Internet of things anomaly identification method, network device and storage medium

Abstract

The present application belongs to the technical field of communications. Disclosed are an Internet of Things anomaly identification method, a network device and a storage medium. The method comprises: acquiring Internet of Things operation data of the current time interval, wherein the Internet of Things operation data comprises registration data, control plane session data, user plane session data and user plane traffic data; and on the basis of the Internet of Things operation data of the current time interval, performing Internet of Things anomaly identification.

Description

Internet of Things anomaly identification method, network device and storage medium

[0001] Related applications

[0002] This application claims priority to Chinese patent application No. 202310714975.X filed on June 15, 2023, the entire contents of which are incorporated by reference into this application. Technical Field

[0003] The present application relates to the field of communications, and in particular to an Internet of Things anomaly identification method, network equipment, and storage medium. Background Art

[0004] With the rapid development of communications technology, the number of IoT terminals connected to mobile communication networks is increasing, and their types are becoming increasingly complex. These diverse IoT terminals have varying reliance on the IoT. Some require high-bandwidth, low-latency communication quality from the network, others require "always-on" connectivity, and still others demand "on-time" data forwarding. However, IoT terminals often operate autonomously, with little human intervention. Therefore, when network anomalies between IoT terminals occur, the IoT terminals themselves struggle to detect them in a timely manner. Instead, IoT operations and maintenance personnel must first detect the anomaly after a fault is detected by relevant IoT terminal staff and a complaint is filed. This approach is inefficient and can reduce user satisfaction with the IoT.

[0005] Summary of the Invention

[0006] The main purpose of this application is to provide an Internet of Things anomaly identification method, network equipment and storage medium, aiming to solve the technical problem of poor timeliness of Internet of Things anomaly identification in conventional technologies.

[0007] To achieve the above-mentioned purpose, an embodiment of the present application provides a method for identifying anomalies in the Internet of Things, which includes: obtaining Internet of Things operation data in a current time interval, wherein the Internet of Things operation data includes registration data, control plane session data, user plane session data, and user plane traffic data; and performing Internet of Things anomaly identification based on the Internet of Things operation data in the current time interval.

[0008] An embodiment of the present application also provides a network device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the IoT anomaly identification method as described above.

[0009] An embodiment of the present application also provides a storage medium, which is a computer-readable storage medium. A computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the Internet of Things anomaly identification method described above are implemented.

[0010] An embodiment of the present application also provides an Internet of Things anomaly identification device, which includes: an acquisition module, configured to obtain Internet of Things operation data in a current time interval, wherein the Internet of Things operation data includes registration data, control plane session data, user plane session data, and user plane traffic data; and an identification module, configured to perform Internet of Things anomaly identification based on the Internet of Things operation data in the current time interval. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] FIG1 is a schematic diagram of the structure of the operating equipment of the hardware operating environment involved in the embodiment of the present application;

[0012] FIG2 is a flow chart of an embodiment of an IoT anomaly identification method according to an embodiment of the present application;

[0013] FIG3 is a schematic diagram of a workflow of data collection according to an embodiment of the method for identifying anomalies in the Internet of Things according to an embodiment of the present application;

[0014] FIG4 is a flow chart of an embodiment of an IoT anomaly identification method according to an embodiment of the present application;

[0015] FIG5 is a schematic diagram of a workflow of an embodiment of an IoT anomaly identification method according to an embodiment of the present application;

[0016] FIG6 is a flow chart of an embodiment of an IoT anomaly identification method according to an embodiment of the present application;

[0017] FIG7 is a schematic diagram of an IoT anomaly identification device according to an embodiment of the present application.

[0018] The realization of the objectives, functional features and advantages of this application will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0019] It should be understood that the specific embodiments described herein are only used to explain the present application and are not intended to limit the present application.

[0020] With the evolution and development of 5G network technology toward 5G-A (5G-Advanced) and 6G, the construction of mobile communication networks is accelerating, targeting industry users and connecting more and more industries to 5G mobile communication networks. The number of IoT devices connected to 5G networks is increasing, and their types are becoming increasingly complex. These diverse IoT devices have varying requirements for IoT, ranging from high-bandwidth, low-latency communication quality to "always-on" capabilities and "on-time" data forwarding.

[0021] However, most IoT terminals are operated by the "objects" themselves, with little human intervention. Therefore, when an abnormality occurs in the network operation between IoT terminals, the IoT terminal itself will continue to execute according to its originally set program, and it is difficult to detect the abnormality in a timely and spontaneous manner. The operation and maintenance personnel of the IoT terminal are usually unable to monitor the IoT terminal for abnormalities at all times. Usually, only after a more obvious fault occurs in the IoT terminal or affects the normal use of the IoT terminal, the relevant staff of the IoT terminal will discover and file a complaint. Then the IoT operation and maintenance personnel will find and analyze the abnormal IoT based on the complaint. This method has poor timeliness and neither meets the industry users' demands for timely detection and handling of faults nor matches the operation and maintenance goals of the self-intelligent network, which greatly reduces the industry users' satisfaction with the 5G smart communication IoT.

[0022] To solve the above technical problems, refer to Figure 1, which is a schematic diagram of the operating equipment structure of the hardware operating environment involved in the embodiment of the present application.

[0023] As shown in Figure 1, the operating device may include: a processor 1001, such as a central processing unit (CPU), a communication bus 1002, a user interface 1003, a network interface 1004, and a memory 1005. Among them, the communication bus 1002 is used to realize the connection and communication between these components. The user interface 1003 may include a display screen (Display), an input unit such as a keyboard (Keyboard), and the user interface 1003 may also include a standard wired interface and a wireless interface. The network interface 1004 may include a standard wired interface and a wireless interface (such as a wireless fidelity (WI-FI) interface). The memory 1005 may be a high-speed random access memory (RAM) or a stable non-volatile memory (NVM), such as a disk storage. The memory 1005 may also be a storage device independent of the aforementioned processor 1001.

[0024] Those skilled in the art will understand that the structure shown in FIG1 does not constitute a limitation on the operating device, and may include more or fewer components than shown, or a combination of certain components, or a different arrangement of components.

[0025] As shown in FIG. 1 , the memory 1005 as a storage medium may include an operating system, a data storage module, a network communication module, a user interface module, and a computer program.

[0026] In the operating device shown in FIG1 , the network interface 1004 is mainly used for data communication with other devices; the user interface 1003 is mainly used for data interaction with the user; the processor 1001 and the memory 1005 in the operating device of the present application can be set in the operating device, and the operating device calls the computer program stored in the memory 1005 through the processor 1001 and performs the following operations:

[0027] Obtaining IoT operation data for the current time interval, wherein the IoT operation data includes registration data, control plane session data, user plane session data, and user plane traffic data;

[0028] Based on the IoT operation data of the current time interval, IoT anomaly identification is performed.

[0029] Exemplarily, the processor 1001 may call a computer program stored in the memory 1005 and further perform the following operations:

[0030] Based on the Internet of Things operation data of the current time interval and a preset fuzzy logic decision rule, the network operation status of the Internet of Things in the current time interval is determined.

[0031] Exemplarily, the processor 1001 may call a computer program stored in the memory 1005 and further perform the following operations:

[0032] Based on the Internet of Things operation data of the current time interval and the network operation status of the current time interval, the network operation status of the Internet of Things in the next time interval is predicted.

[0033] Exemplarily, the processor 1001 may call a computer program stored in the memory 1005 and further perform the following operations:

[0034] By inputting the Internet of Things operation data of the current time interval and the network operation status of the current time interval into a network operation status prediction model, the network operation status of the Internet of Things in the next time interval is predicted, wherein the network operation status prediction model is a long short-term memory artificial neural network model.

[0035] Exemplarily, the processor 1001 may call a computer program stored in the memory 1005 and further perform the following operations:

[0036] Obtaining Internet of Things operation training data corresponding to at least one training time interval and a network operation status training label value for a next time interval of each training time interval, wherein the Internet of Things operation training data includes registration training data, control plane session training data, user plane session training data, and user plane traffic training data;

[0037] Determining a training network operation state of the Internet of Things in each training time interval based on the operation training data of each Internet of Things and a preset fuzzy logic decision rule;

[0038] Inputting the IoT operation training data and the training network operation status corresponding to each of the training time intervals into the network operation status prediction model to be trained, and obtaining a network operation status training prediction value for the next time interval of each of the training time intervals, wherein the network operation status prediction model is a long short-term memory artificial neural network model;

[0039] According to each of the network operation status training label values ​​and each of the network operation status training prediction values, the network operation status prediction model to be trained is iteratively optimized to obtain a trained network operation status prediction model.

[0040] Exemplarily, the processor 1001 may call a computer program stored in the memory 1005 and further perform the following operations:

[0041] Iteratively optimizing the network operation state prediction model to be trained according to each of the network operation state training label values ​​and each of the network operation state training prediction values ​​to obtain a network operation state prediction model to be tested;

[0042] Obtaining Internet of Things operation test data corresponding to at least one test time interval and a network operation status test tag value of a next time interval of each test time interval, wherein the Internet of Things operation test data includes registration test data, control plane session test data, user plane session test data, and user plane traffic test data;

[0043] Determining the test network operation status of the Internet of Things in each of the test time intervals based on the operation test data of each of the Internet of Things and a preset fuzzy logic decision rule;

[0044] Inputting the IoT operation test data and the test network operation status corresponding to each of the test time intervals into the network operation status prediction model to be tested, and obtaining a network operation status test prediction value for the next time interval of each of the test time intervals;

[0045] Calculating the prediction accuracy of the network operation status prediction model to be tested according to each of the network operation status test label values ​​and each of the network operation status test prediction values;

[0046] In a case where the prediction accuracy exceeds a preset accuracy threshold, the network operation status prediction model to be tested is determined as a trained network operation status prediction model.

[0047] Exemplarily, the processor 1001 may call a computer program stored in the memory 1005 and further perform the following operations:

[0048] When the Internet of Things is identified as being in an abnormal state, an abnormal prompt message is output.

[0049] Exemplarily, the registration data includes an initial registration success rate;

[0050] And / or, the control plane session data includes the control plane session establishment success rate

[0051] And / or, the user plane session data includes a user plane session establishment request success rate and an average number of online sessions;

[0052] And / or, the user plane traffic data includes N6 interface uplink traffic and N6 interface downlink traffic.

[0053] The present application provides a method for identifying anomalies in the Internet of Things. Referring to FIG. 2 , in one embodiment of the method for identifying anomalies in the Internet of Things, the method includes:

[0054] Step S10: Acquire IoT operation data of the current time interval, wherein the IoT operation data includes registration data, control plane session data, user plane session data, and user plane traffic data.

[0055] IoT operation data refers to network communication data related to IoT operation. For example, referring to Figure 3, IoT operation data is collected from network devices and various applications within the industry user-side data network (DN). Network devices include the 5G Core Network Control Plane (5GC-CP) network element devices such as the AMF (Access and Mobility Management Function) or SMF (Session Management Function), and the UPF (User Plane Function).

[0056] IoT operation data includes registration data, control plane session data, user plane session data, and user plane traffic data.

[0057] Registration data refers to data related to user terminal registration, including the number of registration requests, the number of successful registrations, the initial registration success rate, etc. In one feasible manner, the initial registration success rate of the entire network can be calculated by obtaining the number of initial registration requests and the number of successful initial registrations for each terminal in the current time interval. Control plane session data refers to data related to session connection establishment and disconnection, etc., transmitted by the control plane, including the number of control plane session establishment requests, the number of successful control plane session establishments, the control plane session establishment success rate, etc. In one feasible manner, the control plane session establishment success rate can be calculated by obtaining the number of control plane session establishment requests and the number of successful control plane session establishments in the current time interval. User plane session data refers to data related to session connection establishment and disconnection, etc., transmitted by the control plane, including the number of user plane session establishment requests, the number of successful user plane session establishment requests, the user plane session establishment success rate, the average number of online sessions, etc. In one feasible manner, the user plane session establishment success rate can be calculated by obtaining the number of user plane session establishment requests and the number of successful user plane session establishment requests in the current time interval. User plane traffic data refers to network traffic data of user plane interfaces, including uplink and downlink traffic of each interface.

[0058] Illustratively, the registration data includes an initial registration success rate.

[0059] Exemplarily, the control plane session data includes a control plane session establishment success rate.

[0060] Exemplarily, the user plane session data includes a user plane session establishment request success rate and an average number of online sessions.

[0061] Exemplarily, the user plane traffic data includes N6 interface uplink traffic and N6 interface downlink traffic.

[0062] In the event of an IoT anomaly, it can significantly impact registration, session establishment, and session quality, further impacting the operation of IoT terminals. For example, an IoT anomaly can cause an IoT terminal to fail to initiate an initial registration request, preventing the terminal from accessing the 5G network. The impact on registration can be characterized by the initial registration success rate, the impact on session establishment can be characterized by the initial control plane session establishment success rate, the user plane session establishment request success rate, and the average number of online sessions, and the impact on session quality can be characterized by the N6 interface uplink traffic and N6 interface downlink traffic. The N6 interface is the interface between the UPF and the DN, used to transmit uplink and downlink user data flows between the UPF and the DN. The initial registration success rate, control plane session establishment success rate, user plane session establishment request success rate, average number of online sessions, N6 interface uplink traffic, and N6 interface downlink traffic are all parameters that are highly correlated with IoT anomalies. Therefore, by monitoring the initial registration success rate, control plane session establishment success rate, user plane session establishment request success rate, average number of online sessions, N6 interface uplink traffic, and N6 interface downlink traffic in the current time interval and identifying IoT anomalies based on this IoT operation data, the accuracy of IoT anomaly identification can be improved. This allows IoT anomalies to be identified earlier and more accurately before they affect the operation of IoT terminals, shortening the duration of IoT anomalies and reducing the adverse effects caused by IoT anomalies. It can even be possible to eliminate IoT anomalies before IoT terminals malfunction due to IoT anomalies, thereby reducing IoT terminal failures, improving IoT terminal user satisfaction with the IoT, and enhancing user experience.

[0063] In this embodiment, communication data generated in the current time interval can be collected from 5GC-CP, UPF and DN, and the Internet of Things operation data of the current time interval can be obtained after statistical analysis, wherein the interval length of each time interval is the same, and the interval length of the time interval can be determined according to actual needs. This embodiment does not impose any restrictions on this. For example, it can be 1 minute, 1 hour, half a day, one day, one week, etc. The current time interval refers to the time interval between the moment when the communication data is currently collected and the moment when the communication data was previously collected.

[0064] Step S20: Identify IoT anomalies based on IoT operation data in the current time interval.

[0065] In this embodiment, by adopting methods such as statistics, machine learning, deep learning, and rule judgment, the Internet of Things operation data in the current time interval is analyzed to realize the abnormal identification of the network operation status of the Internet of Things, wherein the network operation status includes at least normal state and abnormal state, and the normal state can also include one or more different levels of normal state, such as excellent, good, general, etc., and the abnormal state can also include one or more different levels of abnormal state, such as poor, bad, extremely poor, etc.; the abnormal identification of the network operation status of the Internet of Things includes judging whether the network operation status of the Internet of Things is abnormal in the current time interval, determining the degree of abnormality of the network operation status of the Internet of Things in the current time interval, predicting whether the network operation status of the Internet of Things is abnormal in the next time interval, predicting the degree of abnormality of the network operation status of the Internet of Things in the next time interval, etc.

[0066] Exemplarily, the step of identifying anomalies of the Internet of Things based on the Internet of Things operation data of the current time interval may include: inputting the Internet of Things operation data of the current time interval into a time series model to predict the network operation status of the Internet of Things in the next time interval, wherein the time series model may be a regression model, a random forest model, an XGBoost (Extreme Gradient Boosting) model, an LSTM (Long Short-Term Memory) model, etc.

[0067] Exemplarily, after the step of identifying anomalies of the Internet of Things based on the Internet of Things operation data of the current time interval, the method further includes:

[0068] When the Internet of Things is identified as being in an abnormal state, an abnormal prompt message is output.

[0069] After the abnormality of the Internet of Things is identified, whether the Internet of Things is identified to be in an abnormal state or not, an identification result can be generated, and the generated identification result can be stored or output for display.

[0070] In this embodiment, when it is identified that the Internet of Things is in an abnormal state in the current time interval or the next time interval, abnormal prompt information can be output to the operation and maintenance center equipment of the Internet of Things, so that the operation and maintenance personnel of the operation and maintenance center of the Internet of Things can be aware of the abnormal situation of the Internet of Things in a timely manner and take timely measures to eliminate the abnormality.

[0071] In this embodiment, by obtaining the IoT operation data of the current time interval and performing IoT anomaly identification based on the IoT operation data of the current time interval, on the one hand, the entire IoT system can spontaneously identify IoT anomalies without human intervention. On the other hand, the IoT operation data used for IoT anomaly identification include registration data, control plane session data, user plane session data and user plane traffic data, all of which are source data related to the IoT network operation status. Compared with the method of identifying IoT anomalies by making reverse complaints due to IoT anomalies causing IoT terminal failures, the IoT operation data generated by the IoT operation itself can be used to identify IoT anomalies earlier before the IoT anomalies cause more serious consequences for the IoT terminal, thereby improving the timeliness of IoT anomaly identification, and thus facilitating the timely resolution of anomalies, improving the smoothness of use of IoT terminals, reducing complaints from IoT terminal users, and improving user satisfaction with the IoT.

[0072] In another embodiment of the IoT anomaly identification method of the present application, referring to FIG. 4 , the steps of identifying IoT anomalies based on IoT operation data of the current time interval include:

[0073] Step S21: Determine the network operation status of the Internet of Things in the current time interval based on the Internet of Things operation data in the current time interval and the preset fuzzy logic decision rule.

[0074] Fuzzy logic is a scientific method based on multi-valued logic that uses fuzzy sets to study fuzzy thinking, language forms, and their laws. IoT anomalies can arise from a variety of factors, and not just one or a few pieces of IoT operational data can accurately indicate an IoT anomaly. Furthermore, the relationships between various IoT operational data and IoT anomaly states are not linear or deterministic. In different practical scenarios, multiple fuzzy combinations may exist. For example, low user-side traffic does not necessarily indicate an IoT anomaly. If both the initial registration success rate and session establishment success rate are low when user-side traffic is low, the likelihood of an IoT anomaly is high. However, if both the initial registration success rate and session establishment success rate are high when user-side traffic is low, the likelihood of an IoT anomaly is low, possibly due to low IoT usage. Therefore, fuzzy logic can effectively handle these nonlinearities, uncertainties, and ambiguities, improving the robustness and reliability of IoT anomaly identification. The fuzzy logic decision rules in this embodiment can be pre-defined by domain experts based on historical data and can take the form of a fuzzy logic decision rule table, membership function, or other form. This pre-defined fuzzy logic decision rule can then be directly applied to IoT anomaly identification for the current time interval. Fuzzy logic decision rules can be used alone to identify IoT anomalies in the current time interval, and the output network operation status can be an operation status classification label, which can be good, poor, etc. The fuzzy logic decision rule can also be used only as a normalization processing method without making a decision. In this case, the output network operation status can be a value between 0 and 1 obtained by normalization processing, so as to further grade, classify or judge the operation status according to the value of the output network operation status. For example, if the network operation status is pre-set to be greater than or equal to 0.6 as a normal state and less than 0.6 as an abnormal state, and the output network operation status is 0.62, it can be judged that the IoT is in a normal state in the current time interval.

[0075] In this embodiment, the Internet of Things operation data of the current time interval can be input into the preset fuzzy logic decision rules for inference, and the network operation status of the Internet of Things in the current time interval that matches the Internet of Things operation data of the current time interval can be output.

[0076] In one implementation, referring to Table 1, IoT operation data includes the initial registration success rate, control plane session establishment success rate, user plane session establishment request success rate, average number of online sessions, N6 interface uplink traffic, and N6 interface downlink traffic. The IoT operation data for the current time interval is input into the fuzzy logic decision rule shown in Table 1 to determine a corresponding network operation status for each of the following conditions: the initial registration success rate, control plane session establishment success rate, user plane session establishment request success rate, average number of online sessions, N6 interface uplink traffic, and N6 interface downlink traffic. For example, if the initial registration success rate is 95%, the control plane session establishment success rate is 91%, the user plane session establishment request success rate is 88%, the average number of online sessions is 895 per UPF, the N6 interface uplink traffic is 17.5G, and the N6 interface downlink traffic is 82.5G, then by matching the fuzzy logic decision rule, the IoT network operation status for the current time interval can be determined to be 0.8.

[0077] Table 1

[0078] For example, referring to FIG4 , after determining the network operation status of the Internet of Things in the current time interval based on the Internet of Things operation data in the current time interval and the preset fuzzy logic decision rule, the method further includes:

[0079] Step S22: predicting the network operation status of the Internet of Things in the next time interval based on the Internet of Things operation data in the current time interval and the network operation status in the current time interval.

[0080] By determining the network operation status of the current time interval based on the IoT operation data, it is possible to discover the abnormal situation as early as possible after the IoT abnormality occurs, shorten the duration of the IoT abnormality, and eliminate the abnormality in time when the impact of the IoT abnormality on the IoT terminal is small, so that the IoT terminal can resume normal use. If it is possible to predict that the IoT abnormality is about to occur before the IoT abnormality occurs, measures can be taken in advance before the IoT abnormality occurs, and the operation and maintenance mode will be transformed from passive to active, reducing the occurrence of abnormalities. For example, after an IoT anomaly occurs, the communication speed of the IoT terminal decreases, but communication is still possible. The functions of the IoT terminal may be completed slowly but can still be performed. At this time, if the operation and maintenance personnel of the IoT terminal are conducting routine network detection, they may notice it. If the operation and maintenance personnel of the IoT terminal do not conduct network detection, the reduction in the communication speed of the IoT terminal will not be noticed because it does not cause a failure in the IoT terminal. Therefore, if the anomaly is discovered and eliminated in time after the IoT anomaly occurs, it can be restored to a normal communication state before the function of the IoT terminal is completely interrupted, so that the IoT terminal can resume normal operation without causing serious consequences; and if the impending anomaly can be predicted before the IoT anomaly occurs and eliminated before the anomaly occurs, the anomaly can be eliminated before the communication speed of the IoT terminal decreases, that is, for the IoT terminal, it can always be in a normal communication state, not only will no failure occur, but it can also always be in a smooth operation state.

[0081] In this embodiment, after determining the network operation status of the current time interval, the Internet of Things operation data of the current time interval and the network operation status of the current time interval can be spliced ​​into the Internet of Things operation feature vector of the current time interval. By inputting the Internet of Things operation feature vector into a preset network operation status prediction model, the network operation status of the Internet of Things in the next time interval is predicted, wherein the network operation status prediction model can be a time series model, and the time series model can be a regression model, a random forest model, an XGBoost (Extreme Gradient Boosting) model, an LSTM (Long Short-Term Memory) model, etc.

[0082] Exemplarily, the step of predicting the network operation state of the Internet of Things in the next time interval based on the Internet of Things operation data in the current time interval and the network operation state in the current time interval includes:

[0083] Step S221, predicting the network operation state of the Internet of Things in the next time interval by inputting the Internet of Things operation data of the current time interval and the network operation state of the current time interval into the network operation state prediction model, wherein the network operation state prediction model is a long short-term memory artificial neural network model.

[0084] The Long Short-Term Memory (LSTM) artificial neural network model is a time-recursive neural network that leverages contextual information in the mapping process between input and output sequences to process and predict important events in time series with relatively long intervals and delays. However, IoT usage often exhibits a certain degree of cyclicality. For example, data transmission volume for connected vehicles (IoV) is higher during rush hour, resulting in higher registration data, session data, and traffic data. Industrial robots also exhibit similar data transmission patterns throughout their daily work cycles. Therefore, the LSTM artificial neural network model can be used to learn the operating patterns of the IoT under normal and abnormal conditions. Based on the IoT operating data and network status during the current time interval, it can be used to determine whether the IoT follows normal or abnormal operating patterns, thereby predicting the IoT network status for the next time interval.

[0085] When there are sufficient training samples, the long short-term memory artificial neural network model can be pre-trained, and the training process of the long short-term memory artificial neural network model can be carried out on the device that applies the long short-term memory artificial neural network model or on other devices. The conditions for completing the training can be determined based on the loss function value, accuracy, etc. This embodiment does not impose any restrictions on this. For the trained long short-term memory artificial neural network model, no further training is required during use.

[0086] Even with a small number of training samples, the model can be trained to a level where its accuracy meets basic usage requirements, and then further training can be performed using actual prediction data during use. That is, after each prediction determines the predicted value of the IoT network operation status, the actual value of the network operation status can be obtained in the next time interval, thereby calculating the loss based on the predicted value and the actual value of the network operation status, and iteratively updating the long-short-term memory artificial neural network model based on the loss. In one practicable method, referring to Figure 5, the IoT operation data collected in the current time interval is used for both IoT anomaly identification and prediction and model learning and training. After model learning and training, the model for IoT anomaly identification and prediction is updated.

[0087] In this embodiment, after determining the network operation status of the current time interval, the Internet of Things operation data of the current time interval and the network operation status of the current time interval can be spliced ​​into the Internet of Things operation feature vector of the current time interval. By inputting the Internet of Things operation feature vector into a preset long short-term memory artificial neural network model, the network operation status of the Internet of Things in the next time interval can be predicted.

[0088] In this embodiment, fuzzy logic decision rules can be used to more accurately judge the nonlinear, uncertain, and ambiguous relationship between the IoT operation data in the current time interval and the network operation status of the IoT in the current time interval, thereby improving the robustness and reliability of IoT anomaly identification. After determining the network operation status of the IoT in the current time interval, the network operation status of the IoT in the next time interval can be further predicted based on the IoT operation data in the current time interval and the network operation status in the current time interval. This will advance the time of IoT anomaly identification to before the IoT anomaly occurs, further improving the timeliness of IoT anomaly identification, taking measures before the IoT anomaly occurs, and transforming the operation and maintenance mode from passive to active, reducing the occurrence of anomalies, improving the smoothness of IoT terminal use, reducing complaints from IoT terminal users, and improving user satisfaction with the IoT.

[0089] In another embodiment of the method for identifying anomalies in the Internet of Things of the present application, referring to FIG6 , the method for identifying anomalies in the Internet of Things further includes:

[0090] Step A1: Obtain IoT operation training data corresponding to at least one training time interval and a network operation status training tag value for the next time interval of each training time interval, wherein the IoT operation training data includes registration training data, control plane session training data, user plane session training data, and user plane traffic training data;

[0091] In this embodiment, a training method for a network operation status prediction model is provided.

[0092] In this embodiment, before model training, a batch of IoT operation training data corresponding to at least one training time interval and the network operation status training label value of the next time interval of each training time interval can be obtained, wherein the IoT operation training data includes registration training data, control plane session training data, user plane session training data and user plane traffic training data.

[0093] In one practicable manner, after obtaining the IoT operation training data set, the collected training data can also be verified for consistency and integrity, and the training data can be normalized, serialized, and processed. For example, each IoT operation training data set can be sorted according to timestamps, and then standardized. That is, according to the performance characteristics of each type of IoT operation training data, the correctness of the IoT operation training data can be verified based on statistical methods, and abnormal data can be eliminated or corrected. The standardized IoT operation training data can then be spliced ​​into training data feature vectors for each time interval based on timestamps, and each training data feature vector can be arranged in chronological order.

[0094] Step A2: determining the training network operation status of the Internet of Things in each training time interval based on the operation training data of each Internet of Things and the preset fuzzy logic decision rule;

[0095] In this embodiment, the Internet of Things operation training data of each training time interval can be input into the preset fuzzy logic decision rules in chronological order for inference, and the network operation status of the Internet of Things that matches the Internet of Things operation data of each training time interval can be output.

[0096] Step A3: Inputting the IoT operation training data and the training network operation status corresponding to each training time interval into the network operation status prediction model to be trained, and obtaining a training prediction value of the network operation status for the next time interval of each training time interval, wherein the network operation status prediction model is a long short-term memory artificial neural network model;

[0097] In this embodiment, the Internet of Things operation data and the corresponding network operation status of each training time interval are spliced ​​into the Internet of Things operation training feature vector of each training time interval. By inputting each Internet of Things operation training feature vector into the long short-term memory artificial neural network model to be trained in chronological order, the network operation status of the Internet of Things in the next time interval of each training time interval is predicted, and the network operation status training prediction value of the next time interval of each training time interval is obtained.

[0098] Step A4: iteratively optimize the network operation state prediction model to be trained according to each network operation state training label value and each network operation state training prediction value to obtain a trained network operation state prediction model.

[0099] In this embodiment, the model loss of the long short-term memory artificial neural network model to be trained is calculated based on the difference between the network operation status training prediction value obtained by each training time interval and the network operation status training label value of the next time interval of each training time interval, and whether the long short-term memory artificial neural network model to be trained has converged is judged based on the model loss; if the long short-term memory artificial neural network model to be trained has converged, it is determined that the training of the long short-term memory artificial neural network model is completed, and a trained long short-term memory artificial neural network model is obtained; if the long short-term memory artificial neural network model to be trained has not converged, the long short-term memory artificial neural network model to be trained is updated based on the model gradient calculated by the model loss, and the step of obtaining the Internet of Things operation training data corresponding to at least one training time interval and the network operation status training label value of the next time interval of each training time interval is returned to be executed until the calculated model loss converges.

[0100] Exemplarily, the steps of iteratively optimizing the network operation state prediction model to be trained based on each network operation state label and each network operation state training prediction value to obtain a trained network operation state prediction model include:

[0101] Step A41, iteratively optimizing the network operation state prediction model to be trained based on each network operation state training label value and each network operation state training prediction value to obtain a network operation state prediction model to be tested;

[0102] In order to reduce the generalization error and improve the ability of the trained model to have a better prediction effect on real data, the obtained data is usually divided into a training set and a test set. For example, after obtaining a batch of IoT operation history data, this batch of IoT operation history data can be divided into IoT operation training data and IoT operation test data according to a certain ratio. The division ratio of IoT operation training data and IoT operation test data can be set according to actual conditions. For example, 80% of the IoT operation history data can be divided into IoT operation training data, and 20% of the IoT operation history data can be divided into IoT operation test data; the IoT operation training data is used to train the network operation status prediction model, and the IoT operation test data is used to test the accuracy of the network operation status prediction model. The network operation status prediction model is determined to have converged only when the accuracy obtained by testing with the IoT operation test data is higher than the preset accuracy threshold. Otherwise, it is necessary to re-acquire the IoT operation history data and re-train and test the model until the accuracy obtained by testing with the IoT operation test data is higher than the preset accuracy threshold.

[0103] In one practicable manner, after obtaining the IoT operation history data set, the collected historical data can also be verified for consistency and integrity, and the historical data can be normalized, serialized, and normalized. For example, each IoT operation history data can be sorted according to the timestamp, and then the IoT operation history data can be standardized and sorted. That is, according to the performance characteristics of each type of IoT operation history data, the correctness of the IoT operation history data can be verified based on statistical methods, and abnormal data can be eliminated or corrected; then, based on the timestamp, the standardized IoT operation history data can be spliced ​​into historical data feature vectors for each time interval, and each historical data feature vector can be arranged in chronological order, and then each historical data feature vector can be divided into training data feature vectors and test data feature vectors according to a preset ratio.

[0104] In this embodiment, the model loss of the long short-term memory artificial neural network model to be trained is calculated based on the difference between the network operation status training prediction value obtained by each training time interval and the network operation status training label value of the next time interval of each training time interval. The long short-term memory artificial neural network model to be trained is updated based on the model gradient calculated according to the model loss to obtain the network operation status prediction model to be tested.

[0105] Step A42: Obtain IoT operation test data corresponding to at least one test time interval and a network operation status test tag value for the next time interval of each test time interval, wherein the IoT operation test data includes registration test data, control plane session test data, user plane session test data, and user plane traffic test data;

[0106] In this embodiment, the Internet of Things operation test data corresponding to at least one pre-divided test time interval and the network operation status test tag value of the next time interval of each test time interval are obtained, wherein the Internet of Things operation test data includes registration test data, control plane session test data, user plane session test data and user plane traffic test data.

[0107] Step A43: determining the test network operation status of the Internet of Things in each test time interval based on the operation test data of each Internet of Things and a preset fuzzy logic decision rule;

[0108] In this embodiment, the Internet of Things operation test data of each test time interval can be input into the preset fuzzy logic decision rules in chronological order for reasoning, and the network operation status of the Internet of Things that matches the Internet of Things operation data of each test time interval can be output.

[0109] Step A44: Input the IoT operation test data and the test network operation status corresponding to each test time interval into the network operation status prediction model to be tested, and obtain the network operation status test prediction value of the next time interval of each test time interval;

[0110] In this embodiment, the Internet of Things operation data and the corresponding network operation status of each test time interval are spliced ​​into the Internet of Things operation test feature vector of each test time interval. By inputting each Internet of Things operation test feature vector into the long short-term memory artificial neural network model to be tested in chronological order, the network operation status of the Internet of Things in the next time interval of each test time interval is predicted, and the network operation status test prediction value of the next time interval of each test time interval is obtained.

[0111] Step A45, calculating the prediction accuracy of the network operation status prediction model to be tested based on each network operation status test label value and each network operation status test prediction value;

[0112] In this embodiment, the prediction accuracy of the network operation status prediction model to be tested is calculated based on the difference between the network operation status training prediction value obtained by each training time interval and the network operation status training label value of the next time interval of each training time interval.

[0113] Step A46 : When the prediction accuracy exceeds the preset accuracy threshold, the network operation status prediction model to be tested is determined as the trained network operation status prediction model.

[0114] In this embodiment, if the prediction accuracy exceeds a preset accuracy threshold, the long-short-term memory artificial neural network model to be tested is determined to have converged, and the network operation status prediction model to be tested is determined to be a trained network operation status prediction model. If the prediction accuracy does not exceed the preset accuracy threshold, the long-short-term memory artificial neural network model to be tested is determined to have not converged, and the process returns to the step of obtaining IoT operation training data corresponding to at least one training time interval and the network operation status training label value for the next time interval of each training time interval, until the calculated prediction accuracy exceeds the preset accuracy threshold. The accuracy threshold can be set according to actual circumstances and is not limited in this embodiment. For example, it can be 95%.

[0115] In one practicable embodiment, after testing the test set, a batch of IoT operation historical data can be obtained and then divided into IoT operation training data, IoT operation test data, and IoT operation verification data according to a certain ratio. The ratio of IoT operation training data, IoT operation test data, and IoT operation verification data can be set according to actual conditions. For example, 70% of the IoT operation historical data can be divided into IoT operation training data, 20% of the IoT operation historical data can be divided into IoT operation test data, and 10% of the IoT operation historical data can be divided into IoT operation verification data. The IoT operation training data is used to train the network operation status prediction model; the IoT verification data is used to evaluate the network operation status prediction model and determine the optimal model parameters; and the IoT operation test data is used to test the accuracy of the network operation status prediction model. Only when the accuracy obtained by testing with the IoT operation test data exceeds a preset accuracy threshold is the network operation status prediction model determined to have converged. Otherwise, it is necessary to re-acquire IoT operation historical data and re-train, verify, and test the model until the accuracy obtained by testing with the IoT operation test data exceeds the preset accuracy threshold.

[0116] In this embodiment, through model training, the accuracy of the prediction of IoT anomalies in the next time interval can be improved, so that IoT anomalies can be identified and eliminated earlier and more accurately, the smoothness of use of IoT terminals can be improved, complaints from IoT terminal users can be reduced, and user satisfaction with the IoT can be improved.

[0117] Referring to FIG. 7 , in addition, an embodiment of the present application further provides an IoT anomaly identification device, the IoT anomaly identification device comprising:

[0118] An acquisition module M1 is configured to acquire IoT operation data for a current time interval, wherein the IoT operation data includes registration data, control plane session data, user plane session data, and user plane traffic data;

[0119] The identification module M2 is configured to perform IoT anomaly identification based on IoT operation data in the current time interval.

[0120] Exemplarily, the identification module M2 is further configured to:

[0121] Based on the Internet of Things operation data of the current time interval and a preset fuzzy logic decision rule, the network operation status of the Internet of Things in the current time interval is determined.

[0122] Exemplarily, the identification module M2 is further configured to:

[0123] Based on the Internet of Things operation data of the current time interval and the network operation status of the current time interval, the network operation status of the Internet of Things in the next time interval is predicted.

[0124] Exemplarily, the identification module M2 is further configured to:

[0125] By inputting the Internet of Things operation data of the current time interval and the network operation status of the current time interval into a network operation status prediction model, the network operation status of the Internet of Things in the next time interval is predicted, wherein the network operation status prediction model is a long short-term memory artificial neural network model.

[0126] Exemplarily, the IoT anomaly identification device further includes a training module, which is configured to:

[0127] Obtaining Internet of Things operation training data corresponding to at least one training time interval and a network operation status training label value for a next time interval of each training time interval, wherein the Internet of Things operation training data includes registration training data, control plane session training data, user plane session training data, and user plane traffic training data;

[0128] Determining a training network operation state of the Internet of Things in each training time interval based on the operation training data of each Internet of Things and a preset fuzzy logic decision rule;

[0129] Inputting the IoT operation training data and the training network operation status corresponding to each of the training time intervals into the network operation status prediction model to be trained, and obtaining a network operation status training prediction value for the next time interval of each of the training time intervals, wherein the network operation status prediction model is a long short-term memory artificial neural network model;

[0130] According to each of the network operation status training label values ​​and each of the network operation status training prediction values, the network operation status prediction model to be trained is iteratively optimized to obtain a trained network operation status prediction model.

[0131] Exemplarily, the training module is further configured to:

[0132] Iteratively optimizing the network operation state prediction model to be trained according to each of the network operation state training label values ​​and each of the network operation state training prediction values ​​to obtain a network operation state prediction model to be tested;

[0133] Obtaining Internet of Things operation test data corresponding to at least one test time interval and a network operation status test tag value of a next time interval of each test time interval, wherein the Internet of Things operation test data includes registration test data, control plane session test data, user plane session test data, and user plane traffic test data;

[0134] Determining the test network operation status of the Internet of Things in each of the test time intervals based on the operation test data of each of the Internet of Things and a preset fuzzy logic decision rule;

[0135] Inputting the IoT operation test data and the test network operation status corresponding to each of the test time intervals into the network operation status prediction model to be tested, and obtaining a network operation status test prediction value for the next time interval of each of the test time intervals;

[0136] Calculating the prediction accuracy of the network operation status prediction model to be tested according to each of the network operation status test label values ​​and each of the network operation status test prediction values;

[0137] In a case where the prediction accuracy exceeds a preset accuracy threshold, the network operation status prediction model to be tested is determined as a trained network operation status prediction model.

[0138] Exemplarily, the IoT anomaly identification device further includes an output module. After the step of performing IoT anomaly identification based on the IoT operation data of the current time interval, the output module is configured to:

[0139] When the Internet of Things is identified as being in an abnormal state, an abnormal prompt message is output.

[0140] Exemplarily, the registration data includes an initial registration success rate;

[0141] And / or, the control plane session data includes the control plane session establishment success rate

[0142] And / or, the user plane session data includes a user plane session establishment request success rate and an average number of online sessions;

[0143] And / or, the user plane traffic data includes N6 interface uplink traffic and N6 interface downlink traffic.

[0144] The IoT anomaly identification device provided in this application utilizes the IoT anomaly identification method described in the aforementioned embodiments to address the technical issue of poor timeliness in IoT anomaly identification in conventional technologies. Compared to related technologies, the beneficial effects of the IoT anomaly identification device provided in this application's embodiments are the same as those of the IoT anomaly identification method described in the aforementioned embodiments. Other technical features of the IoT anomaly identification device are the same as those disclosed in the aforementioned embodiments and are not further elaborated upon here.

[0145] In addition, an embodiment of the present application also provides a network device, which includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the IoT anomaly identification method as described above.

[0146] In addition, an embodiment of the present application also provides a storage medium, which is a computer-readable storage medium. A computer program is stored on the storage medium, and when the computer program is executed by a processor, the steps of the Internet of Things anomaly identification method as described above are implemented.

[0147] It should be noted that, in this document, the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or system comprising a series of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or system. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or system comprising the element.

[0148] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus the necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) as described above, and includes a number of instructions for enabling a terminal device (which can be a mobile phone, computer, server, or network device, etc.) to execute the methods described in each embodiment of the present application.

[0149] The above are merely optional embodiments of the present application and do not limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A method for identifying anomalies in the Internet of Things, wherein: The Internet of Things anomaly identification method comprises: Obtaining IoT operation data for the current time interval, wherein the IoT operation data includes registration data, control plane session data, user plane session data, and user plane traffic data; Based on the IoT operation data of the current time interval, IoT anomalies are identified.

2. The method for identifying anomalies in the Internet of Things according to claim 1, wherein: The step of identifying anomalies of the Internet of Things based on the Internet of Things operation data of the current time interval includes: Based on the Internet of Things operation data of the current time interval and a preset fuzzy logic decision rule, the network operation status of the Internet of Things in the current time interval is determined.

3. The method for identifying anomalies in the Internet of Things according to claim 2, wherein: After the step of determining the network operation state of the Internet of Things in the current time interval based on the Internet of Things operation data in the current time interval and the preset fuzzy logic decision rule, the method further includes: Based on the Internet of Things operation data of the current time interval and the network operation status of the current time interval, the network operation status of the Internet of Things in the next time interval is predicted.

4. The method for identifying anomalies in the Internet of Things according to claim 3, wherein: The step of predicting the network operation state of the Internet of Things in the next time interval based on the Internet of Things operation data of the current time interval and the network operation state of the current time interval includes: The network operation state of the Internet of Things in the next time interval is predicted by inputting the Internet of Things operation data of the current time interval and the network operation state of the current time interval into a network operation state prediction model, wherein the network operation state prediction model is a long short-term memory artificial neural network model.

5. The method for identifying anomalies in the Internet of Things according to claim 4, wherein: The Internet of Things anomaly identification method also includes: Obtaining Internet of Things operation training data corresponding to at least one training time interval and a network operation status training label value of a next time interval of each training time interval, wherein the Internet of Things operation training data includes registration training data, control plane session training data, user plane session training data, and user plane traffic training data; Determine the training network operation status of the Internet of Things in each training time interval based on the operation training data of each Internet of Things and the preset fuzzy logic decision rule; Inputting the Internet of Things operation training data corresponding to each of the training time intervals and the training network operation status corresponding to each of the training time intervals into the network operation status prediction model to be trained, and obtaining the network operation status training prediction value of the next time interval of each of the training time intervals, wherein the network operation status prediction model is a long short-term memory artificial neural network model; According to each of the network operation status training label values ​​and each of the network operation status training prediction values, the network operation status prediction model to be trained is iteratively optimized to obtain a trained network operation status prediction model.

6. The method for identifying anomalies in the Internet of Things according to claim 5, wherein: The step of iteratively optimizing the network operation state prediction model to be trained according to each of the network operation state training label values ​​and each of the network operation state training prediction values ​​to obtain a trained network operation state prediction model comprises: Iteratively optimizing the network operation state prediction model to be trained according to each of the network operation state training label values ​​and each of the network operation state training prediction values ​​to obtain a network operation state prediction model to be tested; Obtaining Internet of Things operation test data corresponding to at least one test time interval and a network operation status test tag value of a next time interval of each of the test time intervals, wherein the Internet of Things operation test data includes registration test data, control plane session test data, user plane session test data, and user plane traffic test data; Determine the test network operation status of the Internet of Things in each of the test time intervals based on the operation test data of each of the Internet of Things and a preset fuzzy logic decision rule; Inputting the Internet of Things operation test data corresponding to each of the test time intervals and the test network operation status corresponding to each of the test time intervals into the network operation status prediction model to be tested, and obtaining the network operation status test prediction value of the next time interval of each of the test time intervals; Calculating the prediction accuracy of the network operation status prediction model to be tested according to each of the network operation status test label values ​​and each of the network operation status test prediction values; When the prediction accuracy exceeds a preset accuracy threshold, the network operation status prediction model to be tested is determined as a trained network operation status prediction model.

7. The method for identifying anomalies in the Internet of Things according to any one of claims 1 to 6, wherein: After the step of identifying anomalies of the Internet of Things based on the Internet of Things operation data of the current time interval, the method further includes: When the Internet of Things is identified to be in an abnormal state, an abnormal prompt message is output.

8. The method for identifying anomalies in the Internet of Things according to any one of claims 1 to 6, wherein: The registration data includes initial registration success rate; And / or, the control plane session data includes the control plane session establishment success rate And / or, the user plane session data includes a user plane session establishment request success rate and an average number of online sessions; And / or, the user plane traffic data includes N6 interface uplink traffic and N6 interface downlink traffic.

9. A network device, wherein: The network device comprises: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the method for identifying anomalies in the Internet of Things as described in any one of claims 1 to 8.

10. A storage medium, wherein: The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the Internet of Things anomaly identification method according to any one of claims 1 to 8 are implemented.

Images