AI-based set-top box terminal security monitoring system

Abstract

This invention discloses an artificial intelligence-based set-top box terminal security monitoring system, including an operational data acquisition module, a dual-band feature extraction layer module, a dual-image shaping layer module, a set-top box operation inference model design module, a situational change optimization module, and a real-time set-top box terminal security monitoring module. This invention belongs to the field of security monitoring, specifically referring to an artificial intelligence-based set-top box terminal security monitoring system. This solution introduces Euler's formula to transform biphasic features, thereby designing a biphasic activation function to achieve a two-dimensional coupled representation of the set-top box amplitude and phase; it designs an attack sensitivity coefficient based on the degree of trend abruptness to distinguish different trend states; it improves the attack detection rate by constructing a corner cost loss function to constrain the correctness of the inference direction; it introduces a delay factor to design a quasi-bias loss, learns cross-signal rules, and conforms to the security situational awareness of multi-index coupling in the set-top box; thus improving the reliability of set-top box terminal security monitoring.

Description

Technical Field

[0001] This invention relates to the field of security monitoring, specifically to a set-top box terminal security monitoring system based on artificial intelligence. Background Technology

[0002] A set-top box terminal security monitoring system refers to a hardware and software integrated protection system that collects and analyzes operational data from set-top box devices in real time, detecting abnormal behavior and potential threats to ensure the device's operational security, user privacy, and home network security. However, typical set-top box terminal security monitoring systems suffer from several drawbacks: they fail to capture the true gradual changes in the set-top box's behavior and do not consider the differences in abnormal risks under different trend states, resulting in poor early warning effects for sudden anomalies. Furthermore, they often exhibit poor measurement of predicted trajectory deviations and low robustness to distribution drift caused by set-top box system upgrades and network changes, leading to poor reliability in security monitoring. Summary of the Invention

[0003] To address the above issues and overcome the shortcomings of existing technologies, this invention provides an artificial intelligence-based set-top box terminal security monitoring system. Addressing the problems of general set-top box terminal security monitoring systems failing to capture the true gradual changes in the set-top box and neglecting the differences in abnormal risks under different trend states, resulting in poor early warning effects for abnormal changes, this solution introduces Euler's formula to transform biphasic features, thereby designing a biphasic activation function that simultaneously captures static and dynamic information, achieving a coupled representation of the set-top box's amplitude and phase. An attack sensitivity coefficient is designed based on the degree of trend change, focusing on trend deviations at the critical moment of an attack, weakening data interference after an attack, and distinguishing different trends. This solution addresses the issues of poor performance in predicting trajectory deviations and low robustness to distributional drift caused by set-top box system upgrades and network changes, leading to poor security monitoring reliability. It addresses these problems by constructing a corner cost loss function to constrain the correctness of the predicted direction, forcing the model to learn the true trend direction, preventing the mechanical replication of historical values, and improving the attack detection rate. Furthermore, it introduces a delay factor to design a quasi-bias loss, learns cross-signal rules, and detects chain anomalies in advance, aligning with the security situation awareness of multiple coupled indicators in set-top boxes. This ultimately improves the reliability of set-top box terminal security monitoring.

[0004] The technical solution adopted by the present invention is as follows: The set-top box terminal security monitoring system based on artificial intelligence provided by the present invention includes an operation data acquisition module, a dual-band feature extraction layer module, a dual-image shaping layer module, a set-top box operation inference model design module, a situational change optimization module, and a real-time set-top box terminal security monitoring module;

[0005] The operation data acquisition module obtains historical set-top box terminal operation data and constructs an operation dataset.

[0006] The dual-band feature extraction layer module extracts the low-frequency trend and high-frequency fluctuation features of the running data;

[0007] The dual-band shaping layer module concatenates the dual-band features, maps them through a fully connected layer, processes them through an activation function, and maps them again to obtain enhanced temporal features.

[0008] The set-top box operation simulation model design module is based on the dual-band feature extraction layer and dual-image shaping layer module, constructs the corner cost loss function, and designs the set-top box operation simulation model;

[0009] The situational change optimization module designs a delay factor and a time accuracy deviation loss function to optimize the loss function of the set-top box operation simulation model for situational change.

[0010] The real-time set-top box terminal security monitoring module performs security monitoring on the real-time collected set-top box terminal operation data based on the set-top box operation simulation model.

[0011] Furthermore, the operational data acquisition module acquires historical set-top box terminal operational data, deploys a lightweight data acquisition agent through the set-top box terminal, and collects security indicators during normal operation; preprocesses the collected data, including missing value imputation, outlier removal, and data standardization; defines normal state labels, and trains the labels to the measured values ​​at the next moment; thus obtaining the operational dataset.

[0012] Furthermore, the dual-band feature extraction layer module specifically includes:

[0013] For the running dataset, low-frequency trends are preserved based on a low-pass filter;

[0014] High-frequency fluctuations are preserved based on high-pass filters.

[0015] Furthermore, the dual-image shaping layer module specifically includes:

[0016] Biphase mapping involves stitching together the features of two frequency bands and then mapping them to a biphase space through a fully connected layer.

[0017] The design of the biphase activation function involves introducing Euler's formula to design the biphase activation function, decomposing the biphase into the modulus and argument, and then synthesizing the biphase output.

[0018] The feature output, after activation, is mapped back to the real-valued space through a fully connected layer to obtain a temporal feature representation.

[0019] Furthermore, the set-top box operation simulation model design module specifically includes:

[0020] Calculate the degree of deviation of the extrapolated amplitude;

[0021] Calculate the distance between the measured value and the projected value at the previous moment, and introduce a time-series distance parameter that reflects the stride of the data itself;

[0022] Calculate the distance between the measured value at the previous moment and the current measured value to reflect the natural changes of the set-top box on the time axis;

[0023] The time-series distance parameter design uses the average absolute error of adjacent moments of the normal state data of the running dataset to reflect the average variation step of the set-top box data under natural conditions;

[0024] The degree of trend abruptness is calculated based on the temporal slope change over three sampling periods before and after a given time, and the degree of trend abruptness is quantified.

[0025] Calculate the attack sensitivity coefficient, introduce a mutation threshold, and design a nonlinear weighting coefficient;

[0026] The corner cost loss function is designed by taking the angle formed by the previous measured value, the current measured value, and the current inferred value as the constraint object, and the attack sensitivity coefficient as the nonlinear weighting coefficient to obtain the corner cost loss function.

[0027] The core objective of the set-top box operation simulation model is to infer the normal state data of the next moment from the current operation data. It consists of five core layers: feature input layer, dual-band feature extraction layer, dual-image shaping layer, time series simulation layer, and loss calculation layer.

[0028] Furthermore, the situational change optimization module specifically includes:

[0029] Delay factor calculation, by designing delay factors to learn cross-signal rules, thereby providing early warning of chain anomalies;

[0030] The timing bias loss function is designed to optimize the fidelity of the model output sequence and the real sequence in terms of delay factor.

[0031] The total loss design is a weighted sum of the simulation loss and the timing deviation loss in the set-top box operation simulation model.

[0032] Furthermore, the real-time set-top box terminal security monitoring module deploys the trained set-top box operation simulation model to the set-top box terminal to perform security monitoring on the real-time collected set-top box terminal operation data.

[0033] The beneficial effects achieved by the present invention using the above solution are as follows:

[0034] (1) In view of the problem that general set-top box terminal security monitoring systems cannot capture the real gradual change pattern of set-top boxes and do not consider the difference in abnormal risks under different trend states, resulting in poor early warning effect of abnormal changes, this solution introduces Euler's formula to transform the biphase features, thereby designing a biphase activation function, capturing both static and dynamic information, and realizing the dual-dimensional coupled representation of set-top box amplitude and phase; based on the degree of trend change, an attack sensitivity coefficient is designed to focus on the trend deviation at the critical moment of attack, weaken the interference of polluted data after attack, distinguish different trend states, reduce the false alarm rate, and improve the early warning effect at the moment of attack change.

[0035] (2) In view of the problems that general set-top box terminal security monitoring systems have poor measurement effect of predicted trajectory direction deviation and low robustness to distribution drift of set-top box system upgrades and network changes, resulting in poor security monitoring reliability, this solution constructs a corner cost loss function to constrain the correctness of the inference direction, forces the model to learn the real trend direction, prevents mechanical copying of historical values, and improves the attack detection rate; introduces a delay factor to design the quasi-bias loss, learns the cross-signal law, discovers chain anomalies in advance, and fits the security situation perception of set-top box multi-indicator coupling; thereby improving the reliability of set-top box terminal security monitoring. Attached Figure Description

[0036] Figure 1 A schematic diagram of the set-top box terminal security monitoring system based on artificial intelligence provided by the present invention;

[0037] Figure 2 A schematic diagram of the module design for the set-top box operation simulation model.

[0038] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used together with the embodiments of the invention to explain the invention and do not constitute a limitation thereof. Detailed Implementation

[0039] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0040] In the description of this invention, it should be understood that the terms "upper", "lower", "front", "rear", "left", "right", "top", "bottom", "inner", "outer", etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are only for the convenience of describing this invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this invention.

[0041] Example 1, see Figure 1 The set-top box terminal security monitoring system based on artificial intelligence provided by the present invention includes an operation data acquisition module, a dual-band feature extraction layer module, a dual-image shaping layer module, a set-top box operation inference model design module, a situational change optimization module, and a real-time set-top box terminal security monitoring module.

[0042] The operation data acquisition module obtains historical set-top box terminal operation data, constructs an operation dataset, and sends the data to the dual-band feature extraction layer module.

[0043] The dual-band feature extraction layer module extracts the low-frequency trend and high-frequency fluctuation features of the running data and sends the data to the dual-image shaping layer module.

[0044] The dual-band shaping layer module concatenates the dual-band features, maps them through a fully connected layer, processes them with an activation function, and maps them again to obtain enhanced temporal features; and sends the data to the set-top box operation inference model design module.

[0045] The set-top box operation simulation model design module, based on the dual-band feature extraction layer and dual-image shaping layer module, constructs the corner cost loss function and designs the set-top box operation simulation model; and sends the data to the situational change optimization module.

[0046] The situational change optimization module designs a delay factor and a time accuracy deviation loss function to optimize the loss function of the set-top box operation simulation model for situational change; and sends the data to the real-time set-top box terminal security monitoring module.

[0047] The real-time set-top box terminal security monitoring module performs security monitoring on the real-time collected set-top box terminal operation data based on the set-top box operation simulation model.

[0048] Example 2, see Figure 1This embodiment is based on the above embodiment. The running data acquisition module obtains historical set-top box terminal operation data. A lightweight data acquisition agent is deployed on the set-top box terminal to collect security indicators during normal operation, including CPU utilization, memory usage, network traffic, number of processes, frequency of abnormal logs, frequency of system calls, and number of port connections. The sampling frequency is 1 minute / time. The data format is timestamp + multi-dimensional indicator vector. The collected data is preprocessed, including missing value imputation (linear interpolation), outlier removal (3σ principle), and data standardization (Z-score). Normal state labels are defined, and the training labels are the measured values ​​at the next time step (the measured values ​​at the current time step are used as input features, and the model learns to infer the normal state at the next time step from the current state). The running dataset is obtained.

[0049] Example 3, see Figure 1 This embodiment is based on the above embodiment. The dual-band feature extraction layer module, targeting the different frequency band characteristics of the set-top box terminal's operating data (low-frequency trends reflect system load changes, and high-frequency fluctuations reflect sudden attacks), directly separates and enhances the characteristics of each frequency band based on low-pass and high-pass filters; specifically including:

[0050] For the running dataset, the low-frequency trend is preserved based on the low-pass filter, as follows: ;in, These are the learnable weights of the low-pass filter, and t is the sampling time; It is the output of a low-pass filter, preserving the low-frequency trend; This represents the runtime data at the corresponding sampling time; L is the window size. It is the index of the time within the window;

[0051] Based on the high-pass filter preserving high-frequency fluctuations, it can be expressed as: ;in, These are the learnable weights of the high-pass filter; It is the output of a high-pass filter; the learnable weights are optimized through backpropagation.

[0052] Example 4, see Figure 1 This embodiment is based on the above embodiment. The dual-image shaping layer module maps dual-band features to a dual-phase space, using amplitude and phase information to simultaneously characterize the numerical magnitude and trend of change, thereby enhancing the feature representation capability; specifically, it includes:

[0053] Biphase mapping, which concatenates the features of two frequency bands and maps them to a biphase space through a fully connected layer, is represented as: ;in, It is the mapping result of the two-phase space; is the biphase weight matrix; b is the biphase bias vector; biphase space: a feature space designed for the amplitude-phase dual-dimensional representation requirements of set-top box security time-series data, where the first phase represents the amplitude characteristics of the index, and the second phase represents the phase characteristics of the index (the trend of numerical change and the direction of fluctuation); the biphase space maps the real-valued dual-band features into coupled feature vectors of amplitude dimension + phase dimension, while capturing the static numerical magnitude and dynamic trend of set-top box data; the biphase weight matrix is ​​initialized using Xavier, and the biphase bias vector is initialized using constants with an initial value of 0. During training, the value range is constrained by weight pruning, and the weight update uses the Adam optimizer;

[0054] In the monitoring of set-top box operation, features need to simultaneously carry intensity and orientation information, and the learning process must be stable and non-divergent. Therefore, a biphasic activation function is designed by introducing Euler's formula, decomposing the biphasic phase into magnitude and argument (by performing a polar coordinate transformation on z to obtain the magnitude R and argument). , , (where x and y are the real and imaginary parts of z, respectively), and then synthesize the biphase output to avoid extreme outputs while maintaining nonlinearity. The activation function is expressed as: ;in, It is a biphasic activation function; It is the hyperbolic tangent function; It is the scaling factor of the modulus, with a value ranging from 0.1 to 1.0; It is the scaling factor of the argument, with a value ranging from 0.5 to 20; It is a sigmoid function; is the argument of the input two phases; i is the imaginary unit;

[0055] The feature output, after activation, is mapped back to the real-valued space through a fully connected layer to obtain a temporal feature representation.

[0056] Example 5, see Figure 1 and Figure 2 This embodiment is based on the above embodiment. The set-top box operation simulation model design module is designed to address the sequential dependency characteristics of set-top box security time-series data. It designs a corner cost loss function and forces the model to learn the true temporal dynamics by constraining the simulation behavior where the simulation value approaches the value of the previous time step, rather than simply replicating historical values. Specifically, it includes:

[0057] The deviation of the projected amplitude, SD, is calculated and expressed as follows: ;in, These are the measured values ​​of the data at time t, and the measured values ​​under normal conditions. It is the extrapolated value of the data at time t;

[0058] Calculate the distance JD between the measured value and the projected value at the previous moment, and introduce a time-series distance parameter d that reflects the data's own stride, so that set-top box data with different fluctuation amplitudes can be compared in direction deviation within a unified framework, expressed as: ; These are the measured values ​​of the data generated at time t-1.

[0059] The distance PD from the previous measured value to the current measured value is calculated, reflecting the natural changes of the set-top box on the time axis, and is expressed as: ;

[0060] The temporal distance parameter design uses the average absolute error between adjacent time points of the normal-state data in the running dataset to reflect the average variation step of the set-top box data under natural conditions, thus matching the geometric metric with the actual data scale, expressed as: N represents the total number of running data points, with each sampling time corresponding to one running data point.

[0061] Calculate the degree of trend change Based on the temporal slope changes of three sampling periods before and after time t, the degree of trend abrupt change is quantified (adapting to the low computing power of set-top boxes, only the difference between adjacent time periods is used), and expressed as: ; These are the measured values ​​of the data generated at time t-2;

[0062] Calculate the attack sensitivity coefficient Introducing a mutation threshold (The value is taken as the 90th percentile of the normal state of the running dataset), design nonlinear weighting coefficients, expressed as: ; It is the saturation coefficient, which controls the nonlinear variation of the weighting coefficient, and its value is 1.5~2.5.

[0063] By performing the above operations, this solution addresses the problem that general set-top box terminal security monitoring systems cannot capture the true gradual change patterns of the set-top box and do not consider the differences in abnormal risks under different trend states, resulting in poor early warning effects for abnormal changes. Instead, this solution introduces Euler's formula to transform biphasic characteristics, thereby designing a biphasic activation function that simultaneously captures static and dynamic information, achieving a coupled representation of the set-top box's amplitude and phase. Based on the degree of trend change, an attack sensitivity coefficient is designed to focus on trend deviations at the critical moment of an attack, weakening interference from post-attack contamination data, distinguishing different trend states, reducing false alarm rates, and improving early warning effects at the moment of attack changes.

[0064] Example 6, see Figure 1 and Figure 2 Based on the above embodiments, the set-top box operation simulation model design module further includes:

[0065] The corner cost loss function is designed by using the angle formed by the previous measured value, the current measured value, and the current inferred value as the constraint object, with the current measured value as the vertex. The larger the angle, the more the inferred direction deviates from the true trend. The attack sensitivity coefficient is used as a nonlinear weighting coefficient to obtain the corner cost loss function. , is represented as: The inconsistency between the trajectory direction used for quantification prediction and the actual trajectory direction;

[0066] The attack sensitivity coefficient is incorporated as a weight term into the corner cost loss function, allowing the model to learn the temporal patterns of different operating stages of the set-top box with a focus; it can achieve unbiased learning that focuses on critical attack moments, normal moments, and weakens attack contamination moments;

[0067] The model architecture design of the set-top box operation simulation model is a lightweight time series simulation model. Its core objective is to infer the normal state data of the next time step from the current operation data. It consists of five core layers: feature input layer, dual-band feature extraction layer, dual-mapping shaping layer, time series simulation layer (which uses gated linear units to capture time series feature dependencies and maps features to normal state simulation values ​​of the next time step), and loss calculation layer. It completes the entire link from end to end: input → feature extraction → dual-phase enhancement → time series simulation → loss optimization.

[0068] Example 7, see Figure 1 This embodiment is based on the above embodiment. The situational shift optimization module addresses the distribution offset problem caused by set-top box system upgrades and network topology changes. It designs a timing deviation loss function and learns the intrinsic patterns of data rather than the surface distribution by optimizing the correlation of time-series characteristics rather than directly inferring errors. Specifically, it includes:

[0069] Delay factor calculation is used because set-top box security monitoring often faces the problem of multiple mixed indicators and difficulty in judging single-point anomalies. Therefore, by designing a delay factor to learn cross-indicator rules, it is possible to provide early warning of possible chain anomalies and improve the monitoring foresight. Let there be M security indicators for the set-top box, and the delay order be... The delay factor is expressed as: ;in, It is a delay factor, representing the degree of correlation between indicator p and indicator q at the next τ steps; It is the covariance; Var(·) is the variance; and These are the values ​​of index p and index q at the corresponding sampling times, respectively;

[0070] The timing deviation loss function is designed to address the issue that set-top box system upgrades, network rerouting, or service switching can cause the distribution of training data to drift away from that of real data. Therefore, the timing deviation loss function optimizes the fidelity of the model's output sequence relative to the real sequence in terms of the delay factor, ensuring that predictions can still be made based on the law even when the distribution changes. Represented as: M represents the number of safety indicators. This is the maximum delay order, with a value ranging from 5 to 60; It is a delay factor obtained based on the model output;

[0071] The total loss design, in the set-top box operation simulation model, is the weighted sum of the simulation loss and the timing deviation loss, expressed as: ; and These are the loss weighting coefficients, with values ​​ranging from 0.6 to 0.9 and from 0.1 to 0.4, respectively.

[0072] Learning the intrinsic correlation patterns between indicators, rather than specific numerical distributions, provides strong robustness to distribution shifts caused by system upgrades and network changes; it can discover hidden correlation patterns between set-top box security indicators; and it enhances the model's generalization ability under unknown attack scenarios.

[0073] By performing the above operations, this solution addresses the problems of poor measurement of predicted trajectory direction deviation and low robustness to distribution drift caused by set-top box system upgrades and network changes, which lead to poor security monitoring reliability in general set-top box terminal security monitoring systems. This is achieved by constructing a corner cost loss function to constrain the correctness of the inferred direction, forcing the model to learn the true trend direction, preventing the mechanical replication of historical values, and improving the attack detection rate. Furthermore, by introducing a delay factor to design a quasi-bias loss, and learning cross-signal rules, this solution can detect chain anomalies in advance, aligning with the security situation awareness of multiple coupled indicators in set-top boxes. Ultimately, this improves the reliability of set-top box terminal security monitoring.

[0074] Example 8, see Figure 1 This embodiment is based on the above embodiment. The real-time set-top box terminal security monitoring module deploys the trained set-top box operation simulation model to the set-top box terminal to perform security monitoring on the real-time collected set-top box terminal operation data; the specific operation is as follows:

[0075] Based on real-time collected set-top box terminal operating data and the current-moment normal-state projection value output by the model, the deviation is calculated. , is represented as: ;

[0076] Mean of statistical residuals based on sliding window and standard deviation Set dynamic threshold , is represented as: ; This is the sensitivity coefficient, with a value ranging from 2 to 4;

[0077] If the residual exceeds the threshold when executing the anomaly detection rules, an alert is triggered, as shown below: ; This is an abnormal detection result; 1 corresponds to an alert.

[0078] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention.

[0079] The present invention and its embodiments have been described above. This description is not restrictive, and the accompanying drawings are only one embodiment of the present invention; the actual structure is not limited thereto. In conclusion, if those skilled in the art are inspired by this description and design similar structures and embodiments without departing from the spirit of the invention, such designs should fall within the protection scope of the present invention.

Claims

1. A set-top box terminal security monitoring system based on artificial intelligence, characterized in that: The system includes a running data acquisition module, a dual-band feature extraction layer module, a dual-image shaping layer module, a set-top box operation simulation model design module, a situational change optimization module, and a real-time set-top box terminal security monitoring module; The operation data acquisition module obtains historical set-top box terminal operation data and constructs an operation dataset. The dual-band feature extraction layer module extracts low-frequency trend features and high-frequency fluctuation features from the running data; The dual-band shaping layer module concatenates the dual-band features, maps them through a fully connected layer, processes them through an activation function, and maps them again to obtain enhanced temporal features. The set-top box operation simulation model design module is based on the dual-band feature extraction layer and dual-image shaping layer module, constructs the corner cost loss function, and designs the set-top box operation simulation model; The situational change optimization module designs a delay factor and a time accuracy deviation loss function to optimize the loss function of the set-top box operation simulation model for situational change. The real-time set-top box terminal security monitoring module performs security monitoring on the real-time collected set-top box terminal operation data based on the set-top box operation simulation model; The dual-image shaping layer module specifically includes: Biphase mapping involves stitching together the features of two frequency bands and then mapping them to a biphase space through a fully connected layer. The design of the biphase activation function involves introducing Euler's formula to design the biphase activation function, decomposing the biphase into the modulus and argument, and then synthesizing the biphase output. The feature output, after activation, is mapped back to the real-valued space through a fully connected layer to obtain the temporal feature representation; The corner cost loss function takes the angle formed by the previous measured value, the current measured value, and the current inferred value as the constraint object, designs an attack sensitivity coefficient based on the degree of trend change, focuses on the trend deviation at the critical moment of attack, and uses the attack sensitivity coefficient as a nonlinear weighting coefficient to obtain the corner cost loss function. The delay factor calculation is performed by designing a delay factor to learn cross-signal rules; assuming the set-top box has M security indicators, and the delay order is... The delay factor is expressed as: ;in, It is a delay factor, representing the degree of correlation between indicator p and indicator q at the next τ steps; It is the covariance; Var(·) is the variance; and These are the values ​​of index p and index q at the corresponding sampling times, respectively; The timing deviation loss function design optimizes the fidelity of the model output sequence and the real sequence in terms of delay factor by using the timing deviation loss function.

2. The set-top box terminal security monitoring system based on artificial intelligence according to claim 1, characterized in that: The set-top box operation simulation model design module specifically includes: The deviation of the projected amplitude, SD, is calculated and expressed as follows: ;in, These are the measured values ​​of the data at time t, and the measured values ​​under normal conditions. It is the extrapolated value of the data at time t; Calculate the distance JD between the measured value and the projected value at the previous moment, and introduce a time-series distance parameter d that reflects the data's own stride, allowing set-top box data with different fluctuation amplitudes to be compared in direction deviation within a unified framework, expressed as: ; These are the measured values ​​of the data generated at time t-1; The distance PD from the previous measured value to the current measured value is calculated, reflecting the natural changes of the set-top box on the time axis, and is expressed as: ; The temporal distance parameter design uses the average absolute error between adjacent time points of the normal-state data in the running dataset to reflect the average variation step of the set-top box data under natural conditions, thus matching the geometric metric with the actual data scale, expressed as: N represents the total number of running data points, with each sampling time corresponding to one running data point. Calculate the degree of trend change Based on the temporal slope changes of the three sampling periods before and after time t, the degree of trend abrupt change is quantified and expressed as: ; These are the measured values ​​of the data generated at time t-2; Introducing mutation threshold Calculate the attack sensitivity coefficient , represented as: ; It is the saturation coefficient, which controls the nonlinear variation of the weighting coefficients; The corner cost loss function is designed by taking the angle formed by the previous measured value, the current measured value, and the current inferred value as the constraint object, and using the attack sensitivity coefficient as a nonlinear weighting coefficient, resulting in the corner cost loss function, expressed as: ; The core objective of the set-top box operation simulation model is to infer the normal state data of the next moment from the current operation data. It consists of five core layers: feature input layer, dual-band feature extraction layer, dual-image shaping layer, time series simulation layer, and loss calculation layer.

3. The set-top box terminal security monitoring system based on artificial intelligence according to claim 2, characterized in that: The aforementioned situational change optimization module specifically includes: Delay factor calculation; The timing bias loss function is designed to optimize the fidelity between the model's output sequence and the true sequence in terms of delay factor. Represented as: M represents the number of safety indicators. It is the maximum delay order; It is a delay factor obtained based on the model output; The total loss design, in the set-top box operation simulation model, is the weighted sum of the simulation loss and the timing deviation loss, expressed as: ; and It is the loss weight coefficient; used to optimize the loss function of the set-top box operation simulation model based on situational changes.

4. The set-top box terminal security monitoring system based on artificial intelligence according to claim 3, characterized in that: The operational data acquisition module obtains historical set-top box terminal operational data, deploys a lightweight data acquisition agent through the set-top box terminal, and collects security indicators during normal operation; the acquired data is preprocessed, including missing value filling, outlier removal, and data standardization; And define normal state labels, and use the measured values ​​at the next time step as training labels; Obtain the running dataset.

5. The set-top box terminal security monitoring system based on artificial intelligence according to claim 4, characterized in that: The dual-band feature extraction layer module specifically includes: For the running dataset, low-frequency trend features are preserved based on a low-pass filter; High-frequency fluctuations are preserved based on high-pass filters.

6. The set-top box terminal security monitoring system based on artificial intelligence according to claim 5, characterized in that: The real-time set-top box terminal security monitoring module deploys the trained set-top box operation simulation model to the set-top box terminal and performs security monitoring on the real-time collected set-top box terminal operation data.

Images