Smart home system abnormity tracing method and device based on cross-layer association reasoning

Abstract

The invention relates to the technical field of household system abnormity traceability, in particular to an intelligent household system abnormity traceability method and device based on cross-layer association reasoning, and the method comprises the steps: constructing an application-level and network-level behavior dependence graph; executing a cross-layer graph alignment strategy on the two types of graphs, establishing a cross-layer consistency semantic link, marking verification result features, and generating a feature enhanced network and application behavior graph; converting the network and application behavior maps into a structured fact library by utilizing fact codes, and deducing a cross-layer abnormal propagation path and a potential root cause; and converting into newly added semantic nodes and relation edges in the application behavior map, and finally generating a global traceability map fusing double-layer semantics and completely describing system behaviors and an abnormal propagation chain. Therefore, the problems that in the related technology, due to the fact that a cross-layer causal relationship is missing, a serious blind area exists in the coverage range of anomaly detection, misjudgment of a problem source can be caused, and positioning of a system fault is affected are solved.

Description

Technical Field

[0001] This application relates to the field of anomaly tracing technology in home systems, and in particular to a method and apparatus for anomaly tracing in smart home systems based on cross-layer correlation reasoning. Background Technology

[0002] Internet of Things (IoT) systems perceive their environment through distributed sensors and smart devices, and rely on high-level automated decision-making logic to achieve intelligent management. Among these, device-generated events serve as core carriers of state information and are crucial for system perception and control. However, abnormal events (such as erroneous event injection caused by device failure or malicious attacks) can easily trigger cascading errors in system logic, leading to uncontrollable behavior and seriously threatening system security and reliability.

[0003] Among the relevant technologies, the current mainstream diagnostic and tracing methods are mainly of two types. One type of method relies on instrumenting the application layer program of the smart home platform, while the other type of method attempts to directly parse the platform logs and infer the event correlation based on the time sequence characteristics.

[0004] However, related technologies that rely on instrumenting application-layer programs of smart home platforms, while capturing control flow dependencies within and between applications, completely ignore the true patterns of underlying network interactions—because application-layer data objects are essentially derived representations of underlying network activities. Directly parsing platform logs and inferring event correlations based on time-series characteristics fails to identify false events, and the analysis results are easily affected by log noise and difficult to establish causal confirmation. The core flaw of these methods lies in the lack of a unified observation perspective on the cross-layer states of the system and the invisibility of key system states and interactions. Therefore, they cannot effectively model, identify, and correlate causal chains across the network layer (actual communication patterns between devices) and the application layer (automation logic control flow). They are ill-equipped to handle the inherent multi-layered and highly interactive complexity of modern IoT systems (especially smart home and industrial IoT). The lack of understanding of global system behavior, particularly cross-layered anomaly propagation paths, in traditional fault diagnosis methods has become a key bottleneck restricting the security and maintainability of complex IoT systems.

[0005] Therefore, there is an urgent need for a source tracing analysis method that can break through the limitations of a single level and integrate network layer interaction and application layer logic. Summary of the Invention

[0006] This application provides a method and apparatus for tracing the source of anomalies in a smart home system based on cross-layer correlation reasoning, in order to solve the problems in related technologies, such as the lack of cross-layer causal relationships, which leads to serious blind spots in the coverage of anomaly detection (unable to capture anomalies originating from or propagating through the network layer), and can also cause misjudgment of the root cause of the problem, affecting the location of system faults.

[0007] The first aspect of this application provides a method for anomaly tracing in a smart home system based on cross-layer association reasoning, comprising the following steps: capturing key event sequences describing application-level real-time behavior and extracting key data dependencies to construct an application-level behavior graph representing application logical associations and entity temporal evolution associations; collecting all network communication traffic within the smart home system to segment network events and reconstructing the interaction behavior patterns between smart home system devices using a preset network behavior association model to construct a network-level behavior dependency graph; and executing the method based on a pre-built mapping knowledge base constructed from the characteristics of specific network flow patterns corresponding to the target application state or activity. The application-level behavior dependency graph and the network-level behavior dependency graph are aligned across layers using a cross-layer graph alignment strategy. Cross-layer consistent semantic links are established and verification result features are labeled to obtain feature-enhanced network behavior graphs and application behavior graphs. Fact encoding is used to transform the network behavior graph and the application behavior graph into a structured fact base to deduce cross-layer anomaly propagation paths and potential root causes. Based on the cross-layer anomaly propagation paths and potential root causes, they are transformed into newly added semantic nodes and relational edges in the application behavior graph to generate a global source graph that integrates two layers of semantics and fully describes system behavior and anomaly propagation chains, thereby determining the anomaly source tracing results of the smart home system.

[0008] Through the above technical solutions, the embodiments of this application can first construct application-level and network-level behavioral dependency graphs respectively, and establish cross-layer consistent semantic links between the two graphs. This generates a global source graph that integrates dual-layer semantics and fully depicts system behavior and anomaly propagation chains. This ensures that, while maintaining the complete representation of smart home system behavior, it can accurately identify, track, and explicitly present anomaly propagation paths and causal relationships across the network layer and application layer, breaking through the limitations of a single layer and providing highly interpretable, fine-grained anomaly diagnosis capabilities for complex IoT systems.

[0009] Optionally, in one embodiment of this application, capturing key event sequences describing application-level real-time behavior and extracting key data dependencies to construct an application-level behavior dependency graph representing application logic associations and entity temporal evolution associations includes: extracting control logic and data dependencies during the runtime of the smart home system application layer to generate the key event list; processing the key event list to obtain the key data dependencies, and generating the application-level behavior dependency graph based on a preset application-level behavior association model.

[0010] By extracting runtime control logic and transforming it into a list of key events, the previously implicit logic can be converted into a structured event flow, allowing developers, operations personnel, or users to intuitively understand "how the system responds to instructions and how it executes linkages." Further processing of the key event list allows for the explicit extraction of the "event-data-dependency" relationships, forming a structured data dependency network. This process exposes hidden dependencies, preventing linkage failures caused by "ignoring certain data dependencies." The graph visually presents the entire link between "user-scene-device-sensor," upgrading system behavior from "fragmented events" to a "structured network" for intuitive visualization.

[0011] Optionally, in one embodiment of this application, the step of collecting all network communication traffic within the smart home system to segment network events and reconstructing the interaction behavior patterns between smart home system devices using a preset network behavior association model to construct a network-level behavior dependency graph includes: filtering continuous network events with identical data packet length sequences for the same subject and object devices within a short time window to obtain a redundantly filtered list of network events; and constructing the network-level behavior dependency graph based on the redundantly filtered list of network events.

[0012] By using the above technical solutions, filtering redundant network events can reduce the amount of data and lower storage costs, thereby simplifying the graph structure and highlighting the dependencies of core network behaviors.

[0013] Optionally, in one embodiment of this application, the step of executing the cross-layer graph alignment strategy corresponding to the application-level behavior dependency graph and the network-level behavior dependency graph based on a pre-constructed mapping knowledge base corresponding to specific network flow pattern characteristics of the target application state or activity, establishing cross-layer consistent semantic links, and labeling verification result features to obtain feature-enhanced network behavior graphs and application behavior graphs includes: constructing a matching fingerprint database to implement cross-layer semantic links; and constructing an expected behavior baseline model based on the matching fingerprint database to perform collaborative enhancement and logical error correction on the network behavior graph and application behavior graph.

[0014] Through the above technical solutions, the embodiments of this application can construct a matching fingerprint database to implement cross-layer semantic links, thereby eliminating semantic fragmentation between layers and forming a "behavior-support" correspondence between the originally independent two-layer graphs. The information of the network layer and the application layer is naturally complementary. The network layer can capture the "actual execution path of the behavior", and the application layer can interpret the "intent and logic of the behavior". Through the synergistic enhancement of cross-layer links, the information gaps at a single level can be filled. Furthermore, cross-layer association can be carried out based on the expected behavior baseline model, thereby defining the "complete logical chain of normal behavior" to ensure the error correction effect.

[0015] Optionally, in one embodiment of this application, the step of converting the abnormal propagation path and potential root causes into newly added semantic nodes and relational edges in the application behavior graph to generate a global source graph that integrates two layers of semantics and fully describes the system behavior and abnormal propagation chain, and to determine the source tracing result of the smart home system anomalies, includes: mapping the logical rule output to the newly added semantic nodes or relational edges in the application behavior graph based on a preset cross-layer semantic transformation framework, so as to generate the global source graph that integrates two layers of semantics.

[0016] Through the above technical solutions, the embodiments of this application can achieve a leap from "loose association" to "deep coupling" of two-layer semantics, from "local fragments" to "full-link penetration" of traceability capabilities, and from "abstract and obscure" to "structured reuse" of rule application through semantic standardization of a preset framework → graph mapping of logical rules → dynamic fusion of the global graph. As a result, the final generated global traceability graph is not only a "recorder of system behavior" but also a "navigation map for anomaly analysis" and a "data source for automated decision-making," providing "explainable, traceable, and evolvable" core support for the reliability assurance and security protection of complex systems.

[0017] A second aspect of this application provides an anomaly tracing device for a smart home system based on cross-layer association reasoning, comprising: a first construction module, used to capture key event sequences describing application-level real-time behavior and extract key data dependencies to construct an application-level behavior dependency graph representing application logical associations and entity temporal evolution associations; a second construction module, used to collect all network communication traffic within the smart home system to segment network events and reconstruct the interaction behavior patterns between smart home system devices using a preset network behavior association model to construct a network-level behavior dependency graph; and a generation module, used to generate a mapping knowledge base pre-built based on the characteristics of specific network flow patterns corresponding to target application states or activities. The system executes cross-layer graph alignment strategies corresponding to the application-level behavior dependency graph and the network-level behavior dependency graph, establishes cross-layer consistent semantic links, and labels verification result features to obtain feature-enhanced network behavior graphs and application behavior graphs. A derivation module is used to transform the network behavior graph and the application behavior graph into a structured fact base using fact encoding to deduce cross-layer anomaly propagation paths and potential root causes. A source tracing module is used to transform the cross-layer anomaly propagation paths and potential root causes into newly added semantic nodes and relational edges in the application behavior graph, generating a global source tracing graph that integrates two layers of semantics and fully characterizes system behavior and anomaly propagation chains, thus determining the anomaly source tracing results of the smart home system.

[0018] Through the above technical solutions, the embodiments of this application can first construct application-level behavior dependency graphs and network-level behavior dependency graphs respectively, and establish cross-layer consistent semantic links between the two graphs. This generates a global tracing graph that integrates dual-layer semantics and fully depicts system behavior and anomaly propagation chains. This ensures that, while maintaining the complete representation of smart home system behavior, it can accurately identify, track, and explicitly present anomaly propagation paths and causal relationships across the network layer and application layer, breaking through the limitations of a single layer and providing highly interpretable, fine-grained anomaly diagnosis capabilities for complex IoT systems.

[0019] Optionally, in one embodiment of this application, the first construction module includes: a first generation unit, used to extract the control logic and data dependencies of the smart home system at the application layer runtime, and generate the key event list; and a second generation unit, used to process the key event list, obtain the key data dependencies, and generate the application-level behavior dependency graph based on a preset application-level behavior association model.

[0020] By extracting runtime control logic and transforming it into a list of key events, the previously implicit logic can be converted into a structured event flow, allowing developers, operations personnel, or users to intuitively understand "how the system responds to commands and how it executes linkages." Further processing of the key event list allows for the explicit extraction of the "event-data-dependency" relationships, forming a structured data dependency network. This process exposes hidden dependencies, preventing linkage failures caused by "ignoring certain data dependencies." The graph visually presents the entire link of "user-scene-device-sensor," upgrading system behavior from "fragmented events" to a "structured network" for intuitive visualization.

[0021] Optionally, in one embodiment of this application, the second construction module includes: a filtering unit, used to filter consecutive network events with completely identical data packet length sequences within a short time window for the same subject and object devices, to obtain a redundantly filtered list of network events; and a first construction unit, used to construct the network-level behavioral dependency graph based on the redundantly filtered list of network events.

[0022] By using the above technical solutions, filtering redundant network events can reduce the amount of data and lower storage costs, thereby simplifying the graph structure and highlighting the dependencies of core network behaviors.

[0023] Optionally, in one embodiment of this application, the generation module includes: a second construction unit for constructing a matching fingerprint database to implement cross-layer semantic links; and a third construction unit for constructing an expected behavior baseline model based on the matching fingerprint database to perform collaborative enhancement and logical error correction on the network behavior graph and the application behavior graph.

[0024] Through the above technical solutions, the embodiments of this application can construct a matching fingerprint database to implement cross-layer semantic links, thereby eliminating semantic fragmentation between layers and forming a "behavior-support" correspondence between the originally independent two-layer graphs. The information of the network layer and the application layer is naturally complementary. The network layer can capture the "actual execution path of the behavior", and the application layer can interpret the "intent and logic of the behavior". Through the synergistic enhancement of cross-layer links, the information gaps at a single level can be filled. Furthermore, cross-layer association can be carried out based on the expected behavior baseline model, thereby defining the "complete logical chain of normal behavior" to ensure the error correction effect.

[0025] Optionally, in one embodiment of this application, the tracing module includes: a third generation unit, used to map the logical rule output to the newly added semantic nodes or relation edges in the application behavior graph based on a preset cross-layer semantic transformation framework, so as to generate the global tracing graph that integrates two layers of semantics.

[0026] Through the above technical solutions, the embodiments of this application can achieve a leap from "loose association" to "deep coupling" of two-layer semantics, from "local fragments" to "full-link penetration" of traceability capabilities, and from "abstract and obscure" to "structured reuse" of rule application through semantic standardization of a preset framework → graph mapping of logical rules → dynamic fusion of the global graph. As a result, the final generated global traceability graph is not only a "recorder of system behavior" but also a "navigation map for anomaly analysis" and a "data source for automated decision-making," providing "explainable, traceable, and evolvable" core support for the reliability assurance and security protection of complex systems.

[0027] A third aspect of this application provides an electronic device, including: a memory, a processor, and a computer program stored in the memory and executable on the processor. The processor executes the program to implement the anomaly tracing method for smart home systems based on cross-layer association reasoning as described in the above embodiments.

[0028] A fourth aspect of this application provides a non-volatile computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described method for tracing anomalies in a smart home system based on cross-layer association reasoning.

[0029] A fifth aspect of this application provides a computer program product that stores a computer program that, when executed by a processor, implements the above-described method for tracing anomalies in a smart home system based on cross-layer association reasoning.

[0030] Additional aspects and advantages of this application will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of this application. Attached Figure Description

[0031] The above and / or additional aspects and advantages of this application will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein: Figure 1 This is a flowchart of an anomaly tracing method for a smart home system based on cross-layer association reasoning, according to an embodiment of this application. Figure 2 This is a schematic diagram illustrating the principle of an application-level behavior dependency graph construction method based on an application-level behavior association model according to a specific embodiment of this application; Figure 3 This is a flowchart illustrating the principle of a network-level behavior dependency graph construction method based on a network behavior association model according to a specific embodiment of this application. Figure 4 This is a schematic diagram illustrating the principle of a network-level behavior dependency graph construction method based on a network behavior association model according to a specific embodiment of this application; Figure 5 This is a flowchart of the overall algorithm for behavior correction based on an application behavior graph according to a specific embodiment of this application; Figure 6 is a flowchart illustrating the principle of an application-level behavior dependency graph logic error correction method according to a specific embodiment of this application; Figure 7 This is a schematic diagram illustrating the design principle of a logic programming rule according to a specific embodiment of this application; Figure 8 This is a schematic diagram of the structure of an anomaly tracing device for a smart home system based on cross-layer association reasoning according to an embodiment of this application; Figure 9 This is a schematic diagram of the structure of an electronic device provided according to an embodiment of this application. Detailed Implementation

[0032] The embodiments of this application are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain this application, and should not be construed as limiting this application.

[0033] The following describes, with reference to the accompanying drawings, an embodiment of the present application of an anomaly tracing method and apparatus for smart home systems based on cross-layer correlation reasoning. Addressing the issues raised in the background section regarding the lack of cross-layer causal relationships in related technologies, which leads to severe blind spots in anomaly detection coverage (failure to capture anomalies originating from or propagating through the network layer), and further causes misjudgments of the root cause of problems, affecting the localization of system faults, this application provides an anomaly tracing method for smart home systems based on cross-layer correlation reasoning. In this method, application-level behavioral dependency graphs and network-level behavioral dependency graphs representing application logical relationships and entity temporal evolution relationships can be constructed respectively. Cross-layer consistent semantic connections between the two graphs are then established, and verification result features are labeled to generate network behavior and application behavior graphs. These are further transformed into a structured fact base to deduce anomaly propagation paths and potential root causes, thereby generating a global tracing graph that integrates dual-layer semantics and fully characterizes system behavior and anomaly propagation chains, determining the anomaly tracing result of the smart home system. This method, by integrating network layer interaction patterns and application layer control logic, explicitly reconstructs the implicit cross-layer anomaly propagation chain, achieving highly interpretable and fine-grained root cause diagnosis of abnormal system behavior. This solves the problems in related technologies where the lack of cross-layer causal relationships leads to severe blind spots in anomaly detection coverage (failing to capture anomalies originating from or propagating through the network layer), and can even cause misjudgments of the root cause, affecting the localization of system faults.

[0034] Specifically, Figure 1 This is a flowchart illustrating an anomaly tracing method for a smart home system based on cross-layer association reasoning, provided in an embodiment of this application.

[0035] like Figure 1 As shown, this method for tracing anomalies in smart home systems based on cross-layer correlation reasoning includes the following steps: In step S101, key event sequences describing application-level real-time behavior are captured, and key data dependencies are extracted to construct an application-level behavior dependency graph that represents application logical associations and entity temporal evolution associations.

[0036] Application-level knowledge graphs are knowledge graphs designed for specific application scenarios. Based on domain knowledge, they structure and describe entities, attributes, relationships, and rules in a specific domain to form a logically clear, hierarchical, and closely related knowledge system.

[0037] In actual implementation, the embodiments of this application can capture key event sequences describing application-level real-time behavior through smart home platform instrumentation technology, extract key data dependencies including device state changes, user command execution, and automated rule triggering, and construct an application-level graph representing application logic associations and entity temporal evolution associations.

[0038] Compared to general knowledge graphs, application-level knowledge graphs focus more on specific vertical fields, possess deeper professional knowledge and greater applicability, and can better meet the traceability needs of smart furniture systems.

[0039] Optionally, in one embodiment of this application, capturing key event sequences describing application-level real-time behavior and extracting key data dependencies to construct an application-level graph representing application logic associations and entity temporal evolution associations includes: extracting control logic and data dependencies during the runtime of the smart home system application layer to generate a list of key events; processing the list of key events to obtain key data dependencies, and generating an application-level behavior dependency graph based on a preset application-level behavior association model.

[0040] As one possible approach, embodiments of this application can define an application-level behavior association model; through instrumentation technology, the control logic and data dependencies of the smart home system application layer during runtime are dynamically extracted to generate a list of key application-level events; the application log analysis module receives and processes the event list, and dynamically generates an application-level behavior dependency graph based on the application-level behavior association model. .

[0041] Specifically, this application proposes an application-level behavior association model that extends the W3C PROV-DM model. This model can record and analyze the driving mechanism of events, and details how to track device state changes, control command execution and their downstream dependencies.

[0042] This behavioral association model contains three types of nodes: 1) Entity represents a data object; 2) Activity, representing the program (application control logic); 3) The responsible party for the Agent, Entity, and Activity.

[0043] The specific content and examples are shown in Table 1, which is the design of the application layer behavior dependency graph nodes.

[0044] Table 1

[0045] Furthermore, the above model encodes the relationship between execution logic and device state transitions into different types of edges, as shown in Table 2. Table 2 shows the edge design of the application layer behavior dependency graph.

[0046] Table 2

[0047] This model allows for the dynamic tracking of device state evolution and operational dependencies within an application, providing a foundation for subsequent log analysis and dependency graph generation.

[0048] Furthermore, such as Figure 2 As shown, this application embodiment can apply the instrumentation technology to a smart home platform to collect data and events during actual operation and dynamically generate a list of key application events. and iterate through For each event, a graph is analyzed and dynamically generated. .

[0049] By extracting runtime control logic and transforming it into a list of key events, the previously implicit logic can be converted into a structured event flow, allowing developers, operations personnel, or users to intuitively understand "how the system responds to instructions and how it executes linkages." After processing the list of key events, the "event-data-dependency" relationship can be clearly extracted, forming a structured data dependency network. This process can expose hidden dependencies and avoid linkage failures caused by "ignoring certain types of data dependencies." The graph presents the full-link relationship of "user-scene-device-sensor" in a visual way, upgrading system behavior from "fragmented events" to a "structured network" for intuitive display.

[0050] In step S102, all network communication traffic within the smart home system is collected to segment network events, and the interaction behavior patterns between smart home system devices are reconstructed using a preset network behavior association model to build a network-level behavior dependency graph.

[0051] Understandably, a "network-level behavioral dependency graph" is a tool that uses a graph structure (nodes + edges) to model and visualize the behavior and interdependencies of various entities (such as devices, services, and traffic) in a network. It focuses on the macro-level network, revealing the logical connections between different network entities in data transmission, service calls, and resource interactions. It is an important means of understanding network operation patterns, troubleshooting, and detecting anomalies.

[0052] In practical implementation, this application embodiment can deploy network traffic monitoring probes to collect all network communication traffic within the smart home system in real time for network event segmentation. Furthermore, based on a network behavior association model, it can reconstruct the interaction behavior patterns between smart home system devices and construct a network-level behavior dependency graph. .

[0053] The smart home network-level behavioral dependency graph, constructed through a pre-defined network behavior association model, can essentially be understood as transforming "disordered device interactions" into "controllable, visible, and analyzable structured relationships." Its technical effects cover core dimensions such as system operation and maintenance (fault diagnosis), security protection (anomaly detection), user experience (scene optimization), and intelligent upgrades (data support), ultimately enabling smart home systems to advance from "passive response" to "active perception and adaptive optimization."

[0054] Optionally, in one embodiment of this application, all network communication traffic within the smart home system is collected to segment network events, and the interaction behavior patterns between smart home system devices are reconstructed using a preset network behavior association model to construct a network-level behavior dependency graph. This includes: filtering continuous network events with identical data packet length sequences for the same subject and object devices within a short time window to obtain a redundantly filtered list of network events; and constructing a network-level behavior dependency graph based on the redundantly filtered list of network events.

[0055] As one feasible approach, this application proposes a version control-based smart home network behavior tracing model. This model achieves efficient tracing of network events by accurately modeling the temporal dependencies between device interactions, ultimately outputting a network-level behavior dependency graph. .

[0056] Specifically, embodiments of this application may employ a network flow segmentation method combining bidirectional 5-tuple identifiers (source / destination IP addresses, source / destination port numbers, and communication protocols) with a sliding time window to generate a set of network events. Define time threshold A network flow is a set of consecutive data packets with bidirectional 5-tuple identifiers within an interval, representing a discrete network event. :

[0057] in, Representing network events respectively The subject (initiating device, corresponding to the source IP entity of the first packet of the network flow) and the object (responding device, corresponding to the destination IP entity of the first packet) of the corresponding network flow communication. These are the start and end timestamps of the network stream, respectively. This is a sequence of signed data packet lengths: the length value is positive when the device is the subject, and negative otherwise. For example, if... This indicates that the smart home device first sent a 123-byte data packet and then received a 96-byte data packet.

[0058] Furthermore, embodiments of this application propose a network-level tracing model, where the network behavior dependency graph is represented as follows: ,in, For a set of device nodes, ,have ,in, This is the version number of the device node, used to distinguish the state of the same device at different times; It represents network events The set of directed edges; and It is the set of directed edges that connect adjacent version nodes of the same device.

[0059] This application embodiment first filters the data packet length sequence of the same subject and object devices within a short time window (e.g., 10 seconds). Completely consistent continuity A list of network events based on redundancy filtering The specific process of constructing a network graph behavior dependency graph is as follows: Figure 3 As shown, the construction principle is as follows Figure 4 As shown, the specific build process can be summarized as follows: In response to new network incidents Network activity dependency graph First determine its communication subject. ,object If the corresponding node already exists, confirm it as the starting point of the new directed edge; otherwise, create it. Version=0 Nodes serve as the starting point; similarly, object nodes are processed, and if they exist, they are created. Version+1 The node serves as the endpoint; if it does not exist, it is created. Version=0 The nodes serve as endpoints; finally, directed edges connecting the start and end points are used to represent network events, updating the network-level behavior dependency graph. .

[0060] By using the above technical solutions, filtering redundant network events can reduce the amount of data and lower storage costs, thereby simplifying the graph structure and highlighting the dependencies of core network behaviors.

[0061] In step S103, based on the mapping knowledge base pre-built from the specific network flow pattern characteristics corresponding to the target application state or activity, the cross-layer graph alignment strategy corresponding to the application-level behavior dependency graph and the network-level behavior dependency graph is executed to establish cross-layer consistent semantic links and mark the verification result features, so as to obtain the feature-enhanced network behavior graph and application behavior graph.

[0062] Network behavior maps and application behavior maps are structured analysis tools that describe system behavior at different levels. The former focuses on the interaction relationships at the network layer, while the latter focuses on the business logic and behavioral patterns at the application layer. While there are clear hierarchical differences between the two, they are also interconnected, jointly supporting a comprehensive understanding of complex smart home systems.

[0063] Based on the above steps, an application-level behavioral dependency graph representing application logical relationships and entity temporal evolution relationships is constructed. and network-level behavioral dependency graphs Subsequently, embodiments of this application can further pre-build a mapping knowledge base based on the characteristics of specific network flow patterns corresponding to specific application states / activities, and then execute... and A cross-layer graph alignment algorithm is used to establish cross-layer consistent semantic links and label the features of the verification results; for the verified... Based on application-level expected behavior model Implement system behavior correction—introduce prediction nodes and error correction edges to reveal the deviations between actual behavior and expectations at the causal, temporal, and logical levels; ultimately output a feature-enhanced network behavior graph. and application behavior mapping .

[0064] After constructing application-level and network-level graphs respectively, the two graphs are further aligned across layers to establish consistent semantic links across layers. This approach can effectively break down the semantic barriers between the application layer and the network layer, thereby enabling the scattered graph information to form an organic whole. It solves the traditional problem of "the application layer only looks at business and the network layer only looks at traffic," allowing developers and operations personnel to understand the system from the full-link perspective of "business intent → network implementation."

[0065] Optionally, in one embodiment of this application, based on a mapping knowledge base pre-built from the characteristics of specific network flow patterns corresponding to the target application state or activity, a cross-layer graph alignment strategy corresponding to the application-level graph and the network-level behavior dependency graph is executed to establish cross-layer consistent semantic links and mark the verification result features to obtain feature-enhanced network behavior graphs and application behavior graphs. This includes: constructing a matching fingerprint database to implement cross-layer semantic links; and constructing an expected behavior baseline model based on the matching fingerprint database to perform collaborative enhancement and logical error correction on the network behavior graph and the application behavior graph.

[0066] In practical implementation, embodiments of this application can perform cross-layer graph alignment analysis and propose a periodic behavior correction mechanism, which can be achieved by constructing a matching fingerprint database. Implement cross-layer semantic links; and establish a baseline model of expected behavior. This enables collaborative enhancement and logical error correction of network behavior graphs and application behavior graphs, thereby outputting a feature-enhanced network behavior graph. and application behavior mapping That is, to generate an information-enhanced two-layer behavioral dependency graph.

[0067] The following is an illustration using a specific example: First, traverse Node set Based on a predefined fingerprint matching knowledge base exist Search for matching streams If a match is successful, mark it. and for" verified ".

[0068] Furthermore, construct application-level data-driven expected behavior models. Quantify the time consumption characteristics of application activities. Obtain data based on historical application-level logs. Calls and corresponding relationships, parsing Observation set. Among them, Indicates the trigger source identifier: If it is a specific automation rule, it is represented as... If the user initiates the source trigger, then it is... ; It is an activity instance (e.g., Turn ON Light); yes Triggering state result, That is, the time taken to complete the activity (from Generate to (The resulting time difference). For each category The data is cleaned using the IQR interquartile range method (e.g., to remove occasional extreme time-consuming events); the historical average time of the cleaned data is calculated. Generate mapping relationships Baseline time characteristics of all legitimate activities in the storage system.

[0069] Furthermore, based on For elements with abnormal matching To achieve behavior correction, two concepts are involved: prediction nodes and error correction edges, as detailed below: (Definition 1) Prediction Node: A prediction node is a theoretical execution state node derived from the application behavior model, used to characterize the expected state of the system under normal execution conditions. 1) FNnode ( False Negative Entity Node) : Key state nodes that the system should generate but are actually missing. Represents the expected state that was not achieved due to an anomaly.

[0070] 2) FPnode ( False Positive Entity Node ): An abnormal state node that should not appear in the system but is actually observed, representing an unexpected state caused by an attack, error, or abnormal condition.

[0071] (Definition 2) Error Correction Edge: An edge connecting a predicted node to a node in the verified integrity application graph, representing a system logic correction relationship; the specific definitions of error correction edges are shown in Table 3: Table 3

[0072] The overall algorithm flow for behavior correction using behavior graphs is as follows: Figure 5 As shown, from Extract all elements that do not contain "". verified "A collection of unverified application nodes for attribute tags" Start traversal and iterate through each node in the collection. Based on its category branch processing: For the Activity class, delete... Post-order edges, based on Generate FNnode prediction nodes And establish a causal error correction edge between the two, further targeting Execution sequence and logical behavior correction; for Entity categories, delete. The original node in Generate prediction nodes for FPnode categories and will All associated edges are updated to causal error-correcting edges marked with the Unexpected attribute. This process is repeated until all unverified nodes have been processed, and the corrected application graph is output. .

[0073] Specifically, the following statement addresses... The process of performing timing and logic correction is described in Table 4, which contains the definitions of terms used in the algorithm flow.

[0074] Table 4

[0075] Furthermore, the specific logical verification rules involved in the algorithm process are described below: Rule 1 (Conditional Suppression): Predicting Nodes If it is related to the previous state node in the time sequence If the values ​​are inconsistent, then it indicates It should have been The state change is completed at the corresponding time. Therefore, if there is activity... The corresponding activation condition depends on the predecessor node. And the activity was If the fault occurs after the indicated time, then under normal system operation, The represented activity should have been suppressed (i.e., should not have occurred) because the state of the predecessor node should have prevented the condition for the activity from being met.

[0076] A specific definition exists. satisfy: 1)

[0077] 2) ,satisfy:

[0078]

[0079] Therefore, it is assumed that if the system is operating normally, The Activity it represents should have been suppressed.

[0080] Rule 2 (Conditional Pre-triggering): Predicting Nodes If it is related to the successor state node in the time sequence If the values ​​are the same, then it represents It should have been It is generated at the corresponding time. Therefore, if the activity The corresponding trigger condition is And the activity was If the fault occurs after the indicated time, then under normal system operation, The activity that was represented should have been triggered earlier (but was actually delayed) because the normal output of the faulty node should have changed the state of its successor node and triggered the activity earlier.

[0081] Specifically, if satisfy: 1) ; 2) ,satisfy:

[0082]

[0083] Then it is determined The Activity it represents should have been triggered earlier, but was actually delayed.

[0084] The complete process of the time-series logic verification algorithm is shown in Figures 6(a) and 6(b), based on the application graph. and :extract Predecessor Node ,like Then verify = Is it valid? - If valid, add. and If there is no "sameState" edge between them, then add a "shouldDerive" edge and check. Does there exist a rule that satisfies rule 1? Add if it exists. arrive The `shouldForbid` edge. Then extract... successor node ,like Then verify = Established - If established, add arrive If a `shouldPrecede` edge is found, then a `shouldDerive` edge is added, and it is checked whether there exists a condition satisfying rule 2. Add if it exists. arrive The `shouldAdvance` edge is defined; finally, all update results are merged, and the updated result is output. .

[0085] Through the above technical solutions, the embodiments of this application can construct a matching fingerprint database to implement cross-layer semantic links, thereby eliminating the semantic fragmentation between layers and forming a "behavior-support" correspondence between the originally independent two-layer graphs. The information of the network layer and the application layer is naturally complementary. The network layer can capture the "actual execution path of the behavior", and the application layer can interpret the "intent and logic of the behavior". Through the synergistic enhancement of cross-layer links, the information gaps at a single level can be filled. Furthermore, cross-layer association can be carried out based on the expected behavior baseline model, thereby defining the "complete logical chain of normal behavior" to ensure the error correction effect.

[0086] In step S104, fact encoding is used to transform the network behavior graph and application behavior graph into a structured fact base to deduce the abnormal propagation path and potential root causes.

[0087] A structured fact base can be understood as a database or knowledge collection that stores objective facts in a standardized and structured form. Its core is to organize scattered information into a form that is machine-understandable and can be efficiently queried through predefined patterns (such as entities, relations, and attributes).

[0088] This application embodiment can provide feature-enhanced network behavior graphs. and application behavior mapping The facts are encoded into a structured fact base; and further, based on predefined atomic predicates and cross-layer anomaly association reasoning rules (such as the transmission constraints of anomalies between the network layer and the application layer), the logic reasoning engine can automatically deduce the anomaly propagation path and potential root causes that cannot be observed at a single level.

[0089] As a specific and feasible approach, this embodiment employs a logic programming paradigm (using Datalog statements as an example) to automatically identify hidden cross-layer anomaly propagation paths between the "network layer" and the "application layer" and implement root cause reasoning. This method combines atomic predicates with basic facts using a set of general first-order logic rules to deduce higher-order relationships characterizing the anomaly associations of cross-layer entities until the reasoning converges, ultimately outputting a judgment conclusion pointing to the root cause of the cross-layer anomaly.

[0090] The specific implementation includes three layers of processing logic: First, the enhanced application / network program graph output in step S103 is... and The encoding is used as a basic unit of the standardized knowledge base, and the specific definition is shown in Table 5. Table 5 is the basic data type.

[0091] Table 5

[0092] Will Encoded as DeviceNode , FlowEdge, VersionEdge Three different structural information, DeviceNode Represented as Node This represents the device node (including node serial number, IP address, MAC address and version number information); FlowEdge Represented as Edge It represents the network event edge in the network graph (including the edge start / end device node ID, network event start / end timestamp, and whether it has been verified by the application layer). VersionEdge Represented as vEdge Version edge (including edge start / end device node ID). Also, Encoded as AppNode and AppEdge type, AppNode Represented as appNode This represents the application node, including node ID, name (e.g., Light.ON), type (Type=[FPnode, FNnode,Entity, Activity]), and attributes such as whether it has been verified by the network layer and timestamp; AppEdge Represented as appEdge It represents the relationship edges between application nodes, including the start and end node IDs, edge type, and interval time characteristics.

[0093] Secondly, the semantic inferencer defines a set of atomic predicates as computational primitives for anomaly detection. Atomic predicates are the most basic logical expression units in logic programming, used to represent indivisible fundamental relationships or attribute assertions between entities. They transform basic facts into reasonable logical facts, providing a computable criterion for hiding anomaly propagation. Specifically, using… To formally represent, in which, For predicate semantics, These are entity variables. Key predicates include, but are not limited to, time-constraint predicates (A1-A3), node attribute predicates (A4-A6), and periodic feature predicates (A7), specifically including: Predicate A1: Define timestamp equivalence; Predicate A2: Determine the co-occurrence window for events; Predicate A3: Determine the order of events; Predicate A4: Mark FNnode type predicted nodes; Predicate A5: Identify the FPnode type and predict the node; Predicate A6: Capture the device entity that initiated the unverified network event; Predicate A7: Verify the device status polling characteristics.

[0094] The aforementioned atomic predicates can provide scalable exception propagation computation primitives for higher-order logic rules.

[0095] Ultimately, based on atomic predicates and fundamental facts, embodiments of this application can deduce cross-layer anomaly root causes through first-order logic rules.

[0096] In this embodiment, a total of 13 logical rules can be defined, among which R1-R2 are based on Version edge structure inference device state evolution: R3-R6 are inference rules for cross-layer deviation, R7-R9 are network flow semantic reconstruction rules, and R10-R13 are cross-layer root cause diagnosis rules. Specifically, these include: R1 is used to infer direct device state change relationships between devices. Assume... and Network diagram On the device node, if , Nodes via version edges Correlation can lead to inference Nodes are The next state of a node is formally represented as:

[0097] R2 extends the direct version association of R1, recursively tracing version chains of arbitrary length. Assume... and Network diagram The device nodes on both can communicate through Reachable (i.e., there are intermediate nodes) ),but The state is The consequences of multiple steps of transmission can be formally represented as follows:

[0098] R3 is a cross-layer associative primitive generator. Based on time consistency constraints, it establishes... middle , Inter-node network layer communication events and application layer nodes The spatiotemporal alignment is formally represented as:

[0099] R4 is used to locate network bottleneck events that cause application intent execution failures, through correlation. middle , Unverified network events between nodes and application-layer FNnode-type predicted nodes Identification is based on time characteristics, and its formal representation is as follows:

[0100] R5 is used to analyze and capture unexpected application behavior activation. middle , Unauthorized network layer events between nodes trigger unexpected application behavior Its formal representation is:

[0101] R6 is a reliable path deviation detection mechanism that reveals... middle , Inter-node network layer events for legitimate application logic An illegal call chain can be formally represented as:

[0102] R7 captures trigger-response patterns between network events through sequential and time window constraints, aiding in the reconstruction of network event attack chains. (Inference) middle , Nodes and , There is a potential causal relationship between the network activities of nodes, which can be formally represented as:

[0103] R8 identifies network flows with overlapping time signatures, revealing... middle , , The potential cooperative attack patterns on node network links can be formally represented as follows:

[0104] R9 tracks the impact of device state changes on network activity and analyzes... , Inter-network events caused the device status to change Evolved to Further impact The state dependency chain of the network-triggered response pattern (R9 principle diagram is shown below) Figure 7 As shown, if device D1 initiates event e1, triggering the evolution of device D2's state from D2.1 to D2.2, when D3 initiates event e2, its execution result (or the change in system state by e2) depends on the current state of D2.2. This forms a state dependency chain: e1 ⇒ D2 state change ⇒ e2 execution condition, which is satisfied. The formal representation of the rule is as follows:

[0105] The R10 diagnostic system suffers from cross-layer anomaly propagation caused by network flow hijacking, specifically, deviations from the logic causing application-level execution failures. ) through network device nodes ( Bridged to normal logical nodes ( The cross-layer hidden penetration path of ) can be formally represented as:

[0106] R11 diagnoses the root cause of illegal logic triggers and provides reasoning. middle , Node network events are illegal application logic ( The root cause of the call is formally defined as:

[0107] R12 diagnostics identifies the root cause of application intent failure due to state tampering, and provides reasoning. middle , Node network events cause device state changes, triggering application intent ( Failure. For example, in a scenario where Device1 within the local area network launches a DoS attack, causing Yeelight to be unable to respond to platform control commands, this rule outputs (Device1, Yeelight, FNnode Type: Yeelight.ON), meaning that network events on Device1 and Yeelight caused the application command represented by FNnode to fail semantically. Formalized as:

[0108] R13 uses periodic feature analysis to diagnose malicious applications lacking legitimate network event verification, identifying application-layer injection attacks. It also identifies application logic. The generation of this is controlled by a malicious application activity proxy. Formal definition:

[0109] The aforementioned rule system achieves four-dimensional root cause diagnosis (flow hijacking / trigger response / state tampering / malicious application) by combining atomic predicates and intermediate conclusions, and finally outputs a hidden attack chain of "network layer - application layer".

[0110] By using fact encoding to transform network behavior graphs and application behavior graphs into structured fact bases, the core is to transform scattered entities, relationships, and behavioral features into machine-parsable "structured knowledge" through unified logical representations (such as triples, rule-based facts, attribute-relationship models, etc.). This supports the deduction of anomaly propagation paths and root cause localization based on logical reasoning. Compared with unstructured data (such as text and images) or semi-structured data (such as JSON and XML), structured fact bases emphasize the logical correlation and consistency of data, making it easier to reason, analyze, and reuse knowledge.

[0111] In step S105, based on the cross-layer anomaly propagation path and potential root causes, they are transformed into newly added semantic nodes and relational edges in the application behavior graph to generate a global source graph that integrates two layers of semantics and fully describes the system behavior and anomaly propagation chain, thereby determining the anomaly source tracing results of the smart home system.

[0112] In actual implementation, the embodiments of this application can transform cross-layer abnormal path transformation application behavior graphs obtained through deterministic semantic mapping framework reasoning. The newly added semantic nodes and relational edges generate a global source graph that integrates two layers of semantics and fully characterizes system behavior and anomaly propagation chains. It provides interpretable, fine-grained attribution analysis for complex attacks or failures.

[0113] The core value of the global source graph lies in breaking down the "semantic barrier" between network behavior graphs and application behavior graphs. By adding nodes and relational edges, it integrates the originally scattered two layers of behavioral information into a complete semantic network, solving the limitation of traditional graphs that "only see the part and not the whole". By integrating anomaly propagation paths and root cause information, the global source graph transforms the originally hidden and scattered anomaly evolution process into a "visual chain that can be viewed intuitively and traced back in reverse", which greatly reduces the complexity of anomaly analysis.

[0114] Optionally, in one embodiment of this application, based on the cross-layer anomaly propagation path and potential root causes, the semantic nodes and relational edges are transformed into newly added semantic nodes and relational edges in the application behavior graph to generate a global source graph that integrates two layers of semantics and fully describes the system behavior and anomaly propagation chain, and to determine the anomaly source tracing result of the smart home system, including: based on a preset cross-layer semantic transformation framework, mapping the logical rule output to newly added semantic nodes or relational edges in the application behavior graph to generate a global source graph that integrates two layers of semantics.

[0115] This application embodiment can map the logical rule outputs (R10-R13) into an application behavior graph through a cross-layer semantic transformation framework. The newly added nodes / edges generate a global source graph that integrates two layers of semantics. The extended elements of the framework definition are shown in Tables 6 and 7. Table 6 defines cross-layer semantic nodes, and Table 7 defines relational predicates.

[0116] Table 6

[0117] Table 7

[0118] Taking the output of R11 as an example, if UnexpectedCause(X, Y, appNode) is true, it indicates that the network event between X and Y invoked the unexpected application logic appNode. The specific implementation steps are as follows: 1) Network events between X and Y are resolved into nodes of the NetworkActivity category. ; for X, resolve to DeviceAgent node ; 2) In and An initiatedBy edge is created between them, representing that the device initiates network activity; 3) Positioning The node corresponding to appNode ,exist and

[0119] Create cause edges between them to complete a logical trigger key representation, and finally output. .

[0120] Through the above technical solutions, the embodiments of this application can achieve a leap from "loose association" to "deep coupling" of two-layer semantics, from "local fragments" to "full-link penetration" of traceability capabilities, and from "abstract and obscure" to "structured reuse" of rule application through semantic standardization of a preset framework → graph mapping of logical rules → dynamic fusion of the global graph. As a result, the final generated global traceability graph is not only a "recorder of system behavior" but also a "navigation map for anomaly analysis" and a "data source for automated decision-making," providing "explainable, traceable, and evolvable" core support for the reliability assurance and security protection of complex systems.

[0121] The anomaly tracing method for smart home systems based on cross-layer associative reasoning proposed in this application can construct application-level behavioral dependency graphs and network-level behavioral dependency graphs representing application logic associations and entity temporal evolution associations, respectively. Then, it establishes cross-layer consistent semantic connections between these two graphs and labels verification result features, generating network behavior and application behavior graphs. These are further transformed into a structured fact base to deduce anomaly propagation paths and potential root causes, thereby generating a global tracing graph that integrates dual-layer semantics and fully characterizes system behavior and anomaly propagation chains, determining the anomaly tracing results of the smart home system. This method, by integrating network layer interaction patterns and application layer control logic, explicitly reconstructs implicit cross-layer anomaly propagation chains, achieving highly interpretable and fine-grained root cause diagnosis of system anomalies. This solves the problems in related technologies where the lack of cross-layer causal relationships leads to serious blind spots in anomaly detection coverage (inability to capture anomalies originating from or propagating through the network layer), and can even cause misjudgments of the root cause of problems, affecting the localization of system faults.

[0122] Next, refer to the appendix. Figure 8 This application describes an anomaly tracing device for smart home systems based on cross-layer correlation reasoning, according to an embodiment of the present application.

[0123] Figure 8 This is a block diagram of an anomaly tracing device for a smart home system based on cross-layer association reasoning, according to an embodiment of this application.

[0124] like Figure 8 As shown, the smart home system anomaly tracing device 10 based on cross-layer association reasoning includes: a first construction module 100, a second construction module 200, a generation module 300, a derivation module 400, and a tracing module 500.

[0125] The first construction module 100 is used to capture key event sequences describing application-level real-time behavior and extract key data dependencies to construct an application-level behavior dependency graph that represents application logic associations and entity temporal evolution associations.

[0126] The second construction module 200 is used to collect all network communication traffic within the smart home system to segment network events, and to reconstruct the interaction behavior patterns between smart home system devices using a preset network behavior association model, so as to construct a network-level behavior dependency graph.

[0127] The generation module 300 is used to execute cross-layer graph alignment strategies corresponding to application-level behavior dependency graphs and network-level behavior dependency graphs based on a pre-built mapping knowledge base corresponding to specific network flow pattern characteristics of target application states or activities, establish cross-layer consistent semantic links and label verification result features to obtain feature-enhanced network behavior graphs and application behavior graphs.

[0128] The derivation module 400 is used to transform network behavior graphs and application behavior graphs into a structured fact base using fact encoding, in order to deduce cross-layer anomaly propagation paths and potential root causes.

[0129] The source tracing module 500 is used to transform cross-layer anomaly propagation paths and potential root causes into newly added semantic nodes and relational edges in the application behavior graph, so as to generate a global source tracing graph that integrates two layers of semantics and fully describes the system behavior and anomaly propagation chain, and determine the source tracing results of anomalies in the smart home system.

[0130] Optionally, in one embodiment of this application, the first construction module 100 includes: a first generation unit and a second generation unit. The first generation unit is used to extract the control logic and data dependencies of the smart home system at the application layer and generate a list of key events. The second generation unit is used to process the list of key events to obtain key data dependencies, so as to generate an application-level behavior graph based on a preset application-level behavior association model.

[0131] Optionally, in one embodiment of this application, the second construction module 200 includes: a filtering unit and a first construction unit. The filtering unit is used to filter continuous network events with identical data packet length sequences within a short time window for the same subject and object devices, to obtain a redundantly filtered list of network events. The first construction unit is used to construct a network-level behavioral dependency graph based on the redundantly filtered list of network events.

[0132] Optionally, in one embodiment of this application, the generation module 300 includes: a second building unit and a third building unit. The second building unit is used to build a matching fingerprint database to implement cross-layer semantic links; the third building unit is used to build an expected behavior baseline model based on the matching fingerprint database to perform collaborative enhancement and logical error correction on the network behavior graph and the application behavior graph.

[0133] Optionally, in one embodiment of this application, the tracing module 500 includes: a third generation unit, which is used to map the logical rule output to newly added semantic nodes or relation edges in the application behavior graph based on a preset cross-layer semantic transformation framework, so as to generate a global tracing graph that integrates two layers of semantics.

[0134] It should be noted that the foregoing explanation of the embodiment of the method for tracing anomalies in smart home systems based on cross-layer association reasoning also applies to the device for tracing anomalies in smart home systems based on cross-layer association reasoning in this embodiment, and will not be repeated here.

[0135] The anomaly tracing device for smart home systems based on cross-layer correlation reasoning proposed in this application can construct application-level behavioral dependency graphs and network-level behavioral dependency graphs representing application logic correlations and entity temporal evolution correlations, respectively. It then establishes cross-layer consistent semantic connections between these two graphs and labels verification result features, generating network behavior and application behavior graphs. These graphs are further transformed into a structured fact base to deduce anomaly propagation paths and potential root causes, thereby generating a global tracing graph that integrates dual-layer semantics and fully characterizes system behavior and anomaly propagation chains, thus determining the anomaly tracing results of the smart home system. This method, by integrating network layer interaction patterns and application layer control logic, explicitly reconstructs implicit cross-layer anomaly propagation chains, achieving highly interpretable and fine-grained root cause diagnosis of system anomalies. This solves the problems in related technologies where the lack of cross-layer causal relationships leads to severe blind spots in anomaly detection coverage (inability to capture anomalies originating from or propagating through the network layer), and can even cause misjudgments of the root cause of problems, affecting the localization of system faults.

[0136] Figure 9 A schematic diagram of the structure of an electronic device provided in an embodiment of this application. The electronic device may include: The memory 901, the processor 902, and the computer program stored on the memory 901 and capable of running on the processor 902.

[0137] When the processor 902 executes the program, it implements the method for tracing the anomalies of a smart home system based on cross-layer association reasoning provided in the above embodiments.

[0138] Furthermore, electronic devices also include: Communication interface 903 is used for communication between memory 901 and processor 902.

[0139] The memory 901 is used to store computer programs that can run on the processor 902.

[0140] The memory 901 may include high-speed RAM memory, and may also include non-volatile memory, such as at least one disk storage device.

[0141] If the memory 901, processor 902, and communication interface 903 are implemented independently, then the communication interface 903, memory 901, and processor 902 can be interconnected via a bus to complete communication between them. The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of representation, Figure 9 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0142] Optionally, in a specific implementation, if the memory 901, processor 902, and communication interface 903 are integrated on a single chip, then the memory 901, processor 902, and communication interface 903 can communicate with each other through an internal interface.

[0143] The processor 902 may be a central processing unit (CPU), an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of this application.

[0144] This application also provides a non-volatile computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the above-described method for tracing anomalies in a smart home system based on cross-layer association reasoning.

[0145] This application also provides a computer program product storing a computer program that, when executed by a processor, implements the above-described method for tracing anomalies in a smart home system based on cross-layer association reasoning.

[0146] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0147] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this application, "N" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0148] Any process or method described in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or N executable instructions for implementing custom logic functions or processes, and the scope of the preferred embodiments of this application includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved, as should be understood by those skilled in the art to which embodiments of this application pertain.

[0149] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of computer-readable media include: an electrical connection having one or more wires (electronic device), a portable computer disk drive (magnetic device), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Alternatively, the computer-readable medium may be paper or other suitable media on which the program can be printed, since the program can be obtained electronically by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in a computer memory.

[0150] It should be understood that the various parts of this application can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiments, the N steps or methods can be implemented using software or firmware stored in memory and executed by a suitable instruction execution system. If implemented in hardware, as in another embodiment, it can be implemented using any one or more of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0151] Those skilled in the art will understand that all or part of the steps of the methods in the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, the program includes one or a combination of the steps of the method embodiments.

[0152] Furthermore, the functional units in the various embodiments of this application can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into a module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium.

[0153] The storage medium mentioned above can be a read-only memory, a disk, or an optical disk, etc. Although embodiments of this application have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting this application. Those skilled in the art can make changes, modifications, substitutions, and variations to the above embodiments within the scope of this application.

Claims

1. An intelligent home system abnormality tracing method based on cross-layer association reasoning, characterized in that, The method comprises the following steps: capturing a key event sequence describing real-time application-level behavior and extracting key data dependency relationships to construct an application-level behavior dependency graph representing application logic association and entity time sequence evolution association; collecting all network communication traffic in the smart home system to segment network events and reconstruct interaction behavior patterns between smart home system devices using a preset network behavior association model to construct a network-level behavior dependency graph; based on a mapping knowledge base constructed in advance according to specific network stream mode characteristics corresponding to a target application state or activity, performing a cross-layer graph alignment strategy corresponding to the application-level behavior dependency graph and the network-level behavior dependency graph, establishing cross-layer consistent semantic links and marking verification result features to obtain a feature-enhanced network behavior graph and an application behavior graph; using fact encoding transformation to convert the network behavior graph and the application behavior graph into a structured fact library to deduce a cross-layer abnormal propagation path and potential root cause; based on the cross-layer abnormal propagation path and potential root cause, converting newly added semantic nodes and relationship edges in the application behavior graph to generate a global traceability graph that fuses double-layer semantics and completely depicts system behavior and abnormal propagation chains to determine a smart home system abnormal traceability result.

2. The method of claim 1, wherein, The capturing a key event sequence describing real-time application-level behavior and extracting key data dependency relationships to construct an application-level behavior dependency graph representing application logic association and entity time sequence evolution association comprises: extracting control logic and data dependency relationships of the smart home system application layer runtime to generate the key event list; processing the key event list to obtain the key data dependency relationships to generate the application-level behavior dependency graph based on a preset application-level behavior association model.

3. The method of claim 1, wherein, The collecting all network communication traffic in the smart home system to segment network events and reconstruct interaction behavior patterns between smart home system devices using a preset network behavior association model to construct a network-level behavior dependency graph comprises: filtering continuous network events with completely consistent packet length sequences of the same subject and object devices within a short time window to obtain a redundant filtered network event list; constructing the network-level behavior dependency graph based on the redundant filtered network event list.

4. The method of claim 1, wherein, The based on a mapping knowledge base constructed in advance according to specific network stream mode characteristics corresponding to a target application state or activity, performing a cross-layer graph alignment strategy corresponding to the application-level behavior dependency graph and the network-level behavior dependency graph, establishing cross-layer consistent semantic links and marking verification result features to obtain a feature-enhanced network behavior graph and an application behavior graph comprises: constructing a matching fingerprint library to implement cross-layer semantic linking; based on the matching fingerprint library to implement cross-layer semantic linking, constructing an expected behavior baseline model to cooperatively enhance and logically correct the network behavior graph and the application behavior graph.

5. The method of claim 1, wherein, transform into new semantic nodes and relationship edges added in the application behavior graph based on the cross-layer abnormal propagation path and potential root cause, to generate a global traceability graph that fuses double-layer semantics and fully depicts system behavior and abnormal propagation chain, and determine the smart home system abnormal traceability result, including: Based on a preset cross-layer semantic conversion framework, the logical rule output is mapped to the semantic nodes or relationship edges added in the application behavior graph to generate the global traceability graph that fuses double-layer semantics.

6. An intelligent home system abnormality tracing device based on cross-layer association reasoning, characterized in that, Including: A first construction module for capturing a key event sequence describing real-time application-level behavior and extracting key data dependency relationships to construct an application-level behavior dependency graph representing application logic association and entity time sequence evolution association; A second construction module for collecting all network communication traffic in the smart home system to segment network events, and reconstructing interaction behavior patterns between smart home system devices using a preset network behavior association model to construct a network-level behavior dependency graph; A generation module for performing a cross-layer graph alignment strategy corresponding to the application-level behavior graph and the network-level behavior dependency graph based on a mapping knowledge base constructed in advance based on specific network flow mode characteristics corresponding to a target application state or activity, establishing cross-layer consistent semantic links and marking verification result features to obtain a network behavior graph and an application behavior graph with enhanced features; A derivation module for converting the network behavior graph and the application behavior graph into a structured fact library using fact encoding to derive a cross-layer abnormal propagation path and potential root cause; A traceability module for transforming into new semantic nodes and relationship edges added in the application behavior graph based on the cross-layer abnormal propagation path and potential root cause, to generate a global traceability graph that fuses double-layer semantics and fully depicts system behavior and abnormal propagation chain, and determine the smart home system abnormal traceability result.

7. The apparatus of claim 6, wherein, The first construction module includes: A first generation unit for extracting control logic and data dependency relationships of the smart home system application layer runtime to generate the key event list; A second generation unit for processing the key event list to obtain the key data dependency relationships, and generating the application-level behavior dependency graph based on a preset application-level behavior association model.

8. An electronic device, comprising: Including: A memory, a processor, and a computer program stored on the memory and executable on the processor, the processor executing the program to implement the smart home system abnormal traceability method based on cross-layer association reasoning according to any one of claims 1-5.

9. A non-transitory computer readable storage medium having stored thereon a computer program, characterized in that, The program is executed by the processor to implement the smart home system abnormal traceability method based on cross-layer association reasoning according to any one of claims 1-5.

10. A computer program product comprising a computer program, characterized in that, The computer program is executed to implement the smart home system abnormal traceability method based on cross-layer association reasoning according to any one of claims 1-5.

Images