Response method, device, equipment, medium and central control host for abnormal control behavior

Abstract

The application provides a response method and device for abnormal control behavior, equipment, medium and central control host. The central control host is connected with an intelligent device. The central control host comprises a first controller and a second controller. The first controller is in communication connection with the second controller, and the second controller is in communication connection with the intelligent device. The method comprises the following steps: the second controller receives a target control instruction generated by the first controller and directed to the intelligent device; whether the first controller has abnormal control behavior is judged according to the target control instruction; and when it is judged that the first controller has abnormal control behavior, the transmission of the target control instruction is intervened. In the embodiment of the application, the safety monitoring function is completely separated from the first controller for controlling the intelligent device, forming an independent defense line in physical isolation. Even if the model and operating system running on the first controller completely crash, the second controller can still work independently and intervene when an anomaly is detected.

Description

Technical Field

[0001] This application belongs to the technical field of central control host, specifically relating to a response method, device, equipment, medium, and central control host for abnormal control behavior. Background Technology

[0002] In related technologies, home control systems integrating AI reasoning capabilities can autonomously decide and control devices such as lights and air conditioners. However, due to model illusions or disordered decision-making processes, home control systems may exhibit abnormal behaviors such as repeatedly turning the same device on and off or issuing commands at high frequency within a short period of time, leading to device wear and even safety hazards. Summary of the Invention

[0003] In view of the above problems, a response method, apparatus, device, medium, and central control host for abnormal control behavior is proposed to overcome or at least partially solve the above problems, including: A method for responding to abnormal control behavior is applied to a central control host, which is connected to an intelligent device. The central control host includes a first controller and a second controller, the first controller being communicatively connected to the second controller, and the second controller being communicatively connected to the intelligent device. The method includes: The second controller receives the target control command for the smart device generated by the first controller; Based on the target control command, determine whether the first controller exhibits abnormal control behavior; When it is determined that the first controller has abnormal control behavior, the transmission of the target control command is intervened.

[0004] In some embodiments, intervening in the transmission of the target control command includes: Determine the target anomaly level of the abnormal control behavior, and determine the target intervention strategy corresponding to the target anomaly level; According to the target intervention strategy, the transmission of the target control command is intervened.

[0005] In some embodiments, a switch is provided on the communication link between the second controller and the smart device; when the target anomaly level is level one, the intervention in the transmission of the target control command according to the target intervention strategy includes: Disconnect the switch to break the communication connection between the smart device and the second controller.

[0006] In some embodiments, the smart devices include multiple devices; the second controller is communicatively connected to the multiple smart devices via a wireless communication module or a wired communication module; the switch includes a first switch and a second switch, the first switch being connected to the wireless communication module, and the second switch being connected to the wired communication module; disconnecting the switch to disconnect the communication connection between the smart devices and the second controller includes: According to the target control command, the target switch is determined from the first switch and the second switch; Disconnect the target switch to disconnect the power supply to the wireless communication module and / or disconnect the communication connection between the wired communication module and the smart device.

[0007] In some embodiments, the smart devices include multiple devices, with one smart device corresponding to one switch; disconnecting the switch to break the communication connection between the smart device and the second controller includes: According to the target control command, the target smart device is determined from multiple smart devices, and the target switch corresponding to the target smart device is determined; Disconnect the target switch to break the communication connection between the target smart device and the second controller.

[0008] In some embodiments, when the target anomaly level is level two, intervening in the transmission of the target control command according to the target intervention strategy includes: Determine the remaining capacity of the target token bucket and determine whether the remaining capacity satisfies the target control command; When the remaining bucket capacity meets the target control command, the target control command is sent to the smart device; When the remaining bucket capacity is insufficient to meet the target control command, the transmission of the target control command is restricted.

[0009] In some embodiments, determining the target anomaly level of the anomaly control behavior includes: When the target anomaly level is level two, a runaway score is calculated. When the current out-of-control score exceeds a preset threshold, the target abnormality level is adjusted from level two to level one.

[0010] In some embodiments, the method further includes: The preset duration window is divided into multiple time slices, and each time slice corresponds to a slice index. The runaway scoring includes: Determine the current time when the target control command is received, and determine the target fragment index corresponding to the current time; Based on the target shard index, the target time shard is determined, and based on the target time shard and the current time, it is determined whether the target time shard has expired. When the target time slice has not expired, update the count of the target time slice, and determine the current out-of-control score based on the previously determined out-of-control score and the updated count; When the target time slice has expired, determine the existing count of the target time slice and the new count of the target time slice, and determine the current out-of-control score based on the previously determined out-of-control score, the existing count of the target time slice, and the new count of the target time slice.

[0011] In some embodiments, determining the target anomaly level of the anomaly control behavior includes: The abnormal control behavior targets the intelligent device and the devices associated with the intelligent device, and abnormal detection information is obtained. The target anomaly level is determined based on the anomaly detection information.

[0012] In some embodiments, determining the target anomaly level based on the anomaly detection information includes: Determine the intervention behavior of control commands at historical moments, and determine the current abnormal threshold information based on the intervention behavior; The target anomaly level is determined based on the anomaly threshold information and the anomaly detection information.

[0013] This application embodiment also provides a central control host, which is connected to a smart device; the central control host includes: A first controller is used to generate target control commands for the intelligent device; The second controller is communicatively connected to the first controller; the second controller is used to receive the target control command and, based on the target control command, determine whether the first controller has abnormal control behavior; when it is determined that the first controller has abnormal control behavior, it intervenes in the transmission of the target control command.

[0014] In some embodiments, the central control host further includes: The wireless communication module is powered by a first switch, and the enable pin of the first switch is connected to the first pin of the second controller. The wired communication module has its data input terminal connected to the first controller via a second switch; the enable pin of the second switch is connected to the second pin of the second controller. The second controller is used to change the level of the first pin and / or the second pin.

[0015] This application embodiment also provides a response device for abnormal control behavior, applied to a central control host, the central control host being connected to a smart device; the central control host includes a first controller and a second controller, the first controller being communicatively connected to the second controller, and the second controller being communicatively connected to the smart device, the device comprising: The receiving module is used for the second controller to receive the target control command for the smart device generated by the first controller; The judgment module is used to determine whether the first controller has abnormal control behavior based on the target control command; The intervention module is used to intervene in the transmission of the target control command when it is determined that the first controller has abnormal control behavior.

[0016] This application also provides an electronic device, including a processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein the computer program, when executed by the processor, implements the above-described response method for abnormal control behavior.

[0017] This application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the above-described method for responding to abnormal control behaviors.

[0018] The embodiments of this application have the following advantages: In this embodiment, the central control unit includes a first controller and a second controller. The first controller runs the AI ​​agent and generates control commands for the smart devices; the second controller detects the control commands and intervenes based on the detection results. This embodiment completely separates the security monitoring function from the first controller running the AI, forming a physically isolated independent defense. Even if the AI ​​agent and operating system running on the first controller completely crash, the second controller can still work independently and intervene when an anomaly is detected. Attached Figure Description

[0019] The above and / or additional aspects and advantages of this application will become apparent and readily understood from the description of the embodiments taken in conjunction with the following drawings, in which: Figure 1 This is a flowchart illustrating the steps of a method for responding to abnormal control behavior according to an embodiment of this application. Figure 2 This is a flowchart illustrating the steps of another abnormal control behavior response method according to an embodiment of this application; Figure 3 This is a schematic diagram of the structure of a central control host according to an embodiment of this application; Figure 4 This is a schematic diagram of another central control host structure according to an embodiment of this application; Figure 5 This is a flowchart illustrating the data processing steps of a central control host according to an embodiment of this application; Figure 6 This is a schematic diagram of the structure of a response device for abnormal control behavior according to an embodiment of this application. Detailed Implementation

[0020] To make the above-mentioned objectives, features, and advantages of this application more apparent and understandable, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments. Obviously, the described embodiments are only some, not all, of the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0021] In related technologies, the anomaly detection module and the AI ​​agent run on the same operating system and the same processor core.

[0022] The detection logic is completely dependent on the operating environment of the first controller. When the AI ​​agent gets stuck in an infinite loop or resource contention causes the first controller to be under extremely high load, the anomaly detection module running on the same processor may not be able to get an execution opportunity in time because the computing resources are preempted, resulting in a significant delay or even failure to execute the detection and blocking actions.

[0023] In some related technologies, abnormal control behavior can be intervened by sending restart commands or modifying process states. These software actions rely on the normal operation of the operating system scheduling and communication stack. In extreme cases where the AI ​​agent has occupied a large amount of CPU time or blocked the communication queue, the blocking command may be delayed or discarded. More seriously, if the AI ​​agent bypasses the upper-layer API and directly operates the hardware interface, the software blocking will be completely ineffective. To address this, this application provides a central control host, which includes a first controller and a second controller. The first controller runs the AI ​​agent and generates control commands for the intelligent device; the second controller detects the control commands and intervenes based on the detection results. This application completely separates the security monitoring function from the first controller running the AI, forming a physically isolated independent defense. Even if the AI ​​agent and operating system running on the first controller completely crash, the second controller can still work independently and intervene when an anomaly is detected. Based on this central control host, this application proposes a response method for abnormal control behavior, which can realize the intervention of control commands based on the design of the central control host.

[0024] Reference Figure 1 The diagram illustrates a step flowchart of a response method for abnormal control behavior according to an embodiment of this application, which may include the following steps: Step 101: The second controller receives the target control command for the smart device generated by the first controller.

[0025] In this embodiment, the central control unit can be connected to smart devices. The central control unit can be a home control unit or smart home gateway in a smart home system, and the smart devices can be smart home appliances, such as smart air conditioners or smart refrigerators. The central control unit can be used to control the smart devices.

[0026] In some embodiments, the central control host may include a first controller and a second controller. The first controller may be a main controller, in which an AI agent may be deployed. The first controller may be used to receive information uploaded by the smart device and may also be used to generate control commands for the smart device.

[0027] The second controller can be positioned between the first controller and the smart device. Specifically, the second controller can be connected to both the first controller and the smart device. The first controller is not directly connected to the smart device, or it does not directly send control commands to the smart device but instead sends the control commands to the second controller first, which then decides whether to send the control commands to the smart device.

[0028] After generating the target control command for the smart device, the first controller can send the target control command to the second controller. The target control command can be a command generated by the first controller for controlling the smart device, such as controlling the smart device to turn on or adjust its parameters.

[0029] The second controller can intercept and detect control commands before they reach the smart device. This completely separates the security monitoring function from the first controller, forming a physically isolated, independent defense line. This ensures that even if the first controller fails, the second controller can still operate independently and intervene in the commands.

[0030] For the second controller, after receiving the target control command issued by the first controller, it can first intercept and analyze it.

[0031] Step 102: Based on the target control command, determine whether the first controller exhibits abnormal control behavior.

[0032] After intercepting the target control command, the second controller can first determine whether the first controller has any abnormal control behavior towards the smart device based on the target control command. For example, whether the smart device is being operated frequently, or whether there are consecutive conflicting operations (such as opening a window before turning on the air conditioner).

[0033] When the first controller determines that there is no abnormal control behavior, the second controller can send the target control command to the smart device to control the smart device.

[0034] Step 103: When it is determined that the first controller has abnormal control behavior, intervene in the transmission of the target control command.

[0035] In some embodiments, if the first controller is determined to have abnormal control behavior, the second controller may intervene in the transmission of the target control command. For example, the time for the target control command to be transmitted to the smart device may be limited, or the target control command may be temporarily not transmitted to the smart device. This application embodiment does not impose such limitations.

[0036] In this embodiment, the second controller receives target control commands for the smart device generated by the first controller; based on the target control commands, it determines whether the first controller exhibits abnormal control behavior; when abnormal control behavior is detected, it intervenes in the transmission of the target control commands. This embodiment completely separates the security monitoring function from the first controller that controls the smart device, forming a physically isolated independent defense. Even if the model and operating system running on the first controller completely crash, the second controller can still work independently and intervene when an anomaly is detected.

[0037] Reference Figure 2 The flowchart illustrates another method for responding to abnormal control behavior according to an embodiment of this application, which may include the following steps: Step 201: The second controller receives the target control command for the smart device generated by the first controller.

[0038] After generating the target control command for the smart device, the first controller can send the target control command to the second controller.

[0039] The second controller can intercept and detect control commands before they reach the smart device. This completely separates the security monitoring function from the first controller, forming a physically isolated, independent defense line. This ensures that even if the first controller fails, the second controller can still operate independently and intervene in the commands.

[0040] For the second controller, after receiving the target control command issued by the first controller, it can first intercept and analyze it.

[0041] Step 202: Based on the target control command, determine whether the first controller exhibits abnormal control behavior.

[0042] After intercepting the target control command, the second controller can first determine whether the first controller has any abnormal control behavior against the smart device based on the target control command.

[0043] If the first controller determines that there is no abnormal control behavior, the second controller can send the target control command to the smart device to control the smart device.

[0044] Step 203: When it is determined that the first controller has abnormal control behavior, determine the target abnormality level of the abnormal control behavior and determine the target intervention strategy corresponding to the target abnormality level.

[0045] In some embodiments, if it is determined that the first controller has abnormal control behavior, the second controller can intervene in the transmission of the target control command. For example, in order to avoid the impact of excessive protection on the normal user experience, the embodiments of this application can first analyze the target control command sent by the first controller when it is determined that the first controller has abnormal control behavior, so as to determine the target abnormality level of the abnormal control behavior.

[0046] For example, the target anomaly level can be determined based on the degree of anomaly in the abnormal control behavior.

[0047] After determining the target anomaly level, the corresponding target intervention strategy can be determined. For example, different intervention strategies can be set in advance for different anomaly levels, such as: cutting off the communication connection with the smart device at level 1; restricting the sending of control commands at level 2; and sending control commands normally at level 3.

[0048] Step 204: Intervene in the transmission of target control commands according to the target intervention strategy.

[0049] After determining the target intervention strategy, the transmission of target control commands can be intervened according to the strategy. For example: at level 1, target control commands cannot be sent to the smart device due to a communication connection failure. At level 2, target control commands are sent at preset time intervals or according to the current load interval of the communication connection. At level 3, target control commands are sent directly to the smart device.

[0050] In some embodiments of this application, a switch is provided on the communication link between the second controller and the smart device; based on this, when the target anomaly level is level one, step 203 can be implemented through the following sub-steps: Sub-step 11: Disconnect the switch to break the communication connection between the smart device and the second controller.

[0051] In related technologies, abnormal control behavior can be intervened by sending a restart command or modifying the process state. Such software actions rely on the normal operation of the operating system scheduling and communication stack. In extreme cases where the AI ​​agent has already occupied a large amount of CPU time or blocked the communication queue, the blocking command may be delayed or discarded directly. More seriously, if the AI ​​agent bypasses the upper-layer API and directly operates the hardware interface, the software blocking will be completely ineffective. To address this, embodiments of this application can achieve physical disconnection by setting a switch. For example, for wireless devices, complete isolation is achieved by powering off; for wired devices, control commands are blocked by cutting off the signal path. The response latency is determined solely by the hardware flip-flop speed, providing a deterministic and unbypassable forced blocking capability.

[0052] In some embodiments, a switch may be provided on the communication link between the second controller and the smart device. The on / off state of the switch can be controlled by the second controller, thereby enabling the communication connection or interruption between the second controller and the smart device.

[0053] When the abnormality of the control behavior is high, the target abnormality level can be determined as Level 1. At this time, to avoid affecting the smart device, the switch can be turned off to disconnect the communication connection between the smart device and the second controller. As a result, the target control commands generated by the first controller cannot be sent to the smart device through the second controller, and the smart device will no longer be under the control of the first controller.

[0054] In some embodiments of this application, the smart devices include multiple devices; the second controller is communicatively connected to the multiple smart devices via a wireless communication module or a wired communication module; the switch includes a first switch and a second switch, the first switch being connected to the wireless communication module and the second switch being connected to the wired communication module; based on this, sub-step 11 can be implemented by the following method: According to the target control command, the target switch is determined from the first switch and the second switch; the target switch is disconnected to disconnect the power supply to the wireless communication module and / or disconnect the communication connection between the wired communication module and the smart device.

[0055] In some embodiments, the smart devices may include multiple devices, such as smart air conditioners, smart fans, smart door locks, etc.; these smart devices can be connected to the second controller via a wireless communication module or a wired communication module; the wired communication module is used to connect the second controller and the smart devices via a wired connection; the wireless communication module is used to connect the second controller and the smart devices via a wireless connection.

[0056] For example, a smart air conditioner can communicate with a second controller via a wireless communication module, and a smart door lock can communicate with a second controller via a wired communication module.

[0057] The switch may include a first switch and a second switch; wherein, the first switch can be connected to the wireless communication module and used to control the operation of the wireless communication module; when the first switch is open, the wireless communication module stops working; at this time, the second controller disconnects its communication connection with the smart device. When the first switch is closed, the wireless communication module operates normally; at this time, the second controller communicates with the smart device.

[0058] The second switch can be connected to the wired communication module and used to control its operation. When the second switch is open, the wired communication module stops working; at this time, the second controller disconnects from the smart device. When the second switch is closed, the wired communication module operates normally; at this time, the second controller communicates with the smart device.

[0059] In some embodiments, after receiving a target control command, the second controller can determine the smart device to which the target control command is directed, and determine whether the communication connection between the smart device and the second controller is a wired connection or a wireless connection.

[0060] If it is a wired connection, the second switch corresponding to the wired communication module can be used as the target switch. If it is a wireless connection, the first switch corresponding to the wireless communication module can be used as the target switch.

[0061] After the target switch is determined, the second controller can disconnect the target switch. If the target switch corresponds to the wireless communication module, the power supply to the wireless communication module can be disconnected. After the power supply to the wireless communication module is stopped, it can no longer provide a communication connection between the second controller and the smart device, so that the target control command cannot be sent from the second controller to the smart device.

[0062] If the target switch corresponds to a wired communication module, the communication connection between the wired communication module and the smart device can be disconnected; at this time, the second controller is disconnected from the smart device.

[0063] If the target switch corresponds to both a wired communication module and a wireless communication module, then the power supply to the wireless communication module can be disconnected, as well as the communication connection between the wired communication module and the smart device can be disconnected.

[0064] In some embodiments of this application, disconnection can be performed on wired or wireless connections, as described in the embodiments above; In other embodiments of this application, the disconnection may also be performed on a specific smart device, as in the following embodiments: There are multiple smart devices, and each smart device corresponds to one switch; based on this, sub-step 11 can also be implemented using the following method: According to the target control command, the target intelligent device is determined from multiple intelligent devices, and the target switch corresponding to the target intelligent device is determined; the target switch is disconnected to disconnect the communication connection between the target intelligent device and the second controller.

[0065] In some embodiments, a smart device can correspond to a switch; by controlling a switch, the communication connection between the corresponding smart device and the second controller can be controlled; based on this, after receiving the target control command, the smart device targeted by the target control command, i.e., the target smart device, can be determined from among multiple smart devices.

[0066] Then, when the target anomaly level is determined to be Level 1, the switch corresponding to the target smart device can be identified, i.e., the target switch. Next, the target switch can be disconnected, thereby disconnecting the communication connection between the target smart device and the second controller. At this time, the second controller will be unable to send target control commands to the target smart device.

[0067] In some embodiments of this application, when the target anomaly level is level two, the sending of target control commands can be restricted; specifically, step 203 can be implemented through the following sub-steps: Sub-step 21: Determine the remaining capacity of the target token bucket and determine whether the remaining capacity meets the target control instructions.

[0068] In some embodiments, a target token bucket and its capacity can be set for each device or each communication channel (communication channel for wireless communication or communication channel for wired communication).

[0069] After receiving the target control command, the target token bucket of the target device or the target token bucket of the corresponding communication channel can be determined.

[0070] After determining the target token bucket, we can determine the remaining capacity of the target token bucket at the current moment, i.e., the remaining bucket capacity. Next, we can determine whether the remaining bucket capacity satisfies the target control command. For example, if the remaining bucket capacity is less than 1, it can be determined that the remaining bucket capacity does not satisfy the target control command.

[0071] Sub-step 22: When the remaining bucket capacity meets the target control command, send the target control command to the smart device.

[0072] If it is determined that the remaining bucket capacity can meet the target control command, it means that there is a token that can be used to forward the target control command; at this time, the second controller can send the target control command to the smart device.

[0073] Sub-step 23: When the remaining bucket capacity cannot meet the target control command, restrict the sending of the target control command.

[0074] If the remaining bucket capacity is insufficient to satisfy the target control command, it indicates that there are currently no tokens available to forward the target control command. In this case, the second controller can store the target control command in the buffer until tokens are replenished before forwarding it. If the buffer is full, the target control command can be discarded.

[0075] In some embodiments of this application, based on the above sub-steps 21-24, step 203 can determine the target anomaly level of the anomaly control behavior through the following sub-steps: Sub-step 31: When the target anomaly level is level 2, calculate the runaway score.

[0076] In some embodiments, Level 1 may be promoted from Level 2; for example, when the target anomaly level is determined to be Level 2, the second controller may calculate a runaway score against the first controller.

[0077] Specifically, the runaway score is initially 0. After the second controller receives a control command, it can determine the level of abnormality. When it is determined to be level 2, the runaway score can be increased by 1.

[0078] In some embodiments, when the score is determined to be Level 3 (i.e., normal), the runaway score can be multiplied by a decay factor (the decay factor is a positive number less than 1).

[0079] Sub-step 32: When the current out-of-control score exceeds the preset threshold, adjust the target anomaly level from level two to level one.

[0080] After updating the runaway score, the second controller can determine whether the current runaway score exceeds a preset threshold. The preset threshold can be set according to the actual situation, and the specific value is not limited in this embodiment.

[0081] If the current runaway score does not exceed the preset threshold, the second controller can continue to restrict the transmission of control commands.

[0082] Conversely, if the current out-of-control score exceeds a preset threshold, the second controller can adjust the target anomaly level from level two to level one, thus ultimately determining the current target anomaly level as level one. At this point, the communication connection between the second controller and the smart device can be severed.

[0083] In some embodiments of this application, based on sub-steps 21-24, the above method may further include the following steps: The preset duration window is divided into multiple time slices, and each time slice corresponds to a slice index. In some embodiments, to ensure real-time performance on resource-constrained controllers, frequency statistics for individual smart devices employ a time-slicing and differential accumulation method. For example, a fixed-duration preset window can be divided into several equal-length time slices, and a circular counter array and a sum variable can be maintained in memory for each smart device. Each time slice can correspond to a slice index for indexing the corresponding time slice.

[0084] Based on the obtained time slices, sub-step 23 can be implemented as follows: Determine the current time when the target control command is received, and determine the target slice index corresponding to the current time; based on the target slice index, determine the target time slice, and based on the target time slice and the current time, determine whether the target time slice has expired; if the target time slice has not expired, update the count of the target time slice, and determine the current out-of-control score based on the previously determined out-of-control score and the updated count; if the target time slice has expired, determine the existing count of the target time slice and the new count of the target time slice, and determine the current out-of-control score based on the previously determined out-of-control score, the existing count of the target time slice, and the new count of the target time slice.

[0085] In some embodiments, after receiving a target control command, the second controller can first determine the current time at which the target control command was received. Based on this current time and the fragment size, the corresponding target fragment index can be determined.

[0086] After determining the target shard index, the corresponding time shard, i.e. the target time shard, is retrieved based on the target shard index, and it is checked whether the target time shard has become outdated.

[0087] If it is not outdated, update the count of the target time slice, and determine the current out-of-control score based on the previously determined out-of-control score and the updated count of the target time slice.

[0088] Conversely, if it is outdated, the existing count of the target time segment and the new count of the target time segment are determined; in addition, the previously determined runaway score can also be determined.

[0089] Then, the current out-of-control score can be obtained by subtracting the existing count of the target time slice from the previously determined out-of-control score and adding the new count of the target time slice.

[0090] In some embodiments of this application, step 203 may also determine the target anomaly level of the anomaly control behavior through the following sub-steps: Sub-step 41: Detect the target smart device targeted by the abnormal control behavior, as well as the devices associated with the target smart device, to obtain abnormal detection information.

[0091] In related technologies, anomalies in AI agents often manifest as individual commands being normal while the overall sequence is abnormal. For example, an air conditioner might be switched on and off ten times within one minute, even though each control command itself is legal. While simply counting command frequency can identify excessive operation of a single device, it cannot identify unreasonable cross-device linkages (such as windows being repeatedly opened while the air conditioner is cooling), nor can it distinguish between normal, rapid user operations and abnormal, repetitive AI decisions. To address this, the embodiments of this application can perform anomaly analysis from different dimensions, such as: high-frequency detection of single devices, high-frequency detection of associated device groups, detection of timing deviations in operation intervals, and detection of global command rates.

[0092] For example, the second controller can detect the target smart device targeted by the abnormal control behavior, as well as devices associated with the target smart device, to obtain abnormal detection information. The abnormal detection information may include detection information obtained after detecting the target smart device, and detection information obtained after detecting devices associated with the target smart device.

[0093] For example, anomaly detection information may include the number of operations performed by the target smart device within the window period, the number of operations performed by devices associated with the target smart device within the window period, the time interval between the current target control command and the previous control command for the target smart device, and the total number of operations performed by all smart devices within the window period.

[0094] Sub-step 42: Determine the target anomaly level based on the anomaly detection information.

[0095] After obtaining the anomaly detection information, the target anomaly level can be determined based on the anomaly detection information; for example, the anomaly level can be determined based on different anomaly detection information, and then the target anomaly level can be calculated by weighting.

[0096] In some embodiments of this application, sub-step 42 can be implemented by the following method: Identify the intervention behaviors of control commands at historical moments, and determine the current abnormal threshold information based on the intervention behaviors; determine the target abnormality level based on the abnormal threshold information and abnormal detection information.

[0097] In some embodiments, after intervention, the user can perform a recovery operation so that the second controller can continue to send control commands normally; however, in order to verify whether the first controller has truly recovered, an observation period can be set; the judgment conditions during the observation period can be narrowed.

[0098] For example, the intervention behaviors of control commands at historical moments can be determined first; for example, the time of the last intervention behavior can be determined. After determining the intervention behaviors of control commands at historical moments, the abnormal threshold information used for anomaly detection of the first controller can be determined based on the time of the intervention behavior, the intervention strategy, etc. For example, the abnormal threshold information may include the threshold corresponding to the number of operations of the smart device within the window period, the threshold corresponding to the number of operations of devices associated with the smart device within the window period, the threshold corresponding to the time interval between the current control command and the last control command for the smart device, and the threshold corresponding to the total number of operations of all smart devices within the window period, etc.

[0099] After determining the anomaly threshold information and anomaly detection information, the degree of anomaly in the anomaly detection information can be judged based on the anomaly threshold information, thereby determining the target anomaly level.

[0100] In this embodiment, the second controller receives target control commands for the smart device generated by the first controller; based on the target control commands, it determines whether the first controller exhibits abnormal control behavior; when abnormal control behavior is determined, it determines the target anomalous level of the abnormal control behavior and the corresponding target intervention strategy; and based on the target intervention strategy, it intervenes in the transmission of the target control commands. This embodiment completely separates the security monitoring function from the first controller that controls the smart device, forming a physically isolated independent defense. Even if the model and operating system running on the first controller completely crash, the second controller can still work independently and intervene when an anomaly is detected.

[0101] It should be noted that, for the sake of simplicity, the method embodiments are all described as a series of actions. However, those skilled in the art should understand that the embodiments of this application are not limited to the described order of actions, because according to the embodiments of this application, some steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also understand that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of this application.

[0102] Reference Figure 3 The diagram illustrates the structure of a central control host according to an embodiment of this application, which may include: The first controller 310 is used to generate target control commands for smart devices; The second controller 320 is communicatively connected to the first controller 310. The second controller 320 is used to receive target control commands and determine whether the first controller 310 has abnormal control behavior based on the target control commands. When it is determined that the first controller 310 has abnormal control behavior, it intervenes in the transmission of the target control commands.

[0103] In this embodiment, the central control host 30 can communicate with the smart device and is used to receive data uploaded by the smart device and send control commands to the smart device to control the smart device.

[0104] The central control unit 30 may include a first controller 310 and a second controller 320; wherein, the first controller 310 may be equipped with an AI agent to generate control commands for smart devices. The second controller 320 may be located between the first controller 310 and the smart device, and the target control commands generated by the first controller 310 need to be sent to the smart device through the second controller 320.

[0105] After receiving the target control command issued by the first controller 310, the second controller 320 can first determine whether the first controller 310 has any abnormal control behavior against the smart device based on the target control command.

[0106] If the first controller 310 determines that there is no abnormal control behavior, the second controller 320 can send the target control command to the smart device to control the smart device.

[0107] If the first controller 310 is determined to have abnormal control behavior, the second controller 320 can intervene in the transmission of the target control command; for example, it can limit the time for the target control command to be transmitted to the smart device, or temporarily not transmit the target control command to the smart device. This application embodiment does not impose such limitations.

[0108] In some embodiments of this application, the central control host 30 further includes: The wireless communication module is powered by a first switch, and the enable pin of the first switch is connected to the first pin of the second controller 320. The wired communication module has its data input terminal connected to the first controller 310 via a second switch; the enable pin of the second switch is connected to the second pin of the second controller 320. The second controller 320 is used to change the level of the first pin and / or the second pin.

[0109] In some embodiments, the central control host 30 can communicate with smart devices via wired or wireless means; for example, the central control host 30 may also include a wireless communication module for wireless communication with smart devices and a wired communication module for wired communication with smart devices.

[0110] The wireless communication module is powered by a first switch, and the enable pin of the first switch is connected to the first pin of the second controller 320; thus, the second controller 320 can control the opening and closing of the first switch by changing the level of the first pin.

[0111] For example, under normal conditions (i.e., when the wireless communication module is working properly), the second controller 320 can set the first pin to an active level; when it is necessary to disconnect the wireless connection with the smart device, the second controller 320 can set the first pin to an inactive level.

[0112] The data input terminal of the wired communication module can be connected to the transmit pin of the first controller 310 through the second switch, and the enable pin of the second switch can be connected to the second pin of the second controller 320; thus, the second controller 320 can control the opening and closing of the second switch by changing the level of the second pin.

[0113] For example, under normal conditions (i.e., when the wired communication module is working properly), the second controller 320 can set the second pin to a low level; when it is necessary to disconnect the wired connection with the smart device, the second controller 320 can set the second pin to a high level. This application embodiment does not limit this.

[0114] like Figure 4 The diagram shows another structural schematic of a central control host 30 according to an embodiment of this application. It may include: a first controller 310, a second controller 320, a ZigBee module (i.e., a wireless communication module), a Wi-Fi module (i.e., a wireless communication module), an RS485 bus (i.e., a wired communication module), and switches (ZigBee module load switch, Wi-Fi module load switch, and RS485 bus analog switch).

[0115] The first controller 310 is communicatively connected to the second controller 320. Control commands generated by the first controller 310 can be sent to the second controller 320 first, and then the second controller 320 can send them to smart devices (ZigBee devices such as air conditioners, Wi-Fi devices such as speakers, RS485 devices such as curtains). If the second controller 320 restricts the transmission of control commands, it can send an interruption notification to the first controller 310.

[0116] The second controller 320 can control the load switch of the ZigBee module, the load switch of the Wi-Fi module, and the analog switch of the RS485 bus through GPIO, thereby controlling the smooth or interrupted communication between the ZigBee module, the Wi-Fi module, the RS485 bus and the corresponding smart device.

[0117] When the transmission restriction of the control command is triggered, the second controller 320 can drive the indicator light to flash to alert the user.

[0118] like Figure 5 The diagram illustrates a flowchart of data processing steps for a central control host according to an embodiment of this application, which may include the following steps: Phase 1: Initialization; Upon power-on, the second controller reads preset threshold parameters from the reserved sectors of its internal Flash memory. These parameters are written and locked by the user before deployment using a security configuration tool, and include: the maximum number of operations N1 within a single device sliding window; the maximum number of operations N2 within an associated device group window; the maximum number of instructions N3 within a global window; the timing deviation threshold Z_th; and the increment Δ and attenuation coefficient λ for the runaway score. The first controller cannot address this area.

[0119] Phase Two: Command Interception and Recording.

[0120] The second controller receives the control instructions sent by the first controller byte by byte in the UART receive interrupt, parses them according to the predetermined frame format, extracts the device ID and operation code, and records the current count value of the internal timer as a timestamp.

[0121] The second controller maintains a circular queue with a capacity of 128 records in its memory, as well as a frequency statistics table indexed by device ID. The frequency statistics table uses time slicing and differential accumulation to maintain the real-time operation count of each device within the sliding window, and performs frequency statistics by updating the sliding window, ensuring that the computational complexity is O(1).

[0122] O(1) is a time complexity notation in computer science used to describe the relative efficiency of an algorithm's execution time or resource consumption as the input size changes. O(1) indicates that the execution time of an algorithm is constant, meaning that the execution time remains constant regardless of the size of the input data (e.g., always 1 microsecond or 10 nanoseconds).

[0123] Phase 3: Multi-dimensional composite detection.

[0124] Once the new control command record is updated, immediately perform the following checks: 1. Single device high frequency detection: Look up the table to obtain the number of operations of the target smart device ID within the window period. If it is greater than N1, a level 3 anomaly is triggered.

[0125] 2. High-frequency detection of associated device groups: Sum the number of occurrences of this command across all devices in the associated group. If the sum exceeds N², a level 2 exception is triggered. Associated groups are preset in Flash memory, such as {Air Conditioner ID, Window ID}.

[0126] 3. Timing Deviation Detection: Calculate the time interval Δt since the last operation on the target smart device. The historical operation interval mean μ and standard deviation σ of the device are updated online using an exponentially weighted moving average. If |Δt-μ| / σ > Z_th, a level 3 anomaly is triggered.

[0127] 4. Global Rate Detection: Count the total number of operations of all devices within the statistical window period. If it is greater than N3, a level 2 anomaly is triggered.

[0128] Phase 4: Tiered Response and Hardware Circuit Breaker.

[0129] Execute the corresponding response based on the test results: 1. Level 3 Anomaly: The second controller records the anomaly log to the internal Flash, and the control commands are forwarded normally without interfering with the behavior of the first controller.

[0130] 2. Level 2 Anomaly: The second controller internally implements forced rate limiting: The second controller maintains a token bucket for each communication channel (i.e., wireless and wired communication). The bucket capacity and token replenishment rate are determined by preset parameters (e.g., replenishing one token per second, with a maximum capacity of one token). Command forwarding consumes one token. When tokens are exhausted, subsequent commands are temporarily stored in an internal buffer, waiting for token replenishment before forwarding; if the buffer is full, new commands are discarded. Simultaneously, the second controller drives an LED indicator to flash to alert the user and increments the out-of-control score maintained for that channel by Δ. The hardware path remains open.

[0131] Each channel has its own token bucket, out-of-control scoring, and circuit breaker mechanism to ensure the accuracy of anomaly response and system reliability.

[0132] For example: Wi-Fi channel (controlling lights, curtains): Configuration: Token bucket capacity = 5, replenishment rate = 1 token / second (i.e., a maximum of 5 instructions can be forwarded per second).

[0133] Abnormal scenario: The AI ​​sends 10 light switch commands within 1 second.

[0134] The first 5 instructions consume 5 tokens, at which point the token bucket is emptied.

[0135] The last 5 instructions are discarded (or temporarily stored in the buffer) until a token is replenished after 1 second.

[0136] Result: Lighting control was limited, but curtain control was unaffected (because the curtains are a separate device, but still within the Wi-Fi channel).

[0137] RS485 channel (controls air conditioning and fresh air systems): Configuration: Token bucket capacity = 3, replenishment rate = 0.5 tokens / second.

[0138] Abnormal scenario: The AI ​​sends 4 air conditioning commands within 2 seconds.

[0139] Second 1: Consume 2 tokens (2 instructions), 1 token remaining.

[0140] Second 2: 0.5 tokens are added, bringing the total number of tokens to 1.5; then 1 instruction is consumed, leaving 0.5 tokens remaining.

[0141] Second 3: Add 0.5 tokens, then the total number of tokens = 1; this consumes 1 instruction.

[0142] Result: The air conditioning command was limited, but the lighting control on the Wi-Fi channel worked perfectly.

[0143] The runaway score for each channel is calculated and stored independently (independent score variables are allocated to each channel in the MCU memory).

[0144] Calculation logic: Initial score = 0 If a Level 2 anomaly is triggered, the out-of-control score needs to be accumulated by Δ (e.g., Δ=1). If no abnormality is found, the runaway score is multiplied by λ (e.g., λ=0.9, decaying by 10% per second). Circuit breaker condition: score > emergency threshold (e.g., threshold = 5).

[0145] Wi-Fi channel: 1. First minute: Two level 2 anomalies were triggered (score = 0 + 1 + 1 = 2); 2. Second minute: No abnormalities (score = 2 × 0.9 = 1.8); 3. 3rd minute: Triggered 1 Level 2 anomaly (score = 1.8 + 1 = 2.8); 4. 4th minute: Triggered 2 Level 2 anomalies (score = 2.8 + 1 + 1 = 4.8); 5. 5th minute: Triggered 1 level 2 anomaly (score = 4.8 + 1 = 5.8 > 5); Fuse trigger: The second controller shuts off the power supply to the Wi-Fi module, thus disconnecting all Wi-Fi devices (lights and curtains become ineffective).

[0146] RS485 channel: 1. First minute: No abnormalities (score = 0); 2. Minute 2: Triggered 1 Level 2 anomaly (score = 0 + 1 = 1); 3. 3rd minute: No abnormalities (score = 1 × 0.9 = 0.9); 4. 4th minute: No abnormality (score = 0.9 × 0.9 = 0.81) No circuit breaker: The score is always <5, and the RS485 channel continues to work normally (air conditioning and fresh air are not affected).

[0147] 3. Accumulation of Out-of-Control Score and Circuit Breaker Trigger: In each statistical period where current limiting is not triggered, the out-of-control score is multiplied by the attenuation coefficient λ. If the same channel continuously triggers a level 2 anomaly, the out-of-control score will continue to accumulate.

[0148] When the out-of-control score of a channel exceeds a preset emergency threshold, a level 3 circuit breaker is triggered. The circuit breaker action is handled separately according to the channel type: Wireless Channel: Disables the enable GPIO of the corresponding wireless module.

[0149] Wired Channel: Setting the enable GPIO of the corresponding switch to high level opens the switch, physically cutting off the signal path. Simultaneously with the fuse tripping, the second controller sends a pulse signal to the first controller via the interrupt pin and writes the timestamp of the fuse tripping event, the channel identifier, and the frequency statistics at the time of triggering to the internal Flash log area.

[0150] Phase 5: Physical button restoration; After an emergency circuit breaker occurs, recovery can only be achieved manually via a physical button. If the user presses and holds the button on the device for a preset duration (e.g., 3 seconds), the second controller detects this long-press event through timed sampling and then executes the recovery action. Restore the GPIO corresponding to the fuse channel to an active level; mark the channel status as an observation period and start the software timer; temporarily tighten the threshold during the observation period; if there is no abnormality after the observation period, restore all normal parameters.

[0151] Among them, the threshold can refer to anomaly detection parameters, such as: the maximum number of operations in a single device sliding window (N1), the maximum number of operations in an associated device group window (N2), the maximum number of instructions in a global window (N3), and the timing deviation threshold (Z_th).

[0152] During the observation period, these thresholds (i.e., abnormal threshold information) can be set more stringent than normal values ​​(i.e., the values ​​become smaller, and the tolerance decreases). For example: normal N1 = 10 times / minute, observation period N1 = 5 times / minute, normal Z_th = 3σ, observation period Z_th = 2σ.

[0153] During the observation period, instead of immediately returning to normal sensitivity, the sensitivity for anomaly detection is temporarily increased (threshold tightened) to verify whether the AI ​​agent has truly recovered. If no anomalies are found during the observation period, the normal threshold is restored; if anomalies are found, the circuit breaker is immediately triggered again.

[0154] 5.3 Key Algorithm Details: O(1) Sliding Window Statistics; To ensure real-time performance on resource-constrained MCUs, single-device frequency statistics employ a time-slicing and differential accumulation method. A fixed-length window is divided into several equal-length time slices, and a circular counter array and a sum variable are maintained in memory for each device.

[0155] When a new control command arrives, the corresponding target slice index is determined based on the current time. It is then checked whether the target time slice corresponding to the target slice index has expired. If it has expired, the old count value of the target time slice is subtracted from the sum of the runaway scores and cleared to zero. Then, the count of the new control command is incremented and the sum is updated.

[0156] The total variable represents the total number of instructions within the current window. The entire process involves only a few memory reads and writes and integer additions and subtractions, with no loops or traversals, ensuring that the detection does not interfere with the normal instruction forwarding rate.

[0157] For example, the following parameters are set: Slide window duration: 60 seconds (e.g., operation records within the past 60 seconds); Number of time slices: 10 (each slice is 6 seconds, because 60 seconds / 10 = 6 seconds / slice); Device ID: Device A; Circular counting array: An array of size 10 (index 0-9), initially all elements are 0; The total variable, i.e., the sum of the runaway scores: total_count=0; Current time: expressed in seconds (e.g., the time since the system started up); A circular counting array [0, 0, 0, 0, 0, 0, 0, 0, 0, 0] contains 10 time slices, with the count for each time slice initialized to 0.

[0158] Total variable: 0, the total number of operations performed on device A within the current window; Event 1: t = 10 seconds (the operation command of smart device A arrives); Calculate the shard index: Split size = Window duration / Number of splits = 60 / 10 = 6 seconds; Target shard index = floor(10 / 6) = floor(1.666) = 1; Index 1 corresponds to the time interval [6, 12) seconds; Check if the fragments are outdated: Current window start time = t - window duration = 10 - 60 = -50 seconds; The end time of slice 1 = (1+1)*6 = 12 seconds; Check: 12 is greater than 50, so the judgment is not outdated.

[0159] Update the count: array[1] += 1, now the count is [0, 1, 0, 0, 0, 0, 0, 0, 0, 0] The sum = 0 + 1 = 1; Current status: Window: [-50, 10] seconds (including operations at t=10); Total number of operations: 1.

[0160] Event 2: t=55 seconds (the operation command of smart device A arrives); Calculate the shard index: The target shard index = floor(55 / 6) = floor(9.166) = 9; index 9 corresponds to [54, 60) seconds.

[0161] Check if the fragments are outdated: Window start time = 55 - 60 = -5 seconds; The end time of segment 9 = (9+1)*6 = 60 seconds; Check: 60 > 5, the judgment is not outdated.

[0162] Update the count: array [9] += 1, the count is now [0, 1, 0, 0, 0, 0, 0, 0, 1]; The total sum = 1 + 1 = 2; Current status: Window: [-5, 55] seconds; Total number of operations: 2.

[0163] Event 3: t = 65 seconds (the operation command from smart device A arrives); Calculate the shard index: The shard index = floor(65 / 6) = floor(10.833) = 10; since the number of shards = 10, the index modulo is 10%10 = 0. Index 0 corresponds to the [0, 6) seconds, but due to the array loop, index 0 actually represents the shard corresponding to the current time.

[0164] Check if the fragments are outdated: Window start time = 65 - 60 = 5 seconds; Fragment 0 end time = (0+1)*6 = 6 seconds; Check: 6 > 5, therefore it is not outdated. In the [0, 6) of fragment 0, [5, 6) is within the window [5, 65], therefore it is not outdated.

[0165] Update the count: array[0] += 1, now the count is [1, 1, 0, 0, 0, 0, 0, 0, 1]; array[0] was originally 0, now it is 1.

[0166] The total is 2 + 1 = 3.

[0167] Current status: Window: [5, 65] seconds; Operations within the window: t=10, 55, 65 (3 times); t=10 and 55 are both within [5, 65] (t=10≥5, t=55≥5).

[0168] Event 5: t=120 seconds (operation command from smart device A arrives), handle stale fragments: Calculate the shard index: Sharding index = floor(120 / 6) = 20, 20%10 = 0; index 0 represents the current time shard.

[0169] Check if the fragments are outdated: Window start time = 120 - 60 = 60 seconds; Fragment 0 end time = (0+1)*6 = 6 seconds; Check: 6 < 60, deemed outdated; fragment 0's [0, 6) is completely outside the window [60, 120].

[0170] Handling outdated fragments: Subtract the old value of array [0] from the sum: sum = 4 - 1 = 3; Clear array[0] to zero: array[0] = 0; Added instruction counter: array[0]+=1 becomes array[0]=1; Update the sum: Sum = 2 + 1 = 3; Current status: Window: [60, 120] seconds; Operations within the window: t=65, 120 (twice).

[0171] Through the above embodiments, the security monitoring function can be completely separated from the first controller running the AI, forming a physically isolated independent defense. Different fuse methods, namely power cut-off and signal path cut-off, are employed to address the different characteristics of wireless and wired communication, ensuring that all communication paths can be effectively blocked. The fuse action is directly driven by the security coprocessor and does not rely on any software instructions from the main controller. Even if the AI ​​agent and operating system running on the first controller completely crash, the second controller can still operate independently and physically cut off the connection by changing the GPIO level when an anomaly is detected. For wireless devices, complete isolation is achieved by power failure; for wired devices, control commands are blocked by cutting off the signal path. The response latency is determined solely by the hardware flip-flop speed, providing a deterministic and unbypassable forced blocking capability.

[0172] In addition, the second controller maintains a circular queue to record the device ID, operation type, and timestamp of all recent instructions. Each time a new instruction arrives, the statistics are updated in O(1) complexity, and four detection rules are executed in parallel: (a) high-frequency detection of a single device; (b) high-frequency detection of associated device groups; (c) operation interval timing deviation detection; and (d) global instruction rate detection. All threshold parameters are preset by the user through a security configuration tool before deployment and are not automatically adjusted during MCU operation. This application embodiment designs multi-dimensional detection rules for AI behavior characteristics. Rule (a) captures repetitive decision loops on the same device; rule (b) identifies abnormal linkages across devices; and rule (c) updates the operation interval statistics online through an exponentially weighted moving average to capture operation intervals that deviate from the normal pattern. All rules share the same sliding window data structure, resulting in extremely low computational overhead. This analysis method can achieve complex abnormal behavior analysis on independent MCUs with extremely limited resources (RAM is usually only a few KB), covering multiple dimensions such as single device, multi-device association, and timing patterns, and effectively identifies typical abnormal behavior patterns of AI agents.

[0173] Furthermore, this application also proposes a tiered response and mandatory rate limiting mechanism, which can implement different levels of response mechanisms according to the severity of the anomaly: 1. Level 3 Response (Alarm): Records the anomaly but does not block it; suitable for minor anomalies. 2. Level 2 Response (Forced Rate Limiting): Implements instruction queue rate limiting within the security coprocessor, suitable for moderate exceptions. 3. Level 1 Response (Circuit Breaker): Completely cuts off the control path; suitable for severe anomalies. Furthermore, the response mechanism incorporates an out-of-control score accumulation mechanism: when a level 2 anomaly is triggered, the out-of-control score is increased; when there is no anomaly, the score is gradually reduced according to the attenuation coefficient; and when the score exceeds the emergency threshold, a level 1 circuit breaker is triggered.

[0174] This application upgrades the traditional single circuit breaker strategy to a tiered response system. The second-level response employs forced current limiting within the MCU, independent of the main controller. An out-of-control scoring mechanism accumulates anomaly levels; consecutive triggering of second-level anomalies on the same channel will continuously increase the score until the circuit breaker is triggered. Physical button hard recovery eliminates remote attack paths. Through this application's implementation, the impact of excessive protection on the normal user experience can be avoided, while ensuring timely and effective blocking in truly dangerous situations. The forced current limiting mechanism is independent of the main controller processor, ensuring high reliability. The recovery method is simple and reliable, eliminating the risk of remote control.

[0175] Reference Figure 6This illustration shows a structural diagram of a response device for abnormal control behavior according to an embodiment of this application. The device is applied to a central control unit, which is connected to a smart device. The central control unit includes a first controller and a second controller, which are communicatively connected. The second controller is also communicatively connected to the smart device. The device may include the following modules: The receiving module 601 is used for the second controller to receive the target control command for the smart device generated by the first controller. The judgment module 602 is used to determine whether the first controller has abnormal control behavior based on the target control command; The intervention module 603 is used to intervene in the transmission of target control commands when it is determined that the first controller has abnormal control behavior.

[0176] In some embodiments, the intervention module 603 is used to determine the target anomaly level of the abnormal control behavior and the target intervention strategy corresponding to the target anomaly level; and to intervene in the transmission of the target control command according to the target intervention strategy.

[0177] In some embodiments, a switch is provided on the communication link between the second controller and the smart device; when the target anomaly level is level one, the intervention module 603 is used to disconnect the switch to disconnect the communication connection between the smart device and the second controller.

[0178] In some embodiments, the smart devices include multiple devices; the second controller communicates with the multiple smart devices via a wireless communication module or a wired communication module; the switch includes a first switch and a second switch, the first switch is connected to the wireless communication module, the second switch is connected to the wired communication module, and the intervention module 603 is used to determine the target switch from the first switch and the second switch according to the target control command; disconnect the target switch to disconnect the power supply to the wireless communication module and / or disconnect the communication connection between the wired communication module and the smart devices.

[0179] In some embodiments, the smart devices include multiple smart devices, and each smart device corresponds to a switch; the intervention module 603 is used to determine the target smart device from the multiple smart devices according to the target control command, and determine the target switch corresponding to the target smart device; disconnect the target switch to disconnect the communication connection between the target smart device and the second controller.

[0180] In some embodiments, when the target anomaly level is level two, the intervention module 603 is used to determine the remaining capacity of the target token bucket and to determine whether the remaining capacity meets the target control command; when the remaining capacity meets the target control command, the target control command is sent to the smart device; when the remaining capacity cannot meet the target control command, the sending of the target control command is restricted.

[0181] In some embodiments, the intervention module 603 is used to calculate an out-of-control score when the target anomaly level is level two; and when the current out-of-control score exceeds a preset threshold, adjust the target anomaly level from level two to level one.

[0182] In some embodiments, the apparatus further includes: The index building module is used to divide a preset time window into multiple time slices, each time slice corresponding to a slice index. Intervention module 603 is used to determine the current time of receiving the target control command and to determine the target segment index corresponding to the current time; based on the target segment index, it determines the target time segment, and based on the target time segment and the current time, it determines whether the target time segment has expired; when the target time segment has not expired, it updates the count of the target time segment, and determines the current runaway score based on the previously determined runaway score and the updated count; when the target time segment has expired, it determines the existing count of the target time segment and the new count of the target time segment, and determines the current runaway score based on the previously determined runaway score, the existing count of the target time segment, and the new count of the target time segment.

[0183] In some embodiments, the intervention module 603 is used to detect the target smart device targeted by the abnormal control behavior, as well as devices associated with the target smart device, to obtain abnormal detection information; and to determine the target abnormality level based on the abnormal detection information.

[0184] In some embodiments, the intervention module 603 is used to determine the intervention behavior of the control command at a historical time, and determine the current abnormal threshold information based on the intervention behavior; and determine the target abnormality level based on the abnormal threshold information and abnormal detection information.

[0185] In this embodiment, the second controller receives target control commands for the smart device generated by the first controller; based on the target control commands, it determines whether the first controller exhibits abnormal control behavior; when abnormal control behavior is detected, it intervenes in the transmission of the target control commands. This embodiment completely separates the security monitoring function from the first controller that controls the smart device, forming a physically isolated independent defense. Even if the model and operating system running on the first controller completely crash, the second controller can still work independently and intervene when an anomaly is detected.

[0186] This application also provides an electronic device, including a processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein the computer program, when executed by the processor, implements a response method for the above-mentioned abnormal control behavior.

[0187] This application also provides a computer-readable storage medium on which a computer program is stored, and a response method for implementing the above-mentioned abnormal control behavior when the computer program is executed by a processor.

[0188] As the device embodiment is basically similar to the method embodiment, the description is relatively simple, and relevant parts can be found in the description of the method embodiment.

[0189] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.

[0190] Those skilled in the art will understand that embodiments of this application can be provided as methods, apparatus, or computer program products. Therefore, embodiments of this application can take the form of entirely hardware embodiments, entirely software embodiments, or embodiments combining software and hardware aspects. Furthermore, embodiments of this application can take the form of computer program products implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0191] This application describes embodiments with reference to flowchart illustrations and / or block diagrams of methods, terminal devices (systems), and computer program products according to embodiments of this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing terminal device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing terminal device, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0192] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing terminal device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0193] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal equipment, causing a series of operational steps to be performed on the computer or other programmable terminal equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable terminal equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0194] Although preferred embodiments of the present application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the embodiments of the present application.

[0195] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or terminal device. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or terminal device that includes said element.

[0196] The above provides a detailed description of the response method, apparatus, device, medium, and central control host for abnormal control behavior. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A response method for abnormal control behavior, characterized in that, The method is applied to a central control unit, which is connected to an intelligent device; the central control unit includes a first controller and a second controller, the first controller being communicatively connected to the second controller, and the second controller being communicatively connected to the intelligent device; the method includes: The second controller receives the target control command for the smart device generated by the first controller; Based on the target control command, determine whether the first controller exhibits abnormal control behavior; When it is determined that the first controller has abnormal control behavior, the transmission of the target control command is intervened.

2. The method according to claim 1, characterized in that, The intervention in the transmission of the target control command includes: Determine the target anomaly level of the abnormal control behavior, and determine the target intervention strategy corresponding to the target anomaly level; According to the target intervention strategy, the transmission of the target control command is intervened.

3. The method according to claim 2, characterized in that, A switch is provided on the communication link between the second controller and the smart device; when the target anomaly level is level one, the intervention in the transmission of the target control command according to the target intervention strategy includes: Disconnect the switch to break the communication connection between the smart device and the second controller.

4. The method according to claim 3, characterized in that, The smart devices include multiple devices; the second controller communicates with the multiple smart devices via a wireless communication module or a wired communication module; the switch includes a first switch and a second switch, the first switch being connected to the wireless communication module, and the second switch being connected to the wired communication module; disconnecting the switch to disconnect the communication connection between the smart devices and the second controller includes: According to the target control command, the target switch is determined from the first switch and the second switch; Disconnect the target switch to disconnect the power supply to the wireless communication module and / or disconnect the communication connection between the wired communication module and the smart device.

5. The method according to claim 3, characterized in that, The smart devices include multiple devices, with one smart device corresponding to one switch; disconnecting the switch to break the communication connection between the smart device and the second controller includes: According to the target control command, the target smart device is determined from multiple smart devices, and the target switch corresponding to the target smart device is determined; Disconnect the target switch to break the communication connection between the target smart device and the second controller.

6. The method according to claim 2, characterized in that, When the target anomaly level is level two, the intervention in the transmission of the target control command according to the target intervention strategy includes: Determine the remaining capacity of the target token bucket and determine whether the remaining capacity satisfies the target control command; When the remaining bucket capacity meets the target control command, the target control command is sent to the smart device; When the remaining bucket capacity is insufficient to meet the target control command, the transmission of the target control command is restricted.

7. The method according to claim 6, characterized in that, Determining the target anomaly level of the anomaly control behavior includes: When the target anomaly level is level two, a runaway score is calculated. When the current out-of-control score exceeds a preset threshold, the target abnormality level is adjusted from level two to level one.

8. The method according to claim 7, characterized in that, The method further includes: The preset duration window is divided into multiple time slices, and each time slice corresponds to a slice index. The runaway scoring includes: Determine the current time when the target control command is received, and determine the target fragment index corresponding to the current time; Based on the target shard index, the target time shard is determined, and based on the target time shard and the current time, it is determined whether the target time shard has expired. When the target time slice has not expired, update the count of the target time slice, and determine the current out-of-control score based on the previously determined out-of-control score and the updated count; When the target time slice has expired, determine the existing count of the target time slice and the new count of the target time slice, and determine the current out-of-control score based on the previously determined out-of-control score, the existing count of the target time slice, and the new count of the target time slice.

9. The method according to claim 2, characterized in that, Determining the target anomaly level of the anomaly control behavior includes: The abnormal control behavior targets the intelligent device and the devices associated with the intelligent device, and abnormal detection information is obtained. The target anomaly level is determined based on the anomaly detection information.

10. The method according to claim 9, characterized in that, Determining the target anomaly level based on the anomaly detection information includes: Determine the intervention behavior of control commands at historical moments, and determine the current abnormal threshold information based on the intervention behavior; The target anomaly level is determined based on the anomaly threshold information and the anomaly detection information.

11. A central control host, characterized in that, The central control unit is connected to the intelligent device; the central control unit includes: A first controller is used to generate target control commands for the intelligent device; The second controller is communicatively connected to the first controller; the second controller is used to receive the target control command and, based on the target control command, determine whether the first controller has abnormal control behavior; when it is determined that the first controller has abnormal control behavior, it intervenes in the transmission of the target control command.

12. The central control unit according to claim 11, characterized in that, The central control unit also includes: The wireless communication module is powered by a first switch, and the enable pin of the first switch is connected to the first pin of the second controller. The wired communication module has its data input terminal connected to the first controller via a second switch; the enable pin of the second switch is connected to the second pin of the second controller. The second controller is used to change the level of the first pin and / or the second pin.

13. A response device for abnormal control behavior, characterized in that, An application is made in a central control unit, which is connected to an intelligent device; the central control unit includes a first controller and a second controller, the first controller being communicatively connected to the second controller, and the second controller being communicatively connected to the intelligent device; the device includes: The receiving module is used for the second controller to receive the target control command for the smart device generated by the first controller; The judgment module is used to determine whether the first controller has abnormal control behavior based on the target control command; The intervention module is used to intervene in the transmission of the target control command when it is determined that the first controller has abnormal control behavior.

14. An electronic device, characterized in that, It includes a processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein the computer program, when executed by the processor, implements a response method for abnormal control behavior as described in any one of claims 1 to 10.

15. A computer-readable storage medium, characterized in that, A computer program is stored on the computer-readable storage medium, which, when executed by a processor, implements a response method for abnormal control behavior as described in any one of claims 1 to 10.

Images