CN114244751A - Wireless sensor network anomaly detection method and system - Google Patents

Wireless sensor network anomaly detection method and system Download PDF

Info

Publication number
CN114244751A
CN114244751A CN202111388255.6A CN202111388255A CN114244751A CN 114244751 A CN114244751 A CN 114244751A CN 202111388255 A CN202111388255 A CN 202111388255A CN 114244751 A CN114244751 A CN 114244751A
Authority
CN
China
Prior art keywords
data
network node
sensor
abnormal
sample
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
CN202111388255.6A
Other languages
Chinese (zh)
Other versions
CN114244751B (en
Inventor
兰雨晴
王艺璇
余丹
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
China Standard Intelligent Security Technology Co Ltd
Original Assignee
China Standard Intelligent Security Technology Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by China Standard Intelligent Security Technology Co Ltd filed Critical China Standard Intelligent Security Technology Co Ltd
Priority to CN202111388255.6A priority Critical patent/CN114244751B/en
Publication of CN114244751A publication Critical patent/CN114244751A/en
Application granted granted Critical
Publication of CN114244751B publication Critical patent/CN114244751B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/08—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
    • H04L43/0852—Delays
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/08—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
    • H04L43/0876—Network utilisation, e.g. volume of load or congestion level
    • H04L43/0894—Packet rate
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/16—Threshold monitoring
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W24/00—Supervisory, monitoring or testing arrangements
    • H04W24/02—Arrangements for optimising operational condition
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W24/00—Supervisory, monitoring or testing arrangements
    • H04W24/08—Testing, supervising or monitoring using real traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W24/00—Supervisory, monitoring or testing arrangements
    • H04W24/10—Scheduling measurement reports ; Arrangements for measurement reports
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/30—Services specially adapted for particular environments, situations or purposes
    • H04W4/38—Services specially adapted for particular environments, situations or purposes for collecting sensor information
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W84/00—Network topologies
    • H04W84/18—Self-organising networks, e.g. ad-hoc networks or sensor networks
    • Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
    • Y02D—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE
    • Y02D30/00—Reducing energy consumption in communication networks
    • Y02D30/70—Reducing energy consumption in communication networks in wireless communication networks

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Environmental & Geological Engineering (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

The invention provides a wireless sensor network anomaly detection method and a wireless sensor network anomaly detection system, which analyze a monitoring data sequence of any sensor of a wireless sensor network so as to determine whether the corresponding sensor belongs to an anomaly sensor; and judging whether data transmission delay exists in the network node where the abnormal sensor is positioned, so as to determine whether the corresponding network node belongs to the abnormal network node, acquiring and analyzing the monitoring data formed by the abnormal network node, and simultaneously performing data preprocessing before performing abnormal detection on the monitoring data, so as to eliminate part of redundant data which has no influence on the abnormal detection result, thereby greatly reducing the data volume of the monitoring data, reducing the workload of subsequent data abnormal detection, and improving the accuracy and reliability of the data abnormal detection.

Description

Wireless sensor network anomaly detection method and system
Technical Field
The invention relates to the technical field of monitoring of the Internet of things, in particular to a method and a system for detecting abnormality of a wireless sensor network.
Background
The wireless sensor network is generally provided with different types of sensors such as temperature sensors or pressure sensors at different monitoring places, so that a distributed sensor network is constructed, and data monitored by all the sensors are collected and analyzed by using a wireless transmission technology, so that the monitoring of the monitoring area in the whole range is realized. In practical application, due to the fact that a wireless sensor network has a fault or is affected by factors such as external environment interference, data obtained by monitoring the wireless sensor network may have abnormality, and if the abnormal data are not effectively eliminated and enter a subsequent analysis processing link, accuracy and reliability of a monitoring result of the wireless sensor network can be seriously affected, so that the abnormal data obtained by monitoring the wireless sensor network need to be detected and eliminated. Due to the fact that the amount of data obtained by monitoring of the wireless sensor network is large, in the prior art, each piece of data is difficult to accurately detect in an abnormal mode, and the efficiency and the accuracy of data abnormal detection are seriously affected.
Disclosure of Invention
Aiming at the defects in the prior art, the invention provides a method and a system for detecting the abnormality of a wireless sensor network, which analyze a monitoring data sequence of any sensor of the wireless sensor network so as to determine whether the corresponding sensor belongs to an abnormal sensor; and judging whether data transmission delay exists in the network node where the abnormal sensor is positioned, so as to determine whether the corresponding network node belongs to the abnormal network node, acquiring and analyzing the monitoring data formed by the abnormal network node, and simultaneously performing data preprocessing before performing abnormal detection on the monitoring data, so as to eliminate part of redundant data which has no influence on the abnormal detection result, thereby greatly reducing the data volume of the monitoring data, reducing the workload of subsequent data abnormal detection, and improving the accuracy and reliability of the data abnormal detection.
The invention provides a wireless sensor network anomaly detection method, which is characterized by comprising the following steps:
step S1, collecting two monitoring data sequences respectively formed by any sensor in the wireless sensor network in different time periods; analyzing the two monitoring data sequences to judge whether the sensor has abnormal floating of the monitoring data; determining whether the sensor belongs to an abnormal sensor or not according to the judgment result of the abnormal floating of the monitoring data;
step S2, acquiring data interactive transmission states between all sensors in the same network node with the abnormal sensor and the network node relay terminal respectively; analyzing the data interaction transmission state, and judging whether data transmission delay exists between each sensor in the network node and the network node relay terminal;
step S3, determining whether the network node belongs to an abnormal network node according to the judgment result of the data transmission delay; collecting monitoring data formed by all sensors in an abnormal network node, and analyzing the monitoring data so as to judge whether the abnormal network node has data abnormality; then according to the judgment result of the data abnormity, reporting the data abnormity;
further, in the step S1, two monitoring data sequences respectively formed by any sensor in the wireless sensor network in different time periods are collected; analyzing the two monitoring data sequences to judge whether the sensor has abnormal floating of the monitoring data; then, according to the judgment result of the abnormal floating of the monitoring data, determining whether the sensor belongs to an abnormal sensor specifically comprises:
step S101, collecting a first monitoring data sequence formed by any sensor in a wireless sensor network in a first time period; acquiring a second monitoring data sequence formed by any one sensor in a second time period; wherein the first and second time periods have the same length of time and are not contiguous with each other;
step S102, analyzing the first monitoring data sequence and the second monitoring data sequence to determine a first variance corresponding to the first monitoring data sequence and a second variance corresponding to the second monitoring data sequence; and determining an absolute value of a difference between the first variance and the second variance;
step S103, comparing the absolute value of the difference value with a preset difference value threshold value; if the absolute value of the difference is smaller than or equal to the preset difference threshold, determining that the monitoring data of any sensor is not abnormal in floating, and simultaneously determining that any sensor belongs to a normal sensor; if the absolute value of the difference is larger than the preset difference threshold, determining that monitoring data of any sensor are abnormal in floating, and determining that any sensor belongs to an abnormal sensor;
further, in step S2, acquiring data interaction transmission states between all sensors in the same network node as the abnormal sensor and the network node relay terminal respectively; analyzing the data interaction transmission state, and judging whether data transmission delay exists between each sensor in the network node and the network node relay terminal specifically comprises:
step S201, acquiring uplink data transmission rate and downlink data transmission rate between all sensors in the same network node with the abnormal sensor and a terminal in the network node in the data interaction process, and taking the uplink data transmission rate and the downlink data transmission rate as the data interaction transmission state;
step S202, determining a rate ratio between the uplink data transmission rate and the downlink data transmission rate, and comparing the rate ratio with a preset rate ratio threshold; if the rate ratio is smaller than or equal to a preset rate ratio threshold, determining that data transmission delay cannot exist between the corresponding sensor and the network node relay terminal; if the rate ratio is greater than a preset rate ratio threshold, determining that data transmission delay exists between the corresponding sensor and the network node relay terminal;
further, in the step S3, it is determined whether the network node belongs to an abnormal network node according to the determination result of the data transmission delay; collecting monitoring data formed by all sensors in an abnormal network node, and analyzing the monitoring data so as to judge whether the abnormal network node has data abnormality; and then according to the judgment result of the data abnormity, reporting the data abnormity specifically comprises the following steps:
step S301, if the sensors which are more than a preset quantity proportion in all the sensors in the same network node with the abnormal sensor are judged to have data transmission delay, determining that the network node belongs to the abnormal network node; otherwise, determining that the network node belongs to a normal network node;
step S302, collecting monitoring data formed by all sensors in the abnormal network node, taking each monitoring data as a detection sample point, randomly dividing all the detection sample points into a plurality of sample clusters, determining the sample similarity value E among all the sample clusters by using the following formula (1),
Figure BDA0003367859520000041
in the above formula (1), CiRepresenting the random division of all detected sample points into the ith sample cluster of the k sample clusters; x represents a detection sample point contained in the ith sample cluster; | Ci| represents taking the absolute value of the ith sample cluster; j. the design is a squareiRepresents the average value of all detection sample points contained in the ith sample cluster; d (x, J)i) Expression finding x and JiA numerical distance function therebetween;
when the cluster distribution result of any one point changes, for each point in the sample data set, calculating the distance between the mean point and the data point, distributing the data point to each cluster of the cluster pair closest to the point, calculating the mean value of all the points in the cluster, and taking the mean value as the center of the cluster;
then, the following formula (2) is used to obtain the corresponding average value of each sample cluster with the highest sample similarity value among all the sample clusters,
Figure BDA0003367859520000042
in the above formula (2), D [ k ]]A set representing a corresponding mean value for each sample cluster that results in a highest sample similarity value among all sample clusters, the set comprising k mean values;
Figure BDA0003367859520000043
indicates the corresponding J when the value of the function in the parentheses is minimized1...JkA value;
finally, using the following formula (3), set D [ k ] is divided]Mean J comprising the correspondence of each mean to all the test sample pointsZComparing, marking the corresponding sample cluster according to the comparison result,
Figure BDA0003367859520000044
in the above formula (3), QClRepresents a sample cluster ClMarking value of color marking is carried out, R represents a preset red marking value, and G represents a preset green marking value; qClG denotes a sample cluster ClThe included detection sample point data is normal, and the sample cluster C islMarking green; qClR denotes a sample cluster ClIncluding detecting sample point data anomalies, and clustering samples ClMarked red;
step S303, carrying out SVDD algorithm detection on the sample cluster determined to be abnormal in data, reporting the SVDD algorithm detection result to a cloud platform of the wireless sensor network, and deleting the sample cluster determined to be abnormal in data.
The invention also provides a wireless sensor network anomaly detection system which is characterized by comprising a sensor state determination module, a network node transmission delay determination module, a network node state determination module and a data anomaly judgment and report module; wherein the content of the first and second substances,
the sensor state determination module is used for acquiring two monitoring data sequences which are respectively formed by any sensor in the wireless sensor network in different time periods; analyzing the two monitoring data sequences to judge whether the sensor has abnormal floating of the monitoring data; determining whether the sensor belongs to an abnormal sensor or not according to the judgment result of the abnormal floating of the monitoring data;
the network node transmission delay determining module is used for acquiring data interaction transmission states between all sensors which are positioned at the same network node with the abnormal sensor and a network node relay terminal respectively; analyzing the data interaction transmission state, and judging whether data transmission delay exists between each sensor in the network node and the network node relay terminal;
the network node state determining module is used for determining whether the network node belongs to an abnormal network node according to the judgment result of the data transmission delay;
the data abnormity judging and reporting module is used for collecting monitoring data formed by all sensors in an abnormal network node and analyzing the monitoring data so as to judge whether the abnormal network node has data abnormity; then according to the judgment result of the data abnormity, reporting the data abnormity;
further, the sensor state determination module is used for acquiring two monitoring data sequences which are respectively formed by any sensor in the wireless sensor network in different time periods; analyzing the two monitoring data sequences to judge whether the sensor has abnormal floating of the monitoring data; then, according to the judgment result of the abnormal floating of the monitoring data, determining whether the sensor belongs to an abnormal sensor specifically comprises:
acquiring a first monitoring data sequence formed by any sensor in the wireless sensor network in a first time period; acquiring a second monitoring data sequence formed by any one sensor in a second time period; wherein the first and second time periods have the same length of time and are not contiguous with each other;
analyzing the first monitoring data sequence and the second monitoring data sequence to determine a first variance corresponding to the first monitoring data sequence and a second variance corresponding to the second monitoring data sequence; and determining an absolute value of a difference between the first variance and the second variance;
comparing the absolute value of the difference value with a preset difference value threshold; if the absolute value of the difference is smaller than or equal to the preset difference threshold, determining that the monitoring data of any sensor is not abnormal in floating, and simultaneously determining that any sensor belongs to a normal sensor; if the absolute value of the difference is larger than the preset difference threshold, determining that monitoring data of any sensor are abnormal in floating, and determining that any sensor belongs to an abnormal sensor;
further, the network node transmission delay determining module is configured to acquire a data interaction transmission state between each of all sensors located in the same network node as the abnormal sensor and a network node relay terminal; analyzing the data interaction transmission state, and judging whether data transmission delay exists between each sensor in the network node and the network node relay terminal specifically comprises:
acquiring uplink data transmission rate and downlink data transmission rate between all sensors in the same network node as the abnormal sensor and a terminal in the network node in the data interaction process respectively, and taking the uplink data transmission rate and the downlink data transmission rate as the data interaction transmission state;
determining a rate ratio between the uplink data transmission rate and the downlink data transmission rate, and comparing the rate ratio with a preset rate ratio threshold; if the rate ratio is smaller than or equal to a preset rate ratio threshold, determining that data transmission delay cannot exist between the corresponding sensor and the network node relay terminal; if the rate ratio is greater than a preset rate ratio threshold, determining that data transmission delay exists between the corresponding sensor and the network node relay terminal;
further, the determining, by the network node state determining module, whether the network node belongs to an abnormal network node according to the determination result of the data transmission delay specifically includes:
if the sensors with the number ratio exceeding the preset number ratio in all the sensors in the same network node with the abnormal sensor are judged to have data transmission delay, determining that the network node belongs to the abnormal network node; otherwise, determining that the network node belongs to a normal network node;
and the number of the first and second groups,
the data abnormity judging and reporting module is used for collecting monitoring data formed by all sensors in an abnormal network node and analyzing the monitoring data so as to judge whether the abnormal network node has data abnormity; and then according to the judgment result of the data abnormity, reporting the data abnormity specifically comprises the following steps:
collecting monitoring data formed by all sensors in an abnormal network node, taking each monitoring data as a detection sample point, randomly dividing all the detection sample points into a plurality of sample clusters, determining sample similarity values E among all the sample clusters by using the following formula (1),
Figure BDA0003367859520000071
in the above formula (1), CiRepresenting the random division of all detected sample points into the ith sample cluster of the k sample clusters; x represents a detection sample point contained in the ith sample cluster; | Ci| represents taking the absolute value of the ith sample cluster; j. the design is a squareiRepresents the average value of all detection sample points contained in the ith sample cluster; d (x, J)i) Expression finding x and JiA numerical distance function therebetween;
when the cluster distribution result of any one point changes, for each point in the sample data set, calculating the distance between the mean point and the data point, distributing the data point to each cluster of the cluster pair closest to the point, calculating the mean value of all the points in the cluster, and taking the mean value as the center of the cluster;
then, the following formula (2) is used to obtain the corresponding average value of each sample cluster with the highest sample similarity value among all the sample clusters,
Figure BDA0003367859520000072
in the above formula (2), D [ k ]]A set representing a corresponding mean value for each sample cluster that results in a highest sample similarity value among all sample clusters, the set comprising k mean values;
Figure BDA0003367859520000073
indicates the corresponding J when the value of the function in the parentheses is minimized1...JkA value;
finally, using the following formula (3), set D [ k ] is divided]Mean J comprising the correspondence of each mean to all the test sample pointsZComparing, marking the corresponding sample cluster according to the comparison result,
Figure BDA0003367859520000081
in the above-mentioned formula (3),
Figure BDA0003367859520000082
represents a sample cluster ClMarking value of color marking is carried out, R represents a preset red marking value, and G represents a preset green marking value;
Figure BDA0003367859520000083
represents a sample cluster ClThe included detection sample point data is normal, and the sample cluster C islMarking green;
Figure BDA0003367859520000084
represents a sample cluster ClIncluding detecting sample point data anomalies, and clustering samples ClMarked red;
and carrying out SVDD algorithm detection on the sample cluster determined to be abnormal in data, reporting the SVDD algorithm detection result to a cloud platform of the wireless sensor network, and deleting the sample cluster determined to be abnormal in data.
Compared with the prior art, the method and the system for detecting the wireless sensor network abnormity analyze the monitoring data sequence of any sensor of the wireless sensor network so as to determine whether the corresponding sensor belongs to the abnormal sensor; and judging whether data transmission delay exists in the network node where the abnormal sensor is positioned, so as to determine whether the corresponding network node belongs to the abnormal network node, acquiring and analyzing the monitoring data formed by the abnormal network node, and simultaneously performing data preprocessing before performing abnormal detection on the monitoring data, so as to eliminate part of redundant data which has no influence on the abnormal detection result, thereby greatly reducing the data volume of the monitoring data, reducing the workload of subsequent data abnormal detection, and improving the accuracy and reliability of the data abnormal detection.
Additional features and advantages of the invention will be set forth in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. The objectives and other advantages of the invention will be realized and attained by the structure particularly pointed out in the written description and claims hereof as well as the appended drawings.
The technical solution of the present invention is further described in detail by the accompanying drawings and embodiments.
Drawings
In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly described below, it is obvious that the drawings in the following description are only some embodiments of the present invention, and for those skilled in the art, other drawings can be obtained according to the drawings without creative efforts.
Fig. 1 is a schematic flow chart of a method for detecting an abnormality in a wireless sensor network according to the present invention.
Fig. 2 is a schematic structural diagram of a wireless sensor network anomaly detection system provided by the present invention.
Detailed Description
The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.
Fig. 1 is a schematic flow chart of a method for detecting an abnormality in a wireless sensor network according to an embodiment of the present invention. The method for detecting the abnormality of the wireless sensor network comprises the following steps:
step S1, collecting two monitoring data sequences respectively formed by any sensor in the wireless sensor network in different time periods; analyzing the two monitoring data sequences to judge whether the sensor has abnormal floating of the monitoring data; determining whether the sensor belongs to an abnormal sensor or not according to the judgment result of the abnormal floating of the monitoring data;
step S2, acquiring data interactive transmission states between all sensors in the same network node with the abnormal sensor and the network node relay terminal respectively; analyzing the data interactive transmission state, and judging whether data transmission delay exists between each sensor in the network node and the network node relay terminal;
step S3, determining whether the network node belongs to an abnormal network node according to the determination result of the data transmission delay; collecting monitoring data formed by all sensors in an abnormal network node, and analyzing the monitoring data so as to judge whether the abnormal network node has data abnormality; and then reporting the data abnormity according to the judgment result of the data abnormity.
The beneficial effects of the above technical scheme are: the wireless sensor network anomaly detection method analyzes a monitoring data sequence of any sensor of the wireless sensor network so as to determine whether the corresponding sensor belongs to an anomaly sensor; and judging whether data transmission delay exists in the network node where the abnormal sensor is positioned, so as to determine whether the corresponding network node belongs to the abnormal network node, acquiring and analyzing the monitoring data formed by the abnormal network node, and simultaneously performing data preprocessing before performing abnormal detection on the monitoring data, so as to eliminate part of redundant data which has no influence on the abnormal detection result, thereby greatly reducing the data volume of the monitoring data, reducing the workload of subsequent data abnormal detection, and improving the accuracy and reliability of the data abnormal detection.
Preferably, in the step S1, two monitoring data sequences respectively formed by any sensor in the wireless sensor network in different time periods are collected; analyzing the two monitoring data sequences to judge whether the sensor has abnormal floating of the monitoring data; then, according to the judgment result of the abnormal floating of the monitoring data, determining whether the sensor belongs to an abnormal sensor specifically comprises the following steps:
step S101, collecting a first monitoring data sequence formed by any sensor in a wireless sensor network in a first time period; collecting a second monitoring data sequence formed by any one sensor in a second time period; wherein the first time period and the second time period have the same time length, and the first time period and the second time period are not adjacent to each other;
step S102, analyzing the first monitoring data sequence and the second monitoring data sequence to determine a first variance corresponding to the first monitoring data sequence and a second variance corresponding to the second monitoring data sequence; and determining an absolute value of a difference between the first variance and the second variance;
step S103, comparing the absolute value of the difference with a preset difference threshold; if the absolute value of the difference is smaller than or equal to the preset difference threshold, determining that the any sensor has no abnormal floating monitoring data, and simultaneously determining that the any sensor belongs to a normal sensor; and if the absolute value of the difference is larger than the preset difference threshold, determining that the monitoring data of any sensor has abnormal floating, and simultaneously determining that any sensor belongs to an abnormal sensor.
The beneficial effects of the above technical scheme are: the wireless sensor network typically includes a plurality of sensors arranged in a distributed manner, wherein the sensors may be, but are not limited to, temperature sensors, pressure sensors, etc., and each sensor monitors corresponding data, such as temperature data, pressure data, etc., of its location. Meanwhile, the wireless sensor network comprises a plurality of network nodes on a network structure, each network node forms a relatively independent monitoring unit, each network node comprises a plurality of sensors and a network node relay terminal, and the network node relay terminal can be, but is not limited to, a relay cache terminal or a relay server. In each network node, all the sensors are connected with the network node relay terminal, so that the network node relay terminal can perform data interactive transmission with each sensor, and the control of the network node relay terminal on the sensors or the receiving of monitoring data formed by the network node relay terminal on the sensors is realized.
Because the wireless sensor network contains a large number of sensors, if the monitoring data formed by each sensor is analyzed one by one, a large amount of manpower and material resources are needed for data processing, and meanwhile, the efficiency of data analysis cannot be guaranteed. In order to ensure that the sensors in the wireless sensor network are effectively checked, firstly, one sensor can be arbitrarily selected from the wireless sensor network, a first monitoring data sequence and a second monitoring data sequence formed by the sensors are respectively collected in a first time period and a second time period which have the same time length and are not adjacent to each other, the number of data contained in the monitoring data sequences formed in the two time periods by the sensors can be ensured to be the same by setting the first time period and the second time period to be the same, and the data association degree between the first monitoring data sequence and the second monitoring data sequence can be ensured to be reduced to the minimum degree and the two monitoring data sequences can be prevented from colliding due to the effect of accidental factors by setting the first time period and the second time period to be not adjacent to each other. Then, determining respective variances of the first monitoring data sequence and the second monitoring data sequence and a difference between the two variances, and performing threshold comparison on the variance difference, so that whether the sensor has abnormal floating of monitoring data in the whole monitoring data forming process can be determined according to the threshold comparison result, if so, it is indicated that the current data monitoring of the sensor has a problem or the sensor has a problem due to external environment interference, at the moment, the sensor is marked as an abnormal sensor, the abnormal sensor can be used as a clue to perform data abnormality detection on the whole wireless sensor network, and compared with the case of performing data abnormality detection on all the sensors one by one, the efficiency of abnormality detection can be effectively improved, and the time consumed by the abnormality detection can be reduced.
Preferably, in the step S2, acquiring data interaction transmission states between all sensors in the same network node as the abnormal sensor and the network node relay terminal respectively; analyzing the data interaction transmission state, and determining whether a data transmission delay exists between each sensor in the network node and the network node relay terminal specifically includes:
step S201, acquiring uplink data transmission rate and downlink data transmission rate between all sensors in the same network node with the abnormal sensor and a terminal in the network node in the data interaction process, and taking the uplink data transmission rate and the downlink data transmission rate as the data interaction transmission state;
step S202, determining the rate ratio between the uplink data transmission rate and the downlink data transmission rate, and comparing the rate ratio with a preset rate ratio threshold; if the rate ratio is smaller than or equal to a preset rate ratio threshold, determining that data transmission delay cannot exist between the corresponding sensor and the network node relay terminal; and if the rate ratio is greater than a preset rate ratio threshold, determining that data transmission delay exists between the corresponding sensor and the network node relay terminal.
The beneficial effects of the above technical scheme are: when a sensor in a certain network node is determined to belong to an abnormal sensor, other sensors in the network node are affected due to the abnormal monitoring data of the abnormal sensor, so that delay errors of data transmission exist between the other sensors and the network node relay terminal of the network node, and the accuracy of the monitoring data of the whole network node is seriously affected. At this time, an uplink data transmission rate and a downlink data transmission rate between each sensor including the abnormal sensor in the network node and the network node relay terminal are obtained, a rate ratio between the uplink data transmission rate and the downlink data transmission rate is determined, and threshold comparison is performed.
Preferably, in the step S3, it is determined whether the network node belongs to an abnormal network node according to the determination result of the data transmission delay; collecting monitoring data formed by all sensors in an abnormal network node, and analyzing the monitoring data so as to judge whether the abnormal network node has data abnormality; then, according to the judgment result of the data exception, the reporting processing of the data exception specifically comprises:
step S301, if the sensor which is more than a preset quantity proportion in all the sensors of the same network node with the abnormal sensor is judged to have data transmission delay, determining that the network node belongs to the abnormal network node; otherwise, determining that the network node belongs to a normal network node;
step S302, collecting monitoring data formed by all sensors in the abnormal network node, taking each monitoring data as a detection sample point, randomly dividing all the detection sample points into a plurality of sample clusters, determining the sample similarity value E among all the sample clusters by using the following formula (1),
Figure BDA0003367859520000131
in the above formula (1), CiRepresenting the random division of all detected sample points into the ith sample cluster of the k sample clusters; x represents a detection sample point contained in the ith sample cluster; | Ci| represents taking the absolute value of the ith sample cluster; j. the design is a squareiRepresents the average value of all detection sample points contained in the ith sample cluster; d (x, J)i) Expression finding x and JiA numerical distance function therebetween;
when the cluster distribution result of any one point changes, for each point in the sample data set, calculating the distance between the mean point and the data point, distributing the data point to each cluster of the cluster pair closest to the point, calculating the mean value of all the points in the cluster, and taking the mean value as the center of the cluster; the above process is essentially an iterative process, specifically, sample data is randomly divided into K groups (the number of sample points in the group may be different), K objects are randomly selected as the centers of the initial clusters, then the distance between each object and the center of each initial cluster is calculated, and each sample point is assigned to the cluster center closest to the object. The center of the clusters and the sample points assigned to them represent a cluster. The center of the cluster is recalculated for each sample assigned based on the objects existing in the cluster. This process will be repeated until no sample points are reassigned to a different cluster, no cluster centers change;
then, the following formula (2) is used to obtain the corresponding average value of each sample cluster with the highest sample similarity value among all the sample clusters,
Figure BDA0003367859520000132
in the above formula (2), D [ k ]]Representing a set of mean values corresponding to each sample cluster, which makes the sample similarity value among all the sample clusters highest, the set comprising k mean values;
Figure BDA0003367859520000133
indicates the corresponding J when the value of the function in the parentheses is minimized1...JkA value;
finally, using the following formula (3), set D [ k ] is divided]Mean J comprising the correspondence of each mean to all the test sample pointsZComparing, marking the corresponding sample cluster according to the comparison result,
Figure BDA0003367859520000141
in the above-mentioned formula (3),
Figure BDA0003367859520000142
represents a sample cluster ClMarking value of color marking is carried out, R represents a preset red marking value, and G represents a preset green marking value;
Figure BDA0003367859520000143
represents a sample cluster ClThe included detection sample point data is normal, and the sample cluster C islMarking green;
Figure BDA0003367859520000144
represents a sample cluster ClIncluding detecting sample point data anomalies, and clustering samples ClMarked red;
step S303, carrying out SVDD algorithm detection on the sample cluster determined to be abnormal in data, reporting the SVDD algorithm detection result to a cloud platform of the wireless sensor network, and deleting the sample cluster determined to be abnormal in data.
The beneficial effects of the above technical scheme are: when the ratio of the number of the sensors with data transmission delay in the network node exceeds a certain ratio (for example, 50%), abnormal delay exists in the whole monitoring data acquisition and uploading of the network node, that is, the monitoring data cannot be accurately matched with the actual monitoring condition of the sensors, and the network node is determined to belong to an abnormal network node. And (3) preprocessing the monitoring data formed by the abnormal network nodes by using the formulas (1) to (3) subsequently, thereby eliminating redundant data which has no influence on the abnormal detection result from the monitoring data, and greatly reducing the workload of performing abnormal detection on the monitoring data subsequently. Specifically, by using the formula (1), a detection sample point set formed by abnormal network nodes can be clustered and divided, and the detection sample point set is further divided into a plurality of sample clusters, so that all detection sample points can be distinguished and processed conveniently in the following process; by using the formula (2), according to the sample similarity of the sample clusters, the sample mean value of all the sample cluster similarities is obtained, so that the preliminary processing of the detection sample points is completed, the sample point data quantity can be effectively reduced, and the calculation time of the subsequent SVDD algorithm is saved; by using the formula (3), the sample clusters with abnormal conditions can be marked, so that the abnormal sample clusters can be accurately eliminated subsequently. And finally, carrying out anomaly detection on all the sample point data of all the reserved sample clusters by using an SVDD algorithm, thereby accurately distinguishing the remaining sample point data into normal data and abnormal data, and reporting and deleting the data in the sample clusters corresponding to the abnormal data, thereby ensuring that only the sample point data belonging to the normal data can enter the subsequent processing flow. The method for detecting the abnormality of all the sample point data of all the reserved sample clusters by using the SVDD algorithm belongs to the conventional technical means in the field, and will not be described in detail here.
Fig. 2 is a schematic structural diagram of a wireless sensor network anomaly detection system according to an embodiment of the present invention. The wireless sensor network anomaly detection system comprises a sensor state determination module, a network node transmission delay determination module, a network node state determination module and a data anomaly judgment and report module; wherein the content of the first and second substances,
the sensor state determination module is used for acquiring two monitoring data sequences which are respectively formed by any sensor in the wireless sensor network in different time periods; analyzing the two monitoring data sequences to judge whether the sensor has abnormal floating of the monitoring data; determining whether the sensor belongs to an abnormal sensor or not according to the judgment result of the abnormal floating of the monitoring data;
the network node transmission delay determining module is used for acquiring data interactive transmission states between all sensors which are positioned at the same network node with the abnormal sensor and a network node relay terminal respectively; analyzing the data interactive transmission state, and judging whether data transmission delay exists between each sensor in the network node and the network node relay terminal;
the network node state determining module is used for determining whether the network node belongs to an abnormal network node according to the judgment result of the data transmission delay;
the data abnormity judging and reporting module is used for collecting monitoring data formed by all sensors in an abnormal network node and analyzing the monitoring data so as to judge whether the abnormal network node has data abnormity; and then reporting the data abnormity according to the judgment result of the data abnormity.
The beneficial effects of the above technical scheme are: the wireless sensor network anomaly detection system analyzes a monitoring data sequence of any sensor of the wireless sensor network so as to determine whether the corresponding sensor belongs to an anomaly sensor; and judging whether data transmission delay exists in the network node where the abnormal sensor is positioned, so as to determine whether the corresponding network node belongs to the abnormal network node, acquiring and analyzing the monitoring data formed by the abnormal network node, and simultaneously performing data preprocessing before performing abnormal detection on the monitoring data, so as to eliminate part of redundant data which has no influence on the abnormal detection result, thereby greatly reducing the data volume of the monitoring data, reducing the workload of subsequent data abnormal detection, and improving the accuracy and reliability of the data abnormal detection.
Preferably, the sensor state determination module is configured to acquire two monitoring data sequences respectively formed by any one sensor in the wireless sensor network in different time periods; analyzing the two monitoring data sequences to judge whether the sensor has abnormal floating of the monitoring data; then, according to the judgment result of the abnormal floating of the monitoring data, determining whether the sensor belongs to an abnormal sensor specifically comprises the following steps:
acquiring a first monitoring data sequence formed by any sensor in the wireless sensor network in a first time period; collecting a second monitoring data sequence formed by any one sensor in a second time period; wherein the first time period and the second time period have the same time length, and the first time period and the second time period are not adjacent to each other;
analyzing the first monitoring data sequence and the second monitoring data sequence to determine a first variance corresponding to the first monitoring data sequence and a second variance corresponding to the second monitoring data sequence; and determining an absolute value of a difference between the first variance and the second variance;
comparing the absolute value of the difference with a preset difference threshold; if the absolute value of the difference is smaller than or equal to the preset difference threshold, determining that the any sensor has no abnormal floating monitoring data, and simultaneously determining that the any sensor belongs to a normal sensor; and if the absolute value of the difference is larger than the preset difference threshold, determining that the monitoring data of any sensor has abnormal floating, and simultaneously determining that any sensor belongs to an abnormal sensor.
The beneficial effects of the above technical scheme are: the wireless sensor network typically includes a plurality of sensors arranged in a distributed manner, wherein the sensors may be, but are not limited to, temperature sensors, pressure sensors, etc., and each sensor monitors corresponding data, such as temperature data, pressure data, etc., of its location. Meanwhile, the wireless sensor network comprises a plurality of network nodes on a network structure, each network node forms a relatively independent monitoring unit, each network node comprises a plurality of sensors and a network node relay terminal, and the network node relay terminal can be, but is not limited to, a relay cache terminal or a relay server. In each network node, all the sensors are connected with the network node relay terminal, so that the network node relay terminal can perform data interactive transmission with each sensor, and the control of the network node relay terminal on the sensors or the receiving of monitoring data formed by the network node relay terminal on the sensors is realized.
Because the wireless sensor network contains a large number of sensors, if the monitoring data formed by each sensor is analyzed one by one, a large amount of manpower and material resources are needed for data processing, and meanwhile, the efficiency of data analysis cannot be guaranteed. In order to ensure that the sensors in the wireless sensor network are effectively checked, firstly, one sensor can be arbitrarily selected from the wireless sensor network, a first monitoring data sequence and a second monitoring data sequence formed by the sensors are respectively collected in a first time period and a second time period which have the same time length and are not adjacent to each other, the number of data contained in the monitoring data sequences formed in the two time periods by the sensors can be ensured to be the same by setting the first time period and the second time period to be the same, and the data association degree between the first monitoring data sequence and the second monitoring data sequence can be ensured to be reduced to the minimum degree and the two monitoring data sequences can be prevented from colliding due to the effect of accidental factors by setting the first time period and the second time period to be not adjacent to each other. Then, determining respective variances of the first monitoring data sequence and the second monitoring data sequence and a difference between the two variances, and performing threshold comparison on the variance difference, so that whether the sensor has abnormal floating of monitoring data in the whole monitoring data forming process can be determined according to the threshold comparison result, if so, it is indicated that the current data monitoring of the sensor has a problem or the sensor has a problem due to external environment interference, at the moment, the sensor is marked as an abnormal sensor, the abnormal sensor can be used as a clue to perform data abnormality detection on the whole wireless sensor network, and compared with the case of performing data abnormality detection on all the sensors one by one, the efficiency of abnormality detection can be effectively improved, and the time consumed by the abnormality detection can be reduced.
Preferably, the network node transmission delay determining module is configured to acquire a data interaction transmission state between each of all sensors located in the same network node as the abnormal sensor and the network node relay terminal; analyzing the data interaction transmission state, and determining whether a data transmission delay exists between each sensor in the network node and the network node relay terminal specifically includes:
acquiring uplink data transmission rate and downlink data transmission rate between all sensors in the same network node with the abnormal sensor and a terminal in the network node in the data interaction process respectively, and taking the uplink data transmission rate and the downlink data transmission rate as the data interaction transmission state;
determining a rate ratio between the uplink data transmission rate and the downlink data transmission rate, and comparing the rate ratio with a preset rate ratio threshold; if the rate ratio is smaller than or equal to a preset rate ratio threshold, determining that data transmission delay cannot exist between the corresponding sensor and the network node relay terminal; and if the rate ratio is greater than a preset rate ratio threshold, determining that data transmission delay exists between the corresponding sensor and the network node relay terminal.
The beneficial effects of the above technical scheme are: when a sensor in a certain network node is determined to belong to an abnormal sensor, other sensors in the network node are affected due to the abnormal monitoring data of the abnormal sensor, so that delay errors of data transmission exist between the other sensors and the network node relay terminal of the network node, and the accuracy of the monitoring data of the whole network node is seriously affected. At this time, an uplink data transmission rate and a downlink data transmission rate between each sensor including the abnormal sensor in the network node and the network node relay terminal are obtained, a rate ratio between the uplink data transmission rate and the downlink data transmission rate is determined, and threshold comparison is performed.
Preferably, the determining, by the network node state determining module, whether the network node belongs to an abnormal network node according to the determination result of the data transmission delay specifically includes:
if the sensors with the number ratio exceeding the preset number ratio in all the sensors of the same network node with the abnormal sensor are judged to have data transmission delay, determining that the network node belongs to the abnormal network node; otherwise, determining that the network node belongs to a normal network node;
and the number of the first and second groups,
the data abnormity judging and reporting module is used for collecting monitoring data formed by all sensors in an abnormal network node and analyzing the monitoring data so as to judge whether the abnormal network node has data abnormity; then, according to the judgment result of the data exception, the reporting processing of the data exception specifically comprises:
collecting monitoring data formed by all sensors in an abnormal network node, taking each monitoring data as a detection sample point, randomly dividing all the detection sample points into a plurality of sample clusters, determining sample similarity values E among all the sample clusters by using the following formula (1),
Figure BDA0003367859520000191
in the above formula (1), CiRepresenting the random division of all detected sample points into the ith sample cluster of the k sample clusters; x represents a detection sample point contained in the ith sample cluster; | Ci| represents taking the absolute value of the ith sample cluster; j. the design is a squareiRepresents the average value of all detection sample points contained in the ith sample cluster; d (x, J)i) Expression finding x and JiA numerical distance function therebetween;
when the cluster distribution result of any one point changes, for each point in the sample data set, calculating the distance between the mean point and the data point, distributing the data point to each cluster of the cluster pair closest to the point, calculating the mean value of all the points in the cluster, and taking the mean value as the center of the cluster; the above process is essentially an iterative process, specifically, sample data is randomly divided into K groups (the number of sample points in the group may be different), K objects are randomly selected as the centers of the initial clusters, then the distance between each object and the center of each initial cluster is calculated, and each sample point is assigned to the cluster center closest to the object. The center of the clusters and the sample points assigned to them represent a cluster. The center of the cluster is recalculated for each sample assigned based on the objects existing in the cluster. This process will be repeated until no sample points are reassigned to a different cluster, no cluster centers change;
then, the following formula (2) is used to obtain the corresponding average value of each sample cluster with the highest sample similarity value among all the sample clusters,
Figure BDA0003367859520000192
in the above formula (2), D [ k ]]Representing a set of mean values corresponding to each sample cluster, which makes the sample similarity value among all the sample clusters highest, the set comprising k mean values;
Figure BDA0003367859520000193
indicates the corresponding J when the value of the function in the parentheses is minimized1...JkA value;
finally, using the following formula (3), set D [ k ] is divided]Mean J comprising the correspondence of each mean to all the test sample pointsZComparing, marking the corresponding sample cluster according to the comparison result,
Figure BDA0003367859520000201
in the above-mentioned formula (3),
Figure BDA0003367859520000202
represents a sample cluster ClMarking value of color marking is carried out, R represents a preset red marking value, and G represents a preset green marking value;
Figure BDA0003367859520000203
represents a sample cluster ClThe included detection sample point data is normal, and the sample cluster C islMarking green;
Figure BDA0003367859520000204
represents a sample cluster ClIncluding detecting sample point data anomalies, and clustering samples ClMarked red;
and carrying out SVDD algorithm detection on the sample cluster determined to be abnormal in data, reporting the SVDD algorithm detection result to a cloud platform of the wireless sensor network, and deleting the sample cluster determined to be abnormal in data.
The beneficial effects of the above technical scheme are: when the ratio of the number of the sensors with data transmission delay in the network node exceeds a certain ratio (for example, 50%), abnormal delay exists in the whole monitoring data acquisition and uploading of the network node, that is, the monitoring data cannot be accurately matched with the actual monitoring condition of the sensors, and the network node is determined to belong to an abnormal network node. And (3) preprocessing the monitoring data formed by the abnormal network nodes by using the formulas (1) to (3) subsequently, thereby eliminating redundant data which has no influence on the abnormal detection result from the monitoring data, and greatly reducing the workload of performing abnormal detection on the monitoring data subsequently. Specifically, by using the formula (1), a detection sample point set formed by abnormal network nodes can be clustered and divided, and the detection sample point set is further divided into a plurality of sample clusters, so that all detection sample points can be distinguished and processed conveniently in the following process; by using the formula (2), according to the sample similarity of the sample clusters, the sample mean value of all the sample cluster similarities is obtained, so that the preliminary processing of the detection sample points is completed, the sample point data quantity can be effectively reduced, and the calculation time of the subsequent SVDD algorithm is saved; by using the formula (3), the sample clusters with abnormal conditions can be marked, so that the abnormal sample clusters can be accurately eliminated subsequently. And finally, carrying out anomaly detection on all the sample point data of all the reserved sample clusters by using an SVDD algorithm, thereby accurately distinguishing the remaining sample point data into normal data and abnormal data, and reporting and deleting the data in the sample clusters corresponding to the abnormal data, thereby ensuring that only the sample point data belonging to the normal data can enter the subsequent processing flow. The method for detecting the abnormality of all the sample point data of all the reserved sample clusters by using the SVDD algorithm belongs to the conventional technical means in the field, and will not be described in detail here.
As can be seen from the content of the foregoing embodiments, the method and system for detecting an abnormality of a wireless sensor network analyze a monitoring data sequence of any sensor of the wireless sensor network, so as to determine whether the corresponding sensor belongs to an abnormal sensor; and judging whether data transmission delay exists in the network node where the abnormal sensor is positioned, so as to determine whether the corresponding network node belongs to the abnormal network node, acquiring and analyzing the monitoring data formed by the abnormal network node, and simultaneously performing data preprocessing before performing abnormal detection on the monitoring data, so as to eliminate part of redundant data which has no influence on the abnormal detection result, thereby greatly reducing the data volume of the monitoring data, reducing the workload of subsequent data abnormal detection, and improving the accuracy and reliability of the data abnormal detection.
It will be apparent to those skilled in the art that various changes and modifications may be made in the present invention without departing from the spirit and scope of the invention. Thus, if such modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include such modifications and variations.

Claims (8)

1. The method for detecting the abnormality of the wireless sensor network is characterized by comprising the following steps of:
step S1, collecting two monitoring data sequences respectively formed by any sensor in the wireless sensor network in different time periods; analyzing the two monitoring data sequences to judge whether the sensor has abnormal floating of the monitoring data; determining whether the sensor belongs to an abnormal sensor or not according to the judgment result of the abnormal floating of the monitoring data;
step S2, acquiring data interactive transmission states between all sensors in the same network node with the abnormal sensor and the network node relay terminal respectively; analyzing the data interaction transmission state, and judging whether data transmission delay exists between each sensor in the network node and the network node relay terminal;
step S3, determining whether the network node belongs to an abnormal network node according to the judgment result of the data transmission delay; collecting monitoring data formed by all sensors in an abnormal network node, and analyzing the monitoring data so as to judge whether the abnormal network node has data abnormality; and then reporting the data abnormity according to the judgment result of the data abnormity.
2. The wireless sensor network abnormality detection method according to claim 1, characterized in that:
in the step S1, two monitoring data sequences respectively formed by any sensor in the wireless sensor network in different time periods are collected; analyzing the two monitoring data sequences to judge whether the sensor has abnormal floating of the monitoring data; then, according to the judgment result of the abnormal floating of the monitoring data, determining whether the sensor belongs to an abnormal sensor specifically comprises:
step S101, collecting a first monitoring data sequence formed by any sensor in a wireless sensor network in a first time period; acquiring a second monitoring data sequence formed by any one sensor in a second time period; wherein the first and second time periods have the same length of time and are not contiguous with each other;
step S102, analyzing the first monitoring data sequence and the second monitoring data sequence to determine a first variance corresponding to the first monitoring data sequence and a second variance corresponding to the second monitoring data sequence; and determining an absolute value of a difference between the first variance and the second variance;
step S103, comparing the absolute value of the difference value with a preset difference value threshold value; if the absolute value of the difference is smaller than or equal to the preset difference threshold, determining that the monitoring data of any sensor is not abnormal in floating, and simultaneously determining that any sensor belongs to a normal sensor; and if the absolute value of the difference is larger than the preset difference threshold, determining that the monitoring data of any sensor has abnormal floating, and simultaneously determining that any sensor belongs to an abnormal sensor.
3. The wireless sensor network abnormality detection method according to claim 1, characterized in that:
in step S2, acquiring data interactive transmission states between all sensors in the same network node as the abnormal sensor and the network node relay terminal respectively; analyzing the data interaction transmission state, and judging whether data transmission delay exists between each sensor in the network node and the network node relay terminal specifically comprises:
step S201, acquiring uplink data transmission rate and downlink data transmission rate between all sensors in the same network node with the abnormal sensor and a terminal in the network node in the data interaction process, and taking the uplink data transmission rate and the downlink data transmission rate as the data interaction transmission state;
step S202, determining a rate ratio between the uplink data transmission rate and the downlink data transmission rate, and comparing the rate ratio with a preset rate ratio threshold; if the rate ratio is smaller than or equal to a preset rate ratio threshold, determining that data transmission delay cannot exist between the corresponding sensor and the network node relay terminal; and if the rate ratio is greater than a preset rate ratio threshold, determining that data transmission delay exists between the corresponding sensor and the network node relay terminal.
4. The wireless sensor network abnormality detection method according to claim 1, characterized in that:
in step S3, determining whether the network node belongs to an abnormal network node according to the determination result of the data transmission delay; collecting monitoring data formed by all sensors in an abnormal network node, and analyzing the monitoring data so as to judge whether the abnormal network node has data abnormality; and then according to the judgment result of the data abnormity, reporting the data abnormity specifically comprises the following steps:
step S301, if the sensors which are more than a preset quantity proportion in all the sensors in the same network node with the abnormal sensor are judged to have data transmission delay, determining that the network node belongs to the abnormal network node; otherwise, determining that the network node belongs to a normal network node;
step S302, collecting monitoring data formed by all sensors in the abnormal network node, taking each monitoring data as a detection sample point, randomly dividing all the detection sample points into a plurality of sample clusters, determining the sample similarity value E among all the sample clusters by using the following formula (1),
Figure FDA0003367859510000031
in the above formula (1), CiRepresenting the random division of all detected sample points into the ith sample cluster of the k sample clusters; x represents a detection sample point contained in the ith sample cluster; | Ci| represents taking the absolute value of the ith sample cluster; j. the design is a squareiRepresents the average value of all detection sample points contained in the ith sample cluster; d (x, J)i) Expression finding x and JiA numerical distance function therebetween;
when the cluster distribution result of any one point changes, for each point in the sample data set, calculating the distance between the mean point and the data point, distributing the data point to each cluster of the cluster pair closest to the point, calculating the mean value of all the points in the cluster, and taking the mean value as the center of the cluster; then, the following formula (2) is used to obtain the corresponding average value of each sample cluster with the highest sample similarity value among all the sample clusters,
Figure FDA0003367859510000032
in the above formula (2), D [ k ]]Representing the phase of samples between all sample clustersEach sample cluster with the highest similarity value corresponds to a set of mean values, wherein the set comprises k mean values;
Figure FDA0003367859510000033
indicates the corresponding J when the value of the function in the parentheses is minimized1...JkA value;
finally, using the following formula (3), set D [ k ] is divided]Mean J comprising the correspondence of each mean to all the test sample pointsZComparing, marking the corresponding sample cluster according to the comparison result,
Figure FDA0003367859510000041
in the above-mentioned formula (3),
Figure FDA0003367859510000042
represents a sample cluster ClMarking value of color marking is carried out, R represents a preset red marking value, and G represents a preset green marking value;
Figure FDA0003367859510000043
represents a sample cluster ClThe included detection sample point data is normal, and the sample cluster C islMarking green;
Figure FDA0003367859510000044
represents a sample cluster ClIncluding detecting sample point data anomalies, and clustering samples ClMarked red;
step S303, carrying out SVDD algorithm detection on the sample cluster determined to be abnormal in data, reporting the SVDD algorithm detection result to a cloud platform of the wireless sensor network, and deleting the sample cluster determined to be abnormal in data.
5. The wireless sensor network anomaly detection system is characterized by comprising a sensor state determination module, a network node transmission delay determination module, a network node state determination module and a data anomaly judgment and report module; wherein the content of the first and second substances,
the sensor state determination module is used for acquiring two monitoring data sequences which are respectively formed by any sensor in the wireless sensor network in different time periods; analyzing the two monitoring data sequences to judge whether the sensor has abnormal floating of the monitoring data; determining whether the sensor belongs to an abnormal sensor or not according to the judgment result of the abnormal floating of the monitoring data;
the network node transmission delay determining module is used for acquiring data interaction transmission states between all sensors which are positioned at the same network node with the abnormal sensor and a network node relay terminal respectively; analyzing the data interaction transmission state, and judging whether data transmission delay exists between each sensor in the network node and the network node relay terminal;
the network node state determining module is used for determining whether the network node belongs to an abnormal network node according to the judgment result of the data transmission delay;
the data abnormity judging and reporting module is used for collecting monitoring data formed by all sensors in an abnormal network node and analyzing the monitoring data so as to judge whether the abnormal network node has data abnormity; and then reporting the data abnormity according to the judgment result of the data abnormity.
6. The wireless sensor network anomaly detection system according to claim 5, characterized by:
the sensor state determination module is used for acquiring two monitoring data sequences which are respectively formed by any sensor in the wireless sensor network in different time periods; analyzing the two monitoring data sequences to judge whether the sensor has abnormal floating of the monitoring data; then, according to the judgment result of the abnormal floating of the monitoring data, determining whether the sensor belongs to an abnormal sensor specifically comprises:
acquiring a first monitoring data sequence formed by any sensor in the wireless sensor network in a first time period; acquiring a second monitoring data sequence formed by any one sensor in a second time period; wherein the first and second time periods have the same length of time and are not contiguous with each other;
analyzing the first monitoring data sequence and the second monitoring data sequence to determine a first variance corresponding to the first monitoring data sequence and a second variance corresponding to the second monitoring data sequence; and determining an absolute value of a difference between the first variance and the second variance;
comparing the absolute value of the difference value with a preset difference value threshold; if the absolute value of the difference is smaller than or equal to the preset difference threshold, determining that the monitoring data of any sensor is not abnormal in floating, and simultaneously determining that any sensor belongs to a normal sensor; and if the absolute value of the difference is larger than the preset difference threshold, determining that the monitoring data of any sensor has abnormal floating, and simultaneously determining that any sensor belongs to an abnormal sensor.
7. The wireless sensor network anomaly detection system according to claim 5, characterized by:
the network node transmission delay determining module is used for acquiring data interaction transmission states between all sensors which are positioned at the same network node with the abnormal sensor and a network node relay terminal respectively; analyzing the data interaction transmission state, and judging whether data transmission delay exists between each sensor in the network node and the network node relay terminal specifically comprises:
acquiring uplink data transmission rate and downlink data transmission rate between all sensors in the same network node as the abnormal sensor and a terminal in the network node in the data interaction process respectively, and taking the uplink data transmission rate and the downlink data transmission rate as the data interaction transmission state;
determining a rate ratio between the uplink data transmission rate and the downlink data transmission rate, and comparing the rate ratio with a preset rate ratio threshold; if the rate ratio is smaller than or equal to a preset rate ratio threshold, determining that data transmission delay cannot exist between the corresponding sensor and the network node relay terminal; and if the rate ratio is greater than a preset rate ratio threshold, determining that data transmission delay exists between the corresponding sensor and the network node relay terminal.
8. The wireless sensor network anomaly detection system according to claim 5, characterized by:
the network node state determining module is configured to determine whether the network node belongs to an abnormal network node according to the determination result of the data transmission delay, and specifically includes:
if the sensors with the number ratio exceeding the preset number ratio in all the sensors in the same network node with the abnormal sensor are judged to have data transmission delay, determining that the network node belongs to the abnormal network node; otherwise, determining that the network node belongs to a normal network node;
and the number of the first and second groups,
the data abnormity judging and reporting module is used for collecting monitoring data formed by all sensors in an abnormal network node and analyzing the monitoring data so as to judge whether the abnormal network node has data abnormity; and then according to the judgment result of the data abnormity, reporting the data abnormity specifically comprises the following steps:
collecting monitoring data formed by all sensors in an abnormal network node, taking each monitoring data as a detection sample point, randomly dividing all the detection sample points into a plurality of sample clusters, determining sample similarity values E among all the sample clusters by using the following formula (1),
Figure FDA0003367859510000061
in the above formula (1), CiRepresenting the random division of all detected sample points into the ith sample cluster of the k sample clusters; x represents a detection sample contained in the ith sample clusterPoint; | Ci| represents taking the absolute value of the ith sample cluster; j. the design is a squareiRepresents the average value of all detection sample points contained in the ith sample cluster; d (x, J)i) Expression finding x and JiA numerical distance function therebetween;
when the cluster distribution result of any one point changes, for each point in the sample data set, calculating the distance between the mean point and the data point, distributing the data point to each cluster of the cluster pair closest to the point, calculating the mean value of all the points in the cluster, and taking the mean value as the center of the cluster; then, the following formula (2) is used to obtain the corresponding average value of each sample cluster with the highest sample similarity value among all the sample clusters,
Figure FDA0003367859510000071
in the above formula (2), D [ k ]]A set representing a corresponding mean value for each sample cluster that results in a highest sample similarity value among all sample clusters, the set comprising k mean values;
Figure FDA0003367859510000072
indicates the corresponding J when the value of the function in the parentheses is minimized1...JkA value;
finally, using the following formula (3), set D [ k ] is divided]Mean J comprising the correspondence of each mean to all the test sample pointsZComparing, marking the corresponding sample cluster according to the comparison result,
Figure FDA0003367859510000073
in the above-mentioned formula (3),
Figure FDA0003367859510000074
represents a sample cluster ClMarking value for color marking, R representing a preset red marking value, G representing a preset green marking valueA value;
Figure FDA0003367859510000075
represents a sample cluster ClThe included detection sample point data is normal, and the sample cluster C islMarking green;
Figure FDA0003367859510000076
represents a sample cluster ClIncluding detecting sample point data anomalies, and clustering samples ClMarked red;
and carrying out SVDD algorithm detection on the sample cluster determined to be abnormal in data, reporting the SVDD algorithm detection result to a cloud platform of the wireless sensor network, and deleting the sample cluster determined to be abnormal in data.
CN202111388255.6A 2021-11-22 2021-11-22 Wireless sensor network anomaly detection method and system Active CN114244751B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202111388255.6A CN114244751B (en) 2021-11-22 2021-11-22 Wireless sensor network anomaly detection method and system

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202111388255.6A CN114244751B (en) 2021-11-22 2021-11-22 Wireless sensor network anomaly detection method and system

Publications (2)

Publication Number Publication Date
CN114244751A true CN114244751A (en) 2022-03-25
CN114244751B CN114244751B (en) 2023-09-15

Family

ID=80750409

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202111388255.6A Active CN114244751B (en) 2021-11-22 2021-11-22 Wireless sensor network anomaly detection method and system

Country Status (1)

Country Link
CN (1) CN114244751B (en)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115361316A (en) * 2022-07-20 2022-11-18 慧之安信息技术股份有限公司 Internet of things data packet transmission delay detection method based on edge calculation
CN116009501A (en) * 2023-03-22 2023-04-25 山东瑞芝生物科技股份有限公司 Primary pulp production machine management and control system based on data analysis
CN117666493A (en) * 2023-11-16 2024-03-08 北京开元泰达净化设备有限公司 Data interaction method and system applied to industrial Internet of things

Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101516099A (en) * 2009-04-07 2009-08-26 华中科技大学 Test method for sensor network anomaly
US8779921B1 (en) * 2010-05-14 2014-07-15 Solio Security, Inc. Adaptive security network, sensor node and method for detecting anomalous events in a security network
CN105307200A (en) * 2015-09-30 2016-02-03 西安电子科技大学 Method for detecting abnormal value of multidimensional data of wireless sensor network based on trajectory
CN105518756A (en) * 2013-09-10 2016-04-20 瑞典爱立信有限公司 Method and monitoring centre for supporting supervision of events
CN106792883A (en) * 2017-01-20 2017-05-31 哈尔滨工业大学（威海） Sensor network abnormal deviation data examination method and system
CN108171953A (en) * 2018-02-09 2018-06-15 广东科源电气有限公司 The wireless sensor network measure and control device of power transformer
CN110830946A (en) * 2019-11-15 2020-02-21 江南大学 Mixed type online data anomaly detection method
US20210103794A1 (en) * 2019-10-04 2021-04-08 Palo Alto Research Center Incorporated Method and system for semi-supervised anomaly detection with feed-forward neural network for high-dimensional sensor data

Patent Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101516099A (en) * 2009-04-07 2009-08-26 华中科技大学 Test method for sensor network anomaly
US8779921B1 (en) * 2010-05-14 2014-07-15 Solio Security, Inc. Adaptive security network, sensor node and method for detecting anomalous events in a security network
CN105518756A (en) * 2013-09-10 2016-04-20 瑞典爱立信有限公司 Method and monitoring centre for supporting supervision of events
CN105307200A (en) * 2015-09-30 2016-02-03 西安电子科技大学 Method for detecting abnormal value of multidimensional data of wireless sensor network based on trajectory
CN106792883A (en) * 2017-01-20 2017-05-31 哈尔滨工业大学（威海） Sensor network abnormal deviation data examination method and system
CN108171953A (en) * 2018-02-09 2018-06-15 广东科源电气有限公司 The wireless sensor network measure and control device of power transformer
US20210103794A1 (en) * 2019-10-04 2021-04-08 Palo Alto Research Center Incorporated Method and system for semi-supervised anomaly detection with feed-forward neural network for high-dimensional sensor data
CN110830946A (en) * 2019-11-15 2020-02-21 江南大学 Mixed type online data anomaly detection method

Cited By (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115361316A (en) * 2022-07-20 2022-11-18 慧之安信息技术股份有限公司 Internet of things data packet transmission delay detection method based on edge calculation
CN115361316B (en) * 2022-07-20 2023-11-10 慧之安信息技术股份有限公司 Internet of things data packet transmission delay detection method based on edge calculation
CN116009501A (en) * 2023-03-22 2023-04-25 山东瑞芝生物科技股份有限公司 Primary pulp production machine management and control system based on data analysis
CN116009501B (en) * 2023-03-22 2023-06-16 山东瑞芝生物科技股份有限公司 Primary pulp production machine management and control system based on data analysis
CN117666493A (en) * 2023-11-16 2024-03-08 北京开元泰达净化设备有限公司 Data interaction method and system applied to industrial Internet of things
CN117666493B (en) * 2023-11-16 2024-06-14 北京开元泰达净化设备有限公司 Data interaction method and system applied to industrial Internet of things

Also Published As

Publication number Publication date
CN114244751B (en) 2023-09-15

Similar Documents

Publication Publication Date Title
CN114244751A (en) Wireless sensor network anomaly detection method and system
CN109816031B (en) Transformer state evaluation clustering analysis method based on data imbalance measurement
CN111144435B (en) Electric energy abnormal data monitoring method based on LOF and verification filtering framework
CN115982602B (en) Photovoltaic transformer electrical fault detection method
CN112284440B (en) Sensor data deviation self-adaptive correction method
CN108599977B (en) System and method for monitoring system availability based on statistical method
CN115118581B (en) Internet of things data all-link monitoring and intelligent guaranteeing system based on 5G
CN111738348B (en) Power data anomaly detection method and device
CN116523508B (en) Intelligent operation and maintenance management system based on AIoT asset
CN113438110B (en) Cluster performance evaluation method, device, equipment and storage medium
CN116881718A (en) Artificial intelligence training method and system based on big data cleaning
CN113266921A (en) Air conditioning equipment fault detection method, device, equipment and medium
US20230213911A1 (en) Method and device for testing product, computer device and readable storage medium
CN111614504A (en) Power grid regulation and control data center service characteristic fault positioning method and system based on time sequence and fault tree analysis
CN116011850A (en) Lithium iron phosphate intelligent overall process quality supervision platform
CN114597886A (en) Power distribution network operation state evaluation method based on interval type two fuzzy clustering analysis
CN114975184A (en) Semiconductor yield monitoring method and device, electronic equipment and storage medium
CN112799911A (en) Node health state detection method, device, equipment and storage medium
CN111881502A (en) Bridge state discrimination method based on fuzzy clustering analysis
CN116956638B (en) Equipment life data joint fitting inspection analysis method
CN117873007B (en) Manufacturing flow management method, system, equipment and medium based on industrial Internet of things
CN112445632A (en) HPC reliability evaluation method based on fault data modeling
CN117650995B (en) Data transmission anomaly identification method based on outlier detection
CN117439899B (en) Communication machine room inspection method and system based on big data
CN116106679A (en) High-voltage cable on-line monitoring system

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant