Method and device for detecting abnormal data in smart terminals based on edge computing

Abstract

This invention provides a method and device for detecting abnormal data in smart terminals based on edge computing. It acquires the initial operational data stream of the smart terminal and performs time-axis aligned segmentation to obtain data segments to be detected. For each data segment, a behavioral topology graph is constructed with the terminal as nodes and interaction relationships as edges. The behavioral attribute feature sequences of the nodes and the evolution trajectory of the edge interaction strength are extracted. The topology graph and feature sequences are input into an anomaly propagation analysis model for graph convolution operations to trace the anomaly propagation path and output preliminary anomaly labels and anomaly propagation path feature vectors. Within the edge cluster, the feature vectors are broadcast to adjacent nodes for consensus verification, generating consensus anomaly labels and anomaly association graphs between nodes. Combined with a historical anomaly pattern library, dynamic pattern matching and calibration are performed on the consensus results to obtain the final anomaly determination result and anomaly propagation root cause location information for each terminal. This invention improves the accuracy of anomaly detection and the reliability of root cause location.

Description

Technical Field

[0001] This invention relates to the field of data processing, and more specifically, to a method and device for detecting abnormal data in smart terminals based on edge computing. Background Technology

[0002] Intelligent terminal anomaly detection technology is a technique that analyzes the operational data generated by terminal devices to identify abnormal behavior patterns or fault states. Currently, multiple intelligent terminals collect and initially process data through local edge computing nodes, which then collaborate with cloud servers to complete deeper data analysis tasks. The mainstream intelligent terminal anomaly detection methods typically collect operational status data from terminal devices on edge computing nodes and monitor the data stream of a single terminal using preset threshold rules or simple statistical models. When a data indicator exceeds a preset range at a certain moment, the terminal is deemed to have malfunctioned. However, this single-point threshold-based detection method often fails to meet the accuracy requirements of practical applications when faced with complex terminal behavior patterns and dynamically changing operating environments. It is also susceptible to misjudgments due to occasional data fluctuations, and cannot effectively support the need for accurate identification of abnormal intelligent terminal behavior in edge computing scenarios. Summary of the Invention

[0003] In view of this, the present invention provides a method and device for detecting abnormal data in smart terminals based on edge computing.

[0004] According to one aspect of the present invention, a method for detecting abnormal data of intelligent terminals based on edge computing is provided. The method includes: acquiring initial running data streams generated by multiple intelligent terminals deployed on edge computing nodes during a continuous acquisition period; aligning and cutting the initial running data streams along the time axis to obtain multiple data segments to be detected with a unified time reference; constructing a terminal behavior graph for each data segment to be detected, generating a behavior topology graph with intelligent terminals as nodes and inter-terminal interaction relationships as edges, and extracting the behavior attribute feature sequence of each node and the interaction intensity evolution trajectory of each edge in the behavior topology graph; and inputting the behavior topology graph, behavior attribute feature sequence, and interaction intensity evolution trajectory into an abnormal transmission mechanism preset on the edge computing node. The anomaly propagation analysis model uses a graph convolutional network layer to trace the anomaly propagation path, obtaining preliminary anomaly labels and anomaly propagation path feature vectors for each data segment to be detected. Within the edge cluster to which the edge computing node belongs, the anomaly propagation path feature vectors are broadcast to adjacent edge computing nodes. The model receives the sets of anomaly propagation path feature vectors returned by adjacent edge computing nodes and performs consensus verification to generate consensus anomaly labels and anomaly correlation graphs between nodes. Based on the consensus anomaly labels and anomaly correlation graphs between nodes, dynamic pattern matching and calibration are performed using a historical anomaly pattern library stored locally on the edge computing nodes to obtain the final anomaly determination result and anomaly propagation root cause location information for each smart terminal within the corresponding time window.

[0005] According to another aspect of the present invention, a computer device is provided, comprising: a processor; and a memory, wherein the memory stores computer-readable code that, when executed by the processor, causes the processor to perform the method as described above.

[0006] This invention provides a unified time-based data segment for anomaly detection by acquiring the initial operational data stream of smart terminals and aligning and segmenting it along the time axis. By constructing a terminal behavior topology graph and extracting node behavior attribute feature sequences and edge interaction intensity evolution trajectories, isolated terminal data is transformed into a graph structure representing group behavior patterns, enabling anomaly detection to capture the propagation path of anomalies within the cluster. The anomaly propagation analysis model uses a graph convolutional network layer to trace the anomaly diffusion path, obtaining preliminary anomaly markers and propagation path feature vectors, quantifying the direction and range of anomaly propagation. Consensus verification is performed by broadcasting feature vectors within the edge cluster and receiving feature vectors returned by adjacent nodes, generating consensus anomaly markers and anomaly association graphs between nodes, collaboratively verifying the accuracy of anomaly judgment and suppressing single-node misjudgments. Finally, dynamic pattern matching and calibration are performed using a historical anomaly pattern library to obtain the final anomaly judgment result and root cause localization information. This approach utilizes historical experience to correct judgments and accurately locates the source and propagation path of anomalies, thereby comprehensively improving the accuracy, robustness, and interpretability of smart terminal anomaly detection. Attached Figure Description

[0007] Figure 1 This is a schematic diagram of an application scenario provided by the present invention;

[0008] Figure 2 This is a flowchart illustrating an abnormal data detection method for smart terminals based on edge computing provided by the present invention.

[0009] Figure 3 This is a schematic diagram of the structure of a data detection device provided in an embodiment of the present invention;

[0010] Figure 4 This is a schematic diagram of the structure of a computer device provided in an embodiment of the present invention. Detailed Implementation

[0011] To facilitate a clearer understanding of this invention, we will first introduce the application scenarios of the edge computing-based intelligent terminal abnormal data detection method, such as... Figure 1 As shown, the application scenario of this invention includes computer equipment 10 and a cluster of smart terminals. The cluster of smart terminals may include one or more smart terminals; the number of smart terminals will not be limited here. Figure 1 As shown, the smart terminal cluster may specifically include smart terminal 1, smart terminal 2, ..., smart terminal n; it can be understood that smart terminal 1, smart terminal 2, smart terminal 3, ..., smart terminal n can all be connected to computer device 10 via network so that each smart terminal can interact with computer device 10 via network connection.

[0012] It is understood that computer device 10 can refer to a device that executes the edge computing-based intelligent terminal abnormal data detection method provided in the embodiments of the present invention. Computer device 10 can be, for example, a server, a single physical server, a server cluster or distributed system consisting of at least two physical servers, or a computer system. Intelligent terminals can specifically refer to industrial robots, environmental monitoring sensors, smart meters, etc., but are not limited to these. Various intelligent terminals and computer device 10 can be directly or indirectly connected via wired or wireless communication. Furthermore, the number of intelligent terminals and computer device 10 can be one or at least two; the present invention does not impose any limitations on this.

[0013] Further, please see Figure 2 This is a flowchart illustrating an abnormal data detection method for smart terminals based on edge computing, provided in an embodiment of the present invention. Figure 2 As shown, this method can be derived from... Figure 1The method for detecting abnormal data from an edge-computing smart terminal is executed by a computer device 10, and may include the following steps:

[0014] Step S100: Obtain the initial running data stream generated by multiple smart terminals deployed on the edge computing node during the continuous collection period, and perform time-axis aligned cutting on the initial running data stream to obtain multiple data segments to be detected with a unified time base.

[0015] Edge computing nodes are hardware devices or virtual platforms with computing and storage capabilities deployed at the network edge to access and process data uploaded by smart terminals within their coverage area. Smart terminals are various IoT terminal devices that establish communication connections with edge computing nodes, such as industrial robots, environmental monitoring sensors, and smart meters. These devices continuously generate data packets containing operational status and interaction information during operation. A continuous data collection period is a pre-defined time range for collecting data, such as the past five or ten minutes. The initial running data stream is the raw collection of data packets generated by all smart terminals within the continuous data collection period. Due to differences in crystal oscillator frequencies within each terminal device, varying network transmission delays, and diverse data reporting strategies, these data packets are non-aligned and unordered in the time dimension.

[0016] Time-axis alignment and segmentation divides and reassembles the initially disordered data stream according to a unified time base, resulting in multiple data segments that are temporally continuous and of equal length. Specifically, the edge computing node first receives data packets from all connected smart terminals and parses the generation timestamp field carried in the header of each data packet. This timestamp field records the precise time the packet was generated by the terminal. All terminals synchronize their clocks with the edge computing node via a network time protocol before generating the timestamp, ensuring time base consistency. Next, the edge computing node uses a set time window length, such as 5 or 10 seconds, as the segmentation granularity, and sequentially extracts all data packets falling within each time window, starting from the beginning of the continuous acquisition period. For each time window, the set of data packets it contains is encapsulated into a data segment to be detected. Although all data packets within this segment may have slight differences in their generation times, they are all attributed to the same time window, thus achieving time-axis alignment. All data segments to be detected are arranged in chronological order according to the time windows, collectively covering the entire continuous acquisition period.

[0017] Step S200: Construct a terminal behavior graph for each data segment to be detected, generate a behavior topology graph with smart terminals as nodes and inter-terminal interaction relationships as edges, and extract the behavior attribute feature sequence of each node and the interaction intensity evolution trajectory of each edge in the behavior topology graph.

[0018] In one implementation, step S200 may specifically include the following steps S210 to S260:

[0019] Step S210: Analyze the data packets generated by each smart terminal in each data segment to be detected, extract the source terminal identifier field, target terminal identifier field, communication protocol type field, and data payload size field from each data packet, identify whether there is a data packet exchange relationship between any two smart terminals based on the source terminal identifier field and target terminal identifier field, and construct an initial behavior topology graph containing all nodes and all edges, with each smart terminal as a node in the behavior topology graph and the data packet exchange relationship as an edge connecting the two nodes.

[0020] In the data segment to be detected, each data packet generated by a smart terminal is the basic information unit for constructing the behavioral graph. The source terminal identifier field contains the encoding used to uniquely identify the smart terminal sending the packet, such as the terminal's Media Access Control address or device serial number. The destination terminal identifier field contains the encoding used to uniquely identify the smart terminal intended to receive the packet. The communication protocol type field contains the communication protocol standard followed by the data packet during transmission, such as Message Queuing Telemetry Transport Protocol (MQTP) or Hypertext Transfer Protocol (HTTP). The data payload size field contains the actual length of data bytes carried by the data packet after removing the header information. The data packet exchange relationship is a one-way or two-way communication behavior of sending data packets from one smart terminal to another, determined by the source and destination terminal identifiers. The initial behavioral topology graph is a directed or undirected graph structure with smart terminals as nodes and data packet exchange relationships as edges, used to visually represent the communication connection status between terminals. Specifically, the edge computing node first traverses each data packet within the data segment to be detected, parses the source terminal identifier, target terminal identifier, and communication protocol type from the packet header, and parses the data payload size from the packet tail.

[0021] For each pair of source and target terminal identifiers parsed, the edge computing node determines whether these two identifiers correspond to two different smart terminals. If they are different, it confirms that a data packet exchange relationship exists between these two terminals. The edge computing node extracts all smart terminal identifiers that appear in the data segment, with each identifier corresponding to a node in the behavioral topology graph. Simultaneously, all confirmed data packet exchange relationships are converted into edges connecting the corresponding two nodes. If multiple packet exchanges exist between two terminals, only one edge is established, but it will be assigned corresponding weights or attributes in subsequent steps. Ultimately, the generated initial behavioral topology graph contains all active smart terminal nodes within the data segment to be detected and all existing communication connection edges between them.

[0022] Step S220: For each node in the initial behavior topology graph, count the number of data packets sent and received by the smart terminal corresponding to the node at consecutive time points covered by the data segment to be detected. Arrange the number of data packets sent in chronological order to obtain the data transmission frequency sequence of the node, and arrange the number of data packets received in chronological order to obtain the data reception frequency sequence of the node. Combine the data transmission frequency sequence and the data reception frequency sequence to obtain the behavior attribute feature sequence corresponding to each node.

[0023] In one implementation, step S220 may specifically include the following steps S221 to S225:

[0024] Step S221: Obtain the start and end timestamps of the data segment to be detected. Divide the time period between the start and end timestamps into multiple continuous and non-overlapping time sub-windows with a preset unit time interval as the division granularity. Each time sub-window corresponds to a specific time interval range.

[0025] The start timestamp is the beginning of the time range covered by the data segment to be detected, and the end timestamp is the end of that time range. These two timestamps define the time span of the entire data segment to be detected. The unit time interval is a pre-defined fixed duration used to subdivide the entire time span, such as 500 milliseconds or 1 second. The time sub-window is a continuous and non-overlapping time interval obtained by uniformly dividing the time period between the start timestamp and the end timestamp using the unit time interval as its length.

[0026] Specifically, the edge computing node first reads the metadata of the data segment to be detected, obtaining the start and end timestamps corresponding to that segment. Then, based on a preset unit time interval, such as 500 milliseconds, it calculates the total number of time sub-windows that can be divided between the start and end timestamps. Starting from the start timestamp, the edge computing node sequentially accumulates the unit time intervals, generating a series of time points. The interval between any two adjacent time points constitutes a time sub-window.

[0027] For example, the first time sub-window extends from the start timestamp to the start timestamp plus a unit time interval, the second time sub-window extends from the start timestamp plus a unit time interval to the start timestamp plus twice the unit time interval, and so on, until the end timestamp is covered. All generated time sub-windows together form a continuous and non-overlapping sequence on the time axis, providing a precise time segmentation basis for subsequent statistical analysis of the behavior of each node along the time dimension.

[0028] Step S222: For each smart terminal corresponding to a node, traverse all data packets generated by the smart terminal within the data segment to be detected, determine the time sub-window to which the data packet belongs based on the generation timestamp of each data packet, count the total number of data packets sent by the smart terminal as the source terminal within each time sub-window, and arrange the total number of data packets corresponding to each time sub-window according to the order of the time sub-windows to obtain the data transmission frequency sequence of the node.

[0029] The data transmission frequency sequence of a node is used to characterize the data transmission activity of the smart terminal within the data segment to be detected over time. Specifically, for each node in the behavioral topology graph, the edge computing node first filters out all data packets whose source terminal identifiers match the smart terminal identifier corresponding to that node from the data segment to be detected. These packets represent information actively sent out by the smart terminal. Next, for each filtered data packet, the edge computing node parses its generation timestamp field to obtain the specific time when the packet was generated. Then, it compares this time with the range of all time sub-windows divided in step S221 one by one to determine which time sub-window the time falls within, thus assigning the packet to the corresponding time sub-window. After completing the assignment determination for all packets, the edge computing node counts the number of packets assigned within each time sub-window to obtain the total number of data packets sent by the smart terminal as a source terminal within that time sub-window. Finally, following the chronological order of the time sub-windows from morning to evening, the total number of data packets corresponding to each time sub-window is arranged sequentially to form a numerical sequence. This sequence represents the data transmission frequency sequence for that node. The first element in the sequence corresponds to the total number of transmissions within the first time sub-window, the second element corresponds to the total number of transmissions within the second time sub-window, and so on.

[0030] Step S223: For each smart terminal corresponding to a node, traverse all data packets generated by the smart terminal within the data segment to be detected, determine the time sub-window to which the data packet belongs based on the generation timestamp of each data packet, count the total number of data packets received by the smart terminal as the target terminal within each time sub-window, and arrange the total number of data packets corresponding to each time sub-window according to the order of the time sub-windows to obtain the data reception frequency sequence of the node.

[0031] The data reception frequency sequence of a node is used to characterize the data reception activity of the smart terminal within the data segment to be detected over time. Specifically, for each node in the behavioral topology graph, the edge computing node first filters out all data packets whose target terminal identifiers match the smart terminal identifier corresponding to the node from the data segment to be detected. These packets represent information sent to the smart terminal by other smart terminals. Next, for each filtered data packet, the edge computing node parses its generation timestamp field to obtain the specific time when the packet was generated, and assigns the packet to the corresponding time sub-window divided in step S221 based on that time. After completing the assignment judgment of all received packets, the edge computing node counts the number of packets assigned in each time sub-window to obtain the total number of data packets received by the smart terminal as the target terminal in that time sub-window. Finally, according to the chronological order of the time sub-windows from early to late, the total number of data packets corresponding to each time sub-window is arranged sequentially to form a numerical sequence, which is the data reception frequency sequence of the node. The first element in the sequence corresponds to the total number of receptions within the first time sub-window, the second element corresponds to the total number of receptions within the second time sub-window, and so on.

[0032] Step S224: For each time sub-window corresponding to each node, combine the element values ​​in the data transmission frequency sequence and the element values ​​in the data reception frequency sequence corresponding to the time sub-window into a two-dimensional vector, and use the two-dimensional vector as the instantaneous representation of the behavior attribute of the node within the time sub-window.

[0033] The instantaneous representation of behavioral attributes is used to simultaneously characterize the sending and receiving behaviors of a node within a single time sub-window within a unified data structure. Specifically, for each node in the behavioral topology graph, the edge computing node traverses in parallel the node's data sending frequency sequence and data receiving frequency sequence. These two sequences have the same length, and elements at the same position in the sequences correspond to the same time sub-window. For the first time sub-window, the edge computing node extracts the first element value from the node's data sending frequency sequence and the first element value from the data receiving frequency sequence, and combines these two values ​​in a fixed order to form a vector containing two components. For example, the sending frequency is used as the first component of the vector, and the receiving frequency is used as the second component. This vector composed of two values ​​is the instantaneous representation of the node's behavioral attributes within the first time sub-window, which comprehensively reflects the node's data sending and receiving intensity within this short period. In the same way, for the second, third, and so on, up to the last time sub-window, the edge computing node sequentially combines the sending frequency element values ​​and receiving frequency element values ​​at the corresponding positions into a two-dimensional vector, thereby generating an instantaneous representation of behavioral attributes for each time sub-window.

[0034] Step S225: Concatenate the instantaneous representations of the behavioral attributes corresponding to all time sub-windows according to the order of the time sub-windows to obtain the behavioral attribute feature sequence corresponding to each node. The i-th element in the behavioral attribute feature sequence is the two-dimensional vector corresponding to the i-th time sub-window.

[0035] The behavioral attribute feature sequence is a multi-dimensional temporal data structure formed by organizing the instantaneous representations of a node's behavioral attributes within a complete data segment to be detected in chronological order. Specifically, after generating a two-dimensional vector for each time sub-window of a node in step S224, the edge computing node needs to integrate these discrete vectors into a continuous sequence. The integration method is to splice them according to the natural order of the time sub-windows, that is, first, the two-dimensional vector corresponding to the first time sub-window is taken as the first element of the sequence, then the two-dimensional vector corresponding to the second time sub-window is taken as the second element, then the two-dimensional vector corresponding to the third time sub-window is taken as the third element, and so on, until the two-dimensional vector corresponding to the last time sub-window is taken as the last element. The final sequence has a length equal to the total number of time sub-windows, and each element in the sequence is a two-dimensional vector containing the sending frequency and receiving frequency of the node within that time sub-window. This behavioral attribute feature sequence completely records the trajectory of the intensity and pattern of the intelligent terminal's communication behavior over time during the entire data segment to be detected, providing input features for subsequent anomaly analysis models to characterize the dynamics of individual node behavior.

[0036] Step S230: For each edge in the initial behavioral topology graph, count the total number of data packets transmitted by the two smart terminals connected to the edge through the edge at consecutive time points covered by the data segment to be detected. Arrange the total number of data packets in chronological order to obtain the transmission frequency evolution sequence of the edge. Count the total data load of all data packets transmitted by the two smart terminals connected to the edge through the edge at consecutive time points covered by the data segment to be detected and calculate the average data load at each time point. Arrange the average data load in chronological order to obtain the load intensity evolution sequence of the edge. Combine the transmission frequency evolution sequence and the load intensity evolution sequence to obtain the interaction intensity evolution trajectory corresponding to each edge.

[0037] In one implementation, step S230 may specifically include the following steps S231 to S236:

[0038] Step S231: Obtain the start and end timestamps of the data segment to be detected. Divide the time period between the start and end timestamps into multiple continuous and non-overlapping time sub-windows with a preset unit time interval as the division granularity. Each time sub-window corresponds to a specific time interval range.

[0039] Edge computing nodes reacquire the start and end timestamps of the same data segment to be detected, and use the same preset unit time interval, such as 500 milliseconds, to evenly divide the entire time period into a series of continuous and non-overlapping time sub-windows. This is done to ensure that the time segmentation granularity used in subsequent analysis of edge interaction strength remains completely consistent with the time segmentation granularity used in the previous analysis of node behavior, thus enabling the correlation and comparison of node-level behavioral attribute features and edge-level interaction strength evolution trajectories on the same time reference. Each time sub-window still corresponds to a specific time interval range defined by start and end boundaries.

[0040] Step S232: For each edge connecting two smart terminals, traverse all data packets generated by these two smart terminals in the data segment to be detected, filter out data packets whose source terminal is identified as one smart terminal of the edge and whose target terminal is identified as the other smart terminal of the edge, and data packets whose source terminal is identified as the other smart terminal of the edge and whose target terminal is identified as one smart terminal of the edge, and use the filtered data packets as the transmission packet set corresponding to the edge.

[0041] The set of transmission messages corresponding to an edge is a summary of all data messages transmitted through the communication relationship represented by that edge. Specifically, for each edge in the initial behavioral topology graph, the edge computing node first identifies the two smart terminals connected by the edge, for example, labeling these two terminals as Terminal A and Terminal B respectively. Then, the edge computing node traverses all data messages within the data segment to be detected. For each traversed data message, the edge computing node parses its source terminal identifier field and destination terminal identifier field. If the source terminal identifier of a data message is Terminal A and the destination terminal identifier is Terminal B, then the message is determined to be communication from Terminal A to Terminal B, belonging to the message transmitted through this edge. Similarly, if the source terminal identifier of a data message is Terminal B and the destination terminal identifier is Terminal A, then the message is determined to be communication from Terminal B to Terminal A, also belonging to the message transmitted through this edge. Edge computing nodes collect all data packets that meet one of these two conditions to form a set. This set is the transmission packet set corresponding to that edge, encompassing all bidirectional communication content between the two terminals during the data segment to be detected.

[0042] Step S233: Determine the time sub-window to which the transmission message belongs based on the generation timestamp of each transmission message, count the total number of messages belonging to the transmission message set corresponding to the edge within each time sub-window, and arrange the total number of messages corresponding to each time sub-window according to the order of the time sub-windows to obtain the transmission frequency evolution sequence of the edge.

[0043] The transmission frequency evolution sequence is used to characterize the activity level of the communication relationship represented by the edge within the data segment to be detected over time, specifically reflected in the total number of messages transmitted through the edge per unit time. Specifically, for a set of transmission messages already constructed for a certain edge, the edge computing node traverses each transmission message in the set and parses the generation timestamp field of each message. Next, the generation timestamp is compared with the range of all time sub-windows divided in step S231 to determine which time sub-window each message belongs to. After determining the affiliation of all transmission messages, the edge computing node counts the number of transmission messages belonging to each time sub-window to obtain the total number of messages transmitted through the edge within that time sub-window. Finally, according to the chronological order of the time sub-windows from earliest to latest, the total number of messages corresponding to each time sub-window is arranged sequentially to form a numerical sequence, which is the transmission frequency evolution sequence of the edge. The element values ​​in the sequence reflect the frequency of communication between the two terminals within the corresponding time sub-window.

[0044] Step S234: For each transmission packet belonging to the transmission packet set corresponding to the edge within each time sub-window, extract the data load size field of the transmission packet, calculate the sum of the data load sizes of all transmission packets within the time sub-window, divide the sum of the data load sizes by the total number of transmission packets within the time sub-window to obtain the average data load size within the time sub-window, and arrange the average data load sizes corresponding to each time sub-window according to the chronological order of the time sub-windows to obtain the load intensity evolution sequence of the edge.

[0045] The load intensity evolution sequence is used to characterize the trend of the average size of data packets transmitted through the edge over time, reflecting changes in the richness or data density of the communication content. Specifically, after assigning transmitted packets to various time sub-windows, the edge computing node processes each time sub-window individually. For a specific time sub-window, the edge computing node iterates through each transmitted packet belonging to that window, parsing the data load size field from each packet. The value of this field is an integer representing the length of the packet's data portion in bytes. Next, the edge computing node sums the data load size values ​​of these packets to obtain the total data load of all transmitted packets within that time sub-window. Then, the edge computing node divides this total data load by the total number of transmitted packets within that time sub-window; the quotient is the average data load size within that time sub-window, representing the average amount of data transmitted per communication within this short period. If there are no transmitted packets within a certain time sub-window, its average data load size can be defined as zero or a preset minimum value. Edge computing nodes are arranged in chronological order from early to late according to time sub-windows. The average data load size calculated for each time sub-window is arranged sequentially to form a numerical sequence, which is the load intensity evolution sequence of that edge.

[0046] Step S235: For each time sub-window corresponding to each edge, combine the element values ​​in the transmission frequency evolution sequence and the element values ​​in the load intensity evolution sequence corresponding to the time sub-window into a two-dimensional vector, and use the two-dimensional vector as the instantaneous representation of the interaction intensity of the edge within the time sub-window.

[0047] The instantaneous interaction strength representation is used to simultaneously characterize the communication frequency and average load of an edge within a single time sub-window within a unified data structure. Specifically, for each edge in the behavioral topology graph, edge computing nodes traverse the edge's transmission frequency evolution sequence and load strength evolution sequence in parallel. These two sequences have the same length, and elements at the same position in the sequences correspond to the same time sub-window. For the first time sub-window, the edge computing node extracts the first element value from the edge's transmission frequency evolution sequence and the first element value from the load strength evolution sequence, combining these two values ​​in a fixed order to form a vector containing two components. For example, the transmission frequency is used as the first component of the vector, and the average load is used as the second component. This vector composed of two values ​​is the instantaneous interaction strength representation of the edge within the first time sub-window, comprehensively reflecting the communication activity and data density between the two terminals within this short period. In the same way, for the second, third and so on until the last time sub-window, the edge computing node sequentially combines the transmission frequency element value and the average load size element value at the corresponding position into a two-dimensional vector, thereby generating an instantaneous representation of the interaction intensity for each time sub-window.

[0048] Step S236: Concatenate the instantaneous representations of the interaction intensity corresponding to all time sub-windows according to the order of the time sub-windows to obtain the interaction intensity evolution trajectory corresponding to each edge. The i-th element in the interaction intensity evolution trajectory is the two-dimensional vector corresponding to the i-th time sub-window.

[0049] The interaction intensity evolution trajectory is a multi-dimensional temporal data structure formed by organizing the instantaneous representations of the interaction intensity of an edge within a complete data segment to be detected in chronological order. Specifically, after generating a two-dimensional vector for each time sub-window of an edge in step S235, the edge computing node needs to integrate these discrete vectors into a continuous trajectory. The integration method is to splice them according to the natural order of the time sub-windows, that is, firstly, the two-dimensional vector corresponding to the first time sub-window is used as the first time step of the trajectory, then the two-dimensional vector corresponding to the second time sub-window is used as the second time step of the trajectory, then the two-dimensional vector corresponding to the third time sub-window is used as the third time step of the trajectory, and so on, until the two-dimensional vector corresponding to the last time sub-window is used as the last time step of the trajectory. The final trajectory has a length equal to the total number of time sub-windows, and each time step in the trajectory is a two-dimensional vector containing the transmission frequency and average load of the edge within that time sub-window. This interaction intensity evolution trajectory completely records the evolution pattern of the communication relationship between the two intelligent terminals in terms of frequency and load over time during the data segment to be detected.

[0050] Step S240: Scan all nodes in the initial behavior topology graph and identify isolated nodes that are not connected by any edge. For each isolated node, re-parse the data packet generated by the smart terminal corresponding to the isolated node and extract the target terminal identification field from the data packet. If the target terminal identification field points to another node that already exists in the initial behavior topology graph, then add an edge between the isolated node and the other node. If the target terminal identification field points to an unknown node that does not exist in the initial behavior topology graph, then keep the isolated state of the isolated node unchanged.

[0051] An isolated node is a node in the initial behavioral topology graph that has no edges connecting it to any other node. This means that the smart terminal corresponding to this node neither sends nor receives data packets from any other terminal within the data segment to be detected. However, this situation may be due to oversights in data packet parsing or graph construction. Specifically, the edge computing node first traverses all nodes in the initial behavioral topology graph, checking the edge connectivity of each node and marking nodes with a degree of zero as isolated nodes. For each marked isolated node, the edge computing node does not directly treat it as a true isolated point, but performs a supplementary check. The check is performed by re-retrieving all data packets generated by the smart terminal corresponding to the isolated node within the data segment to be detected. For each data packet, the edge computing node re-parses its target terminal identifier field. If it finds that the target terminal identifier of a data packet points to another non-isolated node already existing in the initial behavioral topology graph, this indicates that the isolated node actually attempted to send information to a known terminal, but may not have successfully established the corresponding edge during the initial graph construction due to processing order or other reasons. In this scenario, the edge computing node adds a directed edge between the isolated node and the target node it's pointing to, pointing from the isolated node to the target node. If, after parsing all data packets, it's found that the target terminal identifier points to a terminal identifier that doesn't exist in the current initial behavioral topology graph—meaning the target terminal is a completely new terminal identifier that hasn't appeared in the current data segment—the edge computing node cannot establish a connection and thus maintains the isolated state of that node.

[0052] Step S250: Divide the initial behavior topology graph after the isolated node processing into connected subgraphs. All nodes with direct or indirect edge connections are divided into the same connected subgraph, resulting in multiple connected subgraphs. For each edge within a connected subgraph, calculate the initial weight value of the edge based on the total number of data packet exchanges between the two nodes corresponding to the edge within the data segment to be detected. Assign the initial weight value to the edge to obtain the weighted behavior topology graph corresponding to each connected subgraph.

[0053] Connected subgraph partitioning is the process of decomposing a large graph structure into several internally connected but externally disconnected subgraphs based on the connectivity between nodes. A direct or indirect edge connection means that two nodes are either directly connected by an edge or reachable through a series of consecutive intermediate nodes and edges. A connected subgraph is the largest set of nodes whose internal connections are such that any node can be connected by a path, and the edges between them constitute this subgraph. Specifically, after supplementing the connections of isolated nodes in step S240, the edge computing node obtains a corrected initial behavioral topology graph. Next, the edge computing node uses a graph traversal algorithm, such as breadth-first search or depth-first search, starting from any unvisited node in the graph and visiting all its neighboring nodes along the edges, then starting from these neighboring nodes and visiting their neighbors, until no new reachable nodes can be found. All visited nodes and their edges constitute a connected subgraph. Then, the edge computing node selects another unvisited node from the remaining nodes and repeats the above process until all nodes in the graph are partitioned into a connected subgraph, thus obtaining multiple unconnected subgraphs. For each connected subgraph, the edge computing node needs to assign a weight to each edge within it. The weight is calculated based on the total number of data packet exchanges between the two nodes connected by the edge within the data segment to be detected. The edge computing node recounts the total number of all bidirectional packets transmitted between these two nodes; this total number is the initial weight value for the edge. Finally, this initial weight value is appended as an attribute to the corresponding edge, thus transforming the originally unweighted behavioral topology graph into a weighted behavioral topology graph. Each connected subgraph corresponds to one such weighted subgraph.

[0054] Step S260: Associate and store the weighted behavioral topology graph corresponding to each connected subgraph, the behavioral attribute feature sequence of each node in each connected subgraph, and the interaction intensity evolution trajectory of each edge in each connected subgraph to obtain the data set to be processed for input into the anomaly propagation analysis model.

[0055] Specifically, after assigning weights to each connected subgraph, the edge computing nodes possess three core data components for each subgraph. The first component is the structural information of the subgraph itself, namely, the weighted behavioral topology graph, which includes the identifiers of all nodes and all weighted edges. The second component is the behavioral attribute feature sequence of each node in the subgraph, calculated in step S220, characterizing the temporal dynamics of each node's individual behavior. The third component is the interaction strength evolution trajectory of each edge in the subgraph, calculated in step S230, characterizing the temporal dynamics of the interaction between each pair of nodes.

[0056] Edge computing nodes store these three parts of data as a single unit. Specifically, a data structure can be created where the key is a unique identifier of the connected subgraph, and the values ​​include pointers or references to the corresponding weighted topology graph, a mapping table with node identifiers as keys and node behavior attribute sequence as values, and a mapping table with edge identifiers as keys and edge interaction strength evolution trajectories as values.

[0057] Step S300: Input the behavior topology graph, behavior attribute feature sequence and interaction intensity evolution trajectory into the anomaly propagation analysis model preset on the edge computing node, and track the anomaly diffusion path through the graph convolutional network layer of the anomaly propagation analysis model to obtain the preliminary anomaly label and anomaly propagation path feature vector corresponding to each data segment to be detected.

[0058] In one implementation, step S300 may specifically include the following steps S310 to S360:

[0059] Step S310: Input the behavioral topology graph into the graph embedding encoding layer in the anomaly propagation analysis model. The graph embedding encoding layer samples and aggregates the local neighborhood structure information of each node in the behavioral topology graph. It collects the topological connection relationships from the set of neighboring nodes of each node and maps the topological connection relationships to the initial structure embedding vector corresponding to each node.

[0060] Specifically, the anomaly propagation analysis model first receives the behavioral topology graph corresponding to the data segment to be detected, obtained after step S200. This graph may contain multiple connected subgraphs, but the model treats it as a whole graph structure. The graph embedding coding layer traverses each node in the graph. For the currently processed central node, the coding layer first determines its set of neighboring nodes, i.e., all other nodes directly connected to the central node through an edge. Next, the coding layer can adopt a sampling strategy, such as randomly sampling a fixed number of neighbors, and selecting a subset of neighboring nodes from this set. Then, the coding layer performs an aggregation operation on the information of these selected neighboring nodes. The aggregation operation can be performed by taking the average of the feature vectors of these neighboring nodes, or by using a more complex aggregation function, such as a Long Short-Term Memory network, to process the sequence of neighboring node features. Since the nodes themselves do not have any attribute features at this stage, the information used for aggregation is mainly the identifiers of the neighboring nodes or their roles in the graph. Through this sampling and aggregation, each central node collects structural information about its local neighborhood. The graph embedding coding layer typically contains multiple layers of such sampling and aggregation operations, so that the final representation of each node can be aggregated to the structural information of its multi-hop neighbors. After multiple layers of processing, the encoding layer generates a fixed-dimensional vector for each node, namely the initial structure embedding vector, which encodes the node's position in the behavioral topology graph and its surrounding connection patterns.

[0061] Step S320: Input the behavioral attribute feature sequence of each node into the temporal feature encoding layer in the anomaly propagation analysis model. Perform forward propagation and backward propagation calculations on the behavioral attribute feature sequence through the bidirectional recurrent neural network in the temporal feature encoding layer. Extract the forward hidden state of each time step from the forward propagation process and extract the backward hidden state of each time step from the backward propagation process. Concatenate the forward hidden state and backward hidden state of each time step to obtain the comprehensive hidden state of each time step. Use the comprehensive hidden state of the last time step as the behavioral temporal state vector of the node.

[0062] In one implementation, step S320 may specifically include the following steps S321 to S324:

[0063] Step S321: Input the behavioral attribute feature sequence of each node into the forward recurrent unit of the bidirectional recurrent neural network in chronological order. In the first time step, input the initial hidden state and the feature vector of the first time step into the forward recurrent unit for calculation to obtain the forward output state of the first time step. In each subsequent time step, input the forward output state of the previous time step and the feature vector of the current time step into the forward recurrent unit for calculation to obtain the forward output state of the current time step. Arrange the forward output states of all time steps in chronological order to obtain the forward hidden state sequence.

[0064] For a given node, its temporal feature encoding layer receives its behavioral attribute feature sequence as input, which consists of a series of two-dimensional vectors at different time steps. The forward recurrent unit (RNU) starts processing from the first time step of the sequence. At the first time step, the RNU receives a preset initial hidden state, typically a zero vector, and the two-dimensional feature vector from the first time step as input. Through nonlinear transformations and gating mechanisms within the unit, it calculates the forward output state for the first time step. This forward output state can be seen as the model's encoding of the sequence information up to the first time step. Next, in the second time step, the RNU uses the forward output state calculated in the first time step as the input hidden state for the current time step, and inputs it along with the feature vector from the second time step to calculate the forward output state for the second time step. This process continues until the last time step of the sequence is processed. For each time step processed, the RNU generates a corresponding forward output state. Finally, the forward output states generated at all time steps are arranged in chronological order from first to last, forming a sequence, the forward hidden state sequence, with the same length as the input sequence.

[0065] Step S322: Input the behavioral attribute feature sequence of each node into the backward recurrent unit of the bidirectional recurrent neural network in reverse chronological order. In the last time step, input the initial hidden state and the feature vector of the last time step into the backward recurrent unit for calculation to obtain the backward output state of the last time step. In each subsequent reverse chronological time step, input the backward output state of the next time step and the feature vector of the current reverse chronological time step into the backward recurrent unit for calculation to obtain the backward output state of the current reverse chronological time step. Arrange the backward output states of all time steps in reverse chronological order to obtain the backward hidden state sequence.

[0066] For the same behavioral attribute feature sequence of the same node, the backward recurrent unit (ORU) starts from the last time step of the sequence and processes it in reverse chronological order. In the first reverse-order time step, i.e., the original last time step, the ORU receives a preset initial hidden state, usually a zero vector, and the two-dimensional feature vector from the last time step as input to calculate the backward output state of the last time step. This backward output state encodes the information from the end of the sequence to the last time step. Next, proceeding to the next reverse-order time step, i.e., the original second-to-last time step, the ORU uses the backward output state calculated in the previous reverse-order time step as the input hidden state for the current reverse-order time step, and inputs it along with the feature vector from the second-to-last time step to calculate the backward output state for the second-to-last time step. This process is repeated in reverse chronological order until the first time step of the sequence has been processed. For each reverse-order time step processed, the ORU generates a corresponding backward output state. Finally, the backward output states generated at all time steps are arranged in the order they were processed in reverse chronological order to form a sequence, which is the backward hidden state sequence. Since it was generated in reverse order, the first element in this sequence corresponds to the last time step of the original sequence, and the last element corresponds to the first time step of the original sequence.

[0067] Step S323: For each time step, concatenate the forward output state and the backward output state corresponding to that time step to obtain a dimension-expanded comprehensive hidden state vector. This comprehensive hidden state vector contains temporal dependency information in both the past to the present and the future to the present directions.

[0068] After obtaining the forward hidden state sequence and the backward hidden state sequence through steps S321 and S322 respectively, the edge computing node aligns these two sequences. Since the forward hidden state sequence is arranged in the original chronological order, while the backward hidden state sequence, although generated in reverse order, needs to have its elements rearranged according to the original chronological order during alignment, or a correct index mapping needs to be performed during concatenation. Typically, for the t-th time step in the original sequence, its corresponding forward hidden state is the t-th element in the forward hidden state sequence. Its corresponding backward hidden state is the element in the backward hidden state sequence corresponding to the same original time step. Since the backward sequence is generated in reverse order, the backward hidden state corresponding to the original t-th time step is the (T-t+1)-th element in the backward hidden state sequence, where T is the total length of the sequence. The edge computing node extracts these two hidden state vectors, one from the forward and one from the backward sequence, corresponding to the same original time step, and then concatenates them, that is, appending all components of the backward hidden state vector to the end of the forward hidden state vector. This yields a new vector, the composite hidden state vector. This process is repeated for each time step to obtain a series of composite hidden state vectors. These vectors fuse information from both directions, enabling a more comprehensive capture of the contextual features at each time point in the sequence.

[0069] Step S324: Arrange the integrated hidden state vectors corresponding to each time step in chronological order to obtain the integrated hidden state sequence of each node. Take the integrated hidden state vector of the last time step from the integrated hidden state sequence as the behavior time sequence state vector of that node.

[0070] The behavioral temporal state vector is the final summary representation of the entire behavioral attribute feature sequence. Specifically, after generating the corresponding comprehensive hidden state vector for each time step of the node through step S323, these vectors themselves naturally form a sequence in chronological order, namely the comprehensive hidden state sequence. Each element in this sequence contains bidirectional temporal information for the corresponding time step. However, for a complete sequence analysis task, a fixed-length vector is usually needed to represent the entire sequence. In a bidirectional recurrent neural network, the comprehensive hidden state of the last time step can be used because it not only contains information about the last moment of the sequence but also implicitly contains information about the beginning moment of the sequence through the backpropagation mechanism. Therefore, the edge computing node directly extracts the last element of the sequence from the already constructed comprehensive hidden state sequence, that is, the comprehensive hidden state vector corresponding to the last time step of the original input sequence.

[0071] Step S330: Input the interaction intensity evolution trajectory of each edge into the trajectory feature encoding layer in the anomaly propagation analysis model. Perform convolution kernel sliding calculation on the interaction intensity evolution trajectory through the one-dimensional convolutional neural network in the trajectory feature encoding layer. Extract local fluctuation mode features from the interaction intensity evolution trajectory. Flatten the local fluctuation mode features to obtain the evolution mode feature vector of each edge.

[0072] Specifically, the anomaly propagation analysis model receives the interaction intensity evolution trajectory of each edge calculated in step S200. Each trajectory is a sequence of two-dimensional vectors composed of multiple time steps. The trajectory feature encoding layer treats this two-dimensional sequence as a one-dimensional image or signal with two channels. The encoding layer internally configures multiple one-dimensional convolutional kernels of different sizes; for example, a kernel of size three can capture local change patterns within three consecutive time steps. Each convolutional kernel starts from the beginning of the trajectory sequence, slides one step at a time, covering a local window, and performs a weighted sum of the feature values ​​of the two channels at all time steps within the window with the corresponding weights on the convolutional kernel, adds a bias term, and then passes it through a non-linear activation function to obtain an output value at that window position. As the convolutional kernel slides across the entire sequence, a new output sequence is generated. Parallel operation of multiple convolutional kernels produces multiple different output sequences, which are stacked together to form a multi-dimensional feature map. This feature map is the extracted local fluctuation pattern feature. Subsequently, the trajectory feature encoding layer extracts all elements from this multidimensional feature map and arranges them into a long vector in a certain order; this operation is called flattening. The flattened vector is the evolution pattern feature vector of the edge, which encodes the local variation pattern of the edge's interaction strength in both frequency and load dimensions throughout the entire data segment to be detected.

[0073] Step S340: Concatenate the initial structure embedding vector of each node, the behavior temporal state vector of the node, and the average value of the evolution mode feature vectors of all edges connected to the node to obtain the comprehensive feature representation of each node. Combine the comprehensive feature representations of all nodes into a node feature matrix according to the order of the nodes in the behavior topology graph.

[0074] Specifically, for each node in the behavioral topology graph, the edge computing node first obtains the initial structure embedding vector of the node from the result of step S310, and the behavioral temporal state vector of the node from the result of step S324. Next, the edge computing node traverses all adjacent edges of the node, obtaining the evolutionary pattern feature vector corresponding to each adjacent edge from the result of step S330. Then, it calculates the element-wise average of these adjacent edge evolutionary pattern feature vectors; that is, for each dimension of the vector, it adds the values ​​of all adjacent edge feature vectors in that dimension and divides by the total number of adjacent edges to obtain a new vector, namely the average vector. If the node is an isolated node with no adjacent edges, this average vector can be defined as a vector of all zeros. Afterwards, the edge computing node concatenates these three vectors—the initial structure embedding vector, the behavioral temporal state vector, and the average of the adjacent edge evolutionary pattern feature vectors—in a preset order to form a new vector with a larger dimension. This new vector is the comprehensive feature representation of the node. After the comprehensive feature representation of all nodes is calculated, the edge computing nodes are arranged in the order in which these nodes are indexed in the behavioral topology graph, such as the order after the node identifier is sorted. The comprehensive feature representation of each node is arranged as a row, and finally a two-dimensional matrix with the number of rows equal to the total number of nodes and the number of columns equal to the dimension of the comprehensive feature representation is formed, namely the node feature matrix.

[0075] Step S350: Input the node feature matrix and the adjacency matrix of the behavior topology graph into the graph convolutional propagation layer in the anomaly propagation analysis model. The first graph convolution operation in the graph convolutional propagation layer is used to aggregate and update the first-order neighbor node features of each node. The second graph convolution operation in the graph convolutional propagation layer is used to aggregate and update the second-order neighbor node features of each node. After multiple graph convolution operations, the propagation enhancement feature vector of each node is obtained.

[0076] In one implementation, step S350 may specifically include the following steps S351 to S355:

[0077] Step S351: Add the adjacency matrix to the identity matrix to obtain the modified adjacency matrix after adding self-loop connections. Sum the elements of each row of the modified adjacency matrix to obtain the degree value of each node. Construct a degree diagonal matrix based on the degree value of each node. Invert the degree diagonal matrix and multiply it with the modified adjacency matrix to obtain the normalized graph convolution propagation matrix.

[0078] Specifically, the graph convolutional propagation layer first receives the adjacency matrix of the graph topology, denoted as A. To preserve the features of each node during feature aggregation, the propagation layer adds the adjacency matrix A element-wise to an identity matrix I of the same dimension, obtaining the modified adjacency matrix Ã, i.e., à = A + I. Next, the propagation layer calculates the sum of each row of the modified adjacency matrix Ã, where the sum of the i-th row is the degree value of the i-th node, denoted as di. Then, the propagation layer constructs a degree diagonal matrix D based on the degree values ​​of all nodes. D is a diagonal matrix, and the elements Dii on its diagonal are di. To ensure that the aggregation process is unaffected by differences in node degree, the modified adjacency matrix needs to be normalized. The propagation layer first calculates the inverse of the degree diagonal matrix. , The elements on the diagonal are 1 / di. Finally, the propagation layer will inverse the matrix. Multiplying the normalized graph convolution propagation matrix à with the modified adjacency matrix à yields the normalized graph convolution propagation matrix Ã. norm In some embodiments, a symmetric normalization form may be used, i.e. The purpose of this is to assign smaller weights to neighbors with high degrees and larger weights to neighbors with low degrees when aggregating neighbor features.

[0079] Step S352: Perform a first-order graph convolution multiplication operation on the node feature matrix and the graph convolution propagation matrix to obtain a first-order aggregated feature matrix of each node after aggregating the features of its first-order neighbor nodes. Input the first-order aggregated feature matrix into the first activation function layer for nonlinear transformation to obtain the first-order activation feature matrix.

[0080] The first-order graph convolution multiplication operation multiplies the node feature matrix with the normalized graph convolution propagation matrix, thereby enabling each node to collect feature information from its direct neighbors. The first activation function layer typically uses a linear rectified function to introduce non-linear expressive power into the model. Specifically, the graph convolution propagation layer first receives the node feature matrix generated in step S340, denoted as... This contains the initial comprehensive feature representation of each node. Next, the propagation layer converts the node feature matrix... The normalized graph convolution propagation matrix obtained in step S351 norm Perform matrix multiplication. The result of this multiplication is a new matrix, denoted as H¹. In H¹, the vector in the i-th row is no longer the feature of the original i-th node, but a weighted sum of the feature of the original i-th node and the features of all its first-order neighbors, with the weights determined by Ã. normThe decision is made. This H¹ matrix is ​​the first-order aggregated feature matrix after aggregating the first-order neighbor features. Subsequently, the propagation layer inputs this first-order aggregated feature matrix H¹ into the first activation function layer. The first activation function layer applies a linear rectified function to each element in H¹, setting all negative values ​​to 0 and leaving positive values ​​unchanged. The new matrix obtained after this nonlinear transformation is denoted as H¹. act This is the first-order activation feature matrix.

[0081] Step S353: Perform a second-order graph convolution multiplication operation on the first-order activation feature matrix and the graph convolution propagation matrix to obtain a second-order aggregated feature matrix that further aggregates the second-order features of its neighboring nodes based on the first-order aggregated features of each node. Input the second-order aggregated feature matrix into the second activation function layer for nonlinear transformation to obtain the second-order activation feature matrix.

[0082] Specifically, the graph convolutional propagation layer uses the first-order activation feature matrix H¹ obtained in step S352. act As input for this operation, the propagation layer again uses H¹ as input. act The normalized graph convolution propagation matrix obtained in step S351 nor The matrix m performs matrix multiplication. The result of this multiplication is a new matrix, denoted as H². In H², the vector in the i-th row not only contains the first-order neighbor information after the first aggregation, but also indirectly aggregates the feature information of second-order neighbor nodes (i.e., neighbors of neighbors) due to the diffusion effect of the second multiplication. This H² matrix is ​​the second-order aggregated feature matrix after aggregating the features of second-order neighbors. Next, the propagation layer inputs this second-order aggregated feature matrix H² into the second activation function layer. The second activation function layer also applies a linear rectifier function to each element in H², performing a nonlinear transformation. The new matrix obtained after the transformation is denoted as H². act This is the second-order activation feature matrix.

[0083] Step S354: Concatenate the node feature matrix, the first-order activation feature matrix, and the second-order activation feature matrix to obtain the multi-order propagation enhancement feature vector of each node. The multi-order propagation enhancement feature vector integrates the node's original features, the first-order neighbor propagation features, and the second-order neighbor propagation features.

[0084] Specifically, the graph convolutional propagation layer now has three key matrices: the original node feature matrix. The first-order activation feature matrix H¹ after first-order aggregation and nonlinear transformation act And the second-order activation feature matrix H² after second-order aggregation and nonlinear transformation. act These three matrices have the same number of rows, i.e., the total number of nodes, but may have different numbers of columns. The propagation layer concatenates these three matrices along the column dimension, i.e., it merges H¹... actAll columns appended After the last column, put H² act All columns are appended to H¹ act After the last column, a new matrix is ​​generated, denoted as H. concat In H concat In this structure, each row corresponds to a node, and the content of that row is generated by that node. H¹ act and H² act The vectors in the corresponding rows are concatenated sequentially. Therefore, each row of this new matrix is ​​a multi-order propagation enhanced feature vector, which fully integrates the original features of the node itself, the features enhanced by first-order neighbor information, and the features further enhanced by second-order neighbor information.

[0085] Step S355: Recombine the multi-order propagation enhancement feature vectors of each node according to the order of the nodes in the behavioral topology graph to obtain the propagation enhancement feature matrix. The number of rows of the propagation enhancement feature matrix is ​​equal to the total number of nodes in the behavioral topology graph, and the number of columns is equal to the total number of feature dimensions after concatenation.

[0086] Step S354 has generated a matrix H containing information about all nodes. concat This matrix itself is arranged in node order. Therefore, the recombination operation here is actually an operation on H. concat Perform verification and formatting to clarify its identity as the final output of the graph convolutional propagation layer. Matrix H concat The number of rows is indeed equal to the total number of nodes in the topological graph, and its number of columns is equal to the original node feature matrix. The number of columns, the first-order activation feature matrix H¹ act The number of columns and the second-order activation feature matrix H² act The sum of the column numbers. This matrix, the propagation enhancement feature matrix, will serve as the basic input for subsequent anomaly classification and path encoding. Each row in the matrix, that is, each multi-order propagation enhancement feature vector, encapsulates the propagation information of the node's own behavior, the behavior of its first-order neighbors, and the behavior of its second-order neighbors in the graph structure.

[0087] Step S360: Input the propagation enhancement feature vector of each node into the anomaly classification output layer and the path encoding output layer in the anomaly propagation analysis model respectively. Perform dimensional transformation and probability calculation on the propagation enhancement feature vector through the fully connected mapping in the anomaly classification output layer to obtain the probability value of each node belonging to the anomaly category as a preliminary anomaly label. Perform global information aggregation on the propagation enhancement feature vector of all nodes through the graph pooling operation in the path encoding output layer to generate anomaly propagation path feature vector.

[0088] After obtaining the propagation enhancement feature vector for each node, the model feeds it into two different processing branches. In the anomaly classification branch, the propagation enhancement feature vector for each node is first input into one or more fully connected layers of the anomaly classification output layer. The fully connected layers multiply the input vector with a learnable weight matrix and add a bias, mapping the high-dimensional feature vector to a low-dimensional vector. The dimension of this low-dimensional vector is equal to the preset total number of anomaly categories; for example, the dimension is two for binary classification. Subsequently, this low-dimensional vector is input into a normalized exponential function, which converts each element in the vector into a probability value between zero and one, with the sum of all elements being one. Finally, for each node, the resulting value is the probability that the node belongs to an anomaly category, and this probability value is used as the initial anomaly label for that node. In the global path encoding branch, the model pools the propagation enhancement feature vectors of all nodes in the graph and inputs them into the graph pooling operation of the path encoding output layer. A commonly used graph pooling operation is global average pooling, which averages the feature vectors of all nodes in each dimension, ultimately obtaining an average vector with the same dimension as the feature vector of a single node. Another approach is global max pooling, which takes the maximum value of all node feature vectors in each dimension. This vector, obtained after pooling, represents the global information of the entire graph structure. The path encoding output layer outputs this vector as the feature vector of the anomaly propagation path, which is expected to capture the macroscopic pattern of how anomalies spread between nodes within the entire connected subgraph.

[0089] Step S400: Within the edge cluster to which the edge computing node belongs, broadcast the anomaly propagation path feature vector to the adjacent edge computing nodes, receive the set of anomaly propagation path feature vectors returned by the adjacent edge computing nodes and perform consensus verification, and generate consensus anomaly markers and anomaly association graphs between nodes.

[0090] In one implementation, step S400 may specifically include the following steps S410 to S470:

[0091] Step S410: Read the network address information and neighbor relationship list of the edge computing node in the edge cluster from the local configuration file of the edge computing node. The neighbor relationship list records the network addresses of all adjacent edge computing nodes that have a direct physical link connection or logical communication tunnel with the edge computing node.

[0092] When an edge computing node needs to communicate within the cluster, it first accesses its local file system and reads a file called a configuration file. This file contains the node's own Internet Protocol address and the port number it is listening on, identifying itself. More importantly, the configuration file also contains a structured list, namely the neighbor list. Each item in this list is a network address corresponding to another edge computing node. These nodes are included in the neighbor list because, during cluster deployment, network administrators determine the most direct communication paths between them and the node based on the physical network topology or logical network planning. By parsing this list, the edge computing node knows which specific network targets to send data packets to when broadcasting or engaging in consensus interactions.

[0093] Step S420: For each abnormal propagation path feature vector corresponding to the data segment to be detected generated by the current edge computing node, add the node identifier of the current edge computing node and the timestamp information of the data segment to be detected to the abnormal propagation path feature vector to obtain a broadcast data packet carrying the source mark, and send the broadcast data packet to each neighboring edge computing node in the neighbor relationship list through the broadcast communication mechanism inside the edge cluster.

[0094] For each anomaly propagation path feature vector corresponding to a specific data segment to be detected, generated in step S360, the current edge computing node first creates a packet structure. It fills its own node identifier, such as the device serial number read from the configuration file, as the source field in the packet header. Simultaneously, it fills the timestamp information of the data segment to be detected that generated the anomaly propagation path feature vector into the packet's metadata field. Then, it uses all the values ​​of the original anomaly propagation path feature vector as the packet's payload. After encapsulation, this packet becomes a broadcast packet with a clear source and timestamp information. Next, the current edge computing node, based on the neighbor relationship list obtained in step S410, sequentially retrieves the network address of each neighboring edge computing node in the list. For each address, it copies and sends the same broadcast packet to that address using a pre-defined communication protocol within the edge cluster, such as a socket programming interface based on the User Datagram Protocol (UDP). In this way, all neighboring nodes in the neighbor relationship list can receive the anomaly propagation path feature vector from the current node regarding the same time segment.

[0095] Step S430: Start the listening service and wait to receive response data packets returned by neighboring edge computing nodes. Each response data packet contains the abnormal propagation path feature vector generated by the neighboring edge computing node itself and the abnormal propagation path feature vector received and forwarded by the neighboring edge computing node from other nodes. After parsing all the received response data packets, merge them to obtain the original external feature vector set.

[0096] After sending the broadcast data packet, the current edge computing node immediately starts or wakes up a pre-configured network listening service. This service is bound to a fixed network port and remains in a waiting state. When a neighboring edge computing node receives the broadcast data packet and completes its own processing, it returns a response data packet to the current node's listening port according to the protocol. The current node's listening service parses each received response data packet. The parsing process includes stripping the packet header information and extracting the payload. The payload contains the anomaly propagation path feature vector generated by the neighboring node for the same time segment. Simultaneously, according to the protocol design, if the neighboring node has previously received and stored anomaly propagation path feature vectors from its other neighbors, it will also encapsulate these vectors in the current response data packet and forward them to this node. The listening service parses all received response data packets one by one and adds all extracted anomaly propagation path feature vectors, regardless of their original node origin, to a temporary set. When the listening times out or a preset number of responses are received, this set is considered the original external feature vector set.

[0097] Step S440: Perform dual deduplication on the original external feature vector set based on node identifier and timestamp, delete duplicate feature vectors with the same node identifier and timestamp, and retain the latest anomaly propagation path feature vector generated by each adjacent edge computing node for each data segment to be detected, to obtain the deduplicated external feature vector set.

[0098] The current edge computing node traverses each feature vector in the original external feature vector set. Each feature vector is accompanied by the identifier of its source node and the corresponding timestamp. The node can create a new data structure, such as a mapping table indexed by a composite key consisting of the node identifier and the timestamp. For each feature vector encountered, the node checks if the composite key already exists in the mapping table. If it doesn't exist, it means this is the first time a vector corresponding to this time slice has been received from this node, and the node inserts it into the mapping table with the composite key as the key and the feature vector itself as the value. If the composite key already exists, it means that the same node has previously received feature vectors for the same time slice, and the currently encountered vector is a duplicate. In this case, the node needs to determine which version is newer based on the timestamp. Although the timestamps are the same in double deduplication, network latency may cause the older version to arrive later. The usual rule is that if the composite keys are the same, the first one received is retained, or the latest one is retained based on the sequence number contained in the vector. After traversing the entire original set, the set of all values ​​in the mapping table, i.e. the set of external feature vectors after deduplication, ensures that each neighboring node contributes only a unique and up-to-date anomaly propagation path feature vector for each data segment to be detected.

[0099] Step S450: Perform pairwise similarity calculations between the current edge computing node's own anomaly propagation path feature vector and each feature vector in the deduplicated external feature vector set to obtain the feature vector similarity matrix between the current edge computing node and each adjacent edge computing node for the same data segment to be detected.

[0100] In one implementation, step S450 may specifically include the following steps S451 to S455:

[0101] Step S451: Extract the sub-feature vector corresponding to each smart terminal from the anomaly propagation path feature vector of the current edge computing node itself, and establish a local feature mapping table with the smart terminal identifier as the key and the local sub-feature vector as the value.

[0102] The anomaly propagation path feature vector is a long vector, typically obtained by pooling the entire graph from the path encoding output layer. However, for fine-grained comparisons, this global vector needs to be decomposed into parts corresponding to each smart terminal. A sub-feature vector is a continuous component within the global feature vector specifically used to describe the behavior pattern of a particular smart terminal. A smart terminal identifier is an identity code that uniquely identifies a terminal. The local feature mapping table is a key-value pair data structure that facilitates quick lookup of the corresponding sub-feature vector using the terminal identifier. Specifically, the current edge computing node first obtains its own anomaly propagation path feature vector. This vector is generated with an ordered internal structure, for example, by concatenating the features of each terminal according to the order of their smart terminal identifiers. Therefore, the node can cut this long vector into several segments, each corresponding to a terminal, based on a pre-agreed order and the dimension of each terminal's feature. The node also maintains a list containing the identifiers of all smart terminals participating in constructing the behavior topology graph, with the list order matching the vector cutting order. Then, the node creates an empty mapping table. Next, it iterates through the list of smart terminal identifiers. For the i-th terminal identifier in the list, it extracts the i-th sub-feature vector from the segmented feature vector segments, and then inserts this key-value pair into the mapping table, using the terminal identifier as the key and the extracted sub-feature vector as the value. After the traversal is complete, the local feature mapping table is established, which contains the local sub-feature vectors of each smart terminal observed by the current node.

[0103] Step S452: Extract the sub-feature vector corresponding to each smart terminal reported by each adjacent edge computing node from the deduplicated external feature vector set. For each adjacent edge computing node, establish an external feature mapping table with the smart terminal identifier as the key and the sub-feature vector reported by the node as the value.

[0104] The current edge computing node iterates through each feature vector in the deduplicated set of external feature vectors, each vector bearing the identifier of its source node. For each source node identifier, the node checks if an external feature mapping table has already been created for that source node; if not, it creates a new empty mapping table. Then, the node performs the same segmentation operation as in step S451 on the external feature vector, dividing it into several segments according to the same smart terminal identifier order and the same sub-vector dimension, with each segment corresponding to a terminal. Next, the node iterates through the list of smart terminal identifiers. For the i-th terminal identifier in the list, it extracts the i-th sub-feature vector from the segmented external feature vector and inserts this key-value pair—using the terminal identifier as the key and the extracted sub-feature vector as the value—into the external feature mapping table for that source node. After performing the above operations on all external feature vectors, the current edge computing node possesses multiple external feature mapping tables, each corresponding to a neighboring node, and each mapping table stores the sub-feature vectors of each terminal observed by that neighboring node.

[0105] Step S453: For each smart terminal identifier in the local feature mapping table, check whether there is a matching smart terminal identifier in the external feature mapping table. If there is, obtain the local sub-feature vector corresponding to the smart terminal identifier from the local feature mapping table and obtain the external sub-feature vector corresponding to the smart terminal identifier from the external feature mapping table.

[0106] First, the current edge computing node retrieves the first smart terminal identifier from its local feature mapping table. Then, it performs a lookup operation for each of the external feature mapping tables established in step S452, i.e., for each adjacent edge computing node. The node searches the external feature mapping table of the currently processed adjacent node using the smart terminal identifier as the key. If the search is successful and a corresponding value is found, it means that the adjacent node has also observed the same smart terminal and reported its sub-feature vector. At this point, the node retrieves the value with that identifier as the key from its local feature mapping table (i.e., the local sub-feature vector) and simultaneously retrieves the value with that identifier as the key from the adjacent node's external feature mapping table (i.e., the external sub-feature vector). This successfully pairs the current smart terminal identifier with the current adjacent node, creating a local and external sub-feature vector pair. For each terminal identifier in the local feature mapping table, the node sequentially performs this lookup and pairing operation in the external feature mapping tables of all adjacent nodes, thus preparing all possible vector pairs for subsequent computations.

[0107] Step S454: Calculate the dot product between the local sub-feature vector and the external sub-feature vector, and divide the dot product by the product of the magnitude of the local sub-feature vector and the magnitude of the external sub-feature vector to obtain the cosine similarity value between the two vectors.

[0108] Step S455: Fill the calculated cosine similarity value into the corresponding position of the similarity matrix. The row index of the similarity matrix corresponds to the smart terminal identifier, the column index corresponds to the node identifier of the adjacent edge computing node, and the matrix element value is the feature vector similarity between the corresponding smart terminal and the corresponding adjacent edge computing node in the current edge computing node.

[0109] After calculating a cosine similarity value for each pair (smart terminal identifier, neighboring node identifier) ​​in step S454, the current edge computing node needs to store these values ​​in an ordered manner. The node first creates an empty two-dimensional matrix. The number of rows in the matrix is ​​preset to the total number of smart terminal identifiers contained in the local feature mapping table, and the number of columns is preset to the number of external feature mapping tables created in step S452, i.e., the total number of neighboring edge computing nodes. Simultaneously, the node maintains two mapping relationships: one from row index to smart terminal identifier, and the other from column index to neighboring node identifier. Then, the node iterates through all the calculated similarity values. For each similarity value, it is associated with a specific smart terminal identifier and a specific neighboring node identifier. The node finds the row number corresponding to this smart terminal identifier through the row index mapping and the column number corresponding to this neighboring node identifier through the column index mapping. Next, the node directly assigns the calculated cosine similarity value to the element in the matrix located by that row and column number. After the traversal is complete, all positions in the matrix are either filled with valid similarity values ​​or remain empty because some terminals do not have corresponding data in some neighboring nodes. This filled matrix is ​​the feature vector similarity matrix.

[0110] Step S460: Based on the distribution of similarity values ​​in the feature vector similarity matrix, set a dynamic consensus threshold, mark the smart terminals corresponding to feature vectors with similarity values ​​higher than the dynamic consensus threshold as terminals with consistent consensus, and mark the smart terminals corresponding to feature vectors with similarity values ​​lower than the dynamic consensus threshold as terminals with divergent consensus.

[0111] In one implementation, step S460 may specifically include the following steps S461 to S465:

[0112] Step S461: Perform statistics on all non-empty elements in the feature vector similarity matrix, calculate the average of all non-empty elements as the first statistic, calculate the standard deviation of all non-empty elements as the second statistic, and subtract the preset multiple of the standard deviation from the average to obtain the initial dynamic threshold.

[0113] The current edge computing node first traverses the feature vector similarity matrix constructed in step S455, collecting all elements that have been filled with values, ignoring all empty elements. Then, the node calculates the sum of these non-empty values ​​and divides it by the total number of non-empty elements to obtain the average. Next, the node calculates the square of the difference between each non-empty value and the average, sums these squares, divides them by the total number of non-empty elements, and then takes the square root of the result to obtain the standard deviation. Afterward, the node obtains a pre-set multiplier parameter, such as 0.5 or 1.0. Finally, the node subtracts the value of this pre-set multiplier multiplied by the standard deviation from the calculated average; the resulting difference is the initial dynamic threshold. This threshold is a globally statistically significant reference value.

[0114] Step S462: For each row in the feature vector similarity matrix, i.e. the similarity value sequence corresponding to each smart terminal, calculate the mean and standard deviation of the similarity value in that row, and subtract a preset multiple of the mean from the standard deviation to obtain the dynamic threshold of that row.

[0115] The in-row mean is the average of the similarity values ​​of the same smart terminal from the perspectives of all adjacent edge computing nodes. The in-row standard deviation reflects the consistency between the observations of different nodes for the same smart terminal. The in-row dynamic threshold is a local dividing line calculated based on the data distribution of the terminal itself. Specifically, the current edge computing node processes the feature vector similarity matrix row by row. For the i-th row currently being processed, this row corresponds to a smart terminal. The node collects all non-empty similarity values ​​in this row. Then, the node calculates the in-row mean of these values, i.e., their arithmetic mean. Next, the node calculates the in-row standard deviation of these values, i.e., their dispersion relative to the in-row mean. Afterward, the node uses the same preset multiple parameter as in step S461 to subtract the preset multiple multiplied by the in-row standard deviation from the in-row mean, and the difference is the in-row dynamic threshold corresponding to that row. The above calculation is performed for each row in the matrix, thereby obtaining an in-row dynamic threshold specific to each smart terminal.

[0116] Step S463: Compare the initial dynamic threshold with the intra-row dynamic threshold of each row, and take the larger of the two as the final dynamic threshold for that row.

[0117] Step S464: For each smart terminal, count the number of similarity values ​​in the sequence that are greater than or equal to the final dynamic threshold of the row, and calculate the ratio of the number of similarity values ​​to the total number of non-empty elements in the sequence as the consensus ratio.

[0118] The consensus ratio measures the proportion of neighboring edge computing nodes that share a similar view of a given smart terminal's behavior patterns with the current node. Specifically, the current edge computing node processes the feature vector similarity matrix row by row again. For the currently processed i-th row, the node first obtains the final dynamic threshold corresponding to that row, which is determined in step S463. Then, the node iterates through all non-empty similarity values ​​in that row. During the iteration, the node checks each non-empty value to determine if its value is greater than or equal to the final dynamic threshold for that row. If the condition is met, the node increments a counter. After iterating through all non-empty elements in the row, the node obtains a count value, which is the number of similarity values ​​in the row that are greater than or equal to the final dynamic threshold. Simultaneously, the node also knows the total number of non-empty elements in the row. The node divides this count value by the total number of non-empty elements, and the quotient is the consensus ratio corresponding to the smart terminal. This ratio is a number between zero and one; a higher ratio indicates a higher degree of consensus among different nodes for the terminal.

[0119] Step S465: Compare the consensus ratio with a preset consensus ratio threshold. If the consensus ratio is greater than or equal to the preset consensus ratio threshold, mark the smart terminal as a terminal with consensus. If the consensus ratio is less than the preset consensus ratio threshold, mark the smart terminal as a terminal with consensus disagreement.

[0120] Step S470: Collect all terminals with consensus and their corresponding preliminary anomaly markers to obtain a consensus anomaly marker set. Collect all terminals with consensus disagreements and the connection relationships between these terminals and adjacent edge computing nodes that caused the disagreements. Construct an anomaly association graph between nodes with terminals with consensus disagreements as nodes and the disagreement connection relationships as edges.

[0121] The current edge computing node first creates an empty data structure to store consensus anomaly markers, such as a mapping table. Then, it iterates through all smart terminal identifiers marked as "consensus-agreeing terminals" in step S465. For each such terminal, the node retrieves the initial anomaly marker corresponding to that terminal from the result of step S360, i.e., the probability value of its belonging to the anomaly category. Then, the node inserts the terminal identifier as the key and the probability value as the value into the mapping table of the consensus anomaly marker set. Next, the node creates another empty data structure to construct an anomaly association graph between nodes. The graph construction begins with terminals with consensus disagreements. The node iterates through all smart terminal identifiers marked as "consensus-disagreeing terminals" in step S465. For each such disagreeing terminal, the node needs to identify which adjacent edge computing nodes' "disagreement" caused its low consensus ratio. This can be achieved by backtracking to its row in the similarity matrix, finding those columns with similarity values ​​lower than the final dynamic threshold of that row; the adjacent nodes corresponding to these columns are the nodes that caused the disagreement. Then, the node uses this branching endpoint as a graph node and also creates a graph node for each adjacent edge that caused the branch. Next, the node adds an edge between the branching endpoint and each adjacent node that caused the branch; this edge represents the branching connection. All such branching endpoints, adjacent nodes, and the edges between them together form an anomaly association graph between nodes. This graph visually shows which endpoints and between which adjacent nodes there are inconsistencies in the judgment of anomalies.

[0122] Step S500: Based on the consensus anomaly markers and the anomaly correlation graph between nodes, dynamic pattern matching and calibration are performed using the historical anomaly pattern library stored locally on the edge computing nodes to obtain the final anomaly judgment result and anomaly propagation root cause location information for each smart terminal within the corresponding time window.

[0123] In one implementation, step S500 may specifically include the following steps S510 to S570:

[0124] Step S510: Read the consensus anomaly flag corresponding to each smart terminal from the consensus anomaly flag set, and use the consensus anomaly flag as the baseline anomaly state of the smart terminal. For terminals with consistent consensus, write the consensus anomaly flag directly into the initial version of the final anomaly judgment result.

[0125] The current edge computing node first accesses the consensus anomaly marker set generated in step S470. This set is a mapping table containing all terminal identifiers determined to be "consensus-agreeing" and their preliminary anomaly markers. The node iterates through this mapping table, and for each entry—each terminal identifier and its associated preliminary anomaly marker—the node considers it as the baseline anomaly state of that terminal within the current time window. Then, the node creates an entry for this terminal in a new data structure, such as the final anomaly determination result record table. The node directly fills the corresponding field of the terminal in the final anomaly determination result record table with the preliminary anomaly marker value read from the consensus anomaly marker set. For all terminals with consensus, their final anomaly determination is already determined in the initial version, requiring no subsequent dispute resolution.

[0126] Step S520: Load the anomaly correlation graph between nodes, perform connectivity component analysis on the anomaly correlation graph between nodes, and identify all connected subgraphs in the graph composed of terminal nodes with consensus disagreements. Each connected subgraph represents a region where there is a dispute over anomaly determination.

[0127] The current edge computing node obtains the constructed anomaly correlation graph between nodes from the result of step S470. This graph contains all terminal nodes of consensus disagreements, as well as the adjacent nodes causing the disagreements and the edges between them. The node processes this graph using a graph traversal algorithm, such as depth-first search. The algorithm starts from any unvisited consensus disagreement terminal node in the graph and explores along the edges connecting the disagreements, visiting all reachable nodes, including other consensus disagreement terminals and adjacent edge computing nodes. When further exploration is impossible, all visited nodes and the edges between them constitute a connected subgraph. Then, the algorithm selects another starting point from the remaining unvisited nodes and repeats the above process until all nodes in the graph have been visited. In this way, the anomaly correlation graph between nodes is decomposed into several connected subgraphs. Each connected subgraph is considered an independent disputed region and requires separate subsequent pattern matching and calibration.

[0128] Step S530: For each connected subgraph, select a starting node from the connected subgraph, and traverse along the edges in the graph from the starting node. Collect all terminal nodes of consensus disagreements encountered during the traversal and their disagreement connections with each other to obtain the set of nodes and the set of edges in the disputed region.

[0129] Specifically, for each connected subgraph partitioned in step S520, the current edge computing node needs to extract the consensus divergence terminal nodes separately, forming a more focused set. The node first selects a consensus divergence terminal node in the connected subgraph as the starting point for traversal. Then, the node uses a graph traversal algorithm, such as breadth-first search, to traverse along the edges of the connected subgraph from this starting point. During the traversal, the node only focuses on nodes of type "consensus divergence terminal". Whenever such a node is encountered, the node adds its identifier to the disputed region node set. Simultaneously, for edges connecting two such divergence terminal nodes, or edges connecting a divergence terminal node to the adjacent node causing the divergence, the node adds the information of these edges, including the identifiers of the two endpoints and the direction of the edge, to the disputed region edge set. After traversal, the disputed region node set contains all the divergence terminals in the connected subgraph, while the disputed region edge set describes the connections between these divergence terminals and their relationships with the external nodes that caused the divergence. This refined set will be used for matching against a historical pattern library.

[0130] Step S540: Retrieve anomaly pattern cases recorded within a historical time period that match the time window of the current data segment to be detected from the historical anomaly pattern library stored locally on the edge computing node. Each anomaly pattern case contains a historical anomaly propagation path feature vector, a historical consensus anomaly label set, and historical anomaly propagation root cause location information.

[0131] The historical anomaly pattern library is a database stored locally on the edge computing nodes. It records confirmed anomaly events that occurred in past time windows and their associated characteristic information. Historical time periods can be the same point in time as the current time window, such as the same time every day, or the same duration, such as a period of similar length within the past week. Anomaly pattern cases are the basic recording units in the library. Each case contains three core parts: a historical anomaly propagation path feature vector, i.e., a graph-level feature vector generated through step S360 when a certain anomaly event occurred in the past; a historical consensus anomaly marker set, i.e., the anomaly markers of each terminal ultimately confirmed through step S470 in the past event; and historical anomaly propagation root cause location information, i.e., the source and propagation path of the anomaly confirmed through expert analysis or subsequent steps in the past.

[0132] Step S550: Perform pattern matching calculation between the anomaly propagation path feature vector of each node in the current disputed area node set and the historical anomaly propagation path feature vector in the retrieved historical anomaly pattern cases, and select the most similar reference case from the historical anomaly pattern cases according to the degree of matching.

[0133] In one implementation, step S550 may specifically include the following steps S551 to S556:

[0134] Step S551: For each node in the current disputed area node set, obtain the abnormal propagation path feature vector of that node as the query feature vector.

[0135] The query feature vector is a representation of the current data used for retrieval and matching in the historical case library. Specifically, the current edge computing node first traverses the set of nodes in the disputed area generated in step S530. This set contains the identifiers of all consensus divergent terminals within the current disputed area. For each terminal identifier in the set, the node retrieves the corresponding propagation enhancement feature vector from the output of step S360. Although step S360 ultimately generates a graph-level abnormal propagation path feature vector, what is needed here may be the multi-order propagation enhancement feature vector of the node, or the corresponding sub-vector that can be decomposed from the graph-level vector. Depending on the implementation of the model, it may be that the multi-order propagation enhancement feature vector of each node is directly used as its abnormal propagation path feature vector.

[0136] Step S552: For each retrieved historical anomaly pattern case, obtain the historical anomaly propagation path feature vector of each historical node contained in the case, and construct a set of historical feature vectors.

[0137] The current edge computing node traverses each historical anomaly pattern case retrieved in step S540. For a historical case currently being processed, the node parses its stored data structure. From this case, the node can obtain a set of historical consensus anomaly markers, which contains the identifiers and anomaly markers of each historical node in the historical event. More importantly, the node can obtain the anomaly propagation path feature vectors of each historical node generated when the historical case occurred. These vectors typically correspond one-to-one with the node identifiers in the historical consensus anomaly marker set. The node extracts these historical node identifiers and their corresponding historical anomaly propagation path feature vectors to form a temporary mapping table or set, which is the historical feature vector set of the historical case.

[0138] Step S553: ​​Calculate the distance between the query feature vector and each historical feature vector in the historical feature vector set to obtain the feature distance value between the query feature vector and each historical feature vector.

[0139] Distance metrics are a method to measure the degree of difference between two vectors; for example, Euclidean distance or Manhattan distance can be used. The smaller the feature distance value, the closer the two vectors are in the feature space, meaning the more similar the behavioral patterns they represent.

[0140] Step S554: For each historical abnormal pattern case, calculate the feature distance values ​​between all historical feature vectors and the query feature vector in that case, and find the minimum value as the minimum feature distance between that case and the current node.

[0141] Step S555: Sort the minimum feature distances corresponding to each historical anomaly pattern case, and select a preset number of historical anomaly pattern cases with the smallest minimum feature distances as a set of candidate reference cases.

[0142] Step S556: For each case in the candidate reference case set, calculate the overall matching degree between all historical feature vectors in the case and the abnormal propagation path feature vectors of all nodes in the current disputed area node set, and determine the case with the highest overall matching degree as the most similar reference case.

[0143] Specifically, for each historical case in the candidate reference case set, the current edge computing node needs to calculate its overall matching degree with the entire disputed region. Let the current disputed region node set have N nodes, with feature vectors Vq1, Vq2, ..., VqN. For a candidate historical case, there are M historical nodes, with feature vectors Vh1, Vh2, ..., VhM. One method to calculate the overall matching degree is to construct an N x M distance matrix, where the element in the i-th row and j-th column is the distance between Vqi and Vhj. Then, an optimal matching algorithm, such as the Hungarian algorithm, is applied to this matrix to find a one-to-one pairing method that minimizes the sum of the distances of all pairs. This minimum sum of distances can be used as an inverse indicator of the overall matching degree; that is, the smaller the sum, the higher the matching degree. The node calculates such an overall matching degree indicator for each historical case in the candidate set. Finally, the node compares these indicators and selects the historical case with the optimal indicator, such as the one with the smallest total distance, as the most similar reference case.

[0144] Step S560: Correct the baseline anomaly state of each node in the current disputed area node set according to the set of historical consensus anomaly markers in the most similar reference case, and replace the baseline anomaly state of the current node with the historical consensus anomaly markers in the reference case to obtain the corrected anomaly judgment result.

[0145] Specifically, the current edge computing node has already determined the most similar historical reference case to the current disputed area through step S550. The node loads the data of this reference case, especially the set of historical consensus anomaly markers. This set contains the final anomaly marker of each historical node that was verified when the historical case occurred. Now, the node traverses each terminal identifier in the node set of the current disputed area. For a terminal in the current disputed area, the node needs to find a corresponding historical node in the historical reference case. This correspondence can be determined by the distance between nodes calculated in step S553, that is, the current node corresponds to the historical node with the smallest distance in the historical case. Once the corresponding historical node is found, the node retrieves the anomaly marker value of that historical node from the set of historical consensus anomaly markers. Then, the node returns to the final anomaly judgment result record table established in step S510, finds the entry corresponding to this terminal in the current disputed area, and directly overwrites or replaces the value of its baseline anomaly state field with the historical consensus anomaly marker retrieved from the historical case. In this way, the final anomaly judgment of all terminals in the disputed area is no longer the preliminary consensus marker, but a value corrected after referring to the most similar historical situation.

[0146] Step S570: Analyze the historical anomaly propagation root cause location information in the most similar reference case, extract the root cause node identifier and propagation path description, and use the extracted root cause node identifier and propagation path description as the anomaly propagation root cause location information of the current disputed area.

[0147] In one implementation, step S570 may specifically include the following steps S571 to S575:

[0148] Step S571: Read the data structure of historical anomaly propagation root cause location information from the most similar reference case. The data structure includes a root cause node identifier field and a propagation path node sequence field.

[0149] The data structure for historical anomaly propagation root cause localization information is a predefined data organization format used to store root cause and path information in historical cases. Specifically, the current edge computing node accesses the most similar reference case selected through step S560. Within the data record of this case, there exists a dedicated field or area for storing historical anomaly propagation root cause localization information. The node completely reads the contents of this field. According to the predefined data format specification, this content itself is a composite data structure, explicitly containing at least two sub-parts. The first sub-part is the root cause node identifier field, whose value is a string or number representing the unique identifier of the terminal identified as the source of the anomaly in this historical case. The second sub-part is the propagation path node sequence field, whose value is a list, where each element is the identifier of a historical node, and the order of the list represents the chronological order in which the anomaly propagated in the historical case. After successfully parsing the values ​​of these two fields, the node obtains the root cause and path information from the historical case.

[0150] Step S572: Parse the root cause node identifier field, obtain the unique identifier of the historical root cause node stored therein, map the unique identifier of the historical root cause node to the current disputed area node set, and find the current node with similar behavioral pattern characteristics to the historical root cause node as the current root cause node.

[0151] The current edge computing node obtains the unique identifier of the historical root cause node from step S571. However, the node identifier in the historical cases may be completely different from the node identifier in the current scenario and cannot be used directly. Therefore, the node needs to find which node in the current disputed area has a behavior pattern most similar to that historical root cause node. The node can utilize the distance data already calculated in step S553. The node recalls that when calculating the overall matching degree, for each node in the current disputed area, a historical node with the smallest distance has been found in the historical cases. The node can then query, for the specific historical root cause node, which node in the current disputed area has the smallest distance to it. This current node with the smallest distance is considered to be the most similar to the historical root cause node in terms of behavior pattern. The node identifies this current node as the current root cause node of the current disputed area.

[0152] Step S573: Parse the propagation path node sequence field to obtain a series of historical node identifiers arranged in the propagation order. Map each historical node identifier to the current disputed area node set in sequence. Find the current node with similar behavioral pattern characteristics to each historical node. Arrange these current nodes in the order in the propagation path node sequence field to obtain the current propagation path node sequence.

[0153] Mapping historical paths to the current path involves mapping each historical node traversed by the abnormal propagation in a historical case to the node in the current disputed area whose behavior pattern is most similar, thereby inferring the possible propagation path in the current scenario. The current edge computing node obtains the historical propagation path node sequence field from step S571, which is a sequentially arranged list of historical node identifiers. The node creates an empty list to store the mapped current node identifiers. Then, the node processes each historical node identifier sequentially according to the order in the list. For the historical node identifier currently being processed, the node again uses the distance data calculated in step S553 to find the current node with the smallest distance among the paired distances between all nodes in the historical case and all nodes in the current disputed area. This found current node identifier is considered to correspond to the historical node. The node appends this current node identifier sequentially to the previously created list. After processing all historical node identifiers in the historical path list, the newly generated list contains a series of current node identifiers in the same order; this list is the current propagation path node sequence.

[0154] Step S574: Perform continuity verification on the current propagation path node sequence, check whether there are direct edge connections between adjacent nodes in the current node abnormal association graph. If there are missing edge connections, complete or correct the propagation path node sequence according to the shortest path in the current node abnormal association graph.

[0155] Specifically, after obtaining the current propagation path node sequence, the current edge computing node needs to verify whether this sequence constitutes a continuous communication path physically or logically. The node traverses the sequence from the beginning, checking if there is a direct edge connecting the i-th node and the (i+1)-th node in the current node's abnormal association graph. If so, this propagation step is valid, and the verification passes. If no direct edge connection is found in the current graph for a pair of adjacent nodes, this propagation step has a break. To correct this break, the node needs to use a graph search algorithm to find the shortest path in the current node's abnormal association graph, starting from the i-th node and ending at the (i+1)-th node. If such a shortest path is found, the node inserts all intermediate nodes along this shortest path sequentially between the i-th and (i+1)-th nodes in the sequence, thus completing the connection. If there is no path from node i to node i+1 in the graph, it may be necessary to mark this path as unreachable and take other corrective measures, such as deleting the connection or issuing a warning. After such pairwise verification and completion, the resulting sequence is the corrected sequence of nodes for the current propagation path.

[0156] Step S575: Encapsulate the node identifier of the current root cause node and the completed and corrected current propagation path node sequence to generate abnormal propagation root cause location information for the current disputed area.

[0157] Specifically, the current edge computing node now possesses two key pieces of information: first, the identifier of the current root cause node determined in step S572; and second, the current propagation path node sequence obtained after verification and correction in step S574. The node creates a new data structure, following the same format as in historical cases, containing a root cause node identifier field and a propagation path node sequence field. The node fills the root cause node identifier field with the current root cause node identifier. The node fills the propagation path node sequence field with the completed and corrected current propagation path node sequence as a list. Then, the node serializes this completed data structure or directly stores it as a complete record. This record is the final anomaly propagation root cause location information generated for the current disputed area, indicating which smart terminal the anomaly originated from within the current time window and how it propagated through a series of interactions between terminals.

[0158] Please see Figure 3 This is a schematic diagram of a data detection device provided in an embodiment of the present invention. The aforementioned data detection device can be a computer program (including program code) running on a network device; for example, the data detection device is an application software. This device can be used to execute corresponding steps in the method provided in the embodiments of the present invention. Figure 3 As shown, the data detection device 300 may include:

[0159] The data acquisition module 310 is used to acquire the initial running data stream generated by multiple smart terminals deployed on the edge computing node during a continuous acquisition period, and to perform time axis alignment and cutting on the initial running data stream to obtain multiple data segments to be detected with a unified time base.

[0160] The graph construction module 320 is used to construct a terminal behavior graph for each data segment to be detected, generate a behavior topology graph with smart terminals as nodes and inter-terminal interaction relationships as edges, and extract the behavior attribute feature sequence of each node and the interaction intensity evolution trajectory of each edge in the behavior topology graph.

[0161] The path tracing module 330 is used to input the behavior topology graph, behavior attribute feature sequence and interaction intensity evolution trajectory into the anomaly propagation analysis model preset on the edge computing node, and to perform anomaly propagation path tracing through the graph convolutional network layer of the anomaly propagation analysis model to obtain the preliminary anomaly label and anomaly propagation path feature vector corresponding to each data segment to be detected.

[0162] The anomaly broadcasting module 340 is used to broadcast the anomaly propagation path feature vector to the adjacent edge computing nodes within the edge cluster to which the edge computing node belongs, receive the set of anomaly propagation path feature vectors returned by the adjacent edge computing nodes and perform consensus verification, and generate consensus anomaly markers and anomaly association graphs between nodes.

[0163] The anomaly determination module 350 is used to perform dynamic pattern matching and calibration based on consensus anomaly markers and anomaly correlation graphs between nodes, combined with the historical anomaly pattern library stored locally on the edge computing nodes, to obtain the final anomaly determination result and anomaly propagation root cause location information for each smart terminal within the corresponding time window.

[0164] According to one embodiment of the present invention, Figure 2 The steps involved in the edge computing-based intelligent terminal abnormal data detection method shown can be derived from... Figure 3 The data detection device shown is executed by each module.

[0165] According to one embodiment of the present invention, Figure 3 The modules in the data detection device shown can be individually or entirely combined into one or more units, or one or more of these units can be further divided into at least two functionally smaller sub-units to achieve the same operation without affecting the technical effects of the embodiments of the present invention. The above modules are based on logical functional division. In practical applications, the function of one module can also be implemented by at least two units, or the function of at least two modules can be implemented by one unit. In other embodiments of the present invention, the data detection device may also include other units. In practical applications, these functions can also be implemented with the assistance of other units, and can be implemented collaboratively by at least two units.

[0166] Please see details. Figure 4 This is a schematic diagram of the structure of a computer device provided in an embodiment of the present invention. Figure 4 As shown, the computer device 1000 may include a processor 1001, a network interface 1004, and a memory 1005. Furthermore, the computer device 1000 may also include a user interface 1003 and at least one communication bus 1002. The communication bus 1002 is used to enable communication between these components. The user interface 1003 may include a standard wired interface or a wireless interface. The network interface 1004 may optionally include a standard wired interface or a wireless interface (such as a Wi-Fi interface). The memory 1005 may be high-speed RAM or non-volatile memory, such as at least one disk storage device. Optionally, the memory 1005 may also be at least one storage device located remotely from the processor 1001. Figure 4As shown, the memory 1005, which is a computer-readable storage medium, may include an operating system, a network communication module, a user interface module, and a device control application.

[0167] exist Figure 4 In the computer device 1000 shown, the network interface 1004 provides network communication functions; the user interface 1003 is mainly used to provide an input interface; and the processor 1001 can be used to call the device control application stored in the memory 1005 to implement the methods provided in the above embodiments.

[0168] It should be understood that the computer device 1000 described in the embodiments of the present invention can execute the foregoing text. Figure 2 The implementation principle and beneficial effects of the abnormal data detection method for smart terminals based on edge computing described in the corresponding embodiments will not be repeated here.

Claims

1. A method for detecting abnormal data in smart terminals based on edge computing, characterized in that, The method includes: The initial running data stream generated by multiple smart terminals deployed on edge computing nodes during a continuous collection period is obtained, and the initial running data stream is time-axis aligned and cut to obtain multiple data segments to be detected with a unified time base. For each data segment to be detected, a terminal behavior graph is constructed to generate a behavior topology graph with smart terminals as nodes and inter-terminal interaction relationships as edges. The behavior attribute feature sequence of each node and the interaction intensity evolution trajectory of each edge in the behavior topology graph are extracted. The behavior topology graph, the behavior attribute feature sequence, and the interaction intensity evolution trajectory are input into the anomaly propagation analysis model preset on the edge computing node. The anomaly propagation path is tracked through the graph convolutional network layer of the anomaly propagation analysis model to obtain the preliminary anomaly label and anomaly propagation path feature vector corresponding to each data segment to be detected. Within the edge cluster to which the edge computing node belongs, the abnormal propagation path feature vector is broadcast to the adjacent edge computing nodes. The abnormal propagation path feature vector set returned by the adjacent edge computing nodes is received and consensus verification is performed to generate consensus anomaly markers and anomaly association graphs between nodes. Based on the consensus anomaly markers and the anomaly correlation graph between nodes, dynamic pattern matching and calibration are performed using the historical anomaly pattern library stored locally on the edge computing nodes to obtain the final anomaly determination result and anomaly propagation root cause location information for each smart terminal within the corresponding time window.

2. The method according to claim 1, characterized in that, The step of constructing a terminal behavior graph for each data segment to be detected, generating a behavior topology graph with smart terminals as nodes and inter-terminal interaction relationships as edges, and extracting the behavior attribute feature sequence of each node and the interaction intensity evolution trajectory of each edge in the behavior topology graph, includes: The data packets generated by each smart terminal in each data segment to be detected are analyzed. The source terminal identifier field, target terminal identifier field, communication protocol type field, and data payload size field are extracted from each data packet. Based on the source terminal identifier field and target terminal identifier field, it is determined whether there is a data packet exchange relationship between any two smart terminals. Each smart terminal is used as a node in the behavior topology graph, and the data packet exchange relationship is used as an edge connecting two nodes to construct an initial behavior topology graph containing all nodes and all edges. For each node in the initial behavior topology graph, the number of times the smart terminal corresponding to the node sends and receives data packets at consecutive time points covered by the data segment to be detected is counted. The number of times the data packets are sent is arranged in chronological order to obtain the data sending frequency sequence of the node. The number of times the data packets are received is arranged in chronological order to obtain the data receiving frequency sequence of the node. The data sending frequency sequence and the data receiving frequency sequence are combined to obtain the behavior attribute feature sequence corresponding to each node. For each edge in the initial behavioral topology graph, the total number of data packets transmitted by the two smart terminals connected to the edge through the edge at consecutive time points covered by the data segment to be detected is counted. The total number of data packets is arranged in chronological order to obtain the transmission frequency evolution sequence of the edge. The total data load of all data packets transmitted by the two smart terminals connected to the edge through the edge at consecutive time points covered by the data segment to be detected is counted, and the average data load at each time point is calculated. The average data load is arranged in chronological order to obtain the load intensity evolution sequence of the edge. The transmission frequency evolution sequence and the load intensity evolution sequence are combined to obtain the interaction intensity evolution trajectory corresponding to each edge. Scan all nodes in the initial behavior topology graph to identify isolated nodes that are not connected by any edge. For each isolated node, re-parse the data packet generated by the smart terminal corresponding to the isolated node and extract the target terminal identification field from the data packet. If the target terminal identification field points to another node that already exists in the initial behavior topology graph, then add an edge between the isolated node and the other node. If the target terminal identification field points to an unknown node that does not exist in the initial behavior topology graph, then keep the isolated state of the isolated node unchanged. After processing isolated nodes, the initial behavioral topology graph is divided into connected subgraphs. All nodes with direct or indirect edge connections are grouped into the same connected subgraph, resulting in multiple connected subgraphs. For each edge within a connected subgraph, the initial weight value of the edge is calculated based on the total number of data packet exchanges between the two nodes corresponding to the edge within the data segment to be detected. The initial weight value is then assigned to the edge, resulting in a weighted behavioral topology graph corresponding to each connected subgraph. The weighted behavioral topology graph corresponding to each connected subgraph, the behavioral attribute feature sequence of each node in each connected subgraph, and the interaction intensity evolution trajectory of each edge in each connected subgraph are associated and stored to obtain the data set to be processed for input into the anomaly propagation analysis model.

3. The method according to claim 2, characterized in that, For each node in the initial behavioral topology graph, the number of data packet transmissions and receptions by the corresponding smart terminal at consecutive time points covered by the data segment to be detected are counted. The number of data packet transmissions is arranged in chronological order to obtain the data transmission frequency sequence of that node, and the number of data packet receptions is arranged in chronological order to obtain the data reception frequency sequence of that node. The data transmission frequency sequence and the data reception frequency sequence are combined to obtain the behavioral attribute feature sequence corresponding to each node, including: The start and end timestamps of the data segment to be detected are obtained. Using a preset unit time interval as the granularity, the time period between the start and end timestamps is evenly divided into multiple continuous and non-overlapping time sub-windows, each time sub-window corresponding to a specific time interval range. For each node's corresponding smart terminal, iterate through all the data packets generated by the smart terminal within the data segment to be detected, determine the time sub-window to which the data packet belongs based on the generation timestamp of each data packet, count the total number of data packets sent by the smart terminal as the source terminal within each time sub-window, and arrange the total number of data packets corresponding to each time sub-window according to the order of the time sub-windows to obtain the data transmission frequency sequence of the node; For each node's corresponding smart terminal, iterate through all the data packets generated by the smart terminal within the data segment to be detected, determine the time sub-window to which the data packet belongs based on the generation timestamp of each data packet, count the total number of data packets received by the smart terminal as the target terminal within each time sub-window, and arrange the total number of data packets corresponding to each time sub-window according to the order of the time sub-windows to obtain the data reception frequency sequence of the node. For each time sub-window corresponding to each node, the element values ​​in the data transmission frequency sequence and the element values ​​in the data reception frequency sequence corresponding to the time sub-window are combined into a two-dimensional vector, and the two-dimensional vector is used as the instantaneous representation of the behavior attribute of the node within the time sub-window; The instantaneous representations of behavioral attributes corresponding to all time sub-windows are concatenated according to the chronological order of the time sub-windows to obtain the behavioral attribute feature sequence corresponding to each node. The i-th element in the behavioral attribute feature sequence is the two-dimensional vector corresponding to the i-th time sub-window.

4. The method according to claim 2 or 3, characterized in that, For each edge in the initial behavioral topology graph, the total number of data packets transmitted by the two intelligent terminals connected to the edge through the edge at consecutive time points covered by the data segment to be detected is counted. The total number of data packets is arranged in chronological order to obtain the transmission frequency evolution sequence of the edge. The sum of the data load sizes of all data packets transmitted by the two intelligent terminals connected to the edge through the edge at consecutive time points covered by the data segment to be detected is counted, and the average data load size at each time point is calculated. The average data load sizes are arranged in chronological order to obtain the load intensity evolution sequence of the edge. The transmission frequency evolution sequence and the load intensity evolution sequence are combined to obtain the interaction intensity evolution trajectory corresponding to each edge, including: The start and end timestamps of the data segment to be detected are obtained. Using a preset unit time interval as the granularity, the time period between the start and end timestamps is evenly divided into multiple continuous and non-overlapping time sub-windows, each time sub-window corresponding to a specific time interval range. For each edge connecting two smart terminals, traverse all data packets generated by these two smart terminals in the data segment to be detected, filter out data packets whose source terminal is identified as one smart terminal of the edge and whose target terminal is identified as the other smart terminal of the edge, and data packets whose source terminal is identified as the other smart terminal of the edge and whose target terminal is identified as one smart terminal of the edge, and use the filtered data packets as the transmission packet set corresponding to the edge; The time sub-window to which each transmission message belongs is determined based on the generation timestamp of each transmission message. The total number of messages belonging to the transmission message set corresponding to the edge within each time sub-window is counted. The total number of messages corresponding to each time sub-window is arranged according to the chronological order of the time sub-windows to obtain the transmission frequency evolution sequence of the edge. For each transmission packet belonging to the transmission packet set corresponding to the edge within each time sub-window, extract the data load size field of the transmission packet, calculate the sum of the data load sizes of all transmission packets within the time sub-window, divide the sum of the data load sizes by the total number of transmission packets within the time sub-window to obtain the average data load size within the time sub-window, and arrange the average data load sizes corresponding to each time sub-window according to the chronological order of the time sub-windows to obtain the load intensity evolution sequence of the edge; For each time sub-window corresponding to each edge, the element values ​​in the transmission frequency evolution sequence and the element values ​​in the load intensity evolution sequence corresponding to the time sub-window are combined into a two-dimensional vector, and the two-dimensional vector is used as the instantaneous representation of the interaction intensity of the edge within the time sub-window. The instantaneous representations of the interaction intensity corresponding to all time sub-windows are concatenated according to the chronological order of the time sub-windows to obtain the interaction intensity evolution trajectory corresponding to each edge. The i-th element in the interaction intensity evolution trajectory is the two-dimensional vector corresponding to the i-th time sub-window.

5. The method according to claim 1, characterized in that, The abnormal propagation analysis model, which inputs the behavior topology graph, the behavior attribute feature sequence, and the interaction intensity evolution trajectory into a pre-set edge computing node, tracks the abnormal propagation path through the graph convolutional network layer of the abnormal propagation analysis model to obtain a preliminary abnormal label and an abnormal propagation path feature vector corresponding to each data segment to be detected, including: The behavioral topology graph is input into the graph embedding coding layer in the anomaly propagation analysis model. The graph embedding coding layer samples and aggregates the local neighborhood structure information of each node in the behavioral topology graph, collects the topological connection relationship from the set of neighboring nodes of each node, and maps the topological connection relationship to the initial structure embedding vector corresponding to each node. The behavioral attribute feature sequence of each node is input into the temporal feature encoding layer in the anomaly propagation analysis model. The bidirectional recurrent neural network in the temporal feature encoding layer performs forward propagation calculation and backward propagation calculation on the behavioral attribute feature sequence. The forward hidden state of each time step is extracted from the forward propagation process, and the backward hidden state of each time step is extracted from the backward propagation process. The forward hidden state and the backward hidden state of each time step are concatenated to obtain the comprehensive hidden state of each time step. The comprehensive hidden state of the last time step is used as the behavioral temporal state vector of the node. The interaction intensity evolution trajectory of each edge is input into the trajectory feature encoding layer in the anomaly propagation analysis model. The one-dimensional convolutional neural network in the trajectory feature encoding layer performs convolution kernel sliding calculation on the interaction intensity evolution trajectory. Local fluctuation mode features are extracted from the interaction intensity evolution trajectory. The local fluctuation mode features are flattened to obtain the evolution mode feature vector of each edge. The initial structure embedding vector of each node, the behavior temporal state vector of that node, and the average value of the evolution mode feature vectors of all edges connected to that node are concatenated to obtain the comprehensive feature representation of each node. The comprehensive feature representations of all nodes are then combined into a node feature matrix according to the order of the nodes in the behavior topology graph. The node feature matrix and the adjacency matrix of the behavior topology graph are input into the graph convolutional propagation layer in the anomaly propagation analysis model. The first graph convolution operation in the graph convolutional propagation layer is used to aggregate and update the first-order neighbor node features of each node. The second graph convolution operation in the graph convolutional propagation layer is used to aggregate and update the second-order neighbor node features of each node. After multiple graph convolution operations, the propagation enhancement feature vector of each node is obtained. The propagation enhancement feature vector of each node is input into the anomaly classification output layer and the path encoding output layer of the anomaly propagation analysis model. The propagation enhancement feature vector is transformed in dimension and calculated in probability through the fully connected mapping in the anomaly classification output layer to obtain the probability value of each node belonging to the anomaly category as a preliminary anomaly label. The propagation enhancement feature vector of all nodes is globally aggregated through the graph pooling operation in the path encoding output layer to generate an anomaly propagation path feature vector.

6. The method according to claim 5, characterized in that, The step of inputting the behavioral attribute feature sequence of each node into the temporal feature encoding layer of the anomaly propagation analysis model, and performing forward propagation and backward propagation calculations on the behavioral attribute feature sequence through a bidirectional recurrent neural network in the temporal feature encoding layer, includes: The behavioral attribute feature sequence of each node is input forward into the forward recurrent unit of the bidirectional recurrent neural network in chronological order. In the first time step, the initial hidden state and the feature vector of the first time step are input together into the forward recurrent unit for calculation to obtain the forward output state of the first time step. In each subsequent time step, the forward output state of the previous time step and the feature vector of the current time step are input together into the forward recurrent unit for calculation to obtain the forward output state of the current time step. The forward output states of all time steps are arranged in chronological order to obtain the forward hidden state sequence. The behavioral attribute feature sequence of each node is input into the backward recurrent unit of the bidirectional recurrent neural network in reverse chronological order. At the last time step, the initial hidden state and the feature vector of the last time step are input into the backward recurrent unit for calculation to obtain the backward output state of the last time step. At each subsequent reverse chronological time step, the backward output state of the next time step and the feature vector of the current reverse chronological time step are input into the backward recurrent unit for calculation to obtain the backward output state of the current reverse chronological time step. The backward output states of all time steps are arranged in reverse chronological order to obtain the backward hidden state sequence. For each time step, the forward output state and the backward output state corresponding to that time step are concatenated to obtain a dimension-expanded comprehensive hidden state vector. This comprehensive hidden state vector contains temporal dependency information in both the past to the present and the future to the present directions. Arrange the comprehensive hidden state vectors corresponding to each time step in chronological order to obtain the comprehensive hidden state sequence of each node. Take the comprehensive hidden state vector of the last time step from the comprehensive hidden state sequence as the behavior time sequence state vector of that node.

7. The method according to claim 5 or 6, characterized in that, The step of inputting the node feature matrix and the adjacency matrix of the behavioral topology graph into the graph convolutional propagation layer of the anomaly propagation analysis model, and then aggregating and updating the first-order neighbor node features of each node through the first graph convolution operation in the graph convolutional propagation layer, and aggregating and updating the second-order neighbor node features of each node through the second graph convolution operation in the graph convolutional propagation layer, includes: The adjacency matrix is ​​added to the identity matrix to obtain the modified adjacency matrix with added self-loop connections. The elements of each row of the modified adjacency matrix are summed to obtain the degree value of each node. A degree diagonal matrix is ​​constructed based on the degree value of each node. The inverse of the degree diagonal matrix is ​​multiplied by the modified adjacency matrix to obtain the normalized graph convolution propagation matrix. The node feature matrix is ​​multiplied by the graph convolution propagation matrix to obtain a first-order aggregated feature matrix of each node after aggregating the features of its first-order neighbor nodes. The first-order aggregated feature matrix is ​​then input into the first activation function layer for nonlinear transformation to obtain a first-order activation feature matrix. The first-order activation feature matrix is ​​multiplied by the graph convolution propagation matrix to obtain a second-order aggregated feature matrix that further aggregates the second-order features of its neighboring nodes based on the first-order aggregated features of each node. The second-order aggregated feature matrix is ​​then input into the second activation function layer for nonlinear transformation to obtain the second-order activation feature matrix. The node feature matrix, the first-order activation feature matrix, and the second-order activation feature matrix are concatenated to obtain the multi-order propagation enhancement feature vector of each node. The multi-order propagation enhancement feature vector integrates the node's own original features, the first-order neighbor propagation features, and the second-order neighbor propagation features. The multi-order propagation enhancement feature vectors of each node are recombined according to the order of the nodes in the behavioral topology graph to obtain the propagation enhancement feature matrix. The number of rows of the propagation enhancement feature matrix is ​​equal to the total number of nodes in the behavioral topology graph, and the number of columns is equal to the total number of feature dimensions after concatenation.

8. The method according to claim 1, characterized in that, Within the edge cluster to which the edge computing node belongs, the abnormal propagation path feature vector is broadcast to adjacent edge computing nodes. The set of abnormal propagation path feature vectors returned by adjacent edge computing nodes is received and consensus verification is performed. Consensus anomaly markers and an anomaly correlation graph between nodes are generated, including: Read the network address information and neighbor relationship list of the edge computing node in the edge cluster from the local configuration file of the edge computing node. The neighbor relationship list records the network addresses of all adjacent edge computing nodes that have a direct physical link connection or logical communication tunnel with the edge computing node. For each abnormal propagation path feature vector corresponding to the data segment to be detected generated by the current edge computing node, the node identifier of the current edge computing node and the timestamp information of the data segment to be detected are added to the abnormal propagation path feature vector to obtain a broadcast data packet carrying the source mark. The broadcast data packet is sent to each neighboring edge computing node in the neighbor relationship list through the broadcast communication mechanism inside the edge cluster. The listening service is started to wait for the response data packets returned by the neighboring edge computing nodes. Each response data packet contains the abnormal propagation path feature vector generated by the neighboring edge computing node itself and the abnormal propagation path feature vector received and forwarded by the neighboring edge computing node from other nodes. All the received response data packets are parsed and merged to obtain the original external feature vector set. The original set of external feature vectors is deduplicated based on node identifier and timestamp. Duplicate feature vectors with the same node identifier and timestamp are deleted, and the latest anomaly propagation path feature vector generated by each adjacent edge computing node for each data segment to be detected is retained, resulting in a deduplicated set of external feature vectors. The anomaly propagation path feature vector of the current edge computing node itself is compared with each feature vector in the deduplicated external feature vector set to calculate the similarity between the current edge computing node and each adjacent edge computing node for the same data segment to be detected. Based on the distribution of similarity values ​​in the feature vector similarity matrix, a dynamic consensus threshold is set. Smart terminals corresponding to feature vectors with similarity values ​​higher than the dynamic consensus threshold are marked as terminals with consistent consensus, while smart terminals corresponding to feature vectors with similarity values ​​lower than the dynamic consensus threshold are marked as terminals with divergent consensus. Collect all terminals that reach a consensus and their corresponding preliminary anomaly markers to obtain a consensus anomaly marker set. Collect all terminals that disagree on consensus and the connection relationships between these terminals and the adjacent edge computing nodes that caused the disagreement. Construct an anomaly association graph between nodes with the terminals that disagree on consensus as nodes and the disagreement connection relationships as edges.

9. The method according to claim 8, characterized in that, The step of performing pairwise similarity calculations between the current edge computing node's own anomaly propagation path feature vector and each feature vector in the deduplicated external feature vector set to obtain a feature vector similarity matrix between the current edge computing node and each adjacent edge computing node for the same data segment to be detected includes: Extract sub-feature vectors corresponding to each smart terminal from the anomaly propagation path feature vector of the current edge computing node itself, and establish a local feature mapping table with the smart terminal identifier as the key and the local sub-feature vector as the value. Extract the sub-feature vector corresponding to each smart terminal reported by each adjacent edge computing node from the deduplicated external feature vector set. For each adjacent edge computing node, establish an external feature mapping table with the smart terminal identifier as the key and the sub-feature vector reported by the node as the value. For each smart terminal identifier in the local feature mapping table, check if there is a matching smart terminal identifier in the external feature mapping table. If there is, obtain the local sub-feature vector corresponding to the smart terminal identifier from the local feature mapping table and obtain the external sub-feature vector corresponding to the smart terminal identifier from the external feature mapping table. Calculate the dot product between the local sub-feature vector and the external sub-feature vector, and divide the dot product by the product of the magnitude of the local sub-feature vector and the magnitude of the external sub-feature vector to obtain the cosine similarity value between the two vectors. The calculated cosine similarity value is filled into the corresponding position of the similarity matrix. The row index of the similarity matrix corresponds to the smart terminal identifier, the column index corresponds to the node identifier of the adjacent edge computing node, and the matrix element value is the feature vector similarity between the current edge computing node and the corresponding adjacent edge computing node of the smart terminal.

10. A computer device, characterized in that, include: processor; And a memory, wherein the memory stores computer-readable code that, when executed by the processor, causes the processor to perform the method as described in any one of claims 1 to 9.

Images