Industrial internet of things abnormal traffic detection method and system based on graph neural network

Abstract

The present application relates to the technical field of Internet of Things anomaly detection, and in particular to an industrial Internet of Things anomaly flow detection method and system based on a graph neural network, comprising the following steps: synchronously acquiring macroscopic motion, microscopic vibration and network flow data of a mobile terminal device; deducing a topology change prediction probability and a physical interface jitter prediction feature; constructing a double-scale physical constraint dynamic graph including a node feature matrix and an edge attribute weight; calculating an expected flow baseline according to physical data and finding the difference between the expected flow baseline and real flow to peel off physical interference; inputting a flow residual matrix and a dynamic graph into a graph neural network to derive a residual response vector; calculating an abnormal flow confidence score in combination with an operating condition mode and determining an abnormality; and differentiating and outputting a hardware fault early warning or network isolation instruction according to the determination result and the physical interface jitter feature. The present application realizes accurate peeling off of physical interference and network attacks, effectively reduces the false positive rate and realizes root cause differentiated protection.

Description

Technical Field

[0001] This invention relates to the field of IoT anomaly detection technology, specifically to an industrial IoT anomaly traffic detection method and system based on graph neural networks. Background Technology

[0002] The Industrial Internet of Things (IIoT) is a core infrastructure that deeply integrates sensing, communication, computing, and control technologies into modern industrial production. With the advancement of smart manufacturing, a large number of mobile terminal devices within factories (such as Automated Guided Vehicles (AGVs), Autonomous Mobile Robots (AMRs), and heavy-duty intelligent vehicle terminals) are connected to hybrid industrial wireless and bus networks, enabling automated collaboration in production logistics and manufacturing processes. During the operation of the IIoT, anomaly detection of network traffic is a crucial protective measure to ensure the network security and physical production safety of industrial systems. In recent years, traffic detection technology based on graph neural networks has become an important development trend in this field. It maps industrial network nodes to graph nodes and communication links to graph edges, utilizing the learning capabilities of graph structures to capture abnormal traffic characteristics in complex network topologies.

[0003] Existing industrial IoT traffic anomaly detection technologies based on graph neural networks typically extract network layer features such as packet throughput, arrival time interval, message sequence number, and error rate to construct static or dynamic communication topology graphs. They then utilize graph convolution or graph attention mechanisms to aggregate features of neighboring nodes to output anomaly detection results. This technology can effectively capture non-Euclidean spatial correlation features in multi-node interactions, achieving end-to-end identification of network attacks such as distributed denial-of-service attacks and data tampering. However, in industrial IoT scenarios involving mobile heavy-duty equipment or inspection robots, the equipment inevitably undergoes continuous macroscopic spatial migration and microscopic mechanical vibrations from the chassis power system during operation. When equipment passes through dense areas of metal equipment or roams, spatial obstruction and channel switching can cause drastic changes in network topology. Simultaneously, the severe mechanical vibrations generated by machine operation can induce microsecond-level contact resistance jitter in the vehicle's communication antenna and hardware interface, leading to high-frequency transient packet retransmissions and bursts of error frames. Existing graph neural network technology extracts topology and traffic features only from the pure data domain, lacking the ability to perceive the physical kinematic characteristics and mechanical vibration state of equipment. It is very easy to misjudge topology changes caused by normal physical movement of equipment and message jitter caused by mechanical vibration as spoofed node attacks, man-in-the-middle hijacking or denial-of-service attacks, resulting in an extremely high false alarm rate for abnormal traffic detection. Hardware resources are occupied by a large number of invalid alarms, which seriously affects the practical application benefits of industrial IoT security protection mechanisms in dynamic and complex industrial sites.

[0004] Therefore, there is an urgent need for an abnormal flow detection method for the Industrial Internet of Things to solve the problems mentioned above. Summary of the Invention

[0005] In view of the above-mentioned shortcomings of the existing technology, the present invention provides an industrial Internet of Things abnormal traffic detection method and system based on graph neural network, which can effectively solve the problems mentioned in the existing technology.

[0006] To achieve the above objectives, the present invention provides the following technical solution:

[0007] This invention provides an industrial IoT abnormal traffic detection method based on graph neural networks, the specific steps of which include:

[0008] S100: Acquire macroscopic motion data, microscopic vibration data, and industrial network traffic data corresponding to the industrial IoT mobile terminal device.

[0009] S200. Calculate the topology change prediction probability based on the macroscopic motion data, and calculate the physical interface jitter prediction characteristics based on the microscopic vibration data.

[0010] S300. Combining the topology change prediction probability, the physical interface jitter prediction characteristics, and the industrial network traffic data, a dual-scale physical constraint dynamic graph including node feature matrix and edge attribute weights is constructed.

[0011] S400. Input the dual-scale physical constraint dynamic graph into a pre-trained graph neural network for graph convolution aggregation processing, and calculate the residual response vector that reflects the deviation between the true characteristics of network traffic and the evolution law of physical motion-mechanical vibration.

[0012] S500: Calculate the abnormal traffic confidence score based on the residual response vector, and when the abnormal traffic confidence score is greater than a preset score threshold, determine that there is a traffic anomaly in the industrial network traffic data, and output the corresponding traffic anomaly detection result.

[0013] Furthermore, the acquisition of macroscopic motion data, microscopic vibration data, and industrial network traffic data corresponding to the industrial IoT mobile terminal device includes:

[0014] The macroscopic motion data, including spatial three-dimensional coordinates, motion velocity vector, and access point signal gradient, is acquired in real time through the positioning module and motion sensor.

[0015] The microscopic vibration data, including the vibration spectrum energy distribution and interface physical layer voltage fluctuation characteristics, is acquired in real time through a triaxial accelerometer and a physical layer sampling module.

[0016] The industrial network traffic data, including message retransmission rate, inter-frame arrival delay jitter, and packet loss rate within a preset time window, is obtained through the network interface.

[0017] Furthermore, the construction of a dual-scale physically constrained dynamic graph, including node feature matrices and edge attribute weights, includes:

[0018] Extract the spatial three-dimensional coordinates of node i and node j at a predetermined time t from the macroscopic motion data, and calculate the Euclidean distance between node i and node j.

[0019] The micro-vibration data is subjected to time-frequency conversion processing to extract the total energy of the vibration spectrum at node i;

[0020] Statistically analyze the historical traffic throughput of nodes i and j within a preset time window in the industrial network traffic data;

[0021] The reciprocal of the Euclidean distance, the exponential decay term of the total energy of the vibration spectrum, and the historical throughput are multiplied by preset spatial weight coefficients, preset vibration decay coefficients, and preset flow correlation coefficients, respectively, and then weighted and summed. The summation result is then normalized and mapped using a preset activation function to calculate the edge attribute weight between node i and node j. :

[0022] ;

[0023] in, Use the Sigmoid activation function; and These are the three-dimensional spatial coordinates of node i and node j at the predetermined time t; The distance is Euclidean. The total energy of the vibration spectrum of node i at the predetermined time t; Indicates historical throughput; , , These are the preset spatial weighting coefficient, the preset vibration attenuation coefficient, and the preset flow correlation coefficient, respectively. The preset vibration sensitivity adjustment constant; For the smallest positive constant used for logarithmic smoothing;

[0024] The edge attribute weights are assigned to the dual-scale physical constraint dynamic graph as the connectivity strength and information transmission attenuation factor of the edge topology.

[0025] Furthermore, the step of calculating the topological change prediction probability based on the macroscopic motion data includes:

[0026] The macroscopic motion data is input into a preset kinematic prediction model to deduce the spatial prediction position of the mobile terminal device at the next predetermined sampling time.

[0027] Based on the predicted spatial location and the preset spatial physical location of each candidate access point, the estimated signal coverage of each candidate access point is calculated.

[0028] The communication link corresponding to the estimated signal coverage being lower than the preset signal threshold is identified as the predicted disconnect topology, and the topology change prediction probability of the mobile terminal device undergoing access point roaming handover is calculated.

[0029] Furthermore, the calculation of the residual response vector, which reflects the deviation between the true characteristics of network traffic and the evolution law of physical motion-mechanical vibration, includes:

[0030] The macroscopic motion data and the microscopic vibration data are combined and spliced ​​into a physical state vector, which is then input into a preset physical co-mapping model to solve and obtain the expected physical expected flow feature vector.

[0031] The industrial network traffic data is extracted into a real traffic feature vector, and the real traffic feature vector is subtracted from the physical expected traffic feature vector element by element and the absolute value is processed to remove the physical interference caused by mechanical vibration and motion roaming, and a traffic difference residual matrix is ​​generated.

[0032] The residual matrix of the flow difference is combined with the dynamic graph of the dual-scale physical constraints and input into a pre-trained graph neural network. Multi-layer spatiotemporal graph convolution aggregation operation is performed to calculate and derive the residual response vector R(t):

[0033] ;

[0034] in, This is the actual traffic feature vector; This is the physical expected flow feature vector; The residual matrix of the flow difference; This is the dynamic graph of the dual-scale physical constraints; This refers to the spatiotemporal graph convolution aggregation operation in graph neural networks.

[0035] Furthermore, the step of inputting the dual-scale physical constraint dynamic graph into a pre-trained graph neural network for graph convolution aggregation processing includes:

[0036] The pre-defined graph attention network is used to extract the weighted physical association representation of each node and its neighboring nodes in the spatial dimension of the dual-scale physical constraint dynamic graph.

[0037] The dynamic evolution features of each node in the time dimension are aggregated along a preset temporal window using a preset temporal convolutional network.

[0038] By combining the physical weighted correlation representation with the dynamic evolution characteristics, a multidimensional high-order spatiotemporal feature map matrix is ​​generated, and the residual response vector is derived by mapping.

[0039] Furthermore, the step of calculating the abnormal traffic confidence score based on the residual response vector includes:

[0040] Based on the current operating mode of the mobile terminal device, the preset basic scoring threshold is dynamically adjusted to obtain the preset scoring threshold that matches the current operating mode.

[0041] Calculate the relative deviation of the information entropy between the magnitude of the residual response vector and the preset reference response vector;

[0042] The abnormal traffic confidence score is calculated based on the relative deviation of the information entropy.

[0043] Furthermore, the step of calculating the abnormal traffic confidence score based on the relative deviation of the information entropy includes:

[0044] For the residual response vector By performing a second-norm calculation, the norm term of the response amplitude is obtained.

[0045] The component values ​​of the residual response vector in each dimension are normalized, and the relative entropy between the normalized component values ​​and the preset benchmark mean values ​​of the historical benchmark response vector in each dimension is calculated to obtain the entropy deviation term of the abnormality of the response distribution.

[0046] After multiplying the norm term and the entropy deviation term by preset coefficients, the complementary values ​​are obtained by substituting them into the exponential negative decay function, and the abnormal flow confidence score is calculated and derived. :

[0047] ;

[0048] in, Confidence score for abnormal traffic; Let L be the norm of the residual response vector; is the dimension of the residual response vector; is the normalized component value of the residual response vector in the k-th dimension; The preset baseline mean; and These are the preset norm penalty term adjustment coefficient and entropy deviation adjustment coefficient, respectively;

[0049] The calculated abnormal traffic confidence score is input into the judgment unit and compared with the preset scoring threshold.

[0050] Furthermore, after outputting the corresponding traffic anomaly detection result, it also includes:

[0051] When it is determined that there is abnormal traffic and the physical interface jitter prediction feature indicates poor mechanical physical contact, a hardware physical fault warning command is output to the equipment operation and maintenance terminal.

[0052] When abnormal traffic is detected and the physical interface jitter prediction feature indicates no mechanical or physical contact problems, a network attack alarm command is output to the network security protection terminal, and the network isolation policy of the corresponding abnormal node is triggered.

[0053] An industrial IoT abnormal flow detection system based on graph neural networks includes:

[0054] The data acquisition module is used to acquire macroscopic motion data, microscopic vibration data, and industrial network traffic data corresponding to the industrial IoT mobile terminal device.

[0055] The physical feature prediction module is used to calculate the topology change prediction probability based on the macroscopic motion data and to calculate the physical interface jitter prediction feature based on the microscopic vibration data.

[0056] The dynamic graph construction module is used to combine the topology change prediction probability, the physical interface jitter prediction characteristics, and the industrial network traffic data to construct a dual-scale physical constraint dynamic graph including node feature matrix and edge attribute weights.

[0057] The neural network processing module is used to input the dual-scale physical constraint dynamic graph into a pre-trained graph neural network for graph convolution aggregation processing, and calculate the residual response vector that reflects the deviation between the true characteristics of network traffic and the evolution law of physical motion-mechanical vibration.

[0058] The anomaly decision module is used to calculate the anomaly traffic confidence score based on the residual response vector, and when the anomaly traffic confidence score is greater than a preset score threshold, determine that there is a traffic anomaly in the industrial network traffic data, and output the corresponding traffic anomaly detection result.

[0059] The technical solution provided by this invention has the following advantages compared with the known prior art:

[0060] This invention addresses the issue of physical packet loss, retransmission, and latency jitter that easily occur in industrial mobile terminals during mechanical vibration and spatial roaming. It incorporates macroscopic motion data and microscopic vibration data into a graph structure, forming a dual-scale physically constrained dynamic graph. Simultaneously, a physical co-mapping model extracts and isolates the expected traffic fluctuation baseline caused by physical factors, leaving only the pure traffic residuals as input to a graph neural network for spatiotemporal convolution processing. This mechanism fundamentally solves the problem of traditional detection methods easily misjudging normal physical disturbances such as mechanical jitter, interface micro-short circuits, and wireless roaming as network attacks, significantly improving the accuracy and robustness of abnormal traffic detection.

[0061] This invention overcomes the limitations of traditional detection schemes that can only determine the presence of abnormal traffic. By cross-referencing the residual response vector calculated by a graph neural network with the predicted features of physical interface jitter, it can accurately distinguish the underlying causes of abnormal traffic: when abnormal traffic is present and poor contact is indicated, it accurately identifies it as a loose physical hardware line and outputs an operation and maintenance warning; when abnormal traffic is present but there is no hardware fault, it accurately determines it as a malicious network attack and triggers a network isolation strategy. This provides a differentiated protection strategy with root cause localization capabilities for industrial sites, effectively improving the efficiency of on-site operation and maintenance and security protection. Attached Figure Description

[0062] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are merely some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without any creative effort.

[0063] Figure 1 This is a schematic diagram of the method flow of the present invention;

[0064] Figure 2 This is a schematic diagram of the system structure of the present invention. Detailed Implementation

[0065] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0066] The present invention will be further described below with reference to embodiments.

[0067] Example:

[0068] Reference Figure 1 An industrial IoT abnormal traffic detection method based on graph neural networks includes the following steps:

[0069] S100. At the predetermined sampling time, simultaneously acquire macroscopic motion data, microscopic vibration data, and industrial network traffic data corresponding to the industrial IoT mobile terminal device. Specifically, through the positioning module and motion sensor configured on the industrial mobile terminal device, acquire macroscopic motion data in real time, including spatial three-dimensional coordinates, motion velocity vector, and access point signal gradient; through the triaxial accelerometer and physical layer sampling module installed close to the mechanical frame and bus interface of the industrial mobile terminal device, acquire microscopic vibration data in real time, including the time-domain vibration spectrum energy distribution of the mechanical frame and the voltage fluctuation characteristics of the interface physical layer; simultaneously, acquire industrial network traffic data through the network interface, including message retransmission rate, inter-frame arrival delay jitter, and packet loss rate within a preset time window.

[0070] S200: After acquiring the data, physical feature predictions are performed based on both the macroscopic motion dimension and the microscopic physical dimension. In the macroscopic motion dimension, macroscopic motion data is input into a preset kinematic prediction model to deduce the spatial prediction position of the industrial mobile terminal device at the next predetermined sampling time. Based on the spatial prediction position and the preset spatial physical positions of each candidate wireless access point, the estimated signal coverage of each candidate wireless access point is calculated. When the estimated signal coverage of a certain communication link is lower than a preset signal threshold, the communication link is identified as a predicted disconnected topology, and the topology change prediction probability of the industrial mobile terminal device undergoing wireless access point roaming handover is calculated. In the microscopic physical dimension, microscopic vibration data is input into a preset physical layer damping mapping model to extract high-frequency vibration energy peaks and voltage mutation waveforms. The physical interface jitter prediction features indicating the microscopic physical contact state of the interface are calculated to characterize the degree of interference of mechanical physical jitter on the data link layer.

[0071] Specifically, the physical layer damping mapping model can be a multilayer perceptron (MLP) or support vector regression (SVR) model pre-trained on a fault-free mechanical jitter test set, used to establish a nonlinear mapping between micro-vibration characteristics and interface voltage fluctuations.

[0072] S300, combining topology change prediction probability, physical interface jitter prediction features, and industrial network traffic data, constructs a dual-scale physical constraint dynamic graph including node feature matrices and edge attribute weights. Among them, among them, A two-scale physical constraint dynamic graph constructed for a predetermined time t; It is a set of graph vertices consisting of N communication nodes in an Industrial Internet of Things (IIoT). It is the set of graph edges formed by the wireless communication links between the communication nodes; The node feature matrix at time t (D is the node feature dimension). This represents the edge attribute weight matrix at a predetermined time t.

[0073] Specifically, the node feature matrix The feature vectors of each node are obtained by concatenating the industrial network traffic data and micro-vibration data of the corresponding communication nodes dimension by dimension. To accurately map physical spatial distance and mechanical vibration physical interference into the graph topology, the edge attribute weights between node i and node j are... (i.e., edge attribute weight matrix) The matrix element in the i-th row and j-th column is calculated as follows: Extract the three-dimensional spatial coordinates of node i and node j at a predetermined time t from the macroscopic motion data. and Calculate the Euclidean distance between the two. The micro-vibration data is processed by time-frequency conversion to extract the total energy of the vibration spectrum at node i. ; Statistical analysis of industrial network traffic data, including the historical traffic throughput of nodes i and j within a preset time window. Subsequently, the reciprocal of the Euclidean distance, the exponential decay term of the total energy of the vibration spectrum, and the historical throughput are multiplied by preset spatial weighting coefficients. Preset vibration attenuation coefficient Correlation coefficient with preset flow rate Then, a weighted sum is performed, and the summation result is passed through a preset sigmoid activation function. The normalized mapping is calculated using the following formula:

[0074] ;

[0075] in, Use the Sigmoid activation function; and These are the three-dimensional spatial coordinates of node i and node j at the predetermined time t; The distance is Euclidean. The total energy of the vibration spectrum of node i at the predetermined time t; Indicates historical throughput; , , These are preset spatial weighting coefficient, preset vibration attenuation coefficient, and preset flow correlation coefficient, respectively. The preset vibration sensitivity adjustment constant; For the smallest positive constants used for logarithmic smoothing (e.g.) This is used to prevent the denominator from being zero when nodes coincide in spatial location. The calculated edge attribute weights are then used. The connectivity strength and information transmission attenuation factor of the edge topology are assigned to the edge attribute weight matrix. And give it a dynamic graph with dual-scale physical constraints. This allows subsequent neural networks to automatically absorb topological inhibition caused by physical motion and vibration when performing graph convolution.

[0076] S400 performs physical interference stripping and neural network graph convolution processing. First, the macroscopic motion data... With micro vibration data The vectors are combined and concatenated to form a physical state vector, which is then input into a pre-defined physical co-mapping model. In the process, the expected physical flow feature vector is obtained through calculation. First, it represents the baseline of normal traffic fluctuations under the current physical conditions; second, it extracts the industrial network traffic data into a true traffic feature vector. The actual flow feature vector is then subtracted element-by-element from the physical expected flow feature vector, and its absolute value is calculated to remove the physical interference caused by mechanical vibration and motion roaming, generating a flow difference residual matrix. Finally, the residual matrix of the flow difference, combined with the dual-scale physical constraint dynamic graph, is input into a pre-trained graph neural network to perform multi-layer spatiotemporal graph convolution aggregation operations, thereby calculating and deriving the residual response vector. The calculation formula is as follows:

[0077] ;

[0078] in, This represents the actual traffic feature vector. This represents the physical expected flow feature vector; This is the residual matrix of the flow difference; This is a dynamic graph of physical constraints at two scales. This refers to the spatiotemporal graph convolution aggregation operation in graph neural networks.

[0079] In one specific embodiment, the physical co-mapping model A regression model (such as multilayer perceptron or support vector regression) trained in advance based on historical non-attack-free physical motion / vibration data and network traffic data is used to establish a nonlinear mapping relationship between "physical state - normal traffic fluctuation baseline".

[0080] In the offline phase, the graph neural network uses historical samples without abnormal traffic for self-supervised training, and updates the network parameters using the mean squared loss (MSE Loss) of the residual matrix reconstruction error as the loss function. The graph neural network architecture includes using a graph attention network (GAT) to extract physically weighted association representations of the spatial dimension, and using a temporal convolutional network (TCN) to aggregate dynamic evolution features of the temporal dimension along a preset temporal window; in alternative embodiments, the graph neural network can also use a graph convolutional network (GCN), GraphSAGE, or a long short-term memory network (LSTM) to achieve spatiotemporal feature extraction.

[0081] S500, Adaptive Scoring and Abnormal Traffic Detection for Operating Conditions. First, based on the current operating condition mode of the industrial mobile terminal device, the preset basic scoring threshold is dynamically adjusted to obtain a preset scoring threshold that matches the current operating condition mode; then, the residual response vector... By performing a 2-norm calculation, the norm term of the response amplitude can be obtained. The residual response vector is normalized in each dimension, and the relative entropy between the normalized component values ​​and the preset baseline mean values ​​of the historical baseline response vector in each dimension is calculated to obtain the entropy deviation term of the response distribution anomaly. The norm term and the entropy deviation term are multiplied by preset coefficients and then substituted into the exponential negative decay function to obtain complementary values, thus calculating and deriving the anomaly flow confidence score. The calculation formula is as follows:

[0082] ;

[0083] in, Confidence score for abnormal traffic; Let L be the norm of the residual response vector; is the dimension of the residual response vector; is the normalized component value of the residual response vector in the k-th dimension; The preset baseline mean; and These are the preset norm penalty term adjustment coefficient and entropy deviation adjustment coefficient; the calculated abnormal flow confidence score is then used. The abnormal traffic confidence score is compared with a preset scoring threshold. When the abnormal traffic confidence score is greater than the preset scoring threshold, it is determined that there is an abnormal traffic in the industrial network traffic data, and the corresponding abnormal traffic detection result is output.

[0084] After the S600 outputs the traffic anomaly detection results, it executes differentiated linkage protection. If a traffic anomaly is confirmed and the physical interface jitter prediction feature indicates poor mechanical physical contact, the current traffic anomaly is determined to be caused by loose hardware physical lines, and a hardware physical fault warning command is output to the equipment operation and maintenance terminal. If a traffic anomaly is confirmed and the physical interface jitter prediction feature indicates no poor mechanical physical contact, the current traffic anomaly is determined to be a malicious network attack, and a network attack alarm command is output to the network security protection terminal, triggering the network isolation policy of the corresponding abnormal node.

[0085] Reference Figure 2 An industrial IoT abnormal traffic detection system based on graph neural networks includes:

[0086] The data acquisition module is used to acquire macroscopic motion data, microscopic vibration data, and industrial network traffic data corresponding to the industrial IoT mobile terminal devices.

[0087] The physical feature prediction module is used to calculate the topological change prediction probability based on macroscopic motion data and to calculate the physical interface jitter prediction feature based on microscopic vibration data.

[0088] The dynamic graph construction module is used to combine topology change prediction probability, physical interface jitter prediction characteristics, and industrial network traffic data to construct a dual-scale physical constraint dynamic graph, including node feature matrix and edge attribute weights.

[0089] The neural network processing module is used to input the dual-scale physical constraint dynamic graph into a pre-trained graph neural network for graph convolution aggregation processing, and calculate the residual response vector that reflects the deviation between the true characteristics of network traffic and the evolution law of physical motion-mechanical vibration.

[0090] The anomaly decision module is used to calculate the anomaly traffic confidence score based on the residual response vector, and when the anomaly traffic confidence score is greater than the preset score threshold, it determines that there is a traffic anomaly in the industrial network traffic data and outputs the corresponding traffic anomaly detection result.

[0091] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions will not cause the essence of the corresponding technical solutions to deviate from the protection scope of the technical solutions of the embodiments of the present invention.

Claims

1. An industrial IoT abnormal traffic detection method based on graph neural networks, characterized in that, The specific steps include: S100: Acquire macroscopic motion data, microscopic vibration data, and industrial network traffic data corresponding to the industrial IoT mobile terminal device. S200. Calculate the topology change prediction probability based on the macroscopic motion data, and calculate the physical interface jitter prediction characteristics based on the microscopic vibration data. S300. Combining the topology change prediction probability, the physical interface jitter prediction characteristics, and the industrial network traffic data, a dual-scale physical constraint dynamic graph including node feature matrix and edge attribute weights is constructed. S400. Input the dual-scale physical constraint dynamic graph into a pre-trained graph neural network for graph convolution aggregation processing, and calculate the residual response vector that reflects the deviation between the true characteristics of network traffic and the evolution law of physical motion-mechanical vibration. S500: Calculate the abnormal traffic confidence score based on the residual response vector, and when the abnormal traffic confidence score is greater than a preset score threshold, determine that there is a traffic anomaly in the industrial network traffic data, and output the corresponding traffic anomaly detection result.

2. The industrial IoT abnormal traffic detection method based on graph neural networks according to claim 1, characterized in that, The acquisition of macroscopic motion data, microscopic vibration data, and industrial network traffic data corresponding to the industrial IoT mobile terminal device includes: The macroscopic motion data, including spatial three-dimensional coordinates, motion velocity vector, and access point signal gradient, is acquired in real time through the positioning module and motion sensor. The microscopic vibration data, including the vibration spectrum energy distribution and interface physical layer voltage fluctuation characteristics, is acquired in real time through a triaxial accelerometer and a physical layer sampling module. The industrial network traffic data, including message retransmission rate, inter-frame arrival delay jitter, and packet loss rate within a preset time window, is obtained through the network interface.

3. The industrial IoT abnormal traffic detection method based on graph neural networks according to claim 1, characterized in that, The construction of a dual-scale physically constrained dynamic graph, including node feature matrices and edge attribute weights, includes: Extract the spatial three-dimensional coordinates of node i and node j at a predetermined time t from the macroscopic motion data, and calculate the Euclidean distance between node i and node j. The micro-vibration data is subjected to time-frequency conversion processing to extract the total energy of the vibration spectrum at node i; Statistically analyze the historical traffic throughput of nodes i and j within a preset time window in the industrial network traffic data; The reciprocal of the Euclidean distance, the exponential decay term of the total energy of the vibration spectrum, and the historical throughput are multiplied by preset spatial weight coefficients, preset vibration decay coefficients, and preset flow correlation coefficients, respectively, and then weighted and summed. The summation result is then normalized and mapped using a preset activation function to calculate the edge attribute weight between node i and node j. : ； in, Use the Sigmoid activation function; and These are the three-dimensional spatial coordinates of node i and node j at the predetermined time t; The distance is Euclidean. The total energy of the vibration spectrum of node i at the predetermined time t; Indicates historical throughput; , , These are the preset spatial weighting coefficient, the preset vibration attenuation coefficient, and the preset flow correlation coefficient, respectively. The preset vibration sensitivity adjustment constant; For the smallest positive constant used for logarithmic smoothing; The edge attribute weights are assigned to the dual-scale physical constraint dynamic graph as the connectivity strength and information transmission attenuation factor of the edge topology.

4. The industrial IoT abnormal traffic detection method based on graph neural networks according to claim 1, characterized in that, The calculation of the topology change prediction probability based on the macroscopic motion data includes: The macroscopic motion data is input into a preset kinematic prediction model to deduce the spatial prediction position of the mobile terminal device at the next predetermined sampling time. Based on the predicted spatial location and the preset spatial physical location of each candidate access point, the estimated signal coverage of each candidate access point is calculated. The communication link corresponding to the estimated signal coverage being lower than the preset signal threshold is identified as the predicted disconnect topology, and the topology change prediction probability of the mobile terminal device undergoing access point roaming handover is calculated.

5. The industrial IoT abnormal traffic detection method based on graph neural networks according to claim 1, characterized in that, The calculation yields a residual response vector that reflects the deviation between the true characteristics of network traffic and the evolution of physical motion and mechanical vibration, including: The macroscopic motion data and the microscopic vibration data are combined and spliced ​​into a physical state vector, which is then input into a preset physical co-mapping model to solve and obtain the expected physical expected flow feature vector. The industrial network traffic data is extracted into a real traffic feature vector, and the real traffic feature vector is subtracted from the physical expected traffic feature vector element by element and the absolute value is processed to remove the physical interference caused by mechanical vibration and motion roaming, and a traffic difference residual matrix is ​​generated. The residual matrix of the flow difference is combined with the dynamic graph of the dual-scale physical constraints and input into a pre-trained graph neural network. Multi-layer spatiotemporal graph convolution aggregation operation is performed to calculate and derive the residual response vector R(t): ； in, This is the actual traffic feature vector; This is the physical expected flow feature vector; The residual matrix of the flow difference; This is the dynamic graph of the dual-scale physical constraints; This refers to the spatiotemporal graph convolution aggregation operation in graph neural networks.

6. The industrial IoT abnormal traffic detection method based on graph neural networks according to claim 1, characterized in that, The step of inputting the dual-scale physical constraint dynamic graph into a pre-trained graph neural network for graph convolution aggregation processing includes: The pre-defined graph attention network is used to extract the weighted physical association representation of each node and its neighboring nodes in the spatial dimension of the dual-scale physical constraint dynamic graph. The dynamic evolution features of each node in the time dimension are aggregated along a preset temporal window using a preset temporal convolutional network. By combining the physical weighted correlation representation with the dynamic evolution characteristics, a multidimensional high-order spatiotemporal feature map matrix is ​​generated, and the residual response vector is derived by mapping.

7. The industrial IoT abnormal traffic detection method based on graph neural networks according to claim 1, characterized in that, The step of calculating the abnormal traffic confidence score based on the residual response vector includes: Based on the current operating mode of the mobile terminal device, the preset basic scoring threshold is dynamically adjusted to obtain the preset scoring threshold that matches the current operating mode. Calculate the relative deviation of the information entropy between the magnitude of the residual response vector and the preset reference response vector; The abnormal traffic confidence score is calculated based on the relative deviation of the information entropy.

8. The industrial IoT abnormal traffic detection method based on graph neural networks according to claim 1, characterized in that, The step of calculating the abnormal traffic confidence score based on the relative deviation of the information entropy includes: For the residual response vector By performing a second-norm calculation, the norm term of the response amplitude is obtained. The component values ​​of the residual response vector in each dimension are normalized, and the relative entropy between the normalized component values ​​and the preset benchmark mean values ​​of the historical benchmark response vector in each dimension is calculated to obtain the entropy deviation term of the abnormality of the response distribution. After multiplying the norm term and the entropy deviation term by preset coefficients, the complementary values ​​are obtained by substituting them into the exponential negative decay function, and the abnormal flow confidence score is calculated and derived. : ； in, Confidence score for abnormal traffic; Let L be the norm of the residual response vector; is the dimension of the residual response vector; is the normalized component value of the residual response vector in the k-th dimension; The preset baseline mean; and These are the preset norm penalty term adjustment coefficient and entropy deviation adjustment coefficient, respectively; The calculated abnormal traffic confidence score is input into the judgment unit and compared with the preset scoring threshold.

9. The industrial IoT abnormal traffic detection method based on graph neural networks according to claim 1, characterized in that, After outputting the corresponding traffic anomaly detection result, it also includes: When it is determined that there is abnormal traffic and the physical interface jitter prediction feature indicates poor mechanical physical contact, a hardware physical fault warning command is output to the equipment operation and maintenance terminal. When abnormal traffic is detected and the physical interface jitter prediction feature indicates no mechanical or physical contact problems, a network attack alarm command is output to the network security protection terminal, and the network isolation policy of the corresponding abnormal node is triggered.

10. An industrial IoT abnormal flow detection system based on graph neural networks, characterized in that, include: The data acquisition module is used to acquire macroscopic motion data, microscopic vibration data, and industrial network traffic data corresponding to the industrial IoT mobile terminal device. The physical feature prediction module is used to calculate the topology change prediction probability based on the macroscopic motion data and to calculate the physical interface jitter prediction feature based on the microscopic vibration data. The dynamic graph construction module is used to combine the topology change prediction probability, the physical interface jitter prediction characteristics, and the industrial network traffic data to construct a dual-scale physical constraint dynamic graph including node feature matrix and edge attribute weights. The neural network processing module is used to input the dual-scale physical constraint dynamic graph into a pre-trained graph neural network for graph convolution aggregation processing, and calculate the residual response vector that reflects the deviation between the true characteristics of network traffic and the evolution law of physical motion-mechanical vibration. The anomaly decision module is used to calculate the anomaly traffic confidence score based on the residual response vector, and when the anomaly traffic confidence score is greater than a preset score threshold, determine that there is a traffic anomaly in the industrial network traffic data, and output the corresponding traffic anomaly detection result.

Images