CN106792883A - Sensor network abnormal deviation data examination method and system - Google Patents
Sensor network abnormal deviation data examination method and system Download PDFInfo
- Publication number
- CN106792883A CN106792883A CN201710047973.4A CN201710047973A CN106792883A CN 106792883 A CN106792883 A CN 106792883A CN 201710047973 A CN201710047973 A CN 201710047973A CN 106792883 A CN106792883 A CN 106792883A
- Authority
- CN
- China
- Prior art keywords
- data
- abnormal
- monitoring
- node
- correlation
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W24/00—Supervisory, monitoring or testing arrangements
- H04W24/08—Testing, supervising or monitoring using real traffic
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W84/00—Network topologies
- H04W84/18—Self-organising networks, e.g. ad-hoc networks or sensor networks
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The present invention discloses a kind of sensor network abnormal deviation data examination method, including step：Obtain the Monitoring Data of sensor network；Spatial coherence feature according to data, space correlation detection is carried out to the Monitoring Data, obtains abnormal data therein；Temporal correlation feature according to data, time correlation detection is carried out to the Monitoring Data, obtains abnormal data therein；For any abnormal data, with reference to the testing result that space correlation detection and the time correlation are detected, judge that the abnormal data is event data or malicious data.The present invention can be in real time detecting sensor network abnormal data, and abnormal data to detecting accurately differentiated.
Description
Technical field
The present invention relates to data monitoring field, more particularly to a kind of sensor network abnormal deviation data examination method and system.
Background technology
The abnormal data of wireless sensor network is significant for environmental monitoring, in practical application, abnormal data
There may be two kinds of situations：Malicious data and event data.Malicious data can influence the observed result of base station, reduce network reliability
Property；Event data is the important behaviour of environmental change, can reflect the situation of change of monitored area.How standard is carried out to abnormal data
Really recognize and it is effectively distinguished, so as to the accurate change feelings for understanding monitored area while internet security is safeguarded
Condition, is study hotspot instantly.
The abnormal deviation data examination method being widely used at present mainly has based on statistics and based on the major class of data mining two.It is based on
Data acquisition system of the method for statistics first to that will detect assumes a distributed model or probabilistic model, will not meet the model
Data judging be abnormal data.But in actual applications, data distribution is generally unknown, or cannot be with any one standard scores
Cloth is fitted, and institute is in this way and without versatility.Method based on data mining include based on cluster, based on distance with
And the detection method based on density, these methods are used for excavating abnormal data after being collected into mass data, with obvious
Hysteresis quality, does not meet the original intention of sensor network real-time monitoring.
In wireless sensor network, the Monitoring Data of adjacent node has certain space correlation.Meanwhile, each sensing
The Monitoring Data of device node can form a time series, with temporal correlation.In recent years, for number in sensor network
According to correlation, occur in that some new abnormal deviation data examination methods：For example using the detection method based on Gaussian Profile, pass through
The data of neighbor node judge abnormal data；The abnormal data analysis method of neutral net is and for example based on, by using history
Data set trains neutral net to complete the forecast of subsequent time.Though the above method can be judged present in sensor network
Some exceptions, but the single dimension in time or space is all only considered, two-dimensionses are not combined so that Detection accuracy is not
Height, and malicious data and event data cannot be accurately distinguished.In addition, existing many abnormal deviation data examination methods calculate complicated
Degree is higher, and communications cost is also higher, it is impossible to suitable for the wireless sensor network that computing resource is limited, storage resource is limited.
The content of the invention
For the drawbacks described above of prior art, the present invention provides a kind of sensor network abnormal deviation data examination method and is
System, abnormal data that can be in real time detecting sensor network, and the abnormal data for detecting can accurately be differentiated, judge it
It is malicious data or event data.
According to an aspect of the present invention, there is provided a kind of sensor network abnormal deviation data examination method, including step：
S1. the Monitoring Data of sensor network is obtained；
S2. the spatial coherence feature according to data, space correlation detection is carried out to the Monitoring Data, is obtained therein
Abnormal data；And
Temporal correlation feature according to data, time correlation detection is carried out to the Monitoring Data, is obtained therein different
Regular data；
S3. any abnormal data is directed to, with reference to the testing result that space correlation detection and the time correlation are detected,
Judge that the abnormal data is event data or malicious data.
Preferably, after step S1, before step S2, methods described also includes step：S11. according to sensor network
In the spatial positional information of each node each node is clustered, by the close node division in locus to same cluster.
Preferably, the spatial coherence feature according to data, space correlation detection is carried out to the Monitoring Data, is obtained
Abnormal data therein is obtained to be specially：
S21. for the Monitoring Data of any node in either cluster, the Monitoring Data is calculated same with other nodes in the cluster
The Euclidean distance of the Monitoring Data at moment；
S22. the Euclidean distance is compared with default Euclidean distance threshold value, by less than Euclidean distance threshold value it is European away from
From number as the Monitoring Data space correlation number；
S23. the space correlation number is obtained into the space correlation of the Monitoring Data divided by the node total number in the either cluster
Coefficient；
S24. the space correlation coefficient is compared with default coefficient threshold：If the space correlation coefficient is more than coefficient
Threshold value, then the space correlation testing result of the Monitoring Data is normal；If the space correlation coefficient is not more than coefficient threshold,
The space correlation testing result of the Monitoring Data is abnormal, judges that the Monitoring Data is abnormal data.
Preferably, the temporal correlation feature according to data, time correlation detection is carried out to the Monitoring Data, is obtained
Abnormal data therein is obtained to be specially：
S25. for the Monitoring Data of any node in either cluster, any node is obtained in the monitoring using sliding window
Before data obtaining time and most preceding multiple Historical Monitoring data；
S26. it is predicted using the multiple Historical Monitoring data, obtains prediction data；
S27. the Euclidean distance of the Monitoring Data and the prediction data is calculated, compares the Euclidean distance with default time phase
Close threshold value：If the Euclidean distance is less than time correlation threshold value, the time correlation testing result of the Monitoring Data is normal；If should
Euclidean distance is not less than time correlation threshold value, then the time correlation testing result of the Monitoring Data is abnormal, judges the monitoring number
According to being abnormal data.
Preferably, step S3 is specially：For any abnormal data：If its space correlation testing result is examined with time correlation
Survey result and be exception, then judge that the abnormal data is malicious data；If its space correlation testing result is abnormal, time correlation
Testing result is normal, then judge that the abnormal data is event data；If its time related test results is abnormal, space correlation
Testing result is normal, then judge that the abnormal data is event data.
Preferably, upon step s 2, methods described also includes：For any Monitoring Data, if its space correlation is detected
Result is normally with time correlation testing result, then judge that the Monitoring Data is normal data.
Preferably, after step s 3, methods described also includes：If Monitoring Data is event data, sent to human observer
Alarm signal；If Monitoring Data is malicious data, the credit worthiness of the node for sending the malicious data is reduced；If the credit worthiness of node
Less than the first prestige threshold value, then data are made not forwarded from the node；If the credit worthiness of node is less than the second prestige threshold value, shield
The node.
Preferably, step S11 is specially：According to the spatial positional information of each node in sensor network, using K-Means
Clustering procedure is clustered to each node, by the close node division in locus to same cluster.
Preferably, step S26 is specially：According to the multiple Historical Monitoring data, utilization index smoothing prediction method is obtained
Prediction data；And the sensor network is wireless sensor network.
According to another aspect of the present invention, there is provided a kind of sensor network anomaly data detection system, including：Data are obtained
Modulus block, the Monitoring Data for obtaining sensor network；Abnormal judge module, it is special for the spatial coherence according to data
Levy, space correlation detection is carried out to the Monitoring Data that data acquisition module is obtained, obtain abnormal data therein；And according to
The temporal correlation feature of data, time correlation detection is carried out to the Monitoring Data, obtains abnormal data therein；Abnormal point
Generic module, for for any abnormal data, with reference to the testing result that space correlation detection and the time correlation are detected,
Judge that the abnormal data is event data or malicious data.
In the inventive solutions, after the Monitoring Data for obtaining sensor network, space correlation is carried out respectively
Detection and time correlation detection, abnormal datas therein are detected by two kinds of approach, and combine the testing result of two methods, are judged
Abnormal data is event data or malicious data.The present invention can be in real time detecting sensor network abnormal data, and to inspection
The abnormal data measured accurately is differentiated.
Brief description of the drawings
Fig. 1 is the sensor network abnormal deviation data examination method schematic diagram of the embodiment of the present invention；
Fig. 2 is the space correlation testing process schematic diagram of the embodiment of the present invention；
Fig. 3 is the time correlation testing process schematic diagram of the embodiment of the present invention；
Fig. 4 is the sensor network anomaly data detection system schematic of the embodiment of the present invention；
Fig. 5 is another schematic diagram of sensor network abnormal deviation data examination method of the embodiment of the present invention.
Specific embodiment
To make the objects, technical solutions and advantages of the present invention become more apparent, referring to the drawings and preferred reality is enumerated
Example is applied, the present invention is described in more detail.However, it is necessary to explanation, many details listed in specification are only to be
The reader is set to have a thorough explanation to one or more aspects of the invention, can also even without these specific details
Realize the aspects of the invention.
The present inventor considers：In recent years, with smart city, commonly used, the wireless senser of Internet of Things
Network is developed rapidly, and the data that note abnormalities in real time, and it is network security it to be accurately distinguished and then is effectively processed
Basis.Equally, in military field and industrial circle, malicious attack is caused a significant threat to network security, is quickly and accurately known
Other malicious data has important practical significance.But, existing abnormal data monitoring method only considers temporal correlation or sky
Between correlation, the two is not combined so that Detection accuracy is not high, and cannot be distinguished by malicious data and event data.
Meanwhile, existing many abnormal deviation data examination method computation complexities are higher, and communications cost is also higher, it is impossible to provided suitable for calculating
The wireless sensor network that source is limited, storage resource is limited.
Based on above-mentioned consideration, the present inventor's synthesis temporal correlation feature is monitored the detection of data, can be fast
Abnormal data that may be present in fast detection sensor network, and therefrom accurate discriminating malicious data and event data, Jin Erjin
Row specific aim treatment, so as to the accurate situation of change for understanding monitored area while internet security is safeguarded.The present invention is provided
Sensor network abnormal deviation data examination method and system-computed it is easy, cost is relatively low, supervised in the data of wireless sensor network
There is broad prospect of application in survey.
Technical scheme described in detail below.
Fig. 1 shows sensor of the invention Network Abnormal data detection method, referring to Fig. 1, abnormal deviation data examination method
Specifically perform according to the following steps：
Step S1, obtains the Monitoring Data of sensor network.
Specifically, after the Monitoring Data of sensor network each monitoring cycle is sent to base station, above-mentioned monitoring number is obtained
According to being detected.Usually, sensor network refers to wireless sensor network.
Step S11, the spatial positional information according to each node in sensor network is clustered to each node, by space bit
Close node division is put in same cluster.The close space length for referring to two nodes in above-mentioned locus is in default distance
Within thresholding.Usually, above-mentioned steps are directed to all node clusterings of sensor network, equal for any node after the completion of cluster
Corresponded to therewith in the presence of a cluster.
In practical application, the close sensor node in locus has spatial coherence, and the data difference of its monitoring is not
Greatly.If all nodes in selection communication range are used as calculate node, then will be produced in space correlation detection process big
The communication of amount and computing cost, computation complexity is by with square increase of number of nodes.In a preferred embodiment of the invention, use
K-Means clustering methods are clustered to sensor node, it can be ensured that approached with each node location in cluster, so as to realize section
The classifying rationally of the space of points, while reducing communication and computing cost.
Step S2, the spatial coherence feature according to data carries out space correlation detection to Monitoring Data, obtains therein
Abnormal data.Temporal correlation feature according to data, time correlation detection is carried out to Monitoring Data, obtains abnormal number therein
According to.
Usually, the space correlation detection and time correlation detection for Monitoring Data are arranged side by side, and the execution of the two is suitable
Sequence can flexibly be set according to the actual requirements.
Space correlation detection method is introduced first below, and its idiographic flow can be found in Fig. 2.
In general, in the cluster divided according to step S11, if the Monitoring Data of certain node and other nodes
Have big difference, then it is believed that the data exception.Then data mining can be carried out based on distance.Data digging method based on distance
Different from existing Statistics-Based Method, the method based on distance, without priori data, is not required to using the thought of machine learning
Want training data model.From for this point, the method based on distance and the method based on density are identicals, are belonged to neighbouring
The method of degree, but the method based on density is complex, is not suitable for massive wireless sensor.
Space correlation detection based on distance is performed with specific reference to following steps：
Step S21, for the Monitoring Data of any node in either cluster, calculates other in the Monitoring Data and the cluster respectively
The Euclidean distance of the Monitoring Data of each node synchronization.Above-mentioned synchronization refers to the number for other nodes for calculating
Correspond to synchronization according to data to be tested.
The definition of Euclidean distance is：
For two n-dimensional vector Xa(xa1,xa2,...,xan)、Xb(xb1,xb2,...,xbn), Euclidean distance is：
Work as Xa、XbWhen being one-dimensional vector, its Euclidean distance is：
D (a, b)=| xa-xb|
Step S22, each Euclidean distance for calculating is compared with default Euclidean distance threshold value, will be less than Euclidean distance threshold value
Euclidean distance number as Monitoring Data to be detected space correlation number.
Step S23, by space correlation number divided by the node total number in the cluster, obtains the space correlation of Monitoring Data to be detected
Coefficient.
Step S24, space correlation coefficient is compared with default coefficient threshold：If space correlation coefficient is more than coefficient threshold
Value, then the space correlation testing result of Monitoring Data to be detected is normal；If space correlation coefficient is less than or equal to coefficient threshold,
The space correlation testing result of Monitoring Data to be detected is abnormal, judges that this Monitoring Data is abnormal data.
By step S21 to S24, you can realize the space correlation detection of Monitoring Data, in computation complexity and communicate into
In the case that this is relatively low, real-time detection goes out the abnormal data of space correlation dimension.
Time correlation detection method is described below, its idiographic flow can be found in Fig. 3.
Usually, in wireless sensor network, sensor node obtains Monitoring Data at a certain time interval, each
The data of sensor node transmission can form a time series.By time series analysis, it can be deduced that data sequence is abided by
From statistical law.The data of sensor node collection can have many types, such as temperature, humidity, illumination, and above-mentioned monitoring refers to
Mark scope is different, and the form of expression is also different, if setting up different time series models according to different monitoring indexes, the time is multiple
Miscellaneous degree is high, and enforcement difficulty greatly, is not suitable for wireless sensor network.But, it was found by the inventors of the present invention that not considering
In the case of node long-time dormancy, the common ground of every kind of monitoring index be within a bit of time measured value will not produce it is larger
Rise or fall trend.Thought with integration is similar, it is believed that the change of measured value is accumulated by a series of plateau
It is tired to form.
Based on above-mentioned consideration, the present inventor proposes a kind of index smoothing forecasting method based on sliding window to carry out
Time correlation is detected.Sensor network data amount is big, and disposal ability is relatively limited, and index smoothing forecasting method is pre- time series
A kind of analysis method that complexity is low in survey method, amount of calculation is small, therefore it is very suitable for sensor network.On this basis,
Using the thought of sliding window, selected window size is L (L is the integer more than 1), only chooses the preceding L history of current data
Data are analyzed, simultaneously as measured value does not have obvious Long-term change trend within the relatively short time, can use and once refer to
Exponential smoothing is counted to be predicted.
Time correlation detection is performed according to the following steps：
Step S25, for the Monitoring Data of any node in either cluster, any node is obtained at this using sliding window
Before the Monitoring Data acquisition time and L most preceding Historical Monitoring data.It is above-mentioned most before to refer to before data to be tested, and
And the data closest with data to be tested.For example, P1, P2, P3, P4, P5 are Monitoring Data time series, and data P5 is most
Preceding 2 data are P3, P4.
Step S26, is predicted using L Historical Monitoring data, obtains prediction data.It is preferred that using exponential smoothing
Predicted method carries out above-mentioned prediction.
Step S27, calculates the Euclidean distance of Monitoring Data to be detected and prediction data, compares above-mentioned Euclidean distance and presets
Time correlation threshold value：If Euclidean distance is less than time correlation threshold value, the time correlation testing result of Monitoring Data to be detected
For normal；If Euclidean distance is more than or equal to time correlation threshold value, the time correlation testing result of Monitoring Data to be detected is different
Often, judge that the data are abnormal data.
By step S25 to S27, you can realize the time correlation detection of Monitoring Data, quick detection goes out time correlation dimension
The abnormal data of degree.
For the abnormal data that space correlation detection and time correlation detection are obtained, the present inventor's analysis：Typically
For, malicious data is dramatically different with proximity data with time dimension in space, and event data often only exists a dimension
The difference of degree, it is possible thereby to differentiate to abnormal data.Discrimination process is as follows：
Step S3, any abnormal data for obtaining is detected for by time, space correlation, with reference to space correlation detection and
The testing result of time correlation detection, judges that the abnormal data is event data or malicious data.
Specifically, for any Monitoring Data：If its space correlation testing result is different with time correlation testing result
Often, then judge that the data are malicious data；If its space correlation testing result is normally with time correlation testing result, sentence
The data of breaking are normal data；If space correlation testing result is abnormal, time correlation testing result is normal, then judge the number
According to being event data；If time correlation testing result is abnormal, space correlation testing result is normal, then judge that the data are thing
Number of packages evidence.
So, the present invention detects that the method for combining realizes the inspection of abnormal data by time correlation detection and space correlation
Survey and classification.
For classified event data and malicious data, the present invention carries out following different disposal：
For event data, send alarm signal to human observer and cause it to note, the reality for making it understand monitored area in time
When situation of change.
For malicious data, correct this data and reduce the credit worthiness of the node for sending the malicious data.If the letter of node
Reputation degree is less than the first prestige threshold value, then data is not forwarded from the node.If the credit worthiness of node is less than the second prestige threshold value,
The node is shielded, no longer receives its data.Obviously, the second prestige threshold value is generally less than the first prestige threshold value.
By above-mentioned treatment, the present invention punishes malicious node, safeguards network while monitored area situation is understood in time
Safety.
Fig. 5 is another schematic diagram of inventive sensor Network Abnormal data detection method, therefrom it can be seen that the time
The detailed process that coherent detection is combined with space correlation detection.
Fig. 4 shows that sensor of the invention Network Abnormal data detection system is constituted, and detecting system includes data acquisition
Module 300, abnormal judge module 400, anomaly classification module 500.Specifically：
Data acquisition module 300 is used to obtain the Monitoring Data of sensor network.
Abnormal judge module 400 is used for the spatial coherence feature according to data, the prison obtained to data acquisition module 300
Surveying data carries out space correlation detection, obtains abnormal data therein；And according to the temporal correlation feature of data, to monitoring number
According to time correlation detection is carried out, abnormal data therein is obtained.
Anomaly classification module 500 is used to be directed to any abnormal data, with reference to space correlation detection and time coherent detection
Testing result, judges that the abnormal data is event data or malicious data.
The sensor network abnormal deviation data examination method and system provided according to the present invention, can be in real time to wireless senser
The data of network node monitoring carry out abnormality detection.Behind the data is activation of each monitoring cycle to base station, just can be by between data
Temporal correlation detected, can not only find out abnormal data, the abnormal data for detecting can also be classified, it is accurate
Really distinguish that abnormal data is malicious data or event data, so as to targetedly be processed different abnormal datas.This
Invention can be widely applied to enterprises and institutions, military field, the sensor network data monitoring of industrial circle, Internet of Things information prison
Survey, with high value of practical.
One of ordinary skill in the art will appreciate that all or part of step in realizing above-described embodiment method can be
The hardware of correlation is instructed to complete by program, the program can be stored in a computer read/write memory medium, such as：
ROM/RAM, magnetic disc, CD etc..
The above is only the preferred embodiment of the present invention, it is noted that for the ordinary skill people of the art
For member, under the premise without departing from the principles of the invention, some improvements and modifications can also be made, these improvements and modifications also should
It is considered as protection scope of the present invention.
Claims (10)
1. a kind of sensor network abnormal deviation data examination method, it is characterised in that including step：
S1. the Monitoring Data of sensor network is obtained；
S2. the spatial coherence feature according to data, space correlation detection is carried out to the Monitoring Data, obtains exception therein
Data；And
Temporal correlation feature according to data, time correlation detection is carried out to the Monitoring Data, obtains abnormal number therein
According to；
S3. any abnormal data is directed to, with reference to the testing result that space correlation detection and the time correlation are detected, is judged
The abnormal data is event data or malicious data.
2. the method for claim 1, it is characterised in that after step S1, before step S2, methods described also includes
Step：
S11. the spatial positional information according to each node in sensor network is clustered to each node, and locus is close
Node division is in same cluster.
3. method as claimed in claim 2, it is characterised in that the spatial coherence feature according to data, to the prison
Surveying data carries out space correlation detection, obtains abnormal data therein and is specially：
S21. for the Monitoring Data of any node in either cluster, the Monitoring Data is calculated with other node synchronizations in the cluster
Monitoring Data Euclidean distance；
S22. the Euclidean distance is compared with default Euclidean distance threshold value, by less than the Euclidean distance of Euclidean distance threshold value
Number as the Monitoring Data space correlation number；
S23. the space correlation number is obtained into the space correlation system of the Monitoring Data divided by the node total number in the either cluster
Number；
S24. the space correlation coefficient is compared with default coefficient threshold：If the space correlation coefficient is more than coefficient threshold
Value, then the space correlation testing result of the Monitoring Data is normal；If the space correlation coefficient is not more than coefficient threshold, should
The space correlation testing result of Monitoring Data is abnormal, judges that the Monitoring Data is abnormal data.
4. method as claimed in claim 3, it is characterised in that the temporal correlation feature according to data, to the prison
Surveying data carries out time correlation detection, obtains abnormal data therein and is specially：
S25. for the Monitoring Data of any node in either cluster, any node is obtained in the Monitoring Data using sliding window
Before the acquisition time and most preceding multiple Historical Monitoring data；
S26. it is predicted using the multiple Historical Monitoring data, obtains prediction data；
S27. the Euclidean distance of the Monitoring Data and the prediction data is calculated, compares the Euclidean distance with default time correlation threshold
Value：If the Euclidean distance is less than time correlation threshold value, the time correlation testing result of the Monitoring Data is normal；If this is European
Distance is not less than time correlation threshold value, then the time correlation testing result of the Monitoring Data is abnormal, judges that the Monitoring Data is
Abnormal data.
5. method as claimed in claim 4, it is characterised in that step S3 is specially：
For any abnormal data：If its space correlation testing result is exception with time correlation testing result, judging should
Abnormal data is malicious data；If its space correlation testing result is abnormal, time correlation testing result is normal, then judging should
Abnormal data is event data；If its time related test results is abnormal, space correlation testing result is normal, then judging should
Abnormal data is event data.
6. method as claimed in claim 5, it is characterised in that upon step s 2, methods described also includes：
For any Monitoring Data, if its space correlation testing result is normally with time correlation testing result, judging should
Monitoring Data is normal data.
7. the method as described in claim 1-6 is any, it is characterised in that after step s 3, methods described also includes：
If Monitoring Data is event data, alarm signal is sent to human observer；
If Monitoring Data is malicious data, the credit worthiness of the node for sending the malicious data is reduced；If the credit worthiness of node is less than
First prestige threshold value, then make data not forwarded from the node；If the credit worthiness of node is less than the second prestige threshold value, the section is shielded
Point.
8. method as claimed in claim 7, it is characterised in that step S11 is specially：
According to the spatial positional information of each node in sensor network, each node is clustered using K-Means clustering procedures, will
The close node division in locus is in same cluster.
9. method as claimed in claim 8, it is characterised in that step S26 is specially：According to the multiple Historical Monitoring number
According to utilization index smoothing prediction method obtains prediction data；And
The sensor network is wireless sensor network.
10. a kind of sensor network anomaly data detection system, it is characterised in that including：
Data acquisition module, the Monitoring Data for obtaining sensor network；
Abnormal judge module, for the spatial coherence feature according to data, the monitoring number obtained to data acquisition module
According to space correlation detection is carried out, abnormal data therein is obtained；And according to the temporal correlation feature of data, to the monitoring number
According to time correlation detection is carried out, abnormal data therein is obtained；
Anomaly classification module, for for any abnormal data, with reference to space correlation detection and time correlation detection
Testing result, judge that the abnormal data is event data or malicious data.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201710047973.4A CN106792883A (en) | 2017-01-20 | 2017-01-20 | Sensor network abnormal deviation data examination method and system |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201710047973.4A CN106792883A (en) | 2017-01-20 | 2017-01-20 | Sensor network abnormal deviation data examination method and system |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN106792883A true CN106792883A (en) | 2017-05-31 |
Family
ID=58941462
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201710047973.4A Pending CN106792883A (en) | 2017-01-20 | 2017-01-20 | Sensor network abnormal deviation data examination method and system |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN106792883A (en) |
Cited By (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107295545A (en) * | 2017-07-07 | 2017-10-24 | 中国科学院上海微系统与信息技术研究所 | A kind of wireless sensor network method for monitoring operation states |
| CN108801322A (en) * | 2018-07-06 | 2018-11-13 | 哈尔滨工业大学 | Reliability estimation method for UAV Flight Control System MEMS sensor |
| CN110320890A (en) * | 2019-07-08 | 2019-10-11 | 北京科技大学 | A kind of intruding detection system for PLC control system |
| CN110411497A (en) * | 2019-07-08 | 2019-11-05 | 福建工程学院 | A kind of sensor-based monitoring system and method |
| CN113743769A (en) * | 2021-08-30 | 2021-12-03 | 广东电网有限责任公司 | Data security detection method and device, electronic equipment and storage medium |
| CN114244751A (en) * | 2021-11-22 | 2022-03-25 | 慧之安信息技术股份有限公司 | Wireless sensor network anomaly detection method and system |
| CN115326661A (en) * | 2022-10-12 | 2022-11-11 | 深圳市源清环境技术服务有限公司 | Atmospheric environment-based monitoring method and system and readable storage medium |
| CN116484306A (en) * | 2023-06-20 | 2023-07-25 | 蘑菇物联技术（深圳）有限公司 | Positioning method and device of abnormal sensor, computer equipment and storage medium |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103561418A (en) * | 2013-11-07 | 2014-02-05 | 东南大学 | Anomaly detection method based on time series |
| CN103561419A (en) * | 2013-11-07 | 2014-02-05 | 东南大学 | Distributed event detection method based on correlation |
| CN107205244A (en) * | 2016-03-18 | 2017-09-26 | 哈尔滨工业大学（威海） | A kind of design method of the sensor network anomaly data detection based on temporal correlation |
-
2017
- 2017-01-20 CN CN201710047973.4A patent/CN106792883A/en active Pending
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103561418A (en) * | 2013-11-07 | 2014-02-05 | 东南大学 | Anomaly detection method based on time series |
| CN103561419A (en) * | 2013-11-07 | 2014-02-05 | 东南大学 | Distributed event detection method based on correlation |
| CN107205244A (en) * | 2016-03-18 | 2017-09-26 | 哈尔滨工业大学（威海） | A kind of design method of the sensor network anomaly data detection based on temporal correlation |
Cited By (11)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107295545A (en) * | 2017-07-07 | 2017-10-24 | 中国科学院上海微系统与信息技术研究所 | A kind of wireless sensor network method for monitoring operation states |
| CN108801322A (en) * | 2018-07-06 | 2018-11-13 | 哈尔滨工业大学 | Reliability estimation method for UAV Flight Control System MEMS sensor |
| CN110320890A (en) * | 2019-07-08 | 2019-10-11 | 北京科技大学 | A kind of intruding detection system for PLC control system |
| CN110411497A (en) * | 2019-07-08 | 2019-11-05 | 福建工程学院 | A kind of sensor-based monitoring system and method |
| CN110411497B (en) * | 2019-07-08 | 2021-04-02 | 福建工程学院 | Monitoring system and method based on sensor |
| CN113743769A (en) * | 2021-08-30 | 2021-12-03 | 广东电网有限责任公司 | Data security detection method and device, electronic equipment and storage medium |
| CN114244751A (en) * | 2021-11-22 | 2022-03-25 | 慧之安信息技术股份有限公司 | Wireless sensor network anomaly detection method and system |
| CN114244751B (en) * | 2021-11-22 | 2023-09-15 | 慧之安信息技术股份有限公司 | Wireless sensor network anomaly detection method and system |
| CN115326661A (en) * | 2022-10-12 | 2022-11-11 | 深圳市源清环境技术服务有限公司 | Atmospheric environment-based monitoring method and system and readable storage medium |
| CN116484306A (en) * | 2023-06-20 | 2023-07-25 | 蘑菇物联技术（深圳）有限公司 | Positioning method and device of abnormal sensor, computer equipment and storage medium |
| CN116484306B (en) * | 2023-06-20 | 2023-09-26 | 蘑菇物联技术（深圳）有限公司 | Positioning method and device of abnormal sensor, computer equipment and storage medium |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN106792883A (en) | Sensor network abnormal deviation data examination method and system | |
| CN112491796B (en) | Intrusion detection and semantic decision tree quantitative interpretation method based on convolutional neural network | |
| CN110263846A (en) | The method for diagnosing faults for being excavated and being learnt based on fault data depth | |
| Han et al. | Anomaly detection based on multidimensional data processing for protecting vital devices in 6G-enabled massive IIoT | |
| CN106789904B (en) | Internet of Things intrusion detection method and device | |
| CN105471882A (en) | Behavior characteristics-based network attack detection method and device | |
| CN110390357A (en) | A kind of DTU safety monitoring method based on side channel | |
| Salem et al. | Detecting Masqueraders: A Comparison of One-Class Bag-of-Words User Behavior Modeling Techniques. | |
| CN109818798A (en) | A kind of wireless sensor network intruding detection system and method merging KPCA and ELM | |
| CN104636449A (en) | Distributed type big data system risk recognition method based on LSA-GCC | |
| CN107249000B (en) | Method for detecting abnormal behaviors of mobile user | |
| CN102291392A (en) | Hybrid intrusion detection method based on bagging algorithm | |
| CN109670306A (en) | Electric power malicious code detecting method, server and system based on artificial intelligence | |
| CN117094184B (en) | Modeling method, system and medium of risk prediction model based on intranet platform | |
| CN116384736A (en) | Smart city risk perception method and system | |
| CN117592060B (en) | Method and system for detecting security vulnerabilities of processor network | |
| Berjab et al. | A spatiotemporal and multivariate attribute correlation extraction scheme for detecting abnormal nodes in WSNs | |
| Hegazy | Tag Eldien, AS; Tantawy, MM; Fouda, MM; TagElDien, HA Real-time locational detection of stealthy false data injection attack in smart grid: Using multivariate-based multi-label classification approach | |
| CN107992902A (en) | A kind of routine bus system based on supervised learning steals individual automatic testing method | |
| CN114827211A (en) | Abnormal monitoring area detection method driven by node data of Internet of things | |
| Kanumalli et al. | A scalable network intrusion detection system using bi-lstm and cnn | |
| Sönmez et al. | Anomaly detection using data mining methods in it systems: a decision support application | |
| CN109918901A (en) | The method that real-time detection is attacked based on Cache | |
| Ye et al. | A novel self-supervised learning-based anomalous node detection method based on an autoencoder for wireless sensor networks | |
| CN116074092B (en) | Attack scene reconstruction system based on heterogram attention network |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| RJ01 | Rejection of invention patent application after publication | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20170531 |