A method for detecting abnormal behavior of SIoT nodes based on a spatiotemporal dual-stream model

Abstract

This invention discloses a method for detecting abnormal behavior of SIoT nodes based on a spatiotemporal dual-stream model, belonging to the field of social IoT security technology. This invention overcomes the bottleneck of weakly supervised modeling and solves the problem of scarce anomaly labels. Through a mechanism for constructing an anomaly mask M by initializing hard labels and iteratively generating pseudo-labels, it eliminates the need for large-scale labeled data, allowing model training to begin with only a small number of historical anomaly records. Furthermore, it can dynamically expand supervisory information using unlabeled data. This weakly supervised self-enhancing strategy enables the model to converge stably even in real-world SIoT scenarios (where anomaly events are sparse and labeling costs are high). Compared to traditional methods that rely on full labels, this significantly broadens the scope of application and reduces implementation costs.

Description

Technical Field

[0001] This invention relates to the field of social Internet of Things (IoT) security technology, specifically to a method for detecting abnormal behavior of SIoT nodes based on a spatiotemporal dual-stream model. Background Technology

[0002] With the rapid growth in the number of Social Internet of Things (SIoT) devices, the amount of collaborative data between devices continues to increase. Simultaneously, abnormal behaviors such as malicious device access, forged nodes, injection of false data, and propagation of malicious control commands are frequently occurring. Currently, existing methods for detecting abnormal device behavior in Social IoT mainly fall into three categories: 1) Data content analysis-based methods, which use rules or simple statistics to analyze the content of data packets and status logs uploaded by devices to identify suspicious data or abnormal commands; 2) Static graph structure-based methods, which treat devices as nodes and collaborative communication, service requests, and proximity discovery as edges, using static graph neural networks to learn device embeddings, and then using anomaly detection algorithms to discover outlier nodes; 3) Time-series modeling-based methods, which treat device behavior sequences (communication frequency, data synchronization timestamps, state changes, etc.) as time series, using RNNs, LSTMs, and Transformers to capture rhythm and periodicity, and integrating anomaly detection criteria for identification. However, these methods still have some shortcomings. For example, content analysis-based methods are not robust to multi-type sensor data, encrypted data packets, and binary communication between devices, and are difficult to detect abnormal devices that can be identified by structural behavior alone. Static graph structure-based methods assume that device relationships are fixed and ignore the dynamic evolution of device cooperation relationships over time. Temporal modeling-based methods ignore device relationship topology, cannot utilize the structural information of the "abnormal propagation link", and have difficulty distinguishing between individual device abnormalities and group collaborative abnormalities.

[0003] Currently, researchers both domestically and internationally have conducted relevant studies on the above-mentioned issues. Zhang W, He S, Wang T, et al. proposed Bi-GCN + temporal attention for rumor detection in the article "Rumor detection on social media with bi-directional graph convolutional networks and temporal attention" [Information Processing & Management, 2022, 59(3): 103012]. Chang Q, Zhao P, Li J, et al. proposed GCN and Transformer fusion rumor detection in the article "Memory-augmented transformer with graph convolutional networks for rumor detection on social platforms" [Knowledge-Based Systems, 2024, 292: 111625]. GCN extracts user-post graph structure features, memory-augmented Transformer caches historical rumor vectors, and "memory-current" matching is achieved through cross-attention. Wu T, Li H, Zhang Y, et al., in their article "Video anomaly behavior recognition of 10kV live-line operators via improved ST-GCN" [Southern Power System Technology, 2024, 18(2):45-52], verified the effectiveness of ST-GCN in extracting local spatiotemporal features. Zhao J, Wang X, Cui L, et al., in their article "Dual-stream transformer for skeleton-based action recognition with spatial-temporalattention" [Computer Vision and Image Understanding, 2023, 235:103786], proposed a dual-stream Transformer architecture and verified its ability to capture mutation features.

[0004] While the aforementioned research has made initial progress in smart device monitoring and IoT security, significant research gaps remain in graph structure modeling and temporal modeling for detecting anomalous device behavior in Social Internet of Things (SIoT). Specifically, most existing methods are limited to static graph convolution or single-stream temporal models, and have not yet systematically addressed the problem of simultaneously modeling the "evolution of local device cooperation relationships" and "abnormal communication mutation characteristics." Furthermore, the joint architecture of ST-GCN and two-stream Transformer, and its standardized application in SIoT security scenarios, still lack in-depth research and verification.

[0005] Therefore, it is necessary to propose a method for detecting abnormal device behavior in social IoT based on ST-GCN and dual-stream Transformer. Summary of the Invention

[0006] The purpose of this invention is to provide a method for detecting abnormal behavior of SIoT nodes based on a spatiotemporal dual-stream model, so as to solve the technical problems mentioned in the background art.

[0007] To achieve the above objectives, the present invention provides the following technical solution: a method for detecting abnormal behavior of SIoT nodes based on a spatiotemporal dual-stream model, comprising at least the following steps:

[0008] S1: Construct a dynamic SIoT device relationship graph sequence. A dynamic SIoT device relationship graph sequence G is constructed in real-time using an hourly sliding window mechanism. Device nodes in the SIoT network are defined as nodes in the graph, and core collaborative communication behaviors within a preset time window are defined as edges. A multi-dimensional node feature vector is selected for each device node. ;

[0009] S2: Local spatiotemporal feature extraction. The dynamic SIoT device relationship graph sequence G is input into a spatiotemporal graph convolutional network module, namely the ST-GCN module. The ST-GCN module combines spatial graph convolutional layers and dilated causal convolutional layers to capture the local spatial associations and short-term temporal dependencies between device nodes, respectively, and outputs a short-term spatiotemporal feature matrix X. ST ;

[0010] S3: Simultaneous modeling with a dual-stream Transformer, constructing a dual-stream Transformer architecture including a mainstream branch and an anomaly branch, wherein the model parameters Θn of the mainstream branch and the model parameters Θa of the anomaly branch are independent of each other; the short-term spatiotemporal feature matrix X is... ST The two branches are processed in parallel. The main branch is used to extract the long-term evolution features Fn of the normal communication behavior of the device. The abnormal branch combines the abnormal mask M with weak supervision information at the input end and uses the self-attention mechanism to extract the mutation features Fa of the abnormal communication behavior of the device.

[0011] S4: Feature fusion and anomaly detection. The long-term evolution feature Fn and the mutation feature Fa are concatenated and dimensionality reduced through linear transformation to obtain the comprehensive behavioral representation F. The comprehensive behavioral representation F is then input into a binary classifier to calculate the anomaly confidence of the target device node at the current time. ;

[0012] S5: Optimization of Result Output and Feedback, based on the aforementioned anomaly confidence level. The comparison result with a preset threshold determines whether the device is abnormal and outputs the determination result; simultaneously, based on the abnormality confidence level... A weakly supervised feedback loop is constructed to iteratively update the anomaly mask M.

[0013] Furthermore, the dynamic SIoT device relationship graph sequence G={G1,G2,…,Gt}, at each time step of the graph sequence... Device nodes are defined as nodes. ;

[0014] Connecting devices and edge Defined as the core collaborative communication behavior that occurs between devices in the past T hours, core collaborative communication includes at least data communication, service invocation, proximity discovery and control command interaction;

[0015] The node feature matrix The node feature matrix includes at least the total number of communications, communication time entropy, communication object diversity, and network address change count.

[0016] The number of communications is used to reflect the activity level of the device. Abnormally high or low frequencies may be the baseline signal of malicious nodes.

[0017] The time entropy is used to reflect the distribution regularity of communication in the time dimension. Low time entropy suggests automated scripts, periodic tasks, or abnormal communication patterns.

[0018] The diversity of communication objects is used to characterize the breadth of the scope of device collaboration. Too low diversity may be a signal of concentrated attack links or fake node clusters.

[0019] The address change count is used to associate the security of the device; frequent address changes may indicate a spoofed device, proxy switching, or abnormal connection.

[0020] Furthermore, the ST-GCN module is used to process dynamic graph sequences. By using spatiotemporal convolutional layer operations, the evolutionary patterns of local cooperative communication between devices are accurately captured, and features that integrate local topological structure and short-term temporal evolution information are output. ;

[0021] The spatial graph convolutional layer, also known as SGC, performs SGC at each time step. The above is executed to aggregate the neighborhood features of nodes, thereby capturing local structural signals of the abnormal communication propagation graph;

[0022] The SGC operation can be formalized as follows:

[0023] (1)

[0024] in, ; It is a normalized adjacency matrix; It is a trainable weight matrix;

[0025] SGC can effectively utilize social topology information to enhance node representation;

[0026] After the SGC operation, a dilated causal convolutional layer is connected;

[0027] The dilated causal convolutional layer, or DCCM, is used to solve the problem of capturing temporal dependencies across different time scales in social behavior. The DCCM adopts a dilation rate that increases exponentially with the number of network layers.

[0028] Furthermore, the dual-stream Transformer architecture models the long-term evolution of normal communication behavior with the instantaneous mutation of abnormal communication behavior in a decoupled manner.

[0029] Main branches and exception branches are built by using two Transformer encoders with the same structure but independent parameters;

[0030] The mainstream branches The model parameters Θn are used to learn the long-term evolutionary patterns of normal communication behavior;

[0031] The abnormal branch The model parameter Θa is used to learn rare, high-amplitude anomalous communication behavior mutation features;

[0032] The decoupling of the two parameters Θn and Θa ensures that the two branches can be optimized independently, enabling the simultaneous capture of long-term stable modes and transiently sensitive mutations.

[0033] Main branches and abnormal branches Both branches use the short-term spatiotemporal features output by ST-GCN. As basic input;

[0034] Main branches Using a standard self-attention mechanism, stacking Layered Transformer structure, used to extract from Extracting long-term evolutionary features of device communication behavior. Self-attention mechanisms can calculate The dependency weights between all time steps in the sequence are used to capture the rhythm and periodicity of device communication behavior, effectively establishing a normal baseline for user behavior;

[0035] The extraction of this data provides a reliable benchmark for judging abnormal behavior;

[0036] (2)

[0037] Exceptional branches Transient mutation features used to learn anomalous communication behavior ;

[0038] Use exception branches The input is enhanced;

[0039] Exceptional branches The input is With anomaly mask The fusion representation;

[0040] As an external guiding signal, explicitly guide By focusing attention on spatiotemporal regions where anomalies may occur, the model's sensitivity to sparse anomalous signals can be improved.

[0041] (3)

[0042] in, Concatenate strings.

[0043] Furthermore, S4 includes at least the following steps:

[0044] Will and Perform splicing operation ;

[0045] Subsequently, through a linear transformation layer... Perform feature dimensionality reduction to obtain a dimension of Comprehensive behavioral representation ;

[0046] Comprehensive behavioral representation The input is fed into a binary classifier consisting of a multilayer perceptron (MLP) and a sigmoid activation function.

[0047] (4)

[0048] The classifier calculates the anomaly confidence score for each device node. ;

[0049] Anomaly detection is performed by pre-setting a reasonable threshold. If the calculated anomaly confidence level satisfies If so, the device node is determined to be abnormal;

[0050] Optimize output and feedback based on the anomaly confidence level. The comparison result with a preset threshold determines whether the device is abnormal and outputs the determination result; simultaneously, based on the abnormality confidence level... A weakly supervised feedback loop is constructed to iteratively update the anomaly mask M.

[0051] Furthermore, the output in S5 is a fine-grained category output. To enhance the interpretability of the model, the output layer of the multilayer perceptron (MLP) is designed to output anomaly categories simultaneously. The anomaly categories include at least malicious control devices, forged devices, anomalous data injection sources, and anomalous communication robot devices.

[0052] Furthermore, the iterative update of the anomaly mask M includes at least the following steps:

[0053] A multi-round iterative weakly supervised process is adopted, which is achieved by combining normal pattern regression loss and weighted anomaly classification loss;

[0054] loss function Combined with normal pattern regression loss Weighted anomaly classification loss :

[0055] (5)

[0056] Normal pattern regression loss Used for mainstream branches The output, through encouragement Accurately predict the features of the next time step to ensure Stable learning of long-term communication evolution patterns;

[0057] Weighted anomaly classification loss Used for final anomaly confidence And based on the anomaly mask Weighting;

[0058] for Sparse outlier samples, loss weights Increase the size of the model, forcing it to pay close attention to mutation features;

[0059] Meanwhile, the focus loss mechanism was adopted to further mitigate the impact of extreme class imbalance;

[0060] The training iteration process is as follows:

[0061] First, initialize based on a small number of hard tags. The hard tags include at least historical abnormal device records and malicious control event logs;

[0062] Then train the model, and dynamically update it using the current model's predictions on unlabeled data. pseudo-tags in;

[0063] This process is repeated until the model converges, thereby enabling the model to self-enhance in real-world SIoT scenarios where anomalous labels are scarce.

[0064] Compared with the prior art, the beneficial effects of the present invention are:

[0065] 1. This invention breaks through the bottleneck of weakly supervised modeling and solves the problem of scarce anomaly labels. Through the construction mechanism of anomaly mask M generated by hard label initialization and pseudo label iteration, it can start model training with only a small number of historical anomaly records without relying on large-scale labeled data. Moreover, it can dynamically expand the supervision information using unlabeled data. This weakly supervised self-enhancing strategy enables the model to converge stably in real SIoT scenarios (where anomaly events are sparse and labeling costs are high). Compared with traditional methods that rely on full labels, the applicable scope is greatly broadened and the implementation cost is significantly reduced.

[0066] 2. This invention employs dual-feature synchronous modeling, achieving a dual improvement in detection accuracy and robustness. It utilizes a joint architecture of ST-GCN and a dual-stream Transformer to simultaneously capture local spatiotemporal evolution patterns and long- and short-term behavioral characteristics: ST-GCN efficiently extracts local structural correlations and multi-scale temporal dependencies in device collaboration through spatial graph convolution and dilated causal convolution; the dual-stream Transformer, with its parameter-independent dual-branch design, focuses on the long-term evolutionary baseline of normal behavior and the instantaneous mutation features of abnormal behavior, preventing a single model from being dominated by massive amounts of normal data and ignoring sparse anomalous signals. After dual feature fusion, the model can accurately identify individual anomalies and also capture group collaborative anomalies (such as concentrated attack links), improving detection accuracy compared to traditional single-stream temporal models or static graph models, with particularly outstanding ability to identify low-frequency sudden anomalies and disguised anomalies.

[0067] 3. This invention is content-independent and adaptable to complex SIoT communication scenarios. It relies solely on graph structure data (topology relationships) and behavioral time-series data (communication counts, time entropy, etc.) of device collaboration and communication, without involving content data uploaded by devices (such as encrypted data packets, raw sensor data, and protocol text). This characteristic allows it to overcome the limitations of content-based analysis methods, perfectly adapting to complex SIoT scenarios involving multiple types of sensors, binary communication, and encrypted transmission, while avoiding privacy risks caused by content parsing and meeting data security compliance requirements.

[0068] 4. This invention, through fine-grained classification and high interpretability, meets the actual needs of security risk control. It can not only determine whether a device is abnormal, but also output fine-grained categories such as malicious control devices, forged devices, abnormal data injection sources, and automated communication robots, providing clear handling criteria for security operations and maintenance. Simultaneously, the model's feature extraction process (such as communication object diversity, address change counts, and other node features) and branch modeling logic (normal baseline vs. abnormal mutations) are traceable. Compared to black-box models, it can clearly explain "why it was determined to be abnormal," helping operations and maintenance personnel quickly locate the source of risk and improve risk control response efficiency.

[0069] 5. This invention, through its lightweight and real-time updating design, is adapted to dynamic deployment scenarios of SIoT. ST-GCN's dilated causal convolution expands the receptive field exponentially without increasing computational cost; the dual-stream Transformer has independent parameters but reuses its structure, avoiding model redundancy; the dynamic graph sequence is updated using an hourly sliding window, balancing real-time performance and computational efficiency. The overall architecture, while ensuring accuracy, meets the real-time detection requirements of massive SIoT device access scenarios, and can be deployed on edge gateways or cloud-based risk control platforms, supporting large-scale applications of cross-domain SIoT systems.

[0070] 6. This invention possesses strong generalization capabilities, covering the security needs of multiple SIoT scenarios. Through content-independent node feature design and a dynamic topology adaptation mechanism, the model can be flexibly migrated to different types of SIoT scenarios such as smart homes, industrial IoT, and connected vehicles, without requiring feature reconstruction or architecture adjustment for specific scenarios. It can be used for real-time protection such as malicious device access interception and fake data injection intervention, as well as for post-event analysis such as security auditing and anomaly tracing, providing end-to-end security assurance for SIoT systems. Attached Figure Description

[0071] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0072] Fig. 1 This is a diagram illustrating the overall architecture of the present invention;

[0073] Fig. 2 This is a schematic diagram illustrating the construction process and node features of the present invention;

[0074] Fig. 3 This is a schematic diagram of the spatiotemporal graph convolutional network module structure of the present invention;

[0075] Fig. 4 This is a schematic diagram illustrating the separation of the dual-stream Transformer architecture and abnormal behavior features of the present invention. Detailed Implementation

[0076] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments.

[0077] The social Internet of Things (SIoT) abnormal device behavior detection method based on ST-GCN and dual-stream Transformer disclosed in this invention revolves around four core steps: dynamic device relationship graph modeling, local spatiotemporal feature extraction, dual-stream synchronous evolution modeling, and feature fusion decision-making. It aims to solve the problem of weakly supervised modeling under the condition of scarce abnormal labels, and simultaneously model the long-term evolution of normal device communication behavior and the sudden characteristics of abnormal communication behavior.

[0078] This method first constructs a dynamic SIoT device relationship graph sequence based on core collaborative communication and extracts multi-dimensional node features. Then, it utilizes the ST-GCN module, which combines spatial graph convolution and dilated causal convolution, to extract short-term local spatiotemporal features (XST). The core step involves inputting the XST into a parameter-independent dual-stream Transformer architecture. The mainstream branch extracts long-term evolutionary features of normal communication behavior, while the anomaly branch, combined with an anomaly mask M incorporating weakly supervised information, is specifically used to extract anomalous communication mutation features. Finally, the dual-stream features are fused for classification, and a weakly supervised feedback loop is established based on the prediction results to iteratively update the anomaly mask. This method overcomes the difficulty of scarce anomaly labels, achieving high-precision, interpretable anomaly device detection and fine-grained classification that is independent of communication content and data load.

[0079] Specifically as follows:

[0080] Please see Figs. 1 to 4 A method for detecting abnormal behavior of SIoT nodes based on a spatiotemporal dual-stream model includes at least the following steps:

[0081] S1: Construct a dynamic SIoT device relationship graph sequence. A dynamic SIoT device relationship graph sequence G is constructed in real-time using an hourly sliding window mechanism. Device nodes in the SIoT network are defined as nodes in the graph, and core collaborative communication behaviors within a preset time window are defined as edges. A multi-dimensional node feature vector is selected for each device node. (Constructing a dynamic SIoT device relationship graph is a crucial step in capturing the dynamic evolution of device behavior, providing highly discriminative foundational data support for subsequent spatiotemporal feature extraction. This invention focuses on communication behavior patterns and topology, ensuring anomaly detection is achieved without relying on data content.)

[0082] S2: Local spatiotemporal feature extraction. The dynamic SIoT device relationship graph sequence G is input into a spatiotemporal graph convolutional network module, namely the ST-GCN module. The ST-GCN module combines spatial graph convolutional layers and dilated causal convolutional layers to capture the local spatial associations and short-term temporal dependencies between device nodes, respectively. It achieves exponential growth of the receptive field without increasing the computational load, efficiently captures the evolution of local cooperative communication between devices and the communication dependencies at different time scales, and outputs a short-term spatiotemporal feature matrix X. ST ;

[0083] S3: Simultaneous modeling with a dual-stream Transformer, constructing a dual-stream Transformer architecture including a mainstream branch and an anomaly branch, wherein the model parameters Θn of the mainstream branch and the model parameters Θa of the anomaly branch are independent of each other; the short-term spatiotemporal feature matrix X is... ST The two branches are processed in parallel. The main branch is used to extract the long-term evolution features Fn of the normal communication behavior of the device. The abnormal branch combines the abnormal mask M with weak supervision information at the input end and uses the self-attention mechanism to extract the mutation features Fa of the abnormal communication behavior of the device.

[0084] S4: Feature fusion and anomaly detection. The long-term evolution feature Fn and the mutation feature Fa are concatenated and dimensionality reduced through linear transformation to obtain the comprehensive behavioral representation F. The comprehensive behavioral representation F is then input into a binary classifier to calculate the anomaly confidence of the target device node at the current time. ;

[0085] S5: Optimization of Result Output and Feedback, based on the aforementioned anomaly confidence level. The comparison result with a preset threshold determines whether the device is abnormal and outputs the determination result; simultaneously, based on the abnormality confidence level... A weakly supervised feedback loop is constructed to iteratively update the anomaly mask M.

[0086] Furthermore, the dynamic SIoT device relationship graph sequence G={G1,G2,…,Gt}, at each time step of the graph sequence... Device nodes are defined as nodes. ;

[0087] Connecting devices and edge Defined as the core collaborative communication behavior that occurs between devices in the past T hours, core collaborative communication includes at least data communication, service invocation, proximity discovery and control command interaction;

[0088] This edge definition mechanism ensures that the graph structure fully covers the key communication relationships between devices, reflecting the dynamic topology of SIoT relationships. To capture the dynamic evolution of device communication behavior, the graph structure is updated in real time using an hourly sliding window. This mechanism ensures that the graph sequence reflects the real-time communication status in the SIoT system by continuously incorporating the latest communication data and removing expired information from T hours ago.

[0089] Adjacency Matrix As a mathematical representation of the SIot topology at time step t, its weights reflect the total number or intensity of communications within hour T. To accommodate subsequent graph convolution operations, this matrix will be symmetrically normalized. .

[0090] This invention selects a series of indicators that are independent of data content and have strong discriminative power as device node features to improve robustness to non-content-driven abnormal behaviors.

[0091] The node feature matrix The node feature matrix includes at least the total number of communications, communication time entropy, communication object diversity, and network address change count.

[0092] The number of communications (Activity Count) is used to reflect the activity level of the device. Abnormally high or low frequencies may be the baseline signal of malicious nodes.

[0093] The time entropy ( This is used to reflect the distribution regularity of communication in the time dimension. Low time entropy suggests automated scripts, periodic tasks, or abnormal communication patterns.

[0094] The diversity of communication objects ( This is used to characterize the breadth of the device collaboration range; excessively low diversity may be a signal of a concentrated attack link or a fake node cluster.

[0095] The address change count ( For the security of associated devices, frequent address changes may indicate spoofed devices, proxy switching, or abnormal connections;

[0096] By using structural indicators to abstract abnormal signals into the non-randomness of communication patterns and the non-natural concentration of device relationships, the spatiotemporal abrupt changes formed by this feature under a T-hour sliding window are key discriminative information for distinguishing normal device baselines from malicious device behavior.

[0097] Furthermore, the ST-GCN module is used to process dynamic graph sequences. By using spatiotemporal convolutional layer operations, the evolutionary patterns of local cooperative communication between devices are accurately captured, and features that integrate local topological structure and short-term temporal evolution information are output. ;

[0098] The spatial graph convolutional layer, also known as SGC, performs SGC at each time step. The above is executed to aggregate the neighborhood features of nodes, thereby capturing local structural signals of the abnormal communication propagation graph;

[0099] The SGC operation can be formalized as follows:

[0100] (1)

[0101] in, ; It is a normalized adjacency matrix; It is a trainable weight matrix;

[0102] SGC can effectively utilize social topology information to enhance node representation;

[0103] After the SGC operation, a dilated causal convolutional layer is connected;

[0104] The dilated causal convolutional layer is called DCCM. DCCM is used to solve the problem of capturing temporal dependencies across different time scales in social behavior. DCCM adopts a dilation rate that increases exponentially with the number of network layers to expand the receptive field of the time dimension without increasing the number of computational parameters.

[0105] The evolution of anomalous behavior often spans complex time periods. Traditional convolutions require deep stacking to model long-range dependencies, resulting in high computational resource consumption. DCCM addresses this challenge through the following mechanism: Causality: Strictly guaranteeing the current time step... The output depends only on the current and past input sequences, maintaining the strict causal relationship of time series analysis. Dilated Rate: DCCM employs an exponentially increasing dilation rate. It samples the input sequence in a skip-segment manner. This mechanism increases the model's receptive field ( It can achieve exponential growth, thus efficiently capturing behavioral dependencies at different time scales without increasing computational load or the number of model parameters. By stacking multiple spatiotemporal convolutional blocks, ST-GCN ultimately outputs a short-term spatiotemporal feature matrix. This matrix integrates local spatial interaction and short-term temporal evolution characteristics, providing high-quality input for subsequent two-stream Transformers.

[0106] Furthermore, the dual-stream Transformer architecture solves the technical problem that a single model cannot simultaneously possess stability and sensitivity to sparse anomalous signals by decoupling the long-term evolution of normal communication behavior from the instantaneous mutation of abnormal communication behavior.

[0107] In SIoT, communication data from anomalous devices is typically extremely sparse. If a single model with shared parameters is used, the parameters will be dominated by a large amount of normal data, causing the model to ignore sparse but critical anomalous signals.

[0108] This invention constructs the main branch and the exception branch by using two Transformer encoders with identical structures but independent parameters;

[0109] The mainstream branches The model parameters Θn are used to learn the long-term evolutionary patterns of normal communication behavior;

[0110] The abnormal branch The model parameter Θa is used to learn rare, high-amplitude anomalous communication behavior mutation features;

[0111] The decoupling of the two parameters Θn and Θa ensures that the two branches can be optimized independently, enabling the simultaneous capture of long-term stable modes and transiently sensitive mutations.

[0112] Main branches and abnormal branches Both branches use the short-term spatiotemporal features output by ST-GCN. As basic input;

[0113] Main branches Using a standard self-attention mechanism, stacking Layered Transformer structure, used to extract from Extracting long-term evolutionary features of device communication behavior. Self-attention mechanisms can calculate The dependency weights between all time steps in the sequence are used to capture the rhythm and periodicity of device communication behavior, effectively establishing a normal baseline for user behavior;

[0114] The extraction of this data provides a reliable benchmark for judging abnormal behavior;

[0115] (2)

[0116] Exceptional branches Transient mutation features used to learn anomalous communication behavior ;

[0117] Use exception branches The input is enhanced, thereby solving the problem of weakly supervised modeling with sparse anomaly labels;

[0118] Exceptional branches The input is With anomaly mask The fusion representation;

[0119] As an external guiding signal, explicitly guide By focusing attention on spatiotemporal regions where anomalies may occur, the model's sensitivity to sparse anomalous signals can be improved.

[0120] (3)

[0121] in, Concatenate strings.

[0122] Furthermore, S4 includes at least the following steps:

[0123] Will and Perform splicing operation ;

[0124] Subsequently, through a linear transformation layer... Perform feature dimensionality reduction to obtain a dimension of Comprehensive behavioral representation This dimensionality reduction operation aims to retain core discriminative information while removing redundant features, simplifying subsequent calculations, and helping to improve the model's generalization ability.

[0125] Comprehensive behavioral representation The input is fed into a binary classifier consisting of a multilayer perceptron (MLP) and a sigmoid activation function.

[0126] (4)

[0127] The classifier calculates the anomaly confidence score for each device node. ;

[0128] Anomaly detection is performed by pre-setting a reasonable threshold. If the calculated anomaly confidence level satisfies If so, the device node is determined to be abnormal;

[0129] Optimize output and feedback based on the anomaly confidence level. The comparison result with a preset threshold determines whether the device is abnormal and outputs the determination result; simultaneously, based on the abnormality confidence level... A weakly supervised feedback loop is constructed to iteratively update the anomaly mask M.

[0130] Furthermore, the output of the result in S5 is a fine-grained category output. To enhance the interpretability of the model, the output layer of the multilayer perceptron (MLP) is designed to output anomaly categories simultaneously. The anomaly categories include at least malicious control devices, forged devices, abnormal data injection sources, and abnormal communication robot devices, thus meeting the requirements of SIoT security risk control.

[0131] Furthermore, the iterative update of the anomaly mask M includes at least the following steps:

[0132] A multi-round iterative weakly supervised process is adopted, which is achieved by combining normal pattern regression loss and weighted anomaly classification loss;

[0133] loss function Combined with normal pattern regression loss Weighted anomaly classification loss :

[0134] (5)

[0135] Normal pattern regression loss Used for mainstream branches The output, through encouragement Accurately predict the features of the next time step to ensure Stable learning of long-term communication evolution patterns;

[0136] Weighted anomaly classification loss Used for final anomaly confidence And based on the anomaly mask Weighting;

[0137] for Sparse outlier samples, loss weights Increase the size of the model, forcing it to pay close attention to mutation features;

[0138] Meanwhile, the FocalLoss mechanism is adopted to further mitigate the impact of extreme class imbalance;

[0139] The training iteration process is as follows:

[0140] First, initialize based on a small number of hard tags. The hard tags include at least historical abnormal device records and malicious control event logs;

[0141] Then train the model, and then use the current model's prediction results on unlabeled data (based on...). Strategy) Dynamically updated pseudo-tags in;

[0142] Specifically, confidence level is used The prediction results are used to iteratively generate pseudo-labels for updating... This iterative strategy will identify those elements located near the decision boundary (where the model is uncertain) or those judged as normal with high confidence (e.g., ...). Samples from the main branch were included in the training set. This stabilized the mainstream branch. The baseline of normal communication behavior also forces abnormal branches. By learning boundary mutation features, adaptive enhancement of the model under weak supervision is achieved.

[0143] This process is repeated until the model converges, thereby enabling the model to self-enhance in real-world SIoT scenarios where abnormal labels are scarce.

[0144] In summary:

[0145] The problem this invention aims to solve is the lack of solutions in current technologies for weakly supervised modeling under conditions of scarce anomaly labels and the failure to simultaneously model the long-term behavioral evolution of normal devices and the sudden behavioral characteristics of anomalous devices. This invention employs a method combining ST-GCN and a dual-stream Transformer for anomaly device behavior detection in Social Internet of Things (SIoT). This method does not rely on the content transmitted by devices; it achieves high-precision and interpretable anomaly device detection, malicious command propagation identification, and forged node discovery solely through the structure of the inter-device collaborative communication relationship graph and the temporal data of device behavior. It is applicable to scenarios such as cross-domain SIoT security risk control and malicious data injection intervention.

[0146] The technical solution adopted by this invention to solve its technical problem is as follows: First, a dynamic social Internet of Things (SIoT) device relationship graph is constructed to accurately depict the real-time collaborative communication relationships in the SIoT system. Each device in the SIoT is defined as a node in the graph, and the core interactive behaviors that occur between devices in the past T hours, such as collaborative communication, data exchange, proximity discovery, and service calls, are defined as edges connecting the nodes, ensuring that the graph structure can fully cover the key relationships between devices. Node features are selected from highly discriminative indicators such as communication frequency, time entropy, communication object diversity, and network address change count. Among them, the communication frequency directly reflects the activity level of the device, time entropy reflects the regularity of device communication in time distribution, communication object diversity characterizes the breadth of device collaborative relationships, and address change count is associated with the security and authenticity of the device. To capture the dynamic evolution characteristics of device behavior over time, the graph structure is updated in real time using an hourly sliding window. By continuously incorporating the latest communication data and removing expired information, a dynamic graph sequence G={G1,G2,...,GT} containing T time steps is finally formed, providing basic data support for subsequent spatiotemporal feature extraction that fits the actual scenario.

[0147] For dynamic graph sequences G, this invention extracts local spatiotemporal features using a spatiotemporal graph convolutional network (ST-GCN) to accurately capture the evolutionary patterns of local cooperative communication between devices. For each time step graph Gt in the graph sequence, spatial graph convolution is first performed. After spatial convolution, a dilated causal convolution module is connected. This convolution method can achieve exponential growth of the receptive field without increasing computational cost, thereby efficiently capturing communication dependencies at different time scales. Finally, a short-term spatiotemporal feature matrix XST, which integrates local spatial cooperative relationships and short-term temporal evolution features, is output. The short-term spatiotemporal feature XST output by the spatiotemporal graph convolutional network is used as the input to the mainstream branch of the two-stream Transformer. A standard self-attention mechanism is adopted, and an L-layer Transformer structure is stacked to extract the long-term evolutionary features Fn of normal device communication behavior. The input to the abnormal branch is XST and an anomaly mask M (generated from historical abnormal device records and malicious command events; when there are no labels, pseudo-labels can be generated iteratively using prediction results with confidence <0.5). The structure is the same as the mainstream but the parameters are independent, and it is specifically designed to learn the mutation features Fa of abnormal communication behavior.

[0148] The normal behavior features Fn and abnormal behavior features Fa output by the dual-stream Transformer are concatenated to integrate the key information of the two types of features. Then, a linear transformation is used to reduce the dimensionality of the features, which preserves the core discriminative information and simplifies subsequent calculations, finally obtaining a comprehensive behavior representation F with dimension ℝ^(N×d'). F is input into a binary classifier (MLP+Sigmoid) to calculate the anomaly confidence ŷ for each user account, and a reasonable threshold θ is set. If ŷ>θ, it is judged as an anomaly, and the anomaly category is output (e.g., malicious control node / forged device / abnormal data injection source / abnormal communication robot device).

[0149] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the invention can be implemented in other specific forms without departing from its spirit or essential characteristics. Therefore, the embodiments should be considered in all respects as exemplary and non-limiting, and the scope of the invention is defined by the appended claims rather than the foregoing description. Thus, all variations falling within the meaning and scope of equivalents of the claims are intended to be included within the present invention. No reference numerals in the claims should be construed as limiting the scope of the claims.

Claims

1. A method for detecting abnormal behavior of SIoT nodes based on a spatiotemporal dual-stream model, characterized in that: At least the following steps are included: S1: Construct a dynamic SIoT device relationship graph sequence. A dynamic SIoT device relationship graph sequence G is constructed in real-time using an hourly sliding window mechanism. Device nodes in the SIoT network are defined as nodes in the graph, and core collaborative communication behaviors within a preset time window are defined as edges. A multi-dimensional node feature vector is selected for each device node. ; S2: Local spatiotemporal feature extraction. The dynamic SIoT device relationship graph sequence G is input into a spatiotemporal graph convolutional network module, namely the ST-GCN module. The ST-GCN module combines spatial graph convolutional layers and dilated causal convolutional layers to capture the local spatial associations and short-term temporal dependencies between device nodes, respectively, and outputs a short-term spatiotemporal feature matrix X. ST ; S3: Simultaneous modeling with a dual-stream Transformer, constructing a dual-stream Transformer architecture including a mainstream branch and an anomaly branch, wherein the model parameters Θn of the mainstream branch and the model parameters Θa of the anomaly branch are independent of each other; the short-term spatiotemporal feature matrix X is... ST The two branches are processed in parallel; the main branch is used to extract the long-term evolutionary features Fn of the device's normal communication behavior. The abnormal branch combines an abnormal mask M with weakly supervised information at the input end and uses a self-attention mechanism to extract the mutation features Fa of abnormal communication behavior of the device. S4: Feature fusion and anomaly detection. The long-term evolution feature Fn and the mutation feature Fa are concatenated and dimensionality reduced through linear transformation to obtain the comprehensive behavioral representation F. The comprehensive behavioral representation F is then input into a binary classifier to calculate the anomaly confidence of the target device node at the current time. ; S5: Optimization of Result Output and Feedback, based on the aforementioned anomaly confidence level. The comparison result with a preset threshold determines whether the device is abnormal and outputs the determination result; simultaneously, based on the abnormality confidence level... A weakly supervised feedback loop is constructed to iteratively update the anomaly mask M.

2. The SIoT node abnormal behavior detection method based on a spatiotemporal dual-stream model according to claim 1, characterized in that: The dynamic SIoT device relationship graph sequence G={G1,G2,…,Gt}, at each time step of the graph sequence... Device nodes are defined as nodes. ; Connecting devices and edge Defined as the core collaborative communication behavior that occurs between devices in the past T hours, core collaborative communication includes at least data communication, service invocation, proximity discovery and control command interaction; The node feature matrix The node feature matrix includes at least the total number of communications, communication time entropy, communication object diversity, and network address change count. The number of communications is used to reflect the activity level of the device. Abnormally high or low frequencies may be the baseline signal of malicious nodes. The time entropy is used to reflect the distribution regularity of communication in the time dimension. Low time entropy suggests automated scripts, periodic tasks, or abnormal communication patterns. The diversity of communication objects is used to characterize the breadth of the scope of device collaboration. Too low diversity may be a signal of concentrated attack links or fake node clusters. The address change count is used to associate the security of the device; frequent address changes may indicate a spoofed device, proxy switching, or abnormal connection.

3. The SIoT node abnormal behavior detection method based on a spatiotemporal dual-stream model according to claim 2, characterized in that: The ST-GCN module is used to process dynamic graph sequences. By using spatiotemporal convolutional layer operations, the evolutionary patterns of local cooperative communication between devices are accurately captured, and features that integrate local topological structure and short-term temporal evolution information are output. ; The spatial graph convolutional layer, also known as SGC, performs SGC at each time step. The above is executed to aggregate the neighborhood features of nodes, thereby capturing local structural signals of the abnormal communication propagation graph; The SGC operation can be formalized as follows: (1) in, ; It is a normalized adjacency matrix; It is a trainable weight matrix; SGC can effectively utilize social topology information to enhance node representation; After the SGC operation, a dilated causal convolutional layer is connected; The dilated causal convolutional layer, or DCCM, is used to solve the problem of capturing temporal dependencies across different time scales in social behavior. The DCCM adopts a dilation rate that increases exponentially with the number of network layers.

4. The SIoT node abnormal behavior detection method based on a spatiotemporal dual-stream model according to claim 3, characterized in that: The dual-stream Transformer architecture decouples the long-term evolution of normal communication behavior from the instantaneous mutation of abnormal communication behavior in its modeling. Main branches and exception branches are built by using two Transformer encoders with the same structure but independent parameters; The mainstream branches The model parameters Θn are used to learn the long-term evolutionary patterns of normal communication behavior; The abnormal branch The model parameter Θa is used to learn rare, high-amplitude anomalous communication behavior mutation features; The decoupling of the two parameters Θn and Θa ensures that the two branches can be optimized independently, enabling the simultaneous capture of long-term stable modes and transiently sensitive mutations. Main branches and abnormal branches Both branches use the short-term spatiotemporal features output by ST-GCN. As basic input; Main branches Using a standard self-attention mechanism, stacking Layered Transformer structure, used to extract from Extracting long-term evolutionary features of device communication behavior. Self-attention mechanisms can calculate The dependency weights between all time steps in the sequence are used to capture the rhythm and periodicity of device communication behavior, effectively establishing a normal baseline for user behavior; The extraction of this data provides a reliable benchmark for judging abnormal behavior; (2) Exceptional branches Transient mutation features used to learn anomalous communication behavior ; Use exception branches The input is enhanced; Exceptional branches The input is With anomaly mask The fusion representation; As an external guiding signal, explicitly guide By focusing attention on spatiotemporal regions where anomalies may occur, the model's sensitivity to sparse anomalous signals can be improved. (3) in, Concatenate strings.

5. The SIoT node abnormal behavior detection method based on a spatiotemporal dual-stream model according to claim 4, characterized in that: The S4 includes at least the following steps: Will and Perform splicing operation ; Subsequently, through a linear transformation layer... Perform feature dimensionality reduction to obtain a dimension of Comprehensive behavioral representation ; Comprehensive behavioral representation The input is fed into a binary classifier consisting of a multilayer perceptron (MLP) and a sigmoid activation function. (4) The classifier calculates the anomaly confidence score for each device node. ; Anomaly detection is performed by pre-setting a reasonable threshold. If the calculated anomaly confidence level satisfies If so, the device node is determined to be abnormal; Optimize output and feedback based on the anomaly confidence level. The comparison result with a preset threshold determines whether the device is abnormal and outputs the determination result; simultaneously, based on the abnormality confidence level... A weakly supervised feedback loop is constructed to iteratively update the anomaly mask M.

6. The SIoT node abnormal behavior detection method based on a spatiotemporal dual-stream model according to claim 5, characterized in that: The output in S5 is a fine-grained category output. To enhance the interpretability of the model, the output layer of the multilayer perceptron (MLP) is designed to output anomaly categories simultaneously. The anomaly categories include at least malicious control devices, forged devices, anomalous data injection sources, and anomalous communication robot devices.

7. The SIoT node abnormal behavior detection method based on a spatiotemporal dual-stream model according to claim 6, characterized in that: The iterative update of the anomaly mask M includes at least the following steps: A multi-round iterative weakly supervised process is adopted, which is achieved by combining normal pattern regression loss and weighted anomaly classification loss; loss function Combined with normal pattern regression loss Weighted anomaly classification loss : (5) Normal pattern regression loss Used for mainstream branches The output, through encouragement Accurately predict the features of the next time step to ensure Stable learning of long-term communication evolution patterns; Weighted anomaly classification loss Used for final anomaly confidence And based on the anomaly mask Weighting; for Sparse outlier samples, loss weights Increase the size of the model, forcing it to pay close attention to mutation features; Meanwhile, the focus loss mechanism was adopted to further mitigate the impact of extreme class imbalance; The training iteration process is as follows: First, initialize based on a small number of hard tags. The hard tags include at least historical abnormal device records and malicious control event logs; Then train the model, and dynamically update it using the current model's predictions on unlabeled data. pseudo-tags in; This process is repeated until the model converges, thereby enabling the model to self-enhance in real-world SIoT scenarios where anomalous labels are scarce.

Images