Security monitoring method and apparatus for power internet-of-things terminal device, and medium

Abstract

A security monitoring method and apparatus for a power Internet-of-Things terminal device, and a medium. The method comprises: performing feature extraction on a power consumption analog signal of a CPU module in a power Internet-of-Things terminal device, so as to obtain an embedded encoding vector of power consumption statistical features and a power consumption analog modality feature map; transforming and screening the embedded encoding vector of the power consumption statistical feature and the power consumption analog modality feature map, so as to obtain a feature map; and on the basis of the feature map, determining whether the power Internet-of-Things terminal device is under attack, so as to obtain a security monitoring result. In the method, a power consumption analog signal is monitored in real time, dynamically changing features are captured, and intelligent analysis is then performed, such that whether a power Internet-of-Things terminal device is under attack can be accurately determined on the basis of change patterns and trends in an obtained feature map, thereby solving the problem of it being difficult to capture dynamic signal changes for accurate security monitoring of power Internet-of-Things terminal devices.

Description

A method, device and medium for security monitoring of power Internet of Things terminal equipment Technical Field

[0001] This invention relates to the field of power Internet of Things (IoT) technology, and in particular to a method, device and medium for security monitoring of power IoT terminal equipment. Background Technology

[0002] The Internet of Things (IoT) for power systems integrates advanced sensing, network communication, and data analytics technologies to enable real-time monitoring and management of all aspects of the power system, significantly improving operational efficiency and service quality. However, with the rapid increase in the number of IoT devices and the expanding scope of their applications, the security threats faced by IoT terminal devices are becoming increasingly severe. Malicious attackers may exploit hardware or software vulnerabilities in these devices to carry out attacks such as denial-of-service attacks and data tampering, seriously threatening the stable operation of the power system and the security of personal privacy. Existing technologies primarily rely on side-channel security monitoring and assessment of terminal devices to ensure their security during actual operation.

[0003] However, the methods for security monitoring and evaluation of side channels mainly rely on the classification and judgment of statistical characteristics of power consumption data of terminal devices. Although the statistical characteristic values ​​of power consumption data can reflect some basic characteristics of CPU power consumption, the power consumption characteristics of terminal devices usually change over time, and this static classification and judgment method usually cannot capture the dynamic behavior changes of signals, thus limiting its accuracy and reliability in practical applications. Summary of the Invention

[0004] This invention provides a method, apparatus, and medium for security monitoring of power Internet of Things (IoT) terminal devices, in order to solve the problem of difficulty in capturing dynamic changes in signals and to accurately monitor the security of power IoT terminal devices.

[0005] Obtain the power consumption analog signal of the CPU module from the power Internet of Things terminal device;

[0006] Feature extraction is performed on the power consumption simulation signal to obtain a power consumption statistical feature embedding encoding vector and a power consumption simulation mode feature map;

[0007] The power consumption statistical feature embedding encoding vector and power consumption analog mode feature map are subjected to linear transformation and dual feature filtering to obtain a power consumption analog-digital hybrid mode joint encoding feature map;

[0008] Based on the power consumption analog-digital hybrid mode joint coding feature map, it is determined whether the power Internet of Things terminal device has been attacked, and a security monitoring result is obtained.

[0009] This invention extracts features from analog power consumption signals, generating power consumption statistical feature embedding vectors and analog power consumption mode feature maps. These features reflect the power consumption characteristics of the device under different states, including normal and potential security threat states. Furthermore, analog power consumption signals are inherently dynamic; real-time monitoring and feature extraction of these signals capture the dynamic changes in power consumption. Since attacks often cause abnormal changes in power consumption patterns, this characteristic is crucial for identifying whether a device has been attacked. Linear transformation and dual feature filtering of the extracted power consumption statistical feature embedding vectors and analog power consumption mode feature maps further refine more representative feature information, helping to remove redundant information and retain the most valuable features for security monitoring, thereby improving monitoring accuracy. By jointly encoding power consumption statistical features and analog mode features, a hybrid analog-digital mode joint encoding feature map is formed, which more comprehensively reflects the device's operating status. This hybrid mode representation integrates the advantages of multiple information sources, improving the ability to identify complex attack behaviors.

[0010] Compared to existing technologies, this invention, by real-time monitoring of power consumption analog signals, capturing dynamic change characteristics, and performing intelligent analysis, can accurately determine whether power IoT terminal devices have been attacked based on the change patterns and trends in the obtained feature maps, and provide corresponding security monitoring results. Therefore, it can solve the problem of difficulty in capturing dynamic changes in signals and accurately monitoring the security of power IoT terminal devices.

[0011] As a preferred embodiment, feature extraction is performed on the power consumption analog signal to obtain a power consumption statistical feature embedding encoding vector and a power consumption analog mode feature map, specifically:

[0012] The analog power consumption signal is converted from analog to digital to obtain CPU power consumption data;

[0013] Several statistical feature values ​​are extracted from the CPU power consumption data to obtain CPU power consumption statistical features;

[0014] The interrelationships and interactions between the CPU power consumption statistics features are captured by low-dimensional embedding encoding, resulting in the power consumption statistics feature embedding encoding vector.

[0015] The power consumption simulation signal is analyzed by a power consumption simulation feature extractor to obtain the power consumption simulation mode feature map.

[0016] This preferred solution uses low-dimensional embedding coding technology to capture the interrelationships and interactions between CPU power consumption statistics and compress them into a low-dimensional space. This not only reduces the dimensionality of the data and computational complexity, but also preserves important information in the original data and improves the efficiency of data processing.

[0017] As a preferred embodiment, the power consumption simulation signal is analyzed using a power consumption simulation feature extractor to obtain the power consumption simulation mode feature map, specifically as follows:

[0018] The local features of the power consumption simulation signal are extracted by the depth convolution operation of the power consumption simulation feature extractor to obtain a local feature set;

[0019] Based on the pointwise convolution operation of the power consumption simulation feature extractor, the local feature set is integrated into a global feature representation to obtain the power consumption simulation mode feature map.

[0020] This preferred scheme utilizes a stack of multiple convolutional layers, where convolutional kernels at different levels can extract features at different levels of abstraction. Lower-level convolutional kernels typically extract low-level features such as edges and textures, while higher-level kernels extract more complex, global features. This multi-level feature extraction results in a richer and more comprehensive feature representation. Pointwise convolution operations can integrate and reduce the dimensionality of channel information from different local feature sets, thereby generating a global feature representation. This integration method helps reduce feature redundancy and improve the efficiency of feature representation.

[0021] As a preferred embodiment, the power consumption statistical feature embedding encoding vector and the power consumption analog mode feature map are subjected to linear transformation and dual feature filtering to obtain a power consumption analog-digital hybrid mode joint encoding feature map, specifically:

[0022] The power consumption statistical feature embedding encoding vector is linearly transformed according to two different weight modifier matrices to obtain a representation vector set including the first power consumption statistical feature mapping mode representation vector and the second power consumption statistical feature mapping mode representation vector.

[0023] Based on the gradient magnitude at each position in the representation vector set, the representation vector set is subjected to gradient magnitude-based masking processing to obtain a masked representation vector set including a masked first power statistical feature mapping mode representation vector and a masked second power statistical feature mapping mode representation vector.

[0024] The power consumption analog mode feature map is subjected to dual feature filtering based on the masked representation vector set to obtain the power consumption analog-digital hybrid mode joint coding feature map.

[0025] This preferred scheme uses two different weight modifier matrices to linearly transform the power consumption statistical feature embedding encoding vector, resulting in two feature mapping pattern representation vectors with different angles or emphases. This transformation increases the flexibility of feature expression and can capture more diverse feature information. Masking based on the gradient magnitude at each position in the representation vector set highlights features that have a significant impact on the final result while suppressing or ignoring features with less influence. This helps improve the accuracy and efficiency of feature extraction, enabling the model to more accurately focus on important feature information.

[0026] As a preferred embodiment, based on the gradient magnitude at each position in the representation vector set, the representation vector set is subjected to gradient magnitude-based masking processing to obtain a masked representation vector set including a masked first power statistical feature mapping pattern representation vector and a masked second power statistical feature mapping pattern representation vector, specifically:

[0027] Based on the representation vector set, the absolute value of the difference between the target feature value and the feature values ​​of its adjacent positions is calculated to obtain the gradient magnitude of each position in the first power consumption statistical feature mapping pattern representation vector and the second power consumption statistical feature mapping pattern representation vector.

[0028] The gradient magnitude is marked according to a preset mask threshold to obtain a masked first power consumption statistical feature mapping mode representation vector and a masked second power consumption statistical feature mapping mode representation vector.

[0029] The masked representation vector set is composed of the masked first power consumption statistical feature mapping pattern representation vector and the masked second power consumption statistical feature mapping pattern representation vector.

[0030] This preferred solution, by calculating the absolute value of the difference between the target feature value and the feature values ​​at its adjacent locations, can highlight the spatial variation of the feature value, which is beneficial for capturing key change points in the power consumption statistical feature mapping pattern. By using a preset mask threshold, it is possible to flexibly control which feature locations are retained or ignored, thereby optimizing the feature selection effect by adjusting the threshold.

[0031] As a preferred embodiment, the gradient magnitude is marked according to a preset masking threshold to obtain a masked first power consumption statistical feature mapping pattern representation vector and a masked second power consumption statistical feature mapping pattern representation vector, specifically:

[0032] If the gradient magnitude is greater than the mask threshold, then the corresponding position of the gradient magnitude is marked as active in the masking vector;

[0033] If the gradient magnitude is less than or equal to the mask threshold, then the corresponding position of the gradient magnitude is marked as a suppression state in the masking vector;

[0034] By traversing each position in the first power consumption statistical feature mapping pattern representation vector and the second power consumption statistical feature mapping pattern representation vector, the masked first power consumption statistical feature mapping pattern representation vector and the masked second power consumption statistical feature mapping pattern representation vector are obtained.

[0035] In this preferred scheme, the locations with larger gradient magnitudes usually represent significant changes in feature values ​​in space, and these locations often contain important information. By marking these locations as active states and other locations as suppressed states, features that have little impact on the results can be effectively filtered out, thereby retaining the feature information that is more critical to the power consumption statistical feature mapping pattern representation.

[0036] As a preferred embodiment, the power consumption analog mode feature map is subjected to dual feature filtering based on the masked representation vector set to obtain the power consumption analog-digital hybrid mode joint coded feature map, specifically as follows:

[0037] Using the feature values ​​at each position in the masked first power statistical feature mapping mode representation vector of the masked representation vector set as weights, the feature matrices of each channel of the power simulation mode feature map are weighted to obtain the weighted power simulation mode feature map.

[0038] The weighted power consumption simulation mode feature map is activated to obtain a preliminary filtered power consumption simulation mode feature map.

[0039] Based on the masked second power consumption statistical feature mapping mode representation vector and the preset function, the power consumption analog mode feature map after the initial screening is screened again to obtain the power consumption analog-digital hybrid mode joint coding feature map.

[0040] This preferred scheme utilizes the feature values ​​at each position in the masked first power consumption statistical feature mapping mode representation vector as weights to weight the feature matrices of each channel in the power consumption analog mode feature map. This allows important feature positions to receive greater weight in the weighted feature map, thereby enhancing the influence of these features in subsequent processing and improving the accuracy and effectiveness of feature representation. This dual screening mechanism can further eliminate features that have a small impact on the results, while retaining and strengthening features that contribute significantly to the power consumption analog-digital hybrid mode joint coding feature map, thus improving the accuracy and efficiency of feature selection.

[0041] As a preferred embodiment, the power IoT terminal device is determined to be under attack based on the power consumption analog-digital hybrid mode joint coding feature map, thereby obtaining a security monitoring result. Specifically:

[0042] The feature values ​​in the power consumption analog-digital hybrid mode joint coding feature map are modulated to calculate two modulation values;

[0043] Phase transformation is performed on the power consumption analog-digital hybrid mode joint coding feature map based on the two modulation values ​​to obtain an optimized power consumption analog-digital hybrid mode joint coding phase transformation feature map;

[0044] The optimized power consumption analog-digital hybrid mode joint encoding phase transition feature map is anomaly identified using a preset classifier to obtain the security monitoring results.

[0045] This preferred scheme utilizes the two calculated modulation values ​​to perform phase transformation on the power consumption analog-digital hybrid mode joint coding feature map, which can realize the rearrangement and combination of the feature map in the phase domain. This phase transformation can reveal the behavior of the feature map under different phases, thereby more accurately reflecting the power consumption characteristics of the system under different states. Furthermore, the phase transformation also helps to improve the accuracy and effectiveness of subsequent anomaly identification.

[0046] As a preferred solution, the power consumption analog signal of the CPU module is obtained from the power Internet of Things terminal device, specifically:

[0047] A sampling resistor is connected in series between the power module and the CPU module of the power Internet of Things terminal device, and the current analog signal of the CPU module is obtained by collecting the voltage drop across the sampling resistor.

[0048] The current analog signal is processed based on the sampling resistor to obtain the power consumption analog signal of the CPU module.

[0049] In this preferred embodiment, since current directly reflects power consumption, the power consumption of the CPU module can be calculated in real time by monitoring the voltage drop across the sampling resistor. This helps to promptly detect and address potential power consumption anomalies.

[0050] This application also provides a safety monitoring device for power Internet of Things terminal equipment, including a signal module, an extraction module, a filtering module and a detection module;

[0051] The signal module is used to obtain the power consumption analog signal of the CPU module from the power Internet of Things terminal device;

[0052] The extraction module is used to extract features from the power consumption analog signal to obtain a power consumption statistical feature embedding encoding vector and a power consumption analog mode feature map;

[0053] The filtering module is used to perform linear transformation and dual feature filtering on the power consumption statistical feature embedding encoding vector and the power consumption analog mode feature map to obtain the power consumption analog-digital hybrid mode joint encoding feature map;

[0054] The detection module is used to determine whether the power Internet of Things terminal device has been attacked based on the power consumption analog-digital hybrid mode joint coding feature map, and obtain security monitoring results.

[0055] As a preferred embodiment, the extraction module includes a data unit, a feature unit, a vector unit, and a feature map unit;

[0056] The data unit is used to perform analog-to-digital conversion on the power consumption analog signal to obtain CPU power consumption data.

[0057] The feature unit is used to extract several statistical feature values ​​from the CPU power consumption data to obtain CPU power consumption statistical features.

[0058] The vector unit is used to capture the interrelationships and interactions between the CPU power consumption statistical features through low-dimensional embedding encoding, and to obtain the power consumption statistical feature embedding encoding vector.

[0059] The feature map unit is used to perform waveform feature analysis on the power consumption simulation signal according to the power consumption simulation feature extractor to obtain the power consumption simulation mode feature map.

[0060] As a preferred embodiment, the feature map unit includes a feature subunit and a representation subunit;

[0061] The feature subunit is used to extract local features of the power consumption simulation signal through the depth convolution operation of the power consumption simulation feature extractor to obtain a local feature set;

[0062] The representation subunit is used to integrate the local feature set into a global feature representation based on the pointwise convolution operation of the power consumption simulation feature extractor, thereby obtaining the power consumption simulation mode feature map.

[0063] As a preferred embodiment, the filtering module includes a transformation unit, a mask unit, and a dual-screen unit;

[0064] The transformation unit is used to perform a linear transformation on the power consumption statistical feature embedding encoding vector according to two different weight modifier matrices to obtain a representation vector set including the first power consumption statistical feature mapping mode representation vector and the second power consumption statistical feature mapping mode representation vector.

[0065] The masking unit is used to perform gradient magnitude-based masking on the representation vector set based on the gradient magnitude at each position in the representation vector set, to obtain a masked representation vector set including a masked first power consumption statistical feature mapping mode representation vector and a masked second power consumption statistical feature mapping mode representation vector.

[0066] The dual-screening unit is used to perform dual feature screening on the power consumption analog mode feature map according to the masked representation vector set, so as to obtain the power consumption analog-digital hybrid mode joint coding feature map.

[0067] As a preferred embodiment, the mask unit includes a gradient subunit, a marker subunit, and a vector subunit;

[0068] The gradient subunit is used to calculate the absolute value of the difference between the target feature value and the feature value of its adjacent position based on the representation vector set, so as to obtain the gradient magnitude of each position in the first power consumption statistical feature mapping mode representation vector and the second power consumption statistical feature mapping mode representation vector.

[0069] The marking subunit is used to mark the gradient magnitude according to a preset mask threshold to obtain a masked first power consumption statistical feature mapping mode representation vector and a masked second power consumption statistical feature mapping mode representation vector.

[0070] The vector subunit is used to form the masked representation vector set by the masked first power consumption statistical feature mapping mode representation vector and the masked second power consumption statistical feature mapping mode representation vector.

[0071] As a preferred embodiment, the marker subunit is specifically:

[0072] If the gradient magnitude is greater than the mask threshold, then the corresponding position of the gradient magnitude is marked as active in the masking vector;

[0073] If the gradient magnitude is less than or equal to the mask threshold, then the corresponding position of the gradient magnitude is marked as a suppression state in the masking vector;

[0074] By traversing each position in the first power consumption statistical feature mapping pattern representation vector and the second power consumption statistical feature mapping pattern representation vector, the masked first power consumption statistical feature mapping pattern representation vector and the masked second power consumption statistical feature mapping pattern representation vector are obtained.

[0075] As a preferred embodiment, the dual-screening unit includes a weighting subunit, an activation subunit, and a screening subunit;

[0076] The weighting subunit is used to apply weights to the feature matrices of each channel of the power consumption simulation mode feature map by using the feature values ​​of each position in the masked first power consumption statistical feature mapping mode representation vector of the masked representation vector set as weights, so as to obtain the weighted power consumption simulation mode feature map.

[0077] The activation subunit is used to activate the weighted power consumption simulation mode feature map to obtain a preliminary filtered power consumption simulation mode feature map.

[0078] The filtering subunit is used to perform feature filtering again on the power simulation mode feature map after the initial filtering based on the masked second power statistical feature mapping mode representation vector and the preset function, so as to obtain the power simulation-digital hybrid mode joint coding feature map.

[0079] As a preferred embodiment, the detection module includes a modulation unit, a phase unit, and a recognition unit;

[0080] The modulation unit is used to modulate the feature values ​​in the power consumption analog-digital hybrid mode joint coding feature map and calculate two modulation values.

[0081] The phase unit is used to perform phase transformation on the power consumption analog-digital mixed-mode joint coding feature map according to the two modulation values ​​to obtain an optimized power consumption analog-digital mixed-mode joint coding phase transformation feature map;

[0082] The identification unit is used to identify anomalies in the optimized power consumption analog-digital hybrid mode joint coded phase transition feature map according to a preset classifier, and obtain the security monitoring result.

[0083] As a preferred embodiment, the signal module includes a data acquisition unit and a processing unit;

[0084] The acquisition unit is used to connect a sampling resistor in series between the power module and the CPU module of the power Internet of Things terminal device, and to obtain the current analog signal of the CPU module by acquiring the voltage drop across the sampling resistor.

[0085] The processing unit is used to perform signal processing on the current analog signal based on the sampling resistor to obtain the power consumption analog signal of the CPU module.

[0086] This application also provides a storage medium storing a computer program, which is called and executed by a computer to implement the security monitoring method for a power Internet of Things terminal device as described above. Attached Figure Description

[0087] Figure 1 is a flowchart illustrating a security monitoring method for a power Internet of Things (IoT) terminal device provided in an embodiment of this application;

[0088] Figure 2 is a block diagram of an electronic device provided in an embodiment of this application;

[0089] Figure 3 is an application scenario diagram provided by an embodiment of this application;

[0090] Figure 4 is a structural schematic diagram of a safety monitoring device for a power Internet of Things terminal equipment provided in an embodiment of this application. Detailed Implementation

[0091] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0092] In the description of this application, it should be understood that the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined as "first" and "second" may explicitly or implicitly include one or more of that feature. In the description of this application, unless otherwise stated, "several" means two or more.

[0093] The safety monitoring method for power Internet of Things (IoT) terminal devices provided in this application is mainly applied to situations where it is necessary to overcome the limitations of existing technologies that rely solely on power consumption data statistical characteristics for safety monitoring, and to achieve more accurate, dynamic, and comprehensive safety monitoring of power IoT terminal devices.

[0094] Example 1:

[0095] Please refer to Figure 1. An embodiment of this application provides a security monitoring method for power Internet of Things (IoT) terminal devices, including S1 to S4. The specific implementation steps are as follows:

[0096] S1. Obtain the power consumption analog signal of the CPU module from the power Internet of Things terminal device.

[0097] Step S1 in this embodiment of the application is specifically as follows:

[0098] A sampling resistor with a known resistance value is connected in series between the power module and the CPU module of the power Internet of Things (IoT) terminal device. The "CPU module" in the power IoT terminal is a key hardware component. As the computing core of the IoT device or terminal, it is responsible for executing program instructions, processing data, coordinating communication tasks, managing storage resources, and controlling other parts of the device.

[0099] Based on Kirchhoff's current law, the voltage drop across the sampling resistor is continuously monitored and collected by the data acquisition module. Ohm's law is used to calculate the current flowing through the CPU module by combining the voltage drop and the sampling resistor, thus obtaining the analog current signal of the CPU module.

[0100] Based on the sampling resistor, the current analog signal is converted into a power consumption analog signal using a preset power consumption calculation formula.

[0101] In this embodiment S1, considering that directly connecting the device to the CPU's internal circuit for current monitoring may cause short circuits or other electrical faults, thereby disrupting the normal operation of the terminal device, a sampling resistor with a known resistance value is connected in series. When current passes through the resistor, a voltage drop will be generated across the resistor, thereby obtaining a current analog signal, which is beneficial for maintaining device stability. Furthermore, converting the current analog signal into a power consumption analog signal is beneficial for more intuitively reflecting the CPU's working status and energy consumption.

[0102] Furthermore, since current is a direct reflection of power consumption, the power consumption of the CPU module can be calculated in real time by monitoring the voltage drop across the sampling resistor, which helps to promptly detect and address potential power consumption anomalies.

[0103] S2. Extract features from the power consumption analog signal to obtain the power consumption statistical feature embedding encoding vector and the power consumption analog mode feature map.

[0104] Step S2 in this embodiment includes S2.1 to S2.2; wherein, S2.1 is the process of performing low-dimensional embedding encoding to obtain the power consumption statistical feature embedding encoding vector, and S2.2 is the process of performing convolution operation to generate a power consumption simulated mode feature map, specifically as follows:

[0105] S2.1 Perform AD conversion on the power consumption analog signal to obtain CPU power consumption data;

[0106] Statistical analysis techniques are used to extract several statistical feature values ​​from CPU power consumption data to obtain CPU power consumption statistical features. These features include mean, maximum, minimum, skewness, kurtosis, spectral mean, spectral variance, spectral standard deviation, and root mean square amplitude. They comprehensively reflect the average level, fluctuation range, asymmetry, kurtosis, frequency component information, overall energy level, power consumption stability, and randomness and irregularity of the power consumption data.

[0107] The CPU power consumption statistics feature is embedded and encoded in a low dimension by using a power consumption statistics feature embedding and encoding matrix. This maps multiple statistical feature values ​​to a unified low-dimensional feature space, integrates the information of multiple statistical feature values, captures the interrelationships and interactions between various statistical feature values, and generates a more representative power consumption statistics feature embedding and encoding vector.

[0108] This embodiment S2.1 can extract the power consumption statistical features of the CPU module; by calculating the CPU power consumption statistical features, the energy consumption distribution characteristics of the CPU module can be revealed; and by making full use of the implicit information in the extracted multiple statistical feature values, the features can be embedded and encoded in a low dimension, which can capture the interrelationships and interactions between the CPU power consumption statistical features and compress them into a low-dimensional space. This not only reduces the dimensionality of the data and the computational complexity, but also retains the important information in the original data and improves the efficiency of data processing, thereby generating a more representative power consumption statistical feature embedding and encoding vector, providing a more compact and effective data representation for subsequent security monitoring.

[0109] S2.2. Through the depthwise convolution operation of the power consumption simulation feature extractor in the depthwise separable convolutional neural network model, a convolution kernel is independently applied to each input channel (different time steps or frequency components of the power consumption simulation signal). The purpose is to perform waveform feature analysis on the power consumption simulation signal to extract local features within each input channel, especially features related to the power consumption waveform structure, such as waveform shape and amplitude changes, thereby extracting local features of the power consumption simulation signal and obtaining a local feature set.

[0110] The pointwise convolution operation based on the power consumption simulation feature extractor generates a power consumption simulation modal feature map by weighted summation of all depth convolution output channels at each position.

[0111] In this embodiment, S2.2 can capture the temporal variation pattern of CPU power consumption. Deep convolution is responsible for extracting local features, while pointwise convolution is responsible for integrating these local features into a global feature representation. Through the synergistic effect of deep convolution and pointwise convolution, the waveform structure and temporal variation features in the power consumption simulation signal can be deeply mined, such as the rising edge, falling edge, peaks, troughs, periodic changes, bursts, and frequency drift of the waveform, thereby generating a power consumption simulation mode feature map. Furthermore, the obtained feature map not only captures the temporal variation features of the power consumption signal, but also reflects the inherent structure and pattern of the power consumption waveform. This feature map generation method not only reduces the amount of computation, but also improves the model's learning efficiency and feature extraction capability.

[0112] S3. Perform linear transformation and dual feature filtering on the embedded coding vector of power consumption statistical features and the power consumption analog mode feature map to obtain the power consumption analog-digital hybrid mode joint coding feature map.

[0113] Step S3 in this embodiment includes S3.1 to S3.3; wherein, S3.1 is the process of performing a linear transformation to obtain a representation vector set A, S3.2 is the process of performing feature masking to obtain a masked representation vector set B, and S3.3 is the process of performing dual feature filtering to generate a power consumption analog-digital mixed-mode joint coding feature map, specifically as follows:

[0114] S3.1. Based on the first weight modifier matrix and the second weight modifier matrix, perform a linear transformation on the power consumption statistical feature embedding encoding vector to obtain a representation vector set A, which includes the first power consumption statistical feature mapping pattern representation vector and the second power consumption statistical feature mapping pattern representation vector.

[0115] In this embodiment S3.1, the power consumption statistical feature embedding encoding vector is linearly transformed by two different weight modifier matrices to expand the range of feature expression. This allows the correlation between power consumption statistical features and power consumption analog mode features to be captured from different perspectives, and this transformation increases the flexibility of feature expression.

[0116] S3.2 For each position of the first power consumption statistical feature mapping pattern representation vector in the representation vector set A, calculate the absolute value of the difference between the target feature value and the feature value of the adjacent previous and next positions to obtain the gradient magnitude of each position in the first power consumption statistical feature mapping pattern representation vector.

[0117] If the gradient magnitude is greater than the preset mask threshold, the corresponding position of the gradient magnitude is marked as an active state in the masking vector; where the active state can be represented as 1.

[0118] If the gradient magnitude is less than or equal to the mask threshold, the corresponding position of the gradient magnitude is marked as a suppressed state in the masking vector; where the suppressed state can be represented as 0.

[0119] By traversing all positions of the first power consumption statistical feature mapping pattern representation vector and applying the above masking processing logic, a masked first power consumption statistical feature mapping pattern representation vector of the same length as the original vector is finally generated.

[0120] Similarly, based on the gradient magnitude of each position of the second power consumption statistical feature mapping pattern representation vector in the representation vector set A, the second power consumption statistical feature mapping pattern representation vector is subjected to gradient magnitude-based masking to obtain the masked second power consumption statistical feature mapping pattern representation vector.

[0121] The masked representation vector set B is composed of the masked first power consumption statistical feature mapping mode representation vector and the masked second power consumption statistical feature mapping mode representation vector.

[0122] In this embodiment, S3.2 performs feature masking based on the gradient magnitude at each position in the two feature vectors after linear transformation. This can highlight features that have a greater impact on the final result, while suppressing or ignoring features that have a smaller impact. This helps to improve the accuracy and efficiency of feature extraction, enabling the model to focus more accurately on important feature information.

[0123] Furthermore, locations with large gradient magnitudes typically represent significant changes in feature values ​​in space, and these locations often contain important information. By marking these locations as active states and other locations as inhibited states, features that have little impact on the results can be effectively filtered out, thus retaining the feature information that is more critical to the power consumption statistical feature mapping pattern representation.

[0124] Furthermore, by calculating the absolute value of the difference between the target feature value and the feature values ​​at its adjacent locations, the spatial variation of the feature value can be highlighted, which is beneficial for capturing key change points in the power consumption statistical feature mapping pattern. By using a preset mask threshold, it is possible to flexibly control which feature locations are retained or ignored, thereby optimizing the feature selection effect by adjusting the threshold.

[0125] S3.3. Using the eigenvalues ​​of each position in the masked first power statistical feature mapping mode representation vector of the masked representation vector set B as weights, the feature matrices of each channel of the power simulation mode feature map are weighted to obtain the weighted power simulation mode feature map.

[0126] The hyperbolic tangent function is used to activate the weighted power consumption simulation mode feature map to obtain the power consumption simulation mode feature map after preliminary screening.

[0127] Based on the feature interaction joint coding formula, the masked second power statistical feature mapping mode representation vector and the Sigmoid function in the masked representation vector set B are used to perform feature filtering again on the power analog mode feature map after the initial screening, so as to obtain the power analog-digital hybrid mode joint coding feature map.

[0128] The joint feature coding formula is as follows:

[0129] Among them, V meta This represents the embedding of power consumption statistics into the encoding vector. This represents the first weight modifier matrix. Let w represent the second weight modifier matrix. 0f and w 0g Let V1 and V2 represent different bias terms. V1 represents the first power consumption statistical feature mapping pattern representation vector, and V2 represents the second power consumption statistical feature mapping pattern representation vector. V1(i+1) and V1(i-1) represent the feature values ​​at positions i+1 and i-1 in the first power consumption statistical feature mapping pattern representation vector, respectively. V2(i+1) and V2(i-1) represent the feature values ​​at positions i+1 and i-1 in the second power consumption statistical feature mapping pattern representation vector, respectively. mask(·) represents masking, and θ is a preset mask threshold. The masked first power consumption statistical feature mapping pattern represents the eigenvalue at the i-th position of the vector, V. 1s This represents the masked first power consumption statistical feature mapping pattern representation vector. The masked second power consumption statistical feature mapping pattern represents the eigenvalue at the i-th position of the vector, V. 2s This represents the masked second power consumption statistical feature mapping pattern representation vector. F represents matrix multiplication. main This represents the power consumption analog mode characteristic map, where tanh is the hyperbolic tangent function, and T... gate This represents the power consumption analog mode feature map after initial screening, where sigmoid is the sigmoid activation function, and F represents the power consumption analog-digital hybrid mode joint coding feature map.

[0130] In this embodiment, S3.3 extracts the parts closely related to power consumption statistics by performing weighted operations along the channel dimension, thereby strengthening the important feature interaction between the two. Furthermore, the hyperbolic tangent function and the sigmoid function are introduced for feature activation processing, which can improve the nonlinear expressive power of the features. The hyperbolic tangent function, with an output range between -1 and +1, is used to initially screen features highly correlated with power consumption statistics; while the sigmoid function, with an output range between 0 and 1, is suitable for probability estimation and binarization decision-making, and is used for final feature screening to obtain the power consumption analog-digital hybrid mode joint encoding feature map.

[0131] Furthermore, by using the feature values ​​at each position in the masked first power consumption statistical feature map mode representation vector as weights to weight the feature matrices of each channel in the power consumption analog mode feature map, important feature positions can receive greater weight in the weighted feature map, thereby enhancing the influence of these features in subsequent processing and helping to improve the accuracy and effectiveness of feature representation. This dual screening mechanism can further eliminate features that have a small impact on the results, while retaining and strengthening features that contribute significantly to the power consumption analog-digital hybrid mode joint coding feature map, thus improving the accuracy and efficiency of feature selection.

[0132] As can be seen, this embodiment S3 proposes a feature interaction screening and encoding method based on attention mechanism. Specifically, firstly, the power consumption statistical feature embedding encoding vector is linearly transformed by two different weight modifier matrices to expand the expression range of the features, thereby enabling the capture of the correlation between power consumption statistical features and power consumption simulation mode features from different perspectives.

[0133] Next, feature masking is performed based on the gradient magnitude at each position in the two feature vectors after linear transformation to highlight important power consumption statistics, thereby enhancing the focus on important features in the subsequent feature selection process.

[0134] Furthermore, the two masked feature vectors are used to perform two feature filtering operations on the power consumption simulation mode feature map. By weighting along the channel dimension, the part closely related to the power consumption statistical features is extracted, thereby strengthening the important feature interaction between the two.

[0135] Furthermore, in order to improve the nonlinear expressive power of the features, hyperbolic tangent function and sigmoid function were introduced for feature activation processing in the two feature selection processes.

[0136] S4. Determine whether the power IoT terminal device has been attacked based on the power consumption analog-digital hybrid mode joint coding feature map, and obtain the security monitoring results.

[0137] Step S4 in this embodiment includes S4.1 to S4.2; wherein, S4.1 is the process of performing phase conversion to generate an optimized power consumption analog-digital mixed-mode joint coding feature map F, and S4.2 is the process of performing anomaly identification on the optimized power consumption analog-digital mixed-mode joint coding phase conversion feature map F to obtain security monitoring results, specifically as follows:

[0138] S4.1 Calculate the sum of the absolute values ​​of each feature value in the power consumption analog-digital mixed-mode joint coding feature map to obtain the first power consumption analog-digital mixed-mode joint coding and modulation value; calculate the square root of the sum of the squares of each feature value in the power consumption analog-digital mixed-mode joint coding feature map to obtain the second power consumption analog-digital mixed-mode joint coding and modulation value.

[0139] The power consumption analog-digital mixed-mode joint coding feature map is subtracted by a dot from the second power consumption analog-digital mixed-mode joint coding and modulation value. Then, it is multiplied by a dot with the number of eigenvalues ​​of the power consumption analog-digital mixed-mode joint coding feature map and the reciprocal of the first power consumption analog-digital mixed-mode joint coding and modulation value. The reciprocal of each eigenvalue is then taken to obtain the first power consumption analog-digital mixed-mode joint coding phase transition feature map.

[0140] The power consumption analog-digital mixed-mode joint coding feature map is subtracted by a dot from the first power consumption analog-digital mixed-mode joint coding and modulation value. Then, it is multiplied by a dot by the square root of the number of feature values ​​of the power consumption analog-digital mixed-mode joint coding feature map and the reciprocal of the second power consumption analog-digital mixed-mode joint coding and modulation value. The reciprocal of each feature value is then taken to obtain the second power consumption analog-digital mixed-mode joint coding phase transition feature map.

[0141] Calculate the dot product feature map of the second power consumption analog-digital hybrid mode joint coding phase transition feature map and the weighted hyperparameters, and subtract the dot product feature map from the first power consumption analog-digital hybrid mode joint coding phase transition feature map to obtain the optimized power consumption analog-digital hybrid mode joint coding feature map F.

[0142] The optimized power consumption analog-digital hybrid mode joint coding feature map is as follows: f i ∈F∈R W×H×C n = W × H × C

[0143] Among them, f iLet F represent the individual eigenvalues ​​of the power consumption analog-digital mixed-mode joint coding feature map, where α is the first power consumption analog-digital mixed-mode joint coding and modulation value, β is the second power consumption analog-digital mixed-mode joint coding and modulation value, F is the power consumption analog-digital mixed-mode joint coding feature map, W is the length of the power consumption analog-digital mixed-mode joint coding feature map, C is the number of channels in the power consumption analog-digital mixed-mode joint coding feature map, H is the height of the power consumption analog-digital mixed-mode joint coding feature map, n represents the number of eigenvalues ​​in the power consumption analog-digital mixed-mode joint coding feature map, and R represents the set of real numbers. -1 It is the reciprocal of the first power consumption analog-digital mixed-mode joint coding and modulation value, [·] ⊙-1 It is the reciprocal of each eigenvalue. F1 is the first power consumption analog-digital mixed-mode joint coded phase transition feature map, F2 is the second power consumption analog-digital mixed-mode joint coded phase transition feature map, and β is the reciprocal of each eigenvalue. -1 It is the reciprocal of the second power consumption analog-digital mixed-mode joint coding and modulation value, ω is the weighted hyperparameter, F' is the optimized power consumption analog-digital mixed-mode joint coding feature map, and ⊙ is the positional dot product. It is subtracted based on position.

[0144] In this embodiment S4.1, the difference between the feature values ​​in the power consumption analog-digital hybrid mode joint coding feature map and the difference in modulation representation relative to the overall feature set in the power consumption analog-digital hybrid mode joint coding feature map is used as semantic change intensity information. Different modulation representations are used to perform phase transformation corresponding to position-based intensity modulation. By performing spatial translation operation based on alternating stacking under the set scale equalization of the power consumption analog-digital hybrid mode joint coding feature map, the aggregation enhancement of semantic change phase perception can improve the axial aggregation perception along the feature aggregation direction, thereby improving the aggregation semantic perception effect of the power consumption analog-digital hybrid mode joint coding feature map for detailed semantic changes, thereby improving the expression effect of the power consumption analog-digital hybrid mode joint coding feature map and improving the accuracy of the recognition result obtained by inputting it into a classifier-based anomaly detector.

[0145] Furthermore, by using the two calculated modulation values ​​to perform phase transformation on the power consumption analog-digital hybrid mode joint coding feature map, the feature map can be rearranged and combined in the phase domain. This phase transformation can reveal the behavior of the feature map under different phases, thus more accurately reflecting the power consumption characteristics of the system under different states. In addition, phase transformation also helps to improve the accuracy and effectiveness of subsequent anomaly identification.

[0146] S4.2. Based on the anomaly detector of the classifier, anomaly identification is performed on the optimized power consumption analog-digital hybrid mode joint coding phase transition feature map F to obtain the security monitoring result; wherein, the security monitoring result is used to indicate whether the power Internet of Things terminal equipment has been attacked.

[0147] For the application of the embodiments of this application, please refer to FIG2. FIG2 is a block diagram of an electronic device provided in the embodiments of this application, showing a structural schematic diagram of an electronic device 600 suitable for implementing the first embodiment of this application;

[0148] The terminal devices in this application embodiment may include, but are not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), and in-vehicle terminals (e.g., in-vehicle navigation terminals), as well as fixed terminals such as digital TVs and desktop computers. The electronic device shown in Figure 2 is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments in this application.

[0149] As shown in Figure 2, the electronic device 600 may include a processing unit (e.g., a central processing unit, a graphics processing unit, etc.) 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage device 608 into a random access memory (RAM) 603. The RAM 603 also stores various programs and data required for the operation of the electronic device 600. The processing unit 601, ROM 602, and RAM 603 are interconnected via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0150] Typically, the following devices can be connected to I / O interface 605: input devices 606 including, for example, touchscreens, touchpads, keyboards, mice, cameras, microphones, accelerometers, gyroscopes, etc.; output devices 607 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 608 including, for example, magnetic tapes, hard disks, etc.; and communication devices 609. Communication device 609 allows electronic device 600 to communicate wirelessly or wiredly with other devices to exchange data. Although Figure 2 shows electronic device 600 with various devices, it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed alternatively.

[0151] Specifically, according to embodiments of this application, the process described in FIG1 can be implemented as a computer software program. For example, embodiments of this application include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods shown in the flowchart. In such embodiments, the computer program can be downloaded and installed from a network via communication device 609, or installed from storage device 608, or installed from ROM 602. When the computer program is executed by processing device 601, it performs the functions defined in the methods of embodiments of this application.

[0152] It should be noted that the computer-readable medium described above in this application can be a computer-readable signal medium, a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this application, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this application, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium can be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wires, optical fibers, RF (radio frequency), etc., or any suitable combination thereof.

[0153] In some implementations, clients and servers can communicate using any currently known or future-developed network protocol such as HTTP (Hypertext Transfer Protocol) and can interconnect with digital data communication (e.g., communication networks) of any form or medium. Examples of communication networks include local area networks (“LANs”), wide area networks (“WANs”), the Internet (e.g., the Internet of Things), and peer-to-peer networks (e.g., ad hoc peer-to-peer networks), as well as any currently known or future-developed networks.

[0154] The aforementioned computer-readable medium may be included in the aforementioned electronic device; or it may exist independently and not assembled into the electronic device.

[0155] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof. These programming languages ​​include, but are not limited to, object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as "C" or similar languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0156] The flowcharts and block diagrams in Figures 1-2 illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those shown in the figures. For example, two consecutively represented blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0157] The modules described in the embodiments of this application can be implemented in software or hardware. The name of a module does not necessarily limit the module itself; for example, a test parameter acquisition module can also be described as "a module for acquiring device test parameters corresponding to a target device".

[0158] The functions described above in this document can be performed, at least in part, by one or more hardware logic components. For example, exemplary types of hardware logic components that can be used, without limitation, include: Field Programmable Gate Arrays (FPGAs), Application-Specific Integrated Circuits (ASICs), Application Standard Products (ASSPs), System-on-Chip (SoCs), Complex Programmable Logic Devices (CPLDs), and so on.

[0159] In the context of this application, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. Machine-readable media can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0160] To apply the embodiments of this application, please refer to Figure 3. Figure 3 is an application scenario diagram provided by the embodiments of this application, showing the application scenario of a security monitoring method for a power Internet of Things terminal device according to this embodiment.

[0161] As shown in Figure 3, in this application scenario, firstly, a sampling resistor is connected in series between the power module (e.g., M1 as shown in Figure 3) and the CPU module (e.g., M2 as shown in Figure 3) of the power IoT terminal device. The voltage drop across the sampling resistor is collected by the data acquisition module (e.g., M3 as shown in Figure 3) to obtain the current analog signal of the CPU module (e.g., C as shown in Figure 3). Then, the acquired current analog signal is input to a server (e.g., S as shown in Figure 3) that is equipped with a security monitoring algorithm based on the power IoT terminal device. The server can process the current analog signal based on the security monitoring algorithm of the power IoT terminal device to determine whether the power IoT terminal device has been attacked.

[0162] The above description is merely a preferred embodiment of this application and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of disclosure in this application is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-described concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features with similar functions disclosed in this application.

[0163] Furthermore, while the operations are described in a specific order, this should not be construed as requiring these operations to be performed in the specific order shown or in a sequential order. Multitasking and parallel processing may be advantageous in certain environments. Similarly, while several specific implementation details are included in the above discussion, these should not be construed as limiting the scope of this application. Certain features described in the context of individual embodiments may also be implemented in combination in a single embodiment. Conversely, various features described in the context of a single embodiment may also be implemented individually or in any suitable sub-combination in multiple embodiments.

[0164] Although the subject matter has been described using language specific to structural features and / or methodological logic, it should be understood that the defined subject matter is not necessarily limited to the specific features or actions described above. Rather, the specific features and actions described above are merely implementation examples. Regarding the apparatus in the above embodiments, the specific manner in which the various modules perform their operations has been described in detail in the embodiments relating to the method, and will not be elaborated upon here.

[0165] Overall, this embodiment has the following beneficial effects:

[0166] This application extracts features from power consumption analog signals, extracting power consumption statistical feature embedding encoding vectors and power consumption analog mode feature maps. These features reflect the power consumption characteristics of the device under different states, including normal state and potential security threat state. Furthermore, power consumption analog signals are themselves dynamically changing signals. By monitoring and extracting features from these signals in real time, the dynamic changes in power consumption can be captured. Since attacks often cause abnormal changes in power consumption patterns, this characteristic is crucial for identifying whether a device has been attacked. Linear transformation and dual feature filtering are applied to the extracted power consumption statistical feature embedding encoding vectors and power consumption analog mode feature maps to further refine more representative feature information, helping to remove redundant information and retain the most valuable features for security monitoring, thereby improving monitoring accuracy. By jointly encoding power consumption statistical features and analog mode features to form a power consumption analog-digital hybrid mode joint encoding feature map, the operating status of the device can be more comprehensively reflected. This hybrid mode representation can integrate the advantages of multiple information sources, improving the ability to identify complex attack behaviors.

[0167] Therefore, this application can effectively overcome the limitations of existing technologies that rely solely on power consumption data statistical characteristics for security monitoring, and achieve more accurate, dynamic and comprehensive security monitoring of power Internet of Things terminal devices.

[0168] Example 2:

[0169] Please refer to Figure 4. An embodiment of this application provides a safety monitoring device for a power Internet of Things terminal device, including a signal module 10, an extraction module 20, a filtering module 30, and a detection module 40.

[0170] Among them, the signal module 10 is used to obtain the power consumption analog signal of the CPU module from the power Internet of Things terminal device;

[0171] Extraction module 20 is used to extract features from power consumption analog signals to obtain power consumption statistical feature embedding encoding vector and power consumption analog mode feature map;

[0172] The filtering module 30 is used to perform linear transformation and dual feature filtering on the power consumption statistical feature embedding encoding vector and the power consumption analog mode feature map to obtain the power consumption analog-digital hybrid mode joint encoding feature map;

[0173] The detection module 40 is used to determine whether the power Internet of Things terminal device has been attacked based on the power consumption analog-digital hybrid mode joint coding feature map, and obtain the security monitoring results.

[0174] In one embodiment, the signal module 10 includes a data acquisition unit and a processing unit;

[0175] The acquisition unit is used to connect a sampling resistor of known resistance value in series between the power module and the CPU module of the power Internet of Things (IoT) terminal device. The CPU module in the power IoT terminal is a key hardware component. As the computing core of the IoT device or terminal, it is responsible for executing program instructions, processing data, coordinating communication tasks, managing storage resources, and controlling other parts of the device.

[0176] The acquisition unit is also used to continuously monitor and acquire the voltage drop across the sampling resistor based on Kirchhoff's current law, and calculate the current flowing through the CPU module by combining Ohm's law with the voltage drop and the sampling resistor, thus obtaining the analog current signal of the CPU module.

[0177] The processing unit is used to convert the current analog signal into a power consumption analog signal based on the sampling resistor and using a preset power consumption calculation formula.

[0178] In this embodiment, the signal module 10 takes into account that directly connecting the device to the CPU's internal circuit for current monitoring may cause short circuits or other electrical faults, thereby disrupting the normal operation of the terminal device. Therefore, by connecting a sampling resistor with a known resistance value in series, a voltage drop will be generated across the resistor when current passes through it, thereby obtaining a current analog signal, which is beneficial for maintaining device stability. Furthermore, converting the current analog signal into a power consumption analog signal is beneficial for more intuitively reflecting the CPU's working status and energy consumption.

[0179] Furthermore, since current is a direct reflection of power consumption, the power consumption of the CPU module can be calculated in real time by monitoring the voltage drop across the sampling resistor, which helps to promptly detect and address potential power consumption anomalies.

[0180] In one embodiment, the extraction module 20 includes a data unit, a feature unit, a vector unit, a feature sub-unit, and a representation sub-unit; wherein, the data unit, feature unit, and vector unit are processes of performing low-dimensional embedding encoding to obtain power consumption statistical feature embedding encoding vectors, and the feature sub-unit and representation sub-unit are processes of performing convolution operations to generate power consumption analog mode feature maps, specifically:

[0181] The data unit is used to perform AD conversion on the power consumption analog signal to obtain CPU power consumption data;

[0182] The feature unit is used to extract several statistical feature values ​​from CPU power consumption data using statistical analysis techniques to obtain CPU power consumption statistical features. Among them, CPU power consumption statistical features include mean, maximum, minimum, skewness, kurtosis, spectral mean, spectral variance, spectral standard deviation, and root mean square amplitude, which comprehensively reflect the average level, fluctuation range, asymmetry of data distribution, kurtosis, frequency component information, overall energy level, power consumption stability, and randomness and irregularity of the power consumption data.

[0183] The vector unit is used to perform low-dimensional embedding encoding of CPU power consumption statistics through the power consumption statistics feature embedding encoding matrix, so as to map multiple statistical feature values ​​to a unified low-dimensional feature space, integrate the information of multiple statistical feature values, capture the interrelationships and interactions between various statistical feature values, and generate a more representative power consumption statistics feature embedding encoding vector.

[0184] In this embodiment, the data unit, feature unit, and vector unit can extract the power consumption statistics of the CPU module. By calculating the CPU power consumption statistics, the energy consumption distribution characteristics of the CPU module can be revealed. Furthermore, by fully utilizing the implicit information in the extracted multiple statistical feature values ​​and performing low-dimensional embedding encoding on the features, the interrelationships and interactions between the CPU power consumption statistics can be captured and compressed into a low-dimensional space. This not only reduces the dimensionality of the data and the computational complexity but also retains important information in the original data, improving the efficiency of data processing. As a result, a more representative power consumption statistics feature embedding encoding vector is generated, providing a more compact and effective data representation for subsequent security monitoring.

[0185] The feature subunit is used to apply a convolution kernel independently to each input channel (different time steps or frequency components of the power analog signal) through the depthwise convolution operation of the power analog feature extractor in the depthwise separable convolutional neural network model. Its purpose is to perform waveform feature analysis on the power analog signal to extract local features within each input channel, especially features related to the power waveform structure, such as waveform shape and amplitude changes, thereby extracting local features of the power analog signal and obtaining a local feature set.

[0186] The subunit represents the pointwise convolution operation based on the power simulation feature extractor, which performs a weighted summation of all depth convolution output channels at each location to generate a power simulation modal feature map.

[0187] In this embodiment, the feature subunit and representation subunit can capture the temporal variation pattern of CPU power consumption. Depthwise convolution is responsible for extracting local features, while pointwise convolution integrates these local features into a global feature representation. Through the synergistic effect of depthwise and pointwise convolution, the waveform structure and temporal variation features in the power consumption simulation signal can be deeply mined, such as rising edges, falling edges, peaks, troughs, periodic changes, bursts, and frequency drift, thereby generating a power consumption simulation mode feature map. Furthermore, the resulting feature map not only captures the temporal variation features of the power consumption signal but also reflects the inherent structure and pattern of the power consumption waveform. This feature map generation method not only reduces computational load but also improves the model's learning efficiency and feature extraction capability.

[0188] In one embodiment, the filtering module 30 includes a transformation unit, a gradient subunit, a labeling subunit, a vector subunit, a weighting subunit, an activation subunit, and a filtering subunit; wherein, the transformation unit is the process of performing linear transformation to obtain a representation vector set A, the gradient subunit, the labeling subunit, and the vector subunit are the process of performing feature masking to obtain a masked representation vector set B, and the weighting subunit, the activation subunit, and the filtering unit are the process of performing dual feature filtering to generate a power consumption analog-digital hybrid mode joint coding feature map, specifically:

[0189] The transformation unit is used to perform a linear transformation on the power consumption statistical feature embedding encoding vector according to the first weight modifier matrix and the second weight modifier matrix to obtain a representation vector set A including the first power consumption statistical feature mapping pattern representation vector and the second power consumption statistical feature mapping pattern representation vector.

[0190] In this embodiment, the transformation unit performs a linear transformation on the power consumption statistical feature embedding encoding vector through two different weight modifier matrices to expand the range of feature expression. This allows the correlation between power consumption statistical features and power consumption analog mode features to be captured from different perspectives, and this transformation increases the flexibility of feature expression.

[0191] The gradient subunit is used to calculate the absolute value of the difference between the target feature value and the feature value of the preceding and following positions of the first power consumption statistical feature mapping pattern representation vector in the representation vector set A, so as to obtain the gradient magnitude of each position in the first power consumption statistical feature mapping pattern representation vector.

[0192] The marking subunit is used to mark the corresponding position of the gradient magnitude as an active state in the masking vector if the gradient magnitude is greater than a preset mask threshold; where the active state can be represented as 1.

[0193] The marker subunit is also used to mark the corresponding position of the gradient magnitude as a suppressed state in the masking vector if the gradient magnitude is less than or equal to the mask threshold; where the suppressed state can be represented as 0.

[0194] The marker subunit is also used to generate a masked first power statistical feature mapping pattern representation vector with the same length as the original vector by traversing all positions of the first power statistical feature mapping pattern representation vector and applying the above masking processing logic.

[0195] The marker subunit is also used similarly to perform gradient magnitude-based masking on the second power statistical feature mapping pattern representation vector based on the gradient magnitude at each position of the second power statistical feature mapping pattern representation vector in the representation vector set A, so as to obtain the masked second power statistical feature mapping pattern representation vector.

[0196] The vector sub-unit is used to construct a masked representation vector set B by the masked first power consumption statistical feature mapping mode representation vector and the masked second power consumption statistical feature mapping mode representation vector.

[0197] In this embodiment, the gradient subunit, label subunit, and vector subunit perform feature masking based on the gradient magnitude at each position in the two feature vectors after linear transformation. This can highlight features that have a greater impact on the final result, while suppressing or ignoring features that have a smaller impact. This helps to improve the accuracy and efficiency of feature extraction, enabling the model to focus more accurately on important feature information.

[0198] Furthermore, locations with large gradient magnitudes typically represent significant changes in feature values ​​in space, and these locations often contain important information. By marking these locations as active states and other locations as inhibited states, features that have little impact on the results can be effectively filtered out, thus retaining the feature information that is more critical to the power consumption statistical feature mapping pattern representation.

[0199] Furthermore, by calculating the absolute value of the difference between the target feature value and the feature values ​​at its adjacent locations, the spatial variation of the feature value can be highlighted, which is beneficial for capturing key change points in the power consumption statistical feature mapping pattern. By using a preset mask threshold, it is possible to flexibly control which feature locations are retained or ignored, thereby optimizing the feature selection effect by adjusting the threshold.

[0200] The weighting sub-unit is used to weight the feature matrices of each channel of the power consumption simulation mode feature map by using the feature values ​​of each position in the masked first power consumption statistical feature map mode representation vector of the masked representation vector set B as weights, so as to obtain the weighted power consumption simulation mode feature map.

[0201] The activation sub-unit is used to activate the weighted power consumption simulation mode feature map using the hyperbolic tangent function to obtain the power consumption simulation mode feature map after preliminary screening.

[0202] The filtering subunit is used to perform feature filtering again on the power analog mode feature map after the initial filtering based on the feature interaction joint coding formula, using the masked second power statistical feature map mode representation vector and the Sigmoid function in the masked representation vector set B, to obtain the power analog-digital hybrid mode joint coding feature map.

[0203] The joint feature coding formula is as follows:

[0204] Among them, V meta This represents the embedding of power consumption statistics into the encoding vector. This represents the first weight modifier matrix. Let w represent the second weight modifier matrix. 0f and w 0g Let V1 and V2 represent different bias terms. V1 represents the first power consumption statistical feature mapping pattern representation vector, and V2 represents the second power consumption statistical feature mapping pattern representation vector. V1(i+1) and V1(i-1) represent the feature values ​​at positions i+1 and i-1 in the first power consumption statistical feature mapping pattern representation vector, respectively. V2(i+1) and V2(i-1) represent the feature values ​​at positions i+1 and i-1 in the second power consumption statistical feature mapping pattern representation vector, respectively. mask(·) represents masking, and θ is a preset mask threshold. The masked first power consumption statistical feature mapping pattern represents the eigenvalue at the i-th position of the vector, V. 1s This represents the masked first power consumption statistical feature mapping pattern representation vector. The masked second power consumption statistical feature mapping pattern represents the eigenvalue at the i-th position of the vector, V. 2s This represents the masked second power consumption statistical feature mapping pattern representation vector. F represents matrix multiplication. main This represents the power consumption analog mode characteristic map, where tanh is the hyperbolic tangent function, and T... gate This represents the power consumption analog mode feature map after initial screening, where sigmoid is the sigmoid activation function, and F represents the power consumption analog-digital hybrid mode joint coding feature map.

[0205] In this embodiment, the weighting subunit, activation subunit, and filtering subunit extract the parts closely related to power consumption statistics through weighting operations along the channel dimension, thereby strengthening the important feature interaction between the two. Furthermore, the hyperbolic tangent function and the sigmoid function are introduced for feature activation processing, which can improve the nonlinear expressive power of the features. The hyperbolic tangent function, with an output range between -1 and +1, is used to initially filter out features highly correlated with power consumption statistics; while the sigmoid function, with an output range between 0 and 1, is suitable for probability estimation and binarization decision-making, and is used for final feature filtering, thus obtaining a power consumption analog-digital hybrid mode joint coding feature map.

[0206] Furthermore, by using the feature values ​​at each position in the masked first power consumption statistical feature map mode representation vector as weights to weight the feature matrices of each channel in the power consumption analog mode feature map, important feature positions can receive greater weight in the weighted feature map, thereby enhancing the influence of these features in subsequent processing and helping to improve the accuracy and effectiveness of feature representation. This dual screening mechanism can further eliminate features that have a small impact on the results, while retaining and strengthening features that contribute significantly to the power consumption analog-digital hybrid mode joint coding feature map, thus improving the accuracy and efficiency of feature selection.

[0207] As can be seen, the filtering module 30 in this embodiment proposes a feature interaction filtering encoding method based on attention mechanism. Specifically, it first performs a linear transformation on the power consumption statistical feature embedding encoding vector through two different weight modifier matrices to expand the expression range of the features, thereby enabling the capture of the correlation between power consumption statistical features and power consumption simulation mode features from different perspectives.

[0208] Next, feature masking is performed based on the gradient magnitude at each position in the two feature vectors after linear transformation to highlight important power consumption statistics, thereby enhancing the focus on important features in the subsequent feature selection process.

[0209] Furthermore, the two masked feature vectors are used to perform two feature filtering operations on the power consumption simulation mode feature map. By weighting along the channel dimension, the part closely related to the power consumption statistical features is extracted, thereby strengthening the important feature interaction between the two.

[0210] Furthermore, in order to improve the nonlinear expressive power of the features, hyperbolic tangent function and sigmoid function were introduced for feature activation processing in the two feature selection processes.

[0211] In one embodiment, the detection module 40 includes a modulation unit, a phase unit, and an identification unit; wherein, the modulation unit and the phase unit are processes for performing phase conversion to generate an optimized power consumption analog-digital mixed-mode joint coding feature map F, and the identification unit is a process for anomaly identification of the optimized power consumption analog-digital mixed-mode joint coding phase conversion feature map F to obtain a security monitoring result, specifically:

[0212] The modulation unit is used to calculate the sum of the absolute values ​​of each feature value in the power consumption analog-digital mixed-mode joint coding feature map to obtain the first power consumption analog-digital mixed-mode joint coding and modulation value; and to calculate the square root of the sum of the squares of each feature value in the power consumption analog-digital mixed-mode joint coding feature map to obtain the second power consumption analog-digital mixed-mode joint coding and modulation value.

[0213] A phase unit is used to subtract the power consumption analog-digital mixed-mode joint coding feature map from the second power consumption analog-digital mixed-mode joint coding and modulation value by a dot, and then multiply it by the number of feature values ​​of the power consumption analog-digital mixed-mode joint coding feature map and the reciprocal of the first power consumption analog-digital mixed-mode joint coding and modulation value by a dot, and take the reciprocal of each feature value to obtain the first power consumption analog-digital mixed-mode joint coding phase transition feature map;

[0214] The phase unit is also used to subtract the power consumption analog-digital mixed mode joint coding feature map from the first power consumption analog-digital mixed mode joint coding and modulation value by a dot, and then multiply it by the square root of the number of feature values ​​of the power consumption analog-digital mixed mode joint coding feature map and the reciprocal of the second power consumption analog-digital mixed mode joint coding and modulation value by a dot, and take the reciprocal of each feature value to obtain the second power consumption analog-digital mixed mode joint coding phase transition feature map;

[0215] The phase unit is also used to calculate the dot product feature map of the second power consumption analog-digital hybrid mode joint coding phase transition feature map and the weighted hyperparameter, and to subtract the dot product feature map from the first power consumption analog-digital hybrid mode joint coding phase transition feature map to obtain the optimized power consumption analog-digital hybrid mode joint coding feature map F.

[0216] The optimized power consumption analog-digital hybrid mode joint coding feature map is as follows: f i ∈F∈R W×H×C n = W × H × C

[0217] Among them, f iLet F represent the individual eigenvalues ​​of the power consumption analog-digital mixed-mode joint coding feature map, where α is the first power consumption analog-digital mixed-mode joint coding and modulation value, β is the second power consumption analog-digital mixed-mode joint coding and modulation value, F is the power consumption analog-digital mixed-mode joint coding feature map, W is the length of the power consumption analog-digital mixed-mode joint coding feature map, C is the number of channels in the power consumption analog-digital mixed-mode joint coding feature map, H is the height of the power consumption analog-digital mixed-mode joint coding feature map, n represents the number of eigenvalues ​​in the power consumption analog-digital mixed-mode joint coding feature map, and R represents the set of real numbers. -1 It is the reciprocal of the first power consumption analog-digital mixed-mode joint coding and modulation value, [·] ⊙-1 It is the reciprocal of each eigenvalue. F1 is the first power consumption analog-digital mixed-mode joint coded phase transition feature map, F2 is the second power consumption analog-digital mixed-mode joint coded phase transition feature map, and β is the reciprocal of each eigenvalue. -1 It is the reciprocal of the second power consumption analog-digital mixed-mode joint coding and modulation value, ω is the weighted hyperparameter, F' is the optimized power consumption analog-digital mixed-mode joint coding feature map, and ⊙ is the positional dot product. It is subtracted based on position.

[0218] In this embodiment, the modulation unit and the phase unit use the difference between the feature values ​​in the power-amplitude analog-digital hybrid mode joint coding feature map and the difference in the modulation representation relative to the overall feature set in the power-amplitude analog-digital hybrid mode joint coding feature map as semantic change intensity information. They then perform a phase-like transformation corresponding to position-based intensity modulation by using different modulation representations. This is achieved by performing a spatial translation operation based on alternating stacking under the set scale equalization of the power-amplitude analog-digital hybrid mode joint coding feature map. This enhances the aggregation enhancement of semantic change phase perception along the feature aggregation direction, thereby improving the perception effect of the aggregate semantics of the power-amplitude analog-digital hybrid mode joint coding feature map on detailed semantic changes. This improves the expressive effect of the power-amplitude analog-digital hybrid mode joint coding feature map and enhances the accuracy of the recognition results obtained by inputting it into a classifier-based anomaly detector.

[0219] Furthermore, by using the two calculated modulation values ​​to perform phase transformation on the power consumption analog-digital hybrid mode joint coding feature map, the feature map can be rearranged and combined in the phase domain. This phase transformation can reveal the behavior of the feature map under different phases, thus more accurately reflecting the power consumption characteristics of the system under different states. In addition, phase transformation also helps to improve the accuracy and effectiveness of subsequent anomaly identification.

[0220] The identification unit is used to identify anomalies in the optimized power consumption analog-digital hybrid mode joint coding phase transition feature map F based on the anomaly identifier of the classifier, and obtain the security monitoring result; wherein, the security monitoring result is used to indicate whether the power Internet of Things terminal device has been attacked.

[0221] For the application of the embodiments of this application, please refer to FIG2. FIG2 is a block diagram of an electronic device provided in the embodiments of this application, showing a structural schematic diagram of an electronic device 600 suitable for implementing the second embodiment of this application;

[0222] The terminal devices in this application embodiment may include, but are not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), and in-vehicle terminals (e.g., in-vehicle navigation terminals), as well as fixed terminals such as digital TVs and desktop computers. The electronic device shown in Figure 2 is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments in this application.

[0223] As shown in Figure 2, the electronic device 600 may include a processing unit (e.g., a central processing unit, a graphics processing unit, etc.) 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage device 608 into a random access memory (RAM) 603. The RAM 603 also stores various programs and data required for the operation of the electronic device 600. The processing unit 601, ROM 602, and RAM 603 are interconnected via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0224] Typically, the following devices can be connected to I / O interface 605: input devices 606 including, for example, touchscreens, touchpads, keyboards, mice, cameras, microphones, accelerometers, gyroscopes, etc.; output devices 607 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 608 including, for example, magnetic tapes, hard disks, etc.; and communication devices 609. Communication device 609 allows electronic device 600 to communicate wirelessly or wiredly with other devices to exchange data. Although Figure 2 shows electronic device 600 with various devices, it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed alternatively.

[0225] Specifically, according to embodiments of this application, the process described in FIG1 can be implemented as a computer software program. For example, embodiments of this application include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods shown in the flowchart. In such embodiments, the computer program can be downloaded and installed from a network via communication device 609, or installed from storage device 608, or installed from ROM 602. When the computer program is executed by processing device 601, it performs the functions defined in the methods of embodiments of this application.

[0226] It should be noted that the computer-readable medium described above in this application can be a computer-readable signal medium, a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this application, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this application, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium can be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wires, optical fibers, RF (radio frequency), etc., or any suitable combination thereof.

[0227] In some implementations, clients and servers can communicate using any currently known or future-developed network protocol, such as HTTP (Hypertext Transfer Protocol), and can interconnect with digital data communication (e.g., communication networks) of any form or medium. Examples of communication networks include local area networks (“LANs”), wide area networks (“WANs”), the Internet (e.g., the Internet of Things), and peer-to-peer networks (e.g., ad hoc peer-to-peer networks), as well as any currently known or future-developed networks.

[0228] The aforementioned computer-readable medium may be included in the aforementioned electronic device; or it may exist independently and not assembled into the electronic device.

[0229] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof. These programming languages ​​include, but are not limited to, object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as "C" or similar languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0230] The flowcharts and block diagrams in Figures 1-2 illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those shown in the figures. For example, two consecutively represented blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0231] The modules described in the embodiments of this application can be implemented in software or hardware. The name of a module does not necessarily limit the module itself; for example, a test parameter acquisition module can also be described as "a module for acquiring device test parameters corresponding to a target device".

[0232] The functions described above in this document can be performed, at least in part, by one or more hardware logic components. For example, exemplary types of hardware logic components that can be used, without limitation, include: Field Programmable Gate Arrays (FPGAs), Application-Specific Integrated Circuits (ASICs), Application Standard Products (ASSPs), System-on-Chip (SoCs), Complex Programmable Logic Devices (CPLDs), and so on.

[0233] In the context of this application, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. Machine-readable media can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0234] To apply the embodiments of this application, please refer to Figure 3. Figure 3 is an application scenario diagram provided by the embodiments of this application, showing the application scenario of a security monitoring method for a power Internet of Things terminal device according to this embodiment.

[0235] As shown in Figure 3, in this application scenario, firstly, a sampling resistor is connected in series between the power module (e.g., M1 as shown in Figure 3) and the CPU module (e.g., M2 as shown in Figure 3) of the power IoT terminal device. The voltage drop across the sampling resistor is collected by the data acquisition module (e.g., M3 as shown in Figure 3) to obtain the current analog signal of the CPU module (e.g., C as shown in Figure 3). Then, the acquired current analog signal is input to a server (e.g., S as shown in Figure 3) that is equipped with a security monitoring algorithm based on the power IoT terminal device. The server can process the current analog signal based on the security monitoring algorithm of the power IoT terminal device to determine whether the power IoT terminal device has been attacked.

[0236] The above description is merely a preferred embodiment of this application and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of disclosure in this application is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-described concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features with similar functions disclosed in this application.

[0237] Furthermore, while the operations are described in a specific order, this should not be construed as requiring these operations to be performed in the specific order shown or in a sequential order. Multitasking and parallel processing may be advantageous in certain environments. Similarly, while several specific implementation details are included in the above discussion, these should not be construed as limiting the scope of this application. Certain features described in the context of individual embodiments may also be implemented in combination in a single embodiment. Conversely, various features described in the context of a single embodiment may also be implemented individually or in any suitable sub-combination in multiple embodiments.

[0238] Although the subject matter has been described using language specific to structural features and / or methodological logic, it should be understood that the defined subject matter is not necessarily limited to the specific features or actions described above. Rather, the specific features and actions described above are merely implementation examples. Regarding the apparatus in the above embodiments, the specific manner in which the various modules perform their operations has been described in detail in the embodiments relating to the method, and will not be elaborated upon here.

[0239] Overall, this embodiment has the following beneficial effects:

[0240] This application extracts features from power consumption analog signals, extracting power consumption statistical feature embedding encoding vectors and power consumption analog mode feature maps. These features reflect the power consumption characteristics of the device under different states, including normal state and potential security threat state. Furthermore, power consumption analog signals are themselves dynamically changing signals. By monitoring and extracting features from these signals in real time, the dynamic changes in power consumption can be captured. Since attacks often cause abnormal changes in power consumption patterns, this characteristic is crucial for identifying whether a device has been attacked. Linear transformation and dual feature filtering are applied to the extracted power consumption statistical feature embedding encoding vectors and power consumption analog mode feature maps to further refine more representative feature information, helping to remove redundant information and retain the most valuable features for security monitoring, thereby improving monitoring accuracy. By jointly encoding power consumption statistical features and analog mode features to form a power consumption analog-digital hybrid mode joint encoding feature map, the operating status of the device can be more comprehensively reflected. This hybrid mode representation can integrate the advantages of multiple information sources, improving the ability to identify complex attack behaviors.

[0241] Therefore, this application can effectively overcome the limitations of existing technologies that rely solely on power consumption data statistical characteristics for security monitoring, and achieve more accurate, dynamic and comprehensive security monitoring of power Internet of Things terminal devices.

[0242] Example 3:

[0243] This application provides a computer-readable storage medium, which includes a stored computer program, wherein the computer program controls the device where the computer-readable storage medium is located to execute the security monitoring method for a power Internet of Things terminal device when it is executed.

[0244] The safety monitoring method for power Internet of Things (IoT) terminal devices, when implemented as a software functional unit and used as an independent product, can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the above embodiments can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include any entity or device capable of carrying the computer program code, a recording medium, a USB flash drive, a portable hard drive, a magnetic disk, an optical disk, a computer memory, a read-only memory (ROM), a random access memory (RAM), an electrical carrier signal, a telecommunication signal, and a software distribution medium, etc.

[0245] The above are preferred embodiments of the present invention. It should be noted that, for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A security monitoring method of a power internet of things terminal device, characterized by, The method comprises the following steps: obtaining a power consumption simulation signal of a CPU module from a power internet of things terminal device; extracting features from the power consumption simulation signal to obtain a power consumption statistical feature embedding coding vector and a power consumption simulation modal feature map; performing linear transformation and double feature screening on the power consumption statistical feature embedding coding vector and the power consumption simulation modal feature map to obtain a power consumption simulation-digital hybrid modal joint coding feature map; determining whether the power internet of things terminal device is attacked according to the power consumption simulation-digital hybrid modal joint coding feature map to obtain a security monitoring result. 2.The security monitoring method of the power internet of things terminal device of claim 1, wherein The features of the power consumption simulation signal are extracted to obtain a power consumption statistical feature embedding coding vector and a power consumption simulation modal feature map, specifically as follows: performing analog-digital conversion on the power consumption simulation signal to obtain CPU power consumption data; extracting a plurality of statistical feature values from the CPU power consumption data to obtain CPU power consumption statistical features; capturing the mutual relationship and interaction between the CPU power consumption statistical features through low-dimensional embedding coding to obtain the power consumption statistical feature embedding coding vector; performing waveform feature analysis on the power consumption simulation signal according to a power consumption simulation feature extractor to obtain the power consumption simulation modal feature map. 3.The security monitoring method of the power internet of things terminal device of claim 2, wherein The features of the power consumption simulation signal are extracted to obtain a power consumption statistical feature embedding coding vector and a power consumption simulation modal feature map, specifically as follows: extracting local features of the power consumption simulation signal through deep convolution operation of the power consumption simulation feature extractor to obtain a local feature set; integrating the local feature set into a global feature representation based on point-by-point convolution operation of the power consumption simulation feature extractor to obtain the power consumption simulation modal feature map. 4.The security monitoring method of the power internet of things terminal device of claim 1, wherein, The power consumption statistical feature embedding coding vector and the power consumption simulation modal feature map are subjected to linear transformation and double feature screening to obtain a power consumption simulation-digital hybrid modal joint coding feature map, specifically as follows: performing linear transformation on the power consumption statistical feature embedding coding vector according to two different weight modifier matrices to obtain a representation vector set including a first power consumption statistical feature mapping mode representation vector and a second power consumption statistical feature mapping mode representation vector; performing gradient amplitude-based mask processing on the representation vector set based on the gradient amplitude of each position in the representation vector set to obtain a masked representation vector set including a masked first power consumption statistical feature mapping mode representation vector and a masked second power consumption statistical feature mapping mode representation vector; performing double feature screening on the power consumption simulation modal feature map according to the masked representation vector set to obtain the power consumption simulation-digital hybrid modal joint coding feature map. 5.The security monitoring method of the power internet of things terminal device of claim 4, wherein The gradient amplitude-based mask processing on the representation vector set based on the gradient amplitude of each position in a representation vector set to obtain a masked representation vector set including a masked first power consumption statistical feature mapping representation vector and a masked second power consumption statistical feature mapping representation vector, specifically as follows: Based on the representation vector set, the absolute value of the difference between the target feature value and the feature value of its adjacent position is calculated, and the gradient amplitude of each position in the first power consumption statistical feature mapping mode representation vector and the second power consumption statistical feature mapping mode representation vector is obtained. According to the preset mask threshold, the gradient amplitude is marked to obtain a masked first power consumption statistical feature mapping mode representation vector and a masked second power consumption statistical feature mapping mode representation vector. The masked first power consumption statistical feature mapping mode representation vector and the masked second power consumption statistical feature mapping mode representation vector constitute the masked representation vector set. 6.The security monitoring method of the power internet of things terminal device of claim 5, wherein According to the preset mask threshold, the gradient amplitude is marked to obtain a masked first power consumption statistical feature mapping mode representation vector and a masked second power consumption statistical feature mapping mode representation vector, specifically: If the gradient amplitude is greater than the mask threshold, the corresponding position of the gradient amplitude in the mask vector is marked as an active state; If the gradient amplitude is less than or equal to the mask threshold, the corresponding position of the gradient amplitude in the mask vector is marked as an inhibition state; Iterate through each position in the first power consumption statistical feature mapping mode representation vector and the second power consumption statistical feature mapping mode representation vector to obtain the masked first power consumption statistical feature mapping mode representation vector and the masked second power consumption statistical feature mapping mode representation vector. 7.The security monitoring method of the power internet of things terminal device of claim 4, wherein, According to the masked representation vector set, the power consumption simulation-analog-digital hybrid modal joint coding feature map is obtained by double feature screening on the power consumption simulation modal feature map, specifically: Taking the feature value of each position in the masked first power consumption statistical feature mapping mode representation vector of the masked representation vector set as a weight, each channel feature matrix of the power consumption simulation modal feature map is weighted to obtain a weighted power consumption simulation modal feature map; The preliminary screened power consumption simulation modal feature map is obtained by activating the weighted power consumption simulation modal feature map; Based on the masked second power consumption statistical feature mapping mode representation vector and a preset function, the preliminary screened power consumption simulation modal feature map is screened again to obtain the power consumption simulation-analog-digital hybrid modal joint coding feature map. 8.The security monitoring method of the power internet of things terminal device of claim 1, wherein, According to the power consumption simulation-analog-digital hybrid modal joint coding feature map, it is determined whether the power internet of things terminal device is attacked to obtain a security monitoring result, specifically: The feature values in the power consumption simulation-analog-digital hybrid modal joint coding feature map are modulated to obtain two modulation values; According to the two modulation values, the phase of the power consumption simulation-analog-digital hybrid modal joint coding feature map is converted to obtain an optimized power consumption simulation-analog-digital hybrid modal joint coding phase conversion feature map; According to a preset classifier, the optimized power consumption simulation-analog-digital hybrid modal joint coding phase conversion feature map is abnormally identified to obtain the security monitoring result. 9.The security monitoring method of the power internet of things terminal device of claim 1, wherein, The power consumption simulation signal of the CPU module is obtained from the power internet of things terminal device, specifically: A sampling resistor is connected in series between a power module and a CPU module of the power internet of things terminal device, and a current analog signal of the CPU module is obtained by collecting a voltage drop across the sampling resistor; The current analog signal is processed according to the sampling resistor to obtain the power consumption analog signal of the CPU module. 10.A security monitoring apparatus of a power internet of things terminal device, characterized by, The method comprises a signal module, an extraction module, a screening module and a detection module; The signal module is configured to obtain a power consumption analog signal of a CPU module from a power internet of things terminal device. The extraction module is configured to perform feature extraction on the power consumption analog signal to obtain a power consumption statistical feature embedding code vector and a power consumption analog modal feature map. The screening module is configured to perform linear transformation and double feature screening on the power consumption statistical feature embedding code vector and the power consumption analog modal feature map to obtain a power consumption analog-digital hybrid modal joint encoding feature map. The detection module is configured to determine whether the power internet of things terminal device is attacked according to the power consumption analog-digital hybrid modal joint encoding feature map to obtain a security monitoring result.

11. The security monitoring apparatus of an electric power Internet of Things terminal device according to claim 10, wherein The extraction module comprises a data unit, a feature unit, a vector unit and a feature map unit. The data unit is configured to perform analog-digital conversion on the power consumption analog signal to obtain CPU power consumption data. The feature unit is configured to extract a plurality of statistical feature values from the CPU power consumption data to obtain CPU power consumption statistical features. The vector unit is configured to capture mutual relations and interactions between the CPU power consumption statistical features by low-dimensional embedding coding to obtain the power consumption statistical feature embedding code vector. The feature map unit is configured to perform waveform feature analysis on the power consumption analog signal according to a power consumption analog feature extractor to obtain the power consumption analog modal feature map.

12. The security monitoring apparatus of an electric power Internet of Things terminal device according to claim 11, wherein The feature map unit comprises a feature subunit and a representation subunit. The feature subunit is configured to extract local features of the power consumption analog signal by a deep convolution operation of the power consumption analog feature extractor to obtain a local feature set. The representation subunit is configured to integrate the local feature set into a global feature representation based on a point-by-point convolution operation of the power consumption analog feature extractor to obtain the power consumption analog modal feature map. 13.The security monitoring device of the power internet of things terminal device of claim 10, wherein, The screening module comprises a transformation unit, a mask unit and a double screening unit. The transformation unit is configured to perform linear transformation on the power consumption statistical feature embedding code vector according to two different weight modifier matrices to obtain a representation vector set comprising a first power consumption statistical feature mapping mode representation vector and a second power consumption statistical feature mapping mode representation vector. The mask unit is configured to perform gradient amplitude-based mask processing on the representation vector set based on gradient amplitudes of respective positions in the representation vector set to obtain a masked representation vector set comprising a masked first power consumption statistical feature mapping mode representation vector and a masked second power consumption statistical feature mapping mode representation vector. The double-screening unit is configured to perform double feature screening on the power consumption simulation modal feature map according to the set of mask-coded representation vectors to obtain the power consumption simulation-digital hybrid modal joint coding feature map.

14. The security monitoring apparatus of an electric power Internet of Things terminal device according to claim 13, wherein The mask unit comprises a gradient subunit, a marking subunit and a vector subunit. The gradient subunit is configured to calculate absolute values of differences between target feature values and feature values at adjacent positions of the set of representation vectors to obtain gradient amplitudes at positions in the first power consumption statistical feature mapping mode representation vector and the second power consumption statistical feature mapping mode representation vector. The marking subunit is configured to mark the gradient amplitudes according to a preset mask threshold to obtain a mask-coded first power consumption statistical feature mapping mode representation vector and a mask-coded second power consumption statistical feature mapping mode representation vector. The vector subunit is configured to form the set of mask-coded representation vectors from the mask-coded first power consumption statistical feature mapping mode representation vector and the mask-coded second power consumption statistical feature mapping mode representation vector.

15. The security monitoring apparatus of an electric power Internet of Things terminal device according to claim 14, wherein The marking subunit is specifically configured to: if the gradient amplitude is greater than the mask threshold, mark a corresponding position of the gradient amplitude in the mask-coded vector as an active state; if the gradient amplitude is less than or equal to the mask threshold, mark the corresponding position of the gradient amplitude in the mask-coded vector as an inhibited state; and traverse each position in the first power consumption statistical feature mapping mode representation vector and the second power consumption statistical feature mapping representation vector to obtain the mask-coded first power consumption statistical feature mapping mode representation vector and the mask-coded second power consumption feature mapping mode representation vector.

16. The apparatus for security monitoring of a power internet of things terminal device according to claim 13, wherein The double-screening unit comprises a weighting subunit, an activation subunit and a screening subunit. The weighting subunit is configured to use feature values at positions in the mask-coded first power consumption statistical feature mapping mode representation vector of the set of mask-coded representation vectors as weights to weight each channel feature matrix of the power consumption simulation modal feature map to obtain a weighted power consumption simulation modal feature map. The activation subunit is configured to perform activation processing on the weighted power consumption simulation modal feature map to obtain a preliminarily screened power consumption simulation modal feature map. The screening subunit is configured to perform feature screening again on the preliminarily screened power consumption simulation modal feature map based on the mask-coded second power consumption statistical feature mapping mode representation vector and a preset function to obtain the power consumption simulation-digital hybrid modal joint coding feature map.

17. The security monitoring apparatus of an electric power Internet of Things terminal device according to claim 10, wherein The detection module comprises a modulation unit, a phase unit and an identification unit. The modulation unit is configured to modulate feature values in the power consumption simulation-digital hybrid modal joint coding feature map to calculate two modulation values. The phase unit is configured to perform phase conversion on the power consumption simulation-digital hybrid modal joint coding feature map according to the two modulation values to obtain an optimized power consumption simulation-digital hybrid modal joint coding phase conversion feature map. The identification unit is configured to perform anomaly identification on the optimized power consumption simulation-digital hybrid modal joint coding phase conversion feature map according to a preset classifier to obtain the safety monitoring result.

18. The security monitoring apparatus of an electric power Internet of Things terminal device according to claim 10, wherein The signal module comprises a collecting unit and a processing unit; The collecting unit is configured to connect a sampling resistor in series between the power module and the CPU module of the power internet of things terminal device, and obtain a current analog signal of the CPU module by collecting a voltage drop across the sampling resistor. The processing unit is configured to perform signal processing on the current analog signal according to the sampling resistor, and obtain the power consumption analog signal of the CPU module.

19. A storage medium, characterized by The storage medium stores a computer program, the computer program is called and executed by a computer, and a safety monitoring method of a power internet of things terminal device is realized.

Images