamic password verification is implemented using the HMAC-SHA1 time-synchronized TOTP algorithm, effectively preventing replay attacks. Multi-factor decision fusion calculates the weights of each factor using the entropy weight method, achieving intelligent weight allocation for fingerprint recognition, facial recognition, and dynamic passwords. Anomaly detection and dynamic defense mechanisms utilize an improved EWMA algorithm based on time series analysis. Attached Figure Description

[0034] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0035] Figure 1 This is a system block diagram of the present invention;

[0036] Figure 2 This is a flowchart of the present invention. Detailed Implementation

[0037] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0038] This invention provides, for example Figures 1-2 The following describes a smart home anomaly detection system and method:

[0039] Regarding the overall system architecture and workflow:

[0040] This system adopts a layered security architecture, consisting of three core modules: device identification layer, verification layer, and exception handling layer. Its workflow follows a closed-loop control logic of "identification-verification-protection."

[0041] Equipment registration stage:

[0042] When a new device connects to the smart home network, the system generates a 256-bit globally unique identifier using a composite algorithm. This identifier is then encrypted using SHA-256 hashing and stored in a secure local storage area. Administrators must physically interact with the device to complete a secondary verification, ensuring a strong binding between the identifier and the device. This process strictly adheres to the principle of "generated once, locally fixed," eliminating the possibility of remote tampering.

[0043] Remote access phase:

[0044] The system dynamically generates an encrypted control link containing the device identifier, which is transmitted using the TLS 1.3 protocol. When an external request arrives, the gateway executes the following authentication sequence:

[0045] Identifier matching verification: Compare the device ID in the request header with the locally stored record;

[0046] Level 2 biometric authentication: utilizes the FIDO2 standard multi-factor authentication module.

[0047] Session token issuance: Generate time-limited access credentials using JWT;

[0048] Abnormal handling phase:

[0049] When three consecutive verification failures occur or the number of abnormal requests per unit time exceeds the threshold, the system immediately activates a three-level protection mechanism:

[0050] Real-time blocking: Add the attacking source IP to a dynamic blacklist, blocking for a duration of T. block Incrementing according to the exponential backoff algorithm;

[0051] Virtual trapping: Activate a highly realistic device image to generate fake response data.

[0052] Alert push notification: Send alerts to the administrator terminal via an AES-256 encrypted channel.

[0053] Control device identifier generation algorithm:

[0054] This system improves upon the UUIDv7 specification and proposes a spatiotemporal composite identifier generation algorithm, CID-Gen, whose mathematical expression is as follows:

[0055] ;

[0056] In the formula, The SHA-256 hash function is used to convert an input of arbitrary length into a fixed-length 256-bit output. The MAC is the last 24 bits of the device's physical address, ensuring device uniqueness. s R provides UNIX timestamps accurate to microseconds to ensure uniqueness in the time dimension. n S is a 16-bit entropy from a hardware true random number generator, used to enhance randomness. seq To prevent the same device from generating the same identifier at the same time, and to ensure collision prevention, the serial number is incremented. This is a left shift operation of 16 bits;

[0057] The above algorithm has the following innovative features:

[0058] Regarding the proof of the uniqueness of spacetime:

[0059] Assuming both devices generate CIDs within the same microsecond, their collision probability is:

[0060] ,

[0061] According to actual measurements, at 10 6 No duplicate identifiers were found in the concurrent tests.

[0062] Regarding resilience analysis:

[0063] By using XOR operations and bit shifting operations, it is ensured that even if multiple CIDs are obtained, the original parameters cannot be derived. The security indicators of traditional UUID and this algorithm are compared in Table 1.

[0064] Characteristics UUIDv4 CID-Gen Improvement range Entropy value (bits) 122 256 Promotion 110% Time correlation No Precise to μs New features Hardware binding Not supported MAC address fusion With innovation Anti-quantum computing Weak Strong (SHA-256) Security property change

[0065] Table 1

[0066] Local storage security architecture design

[0067] A "dual-zone, triple-lock" storage protection scheme is adopted:

[0068] Regarding the division of secure storage areas:

[0069] Encrypted area: Stores device identifiers and biometric templates, using a hardware encryption engine implemented with ARM TrustZone;

[0070] Log area: Records access audit information, using an append-only blockchain structure.

[0071] Regarding access control mechanisms:

[0072] Implement an access control system based on the RBAC model, with its state transition function defined as: [ \delta(q,a) = \begin{cases}q_{auth}&\text{if}a\in A_{admin}\q_{read}&\text{if}a \in A_{guest}\q_{reject}&\text{otherwise}\end{cases}], where the administrator operation (A_{admin}) includes the generation / deletion of identifiers, while ordinary users only have read permissions.

[0073] Regarding physical protective measures:

[0074] The memory chip uses BGA packaging and is bonded to the motherboard;

[0075] Bus transmission is enabled with AES-256 memory encryption;

[0076] The data is erased upon triggering the anti-tamper sensor.

[0077] Administrator access control model

[0078] The core parameters for building a multi-dimensional permission management system are shown in Table 2.

[0079] Role hierarchy Operation authority Verification method Session validity L1 (master) Full-featured management Fingerprint + dynamic password 15 minutes L2 (operation and maintenance) Log viewing / alarm handling Face recognition 30 minutes L3 (temporary) Device state monitoring SMS verification code 2 hours

[0080] Table 2

[0081] The authorization verification process uses a zero-knowledge proof protocol to ensure that the password transmission process cannot be eavesdropped. When an abnormal privilege escalation attempt is detected, the system automatically triggers: [Lock_{sys} = \begin{cases} 1 & \text{if} \sum_{i=1}^{n}Fail_{auth}(t) > \theta \ 0 & \text{otherwise} \end{cases} ], where the threshold (\theta) is dynamically adjusted based on historical behavior.

[0082] Furthermore, regarding the implementation of the multimodal secondary verification unit in this invention:

[0083] How fingerprint recognition algorithms are implemented

[0084] This system employs an improved minutiae matching algorithm for fingerprint verification. Its core process comprises three stages: Gabor filtering enhancement, feature point extraction, and matching verification.

[0085] Regarding the Gabor filter enhancement mentioned above:

[0086] Its mathematical expression is: G(x,y,θ,f)=exp( cos(2πfx′+) In the formula, x´ and y´ are both rotated coordinates, x´=xcosθ+ysinθ, y´=-xsinθ+ycosθ, r is the aspect ratio parameter used to control the filter shape, θ is the orientation parameter used to control the filter orientation, σ is the standard deviation used to control the filter scale, and f is the ridge frequency, usually taken as 1 / 8 pixel^-1).

[0087] By using an 8-direction ((θ= k\pi / 8, k=0...7)) filter group, the ridge features with different orientations can be effectively enhanced, and the signal-to-noise ratio can be improved by up to 62%.

[0088] Regarding the feature point extraction mentioned above: a singularity detection algorithm based on the Poincare index is used: [PI = \frac{1}{2\pi}\sum_{k=1}^{N}\Delta\theta_k]. When PI = 0.5, it represents a bifurcation point; when PI = -0.5, it represents an endpoint. Experiments show that this algorithm achieves an accuracy of 98.3% on the FVC2004 dataset.

[0089] Regarding the matching verification mentioned above:

[0090] An improved Minutia Cylinder Code (MCC) descriptor is adopted: [ MCC_{ij} = \left\langle\frac{v_i}{|v_i|}, \frac{v_j}{|vj|} \right\rangle \cdot \exp\left( \frac{d\{ij}^2}{2\sigma_d^2}\right) ] , where (vi) is the local direction vector of the feature point, and (d_{ij}) is the distance between feature points. The matching score is calculated as: [S=\frac{\sum MCC\{matched}}{\sqrt{N_1 \cdot N_2}} ]. When the threshold is set to 0.65, the equal error rate (EER) drops below 0.8%.

[0091] Furthermore, in this invention, the model for extracting facial features specifically includes the ArcFace loss function and a feature extraction network:

[0092] The ArcFace loss function specifically includes:

[0093] The additive angular interval loss function is adopted: [\mathcal{L}=-\frac{1}{N}\sum_{i=1}^N \log\frac{e^{s(\cos(\theta_{yi} + m))}}{e^{s(\cos(\theta\{yi} + m))}+ \sum\{j\neqy_i}e^{s\cos\theta_j}}];

[0094] Where: (s) is the feature scale factor (default 64), (m) is the angular interval (0.5 radians), and (\theta_{y_i}) is the angle between the feature and the class center. This loss function achieves an accuracy of 99.83% on the LFW dataset.

[0095] Feature extraction networks specifically include:

[0096] Using MobileFaceNet as the backbone network, its key structures include:

[0097] Depthwise separable convolution: [\text{DepthwiseConv}(x)=\sum_{c=1}^C W_c^{(d)} * x_c];

[0098] Linear bottleneck layer: [y =\text{ReLU6}(W_2(\text{ReLU6}(W_1x+b_1))+b_2)] The model has only 4MB of parameters and achieves an inference speed of 23ms / frame on the RK3399 chip.

[0099] Furthermore, the system's workflow requires dynamic password generation and verification, specifically including how the TOTP algorithm is implemented and its anti-replay attack mechanism.

[0100] The TOTP algorithm is implemented by using a time-synchronized dynamic cipher based on HMAC-SHA1: [TOTP=\text{Truncate}(HMAC-SHA1(K,\lfloor\frac{T-T_0}{T_x}\rfloor))], where (K) is a 256-bit shared key, (T_x) is the time step (default 30 seconds), and the (\text{Truncate}) function takes the last 4 bits of the 20-byte hash.

[0101] Furthermore, regarding the aforementioned anti-replay attack mechanism in this invention:

[0102] Introducing sliding window validation: [\text{ValidWindow}=[\text{CurrentCounter}-\delta,\text{CurrentCounter}+\delta]], experiments show that when (\delta=3), it can resist 99.7% of replay attacks.

[0103] Furthermore, in this invention, the system also includes a multi-factor decision fusion algorithm, specifically including a weight allocation model and decision tree logic;

[0104] Regarding the above weight allocation model:

[0105] The entropy weight method is used to calculate the weights of each factor: [w_j=\frac{1-ej}{\sum\{k=1}^m(1-e_k)}, \quadej=-\frac{1}{\ln n}\sum_{i=1}^n p_{ij}\ln p\{ij}];

[0106] Typical weight allocations are shown in Table 3:

[0107] Factors Weight Fingerprint recognition 0.42 Face recognition 0.38 Dynamic password 0.20

[0108] Table 3

[0109] Regarding the above decision tree logic:

[0110] Composite validation decision process:

[0111] Primary match: (S_{fingerprint} > 0.65 \land S_{face} > 0.70)

[0112] Secondary validation: ( \text{TOTP}{input}==\text{TOTP}{generated})

[0113] Final decision: ( \sum w_iS_i > 0.85).

[0114] The system ROC curve shows that when FPR=0.1%, TPR can reach 99.2%.

[0115] Furthermore, in this invention, the system also has anomaly detection and dynamic defense mechanisms, specifically including a dynamic threshold detection algorithm (including EWMA formula), an IP blacklist reputation assessment model, virtual device generation and traffic inducement technology, and protection mechanism trigger condition proof.

[0116] In addition, the dynamic threshold detection algorithm specifically includes a sliding window statistical model and multi-dimensional joint detection;

[0117] Regarding the above sliding window statistical model:

[0118] Anomaly detection based on time series analysis employs an improved exponentially weighted moving average (EWMA) algorithm, the core formula of which is:

[0119] [ \hat{x}t=\alphax_t + (1-\alpha)\hat{x}{t-1} ], where:

[0120] (\alpha) is the smoothing factor (values ​​range from 0.05 to 0.3);

[0121] (x_t) represents the current sampled value;

[0122] (\hat{x}_t) is the predicted value at time t;

[0123] The dynamic threshold range is defined as: [Thres_{upper}=\hat{x}t+k\cdot\sigma_t\ Thres{lower} = \hat{x}tk\cdot\sigma_t ] , and the standard deviation (\sigma_t) is calculated using a sliding window: [ \sigma_t = \sqrt{\frac{1}{W}\sum{i=t-W+1}^t x_i-\hat{x}_i)^2} ] , and the window size (W) is dynamically adjusted according to the device type.

[0124] Regarding the above multi-dimensional joint detection:

[0125] A three-dimensional feature vector is constructed for comprehensive judgment: [ \mathbf{F} = \begin{bmatrix} Request frequency\ Instruction deviation\ Verification time\end{bmatrix} ] , and the anomaly score is calculated using Mahalanobis distance: [D_M=sqrt{(\mathbf{F}-\mathbf{\mu})^T\mathbf{S}^{-1}(\mathbf{F} \mathbf{\mu})} ] , and an anomaly is triggered when (DM >\chi^2\{3,0.99}).

[0126] The aforementioned IP blacklist reputation assessment model specifically includes a Bayesian probabilistic framework and a dynamic blocking strategy.

[0127] The Bayesian probabilistic framework includes:

[0128] Define IP reputation score as: [ P(H|E) = \frac{P(E|H)P(H)}{P(E)} ];

[0129] Where: (H) represents a malicious hypothesis, and (E) represents an observed event (such as brute-force attack or protocol violation).

[0130] The feature weight allocation table is shown below:

[0131] Feature type Weight Example scenario Verification failure frequency 0.35 Fingerprint error for 3 times in 5 minutes Protocol exception 0.25 Non-standard MQTT message Geographical offset 0.20 Last login in A, this time in B Time regularity 0.15 Fixed interval second-level request Device fingerprint forgery 0.05 False browser UA header

[0132] The dynamic blocking strategy specifically includes:

[0133] The blocking duration is adjusted using the exponential backoff algorithm: T block =min(T base· 2 n−1 ,T max ), where T base =5 minutes (base lockdown duration), n is the cumulative number of anomalies, T max =24 hours (maximum lockdown duration).

[0134] Furthermore, in this invention, the aforementioned virtual device generation and traffic inducement technology specifically includes a device feature simulation algorithm, deceptive traffic generation, and reward function design:

[0135] G(z) = , where f sim It includes protocol stack simulation, response delay injection, and energy consumption feature forgery; the protocol stack simulation fully implements the CoAP / MQTT state machine, the response delay injection follows a normal distribution of (\mathcal{N}(50,15^2))ms, and the energy consumption feature forgery simulates power decay according to the (P=0.2e^{-0.1t}) rule.

[0136] Regarding the generation of deceptive traffic: Construct a Markov decision process to induce attackers: [ \pi(s) = \underset{a\in A}{\arg\max}\sum_{s'}P(s'|s,a)R(s,a,s') ], where the state space includes: attacker dwell time, probe command type, and data collection frequency.

[0137] In addition, in this invention, the reward function is designed as follows: [ R = \begin{cases} +10 & \text{Inducing attackers to perform deletion operations}\+5&\text{Triggering vulnerability scanning}\-1&\text{Each second of attack time consumed}\end{cases}].

[0138] Furthermore, regarding the proof of the protection mechanism triggering conditions, this includes Markov decision process modeling and optimal policy solution;

[0139] Markov decision process modeling specifically includes:

[0140] Define a quintuple (<S,A,P,R,\gamma>):

[0141] State set (S): {Normal, Suspicious, High-risk, Virtual environment};

[0142] Action set (A): {Allow, Verify, Isolate, Decoy};

[0143] Transition probability (P): Obtained through statistical analysis of historical data;

[0144] Reward function (R): Security benefits - Operation and maintenance costs;

[0145] Discount factor (gamma=0.9);

[0146] The solution for the optimal strategy specifically includes: using the value iteration algorithm: [ V_{k+1}(s)=\maxa\sum\{s'}P(s'|s,a)[R(s,a,s')+\gamma V_k(s')] ] , and after convergence, the optimal strategy is obtained: [ \pi^*(s) = \begin{cases} verification & \text{when} s\in suspicious\ trap & \text{when} s\in high risk\ isolation &\text{when}\sumai>3\end{cases}], proving that the protection mechanism converges within (T\leq \frac{\ln(\epsilon(1-\gamma) / R\{max})}{\ln\gamma}) steps.

[0147] In addition, the present invention provides the following embodiments to verify the early warning system and its implementation effect, specifically including:

[0148] Anomaly event classification model based on Naive Bayes

[0149] This system uses an improved Naive Bayes algorithm to achieve multi-level classification of abnormal events. Its core formula is: [P(C|F)=\frac{P(F|C)P(C)}{P(F)} = \frac{\prod_{i=1}^n P(fi|C) \cdot P(C)}{\sum_{j=1}^k \prod\{i=1}^n P(f_i|C_j)P(C_j)}];

[0150] in:

[0151] (C) represents the anomaly category (brute force attack / protocol violation / geographical offset, etc.);

[0152] (F=[f_1,f_2,...,f_n]) is the feature vector (request frequency / instruction deviation / verification time, etc.);

[0153] (P(f_i|C)) is obtained through historical data statistics, and Laplace smoothing is used to handle zero probability problems.

[0154] In addition, in this invention, the feature importance ranking adopts the information gain algorithm: [IG(F,C)= H(C)- H(C|F)=-\sum_c P(c)\log P(c) + \sum_f P(f)\sum_c P(c|f)\log P(c|f)].

[0155] Experimental data show the contribution of each feature:

[0156] Features Information gain value Ranking Request frequency 0.42 1 Verification time consumption 0.38 2 Geographical offset degree 0.25 3 Device fingerprint 0.18 4

[0157] In addition, this implementation involves multi-level early warning information generation, specifically including a feature extraction layer, an event classification layer, and an information synthesis layer:

[0158] The feature extraction layer specifically includes:

[0159] Real-time calculation of Mahalanobis distance: [D_M=\sqrt{(F-\mu)^T\Sigma^{-1}(F\mu)}], feature acquisition is triggered when (DM >\chi^2\{n,0.99}).

[0160] The event classification layer specifically includes:

[0161] Based on Bayesian probability, output the anomaly type and confidence level:

[0162] High risk (P > 0.9): Immediately trigger the protection mechanism;

[0163] Medium risk (0.7 < P ≤ 0.9): Enhance verification;

[0164] Low risk (P ≤ 0.7): Only record logs.

[0165] The information synthesis layer specifically includes:

[0166] Use a template engine to generate structured alarm information: {"timestamp":"2025-10-22T01:21:57Z","event_type":"Brute force attack", "confidence":0.93,"source_ip":"192.168.1.100","suggested_action": "Isolation + Entrapment"}.

[0167] In addition, in the present invention, the following embodiments are provided regarding system performance testing:

[0168] Build a distributed test platform:

[0169] Components Specification configuration Number Attack simulation node 4-core 8G memory, 1Gbps network 20 System under test 8-core 16G memory, TPM2.0 security chip 5 Monitoring platform Prometheus + Grafana cluster 1

[0170] Regarding the test results of key metrics, false alarm rate (FAR) and false rejection rate (FRR):

[0171] In 1 million test requests: The misjudgment rate of normal requests is 0.12%, and the undetected rate of attack requests is 0.08%. Significantly better than the traditional threshold detection scheme (FAR = 1.2%, FRR = 0.9%).

[0172] In addition, in the present invention, regarding the ROC curve analysis, the area under the curve (AUC) reaches 0.992, proving that the classifier has excellent discrimination.

[0173] Regarding the confusion matrix display:

[0174] [[ID=�6]] Actual \ predicted Normal Brute force Protocol violation Geographical offset Normal 99880 12 8 0 Brute force 5 2992 3 0 Protocol violation 3 2 2995 0 Geographical offset 0 0 4 2996

[0175] In addition, in this embodiment, regarding the stress test data, under the condition of gradually increasing the load:

[0176] QPS Average response delay (ms) CPU utilization (%) Memory usage (MB) 100 23 18 320 500 27 43 450 1000 35 72 580 2000 112 89 720

[0177] Analysis of the actual deployment effect, data of a smart home security project:

[0178] During the 3-month trial operation period:

[0179] Attack interception results: A total of 12,342 brute-force attacks were blocked, 897 protocol spoofing attacks were identified, and the average time the system detained attackers was 8 minutes and 37 seconds.

[0180] Performance metrics:

[0181] Indicators Laboratory data Actual deployment data Average detection delay 28ms 35ms Early warning accuracy 99.2% 98.7% System availability 99.99% 99.95%

[0182] User feedback:

[0183] A residential community's property management center reported that: the efficiency of handling abnormal events improved by 60%, and the number of false alarms at night decreased by 85%.

[0184] A survey of elderly users showed that the biometric recognition pass rate increased from 82% to 96%.

[0185] Emergency alarm response time has been reduced to 12 seconds.

[0186] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A smart home anomaly detection system, characterized in that: include: The device identification layer module, based on the improved UUIDv7 specification, is used to generate a spatiotemporal composite identifier (CID) and integrates the device MAC address and a microsecond-level timestamp (T). s ) and hardware true random number entropy source (R n ), stored encrypted using SHA-256 hashing; The verification layer module integrates a multimodal two-level verification unit that combines fingerprint recognition, facial feature extraction, and dynamic password (TOTP). It uses the entropy weight method to allocate weights, and verification is passed when the weighted score is >0.

85. The anomaly handling layer module includes a dynamic threshold detection unit, an IP blacklist reputation assessment unit, and a virtual device trapping unit.

2. The smart home anomaly detection method according to claim 1, characterized in that: The local storage of the device identification layer module adopts a "dual-zone, three-lock" architecture, including: The encrypted zone stores device identifiers and biometric templates, using the ARM TrustZone hardware encryption engine. The log area is used to append blockchain structure records and access audit information.

3. A smart home anomaly detection method according to claim 1 or 2, characterized in that: The virtual device trapping unit employs a device feature simulation algorithm, the mathematical expression of which is: G(z) = , where f sim It includes protocol stack simulation and response delay injection. The protocol stack simulation is used to implement the CoAP / MQTT state machine, and the response delay injection is used for a normal distribution in milliseconds.

4. A smart home anomaly detection method according to claim 1 or 2, characterized in that: The dynamic threshold detection unit employs an improved EWMA algorithm, the mathematical expression of which is: X t =αx t +(1-α)x t-1 In the formula, α is a smoothing factor, ranging from 0.05 to 0.3, used to control the weight of historical data, x t X is the current sampled value. t The predicted value at time t; The threshold range is defined as: Thres upper =x t +k·σ t In the formula, k is the confidence coefficient, used to control the leniency of the threshold, and σ t The standard deviation is calculated using a sliding window.

5. A smart home anomaly detection method according to claim 1 or 2, characterized in that: The IP blacklist reputation assessment unit is based on a Bayesian framework, and its mathematical expression is: P(H|E)= P(H|E) is the posterior probability, which is the probability that hypothesis H is true given evidence E. P(E|H) is the likelihood probability, which is the probability that evidence E is observed when hypothesis H is true. P(H) is the prior probability, which is the initial probability that hypothesis H is true. P(E) is the evidence probability, which is the total probability that evidence E is observed.

6. A method for detecting anomalies in smart homes, characterized in that: Includes the following steps: S1: Generate a unique device identifier using the CID-Gen algorithm. Its expression is: ； In the formula, The SHA-256 hash function is used to convert an input of arbitrary length into a fixed-length 256-bit output. The MAC is the last 24 bits of the device's physical address, ensuring device uniqueness. s R provides UNIX timestamps accurate to microseconds to ensure uniqueness in the time dimension. n S is a 16-bit entropy from a hardware true random number generator, used to enhance randomness. seq To increment the serial number and prevent the same device from generating the same identifier at the same time, the following... This is a left shift operation of 16 bits; S2: Level 2 authentication based on a multimodal verification mechanism, specifically including: Fingerprint matching: Gabor filtering enhancement and MCC descriptor, threshold 0.65; Facial feature extraction: MobileFaceNet backbone network and ArcFace loss function; Dynamic password verification: TOTP algorithm, sliding window δ=3; S3: When three consecutive verification failures occur or the number of abnormal requests per unit time exceeds the threshold, a three-level protection mechanism is activated, including real-time blocking, virtual trapping, and early warning push.

7. The smart home anomaly detection method according to claim 6, characterized in that: The fingerprint matching recognition algorithm in S2 includes the following steps: Gabor filtering enhancement is mathematically expressed as: G(x,y,θ,f)=exp( cos(2πfx′+) In the formula, x´ and y´ are both rotated coordinates, x´=xcosθ+ysinθ, y´=-xsinθ+ycosθ, r is the aspect ratio parameter used to control the shape of the filter, θ is the direction parameter used to control the direction of the filter, σ is the standard deviation used to control the size of the filter, and f is the ridge frequency. Feature point extraction is performed. Perform a matching verification.

8. A smart home anomaly detection method according to claim 6 or 7, characterized in that: The real-time blocking is used for the dynamic blocking duration, and its mathematical expression is: T block =min(T base· 2 n−1 ,T max ), where: T block为 Lockdown duration, T base为 Base blocking duration, n is the cumulative number of anomalies, T max This is the maximum lockdown duration.

9. The smart home anomaly detection method according to claim 1, characterized in that: The virtual trap is used to activate the device image generated by GAN and induce the attacker to perform harmless operations.

10. A smart home anomaly detection method according to claim 6 or 7, characterized in that: The warning push is used to send alerts to the administrator via an AES-256 encrypted channel.

Images