Iot anomaly detection method and system based on quaternion state space diffusion enhancement

Abstract

The application discloses an Internet of Things anomaly detection method and system based on quaternion state space diffusion enhancement, and belongs to the technical field of network security and artificial intelligence. The method comprises the following steps: mapping traffic time sequence features into a quaternion tensor to maintain the internal coupling relationship of multi-dimensional features; designing a double-flow encoder, extracting continuous flow features by using a quaternion selective state space model, and modeling discrete protocol features by using a dynamic hypergraph neural network; generating an adversarial pseudo-anomaly sample by using a latent diffusion model to perform self-supervised pre-training, and combining a quaternion cepstrum distance loss to optimize the representation; optimizing the injected learnable prompt vector in the small sample fine-tuning stage, and correcting the class prototype by using a semi-supervised expectation maximization algorithm; calculating sample anomaly scores based on an energy model to realize known attack classification and unknown anomaly determination. The application significantly improves the generalization ability of the model under the condition of small samples and the detection ability of unknown threats.

Description

Technical Field

[0001] This invention belongs to the field of interdisciplinary technology of network security and artificial intelligence, and specifically relates to a method and system for detecting network traffic anomalies in an Internet of Things (IoT) environment. Background Technology

[0002] In recent years, using deep learning models to analyze and detect network traffic has gradually become a research hotspot. However, existing methods have limitations.

[0003] First, due to the rapid evolution of IoT attack methods, obtaining a large number of labeled new attack samples is extremely difficult. This makes it difficult for deep learning models trained on large-scale labeled data to obtain sufficient supervision signals, leading to overfitting and weak generalization ability. Second, IoT traffic data contains continuous fluid features (such as packet interval time and packet size) and discrete protocol features (such as TCP flags). Existing methods often simply concatenate or process these features independently, ignoring the strong inherent coupling between different modal features, resulting in insufficient feature representation. Third, traditional classification models are usually based on the closed-set assumption, meaning that the categories appearing in the testing phase must have been seen in the training phase. This makes it difficult for the model to effectively distinguish between known attacks and unknown anomalies, easily misclassifying unknown attacks as normal traffic or a known attack. Therefore, there is an urgent need for an IoT anomaly detection method that can effectively integrate multimodal features, possess strong generalization ability under small sample conditions, and accurately identify unknown threats.

[0004] It should be noted that the references to relevant prior art and the description of its possible defects or problems herein should not be construed as an admission that the prior art constitutes part of common general knowledge in the art, or an admission that it implies the solution of the present invention in any way. Summary of the Invention

[0005] Purpose of the invention: In order to solve the challenges of small sample size, heterogeneous features, and unknown attack identification in anomaly detection in IoT scenarios, this invention provides an IoT anomaly detection method and system based on quaternion state space diffusion enhancement, which can effectively integrate multimodal features, has strong generalization ability under small sample conditions, and can accurately identify unknown threats.

[0006] Technical solution: Firstly, an IoT anomaly detection method based on quaternion state space diffusion enhancement, comprising the following steps:

[0007] Analyze raw IoT traffic data and extract four basic features: packet interval time, packet size, protocol flags, and information entropy, and construct a quaternion time series tensor.

[0008] A dual-stream encoder that operates in parallel is constructed. The first-stream encoder processes the continuous fluid features in the quaternion time-series tensor based on a quaternion selective state-space model, while the second-stream encoder processes the discrete protocol features in the quaternion time-series tensor based on a dynamic hypergraph neural network. The features output by the two encoders are fused to obtain the final flow representation vector.

[0009] The latent space is constructed based on the two-stream encoder. The distribution of normal flow in the latent space is learned using a diffusion model. Pseudo-abnormal samples located at the decision boundary are generated through diffusion and denoising processes. Based on the pseudo-abnormal samples and normal samples, combined with the designed loss function, the two-stream encoder is pre-trained in a self-supervised manner, and the pre-training parameters are saved.

[0010] The dual-stream encoder parameters are frozen, and a set of learnable continuous cue vectors are constructed and injected into the front end of the input sequence. By optimizing only the cue vectors and a lightweight classification head, the model is adapted to the new task. At the same time, using support set and query set samples, prototype vectors of each category are iteratively corrected in a semi-supervised manner.

[0011] The traffic data to be detected is acquired and constructed as a quaternion temporal tensor. Pre-trained parameters and optimized cue vectors are loaded onto the dual-stream encoder. Traffic representation is extracted based on the quaternion temporal tensor. The energy value between the traffic representation and the corrected prototype vectors of each category is calculated. The traffic to be detected is determined to be a known attack category or an unknown anomaly by comparing the energy value with a preset threshold.

[0012] Furthermore, by analyzing the raw IoT traffic data, four basic features are extracted: packet interval time, packet size, protocol flags, and information entropy. A quaternion time series tensor is then constructed, including:

[0013] The packet interval time is mapped to the real part of a quaternion, and the packet size, protocol flag scalar features, and information entropy are mapped to the three imaginary parts of the quaternion, respectively. For a traffic sequence of length L, the constructed quaternion time series tensor... The t-th element q t Represented as: ,in These represent the normalized packet interval time, packet size, scalar characteristics of protocol flags, and information entropy, respectively, where i, j, and k are the imaginary units of the quaternions, satisfying the Hamiltonian algebra rules. ,and B represents the batch size, and H represents the quaternion field.

[0014] Protocol flag scalar feature y t Obtained in the following way: the original protocol flags Code. t Mapped to a d-dimensional vector through a learnable embedding layer. Then, through a linear projection or mean averaging operation, the dimensionality is reduced to a scalar, i.e. W y For projection weights.

[0015] Furthermore, in the first-order encoder, the quaternion-selective state-space model is calculated at discrete time step k by the following discretized equations of the continuous-time system:

[0016] , ,

[0017] in These represent continuous state, input, and output, respectively. Given a time-varying quaternion system matrix; discretized using a zero-order hold, the recursive equation for discrete time step k is obtained:

[0018] ,

[0019] ,

[0020] ,

[0021] ,

[0022] in To discretize the step size, It is the current input Matrix generated by selective network The exponent of the quaternion matrix. This represents quaternion multiplication, where all operations are performed within the quaternion field.

[0023] Furthermore, in the second-stream encoder, the dynamic hypergraph neural network in the first... The construction of each time window and the convolution calculation are as follows:

[0024] Node and hyperedge definition: Assume the window contains Each data packet has a set of protocol flags. After deduplication, the node set is obtained. Define the hyperedge set based on statistical co-occurrence relations. Each super edge Connect a group of related nodes;

[0025] Inclusion Matrix: Constructing the Inclusion Matrix The element of the incidence matrix is ​​such that the node v belongs to the hyperedge e. ;

[0026] Hypergraph Convolution: Initial Features of Nodes The embedding vector is its flag; the formula for the hypergraph convolution operation in the l-th layer is:

[0027] ,

[0028] in The degree matrix is ​​a diagonal matrix whose elements are... ; The hyperedge degree matrix is ​​a diagonal matrix whose elements are... ; It is a learnable hyperedge weight diagonal matrix; Let be the learnable parameter matrix of the l-th layer.

[0029] Furthermore, a latent space is constructed based on the two-stream encoder, and the distribution of normal flow in the latent space is learned using a latent diffusion model. Pseudo-anomaly samples located at the decision boundary are generated through a diffusion and denoising process, including:

[0030] Using a dual-stream encoder Mapping the quaternion time-series tensor Q of normal flow samples to the latent space yields the initial latent representation. , Indicates the dimension of the encoder mapping;

[0031] Perform a forward diffusion process, defined as a T-step Markov chain: Each step is , Represents the conditional probability distribution. Indicates a Gaussian normal distribution. Let I represent the latent variables at step t, and let I be the identity matrix. For the preset cosine scheduling noise variance table, satisfying ;

[0032] Through reparameterization techniques, from the initial latent representation Directly sample the latent noise variables at any step t: ,in It is Gaussian noise. , This is the cumulative noise figure;

[0033] From the predefined intermediate step range Uniform random sampling in one step Obtain the corresponding noisy latent representation Using a trained denoising network right Perform a single-step backward prediction to calculate the state of the previous time step. The underlying representation of the generated pseudo-anomaly samples is calculated as follows: .

[0034] Furthermore, the loss function used for self-supervised pre-training of the two-stream encoder is... It is a weighted sum of the contrast loss term and the reconstruction loss term, and its expression is: ,in, Characterization of normal samples For the feature representation of pseudo-abnormal samples, For the dual-stream encoder to be pre-trained; For the reconstructed quaternion temporal tensor; To balance the hyperparameters of the two losses;

[0035] Comparison loss L contrastive The goal is to minimize the feature distance between normal samples while maximizing the feature distance between normal samples and pseudo-abnormal samples, until a preset boundary interval is met. The calculation formula is:

[0036] ,

[0037] in For a pair of normal samples, It is the Euclidean distance function;

[0038] Reconstruction loss L recon Specifically, the quaternion cepstral distance loss is calculated as follows: the quaternion time series tensor Q is decomposed into four independent real-valued channel signals. ,in These correspond to the real part and the three imaginary parts, respectively; for each channel signal s[n] of each sample in each batch, its cepstral coefficients c[n] are calculated according to the following formula:

[0039] ,

[0040] ,

[0041] ,

[0042] For each flow sample in the batch, the cepstral coefficient c[n] calculated on the c-th channel is represented as a row vector. , The cepstral coefficient matrix for channel c is as follows:

[0043] ,

[0044] The reconstruction loss is calculated based on the cepstral coefficient matrix:

[0045] ,

[0046] in and Let n represent the Discrete Fourier Transform and its inverse transform, respectively, where n is the discrete-time index. Here, L is the frequency index, and L is the sequence length. To prevent small constants with negative infinity from appearing in logarithmic calculations; This represents the Frobenius norm.

[0047] Furthermore, the process of iteratively correcting the prototype vector in a semi-supervised manner specifically employs the soft-label expectation-maximization algorithm, and its t-th iteration steps are as follows:

[0048] Expected step: Calculate the query set The soft-assigned probability that each sample belongs to class K :

[0049] ,

[0050] in To provide suggestions for enhanced input, For sample characterization, Let be the prototype vector of category k at the t-th iteration. It is the Euclidean distance function. This is a temperature parameter used to control the smoothness of the probability distribution;

[0051] Maximize step: Utilize support set Based on the hard labels and soft assignment probabilities of the query set, update the prototype vectors for each category:

[0052] ,

[0053] in This is an indicator function; its value is 1 when the condition is true, and 0 otherwise. Weight coefficients for the query set samples; initial prototype Calculated from the support set samples;

[0054] Repeat the above two steps until the convergence condition is met. ,in This is the preset convergence threshold.

[0055] Furthermore, the energy value between the flow representation and the corrected prototype vectors of each category is calculated based on the Helmholtz free energy definition, with the specific formula as follows:

[0056] ,

[0057] in The flow rate sample to be detected. The enhanced characterization is shown for the flow sample to be detected. These are the corrected prototype vectors of the K known attack categories. It is the Euclidean distance function. For temperature parameters;

[0058] The detection of traffic is determined by comparing its energy value with a preset threshold, classifying it as a known attack or an unknown anomaly. This includes cases where the sample's energy value is below a first threshold τ and its distance from the nearest prototype is less than a second threshold. If the energy level is within the range of known attack types corresponding to the lowest energy prototype, then the sample will be classified as an unknown anomaly; otherwise, the sample will be classified as an unknown anomaly.

[0059] Secondly, an IoT anomaly detection system based on quaternion state space diffusion enhancement includes:

[0060] The data preprocessing module is used to parse raw IoT traffic data, extract four basic features: packet interval time, data packet size, protocol flag bits, and information entropy, and construct a quaternion time series tensor.

[0061] The dual-stream heterogeneous feature encoding module is used to construct a dual-stream encoder that works in parallel. The first-stream encoder processes the continuous fluid features in the quaternion time-series tensor based on the quaternion selective state-space model, while the second-stream encoder processes the discrete protocol features in the quaternion time-series tensor based on the dynamic hypergraph neural network. The features output by the two encoders are fused to obtain the final flow characterization vector.

[0062] The adversarial pre-training module is used to construct a latent space based on the two-stream encoder, learn the distribution of normal flow in the latent space using a diffusion model, and generate pseudo-abnormal samples located at the decision boundary through diffusion and denoising processes. Based on the pseudo-abnormal samples and normal samples, combined with the designed loss function, the two-stream encoder is pre-trained in a self-supervised manner, and the pre-training parameters are saved.

[0063] The few-shot adaptation module is used to freeze the parameters of the two-stream encoder, construct a set of learnable continuous cue vectors and inject them into the front end of the input sequence. By optimizing only the cue vectors and a lightweight classification head, the model is adapted to the new task. At the same time, using support set and query set samples, prototype vectors of each category are iteratively corrected in a semi-supervised manner.

[0064] The online detection module receives traffic data to be detected; it calls the data preprocessing module to construct a quaternion time series tensor from the traffic data to be detected; it calls the dual-stream heterogeneous feature encoding module and loads pre-trained parameters and optimized cue vectors; it extracts traffic representations based on the quaternion time series tensor; it calculates the energy value between the traffic representation and the corrected prototype vectors of each category; and it determines whether the traffic to be detected is a known attack category or an unknown anomaly by comparing the energy value with a preset threshold.

[0065] Thirdly, the present invention also provides an electronic device, comprising: one or more processors; a memory; and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, wherein when the programs are executed by the processors, they implement the steps of the IoT anomaly detection method based on quaternion state space diffusion enhancement as described in the first aspect of the present invention.

[0066] Fourthly, the present invention also provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the IoT anomaly detection method based on quaternion state space diffusion enhancement as described in the first aspect of the present invention.

[0067] Fifthly, the present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the IoT anomaly detection method based on quaternion state space diffusion enhancement as described in the first aspect of the present invention.

[0068] Beneficial effects: This invention introduces quaternion representation, mapping traffic features of different modalities to quaternion space, effectively preserving the inherent coupling relationship between features, and providing richer feature expression compared to traditional real-valued vector concatenation; it combines the linear complexity advantage of state-space models in long sequence modeling with the advantages of hypergraph neural networks in handling high-order co-occurrence relationships of discrete features, achieving comprehensive capture of the spatiotemporal characteristics of traffic; it generates high-quality pseudo-anomaly samples for pre-training through a latent diffusion model, which, compared to random augmentation, can more effectively drive the model to learn clear and robust decision boundaries; it combines quaternion cepstral loss, making the model more sensitive to frequency domain anomalies; during fine-tuning, it incorporates cue learning, requiring only a very small number of parameter adjustments to achieve high-performance transfer in small-sample scenarios; and it introduces an energy-based decision mechanism, which can effectively identify unknown abnormal traffic outside the distribution, improving the system's security. Attached Figure Description

[0069] Figure 1 The flowchart shows an IoT anomaly detection method based on quaternion state space diffusion enhancement.

[0070] Figure 2 A schematic diagram of a method for constructing a dual-stream heterogeneous feature encoder;

[0071] Figure 3 A schematic diagram illustrating the self-supervised pre-training process to enhance adversarial diffusion;

[0072] Figure 4 A diagram illustrating the fine-tuning process for small samples;

[0073] Figure 5 This is a schematic diagram of the energy determination logic. Detailed Implementation

[0074] The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solutions of the present invention, and should not be used to limit the scope of protection of the present invention.

[0075] like Figure 1 As shown, this invention provides an IoT anomaly detection method based on quaternion state space diffusion enhancement, the method comprising the following steps:

[0076] Step 1, Quaternion Multimodal Temporal Tensor Construction: Parse the raw IoT traffic data and extract four basic features: packet interval time, packet size, protocol flags, and information entropy; map the packet interval time to the real part of the quaternion, and map the packet size, protocol flag embedding vector, and information entropy to the three imaginary parts of the quaternion, respectively, to construct the quaternion temporal tensor.

[0077] This step aims to uniformly map heterogeneous IoT traffic characteristics to a quaternion space, referring to... Figure 2 Specifically, it includes:

[0078] (1) Use a traffic collector (Wireshark) to capture raw traffic PCAP files in an IoT environment. Segment the traffic into sessions based on a 5-tuple (source IP, destination IP, source port, destination port, protocol). For each session stream, extract a sequence of length L (L=100 in this example). If the length is insufficient, pad with zeros; if it exceeds the length, truncate it. Extract four basic features:

[0079] Inter-arrival Time (IAT): The time difference between the arrival of two adjacent data packets;

[0080] Packet Size: The length of the data packet's payload;

[0081] Protocol flags: such as SYN, ACK, FIN, etc. in the TCP protocol;

[0082] Information entropy (Payload Entropy): Shannon entropy calculated based on the byte distribution of the data packet payload.

[0083] (2) After feature extraction, preprocessing and normalization are performed: Min-Max normalization is performed on the packet interval time, mapping it to the [0,1] interval; Z-Score standardization is performed on the packet size and information entropy to make them conform to the standard normal distribution; the protocol flag bits are embedded to convert the original discrete flag bits Code into a normal distribution. tInput a learnable embedding layer, map it to a d-dimensional vector (d=16 in this example), and then project it through a linear projection W. y Compressed into a scalar feature y t .

[0084] (3) Next, we construct the quaternion time series tensor using Hamiltonian algebra rules: ,and The four types of features mentioned above are mapped to the real part and three imaginary parts of a quaternion, respectively. The quaternion element q at time step t... t Represented as: ,in represents the normalized packet interval time, packet size, protocol flag scalar feature, and information entropy, respectively, where i, j, and k are the imaginary units of the quaternions. The final result is a quaternion temporal tensor Q with dimensions (B, L, 4), where B is the batch size.

[0085] Step 2, Dual-stream heterogeneous feature encoding and fusion design: Construct a dual-stream encoder that works in parallel. The first-stream encoder processes the continuous fluid features in the quaternion time-series tensor based on a quaternion selective state-space model, while the second-stream encoder processes the discrete protocol features in the quaternion time-series tensor based on a dynamic hypergraph neural network. The features output by the two encoders are fused to obtain the final flow representation vector.

[0086] like Figure 2 As shown, this step designs a parallel dual-stream encoder to process continuous fluid characteristics and discrete protocol characteristics separately, specifically including:

[0087] First-rate encoder: Employs a quaternion-selective state-space model to handle continuous fluid characteristics. The calculation of this model at discrete time step k is defined by the following discretized equations of the continuous-time system:

[0088] , ,

[0089] in These represent continuous state, input, and output, respectively. Given a time-varying quaternion system matrix; discretized using a zero-order hold, the recursive equation for discrete time step k is obtained:

[0090] ,

[0091] ,

[0092] ,

[0093] ,

[0094] in To discretize the step size, It is the current input Matrix generated by selective network Let I be the exponent of the quaternion matrix, and let I be the identity matrix. This represents quaternion multiplication, where all operations are performed within the quaternion field.

[0095] The quaternion multiplication described herein is a calculation of two quaternion matrices, which can be equivalently converted into matrix multiplication in its real-valued representation: multiplying each quaternion... Represented as a real-valued matrix:

[0096] ,

[0097] Quaternion matrix multiplication can be performed by converting the quaternions into their corresponding real-valued matrices and then performing standard real-valued matrix multiplication.

[0098] The second-stream encoder employs a dynamic hypergraph neural network to process discrete protocol features. The dynamic hypergraph neural network in the first... The construction of time windows and the definition of convolution calculation are as follows.

[0099] (1) Definition of nodes and hyperedges: Suppose that the window contains Each data packet has a set of protocol flags. After deduplication, the node set is obtained. Based on the statistical co-occurrence relationship (flag bits A and B frequently appear in pairs within a time proximity window), a set of hyperedges is defined. Each super edge Connect a group of related nodes.

[0100] (2) Correlation Matrix: Constructing the correlation matrix The matrix element is defined if and only if node v belongs to hyperedge e. .

[0101] (3) Hypergraph Convolution: Initial Features of Nodes The embedding vector is its flag; the formula for the hypergraph convolution operation in the l-th layer is:

[0102] ,

[0103] in The degree matrix is ​​a diagonal matrix whose elements are... ; The hyperedge degree matrix is ​​a diagonal matrix whose elements are... ; It is a learnable hyperedge weight diagonal matrix; Let be the learnable parameter matrix of the l-th layer.

[0104] The features output from the two encoders are concatenated and linearly mapped to obtain the final flow representation vector. This dual-stream heterogeneous feature encoder, also known as a dual-stream encoder, has its parameters initialized and pre-trained in step 3, and fine-tuned in step 4.

[0105] Step 3, Adversarial Diffusion Enhanced Self-Supervised Pre-training: The latent diffusion model is used to learn the distribution of normal flow in the latent space, and pseudo-abnormal samples located at the decision boundary are generated through its diffusion and denoising process; based on the pseudo-abnormal samples and normal samples, combined with the designed loss function, the dual-flow heterogeneous feature encoder is self-supervised pre-trained to learn a flow representation with strong discriminativeness, and the pre-training parameters are saved.

[0106] This step aims to pre-train a two-stream encoder using unlabeled data, referring to... Figure 3 Specifically, it includes:

[0107] (1) Perform latent space mapping using a two-stream encoder. Mapping the quaternion temporal tensor Q of normal samples to the latent space yields the initial latent representation. The latent representation is the flow representation vector obtained by fusing the two outputs of the dual-stream encoder. In this embodiment, the latent space dimension is set to 64. A Markov chain forward diffusion process of T steps (T=1000 in this embodiment) is defined: Each step is . Represents the conditional probability distribution. Indicates a Gaussian normal distribution. Let I represent the latent variable at step t, and let I be the identity matrix, ensuring that the noise is independent across all dimensions. Define the cosine scheduling noise variance sequence. ,satisfy By utilizing the reparameterization technique, the noisy latent variable at step t is directly sampled. :

[0108] ,

[0109] ,

[0110] in It is Gaussian noise. This represents the cumulative noise coefficient. To generate pseudo-anomaly samples, this invention does not perform complete pure noise generation, but instead starts from a predefined intermediate step range. (In this embodiment, random sampling is set within [200, 500]) one step Using a trained denoising network right Perform a single-step inverse prediction to obtain a partially denoised latent representation:

[0111] ,

[0112] Will This serves as a potential representation of the generated pseudo-abnormal samples. These samples are located in a low-density region surrounding the normal data distribution, i.e., at the ambiguous boundary between normal and abnormal, which is significant for training the classifier's boundary sensitivity.

[0113] (2) Calculation and optimization of the hybrid loss function, including normal samples and generated pseudo-anomaly samples Input the two-stream encoder to be pre-trained and calculate the joint loss: ,in, Characterization of normal samples For the feature representation of pseudo-abnormal samples, For the dual-stream encoder to be pre-trained; For the reconstructed quaternion temporal tensor; To balance the hyperparameters of the two losses (in this embodiment) ).

[0114] The contrast loss L contrastive The goal is to minimize the feature distance between normal samples while maximizing the feature distance between normal samples and pseudo-abnormal samples, until a preset boundary interval is met. The calculation formula is:

[0115] ,

[0116] in For a pair of normal samples, It is the Euclidean distance function.

[0117] The reconstruction loss L recon Specifically, this involves quaternion cepstral distance loss. First, the quaternion time-series tensor Q is decomposed into four independent real-valued channel signals. ,in Corresponding to the real part and three imaginary parts respectively; for each channel signal s[n] of each sample in each batch, calculate its cepstral coefficients c[n]:

[0118] ,

[0119] ,

[0120] ,

[0121] ,

[0122] ,

[0123] in and Let n represent the Discrete Fourier Transform and its inverse transform, respectively, where n is the discrete-time index. Here, L is the frequency index, and L is the sequence length. To prevent the logarithmic calculation from resulting in a small constant with negative infinity, for each flow sample in the batch, the c[n] c of the c-th channel is represented as a row vector. , Let c be the cepstral coefficient matrix of channel c. Let Frobenius norm be denoted. The reconstruction loss is defined as the difference in Frobenius norm between the cepstral coefficient matrices of the original signal and the reconstructed signal.

[0124] Step 4, Fine-tuning and prototype correction of small-sample temporal cueing: A set of learnable continuous cue vectors is injected into the front end of the input sequence, and the model is adapted to the new task by optimizing only the cue vectors and a lightweight classification head; at the same time, using support set and query set samples, prototype vectors of each category are iteratively corrected in a semi-supervised manner to improve the robustness of the representation under small sample conditions.

[0125] This step enables the pre-trained model to quickly adapt to new tasks under small sample conditions. For example... Figure 4 As shown, a support set of a small number of labeled samples and an unlabeled query set for auxiliary training are pre-constructed.

[0126] Pre-trained dual-stream encoder The input dimension is Define a trainable parameter matrix As a set of cue vectors, where m is the cue length; for any input sample, the quaternion temporal tensor Q is mapped through a linear projection layer to... Construct its enhanced input prompts for:

[0127] ,

[0128] in p represents a concatenation operation along the length dimension of the sequence. i For the i-th row of P, x j For the j-th row of X, then... Dual-stream encoder with input freeze parameters Only the cue vector P and the lightweight classifier head are optimized, so that the model can quickly adapt to new tasks.

[0129] Using samples from the support set (labeled) and the query set (unlabeled), the prototypes of each category are iteratively corrected using a soft-label expectation-maximization algorithm. The steps for the t-th iteration are as follows:

[0130] 1) Expected step: Calculate the query set The soft-assigned probability that each sample belongs to class K :

[0131] ,

[0132] in To provide suggestions for enhanced input, For sample characterization, Let be the prototype vector of category k at the t-th iteration. It is the Euclidean distance function. Temperature is a parameter that controls the smoothness of the probability distribution.

[0133] 2) Maximize step: Utilize support set Based on the hard labels and soft assignment probabilities of the query set, update the prototype vectors for each category:

[0134] ,

[0135] in This is an indicator function; its value is 1 when the condition is true, and 0 otherwise. Weight coefficients for the query set samples; initial prototype Calculated from the support set samples.

[0136] 3) Repeat the above two steps until the convergence condition is met. Convergence threshold In this embodiment, the minimum positive number is preset. =0.0001.

[0137] Step 5, Anomaly determination based on energy model: For the test sample (in this embodiment, the test sample is used to observe the model performance; in actual applications, it is the traffic to be detected), calculate the energy value between it and the prototype vector of each category; by comparing the energy value with a preset threshold, determine whether the test sample is a known attack category or an unknown anomaly.

[0138] like Figure 5 As shown, this step is used to identify known attacks and unknown anomalies. Specifically, it includes:

[0139] For calculating test samples energy value The formula is based on the Helmholtz definition of free energy, and the specific formula is as follows:

[0140] ,

[0141] in Provide enhanced representations for the test samples. These are the prototype vectors of the K known attack categories after correction in step 4. It is the Euclidean distance function. To maintain the same temperature parameter as in step 4, a threshold τ is set, and the judgment rule is as follows:

[0142] ,

[0143] in An additional distance threshold is used to filter out anomalous samples that are too far from all prototypes, further improving the ability to identify out-of-distribution samples. As the decision rule shows, if a sample's energy value is below τ and its distance from the nearest prototype is less than the threshold... If the energy level is within the range of known attack types corresponding to the lowest energy prototype, then the sample is classified as an unknown anomaly. Otherwise, the sample is determined to be an unknown anomaly.

[0144] This invention utilizes a large amount of unlabeled data to perform adversarial diffusion pre-training on a two-stream encoder, obtaining model parameters with general feature extraction capabilities. Subsequently, a small number of labeled samples are used to fine-tune the pre-trained model with prompts and perform prototype correction, generating a classifier and prototype vector adapted to a specific detection task. In practical applications, the system receives the traffic to be detected in real time, constructs a quaternion tensor, loads the optimized two-stream encoder parameters and prompt vectors, extracts traffic representations, calculates the distance to each category's prototype using an energy model, and outputs the final detection result.

[0145] Based on the same technical concept as the method embodiments, the present invention also provides an IoT anomaly detection system based on quaternion state space diffusion enhancement, comprising:

[0146] The data preprocessing module is used to parse raw IoT traffic data, extract four basic features: packet interval time, data packet size, protocol flag bits, and information entropy, and construct a quaternion time series tensor.

[0147] The dual-stream heterogeneous feature encoding module is used to construct a dual-stream encoder that works in parallel. The first-stream encoder processes the continuous fluid features in the quaternion time-series tensor based on the quaternion selective state-space model, while the second-stream encoder processes the discrete protocol features in the quaternion time-series tensor based on the dynamic hypergraph neural network. The features output by the two encoders are fused to obtain the final flow characterization vector.

[0148] The adversarial pre-training module is used to construct a latent space based on the two-stream encoder, learn the distribution of normal flow in the latent space using a diffusion model, and generate pseudo-abnormal samples located at the decision boundary through diffusion and denoising processes. Based on the pseudo-abnormal samples and normal samples, combined with the designed loss function, the two-stream encoder is pre-trained in a self-supervised manner, and the pre-training parameters are saved.

[0149] The few-shot adaptation module is used to freeze the parameters of the two-stream encoder, construct a set of learnable continuous cue vectors and inject them into the front end of the input sequence. By optimizing only the cue vectors and a lightweight classification head, the model is adapted to the new task. At the same time, using support set and query set samples, prototype vectors of each category are iteratively corrected in a semi-supervised manner.

[0150] The online detection module receives traffic data to be detected; it calls the data preprocessing module to construct a quaternion time series tensor from the traffic data to be detected; it calls the dual-stream heterogeneous feature encoding module and loads pre-trained parameters and optimized cue vectors; it extracts traffic representations based on the quaternion time series tensor; it calculates the energy value between the traffic representation and the corrected prototype vectors of each category; and it determines whether the traffic to be detected is a known attack category or an unknown anomaly by comparing the energy value with a preset threshold.

[0151] It should be understood that the IoT anomaly detection system based on quaternion state space diffusion enhancement in the embodiments of the present invention can implement all the technical solutions in the above method embodiments. The functions of each functional module can be specifically implemented according to the methods in the above method embodiments. The specific implementation process can be referred to the relevant descriptions in the above embodiments, which will not be repeated here.

[0152] The present invention also provides an electronic device, comprising: one or more processors; a memory; and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, wherein when the programs are executed by the processors, they implement the steps of the IoT anomaly detection method based on quaternion state space diffusion enhancement as described above.

[0153] The present invention also provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the IoT anomaly detection method based on quaternion state space diffusion enhancement as described above.

[0154] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, apparatus, computer devices, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0155] This invention is described with reference to a flowchart of a method according to embodiments of the invention. It should be understood that each step in the flowchart and combinations thereof can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing device, generate instructions for implementing the process. Figure 1 A device for a function specified in one or more processes.

[0156] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 The function specified in one or more processes.

[0157] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 Steps of a specified function in one or more processes.

Claims

1. An IoT anomaly detection method based on quaternion state space diffusion enhancement, characterized in that, Includes the following steps: Analyze raw IoT traffic data and extract four basic features: packet interval time, packet size, protocol flags, and information entropy, and construct a quaternion time series tensor. A dual-stream encoder that operates in parallel is constructed. The first-stream encoder processes the continuous fluid features in the quaternion time-series tensor based on a quaternion selective state-space model, while the second-stream encoder processes the discrete protocol features in the quaternion time-series tensor based on a dynamic hypergraph neural network. The features output by the two encoders are fused to obtain the final flow representation vector. The latent space is constructed based on the two-stream encoder, the distribution of normal flow in the latent space is learned using the diffusion model, and pseudo-abnormal samples located at the decision boundary are generated through the diffusion and denoising process. Based on pseudo-abnormal samples and normal samples, combined with the designed loss function, the two-stream encoder is pre-trained under self-supervised supervision, and the pre-training parameters are saved. The dual-stream encoder parameters are frozen, and a set of learnable continuous cue vectors are constructed and injected into the front end of the input sequence. By optimizing only the cue vectors and a lightweight classification head, the model is adapted to the new task. At the same time, using support set and query set samples, prototype vectors of each category are iteratively corrected in a semi-supervised manner. The traffic data to be detected is acquired and constructed as a quaternion temporal tensor. Pre-trained parameters and optimized cue vectors are loaded onto the dual-stream encoder. Traffic representation is extracted based on the quaternion temporal tensor. The energy value between the traffic representation and the corrected prototype vectors of each category is calculated. The traffic to be detected is determined to be a known attack category or an unknown anomaly by comparing the energy value with a preset threshold.

2. The method according to claim 1, characterized in that, Analyze raw IoT traffic data to extract four basic features: packet interval time, packet size, protocol flags, and information entropy. Construct a quaternion time series tensor, including: The packet interval time is mapped to the real part of a quaternion, and the packet size, protocol flag scalar features, and information entropy are mapped to the three imaginary parts of the quaternion, respectively. For a traffic sequence of length L, the constructed quaternion time series tensor... The t-th element q t Represented as: ,in These represent the normalized packet interval time, packet size, scalar characteristics of protocol flags, and information entropy, respectively, where i, j, and k are the imaginary units of the quaternions, satisfying the Hamiltonian algebra rules. ,and B represents the batch size, and H represents the quaternion field. Protocol flag scalar feature y t Obtained in the following way: the original protocol flags Code. t Mapped to a d-dimensional vector through a learnable embedding layer. Then, through a linear projection or mean averaging operation, the dimensionality is reduced to a scalar, i.e. W y For projection weights.

3. The method according to claim 2, characterized in that, In the first-order encoder, the quaternion-selective state-space model is calculated at discrete time step k by the following discretized equations of the continuous-time system: , ， in These represent continuous state, input, and output, respectively. Given a time-varying quaternion system matrix; discretized using a zero-order hold, the recursive equation for discrete time step k is obtained: ， ， ， ， in To discretize the step size, It is the current input Matrix generated by selective network The exponent of the quaternion matrix. This represents quaternion multiplication, where all operations are performed within the quaternion field.

4. The method according to claim 3, characterized in that, In the second-stream encoder, the dynamic hypergraph neural network is in the first... The construction of each time window and the convolution calculation are as follows: Node and hyperedge definition: Assume the window contains Each data packet has a set of protocol flags. After deduplication, the node set is obtained. Define the hyperedge set based on statistical co-occurrence relations. Each super edge Connect a group of related nodes; Inclusion Matrix: Constructing the Inclusion Matrix The element of the incidence matrix is ​​such that the node v belongs to the hyperedge e. ; Hypergraph Convolution: Initial Features of Nodes The embedding vector is its flag; the formula for the hypergraph convolution operation in the l-th layer is: ， in The degree matrix is ​​a diagonal matrix whose elements are... ; The hyperedge degree matrix is ​​a diagonal matrix whose elements are... ; It is a learnable hyperedge weight diagonal matrix; Let be the learnable parameter matrix of the l-th layer.

5. The method according to claim 4, characterized in that, A latent space is constructed based on a two-stream encoder. A latent diffusion model is used to learn the distribution of normal flow within the latent space. Pseudo-anomaly samples located at the decision boundary are generated through a diffusion and denoising process, including: Using a dual-stream encoder Mapping the quaternion time-series tensor Q of normal flow samples to the latent space yields the initial latent representation. , Indicates the dimension of the encoder mapping; Perform a forward diffusion process, defined as a T-step Markov chain: Each step is , Represents the conditional probability distribution. Indicates a Gaussian normal distribution. Let I represent the latent variables at step t, and let I be the identity matrix. For the preset cosine scheduling noise variance table, satisfying ; Through reparameterization techniques, from the initial latent representation Directly sample the latent noise variables at any step t: ,in It is Gaussian noise. , This is the cumulative noise figure; From the predefined intermediate step range Uniform random sampling in one step Obtain the corresponding noisy latent representation Using a trained denoising network right Perform a single-step backward prediction to calculate the state of the previous time step. The underlying representation of the generated pseudo-anomaly samples is calculated as follows: .

6. The method according to claim 5, characterized in that, The loss function used for self-supervised pre-training of a two-stream encoder It is a weighted sum of the contrast loss term and the reconstruction loss term, and its expression is: ,in, Characterization of normal samples For the feature representation of pseudo-abnormal samples, For the dual-stream encoder to be pre-trained; For the reconstructed quaternion temporal tensor; To balance the hyperparameters of the two losses; Comparison loss L contrastive The goal is to minimize the feature distance between normal samples while maximizing the feature distance between normal samples and pseudo-abnormal samples, until a preset boundary interval is met. The calculation formula is: ， in For a pair of normal samples, It is the Euclidean distance function; Reconstruction loss L recon Specifically, the quaternion cepstral distance loss is calculated as follows: the quaternion time series tensor Q is decomposed into four independent real-valued channel signals. ,in These correspond to the real part and the three imaginary parts, respectively; for each channel signal s[n] of each sample in each batch, its cepstral coefficients c[n] are calculated according to the following formula: ， ， ， For each flow sample in the batch, the cepstral coefficient c[n] calculated on the c-th channel is represented as a row vector. , The cepstral coefficient matrix for channel c is as follows: ， The reconstruction loss is calculated based on the cepstral coefficient matrix: ， in and Let n represent the Discrete Fourier Transform and its inverse transform, respectively, where n is the discrete-time index. Here, L is the frequency index, and L is the sequence length. To prevent small constants with negative infinity from appearing in logarithmic calculations; This represents the Frobenius norm.

7. The method according to claim 6, characterized in that, The process of iteratively correcting the prototype vector in a semi-supervised manner specifically employs the soft-label expectation-maximization algorithm, and its t-th iteration steps are as follows: Expected step: Calculate the query set The soft-assigned probability that each sample belongs to class K : ， in To provide suggestions for enhanced input, For sample characterization, Let be the prototype vector of category k at the t-th iteration. It is the Euclidean distance function. This is a temperature parameter used to control the smoothness of the probability distribution; Maximize step: Utilize support set Based on the hard labels and soft assignment probabilities of the query set, update the prototype vectors for each category: ， in This is an indicator function; its value is 1 when the condition is true, and 0 otherwise. Weight coefficients for the query set samples; initial prototype Calculated from the support set samples; Repeat the above two steps until the convergence condition is met. ,in This is the preset convergence threshold.

8. The method according to claim 7, characterized in that, The energy value between the flow representation and the corrected prototype vectors of each category is calculated based on the Helmholtz free energy definition, with the specific formula as follows: ， in The flow rate sample to be detected. The enhanced characterization is shown for the flow sample to be detected. These are the corrected prototype vectors of the K known attack categories. It is the Euclidean distance function. For temperature parameters; The detection of traffic is determined by comparing its energy value with a preset threshold, classifying it as a known attack or an unknown anomaly. This includes cases where the sample's energy value is below a first threshold τ and its distance from the nearest prototype is less than a second threshold. If the energy level is within the range of known attack types corresponding to the lowest energy prototype, then the sample will be classified as an unknown anomaly; otherwise, the sample will be classified as an unknown anomaly.

9. An IoT anomaly detection system based on quaternion state space diffusion enhancement, characterized in that, include: The data preprocessing module is used to parse raw IoT traffic data, extract four basic features: packet interval time, packet size, protocol flags, and information entropy, and construct a quaternion time series tensor. The dual-stream heterogeneous feature encoding module is used to construct a dual-stream encoder that works in parallel. The first-stream encoder processes the continuous fluid features in the quaternion time-series tensor based on the quaternion selective state-space model, while the second-stream encoder processes the discrete protocol features in the quaternion time-series tensor based on the dynamic hypergraph neural network. The features output by the two encoders are fused to obtain the final flow characterization vector. The adversarial pre-training module is used to construct a latent space based on the two-stream encoder, learn the distribution of normal flow in the latent space using a diffusion model, and generate pseudo-abnormal samples located at the decision boundary through diffusion and denoising processes. Based on the pseudo-abnormal samples and normal samples, combined with the designed loss function, the two-stream encoder is pre-trained in a self-supervised manner, and the pre-training parameters are saved. The few-shot adaptation module is used to freeze the parameters of the two-stream encoder, construct a set of learnable continuous cue vectors and inject them into the front end of the input sequence. By optimizing only the cue vectors and a lightweight classification head, the model is adapted to the new task. At the same time, using support set and query set samples, prototype vectors of each category are iteratively corrected in a semi-supervised manner. The online detection module is used to receive traffic data to be detected; The data preprocessing module is invoked to construct the traffic data to be detected into a quaternion time series tensor; The dual-stream heterogeneous feature encoding module is invoked and pre-trained parameters and optimized cue vectors are loaded. Traffic representation is extracted based on quaternion time series tensors. The energy value between the traffic representation and the corrected prototype vectors of each category is calculated. By comparing the energy value with a preset threshold, it is determined whether the traffic to be detected is a known attack category or an unknown anomaly.

10. An electronic device, characterized in that, include: One or more processors; Memory; And one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, wherein when the programs are executed by the processors, they implement the steps of the IoT anomaly detection method based on quaternion state space diffusion enhancement as described in any one of claims 1-8.

Images