An internet of things device anomaly detection method and system based on space-time fusion and latent regularization
By constructing a spatiotemporal fusion and potential regularization method for anomaly detection of IoT devices, and using Transformer and graph neural networks to extract features and perform regularization processing, the method solves the problems of insufficient accuracy, scalability and robustness in existing technologies, and achieves efficient anomaly detection of IoT devices.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- HUAZHONG UNIV OF SCI & TECH
- Filing Date
- 2026-04-30
- Publication Date
- 2026-07-31
AI Technical Summary
Existing IoT device identification technologies are inadequate in terms of accuracy, efficiency, scalability, and robustness. They are unable to effectively identify new devices and respond to corrupted network data packets, leading to a decline in identification accuracy.
We adopt a spatiotemporal fusion and latent regularization approach. By constructing an anomaly detection network model that includes a temporal modeling module and a spatial modeling module, we use Transformer and graph neural network to extract features. Combined with latent variable predictor and KL divergence constraint, we perform feature regularization and contrastive learning to achieve unified alignment of temporal and spatial features and anomaly determination.
It improves the accuracy and robustness of anomaly detection for IoT devices, effectively identifies abnormal device behavior in complex scenarios, adapts to dynamic changes in multi-sensor correlations, and enhances the ability to identify long-term dependencies and gradual anomaly patterns.
Smart Images
Figure CN122496445A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of Internet of Things (IoT) technology, and in particular to an IoT device anomaly detection method and system based on spatiotemporal fusion and potential regularization. Background Technology
[0002] IoT device identification, which involves passively analyzing network traffic to extract IoT device characteristics and accurately identify the model of IoT devices, is a prerequisite for realizing IoT device management, resource scheduling, and security protection.
[0003] The shortcomings of existing IoT device identification technologies are mainly reflected in three aspects. First, they cannot balance accuracy and efficiency. To ensure high identification accuracy, existing technologies often use complex statistical features, performing statistical analysis on all data packets within a fixed time window, resulting in significant computational overhead. Some technologies use lightweight features to improve identification efficiency, but the identification accuracy drops significantly. Second, existing technologies lack scalability, performing poorly in scenarios where new IoT devices are continuously added. As new devices are added, the identification model suffers from forgetting, failing to identify previously recognized devices. Third, existing technologies lack robustness. Due to network issues, the network may capture some corrupted data packets, leading to a decrease in the identification accuracy of existing technologies. Therefore, there is an urgent need for an IoT device identification method that balances accuracy and efficiency, and possesses scalability and robustness. Summary of the Invention
[0004] This invention addresses the technical problems existing in the prior art by providing an IoT device anomaly detection method and system based on spatiotemporal fusion and potential regularization. This method can improve the accuracy and robustness of IoT multivariate time series anomaly detection and enable effective identification of abnormal device behavior in complex IoT scenarios.
[0005] According to a first aspect of the present invention, an anomaly detection method for Internet of Things (IoT) devices based on spatiotemporal fusion and potential regularization is provided, comprising: Step 1: Obtain multivariate time series data generated by multiple sensors in the IoT system, and construct an anomaly detection network model that includes a time modeling module and a spatial modeling module; Step 2: Based on the time modeling module, feature extraction is performed on the time series data to obtain a time feature representation. Based on the time feature representation, the posterior and prior distributions of the latent variables are established. Based on the posterior and prior distributions, the KL divergence is calculated to perform regularization processing on the time feature representation. Step 3: Map each sensor in the time series data as a graph node, calculate the similarity between nodes based on the time series features, generate a dynamic graph structure through the Gumbel-Softmax mechanism, calculate the structural coefficients of the graph structure to weight the message passing between nodes, and obtain a spatial feature representation. Step 4: The temporal feature representation and the spatial feature representation are fused to obtain a fused feature representation. The goal is to align the temporal and spatial features in a unified latent space. The fused feature representation is constrained by a contrastive learning method to obtain an optimized fused feature representation. Step 5: Reconstruct the time series based on the optimized fused feature representation, calculate the reconstruction error and combine it with attention weights to obtain anomaly scores, process the anomaly scores using dynamic statistical methods and complete the anomaly determination.
[0006] Based on the above technical solution, the present invention can also be improved as follows.
[0007] Optionally, after obtaining the time series data in step 1, the time series data is normalized and missing values are filled, and the time series is divided into time window samples of fixed length.
[0008] Optionally, the input parameters of the anomaly detection network model are set according to the length of the time series, the feature dimension, and the window size; The time modeling module is built based on the Transformer structure and is used to extract time-dependent features; the spatial modeling module is built based on the graph neural network structure and is used to model the correlation between sensors. After constructing the anomaly detection network model, the method further includes: initializing the parameters of the anomaly detection network model and setting the hyperparameters of the anomaly detection network model; the hyperparameters include: the dimension of latent variables, the number of attention heads, and the dimension of hidden layers.
[0009] Optionally, in step 2, the posterior distribution of the latent variables is constructed using a latent variable predictor. With prior distribution Both the posterior and prior distributions follow a Gaussian distribution: in, Denotes the posterior probability distribution function. Denotes the prior probability distribution function. Indicates time The corresponding latent variables, Indicates time Previous sequence of latent variables, Indicates time The time characteristics are represented, Indicates a Gaussian distribution. Let represent the mean of the posterior distribution. This represents the variance of the posterior distribution. This represents the mean of the prior distribution. This represents the variance of the prior distribution. Indicates a time step.
[0010] Optionally, in step 2, the formula for calculating the KL divergence based on the posterior and prior distributions is as follows: in, This represents the KL divergence between the posterior and prior distributions. The KL divergence is used as a regularization constraint to represent the time features. Perform regularization processing.
[0011] Optionally, step 3 includes: Step 301: Map each sensor in the time series data to a graph node, and calculate the similarity between any two nodes based on the time series features: in, Indicates the first Time series feature mean vector of each sensor This represents the vector dot product operation. The norm of a vector; Step 302: Construct edge connection probabilities based on the similarity, and sample the edges using the Gumble-Softmax mechanism to generate the adjacency matrix of the graph. The existence probability of any i-th edge obtained by Gumbel-Softmax sampling Represented as: in, Represents class probability, This represents noise sampled from the Gumbel distribution. Indicates temperature parameter; Step 303, based on the adjacency matrix Constructing the neighbor mask matrix And calculate the number of common neighbors between any two nodes; in, Represents the identity matrix. Represents a node With nodes The number of common neighbors; Representing the neighbor mask matrix respectively The elements in the i-th row and k-th column and the j-th row and k-th column; Step 304: Calculate the structural importance coefficient for measuring the connections between nodes based on the number of common neighbors. in, Represents a node With nodes The structural coefficients between them This represents the maximum number of common neighbors among all node pairs. To adjust the parameters; Step 305: Based on the structural coefficients, the message passing between nodes is weighted to obtain the spatial feature representation of the nodes as follows: in, Represents a node The updated spatial feature representation, Represents a node The set of neighboring nodes, This represents the learnable weight matrix.
[0012] Optionally, step 4 includes: Step 401, representing the time features and the spatial feature representation Perform a concatenation operation to obtain the fused feature representation; Step 402, based on the time feature representation Spatial feature representation Construct positive and negative sample pairs, where within the same time window... Constructing positive samples, between different time windows Forming negative sample pairs; Step 403, construct the contrastive learning objective function based on the positive sample pairs and negative sample pairs as follows: in, Indicates batch size. Represents the similarity function. Indicates the temperature coefficient; Step 404: With the goal of making the temporal and spatial features of the same time window close to each other in the latent space and separating the feature representations of different samples, the fused feature representation is optimized using the contrastive learning objective function to obtain the optimized fused feature representation. .
[0013] Optionally, step 5 includes: Step 501, based on the optimized fused feature representation The input time series is reconstructed to obtain the reconstructed sequence. Calculate the original sequence With reconstruction sequence The reconstruction error between them is: in, Represents the Euclidean norm; Step 502: Calculate the attention contribution of the sub-neighborhood based on the attention matrix in the time modeling module. And calculate the initial anomaly score based on the reconstruction error: in, Indicates time The initial anomaly score, This represents element-wise multiplication. Step 503: Perform statistical modeling on the initial anomaly score based on a sliding time window, and calculate the current time. mean with standard deviation The initial anomaly score is then normalized. in, This represents the standardized outlier score. The cumulative distribution function representing the standard normal distribution; Step 504, when If the value exceeds the preset threshold, it is considered abnormal; otherwise, it is considered normal.
[0014] According to a second aspect of the present invention, an anomaly detection system for Internet of Things (IoT) devices based on spatiotemporal fusion and potential regularization is provided, comprising: an anomaly detection network model construction module, a temporal feature representation generation module, a spatial feature representation generation module, a fusion feature representation generation module, and an anomaly determination module; The anomaly detection network model construction module is used to acquire multivariate time series data generated by multiple sensors in the Internet of Things system and construct an anomaly detection network model that includes a time modeling module and a spatial modeling module. The time feature representation generation module is used to extract features from the time series data based on the time modeling module to obtain a time feature representation, establish the posterior and prior distributions of the latent variables based on the time feature representation, and calculate the KL divergence based on the posterior and prior distributions to perform regularization processing on the time feature representation; The heterospatial feature representation generation module is used to map each sensor in the time series data as a graph node, calculate the similarity between nodes according to the time series features, generate a dynamic graph structure through the Gumbel-Softmax mechanism, calculate the structural coefficient of the graph structure to weight the message passing between nodes, and obtain the spatial feature representation. The fusion feature representation generation module is used to fuse the temporal feature representation and the spatial feature representation to obtain a fusion feature representation, with the goal of aligning the temporal and spatial features in a unified latent space. The fusion feature representation is constrained by a contrastive learning method to obtain an optimized fusion feature representation. The anomaly detection module is used to reconstruct the time series based on the optimized fused feature representation, calculate the reconstruction error and obtain an anomaly score by combining the attention weight, process the anomaly score using dynamic statistical methods and complete the anomaly detection.
[0015] This invention provides an IoT device anomaly detection method and system based on spatiotemporal fusion and latent regularization. Addressing the insufficient long-term dependency modeling capabilities in existing technologies, this invention constructs a Transformer-based temporal modeling module and introduces a latent variable predictor and KL divergence constraints to regularize temporal features, improving the ability to identify gradual and long-term anomaly patterns. Addressing the insufficient characterization of multi-sensor relationships in existing technologies, this invention constructs an adaptive graph embedding module to dynamically learn the relationships between sensors and combines structural coefficients to weight the message passing process, improving the detection capability of associated anomalies. Addressing the insufficient spatiotemporal feature fusion capabilities in existing technologies, this invention fuses temporal and spatial features and uses contrastive learning to achieve feature alignment in a unified latent space, improving the accuracy and robustness of anomaly detection. Attached Figure Description
[0016] Figure 1 This is an overall flowchart of an embodiment of an IoT device anomaly detection method based on spatiotemporal fusion and potential regularization provided by the present invention. Figure 2 This is a comparison chart of the anomaly detection performance of the IoT device anomaly detection method provided by this invention and existing technologies on the SWAT, WADI, PSM, MSL and SMAP datasets; Figure 3(a) is a comparison of the anomaly detection performance of the model after removing the spatial graph module and the complete model on the SWAT, WADI, PSM, MSL and SMAP datasets in the embodiment of the present invention. Figure 3(b) is a comparison of the anomaly detection performance of the model after removing the latent variable predictor and the complete model on the SWAT, WADI, PSM, MSL and SMAP datasets in the embodiment of the present invention. Figure 3(c) is a comparison of the anomaly detection performance of the model after removing the structural coefficients and the complete model on the SWAT, WADI, PSM, MSL and SMAP datasets in the embodiment of the present invention. Figure 4 This is a schematic diagram of the anomaly detection results in an embodiment of the present invention; Figure 5 This is a schematic diagram showing the structural changes of the sensor correlation diagram under normal and abnormal states in an embodiment of the present invention. Detailed Implementation
[0017] The principles and features of the present invention are described below with reference to the accompanying drawings. The examples given are only for explaining the present invention and are not intended to limit the scope of the present invention.
[0018] The technical terminology of this invention will be explained and described below: IoT device anomaly detection: refers to the technical process in IoT systems that identifies and judges whether a device has an abnormal state, fault behavior, attack behavior, or abnormal operating trend based on multivariate time series data generated during device operation. Its core objective is to achieve real-time monitoring, anomaly warning, and security protection of IoT device operating status.
[0019] Multivariate time series data refers to a collection of data collected from multiple sensors, actuators, or monitoring variables over a continuous time dimension. The data at each moment is composed of multiple variables and is used to reflect the overall operating status of the Internet of Things system at that moment.
[0020] The time modeling module refers to a functional module that models the changing patterns of multivariate time series over time, used to extract time dependencies, long-term trends, and local dynamic features. In this invention, the time modeling module is preferably implemented using a Transformer-based network structure.
[0021] Spatial modeling module: This refers to a functional module that models the correlations between different variables in a multivariate time series, used to characterize the correlations, coupling relationships, and structural changes among multiple sensors. In this invention, the spatial modeling module is optimized using an adaptive graph embedding and structure-aware message passing mechanism.
[0022] Latent variable predictor: This refers to the latent space modeling module set after the time modeling module. It is used to establish the posterior and prior distributions of latent variables based on the temporal feature representation, and to achieve temporal consistency modeling of the latent space through distribution constraints, so as to enhance the model's ability to represent anomalous time patterns.
[0023] Dynamic graph structure: refers to a graph structure that is dynamically generated based on the real-time correlation between variables in the input sample. Graph nodes represent sensors or variables, and graph edges represent the correlation between variables. Compared with predefined static graph structures, dynamic graph structures can more accurately reflect the dynamic changes in sensor relationships.
[0024] Structural coefficient: refers to the connection weight calculated based on the number of common neighbors between two nodes in the graph. It is used to reflect the structural importance of the connection between nodes and to weight neighboring nodes during message passing in order to enhance critical connections and suppress noisy connections.
[0025] Spatiotemporal contrastive learning refers to a learning mechanism that maps temporal and spatial feature representations to a unified latent space and constructs positive and negative sample pairs to ensure that the temporal and spatial features of the same sample remain consistent and the features of different samples remain distinguishable. This mechanism is used to improve the representational ability of spatiotemporal fusion features.
[0026] Anomaly score: This refers to a numerical indicator used to characterize the degree to which input data deviates from the normal pattern at a certain moment. The higher the score, the greater the probability of an anomaly occurring at that moment. In this invention, the anomaly score is determined jointly by reconstruction error, attention contribution, and dynamic statistical scoring.
[0027] Figure 1 This is an overall flowchart of an embodiment of an IoT device anomaly detection method based on spatiotemporal fusion and potential regularization provided by the present invention, as shown below. Figure 1 As shown, the method includes: Step 1, acquiring multivariate time series data generated by multiple sensors in the Internet of Things system, and constructing an anomaly detection network model that includes a time modeling module and a spatial modeling module.
[0028] Step 2: Based on the time modeling module, feature extraction is performed on the time series data to obtain time feature representation. Based on the time feature representation, the posterior and prior distributions of the latent variables are established. Based on the posterior and prior distributions, the KL (Kullback-Leibler) divergence is calculated to perform regularization processing on the time feature representation.
[0029] Step 3: Map each sensor in the time series data to a graph node, calculate the similarity between nodes based on the time series features, and generate a dynamic graph structure through the Gumbel-Softmax mechanism. Calculate the structural coefficients of the graph structure to weight the message passing between nodes, and obtain a spatial feature representation.
[0030] Step 4: The temporal feature representation and the spatial feature representation are fused to obtain the fused feature representation. The goal is to align the temporal and spatial features in a unified latent space. The fused feature representation is constrained by a contrastive learning method to obtain the optimized fused feature representation.
[0031] Step 5: Reconstruct the time series based on the optimized fused feature representation, calculate the reconstruction error and obtain the anomaly score by combining the attention weight, process the anomaly score using dynamic statistical methods and complete the anomaly determination.
[0032] This invention provides an anomaly detection method for IoT devices based on spatiotemporal fusion and latent regularization. It constructs a unified anomaly detection network comprising a temporal modeling module and a spatial modeling module. The temporal modeling module extracts time-dependent features from multivariate time series data and combines this with a latent variable predictor to constrain the latent space. Temporal consistency modeling is achieved using the KL divergence between the posterior and prior distributions, enhancing the model's ability to represent long-term dependencies, gradual anomaly patterns, and potential dynamic changes, thereby improving the identification of anomalous time patterns. This enhances the accuracy and robustness of anomaly detection in multivariate time series data in IoT, enabling effective identification of abnormal device behavior in complex IoT scenarios. Example 1
[0033] Embodiment 1 provided by this invention is an embodiment of an IoT device anomaly detection method based on spatiotemporal fusion and potential regularization provided by this invention, combined with... Figure 1 It can be seen that embodiments of this IoT device anomaly detection method include: Step 1: Obtain multivariate time series data generated by multiple sensors in the IoT system, and construct an anomaly detection network model that includes a time modeling module and a spatial modeling module.
[0034] In one possible embodiment, after obtaining the time series data in step 1, the time series data is normalized and missing values are filled, and the time series is divided into time window samples of fixed length.
[0035] In one possible implementation, the input parameters of the anomaly detection network model are set according to the length of the time series, the feature dimension, and the window size.
[0036] The temporal modeling module is built on a Transformer structure and is used to extract time-dependent features; the spatial modeling module is built on a graph neural network structure and is used to model the correlation between sensors.
[0037] After constructing the anomaly detection network model, the process also includes: initializing the anomaly detection network model parameters and setting the hyperparameters of the anomaly detection network model; the hyperparameters include: the dimension of latent variables, the number of attention heads, and the dimension of hidden layers, etc.
[0038] Step 2: Based on the time modeling module, feature extraction is performed on the time series data to obtain the time feature representation. Based on the time feature representation, the posterior and prior distributions of the latent variables are established. Based on the posterior and prior distributions, the KL divergence is calculated to perform regularization processing on the time feature representation.
[0039] In one possible embodiment, step 2 includes: Step 201: Input the time window samples into the Transformer-based time modeling module to extract time feature representations. It is used to characterize the time dependencies of multivariate time series.
[0040] Step 202, based on the time feature representation Construct the posterior distribution of latent variables using a latent variable predictor. With prior distribution Where both the posterior and prior distributions follow a Gaussian distribution: in, Denotes the posterior probability distribution function. Denotes the prior probability distribution function. Indicates time The corresponding latent variables, Indicates time Previous sequence of latent variables, Indicates time The time characteristics are represented, Indicates a Gaussian distribution. Let represent the mean of the posterior distribution. This represents the variance of the posterior distribution. This represents the mean of the prior distribution. This represents the variance of the prior distribution. Indicates a time step.
[0041] Step 203: Calculate the KL divergence based on the posterior and prior distributions as a regularization constraint term to constrain the latent variables. The calculation formula is as follows: in, This represents the Kullback-Leibler divergence between the posterior and prior distributions.
[0042] Step 204: Use the KL divergence constraint term to analyze the time features. Regularization is performed to ensure the continuity and consistency of latent variables over time, thereby enhancing the model's ability to distinguish abnormal time patterns.
[0043] Step 3: Map each sensor in the time series data to a graph node, calculate the similarity between nodes based on the time series features, and generate a dynamic graph structure through the Gumbel-Softmax mechanism. Calculate the structural coefficients of the graph structure to weight the message passing between nodes, and obtain a spatial feature representation.
[0044] In one possible embodiment, step 3 includes: Step 301: Map each sensor in the time series data to a graph node, and calculate the similarity between any two nodes based on the time series features. The similarity is expressed using cosine similarity: in, Indicates the first Time series feature mean vector of each sensor This represents the vector dot product operation. The norm of a vector.
[0045] Step 302: Construct edge connection probabilities based on similarity, and sample edges using the Gumble-Softmax mechanism to generate the adjacency matrix of the graph. The existence probability of any i-th edge obtained by Gumbel-Softmax sampling Represented as: in, Represents class probability, This represents noise sampled from the Gumbel distribution. This represents the temperature parameter.
[0046] Step 303, based on the adjacency matrix Constructing the neighbor mask matrix And calculate the number of common neighbors between any two nodes.
[0047] in, Represents the identity matrix. Represents a node With nodes The number of common neighbors; Representing the neighbor mask matrix respectively The elements in the i-th row and k-th column and the j-th row and k-th column.
[0048] Step 304: Calculate the structural importance coefficient for measuring the connections between nodes based on the number of common neighbors. The expression is as follows: in, Represents a node With nodes The structural coefficients between them This represents the maximum number of common neighbors among all node pairs. To adjust the parameters.
[0049] Step 305: Weight the message passing between nodes based on the structural coefficients to obtain the spatial feature representation of the nodes. The calculation formula is as follows: in, Represents a node The updated spatial feature representation, Represents a node The set of neighboring nodes, This represents the learnable weight matrix.
[0050] Step 4: The temporal feature representation and the spatial feature representation are fused to obtain the fused feature representation. The goal is to align the temporal and spatial features in a unified latent space. The fused feature representation is constrained by a contrastive learning method to obtain the optimized fused feature representation.
[0051] In one possible embodiment, step 4 includes: Step 401, representing the time features and spatial feature representation Perform a splicing operation to obtain the fused feature representation.
[0052] Step 402, based on time feature representation Spatial feature representation Construct positive and negative sample pairs, where within the same time window... Constructing positive samples, between different time windows This forms a negative sample pair.
[0053] Step 403: Construct a contrastive learning objective function based on positive and negative sample pairs, the expression of which is: in, Indicates batch size. Represents the similarity function. This represents the temperature coefficient.
[0054] Step 404 aims to make the temporal and spatial features of the same time window close to each other in the latent space and to separate the feature representations of different samples. The optimized fused feature representation is obtained by using a contrastive learning objective function. This enables spatiotemporal feature alignment.
[0055] Step 5: Reconstruct the time series based on the optimized fused feature representation, calculate the reconstruction error and obtain the anomaly score by combining the attention weight, process the anomaly score using dynamic statistical methods and complete the anomaly determination.
[0056] In one possible embodiment, step 5 includes: Step 501, based on the optimized fused feature representation The input time series is reconstructed to obtain the reconstructed sequence. Calculate the original sequence With reconstruction sequence The reconstruction error between them is: in, This represents the Euclidean norm.
[0057] Step 502: Calculate the attention contribution of the sub-neighborhood based on the attention matrix in the time modeling module. And calculate the initial anomaly score based on the reconstruction error: in, Indicates time The initial anomaly score, This indicates element-wise multiplication.
[0058] Step 503: Perform statistical modeling on the initial anomaly score based on a sliding time window, and calculate the current time. mean with standard deviation The initial anomaly scores were then normalized. in, This represents the standardized outlier score. The cumulative distribution function represents the standard normal distribution.
[0059] Step 504: Standardize the anomaly scores according to the preset threshold. Make a judgment when If the value exceeds the preset threshold, it is considered abnormal; otherwise, it is considered normal. Example 2
[0060] Embodiment 2 of the present invention is an embodiment of an IoT device anomaly detection system based on spatiotemporal fusion and potential regularization. The embodiment of the IoT device anomaly detection system includes: an anomaly detection network model construction module, a temporal feature representation generation module, a spatial feature representation generation module, a fusion feature representation generation module, and an anomaly determination module.
[0061] The anomaly detection network model building module is used to acquire multivariate time series data generated by multiple sensors in the Internet of Things system and build an anomaly detection network model that includes a time modeling module and a spatial modeling module.
[0062] The time feature representation generation module is used to extract features from time series data based on the time modeling module to obtain time feature representations. Based on the time feature representations, the posterior and prior distributions of the latent variables are established. Based on the posterior and prior distributions, the KL divergence is calculated to perform regularization processing on the time feature representations.
[0063] The heterogeneous spatial feature representation generation module is used to map each sensor in the time series data into graph nodes, calculate the similarity between nodes based on the time series features, generate a dynamic graph structure through the Gumbel-Softmax mechanism, calculate the structural coefficients of the graph structure to weight the message passing between nodes, and obtain the spatial feature representation.
[0064] The fusion feature representation generation module is used to fuse temporal and spatial feature representations to obtain a fusion feature representation. The goal is to align temporal and spatial features in a unified latent space. The fusion feature representation is constrained by a contrastive learning method to obtain an optimized fusion feature representation.
[0065] The anomaly detection module is used to reconstruct the time series based on the optimized fused feature representation, calculate the reconstruction error and obtain the anomaly score by combining the attention weight, and use dynamic statistical methods to process the anomaly score and complete the anomaly detection.
[0066] It is understood that the IoT device anomaly detection system based on spatiotemporal fusion and potential regularization provided by the present invention corresponds to the IoT device anomaly detection method based on spatiotemporal fusion and potential regularization provided in the foregoing embodiments. The relevant technical features of the IoT device anomaly detection system based on spatiotemporal fusion and potential regularization can be referred to the relevant technical features of the IoT device anomaly detection method based on spatiotemporal fusion and potential regularization, and will not be repeated here. Example 3
[0067] Embodiment 3 provided by the present invention is a specific application embodiment of the IoT device anomaly detection method based on spatiotemporal fusion and potential regularization provided by the present invention.
[0068] like Figure 2 The figures show a performance comparison of the anomaly detection method for IoT devices based on spatiotemporal fusion and latent regularization provided by this invention with existing technologies on the SWAT, WADI, PSM, MSL, and SMAP datasets, where GALT represents the results of this invention. Figures 3(a)-(c) show the performance comparison results of anomaly detection under different module configurations in this invention. Figure 3(a) shows the performance comparison results with the complete model after removing the spatial graph module; Figure 3(b) shows the performance comparison results with the complete model after removing the latent variable predictor; and Figure 3(c) shows the performance comparison results with the complete model after removing the structural coefficients. Figure 4 The image shown is a schematic diagram of the anomaly detection results in an embodiment of the present invention. Figure 5 The diagram shown is a schematic diagram of the changes in the sensor correlation diagram structure under normal and abnormal states in an embodiment of the present invention. Figures 2-5 This study demonstrates that the proposed method can effectively detect anomalies in multivariate time series data of the Internet of Things (IoT). By employing time modeling, latent regularization, dynamic graph structure learning, structure-aware message passing, and spatiotemporal feature fusion, the method improves the accuracy, robustness, and stability of anomaly detection and is applicable to device status monitoring and anomaly early warning in complex IoT scenarios.
[0069] This invention provides an IoT device anomaly detection method and system based on spatiotemporal fusion and latent regularization. Addressing the insufficient long-term dependency modeling capabilities in existing technologies, this invention constructs a Transformer-based temporal modeling module and introduces a latent variable predictor and KL divergence constraints to regularize temporal features, improving the ability to identify gradual and long-term anomaly patterns. To address the insufficient characterization of multi-sensor relationships in existing technologies, this invention constructs an adaptive graph embedding module to dynamically learn the relationships between sensors and combines structural coefficients to weight the message passing process, improving the detection capability of associated anomalies. Finally, to address the insufficient spatiotemporal feature fusion capabilities in existing technologies, this invention fuses temporal and spatial features and employs contrastive learning to achieve feature alignment in a unified latent space, improving the accuracy and robustness of anomaly detection.
[0070] It should be noted that the descriptions of each embodiment in the above embodiments have different focuses. For parts that are not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.
[0071] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.
[0072] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.
[0073] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.
[0074] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.
[0075] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the invention.
[0076] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.
Claims
1. A method for IoT device anomaly detection based on spatio-temporal fusion and latent regularization, characterized in that, The method for detecting anomalies in IoT devices includes: Step 1: Obtain multivariate time series data generated by multiple sensors in the IoT system, and construct an anomaly detection network model that includes a time modeling module and a spatial modeling module; Step 2: Based on the time modeling module, feature extraction is performed on the time series data to obtain a time feature representation. Based on the time feature representation, the posterior and prior distributions of the latent variables are established. Based on the posterior and prior distributions, the KL divergence is calculated to perform regularization processing on the time feature representation. Step 3: Map each sensor in the time series data as a graph node, calculate the similarity between nodes based on the time series features, generate a dynamic graph structure through the Gumbel-Softmax mechanism, calculate the structural coefficients of the graph structure to weight the message passing between nodes, and obtain a spatial feature representation. Step 4: The temporal feature representation and the spatial feature representation are fused to obtain a fused feature representation. The goal is to align the temporal and spatial features in a unified latent space. The fused feature representation is constrained by a contrastive learning method to obtain an optimized fused feature representation. Step 5: Reconstruct the time series based on the optimized fused feature representation, calculate the reconstruction error and combine it with attention weights to obtain anomaly scores, process the anomaly scores using dynamic statistical methods and complete the anomaly determination. 2.The IoT device anomaly detection method of claim 1, wherein, After obtaining the time series data in step 1, the time series data is normalized and missing values are filled, and the time series is divided into time window samples of fixed length.
3. The method for detecting anomalies in IoT devices according to claim 1, characterized in that, The input parameters of the anomaly detection network model are set according to the length of the time series, the feature dimension, and the window size. The time modeling module is built based on the Transformer structure and is used to extract time-dependent features; the spatial modeling module is built based on the graph neural network structure and is used to model the correlation between sensors. After constructing the anomaly detection network model, the method further includes: initializing the parameters of the anomaly detection network model and setting the hyperparameters of the anomaly detection network model; the hyperparameters include: the dimension of latent variables, the number of attention heads, and the dimension of hidden layers.
4. The method for detecting anomalies in IoT devices according to claim 1, characterized in that, In step 2, the posterior distribution of the latent variables is constructed by a latent variable predictor with the prior distribution The posterior distribution and the prior distribution are both Gaussian distributions: in, Denotes the posterior probability distribution function. Denotes the prior probability distribution function. Indicates time The corresponding latent variables, Indicates time Previous sequence of latent variables, Indicates time The time characteristics are represented, Indicates a Gaussian distribution. Let represent the mean of the posterior distribution. This represents the variance of the posterior distribution. This represents the mean of the prior distribution. This represents the variance of the prior distribution. Indicates a time step.
5. The IoT device anomaly detection method of claim 4, wherein, In step 2, the formula for calculating the KL divergence based on the posterior and prior distributions is as follows: wherein, denotes the KL divergence between the posterior distribution and the prior distribution; using the KL divergence as a regularization constraint term on the temporal feature representation regularization processing.
6. The IoT device anomaly detection method of claim 1, wherein, Step 3 includes: Step 301: Map each sensor in the time series data to a graph node, and calculate the similarity between any two nodes based on the time series features: wherein, denotes the time series feature mean vector of the denotes the vector inner product operation, denotes the norm of a vector; At step 302, an edge connection probability is constructed according to the similarity, and an adjacency matrix of the graph is generated by sampling the edge through a Gumble-Softmax mechanism An existence probability of any ith edge obtained through Gumbel-Softmax sampling is represented as: in, Represents class probability, This represents noise sampled from the Gumbel distribution. Indicates temperature parameter; Step 303, based on the adjacency matrix Constructing the neighbor mask matrix And calculate the number of common neighbors between any two nodes; in, Represents the identity matrix. Represents a node With nodes The number of common neighbors; Representing the neighbor mask matrix respectively The elements in the i-th row and k-th column and the j-th row and k-th column; Step 304: Calculate the structural importance coefficient for measuring the connections between nodes based on the number of common neighbors. in, Represents a node With nodes The structural coefficients between them This represents the maximum number of common neighbors among all node pairs. To adjust the parameters; Step 305: Based on the structural coefficients, the message passing between nodes is weighted to obtain the spatial feature representation of the nodes as follows: in, Represents a node The updated spatial feature representation, Represents a node The set of neighboring nodes, This represents the learnable weight matrix.
7. The method for detecting anomalies in IoT devices according to claim 1, characterized in that, Step 4 includes: Step 401, representing the time features and the spatial feature representation Perform a concatenation operation to obtain the fused feature representation; Step 402, based on the time feature representation Spatial feature representation Construct positive and negative sample pairs, where within the same time window... Constructing positive samples, between different time windows Forming negative sample pairs; Step 403, construct the contrastive learning objective function based on the positive sample pairs and negative sample pairs as follows: in, Indicates batch size. Represents the similarity function. Indicates the temperature coefficient; Step 404: With the goal of making the temporal and spatial features of the same time window close to each other in the latent space and separating the feature representations of different samples, the fused feature representation is optimized using the contrastive learning objective function to obtain the optimized fused feature representation. .
8. The method for detecting anomalies in IoT devices according to claim 1, characterized in that, Step 5 includes: Step 501, based on the optimized fused feature representation The input time series is reconstructed to obtain the reconstructed sequence. Calculate the original sequence With reconstruction sequence The reconstruction error between them is: in, Represents the Euclidean norm; Step 502: Calculate the attention contribution of the sub-neighborhood based on the attention matrix in the time modeling module. And calculate the initial anomaly score based on the reconstruction error: in, Indicates time The initial anomaly score, This represents element-wise multiplication. Step 503: Perform statistical modeling on the initial anomaly score based on a sliding time window, and calculate the current time. mean with standard deviation The initial anomaly score is then normalized. in, This represents the standardized outlier score. The cumulative distribution function representing the standard normal distribution; Step 504, when If the value exceeds the preset threshold, it is considered abnormal; otherwise, it is considered normal.
9. An IoT device anomaly detection system based on spatiotemporal fusion and potential regularization, characterized in that, The IoT device anomaly detection system includes: an anomaly detection network model construction module, a time feature representation generation module, a spatial feature representation generation module, a fusion feature representation generation module, and an anomaly determination module; The anomaly detection network model construction module is used to acquire multivariate time series data generated by multiple sensors in the Internet of Things system and construct an anomaly detection network model that includes a time modeling module and a spatial modeling module. The time feature representation generation module is used to extract features from the time series data based on the time modeling module to obtain a time feature representation, establish the posterior and prior distributions of the latent variables based on the time feature representation, and calculate the KL divergence based on the posterior and prior distributions to perform regularization processing on the time feature representation; The heterospatial feature representation generation module is used to map each sensor in the time series data as a graph node, calculate the similarity between nodes according to the time series features, generate a dynamic graph structure through the Gumbel-Softmax mechanism, calculate the structural coefficient of the graph structure to weight the message passing between nodes, and obtain the spatial feature representation. The fusion feature representation generation module is used to fuse the temporal feature representation and the spatial feature representation to obtain a fusion feature representation, with the goal of aligning the temporal and spatial features in a unified latent space. The fusion feature representation is constrained by a contrastive learning method to obtain an optimized fusion feature representation. The anomaly detection module is used to reconstruct the time series based on the optimized fused feature representation, calculate the reconstruction error and obtain an anomaly score by combining the attention weight, process the anomaly score using dynamic statistical methods and complete the anomaly detection.