Embedded internet of things intrusion detection method and system for smart farm

Abstract

The application discloses a smart farm-oriented embedded Internet of Things intrusion detection method and system, and particularly relates to the technical field of computer system intrusion detection, and is used for solving the problem that the existing embedded intrusion detection method cannot identify the cumulative judgment deviation in the flat decision boundary area caused by model compression, and the slow escape attack is continuously misjudged as normal; the method is characterized in that: a continuous output confidence sequence of a compressed intrusion detection model is acquired, the directional retention density of the confidence in the decision threshold neighborhood shadow area is calculated, and a segmented non-stationary test is performed to locate a suspicious period; in the suspicious period, the output wandering track is modeled as a random walk process with an absorbing boundary to obtain a compression degree index, the progressive deviation of the forward sequence and the reverse sequence output track is used to obtain a time sequence asymmetry, and a triple condition joint determination is performed in combination with the wandering track duration to realize the identification of the slow escape attack.

Description

Technical Field

[0001] This invention relates to the field of computer system intrusion detection technology, and more specifically, to an embedded Internet of Things (IoT) intrusion detection method and system for smart farms. Background Technology

[0002] Embedded sensor nodes and edge controllers widely used in smart farms are typically deployed with compressed, lightweight intrusion detection models to identify malicious behavior, due to limitations in microprocessor computing power, storage space, and power supply. To adapt to resource constraints, simplification techniques such as pruning and quantization are commonly used to reduce parameter size and computational load. However, these processes inevitably alter the geometric characteristics of the model's decision boundary, resulting in locally flat areas or non-smooth transitions. Simultaneously, the constantly changing natural conditions of the farm environment, such as light, temperature, and humidity, coupled with sensor noise, cause considerable fluctuations in the collected monitoring data. These fluctuations are often treated as acceptable background changes during system design and do not trigger alarms. Existing embedded intrusion detection solutions primarily focus on identifying single significant anomalies or short-term statistical mutations, without deeply examining the long-term behavioral characteristics of the compressed model's decision boundary.

[0003] Existing embedded intrusion detection methods have shortcomings: When attackers continuously inject small disturbances into the system under the cover of normal data fluctuations inherent in the agricultural environment, these disturbances, when occurring individually, are considered legitimate changes and allowed to proceed. However, they have a non-negligible cumulative effect in the flat region of the compressed model's decision boundary, causing the model's response baseline to abnormal activities to shift slowly. Existing detection mechanisms cannot identify this cumulative judgment shift caused by both model structural defects and environmental data noise. As a result, after a long period of time, the actual continuous intrusion behavior is stably classified as normal by the model, thus exposing the system to the risk of covert, slow escape attacks. Summary of the Invention

[0004] In order to overcome the above-mentioned defects of the prior art, the present invention provides an embedded Internet of Things intrusion detection method and system for smart farms to solve the problems mentioned in the background art.

[0005] To achieve the above objectives, the present invention provides the following technical solution: Embedded IoT intrusion detection methods for smart farms include: S1: Obtain the continuous output confidence sequence of the compressed intrusion detection model on the embedded node of the smart farm for the real-time data stream; S2: The directional dwell density is calculated by analyzing the ratio of the dwell time to the number of crossings in a single direction when the continuous output confidence sequence crosses the shadow area of ​​the decision threshold neighborhood within a preset time window. S3: Perform a piecewise nonstationarity test on the directional retention density to identify suspicious periods in which the statistical characteristics of retention density change continuously. S4: Extract the wandering trajectory of the compressed intrusion detection model output in the shadow area during the suspicious period, model the wandering trajectory as a random walk process with an absorption boundary, and calculate the reciprocal of the average first escape time as the compression index. S5: Input the input data segments corresponding to the wandering trajectory into the compressed intrusion detection model in forward and reverse order respectively to obtain the forward output trajectory and the reverse output trajectory. Calculate the progressive deviation between the two as the temporal asymmetry. S6: When the duration of the loitering trajectory exceeds the preset threshold, the compression index exceeds the compression threshold, and the temporal asymmetry exceeds the asymmetry threshold, a slow escape attack is determined to have occurred and an intrusion alarm is generated.

[0006] Furthermore, the continuous output confidence sequence of the compressed intrusion detection model on the embedded node of the smart farm for the real-time data stream is obtained, including: On the embedded node of the smart farm, by analyzing the relationship between the fluctuation amplitude of the real-time data stream within the sliding time window and the preset fluctuation baseline, the data sampling segments that need to be evaluated for confidence are identified. Input the data sample fragment into the compressed intrusion detection model to perform forward inference and obtain the predicted probability value output by the compressed intrusion detection model; A preset number of predicted probability values ​​are continuously collected to generate a continuous output confidence sequence.

[0007] Furthermore, by analyzing the ratio of the dwell time to the number of crossings in a single direction when the continuous output confidence sequence crosses the shadow area of ​​the decision threshold neighborhood within a preset time window, the directional dwell density is calculated, including: Based on the positional relationship between the continuous output confidence sequence and the decision threshold, determine the crossing events of the continuous output confidence sequence entering and leaving the shadow area of ​​the decision threshold neighborhood within the preset time window; Record the direction of each crossing event, merge multiple consecutive crossing events with the same direction into a single one-way stay event, and accumulate the duration of the single one-way stay event as the stay duration. The total number of traversal events within a preset time window is counted, and the ratio of dwell time to total number of events is calculated to obtain the directional dwell density.

[0008] Furthermore, multiple consecutive crossing events with the same crossing direction are merged into a single unidirectional retention event, including: when two adjacent crossing events have the same crossing direction, the two adjacent crossing events are grouped into the same unidirectional retention event; when two adjacent crossing events have opposite crossing directions, the previous unidirectional retention event is confirmed to have terminated, and the current crossing event is used as the start of a new unidirectional retention event; the difference between the occurrence time of the first crossing event and the occurrence time of the last crossing event within the same unidirectional retention event is used as the duration of the single unidirectional retention event.

[0009] Furthermore, a piecewise nonstationarity test was performed on the directional retention density to identify suspicious periods in which the statistical characteristics of the retention density underwent continuous changes, including: The directional retention density is divided into continuous, non-overlapping observation segments along the time axis, and the local mean of the directional retention density within each observation segment is calculated. By comparing the magnitudes of local means in adjacent observation segments, segment sequences in which local means show a unidirectional increase or a unidirectional decrease and appear continuously are extracted. The segment that first appears in a unidirectional increasing or decreasing sequence is taken as the starting segment of the offset, and the last segment that appears in a unidirectional increasing or decreasing sequence is taken as the ending segment of the offset. The time period between the start and end segments of the offset is identified as a suspicious period in which the statistical characteristics of the retention density continuously change.

[0010] Furthermore, extracting segmented sequences where the local mean is unidirectionally increasing or decreasing and occurs continuously includes: calculating the difference between the local means of adjacent observation segments to obtain the change in local mean; confirming a unidirectional trend in the local mean when the change in local mean maintains the same sign in multiple consecutive observation segments; sequentially connecting the observation segments with the continuous unidirectional trend to form a segmented sequence that is unidirectionally increasing or decreasing; and confirming the termination of the current segmented sequence when the sign of the change in local mean reverses.

[0011] Furthermore, the wandering trajectory of the compressed intrusion detection model output in the shadow area during the suspicious period is extracted. The wandering trajectory is modeled as a random walk process with an absorbing boundary, and the reciprocal of the average first escape time is calculated as an index of compression, including: During the suspicious period, record the time points when the compressed intrusion detection model outputs each entry and exit from the decision threshold neighborhood shadow area, and extract the output value sequence between adjacent entry and exit time points as the wandering trajectory. Using the upper or lower boundary of the shadow region in the neighborhood of the decision threshold as the absorption boundary, and the step size of the change in the output value in the wandering trajectory as the step size parameter of the random walk, a random walk process with an absorption boundary is constructed. In a random walk with an absorbing boundary, starting from each sampling point on the wandering trajectory, the expected value of the number of steps required to reach the absorbing boundary for the first time is simulated and calculated. The harmonic average of the expected values ​​corresponding to all sampling points is taken to obtain the average first escape time. The reciprocal of the average first escape time is calculated as an indicator of the degree of compression.

[0012] Furthermore, the input data segments corresponding to the wandering trajectory are input into the compressed intrusion detection model in both forward and reverse order to obtain the forward and reverse output trajectories. The progressive deviation between the two is calculated as the temporal asymmetry, including: From the real-time data stream corresponding to the suspicious period, extract the input data segments that are synchronized with the wandering trajectory, arrange the input data segments in the original time order to obtain the forward input sequence, and arrange the input data segments in reverse time order to obtain the reverse input sequence. Input the forward-order input sequence into the compressed intrusion detection model to obtain the forward-order output trajectory of the compressed intrusion detection model; input the reverse-order input sequence into the compressed intrusion detection model to obtain the reverse-order output trajectory of the compressed intrusion detection model. The difference between the output values ​​at the same time index position is compared between the forward and reverse output trajectories. The cumulative difference between the output values ​​at each time index position is taken as the progressive deviation, and the progressive deviation is determined as the temporal asymmetry.

[0013] Furthermore, when the duration of the loitering trajectory exceeds a preset threshold, the compression index exceeds a compression threshold, and the temporal asymmetry exceeds an asymmetry threshold, a slow escape attack is determined to have occurred and an intrusion alarm is generated, including: The duration of the wandering trajectory is calculated from the wandering trajectory extracted during the suspicious period, based on the time point of first entering the decision threshold neighborhood shadow area and the time point of last leaving the decision threshold neighborhood shadow area output by the compressed intrusion detection model. Determine whether the duration exceeds a preset threshold, whether the compression index exceeds a compression threshold, and whether the temporal asymmetry exceeds an asymmetry threshold. When the duration exceeds a preset threshold, the pressure index exceeds the pressure threshold, and the timing asymmetry exceeds the asymmetry threshold, a slow escape attack is determined to have occurred and an intrusion alarm is generated.

[0014] On the other hand, the present invention provides an embedded Internet of Things intrusion detection system for smart farms, comprising: The confidence acquisition module is used to acquire the continuous output confidence sequence of the compressed intrusion detection model on the embedded node of the smart farm for the real-time data stream; The density calculation module is used to calculate the directional dwell density by analyzing the ratio of the dwell time to the number of crossings in a single direction when the continuously output confidence sequence crosses the shadow area of ​​the decision threshold neighborhood within a preset time window. The suspicious identification module is used to perform piecewise nonstationarity tests on directional retention density and identify suspicious periods in which the statistical characteristics of retention density change continuously. The index calculation module is used to extract the wandering trajectory of the compressed intrusion detection model output in the shadow area during the suspicious period, model the wandering trajectory as a random walk process with an absorption boundary, and calculate the reciprocal of the average first escape time as the compression index. The asymmetry calculation module is used to input the input data segments corresponding to the wandering trajectory into the compressed intrusion detection model in forward and reverse order respectively, to obtain the forward output trajectory and the reverse output trajectory, and to calculate the progressive deviation between the two as the temporal asymmetry. The alarm detection module is used to determine that a slow escape attack has occurred and generate an intrusion alarm when the duration of the loitering trajectory exceeds a preset threshold, the compression index exceeds the compression threshold, and the temporal asymmetry exceeds the asymmetry threshold.

[0015] Compared with the prior art, the present invention has the following beneficial effects: 1. By analyzing the directional retention density of confidence scores within the shadowed area of ​​the decision threshold neighborhood, the detection perspective shifts from single-point threshold comparison to continuous observation of the movement pattern of the confidence score sequence in the threshold neighborhood. When a slow escape attack injects disturbance into the system, the output of the compressed intrusion detection model generates a directional cumulative shift within the flat area of ​​the decision boundary. The directional retention density is converted into a quantifiable statistical indicator by statistically comparing the number of crossings with the one-way retention time, thus avoiding missed detections caused by attack disturbance amplitudes lower than the conventional alarm threshold. The piecewise non-stationarity test further locates suspicious periods where statistical characteristics continuously change from the temporal changes of the directional retention density, thus defining the time boundary for subsequent detailed analysis.

[0016] 2. During suspicious periods, the wandering trajectory output by the compressed intrusion detection model is modeled as a random walk process with an absorption boundary. A compression index is constructed by the reciprocal of the average first escape time to quantify the degree of compression of the output value as it is pushed toward the alarm boundary from the perspective of survival analysis. At the same time, the irreversibility of the cumulative effect of the attack in the temporal direction is utilized to obtain the temporal asymmetry by comparing the progressive deviation of the forward and reverse output trajectories. The temporal symmetry of environmental fluctuations and the directional inertia of attack disturbances are distinguished. The compression index and temporal asymmetry independently characterize the cumulative attack from the spatial compression dimension and the temporal direction dimension, respectively. Finally, together with the duration of the wandering trajectory, they constitute a triple judgment condition. The three are complementary in detection logic, separating the brief shadow zone crossing caused by the fluctuation of normal environmental data from the continuous unidirectional drift caused by slow escape attacks. Effective identification of covert cumulative attacks is achieved under resource-constrained embedded conditions. Attached Figure Description

[0017] Figure 1 This is a flowchart of the embedded IoT intrusion detection method for smart farms according to the present invention; Figure 2 This is a schematic diagram of the embedded Internet of Things intrusion detection system for smart farms according to the present invention. Detailed Implementation

[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] Example 1: Figure 1 This invention presents an embedded IoT intrusion detection method for smart farms, comprising: S1: Obtain the continuous output confidence sequence of the compressed intrusion detection model on the embedded node of the smart farm for the real-time data stream; S2: The directional dwell density is calculated by analyzing the ratio of the dwell time to the number of crossings in a single direction when the continuous output confidence sequence crosses the shadow area of ​​the decision threshold neighborhood within a preset time window. S3: Perform a piecewise nonstationarity test on the directional retention density to identify suspicious periods in which the statistical characteristics of retention density change continuously. S4: Extract the wandering trajectory of the compressed intrusion detection model output in the shadow area during the suspicious period, model the wandering trajectory as a random walk process with an absorption boundary, and calculate the reciprocal of the average first escape time as the compression index. S5: Input the input data segments corresponding to the wandering trajectory into the compressed intrusion detection model in forward and reverse order respectively to obtain the forward output trajectory and the reverse output trajectory. Calculate the progressive deviation between the two as the temporal asymmetry. S6: When the duration of the loitering trajectory exceeds the preset threshold, the compression index exceeds the compression threshold, and the temporal asymmetry exceeds the asymmetry threshold, a slow escape attack is determined to have occurred and an intrusion alarm is generated.

[0020] In the implementation of S1, in the actual deployment environment of a smart farm, the embedded node is typically a sensor device or edge controller based on a microcontroller unit. The embedded node locally deploys a compressed intrusion detection model that has undergone offline pruning and parameter quantization. The compressed intrusion detection model refers to a lightweight model that, by removing redundant connections and reducing the precision of weight representations from the original deep learning intrusion detection model, can directly run inference within the limited memory space and computing power of the embedded node.

[0021] The real-time data stream originates from environmental monitoring data and equipment status data continuously collected and uploaded by various sensors in the smart farm. Environmental monitoring data includes, but is not limited to, soil temperature, soil moisture, air temperature, air humidity, light intensity, and carbon dioxide concentration. Equipment status data includes, but is not limited to, irrigation valve on / off status, fertigation machine operating current, and supplemental lighting power output. The real-time data stream is fed into the compressed intrusion detection model front-end buffer on the embedded node at a fixed sampling frequency.

[0022] On the embedded nodes of the smart farm, the relationship between the fluctuation amplitude of the real-time data stream within a sliding time window and the preset fluctuation baseline is analyzed to identify data sampling segments that require confidence assessment. The specific implementation is as follows: The sliding time window is a data unit formed by framing and extracting a sequence of continuously arriving sampling points from the real-time data stream over a fixed time span. The time span of the sliding time window is set according to the typical change cycle of various sensor data in the smart farm. For example, for environmental parameters with large inertia, such as temperature and humidity, the time span of the sliding time window is set to 5 minutes; for discrete change signals such as the on / off status of irrigation valves, the time span of the sliding time window is set to 30 seconds. The preset fluctuation baseline is a dynamic reference value representing the normal fluctuation range of data in the smart farm under conditions free from network intrusion. The preset fluctuation baseline is dynamically updated by weighted recursive calculation of the mean and standard deviation of the real-time data stream within several past sliding time windows, ensuring that the preset fluctuation baseline can adapt to normal drift under different time periods and weather conditions caused by natural conditions such as light, temperature, and humidity. The fluctuation range of the real-time data stream within the sliding time window is obtained by calculating the deviation between the sampled data values ​​within the sliding time window and the preset fluctuation baseline. The upper limit of the baseline tolerance deviation is set by multiplying the standard deviation of the preset fluctuation baseline by an adjustable coefficient; for example, the upper limit of the baseline tolerance deviation is set to 3 times the standard deviation. When the deviation exceeds the upper limit of the baseline tolerance deviation, it indicates that the real-time data stream exhibits abnormal fluctuation characteristics. At this time, the data units intercepted within the sliding time window are marked as data sampling segments that require confidence assessment. In this way, it is possible to distinguish between natural drift caused by normal daily temperature variations or slow decreases in humidity in agricultural environments and abnormal data disturbances caused by network attacks. The fluctuation range of natural drift is within the preset fluctuation baseline tolerance range and will not be identified as data sampling segments that require confidence assessment, thereby effectively reducing unnecessary confidence calculation overhead in subsequent processing.

[0023] After the data sampling fragment is identified and extracted, it is input into the compressed intrusion detection model to perform forward inference, obtaining the predicted probability value output by the compressed intrusion detection model. Forward inference refers to constructing an input vector from the features of each dimension in the data sampling fragment according to the feature dimensions of the input layer of the compressed intrusion detection model, passing the input vector through matrix multiplication and activation function operations in each hidden layer of the compressed intrusion detection model, and then calculating the predicted probability value at the output layer using a normalized exponential function. The predicted probability value is a scalar value between 0 and 1, representing the confidence level of the compressed intrusion detection model in determining that the current data sampling fragment belongs to the attack category. The closer the predicted probability value is to 1, the more likely the compressed intrusion detection model judges the current data sampling fragment to be an attack behavior; the closer the predicted probability value is to 0, the more likely the compressed intrusion detection model judges the current data sampling fragment to be normal behavior. When running the compressed intrusion detection model on the embedded node of the smart farm, the matrix multiplication involved in the forward inference process is completed by the fixed-point arithmetic unit on the embedded node, and the activation function operation is approximated by looking up a table to adapt to the computing resource limitations of the embedded node.

[0024] A predetermined number of predicted probability values ​​are continuously collected to generate a continuous output confidence sequence. The predicted probability values ​​output from each forward inference are stored in a circular buffer in chronological order. The length of the circular buffer is equal to the predetermined number. This predetermined number is set based on the requirement that the compressed intrusion detection model on the embedded node of the smart farm needs to accumulate a sufficiently long confidence observation window to provide effective statistical samples for subsequent analysis. The predetermined number is determined by the product of the sliding window's time span and the sampling frequency; for example, it is twice the product. When the circular buffer is full, all the predicted probability values ​​stored in it constitute a continuous output confidence sequence. Each time a new predicted probability value enters the circular buffer, the earliest entering predicted probability value is removed, maintaining the number of predicted probability values ​​in the circular buffer at the predetermined number. The continuous output confidence sequence generated in this manner is used for further processing in subsequent steps.

[0025] It is worth noting that the construction process of the compressed intrusion detection model is as follows. First, a deep learning intrusion detection model trained on a general computing platform is obtained as the original deep learning intrusion detection model. The network structure of the original deep learning intrusion detection model includes several convolutional layers, several fully connected layers, and an output layer. The training data of the original deep learning intrusion detection model comes from normal traffic samples collected during the historical operation of the smart farm and abnormal traffic samples labeled with attack types. Redundant connection removal refers to evaluating the sparsity of the weight matrix of each fully connected layer in the original deep learning intrusion detection model, and removing connections whose absolute weight value is lower than the pruning threshold from the weight matrix. The pruning threshold is set according to the quantile of the distribution of the absolute values ​​of the weights of the fully connected layers. For example, the pruning threshold is set to the 10th quantile of the distribution of the absolute values ​​of the weights of the fully connected layers. After the connection removal is completed, the remaining weight matrix is ​​reordered to form a sparse matrix storage format to reduce storage space. Reducing the precision of weight representation refers to converting the weight parameters of the original deep learning intrusion detection model, which retains connections, from their original 32-bit floating-point representation to 8-bit integer representation. The conversion method is symmetric linear quantization, and the scaling factor for symmetric linear quantization is calculated based on the ratio of the maximum absolute value in the weight matrix of each fully connected layer to the upper limit of the 8-bit integer representation range. After removing redundant connections and reducing the precision of weight representation, the parameter storage of the original deep learning intrusion detection model is reduced to less than one-quarter of its original size. During forward inference, matrix multiplication is converted from floating-point operations to integer operations, enabling inference to be completed directly on the embedded nodes of the smart farm with limited memory space and computing power.

[0026] When deploying a compressed intrusion detection model on an embedded node in a smart farm, the weight parameters and scaling factors in a sparse matrix storage format are written into the firmware storage area of ​​the embedded node. The inference engine running on the embedded node reads the weight parameters and scaling factors during the initialization phase, reconstructs the network structure of the compressed intrusion detection model, and then the compressed intrusion detection model can perform online inference on the input real-time data stream.

[0027] In an embodiment implementing S2, the directional retention density is calculated based on the continuous output confidence sequence obtained from the embedded node of the smart farm. The continuous output confidence sequence is generated by the step of obtaining the continuous output confidence sequence of the compressed intrusion detection model on the embedded node of the smart farm for the real-time data stream, and is a sequence of predicted probability values ​​arranged in chronological order.

[0028] The decision threshold is the boundary used within the compressed intrusion detection model to distinguish between normal and attack behaviors. The decision threshold is set as follows: before deployment, the compressed intrusion detection model is tested using a verification dataset collected during the historical operation of the smart farm. This dataset includes normal traffic samples and abnormal traffic samples labeled with attack types. The predicted probability values ​​output by the compressed intrusion detection model for the verification dataset are calculated separately. The false positive rate and false negative rate are then statistically analyzed for different decision threshold values. The false positive rate is the proportion of normal traffic samples incorrectly identified as attack behaviors, and the false negative rate is the proportion of abnormal traffic samples incorrectly identified as normal behaviors. The decision threshold is selected based on the minimum harmonic mean of the false positive rate and false negative rate.

[0029] The decision threshold neighborhood shaded area is a band-shaped numerical interval formed by extending an offset to both sides of the decision threshold. The offset is set based on the normal fluctuation range of the continuous output confidence sequence under attack-free conditions. Specifically, during the normal operation period of the smart farm, a continuous output confidence sequence is collected as a baseline sample. The normal operation period refers to the time when the smart farm network is not under intrusion attack and all sensor data are within the normal range of change. The standard deviation of all predicted probability values ​​in the baseline sample is calculated, and the offset is set to a multiple of this standard deviation, for example, two standard deviations. The decision threshold neighborhood shaded area has a lower boundary and an upper boundary. The lower boundary is the decision threshold minus the offset, and the upper boundary is the decision threshold plus the offset. When a predicted probability value in the continuous output confidence sequence is not less than the lower boundary and not greater than the upper boundary, that predicted probability value lies within the decision threshold neighborhood shaded area.

[0030] The preset time window is used to limit the time range involved in the directional persistence density analysis. The length of the preset time window is set according to the expected delay characteristics of the compressed intrusion detection model's response to slow escape attacks. The expected delay characteristics are jointly determined by the width of the flat region of the decision boundary of the compressed intrusion detection model and the cumulative rate of attack perturbation. The width of the flat region of the decision boundary refers to the area where the output change rate of the compressed intrusion detection model is lower than the lower limit of sensitivity within the shadow region of the decision threshold neighborhood. The cumulative rate of attack perturbation refers to the magnitude by which the confidence level shifts towards the attack category direction per unit time due to the small perturbation injected by the attacker. When setting the length of the preset time window, it is necessary to ensure that a sufficient number of crossing events can be covered within the preset time window so that the statistical characteristics are stable, while not exceeding the upper limit allowed for alarm delay. For example, the length of the preset time window is set to 30 minutes.

[0031] Within a preset time window, the positional relationship between the continuous output confidence sequence and the decision threshold neighborhood shaded area is analyzed to determine crossing events. A crossing event refers to the moment when the predicted probability value in the continuous output confidence sequence moves from outside the decision threshold neighborhood shaded area into the decision threshold neighborhood shaded area, or moves from inside the decision threshold neighborhood shaded area to outside the decision threshold neighborhood shaded area. When the predicted probability values ​​of two adjacent sampling points in the continuous output confidence sequence are located, one outside and one inside the decision threshold neighborhood shaded area, an entry crossing event is determined, and the crossing direction of the entry crossing event is recorded as the entry direction. When the predicted probability values ​​of two adjacent sampling points in the continuous output confidence sequence are located, one inside and one outside the decision threshold neighborhood shaded area, a departure crossing event is determined, and the crossing direction of the departure crossing event is recorded as the departure direction. Entry crossing events and departure crossing events are collectively referred to as crossing events, and the corresponding crossing direction is recorded for each crossing event.

[0032] After identifying all crossing events within a preset time window, multiple consecutive crossing events with the same crossing direction are merged into a single unidirectional dwelling event. The merging rule is as follows: traverse all crossing events in chronological order; when two adjacent crossing events have the same crossing direction, they are grouped into the same unidirectional dwelling event. When two adjacent crossing events have opposite crossing directions, the previous unidirectional dwelling event is confirmed to have terminated, and the current crossing event is used as the start of a new unidirectional dwelling event. For each unidirectional dwelling event, the difference between the occurrence time of the first crossing event and the occurrence time of the last crossing event within the same unidirectional dwelling event is taken as the duration of the single unidirectional dwelling event.

[0033] The duration of all unidirectional dwelling events within the preset time window is accumulated to obtain the dwelling duration. The total number of crossing events within the preset time window is counted. The directional dwelling density is calculated as: Density = Tdwell / Ncross, where Density represents the directional dwelling density, Tdwell represents the dwelling duration, and Ncross represents the total number of crossing events. The directional dwelling density is a value with time dimensions. Its physical meaning is the average dwelling duration along a single direction for each crossing event. A higher directional dwelling density indicates a higher degree of cumulative dwelling along a single direction within the decision threshold neighborhood shaded area of ​​the continuous output confidence sequence.

[0034] Directional retention density captures the persistent characteristic of confidence levels unidirectionally persisting within the shadowed region of the decision threshold neighborhood. For slow escape attacks, the small perturbations injected by the attack cause confidence levels to gradually drift towards the attack category. This drift manifests as prolonged unidirectional retention within the shadowed region of the decision threshold neighborhood, thus directional retention density shows a significant response to the cumulative effect of the attack. Confidence fluctuations caused by normal environmental fluctuations exhibit relatively balanced bidirectional traversal within the shadowed region of the decision threshold neighborhood, with directional retention density remaining at a low level. By calculating the ratio of retention duration to the number of traversals, directional retention density distinguishes between cumulative unidirectional drift and random bidirectional oscillations, providing a discriminative characteristic indicator for subsequent identification of suspicious periods.

[0035] In the embodiment implementing S3, a suspicious period identification process is performed based on the directional dwelling density, where the statistical characteristics of dwelling density continuously change. The directional dwelling density is a time-varying index sequence output by the step of calculating the directional dwelling density by analyzing the ratio of the dwelling time in a single direction to the number of crossings when the continuously output confidence sequence crosses the shadow area of ​​the decision threshold neighborhood within a preset time window. Each directional dwelling density value corresponds to the statistical result of a preset time window.

[0036] Observation segments are continuous, non-overlapping data segments obtained by dividing the directional retention density sequence into equal-length sections along the time axis. The segmentation method involves determining the time span of each observation segment based on the total duration of the directional retention density sequence and the desired detection sensitivity. The time span of each observation segment must be set such that the number of directional retention density data points within a single observation segment is sufficient to support reliable statistics for local means, while not exceeding the upper limit of the attack accumulation effect being submerged in an excessively long averaging window. The time span of the observation segment is jointly determined based on the sampling period of the directional retention density and the typical accumulation rate of a slow escape attack. For example, the time span of the observation segment is set to an integer multiple of the directional retention density sampling period, ensuring that each observation segment contains at least 10 directional retention density data points.

[0037] After dividing the directional retention density sequence along the time axis into several consecutive and non-overlapping observation segments, the local mean of the directional retention density within each observation segment is calculated. The local mean refers to the arithmetic mean of all directional retention density data points within the observation segment, reflecting the overall level of directional retention density within the corresponding time period. For the i-th observation segment, the local mean is calculated by summing all directional retention density data points contained in the i-th observation segment and dividing by the number of directional retention density data points in the i-th observation segment.

[0038] The local means of adjacent observation segments are compared sequentially. Adjacent observation segments refer to two observation segments that are immediately adjacent on the time axis; the i-th observation segment and the (i+1)-th observation segment are considered adjacent. The change in local mean is calculated by subtracting the local means of adjacent observation segments. The change in local mean is ΔMean. i =Mean i+1 -Mean i , where ΔMean i Mean represents the change in local mean from the i-th observation segment to the (i+1)-th observation segment. i Mean represents the local mean of the i-th observation segment. i+1 This represents the local mean of the (i+1)th observation segment. When the change in the local mean is positive, the directional retention density shows an increasing trend; when the change in the local mean is negative, the directional retention density shows a decreasing trend.

[0039] When the change in local mean value maintains the same sign across multiple consecutive observation segments, it confirms that the local mean value of directional retention density exhibits a unidirectional trend. The same sign means that the changes in local mean value across consecutive adjacent observation segments are either all positive or all negative. The lower limit for the number of consecutive observation segments is used to filter out interference from random fluctuations caused by environmental noise on trend judgment. This lower limit is set based on the autocorrelation characteristics of the natural fluctuations in directional retention density during periods when the smart farm is not under attack. The autocorrelation analysis involves collecting the directional retention density sequence during the historical normal operation period of the smart farm, and counting the average interval between reversals in the sign of the change in local mean value across adjacent observation segments. The lower limit is set to be no less than 1.5 times the average interval number of segments; for example, a lower limit of 3. When the changes in local mean value across consecutive adjacent observation segments have the same sign and the number of consecutive occurrences reaches the lower limit, it confirms that the local mean value exhibits a unidirectional trend.

[0040] Observational segments exhibiting a continuous unidirectional trend are sequentially connected to form a unidirectional increasing or decreasing segment sequence. The connection method involves starting with the initial observational segment that triggers confirmation of the unidirectional trend, and sequentially incorporating subsequent observational segments with the same sign of local mean change along the positive time axis, until the sign of the local mean change reverses. Sign reversal refers to the local mean change changing from positive to negative or vice versa. When the sign of the local mean change reverses, the current segment sequence is confirmed to terminate, and the last observational segment in the sequence is the last observational segment that maintained the same sign before the sign reversal.

[0041] The segment in the segmented sequence that first shows a unidirectional increase or decrease is designated as the starting segment of the offset, and the segment that last shows a unidirectional increase or decrease is designated as the ending segment. The starting and ending segments together define a complete unidirectional offset process. The position of the starting segment corresponds to the starting time point when the directional retention density begins to undergo a sustained unidirectional change, and the position of the ending segment corresponds to the ending time point when this sustained unidirectional change in directional retention density ends. The time period between the starting and ending segments is identified as a suspicious period where the statistical characteristics of retention density undergo a sustained change. The time span of this suspicious period is equal to the time interval from the starting time of the starting segment to the ending time of the ending segment.

[0042] The piecewise nonstationarity test identifies suspicious periods by detecting persistent changes in the statistical characteristics of directional retention density over time. For slow escape attacks, the small perturbations injected by the attack cause the directional retention density to continuously shift in a single direction, with the local mean exhibiting a persistent unidirectional increasing or decreasing trend. This persistent unidirectional trend differs significantly in statistical characteristics from short-term random oscillations caused by normal environmental fluctuations. By segmenting and connecting observations of persistent unidirectional changes in the local mean into a piecewise sequence, statistically significant persistent shift processes are selected, avoiding misjudgments triggered by short-term fluctuations. This also provides a time boundary for subsequent steps to conduct more refined wandering trajectory analysis and temporal asymmetry verification within suspicious periods.

[0043] In the implementation of S4, during the suspicious period, the process of extracting the wandering trajectory of the compressed intrusion detection model output within the decision threshold neighborhood shadow area and calculating the compression index is performed. The suspicious period is the time interval output by the step of identifying suspicious periods where the statistical characteristics of the directional retention density continuously change by performing a piecewise non-stationarity test on the directional retention density. The suspicious period defines the start and end range of the continuous unidirectional shift of the directional retention density. The decision threshold neighborhood shadow area has been defined in the step of calculating the directional retention density, and is a band-shaped numerical interval formed by extending one offset to each side of the decision threshold.

[0044] During the suspicious period, the predicted probability values ​​output by the compressed intrusion detection model are scanned point by point, recording the time points when the compressed intrusion detection model output enters and leaves the decision threshold neighborhood shadow zone each time. The entry time point refers to the sampling moment when the predicted probability value in the continuous output confidence sequence crosses from outside the decision threshold neighborhood shadow zone into the interior, and the departure time point refers to the sampling moment when the predicted probability value in the continuous output confidence sequence crosses from inside the decision threshold neighborhood shadow zone into the outside. Adjacent entry and departure time points are paired, and all predicted probability values ​​contained between adjacent entry and departure time points are extracted and arranged chronologically to form an output value sequence. This output value sequence constitutes a wandering trajectory. During the suspicious period, as the compressed intrusion detection model output repeatedly enters and leaves the decision threshold neighborhood shadow zone, several wandering trajectories are generated. Each wandering trajectory corresponds to a complete traversal process from entering to leaving the decision threshold neighborhood shadow zone.

[0045] After extracting all wandering trajectories within the suspicious time period, each wandering trajectory is independently modeled as a random walk process with an absorption boundary. A random walk process with an absorption boundary is a probabilistic model where a particle moves randomly in the state space, and an absorption boundary exists in the state space. Once the particle reaches the absorption boundary, the random walk process terminates immediately. When modeling a wandering trajectory as a random walk process with an absorption boundary, the absorption boundary is set as follows: for wandering trajectories above the decision threshold, the absorption boundary is the upper boundary of the shaded area in the neighborhood of the decision threshold; for wandering trajectories below the decision threshold, the absorption boundary is the lower boundary of the shaded area in the neighborhood of the decision threshold. The absorption boundary corresponds to the critical value at which the compressed intrusion detection model issues an alarm. Once the output value in the wandering trajectory crosses the absorption boundary, an attack judgment is triggered. The characteristic of a slow escape attack is that the output of the compressed intrusion detection model is gradually pushed towards the absorption boundary but has not yet crossed it.

[0046] The step size parameter of a random walk is estimated based on the step size of the output value change between adjacent sampling points in a wandering trajectory. The step size is the difference between the predicted probability value of the next sampling point and the predicted probability value of the previous sampling point in a wandering trajectory. The absolute values ​​of the step sizes of all adjacent sampling points in a wandering trajectory are statistically analyzed, and the arithmetic mean of all absolute values ​​of the step sizes is taken as the step size parameter of the random walk. The step size parameter reflects the typical amplitude of the local fluctuations of a wandering trajectory within the shaded area of ​​the decision threshold neighborhood.

[0047] After constructing the random walk process with an absorbing boundary, starting from each sampling point on a wandering trajectory, the expected number of steps required to first reach the absorbing boundary is simulated and calculated. For a sampling point on a wandering trajectory, the simulation is performed by using the predicted probability value of the sampling point as the starting position of the random walk, the step size parameter as the typical step size for each step, and the absorbing boundary as the termination condition. The expected number of steps to first reach the absorbing boundary from the starting position is calculated through numerical iteration. The specific process of the numerical iteration method is as follows: the continuous numerical interval between the absorption boundary and the decision threshold is discretized into several equally spaced grid points, with the distance between adjacent grid points equal to the step size parameter. Based on the characteristic that particles move one step up or down with equal probability from any grid point during a random walk, a recursive equation is established for the expected number of steps to first reach the absorption boundary for any grid point. The recursive equation is in the form that the expected number of steps for any grid point is equal to the average of the expected numbers of the two adjacent grid points plus 1. The expected number of steps for the absorption boundary grid point is zero. The recursive equations for all grid points are solved simultaneously to obtain the expected number of steps to first reach the absorption boundary from any grid point. The harmonic mean of the expected number of steps corresponding to all sampling points on a wandering trajectory is taken to obtain the average first escape time of a wandering trajectory. The harmonic mean is calculated by first calculating the arithmetic mean of the reciprocals of the expected number of steps corresponding to all sampling points on a wandering trajectory, and then taking the reciprocal of the arithmetic mean.

[0048] After calculating the average first escape time for each wandering trajectory, the average first escape times of all wandering trajectories are summed and averaged to obtain the average first escape time used for calculating the compression index. The compression index is calculated as: Pcompress = 1 / Tescape, where Pcompress represents the compression index, and Tescape represents the value obtained by summing and averaging the average first escape times of all wandering trajectories. The compression index has the dimension of the reciprocal of time. The larger the value of the compression index, the higher the degree of compression of the wandering trajectory, and the more significant the trend of the compressed intrusion detection model output being pushed towards the absorption boundary within the shadow region of the decision threshold neighborhood.

[0049] The Squeeze Index quantifies the pressure state of the output value when it is continuously pushed by small perturbations of a slow escape attack within the shadow region of the decision threshold neighborhood by modeling the wandering trajectory as a random walk process with an absorbing boundary. For cumulative slow escape attacks, the attack perturbation causes the output of the compressed intrusion detection model to continuously shift towards the absorbing boundary within the shadow region of the decision threshold neighborhood, the mean first escape time continuously decreases, and the Squeeze Index continuously increases. For non-directional oscillations caused by normal environmental fluctuations, there is no continuous tendency for the wandering trajectory to advance towards the absorbing boundary, the mean first escape time remains relatively large, and the Squeeze Index remains at a low level. As a quantitative assessment of the survival status of the wandering trajectory within the shadow region of the decision threshold neighborhood, the Squeeze Index provides a characteristic basis of the pressure dimension for subsequent steps to combine temporal asymmetry in comprehensive attack determination.

[0050] In the implementation of S5, based on the extracted wandering trajectories, a process for calculating temporal asymmetry is performed. The wandering trajectory is a sequence of output values ​​from the step of extracting the wandering trajectory of the compressed intrusion detection model within the shadow region of the decision threshold neighborhood during a suspicious time period. Each wandering trajectory corresponds to a complete traversal process of the compressed intrusion detection model from entering to leaving the shadow region of the decision threshold neighborhood. The suspicious time period is the time interval output from the step of identifying suspicious time periods where the statistical characteristics of the directional retention density continuously change through a piecewise non-stationarity test.

[0051] From the real-time data stream corresponding to the suspicious time period, an input data segment synchronized with the wandering trajectory is extracted. The real-time data stream consists of data continuously received from sensors on the embedded nodes of the smart farm. The input data segment refers to the portion of the real-time data stream that is temporally aligned with the wandering trajectory. Temporal alignment is achieved by using the sampling time of the first sampling point in the wandering trajectory as the start time and the sampling time of the last sampling point as the end time. All sampled data within the interval from the start time to the end time is extracted from the real-time data stream and used as the input data segment synchronized with the wandering trajectory. Each data point in the input data segment corresponds one-to-one with each predicted probability value in the wandering trajectory in time.

[0052] Arranging the input data segments in their original chronological order yields a forward-order input sequence. This sequence preserves the natural chronological progression of the data collected by the sensor, with data points arranged sequentially from earliest to latest sampling time. Arranging the input data segments in reverse chronological order yields a reverse-order input sequence. This sequence is obtained by completely reversing the order of data points within the input data segments. The reversal occurs when the last data point in the forward-order sequence becomes the first data point in the reverse-order sequence, the second-to-last data point in the forward-order sequence becomes the second data point in the reverse-order sequence, and so on, until the first data point in the forward-order sequence becomes the last data point in the reverse-order sequence.

[0053] The compressed intrusion detection model inputs a forward-order input sequence. It performs forward inference for each data point in the forward-order input sequence, outputting the corresponding predicted probability value. All predicted probability values ​​are then arranged in the sampling order of the forward-order input sequence to obtain the forward-order output trajectory. Similarly, the compressed intrusion detection model inputs a reverse-order input sequence. It performs forward inference for each data point in the reverse-order input sequence, outputting the corresponding predicted probability value. All predicted probability values ​​are then arranged in the sampling order of the reverse-order input sequence to obtain the reverse-order output trajectory. The time index positions in the forward-order output trajectory correspond one-to-one with the time index positions in the reverse-order output trajectory; data points at the same time index position correspond to the same original sampling time.

[0054] Compare the output values ​​of the forward-order and reverse-order output trajectories at the same time index position. For the j-th time index position, the difference in output values ​​is calculated as the predicted probability value of the forward-order output trajectory minus the predicted probability value of the reverse-order output trajectory at the j-th time index position. The cumulative difference of output values ​​across all time index positions is used as the progressive bias, calculated as: Aacc = Σ(S j -R j ), where Aacc represents the progressive deviation, S j R represents the predicted probability value of the forward-order output trajectory at the j-th time index position. j Σ represents the predicted probability value of the reverse-order output trajectory at the j-th time index position, and Σ represents the summation over all time index positions. The progressive bias reflects the unidirectional cumulative degree of deviation of the overall forward-order output trajectory from the reverse-order output trajectory.

[0055] The progressive bias is defined as temporal asymmetry. Temporal asymmetry is a cumulative bias quantity. The physical meaning of temporal asymmetry is the overall difference in the output trajectory of the compressed intrusion detection model for the same input data segment under two input modes: forward temporal evolution and reverse temporal evolution.

[0056] Temporal asymmetry distinguishes between slow escape attacks and normal environmental fluctuations based on the irreversibility of the cumulative effect of attacks. When an attacker launches a slow escape attack on an embedded node in a smart farm, the small perturbations injected by the attack accumulate continuously in the original time direction, causing the output of the compressed intrusion detection model to gradually drift towards the attack category. This drift process exhibits directional inertia. After reversing the time order of the input data segments, the cumulative direction of the attack perturbations is forcibly reversed. The cumulative effect of the attack, which was originally progressive under the forward order condition, cannot be traced back symmetrically under the reverse order condition. This results in a systematic deviation between the forward and reverse output trajectories at the same time index position, with a significant increase in the absolute value of the progressive deviation. For output changes caused by normal environmental fluctuations, since the natural fluctuations of environmental factors such as temperature and humidity have statistical symmetry under both forward and reverse time evolution, the forward and reverse output trajectories corresponding to the forward and reverse input sequences maintain a high degree of symmetry, and the progressive deviation approaches zero. Temporal asymmetry, by quantifying the progressive deviation between the forward and reverse output trajectories, provides a verification basis for judging slow escape attacks from the temporal direction dimension, independent of the compression index.

[0057] In the implementation of S6, based on the calculated temporal asymmetry, the final determination of slow escape attacks and the generation of intrusion alarms are performed. The wandering trajectory is the output value sequence from the step of extracting the wandering trajectory output by the compressed intrusion detection model within the shadow area of ​​the decision threshold neighborhood during the suspicious time period. The compression index is a value obtained by modeling the wandering trajectory as a random walk process with an absorbing boundary and calculating the reciprocal of the average first escape time. The temporal asymmetry is a value obtained by inputting the input data segments corresponding to the wandering trajectory into the compressed intrusion detection model in both forward and reverse order and calculating the progressive bias.

[0058] The duration of the wandering trajectory is calculated from the wandering trajectories extracted during the suspicious period. The duration is calculated by obtaining the time point when the compressed intrusion detection model output first enters the decision threshold neighborhood shadow zone, and the time point when the compressed intrusion detection model output last leaves the decision threshold neighborhood shadow zone. The time difference between the time of the last departure from the decision threshold neighborhood shadow zone and the time of the first entry into the decision threshold neighborhood shadow zone is taken as the duration of the wandering trajectory. The duration reflects the total time span during which the compressed intrusion detection model output continuously or intermittently lingers within the decision threshold neighborhood shadow zone.

[0059] The preset threshold is a boundary used to determine whether the duration of the attack meets the persistence requirement. The preset threshold is set based on the minimum time span required for a slow escape attack to produce an observable cumulative effect on the output of the compressed intrusion detection model (CIM) from the initial injection of the perturbation. The perturbation amplitude of a slow escape attack is within the normal fluctuation range, and the process of gradually pushing the CIM output towards the absorption boundary requires a relatively long time to form a statistically distinguishable shift characteristic. The preset threshold is determined based on the maximum duration of confidence levels remaining within the decision threshold neighborhood shadow zone caused by normal environmental fluctuations in the historical operational data of the smart farm. Specifically, samples of the continuous retention time of the CIM output within the decision threshold neighborhood shadow zone are collected from multiple normal operating cycles of the smart farm. The empirical distribution of the retention time is statistically analyzed, and the preset threshold is set as the retention time value corresponding to the 95th quantile of the empirical distribution. For example, the preset threshold is set to 15 minutes. When the duration exceeds the preset threshold, it indicates that the retention time of the CIM output within the decision threshold neighborhood shadow zone has exceeded the upper limit of the occasional retention time caused by normal environmental fluctuations.

[0060] The squeeze threshold is a boundary used to determine whether the squeeze level has reached the level of attack pressure. The squeeze threshold is set by calculating the squeeze level index corresponding to the trajectory of the compressed intrusion detection model output within the shadow region of the decision threshold neighborhood during multiple normal operation cycles of the smart farm. An empirical distribution of the squeeze level index is then statistically analyzed, and the squeeze threshold is set as the squeeze level index value corresponding to the 95th quantile of this empirical distribution. When the squeeze level index exceeds the squeeze threshold, it indicates that the squeeze level experienced by the compressed intrusion detection model output within the shadow region of the decision threshold significantly exceeds the squeeze level that normal environmental fluctuations can cause.

[0061] The asymmetry threshold is a boundary used to determine whether the temporal asymmetry reaches the level of attack irreversibility. The asymmetry threshold is set by calculating the temporal asymmetry corresponding to the trajectory of the compressed intrusion detection model output within the shadow region of the decision threshold neighborhood during multiple normal operation cycles of the smart farm. An empirical distribution of the temporal asymmetry is then statistically analyzed, and the asymmetry threshold is set as the temporal asymmetry value corresponding to the 95th quantile of this empirical distribution. When the temporal asymmetry exceeds the asymmetry threshold, it indicates that the progressive deviation between the forward and reverse output trajectories significantly exceeds the degree of symmetry that normal environmental fluctuations can maintain under time reversal conditions.

[0062] The system performs comparisons of duration with a preset threshold, pressure index with a pressure threshold, and temporal asymmetry with an asymmetry threshold. A slow escape attack is identified when all three conditions are met simultaneously: duration exceeding the preset threshold, pressure index exceeding the pressure threshold, and temporal asymmetry exceeding the asymmetry threshold. Upon detection of a slow escape attack, an intrusion alarm is generated on the embedded node of the smart farm. The intrusion alarm is a structured alarm message containing the start and end times of the suspicious period, the pressure index value, the temporal asymmetry value, and the duration value. The intrusion alarm is reported to the smart farm management platform through the communication interface of the embedded node.

[0063] This study employs a three-pronged approach: duration, compression index, and temporal asymmetry. It comprehensively identifies slow escape attacks from three independent perspectives: the temporal persistence dimension (duration), the spatial compression degree dimension (compression index), and the temporal irreversibility dimension (temporal asymmetry). Duration ensures that detected abnormal offsets are not caused by transient random perturbations; the compression index ensures that the output of the compressed intrusion detection model is indeed subject to a directional thrust towards the absorption boundary; and temporal asymmetry ensures that the progressive deviations in forward and backward reasoning are caused by cumulative attacks with directional inertia rather than temporally reversible environmental noise. These three conditions provide evidence for cumulative slow escape attacks from different dimensions. An intrusion alarm is triggered only when all three dimensions of evidence are simultaneously valid; an intrusion alarm is not generated if a single dimension's judgment index is triggered incidentally by environmental fluctuations.

[0064] Example 2: Figure 2 A schematic diagram of the embedded IoT intrusion detection system for smart farms according to the present invention is provided. The embedded IoT intrusion detection system for smart farms includes: The confidence acquisition module is used to acquire the continuous output confidence sequence of the compressed intrusion detection model on the embedded node of the smart farm for the real-time data stream; The density calculation module is used to calculate the directional dwell density by analyzing the ratio of the dwell time to the number of crossings in a single direction when the continuously output confidence sequence crosses the shadow area of ​​the decision threshold neighborhood within a preset time window. The suspicious identification module is used to perform piecewise nonstationarity tests on directional retention density and identify suspicious periods in which the statistical characteristics of retention density change continuously. The index calculation module is used to extract the wandering trajectory of the compressed intrusion detection model output in the shadow area during the suspicious period, model the wandering trajectory as a random walk process with an absorption boundary, and calculate the reciprocal of the average first escape time as the compression index. The asymmetry calculation module is used to input the input data segments corresponding to the wandering trajectory into the compressed intrusion detection model in forward and reverse order respectively, to obtain the forward output trajectory and the reverse output trajectory, and to calculate the progressive deviation between the two as the temporal asymmetry. The alarm detection module is used to determine that a slow escape attack has occurred and generate an intrusion alarm when the duration of the loitering trajectory exceeds a preset threshold, the compression index exceeds the compression threshold, and the temporal asymmetry exceeds the asymmetry threshold.

[0065] All calculations involved in the embodiments are performed using dimensionless numerical values, and the preset parameters and thresholds in the calculations can be set by those skilled in the art according to actual conditions.

[0066] This technical solution can be flexibly deployed, for example, as embedded software running on device hardware, or installed on personal computers or other smart terminals with user interfaces, thus adapting to various hardware environments and usage requirements.

[0067] The above solutions can be implemented in software, hardware, firmware, or a combination thereof. When implemented in software, they are presented, in whole or in part, as a computer program product, containing one or more computer instructions or programs. When these instructions or programs are loaded and executed on a computer, results are produced corresponding to the processes or functions of the embodiments of this application. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. Computer instructions can be stored in a computer-readable storage medium or transmitted from one medium to another via wired or wireless means, such as from a website, server, or data center via wired means such as fiber optic cables, twisted-pair cables, or coaxial cables, or wireless means such as infrared or microwaves to another site. A computer-readable storage medium refers to any usable medium that a computer can access or a data storage device such as a server or data center that contains one or more usable media, including magnetic media such as floppy disks, hard disks, and magnetic tapes, optical media such as DVDs, and semiconductor media such as solid-state drives.

[0068] The specific working process of the system, device and module can be found in the method embodiment, and will not be repeated here.

[0069] The disclosed systems, devices, and methods can be implemented in other ways. The device embodiments are for illustrative purposes only, and the module division is only a logical division. In practice, different divisions can be implemented, such as merging or integrating multiple modules or components, or omitting some features. Coupling, direct coupling, or communication connections between the components can be achieved through interfaces, while indirect coupling or communication connections can take electrical, mechanical, or other forms.

[0070] The modules described as separate components may or may not be physically separated. The components shown as modules can be physical hardware or software, and can be deployed centrally or distributed across multiple network nodes. Some or all of the modules can be selected to achieve the purpose of this embodiment, depending on actual needs.

[0071] The functional modules in each embodiment can be integrated into one processing module, or they can exist independently, or two or more modules can be integrated into one.

[0072] If the functionality is implemented as a software module and used as an independent product, it can be stored in a computer-readable storage medium. Under this understanding, the substantial contribution of the technical solution of this application can be embodied in the form of a software product. This computer software product is stored in a storage medium and contains instructions to cause a computer device, such as a personal computer, server, or network device, to execute all or part of the steps of the methods in the embodiments of this application. The storage medium includes any medium capable of storing program code, such as a USB flash drive, portable hard drive, read-only memory, random access memory, magnetic disk, or optical disk.

[0073] The above are merely specific embodiments of this application, and the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should fall within the scope of protection of this application.

Claims

1. An embedded IoT intrusion detection method for smart farms, characterized in that, include: S1: Obtain the continuous output confidence sequence of the compressed intrusion detection model on the embedded node of the smart farm for the real-time data stream; On the embedded node of the smart farm, by analyzing the relationship between the fluctuation amplitude of the real-time data stream within the sliding time window and the preset fluctuation baseline, the data sampling segments that need to be evaluated for confidence are identified. The preset fluctuation baseline is a dynamic reference value that represents the normal fluctuation range of data in a smart farm under conditions where it is not subject to network intrusion. After the data sampling segment is identified and extracted, it is input into the compressed intrusion detection model to perform forward inference and obtain the predicted probability value output by the compressed intrusion detection model. The predicted probability value is a scalar value in the range of 0 to 1, which represents the confidence level of the compressed intrusion detection model in determining that the current data sampling segment belongs to the attack category. A preset number of predicted probability values ​​are continuously collected to generate a continuous output confidence sequence. S2: The directional dwell density is calculated by analyzing the ratio of the dwell time to the number of crossings in a single direction when the continuous output confidence sequence crosses the shadow area of ​​the decision threshold neighborhood within a preset time window. The decision threshold is the boundary used to distinguish between normal behavior and attack behavior within the compressed intrusion detection model; the decision threshold neighborhood shaded area is a strip-shaped numerical range formed by extending an offset to both sides of the decision threshold as the center. S3: Perform a piecewise nonstationarity test on the directional retention density to identify suspicious periods in which the statistical characteristics of retention density change continuously. S4: Extract the wandering trajectory of the compressed intrusion detection model output in the shadow area during the suspicious period, model the wandering trajectory as a random walk process with an absorption boundary, and calculate the reciprocal of the average first escape time as the compression index. The time points when the output of the compressed intrusion detection model enters and leaves the decision threshold neighborhood shadow zone are recorded. During the suspicious period, as the output of the compressed intrusion detection model repeatedly enters and leaves the decision threshold neighborhood shadow zone, several wandering trajectories are generated. The step size parameter reflects the typical amplitude of the local fluctuation of a wandering trajectory within the decision threshold neighborhood shadow zone. After calculating the average first escape time for each wandering trajectory, the average first escape time of all wandering trajectories is taken and averaged to obtain the average first escape time on which the compression index is based. The compression index is calculated as: Pcompress = 1 / Tescape, where Pcompress represents the compression index and Tescape represents the value obtained by taking and averaging the average first escape time of all wandering trajectories. The compression index quantifies the compression state of the output value when it is continuously pushed by small perturbations of slow escape attacks within the decision threshold neighborhood shadow zone by modeling the wandering trajectory as a random walk process with an absorbing boundary. S5: Input the input data segments corresponding to the wandering trajectory into the compressed intrusion detection model in forward and reverse order respectively to obtain the forward output trajectory and the reverse output trajectory. Calculate the progressive deviation between the two as the temporal asymmetry. S6: When the duration of the loitering trajectory exceeds the preset threshold, the compression index exceeds the compression threshold, and the temporal asymmetry exceeds the asymmetry threshold, a slow escape attack is determined to have occurred and an intrusion alarm is generated.

2. The embedded IoT intrusion detection method for smart farms according to claim 1, characterized in that, By analyzing the ratio of the dwell time to the number of crossings in a single direction when a continuous output confidence sequence crosses the shadow area of ​​the decision threshold neighborhood within a preset time window, the directional dwell density is calculated, including: Based on the positional relationship between the continuous output confidence sequence and the decision threshold, determine the crossing events of the continuous output confidence sequence entering and leaving the shadow area of ​​the decision threshold neighborhood within the preset time window; Record the direction of each crossing event, merge multiple consecutive crossing events with the same direction into a single one-way stay event, and accumulate the duration of the single one-way stay event as the stay duration. The total number of traversal events within a preset time window is counted, and the ratio of dwell time to total number of events is calculated to obtain the directional dwell density.

3. The embedded IoT intrusion detection method for smart farms according to claim 2, characterized in that, Multiple consecutive crossing events with the same crossing direction are merged into a single unidirectional retention event, including: when two adjacent crossing events have the same crossing direction, the two adjacent crossing events are grouped into the same unidirectional retention event; when two adjacent crossing events have opposite crossing directions, the previous unidirectional retention event is confirmed to have terminated, and the current crossing event is used as the start of a new unidirectional retention event; the difference between the occurrence time of the first crossing event and the occurrence time of the last crossing event within the same unidirectional retention event is used as the duration of the single unidirectional retention event.

4. The embedded IoT intrusion detection method for smart farms according to claim 1, characterized in that, A piecewise nonstationarity test was performed on the directional retention density to identify suspicious periods in which the statistical characteristics of retention density underwent continuous changes, including: The directional retention density is divided into continuous, non-overlapping observation segments along the time axis, and the local mean of the directional retention density within each observation segment is calculated. By comparing the magnitudes of local means in adjacent observation segments, segment sequences in which local means show a unidirectional increase or a unidirectional decrease and appear continuously are extracted. The segment that first appears in a unidirectional increasing or decreasing sequence is taken as the starting segment of the offset, and the last segment that appears in a unidirectional increasing or decreasing sequence is taken as the ending segment of the offset. The time period between the start and end segments of the offset is identified as a suspicious period in which the statistical characteristics of the retention density continuously change.

5. The embedded IoT intrusion detection method for smart farms according to claim 4, characterized in that, Extracting segmented sequences where local means exhibit unidirectional increasing or decreasing trends and occur consecutively includes: calculating the difference between the local means of adjacent observation segments to obtain the change in local means; confirming a unidirectional trend in local means when the change in local means maintains the same sign across multiple consecutive observation segments; sequentially connecting observation segments with continuous unidirectional trends to form a unidirectional increasing or decreasing segmented sequence; and confirming the termination of the current segmented sequence when the sign of the change in local means reverses.

6. The embedded IoT intrusion detection method for smart farms according to claim 1, characterized in that, Extract the wandering trajectory of the compressed intrusion detection model output in the shadow area during the suspicious period. Model the wandering trajectory as a random walk process with an absorbing boundary. Calculate the reciprocal of the average first escape time as an index of compression intensity, including: During the suspicious period, the output value sequence between adjacent entry and exit time points is extracted as the wandering trajectory; Using the upper or lower boundary of the shadow region in the neighborhood of the decision threshold as the absorption boundary, and the step size of the change in the output value in the wandering trajectory as the step size parameter of the random walk, a random walk process with an absorption boundary is constructed. In a random walk with an absorbing boundary, starting from each sampling point on the wandering trajectory, the expected value of the number of steps required to reach the absorbing boundary for the first time is simulated and calculated. The harmonic average of the expected values ​​corresponding to all sampling points is taken to obtain the average first escape time. The reciprocal of the average first escape time is calculated as an indicator of the degree of compression.

7. The embedded IoT intrusion detection method for smart farms according to claim 1, characterized in that, The input data segments corresponding to the wandering trajectory are input into the compressed intrusion detection model in both forward and reverse order to obtain the forward and reverse output trajectories. The progressive deviation between the two is calculated as the temporal asymmetry, including: From the real-time data stream corresponding to the suspicious period, extract the input data segments that are synchronized with the wandering trajectory, arrange the input data segments in the original time order to obtain the forward input sequence, and arrange the input data segments in reverse time order to obtain the reverse input sequence. Input the forward-order input sequence into the compressed intrusion detection model to obtain the forward-order output trajectory of the compressed intrusion detection model; input the reverse-order input sequence into the compressed intrusion detection model to obtain the reverse-order output trajectory of the compressed intrusion detection model. Compare the output values ​​of the forward and reverse output trajectories at the same time index position, and use the cumulative difference of the output values ​​at each time index position as the progressive deviation. The progressive deviation is determined as the temporal asymmetry.

8. The embedded IoT intrusion detection method for smart farms according to claim 1, characterized in that, When the duration of the loitering trajectory exceeds a preset threshold, the compression index exceeds a compression threshold, and the temporal asymmetry exceeds an asymmetry threshold, a slow escape attack is determined to have occurred, and an intrusion alarm is generated, including: From the wandering trajectories extracted during the suspicious period, the duration of the wandering trajectory is calculated based on the time point when the first entry into the decision threshold neighborhood shadow area and the time point when the last exit from the decision threshold neighborhood shadow area output by the compressed intrusion detection model. Determine whether the duration exceeds a preset threshold, whether the compression index exceeds a compression threshold, and whether the temporal asymmetry exceeds an asymmetry threshold. When the duration exceeds a preset threshold, the pressure index exceeds the pressure threshold, and the timing asymmetry exceeds the asymmetry threshold, a slow escape attack is determined to have occurred and an intrusion alarm is generated.

9. An embedded IoT intrusion detection system for smart farms, used to implement the embedded IoT intrusion detection method for smart farms as described in any one of claims 1-8, characterized in that, include: The confidence acquisition module is used to acquire the continuous output confidence sequence of the compressed intrusion detection model on the embedded node of the smart farm for the real-time data stream; The density calculation module is used to calculate the directional dwell density by analyzing the ratio of the dwell time to the number of crossings in a single direction when the continuously output confidence sequence crosses the shadow area of ​​the decision threshold neighborhood within a preset time window. The suspicious identification module is used to perform piecewise nonstationarity tests on directional retention density and identify suspicious periods in which the statistical characteristics of retention density change continuously. The index calculation module is used to extract the wandering trajectory of the compressed intrusion detection model output in the shadow area during the suspicious period, model the wandering trajectory as a random walk process with an absorption boundary, and calculate the reciprocal of the average first escape time as the compression index. The asymmetry calculation module is used to input the input data segments corresponding to the wandering trajectory into the compressed intrusion detection model in forward and reverse order respectively, to obtain the forward output trajectory and the reverse output trajectory, and to calculate the progressive deviation between the two as the temporal asymmetry. The alarm detection module is used to determine that a slow escape attack has occurred and generate an intrusion alarm when the duration of the loitering trajectory exceeds a preset threshold, the compression index exceeds the compression threshold, and the temporal asymmetry exceeds the asymmetry threshold.

Images