A data analysis method and system based on an internet of things terminal behavior portrait

Abstract

The application discloses a data analysis method and system based on terminal behavior image of Internet of Things, and belongs to the technical field of Internet of Things data processing. Channel state parameters of terminal sleep period are collected, and correlation records are established with reported communication quality parameters after terminal sleep ends. Mapping relationship between channel states of each terminal and communication quality is constructed, and normal communication quality intervals under different channel states are adaptively generated. Based on the mapping relationship, whether the terminal reported message is abnormal is judged in real time, and the message to be intercepted is marked. Meanwhile, spatially adjacent terminals are screened in combination with terminal radio frequency signal characteristics, an interception influence index is constructed, a hierarchical strategy is executed, and finally the number of each type of abnormal event in a fixed time window is counted, a comprehensive abnormality index is calculated, and multi-level terminal early warning and regional channel early warning are outputted and matched with corresponding disposal strategies.

Description

Technical Field

[0001] This invention relates to the field of Internet of Things (IoT) data processing technology, specifically a data analysis method and system based on IoT terminal behavior profiling. Background Technology

[0002] Low-power wide-area networks (LPWANs), represented by NB-IoT and LoRa, have become a core supporting technology for the interconnection of massive IoT terminals due to their advantages of low power consumption, wide coverage, and massive connectivity. Terminal behavior profiling technology models the data generated by device operation, constructs a feature baseline representing its normal behavior pattern, and then identifies abnormal behaviors that deviate from the baseline. It is one of the commonly used methods for IoT terminal security detection.

[0003] To meet low-power requirements, LPWAN terminals typically employ intermittent communication modes, waking up only at specific times to report a small amount of data before entering sleep mode. The typical reporting interval for LPWAN terminals is several hours or even days, much longer than that of traditional IoT terminals such as WiFi and BLE. During these long sleep periods, multiple noise fluctuations, co-channel interference, or signal attenuation events may occur in the wireless channel where the terminal resides. The cumulative effect of these events directly impacts the communication quality upon the terminal's next wake-up, and may even alter the terminal's normal communication behavior, causing the historically based behavioral baseline to deviate further from the terminal's actual operating conditions. However, existing technologies, when profiling behavior, only analyze the characteristics carried by the terminal's reported data packets, lacking effective perception and recording of actual state changes in the channel during the reporting interval. The main analytical basis is limited to the limited data actively reported by the terminal, failing to obtain information on noise fluctuations and interference events that have occurred in the channel during the sleep period. This makes it difficult for the evaluation results to reflect the true state of the terminal's communication link during actual transmission. Summary of the Invention

[0004] The purpose of this invention is to provide a data analysis method and system based on IoT terminal behavior profiling to solve the problems mentioned in the background art.

[0005] To address the aforementioned technical problems, this invention provides the following technical solution: a data analysis method based on IoT terminal behavior profiling, comprising: Step S100: During the sleep period between two adjacent communications of the terminal, the gateway continuously monitors and records the status parameters of the channel where the terminal is located, including the fluctuation value of the channel noise floor and the frequency of occurrence of signals not originating from this terminal; the status parameters recorded during this sleep period are associated with the communication quality parameters reported for the first time after the end of the sleep period and stored to form a sleep and communication association record; Step S200: Collect multiple records associated with dormancy and communication within a preset historical time period, and construct a mapping relationship between channel state and communication quality using channel state parameters as conditions and communication quality parameters as results; Step S300: When the terminal completes sleep and reports data, extract the channel status parameters recorded by the gateway during the current sleep period, and simultaneously extract the communication quality parameters reported this time; combine the mapping relationship to determine whether the current communication parameters match the normal range under the corresponding channel, determine whether the current packet needs to be intercepted based on the matching result, and simultaneously retain all channel and original communication records and generate a preliminary abnormal prompt. Step S400: If the current message is determined to be intercepted, assess the degree of interference that this interception operation will cause to the overall channel transmission in the area, and execute a graded interception strategy; Step S500: Statistically analyze the interception judgment results and the number of anomalies within a fixed time window, output graded anomaly warnings, and automatically generate terminal communication handling strategies based on channel interference levels.

[0006] Step S100 specifically includes: Step S101: After receiving the data packet reported by the target terminal, the gateway records the reception time of this report as the start time of the target terminal's current sleep period; the gateway continuously listens for the next uplink report from the target terminal, and when it receives the next data packet reported by the target terminal, it records the reception time of the next report as the end time of the current sleep period; the time period between the start time and the end time is determined as the current sleep period of the target terminal. Step S102: During the current sleep period, the gateway periodically collects the status parameters of the channel where the target terminal is located at a fixed sampling interval, including the measured value of the channel noise floor and the detection results of signals from sources other than this terminal in the channel; The gateway obtains the current noise floor value of the channel through the RSSI measurement function of the receiver, calculates the difference between the current noise floor value and the historical average noise floor value of the current channel, and obtains the noise floor fluctuation value, specifically: Noise floor fluctuation value = |current noise floor - historical average noise floor|. At the same time, the gateway performs preamble identification on the received signal to determine whether there are radio frequency signals sent by non-target terminals in the channel, and counts the number of times such non-target terminal source signals appear during the current sleep period as the occurrence frequency of non-terminal source signals; Step S103: After the current sleep period ends, the target terminal initiates the next report, the gateway receives the data packet of the next report and extracts the corresponding communication quality parameters, where the communication quality parameters include received signal strength and signal-to-noise ratio; the noise floor fluctuation value and the occurrence frequency of signals from non-local terminals recorded in step S102 are stored in association with the communication quality parameters to form a single sleep and communication association record, which is archived and stored by the terminal device number.

[0007] Step S200 specifically includes: Step S201: Extract all sleep and communication association records formed within a preset historical period from the historical data of the terminal, where there are a total of N records, and each record includes channel state parameters and corresponding communication quality parameters within one sleep period; the channel state parameters at least include the noise floor fluctuation value ΔP and the occurrence frequency f of signals from non-local terminals, and the communication quality parameters at least include the received signal strength R; each record is represented as a three-dimensional sample vector Sn=(ΔPn,fn,Rn), where (ΔPn,fn) is the coordinate of the nth record in the channel state space, Rn is the labeled value of the received signal strength corresponding to the nth record, and n∈[1,N]; Step S202: Analyze the distribution density of the N sample points in the channel state space. For any position x=(ΔP,f) in the channel state space, calculate the density value D(x) at this position as the ratio of the number of sample points contained in a circular region centered at x and with a radius r to the area of the region: D(x)=K(x,r) / (πr 2 ); where K(x,r) is the total number of sample points falling into the circular region centered at x and with a radius r, and r is a preset neighborhood radius; compare the density value D(x) with a preset density threshold Td, mark the position x as a high-density point when D(x)≥Td, and mark the position x as a low-density point when D(x)<Td; traverse the channel state space, and integrate the spatially continuously connected high-density points into the high-density coverage area A of the terminal; Step S203: When the terminal completes the current sleep and reports data, extract the channel state parameters of this sleep period as the to-be-queried point xq=(ΔPq,fq); determine whether the to-be-queried point xq falls into the high-density coverage area A: If xq falls into the high-density coverage area A, extract the R values of all sample points in A, take the median M of this set as the reference value, and take the interquartile range Q of this set as the fluctuation amplitude, then the expected communication quality interval is [M-k×Q, M+k×Q], where k is a preset positive coefficient; If xq does not fall within the high-density coverage area A, select the nearest neighbor sample point of the to-be-queried point xq in the channel state space, denote the nearest neighbor sample point as St, whose corresponding R annotation value is Rt, take Rt as the reference value and the preset extension width δ as the floating range, then the expected communication quality interval is [Rt-δ, Rt+δ]; where δ ∈ [3, 10]; Compare the current actual received signal strength Rq with the expected communication quality interval, if Rq falls within this interval, the communication is determined to be normal, otherwise it is determined to be abnormal; Step S204: After each valid communication is confirmed, add the current sleep and communication association record as a new sample point to the sample point set, re-execute the density analysis in step S202, and update the high-density coverage area A; for sample points in the sample point set that fall outside the current high-density coverage area A and have not been selected as the nearest neighbor sample point in the latest preset number of queries, remove them from the sample point set; the high-density coverage area and the corresponding expected communication quality interval calculation rule together constitute the mapping relationship of the corresponding terminal in the channel state space.

[0008] Step S300 specifically includes: Step S301: When the terminal completes the current sleep and reports data, the gateway receives the currently reported data packet, records the receiving time of this report, and extracts the communication quality parameters of this report, including the actual received signal strength Rc; at the same time, retrieve the channel state parameters recorded during this sleep period from the local storage of the gateway, including the noise floor fluctuation value ΔPc during this sleep period and the occurrence frequency fc of signals from non-local terminal sources, and take (ΔPc, fc) as the channel state coordinate of the to-be-queried point; Step S302: According to the mapping relationship determined in step S200, take (ΔPc, fc) as the input, and obtain the expected communication quality interval [L, U] under the current channel state according to the expected communication quality interval calculation method in step S203, where L is the lower limit of the interval and U is the upper limit of the interval; compare the actual received signal strength Rc with the expected communication quality interval [L, U]: if L ≤ Rc ≤ U, it is determined that the current communication quality matches the channel state; if Rc < L or Rc > U, it is determined that the current communication quality does not match the channel state; Step S303: When the determination in step S302 is a match, mark the current message as a compliant message and allow normal forwarding; when the determination in step S302 is a mismatch, mark the current message as a to-be-intercepted message, perform interception processing, and locally store all channel state records of the current dormant period and the originally reported communication quality raw records; generate a preliminary abnormality prompt according to the step determination result: when the message is marked as a compliant message, generate a normal status prompt; when the message is marked as a to-be-intercepted message, generate a preliminary abnormality prompt, associate and mark the abnormality prompt with the stored records, and then save the same to a local abnormality log.

[0009] Step S400 specifically includes: Step S401: The gateway maintains a signal feature vector of each terminal, where the signal feature vector at least includes an average received signal strength μRSSI and an average signal arrival angle μJ of the terminal when reporting multiple times within a preset historical period; when the current message is marked as a to-be-intercepted message in step S303, with the signal feature vector of the current target terminal T (μRSSI T , μJ T ) as a reference, traverse all other terminals under the same gateway, denote any other terminal currently traversed as K, and calculate the similarity between the signal feature vector of the terminal K and the signal feature vector of the target terminal T one by one; when the similarity exceeds a preset similarity threshold, mark the terminal K as a spatially adjacent terminal of the target terminal T; all the spatially adjacent terminals constitute an adjacent terminal set N(T) of the target terminal T; Step S402: Count the number Ma of terminals currently in an active state in the adjacent terminal set N(T), where the terminals in the active state are terminals that have valid reporting behaviors within a preset time window; and count the number Mp of terminals that have been marked as high-priority terminals in the adjacent terminal set; calculate an interception impact index F: F=(Ma / |N(T)|)×(Mp+1); where |N(T)| is the total number of adjacent terminals; Ma / |N(T)| represents the active density of terminals in the adjacent area; (Mp+1) represents the weight coefficient of affected high-priority terminals in the adjacent area; the adjacent area is a radio frequency adjacent area corresponding to the spatially adjacent terminal set N(T) of the target terminal T; Step S403: Compare the interception impact index F obtained in S402 with a preset low interference threshold TL and a preset high interference threshold TH, and execute a hierarchical interception strategy: If F<TL, it is determined that the interference impact of this interception operation on the adjacent area is small, and local interception and discarding of the current message is performed; If TL≤F<TH, it is determined that this interception operation has a medium degree of interference impact on the adjacent area, interception and discarding is performed, and a channel occupation prompt is sent to the currently active terminals in the adjacent terminal set N(T), where the channel occupation prompt is used to notify the adjacent terminals to suspend uplink transmission within a preset time length; If F≥TH, it is determined that the interference impact of this interception operation on the adjacent area is relatively large, interception and discarding is not performed temporarily, the anomaly detection records of each terminal in the adjacent terminal set N(T) within the latest preset time window are retrieved, and it is queried whether there is any adjacent terminal marked as to-be-intercepted therein, If it exists, it is determined that multiple terminals in the adjacent area have anomalies at the same time, a regional collaborative anomaly alarm is triggered, and the current packet is associated and recorded with the adjacent abnormal terminal list and then allowed to be forwarded; If it does not exist, it is determined that the current anomaly is limited to the target terminal T itself, the current packet is marked as a concerned packet and allowed to be forwarded, and current limiting processing is performed on the subsequent communications of the target terminal T at the same time.

[0010] Step S500 specifically includes: Step S501: Count the total number Cn of times that the target terminal T is marked as a compliant packet in step S303 within the current statistical period T , the total number Ci of times marked as a to-be-intercepted packet T , and the total number Cw of times marked as a concerned packet due to F≥TH in step S403 T and the number Cr of times a regional collaborative alarm is triggered T , and calculate the comprehensive anomaly index E(T) of the target terminal T: E(T)=(Ci T +Cw T ×λw+Cr T ×λr) / Ctotal T ; where Ctotal T is the total number of packets reported by the target terminal T within the current statistical period, λw is the weighting coefficient of the concerned packet, λr is the weighting coefficient of the regional alarm, and both λw and λr are greater than 1, which are used to reflect that the concerned packet and the regional alarm have higher risk weights than ordinary to-be-intercepted packets; Step S503: Compare the comprehensive anomaly index E(T) with a preset early warning level threshold, and output a corresponding graded anomaly early warning: When E(T) is lower than the first early warning threshold, it is determined that the terminal state is normal, and no early warning is output; When E(T) reaches the first early warning threshold but is lower than the second early warning threshold, it is determined that the terminal is in a low-risk abnormal state, a first-level early warning is output, to prompt operation and maintenance personnel to continuously monitor the target terminal T; When E(T) reaches the second warning threshold but is lower than the third warning threshold, the terminal is determined to be in a medium-risk abnormal state, a level-two warning is output, and it is recommended to perform offline detection on the target terminal T. When E(T) reaches or exceeds the third warning threshold, the target terminal T is determined to be in a high-risk abnormal state, and a level three warning is output. It is recommended that the operation and maintenance personnel conduct on-site inspection or replacement of the target terminal T. When the cumulative number of regional collaborative alarms Cr exceeds the preset regional alarm threshold within the preset time window, a regional warning is output, indicating that there is a regional communication anomaly within the current gateway coverage area, and it is recommended to perform a regional channel scan.

[0011] A data analysis system based on IoT terminal behavior profiling includes a channel data acquisition and correlation module, a terminal behavior profiling construction module, a packet judgment and interception module, an interception impact assessment module, and a statistical early warning output module. During the sleep period between two consecutive communications of the terminal, the gateway continuously monitors and records the status parameters of the channel where the terminal is located, including the fluctuation value of the channel noise floor and the frequency of occurrence of signals not originating from this terminal. The status parameters recorded during this sleep period are associated with the communication quality parameters reported for the first time after the end of the sleep period and stored to form a sleep and communication association record. The terminal behavior profile building module collects multiple records related to dormancy and communication within a preset historical time period. Using channel state parameters as conditions and communication quality parameters as results, it constructs a mapping relationship between channel state and communication quality. When the terminal completes sleep and reports data, the message judgment and interception module extracts the channel status parameters recorded by the gateway during the current sleep period and simultaneously extracts the communication quality parameters reported this time; it combines the mapping relationship to determine whether the current communication parameters match the normal range under the corresponding channel, determines whether the current message needs to be intercepted based on the matching result, and simultaneously retains all channel and original communication records and generates a preliminary abnormal prompt. If the current packet is determined to be to be intercepted, the interception impact assessment module will assess the degree of interference that the current interception operation will cause to the overall channel transmission in the area and execute a graded interception strategy. The statistical early warning output module statistically analyzes the interception judgment results and the number of anomalies within a fixed time window, outputs graded anomaly early warnings, and automatically generates terminal communication handling strategies based on the channel interference level.

[0012] Compared with the prior art, the beneficial effects achieved by the present invention are: This invention constructs a behavior analysis path for the entire sleep and communication cycle by continuously recording channel noise fluctuations and the occurrence of external signals during the terminal's sleep period and associating and storing them with the communication quality after the terminal is woken up. This enables the terminal's behavior profile to cover the entire sleep and communication cycle. Even under the condition of low communication frequency of LPWAN terminals, more information reflecting the terminal's working status can still be obtained from limited communication events, thus improving the stability of the behavior profile in data-sparse scenarios. This invention establishes a mapping relationship between the channel status of each terminal and the communication quality, enabling the anomaly detection of terminal-reported messages. This effectively identifies communication quality deviations caused by terminal-specific problems or channel anomalies. By assessing the activity density of neighboring terminals and the weight of high-priority terminals, the interference of interception operations on regional channels is kept within a controllable range. In high-interference situations, further collaborative judgment is performed by combining the abnormal status of neighboring terminals, effectively distinguishing between individual anomalies and regional problems, and triggering collaborative alarms when regional problems occur. By calculating a comprehensive anomaly index by statistically analyzing abnormal events of terminals within a time window, a tiered early warning output is achieved, providing maintenance personnel with differentiated handling guidelines. Attached Figure Description

[0013] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings: Figure 1 This is a flowchart of a data analysis method based on IoT terminal behavior profiling. Detailed Implementation

[0014] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0015] Please see Figure 1 This invention provides a technical solution: a data analysis system based on IoT terminal behavior profiling, comprising a channel data acquisition and correlation module, a terminal behavior profiling construction module, a packet judgment and interception module, an interception impact assessment module, and a statistical early warning output module. During the sleep period between two consecutive communications of the terminal, the gateway continuously monitors and records the status parameters of the channel where the terminal is located, including the fluctuation value of the channel noise floor and the frequency of occurrence of signals not originating from this terminal. The status parameters recorded during this sleep period are associated with the communication quality parameters reported for the first time after the end of the sleep period and stored to form a sleep and communication association record. The terminal behavior profile building module collects multiple records related to dormancy and communication within a preset historical time period. Using channel state parameters as conditions and communication quality parameters as results, it constructs a mapping relationship between channel state and communication quality. When the terminal completes sleep and reports data, the message judgment and interception module extracts the channel status parameters recorded by the gateway during the current sleep period and simultaneously extracts the communication quality parameters reported this time; it combines the mapping relationship to determine whether the current communication parameters match the normal range under the corresponding channel, determines whether the current message needs to be intercepted based on the matching result, and simultaneously retains all channel and original communication records and generates a preliminary abnormal prompt. If the current packet is determined to be to be intercepted, the interception impact assessment module will assess the degree of interference that the current interception operation will cause to the overall channel transmission in the area and execute a graded interception strategy. The statistical early warning output module statistically analyzes the interception judgment results and the number of anomalies within a fixed time window, outputs graded anomaly early warnings, and automatically generates terminal communication handling strategies based on the channel interference level.

[0016] A data analysis method based on IoT terminal behavior profiling includes: Step S100: During the sleep period between two adjacent communications of the terminal, the gateway continuously monitors and records the status parameters of the channel where the terminal is located, including the fluctuation value of the channel noise floor and the frequency of occurrence of signals not originating from this terminal; the status parameters recorded during this sleep period are associated with the communication quality parameters reported for the first time after the end of the sleep period and stored to form a sleep and communication association record; Step S200: Collect multiple records associated with dormancy and communication within a preset historical time period, and construct a mapping relationship between channel state and communication quality using channel state parameters as conditions and communication quality parameters as results; Step S300: When the terminal completes sleep and reports data, extract the channel status parameters recorded by the gateway during the current sleep period, and simultaneously extract the communication quality parameters reported this time; combine the mapping relationship to determine whether the current communication parameters match the normal range under the corresponding channel, determine whether the current packet needs to be intercepted based on the matching result, and simultaneously retain all channel and original communication records and generate a preliminary abnormal prompt. Step S400: If the current message is determined to be intercepted, assess the degree of interference that this interception operation will cause to the overall channel transmission in the area, and execute a graded interception strategy; Step S500: Statistically analyze the interception judgment results and the number of anomalies within a fixed time window, output graded anomaly warnings, and automatically generate terminal communication handling strategies based on channel interference levels.

[0017] Step S100 specifically includes: Step S101: After receiving the data packet reported by the target terminal, the gateway records the reception time of this report as the start time of the target terminal's current sleep period; the gateway continuously listens for the next uplink report from the target terminal, and when it receives the next data packet reported by the target terminal, it records the reception time of the next report as the end time of the current sleep period; the time period between the start time and the end time is determined as the current sleep period of the target terminal. Step S102: During the current sleep period, the gateway periodically collects the status parameters of the channel where the target terminal is located at a fixed sampling interval, including the measured value of the channel noise floor and the detection results of signals from sources other than this terminal in the channel; The gateway obtains the current noise floor value of the channel through the RSSI measurement function of the receiver, calculates the difference between the current noise floor value and the historical average noise floor value of the current channel, and obtains the noise floor fluctuation value, specifically: Noise floor fluctuation value = |current noise floor - historical average noise floor|. At the same time, the gateway performs preamble identification on the received signal to determine whether there are radio frequency signals sent by non-target terminals in the channel, and counts the number of times such non-target terminal source signals appear during the current sleep period as the occurrence frequency of non-terminal source signals; Step S103: After the current sleep period ends, the target terminal initiates the next report. The gateway receives the data packet of the next report and extracts the corresponding communication quality parameters, which include the received signal strength and signal-to-noise ratio. The noise floor fluctuation value recorded in step S102 and the frequency of occurrence of signals from non-local sources are associated with the communication quality parameters and stored to form a single sleep and communication association record, which is archived and saved according to the terminal device number.

[0018] Step S200 specifically includes: Step S201: Extract all sleep and communication association records formed within a preset historical period from the terminal's historical data. Assume there are N records in total. Each record contains channel state parameters and corresponding communication quality parameters within a sleep period. The channel state parameters include at least the noise floor fluctuation value ΔP and the frequency f of signals originating from outside the terminal. The communication quality parameters include at least the received signal strength R. Represent each record as a three-dimensional sample vector Sn=(ΔPn,fn,Rn), where (ΔPn,fn) are the coordinates of the nth record in the channel state space, and Rn is the received signal strength label value corresponding to the nth record, n∈[1,N]. Step S202: Analyze the distribution density of N sample points in the channel state space. For any position x=(ΔP, f) in the channel state space, calculate the density value D(x) at this position. D(x) is the ratio of the number of sample points contained in a circular region centered at x with a radius r to the area of the region, which is specifically expressed as: D(x)=K(x,r) / (πr 2 ); where K(x,r) is the total number of sample points falling into the circular region centered at x with radius r, and r is a preset neighborhood radius; compare the density value D(x) with the preset density threshold Td, mark the position x as a high-density point when D(x)≥Td, and mark the position x as a low-density point when D(x)<Td; traverse the channel state space, and integrate the spatially continuously connected high-density points into the high-density coverage area A of the terminal; Step S203: When the terminal completes the current sleep and reports data, extract the channel state parameters of this sleep period as the query point xq=(ΔPq, fq); determine whether the query point xq falls within the high-density coverage area A: If xq falls within the high-density coverage area A, extract the R values of all sample points in A, take the median M of this set as the reference value, and take the interquartile range Q of this set as the fluctuation amplitude, then the expected communication quality interval is [M-k×Q, M+k×Q], where k is a preset positive coefficient, and k∈[1,3]; If xq does not fall within the high-density coverage area A, select the nearest neighbor sample point of the query point xq in the channel state space, denote the nearest neighbor sample point as St, whose corresponding R annotation value is Rt, take Rt as the reference value, and take the preset extension width δ as the floating range, then the expected communication quality interval is [Rt-δ, Rt+δ]; where δ∈[3,10]; Compare the current actual received signal strength Rq with the expected communication quality interval, if Rq falls within this interval, it is determined that the communication is normal, otherwise it is determined to be abnormal; Step S204: After each valid communication is confirmed, add the current sleep and communication association record as a new sample point to the sample point set, re-execute the density analysis of step S202, and update the high-density coverage area A; for sample points in the sample point set that fall outside the current high-density coverage area A and have not been selected as the nearest neighbor sample in the latest preset number of queries, remove them from the sample point set; the high-density coverage area and the corresponding expected communication quality interval calculation rules together constitute the mapping relationship of the corresponding terminal in the channel state space.

[0019] Step S300 specifically includes: Step S301: When the terminal completes the current dormancy and reports data, the gateway receives the currently reported data packet, records the reception time of this report, and extracts the communication quality parameters of this report, including the actual received signal strength Rc; at the same time, it retrieves the channel state parameters recorded during this dormancy period from the local storage of the gateway, including the noise floor fluctuation value ΔPc of this dormancy period and the occurrence frequency fc of signals from non-local terminal sources, and takes (ΔPc, fc) as the channel state coordinate of the point to be queried; Step S302: According to the mapping relationship determined in step S200, taking (ΔPc, fc) as input, and following the calculation method of the expected communication quality interval in step S203, the expected communication quality interval [L, U] under the current channel state is obtained, where L is the lower limit of the interval and U is the upper limit of the interval; the actual received signal strength Rc is compared with the expected communication quality interval [L, U]: if L ≤ Rc ≤ U, it is determined that the current communication quality matches the channel state; if Rc < L or Rc > U, it is determined that the current communication quality does not match the channel state; Step S303: When the determination result in step S302 is a match, the current message is marked as a compliant message and allowed to be forwarded normally; when the determination result in step S302 is a mismatch, the current message is marked as a message to be intercepted, interception processing is executed, and all channel state records of this dormancy period and the original communication quality records of this report are kept locally; a preliminary abnormality prompt is generated according to the determination result: when the message is marked as a compliant message, a normal state prompt is generated; when the message is marked as a message to be intercepted, a preliminary abnormality prompt is generated, and the abnormality prompt is associated and marked with the retained records and then saved to the local abnormality log.

[0020] Step S400 specifically includes: Step S401: The gateway maintains the signal feature vector of each terminal, and the signal feature vector at least includes the average received signal strength μRSSI and the average signal arrival angle μJ of the terminal during multiple reports within a preset historical period; when step S303 marks the current message as a message to be intercepted, taking the signal feature vector of the current target terminal T (μRSSI T ,μJ T ) as a reference, traverse all other terminals under the same gateway, mark any other terminal currently traversed as K, and calculate the similarity between the signal feature vector of terminal K and the signal feature vector of target terminal T one by one; when the similarity exceeds the preset similarity threshold, terminal K is marked as a spatially adjacent terminal of target terminal T; all spatially adjacent terminals form an adjacent terminal set N(T) of target terminal T; Step S402: Count the number Ma of terminals currently in the active state in the neighboring terminal set N(T), wherein the terminals in the active state are terminals that have valid reporting behavior within a preset time window; and count the number Mp of terminals already marked as high-priority terminals in the neighboring terminal set; calculate the interception influence index F: F=(Ma / |N(T)|)×(Mp+1); wherein |N(T)| is the total number of neighboring terminals; Ma / |N(T)| represents the active density degree of terminals in the neighboring area; (Mp+1) represents the weight coefficient of influence on high-priority terminals in the neighboring area; the neighboring area is the radio frequency neighboring area corresponding to the spatially neighboring terminal set N(T) of the target terminal T; Step S403: Compare the interception influence index F obtained in S402 with the preset low interference threshold TL and high interference threshold TH, and execute a hierarchical interception strategy: If F<TL, it is determined that the interference influence of this interception operation on the neighboring area is small, and local interception and discarding of the current packet is executed; If TL≤F<TH, it is determined that the interception operation has a moderate interference influence on the neighboring area, interception and discarding is executed, and a channel occupation prompt is sent to the terminals currently in the active state in the neighboring terminal set N(T), wherein the channel occupation prompt is used to notify the neighboring terminals to suspend uplink transmission within a preset time length; If F≥TH, it is determined that the interference influence of this interception operation on the neighboring area is relatively large, the interception and discarding is not executed temporarily, the anomaly detection record of each terminal in the neighboring terminal set N(T) within the latest preset time window is retrieved, to query whether there is a neighboring terminal marked as to-be-intercepted, If it exists, it is determined that multiple terminals in the neighboring area have anomalies at the same time, a regional collaborative anomaly alarm is triggered, and the current packet is associated and recorded with the neighboring anomaly terminal list before being allowed to be forwarded; If it does not exist, it is determined that the current anomaly is limited to the target terminal T itself, the current packet is marked as a concerned packet and allowed to be forwarded, and current limiting processing is performed on subsequent communications of the target terminal T at the same time.

[0021] Wherein, the low interference threshold TL and the high interference threshold TH are determined according to the percentiles of the F value distribution by collecting historical data of F values of all terminals under the gateway in a normal operating state: the 40th percentile of the F value distribution is taken as the initial value of TL, the 70th percentile of the F value distribution is taken as the reference initial value of TH, and the F value distribution is recalculated and the thresholds are updated every preset period; Step S500 specifically includes: Step S501: Count the total number Cn of times that the target terminal T is marked as a compliant packet in step S303 within the current statistical period TThe total number of times Ci was marked as a packet to be intercepted T And the total number of times Cw is marked as a message of concern because F≥TH in step S403. T The number of times the alarm is coordinated with the triggered area Cr T Calculate the comprehensive anomaly index E(T) of the target terminal T: E(T)=(Ci T +Cw T ×λw+Cr T ×λr) / Ctotal T ; Among them, Ctotal T λw is the total number of messages reported by target terminal T within the current statistical period, λr is the weighting coefficient for messages of interest, and λw is the weighting coefficient for regional alarms. Both λw and λr are greater than 1, reflecting that messages of interest and regional alarms have a higher risk weight than ordinary messages to be intercepted. T When the sample size is below the preset statistical sample size threshold, the statistical period is extended until the sample size reaches the threshold before calculating E(T) to avoid statistical distortion caused by an excessively small sample size. Step S503: Compare the comprehensive anomaly index E(T) with the preset warning level threshold, and output the corresponding graded anomaly warning: When E(T) is lower than the first warning threshold, the terminal is determined to be in normal status and no warning is output. When E(T) reaches the first warning threshold but is lower than the second warning threshold, the terminal is determined to be in a low-risk abnormal state, and a first-level warning is output to prompt the operation and maintenance personnel to continuously monitor the target terminal T. When E(T) reaches the second warning threshold but is lower than the third warning threshold, the terminal is determined to be in a medium-risk abnormal state, a level-two warning is output, and it is recommended to perform offline detection on the target terminal T. When E(T) reaches or exceeds the third warning threshold, the target terminal T is determined to be in a high-risk abnormal state, and a level three warning is output. It is recommended that the operation and maintenance personnel conduct on-site inspection or replacement of the target terminal T. When the cumulative number of regional collaborative alarms Cr exceeds the preset regional alarm threshold within the preset time window, a regional warning is output, indicating that there is a regional communication anomaly within the current gateway coverage area, and it is recommended to perform a regional channel scan.

[0022] This invention takes a water meter terminal within the coverage area of ​​a LoRa gateway as an example. The gateway is connected to about 200 water meter terminals. Each terminal wakes up approximately every 4 hours according to a preset cycle and reports water consumption data to the gateway. The implementation process of this invention is illustrated using a terminal numbered T as an example. During the sleep period between two consecutive reports from terminal T, the gateway periodically collects channel noise floor samples at 1-minute intervals, totaling 240 noise floor samples. The gateway calculates the fluctuation range of the noise floor relative to the historical average noise floor of -105 dBm during this period. If the noise floor measured during the sampling period is -95 dBm, the noise floor fluctuation value at that measurement point is |-95-(-105)|=10 dB. The gateway averages the fluctuation values ​​of all 240 measurement points during this period as the noise floor fluctuation value for that sleep period: ΔP=8.3 dB. Simultaneously, the gateway performs preamble identification on the received signal, accumulating the noise floor fluctuation over the entire 4-hour sleep period. A total of 12 radio frequency signals originating from sources other than terminal T were detected, meaning the frequency of non-terminal source signals was f=12 times. When terminal T woke up at 12:00 noon and reported water consumption data, the gateway extracted the received signal strength RSSI=-103dBm reported this time, associated ΔP=8.3dB and f=12 times with this RSSI value and stored it to form a record of sleep and communication association. The gateway continuously collected all association records of terminal T in the past 30 days. Each record is represented as a three-dimensional sample vector (ΔP,f,R), where ΔP is the noise floor fluctuation value during the sleep period, f is the frequency of non-terminal source signals, and R is the corresponding received signal strength. Using (ΔP,f) as the coordinates in the channel state space, and setting the neighborhood radius r=5, calculate the sample point density at each location within this space; if the neighborhood radius of a location x=(8,10) contains K=12 sample points, then the density value at that location D(x)=12 / (π×5) 2 =12 / 78.54≈0.153; Set the density threshold Td=0.1. Since 0.153≥0.1, mark this location as a high-density point; After traversing the entire channel state space, integrate the spatially connected high-density points into a high-density coverage area A; When terminal T completes its next sleep cycle and reports data, the gateway extracts the channel state coordinates (ΔPc, fc) of the current sleep period. Let ΔPc = 6.5dB and fc = 8 times. It determines that (6.5, 8) falls within the high-density coverage area A, and extracts the R values ​​of all sample points within A, totaling 150 sample points. The median of these 150 R values ​​is M = -102dBm, and the interquartile range is Q = 4dBm. Therefore, the expected RSSI interval is [M-1.5Q, M+1.5Q] = [-102-6, -102+6] = [-108dBm, -96dBm]. The actual received signal strength RSSI reported this time is -112dBm, which does not fall within the [-108, -96] interval. Therefore, it determines that the communication quality does not match the channel state and marks the current packet as a packet to be intercepted. The gateway maintains the signal feature vectors of each terminal as the average received signal strength and the average signal angle of arrival. Taking the signal feature vector of terminal T as a reference, the similarity between other terminals and terminal T is calculated one by one. If the difference in average received signal strength between terminal K and terminal T is 2dBm and the difference in average signal angle of arrival is 5°, the Euclidean distance between the two in the signal feature space is 5.39. The preset similarity threshold is 8.0. If 5.39 < 8.0, terminal K is marked as a spatial neighbor terminal of terminal T. After traversal, there are a total of 5 terminals in the set N(T) of neighbor terminals of terminal T. Count the number of currently active terminals Ma in N(T), assuming that 3 neighboring terminals reported in the past hour, i.e., Ma=3; Count the number of terminals Mp in N(T) that have been marked as high priority, assuming that 1 of them is a high priority terminal, i.e., Mp=1; Calculate the interception impact index: F=(Ma / |N(T)|)×(Mp+1)=(3 / 5)×(1+1)=1.2; The preset low interference threshold TL=0.6 and high interference threshold TH=1.5; since 0.6≤F=1.2<1.5, interception and discarding are performed, and a channel occupancy prompt is sent to the nearby active terminals, notifying them to suspend uplink transmission within 100ms; If, during a subsequent interception, there are 5 active nearby terminals and 2 high-priority terminals, then F = (5 / 5) × (2 + 1) = 3.0, exceeding the high interference threshold TH = 1.5. The gateway will not intercept or discard the packet, but will retrieve the anomaly detection records of each terminal in the nearby terminal set N(T) within the last 24 hours. If it is found that 2 out of the 5 nearby terminals were also marked as pending interception within the last 24 hours, that is, there are nearby abnormal terminals, it is determined that multiple terminals within the coverage area of ​​the gateway are simultaneously abnormal, triggering a regional collaborative anomaly alarm. The current packet is associated with the list of nearby abnormal terminals and then forwarded. If, after querying, it is found that none of the 5 nearby terminals are marked as pending interception, it is determined that the current anomaly is limited to terminal T itself, the current packet is marked as a packet of interest and forwarded, and rate limiting is applied to subsequent communication of terminal T. Gateway statistics on terminal T's judgment results within a 24-hour time window: Compliance message Cn T =4 times, intercepted message Ci T =3 times, pay attention to message Cw T =1 time, regional collaborative alarm Cr T =0 times; Total number of messages Ctotal T =4+3+1+0=8 times; preset the weighting coefficient of the attention message λw=2, the weighting coefficient of the regional alarm λr=3, and calculate the comprehensive anomaly index: E(T)=0.625; The preset warning thresholds are T1=0.3, T2=0.6, and T3=0.8. Since 0.6≤E(T)<0.8, terminal T is in a medium-risk abnormal state, and a level-two warning is output, suggesting that offline detection be performed on terminal T. If Cr accumulates to 3 times within 24 hours, exceeding the regional alarm threshold by 2 times, a regional warning is output simultaneously, prompting maintenance personnel to perform channel scanning on the coverage area of ​​the gateway to check for external interference sources or equipment failures.

[0023] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the invention can be implemented in other specific forms without departing from its spirit or essential characteristics. Therefore, the embodiments should be considered in all respects as exemplary and non-limiting, and the scope of the invention is defined by the appended claims rather than the foregoing description. Thus, all variations falling within the meaning and scope of equivalents of the claims are intended to be included within the present invention. No reference numerals in the claims should be construed as limiting the scope of the claims.

Claims

1. A data analysis method based on IoT terminal behavior profiling, characterized in that: The method includes: Step S100: During the sleep period between two adjacent communications of the terminal, the gateway continuously monitors and records the status parameters of the channel where the terminal is located, including the fluctuation value of the channel noise floor and the frequency of occurrence of signals not originating from this terminal; the status parameters recorded during this sleep period are associated with the communication quality parameters reported for the first time after the end of the sleep period and stored to form a sleep and communication association record; Step S200: Collect multiple records associated with dormancy and communication within a preset historical time period, and construct a mapping relationship between channel state and communication quality using channel state parameters as conditions and communication quality parameters as results; Step S300: When the terminal completes sleep and reports data, extract the channel status parameters recorded by the gateway during the current sleep period, and simultaneously extract the communication quality parameters reported this time; combine the mapping relationship to determine whether the current communication parameters match the normal range under the corresponding channel, determine whether the current packet needs to be intercepted based on the matching result, and simultaneously retain all channel and original communication records and generate a preliminary abnormal prompt. Step S400: If the current message is determined to be intercepted, assess the degree of interference that this interception operation will cause to the overall channel transmission in the area, and execute a graded interception strategy; Step S500: Statistically analyze the interception judgment results and the number of anomalies within a fixed time window, output graded anomaly warnings, and automatically generate terminal communication handling strategies based on channel interference levels.

2. The data analysis method based on IoT terminal behavior profiling according to claim 1, characterized in that: Step S100 includes: Step S101: After receiving the data packet reported by the target terminal, the gateway records the reception time of this report as the start time of the target terminal's current sleep period; the gateway continuously listens for the next uplink report from the target terminal, and when it receives the next data packet reported by the target terminal, it records the reception time of the next report as the end time of the current sleep period; the time period between the start time and the end time is determined as the current sleep period of the target terminal. Step S102: During the current sleep period, the gateway periodically collects the status parameters of the channel where the target terminal is located at a fixed sampling interval, including the measured value of the channel noise floor and the detection results of signals from sources other than this terminal in the channel; The gateway obtains the current noise floor value of the channel through the RSSI measurement function of the receiver, calculates the difference between the current noise floor value and the historical average noise floor value of the current channel, and obtains the noise floor fluctuation value, specifically: Noise floor fluctuation value = |current noise floor - historical average noise floor|. At the same time, the gateway performs preamble identification on the received signal to determine whether there are radio frequency signals sent by non-target terminals in the channel, and counts the number of times such non-target terminal source signals appear during the current sleep period as the occurrence frequency of non-terminal source signals; Step S103: After the current sleep period ends, the target terminal initiates the next report, the gateway receives the data packet of the next report and extracts the corresponding communication quality parameter, where the communication quality parameter includes received signal strength and signal-to-noise ratio; the noise floor fluctuation value and the occurrence frequency of signals from non-local terminals recorded in step S102 are stored in association with the communication quality parameter to form a single sleep and communication association record, which is archived and stored by the terminal device number.

3. The data analysis method based on IoT terminal behavior profiling according to claim 1, characterized in that: The step S200 includes: Step S201: Extract all sleep and communication association records formed within a preset historical period from the historical data of the terminal, assuming there are a total of N records, each record includes channel state parameters and corresponding communication quality parameters within one sleep period; the channel state parameters at least include a noise floor fluctuation value ΔP and an occurrence frequency f of signals from non-local terminals, and the communication quality parameters at least include received signal strength R; represent each record as a three-dimensional sample vector Sn=(ΔPn,fn,Rn), where (ΔPn,fn) is the coordinate of the nth record in the channel state space, Rn is the labeled value of the received signal strength corresponding to the nth record, and n∈[1,N]; Step S202: Analyze the distribution density of N sample points in the channel state space. For any position x=(ΔP,f) in the channel state space, calculate the density value D(x) at that position. D(x) is the ratio of the number of sample points contained in a circular region centered at x and with radius r to the area of ​​the region, specifically expressed as: D(x)=K(x,r) / (πr) 2 ); where K(x,r) is the total number of sample points falling within a circular area centered at x with a radius r, and r is a preset neighborhood radius; compare the density value D(x) with a preset density threshold Td, mark the position x as a high-density point when D(x)≥Td, and mark the position x as a low-density point when D(x)<Td; traverse the channel state space, and integrate the spatially continuously connected high-density points into a high-density coverage area A of the terminal.

4. The data analysis method based on IoT terminal behavior profiling according to claim 3, characterized in that: The step S200 further includes: Step S203: When the terminal completes the current sleep and reports data, extract the channel state parameter of the current sleep period as the to-be-queried point xq=(ΔPq,fq); determine whether the to-be-queried point xq falls into the high-density coverage area A: If xq falls into the high-density coverage area A, extract the R values of all sample points in A, take the median M of this set as the reference value, and take the interquartile range Q of this set as the fluctuation amplitude, then the expected communication quality interval is [M-k×Q, M+k×Q], where k is a preset positive coefficient; If xq does not fall into the high-density coverage area A, select the nearest neighbor sample point of the to-be-queried point xq in the channel state space, denote the nearest neighbor sample point as St, whose corresponding R labeled value is Rt, take Rt as the reference value, and take the preset extension width δ as the floating range, then the expected communication quality interval is [Rt-δ, Rt+δ]; where δ∈[3,10]; Compare the current actual received signal strength Rq with the expected communication quality interval, if Rq falls within the interval, it is determined that the communication is normal, otherwise it is determined to be abnormal; Step S204: After each valid communication is confirmed, the current sleep and communication association record is added as a new sample point to the sample point set, the density analysis in step S202 is re-executed, and the high-density coverage area A is updated; for sample points in the sample point set that fall outside the current high-density coverage area A and have not been selected as nearest neighbor samples in the latest preset number of queries, they are removed from the sample point set; the high-density coverage area and the corresponding expected communication quality interval calculation rule together constitute the mapping relationship of the corresponding terminal in the channel state space.

5. The data analysis method based on IoT terminal behavior profiling according to claim 1, characterized in that: Said step S300 comprises: Step S301: When the terminal completes the current sleep and reports data, the gateway receives the currently reported data packet, records the reception time of this report, and extracts the communication quality parameters of this report, including the actual received signal strength Rc; at the same time, the channel state parameters recorded during this sleep period are retrieved from the local storage of the gateway, including the noise floor fluctuation value ΔPc of this sleep period and the occurrence frequency fc of signals from non-this terminal sources, and (ΔPc, fc) is taken as the channel state coordinate of the point to be queried; Step S302: According to the mapping relationship determined in step S200, with (ΔPc, fc) as the input, the expected communication quality interval [L, U] under the current channel state is obtained according to the expected communication quality interval calculation method in step S203, where L is the lower limit of the interval and U is the upper limit of the interval; the actual received signal strength Rc is compared with the expected communication quality interval [L, U]: if L ≤ Rc ≤ U, it is determined that the current communication quality matches the channel state; if Rc < L or Rc > U, it is determined that the current communication quality does not match the channel state; Step S303: When the determination result in step S302 is a match, the current message is marked as a compliant message and allowed to be forwarded normally; when the determination result in step S302 is a mismatch, the current message is marked as a to-be-blocked message, blocking processing is performed, and all channel state records of this sleep period and the original communication quality records of this report are stored locally; a preliminary abnormality prompt is generated according to the determination result: when the message is marked as a compliant message, a normal status prompt is generated; when the message is marked as a to-be-blocked message, a preliminary abnormality prompt is generated, and the abnormality prompt is associated and marked with the stored records and then saved to the local abnormality log.

6. The data analysis method based on IoT terminal behavior profiling according to claim 1, characterized in that: Said step S400 comprises: Step S401: The gateway maintains the signal feature vector of each terminal. The signal feature vector includes at least the average received signal strength μRSSI and the average signal angle of arrival μJ when the terminal reports multiple times within a preset historical period. When step S303 marks the current packet as a packet to be intercepted, the signal feature vector (μRSSI) of the current target terminal T is used. T ,μJ T Using K as a reference, traverse all other terminals under the same gateway, and denote any other terminal currently traversed as K. Calculate the similarity between the signal feature vector of terminal K and the signal feature vector of the target terminal T. When the similarity exceeds a preset similarity threshold, mark terminal K as a spatial neighbor terminal of the target terminal T. Construct the set N(T) of neighbor terminals of the target terminal T by using all spatial neighbor terminals as reference. Step S402: Count the number Ma of terminals currently in an active state in the neighboring terminal set N(T), wherein the terminals in the active state are terminals that have valid reporting behaviors within a preset time window; and count the number Mp of terminals that have been marked as high-priority terminals in the neighboring terminal set; calculate the blocking impact index F: F=(Ma / |N(T)|)×(Mp+1); Where |N(T)| is the total number of neighboring terminals; Ma / |N(T)| represents the active density degree of terminals in the neighboring area; (Mp+1) represents the weight coefficient of affected high-priority terminals in the neighboring area; said neighboring area is the radio frequency neighboring area corresponding to the spatially neighboring terminal set N(T) of the target terminal T.

7. The data analysis method based on IoT terminal behavior profiling according to claim 6, characterized in that: Said step S400 further comprises: Step S403: Compare the interception impact index F obtained in S402 with the preset low interference threshold TL and high interference threshold TH, and execute a hierarchical interception strategy: If F<TL, it is determined that the current interception operation has a small interference impact on adjacent areas, and the local interception and discarding of the current packet is performed; If TL≤F<TH, it is determined that the current interception operation has a moderate interference impact on adjacent areas, interception and discarding is performed, and a channel occupation prompt is sent to the currently active terminals in the adjacent terminal set N(T), where the channel occupation prompt is used to notify the adjacent terminals to suspend uplink transmission within a preset time length; If F≥TH, it is determined that the current interception operation has a large interference impact on adjacent areas, the interception and discarding is not performed temporarily, the anomaly detection records of each terminal in the adjacent terminal set N(T) within the latest preset time window are retrieved, and it is queried whether there are adjacent terminals that have been marked as to-be-intercepted, If such adjacent terminals exist, it is determined that multiple terminals in the adjacent area are abnormal at the same time, a regional collaborative anomaly alarm is triggered, and the current packet is associated and recorded with the adjacent abnormal terminal list before being allowed to be forwarded; If no such adjacent terminal exists, it is determined that the current anomaly is limited to the target terminal T itself, the current packet is marked as a concerned packet and allowed to be forwarded, and current limiting processing is performed on the subsequent communications of the target terminal T at the same time.

8. The data analysis method based on IoT terminal behavior profiling according to claim 1, characterized in that: The step S500 includes: Step S501: Count the total number of times Cn of target terminal T was marked as a compliant message in step S303 within the current statistical period. T The total number of times Ci was marked as a packet to be intercepted T And the total number of times Cw is marked as a message of concern because F≥TH in step S403. T The number of times the alarm is coordinated with the triggered area Cr T Calculate the comprehensive anomaly index E(T) of the target terminal T: E(T)=(Ci T +Cw T ×λw+Cr T ×λr) / Ctotal T ; Among them, Ctotal T λw is the total number of messages reported by target terminal T within the current statistical period, λr is the weighting coefficient of the messages of interest, and λr is the weighting coefficient of the regional alarm. Both λw and λr are greater than 1, which is used to reflect that messages of interest and regional alarms have a higher risk weight than ordinary messages to be intercepted. Step S503: Compare the comprehensive anomaly index E(T) with preset warning level thresholds, and output corresponding hierarchical anomaly warnings: When E(T) is lower than the first warning threshold, it is determined that the terminal state is normal, and no warning is output; When E(T) reaches the first warning threshold but is lower than the second warning threshold, it is determined that the terminal is in a low-risk abnormal state, a level-1 warning is output to prompt operation and maintenance personnel to continuously monitor the target terminal T; When E(T) reaches the second warning threshold but is lower than the third warning threshold, it is determined that the terminal is in a medium-risk abnormal state, a level-2 warning is output to recommend performing offline detection on the target terminal T; When E(T) reaches or exceeds the third warning threshold, it is determined that the target terminal T is in a high-risk abnormal state, a level-3 warning is output to recommend operation and maintenance personnel to perform on-site inspection or replacement of the target terminal T; When the cumulative number Cr of regional collaborative alarms exceeds the preset regional alarm threshold within a preset time window, a regional-level warning is output to prompt that there is a regional communication anomaly within the coverage of the current gateway, and recommend performing regional channel scanning.

9. A data analysis system based on IoT terminal behavior profiling, characterized in that, The system includes a channel data collection and association module, a terminal behavior profile construction module, a packet determination and interception module, an interception impact assessment module, and a statistical warning output module: During the sleep period between two adjacent communications of a terminal, the channel data collection and association module continuously monitors and records the state parameters of the channel where the terminal is located by the gateway, including the fluctuation value of the channel noise floor and the occurrence frequency of signals from non-local terminals; the state parameters recorded in this sleep period are associated and stored with the communication quality parameters reported for the first time after the end of the sleep period, so as to form a sleep and communication association record; The terminal behavior profile building module collects multiple records related to dormancy and communication within a preset historical time period, and constructs a mapping relationship between channel state and communication quality using channel state parameters as conditions and communication quality parameters as results. When the terminal completes sleep mode and reports data, the message judgment and interception module extracts the channel status parameters recorded by the gateway during the current sleep period and simultaneously extracts the communication quality parameters reported this time. Based on the mapping relationship, determine whether the current communication parameters match the normal range under the corresponding channel. Based on the matching result, determine whether the current message needs to be intercepted. Simultaneously retain all channel and original communication records and generate a preliminary abnormal prompt. If the current message is determined to be to be intercepted, the interception impact assessment module assesses the degree of interference that the current interception operation will cause to the overall channel transmission in the region and executes a graded interception strategy. The statistical early warning output module statistically analyzes the interception judgment results and the number of anomalies within a fixed time window, outputs graded anomaly early warnings, and automatically generates terminal communication handling strategies in conjunction with the channel interference level.

Images