CN116346824A - NB-IoT abnormal data testing method and system based on edge calculation - Google Patents

NB-IoT abnormal data testing method and system based on edge calculation Download PDF

Info

Publication number
CN116346824A
CN116346824A CN202310365622.3A CN202310365622A CN116346824A CN 116346824 A CN116346824 A CN 116346824A CN 202310365622 A CN202310365622 A CN 202310365622A CN 116346824 A CN116346824 A CN 116346824A
Authority
CN
China
Prior art keywords
iot
test
layer
edge
test data
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN202310365622.3A
Other languages
Chinese (zh)
Inventor
杨宏
张弛
汪晶晶
王晓春
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
China Electronics Standardization Institute
Original Assignee
China Electronics Standardization Institute
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by China Electronics Standardization Institute filed Critical China Electronics Standardization Institute
Priority to CN202310365622.3A priority Critical patent/CN116346824A/en
Publication of CN116346824A publication Critical patent/CN116346824A/en
Pending legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1425—Traffic logging, e.g. anomaly detection
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/46—Multiprogramming arrangements
    • G06F9/50—Allocation of resources, e.g. of the central processing unit [CPU]
    • G06F9/5061—Partitioning or combining of resources
    • G06F9/5072—Grid computing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
    • Y02D—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE
    • Y02D30/00—Reducing energy consumption in communication networks
    • Y02D30/70—Reducing energy consumption in communication networks in wireless communication networks

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • General Engineering & Computer Science (AREA)
  • Signal Processing (AREA)
  • Computing Systems (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Computer Hardware Design (AREA)
  • Physics & Mathematics (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Mathematical Physics (AREA)
  • General Physics & Mathematics (AREA)
  • Maintenance And Management Of Digital Transmission (AREA)

Abstract

The invention discloses an NB-IoT abnormal data testing method and system based on edge calculation, and belongs to the technical field of 5G communication. According to the method, the data processing is carried out through the edge server, so that the testing speed of network abnormal data of the narrow-band Internet of things is improved, and the use safety of the terminal equipment is improved. The test terminal responds to authentication requests under various conditions; meanwhile, the testing mode of the multiple terminals can test the specific conditions of the multiple terminals in a short time, so that the purposes of saving time and accelerating testing speed are achieved.

Description

NB-IoT abnormal data testing method and system based on edge calculation
Technical Field
The invention belongs to the technical field of 5G communication, and particularly relates to an NB-IoT abnormal data testing method and system based on edge calculation.
Background
With the recent development of economy and science and the popularization of information technology, the internet has played an increasingly important role in various fields of the whole society, and has just become a strategic key for national development. Current society has higher demands on the development of the internet, such as mass connection, low cost, low energy consumption, high stability, etc., which the prior art cannot meet. Narrowband internet of things (NB-IoT technology) is considered one of the technologies that can meet the above needs and solve these challenging challenges. Through the NB-IoT technology, the terminal device can transmit data by utilizing a narrowband internet of things base station under a narrowband network, and the terminal device can enhance network coverage and increase device connection quantity by utilizing various technologies such as narrow bandwidth, spectrum improvement and the like. At present, research work in the application field mainly belongs to the fields of intelligent parking, intelligent meter reading and the like. However, since NB-IoT technology has its own drawbacks due to its simple structure, such as an external attacker may attack a terminal device operating on the NB-IoT network using abnormal data, thereby achieving data destruction and theft, etc., it is a challenging matter how to secure the NB-IoT network and the device terminal. Therefore, in a specific case, it is necessary to detect abnormality in the network traffic data.
However, current technology also presents a number of challenges and limitations in facing increasingly complex network environments. The network abnormal data test is used as an active safety technology, and can analyze the network data of the terminal equipment, identify normal and abnormal network behaviors, and effectively screen out equipment with problems in the network. The traditional anomaly detection method adopts a central computing mode, and a large amount of network data is processed by a central server. Although the central detection method can test the abnormal data of the network in a time, as the data volume and the data complexity of the network rise, the processing difficulty and the processing time of the abnormal detection can be greatly increased, and the central calculation mode is difficult to cope with. Meanwhile, the current detection system can only detect one type of NB-IoT device, and if a large number of NB-IoT devices in different categories exist currently, repeated tests are needed, so that the workload is increased.
Disclosure of Invention
In order to adapt to the current network conditions and efficiently and accurately detect network traffic anomalies, the invention provides an NB-IoT anomaly data testing scheme based on edge calculation.
Edge computing refers to splitting tasks that would otherwise be performed by a central server, and then shunting to each edge server for execution. These edge servers are deployed near the terminal or user equipment side and can directly provide computing resources to the terminal. The edge computing technology not only can improve the processing efficiency of tasks and lighten the computing pressure of a central server positioned in a core network, but also can improve the resource utilization rate and the safety. Therefore, in the narrowband internet of things network, the testing speed and the safety of the testing system can be improved through an edge computing technology.
The invention discloses an NB-IoT abnormal data testing method based on edge calculation. The NB-IoT is a narrowband internet of things and comprises a central decision layer, a cloud center layer, an edge layer and a device layer; wherein: deploying a PC server side in the central decision layer, deploying a core network in the cloud central layer, deploying a test data server and L edge servers in an upper layer of the edge layer, deploying M NB-IoT platforms in a lower layer of the edge layer, and deploying N NB-IoT devices in the device layer, wherein L is less than or equal to M is less than or equal to N; the central decision layer is communicated with the cloud center layer, the cloud center layer is communicated with the edge layer, and the upper layer and the lower layer of the edge layer by high-speed Ethernet, and the edge layer is communicated with the equipment layer, and the test data server is communicated with the equipment layer by radio frequency induction.
The method comprises the following steps:
step S1, the PC server side issues a test request, the test request is received by the test data server through the core network, and the test request comprises unique identification codes Di of P NB-IoT devices to be tested, i is {1, 2.., P };
S2, classifying the P NB-IoT devices to be tested based on test data types by the test data server according to the unique identification code Di to obtain C categories, generating C test data corresponding to the C categories, and forwarding the C test data to the corresponding NB-IoT devices to be tested in a radio frequency induction mode, wherein C is less than or equal to P;
step S3, after the P to-be-tested NB-IoT devices receive the respective test data, analyzing the test data, generating interactive communication flow through interaction with the test data server, adding the unique identification code Di into the interactive communication flow, packaging the interactive communication flow, and sending the test response message to an NB-IoT platform corresponding to the NB-IoT device in a radio frequency induction mode as a test response message;
step S4, the NB-IoT platform collects the test response message from the NB-IoT device associated with the test response message and forwards the test response message to an edge server with an association relationship, and the edge server locally preprocesses the test response message to obtain test result traffic ti in a standard format corresponding to the test data type;
And S5, the edge server sends the test result flow ti and the unique identification code Di which are packaged to the core network as test result messages { ti, di } in a standard format, the core network analyzes flow characteristic information Ki from the test result flow ti, and sends a characteristic sequence { Ki, di } to the PC server side so as to determine abnormal current data and corresponding NB-IoT equipment.
According to the method of the first aspect of the present invention, in the step S1, the PC server determines the P NB-IoT devices to be tested according to the test requirements, and obtains unique identification codes Di of the P NB-IoT devices to be tested.
According to the method of the first aspect of the invention, different test data types correspond to different test data, the analysis modes of different NB-IoT devices on the test data of the same category are different, and the generated interactive communication traffic is also different; the PC server side located in the central decision layer, the test data server located in the upper layer of the edge layer and the L edge servers all maintain the corresponding relation between the unique identification code Di of each NB-IoT device and the test data type locally.
According to the method of the first aspect of the present invention, in the step S2, the test data server determines, by searching, a test data type corresponding to the unique identification code Di based on the correspondence maintained locally, obtains the C categories by classification, forwards C test data corresponding to the C categories to a corresponding NB-IoT device to be tested, the test data originating from a kdcup 99 dataset or a standard NB-IoT dataset.
According to the method of the first aspect of the invention, each edge server corresponds to a plurality of NB-IoT platforms, each NB-IoT platform corresponds to a plurality of NB-IoT devices; in the step S4, after receiving the test response message, the edge server searches for and determines a test data type corresponding to the unique identification code Di based on the correspondence maintained locally, obtains a standard format corresponding to the determined test data type, and pre-processes the interactive communication traffic in the test response message according to the self-calculation force of the edge server, so as to edit the interactive communication traffic into a test result traffic ti in the standard format, where the pre-processing at least includes: dimensionality reduction processing, noise reduction processing, data clipping, data cleaning and normalization processing.
According to the method of the first aspect of the invention, in said step S5: the core network analyzes the test result flow ti, and calculates the information entropy, the relative entropy and the information gain of the test result flow ti to determine the flow characteristic information Ki of the test result flow ti; the PC server side extracts the flow characteristic information Ki and the unique identification code Di from the characteristic sequence { Ki, di }, determines a test data type corresponding to the unique identification code Di locally by searching, and acquires a characteristic information threshold interval [ Kmin, kmax ] corresponding to the determined test data type; if the flow characteristic information Ki is E [ Kmin, kmax ], the interactive communication flow generated by the NB-IoT device is a normal flow; otherwise, recording a unique identification code Di of the NB-IoT device corresponding to the abnormal traffic, listing the NB-IoT device corresponding to the abnormal traffic as an abnormal NB-IoT device, and sending an alarm to an edge server and an NB-IoT platform associated with the abnormal NB-IoT device.
According to the method of the first aspect of the present invention, the radio frequency induction means that the data to be transmitted is encoded on the radio frequency by using the radio frequency induction panel and then transmitted to the receiving party.
The second aspect of the invention discloses an NB-IoT anomalous data testing system based on edge computation. The system comprises a central decision layer, a cloud central layer, an edge layer and an equipment layer; wherein: deploying a PC server side in the central decision layer, deploying a core network in the cloud central layer, deploying a test data server and L edge servers in an upper layer of the edge layer, deploying M NB-IoT platforms in a lower layer of the edge layer, and deploying N NB-IoT devices in the device layer, wherein L is less than or equal to M is less than or equal to N; the central decision layer is communicated with the cloud center layer, the cloud center layer is communicated with the edge layer, and the upper layer and the lower layer of the edge layer by high-speed Ethernet, and the edge layer is communicated with the equipment layer, and the test data server is communicated with the equipment layer by radio frequency induction.
The system is in a working state:
the PC server side issues a test request, the test request is received by the test data server through the core network, and the test request comprises unique identification codes Di, i epsilon {1,2, & gt, P } of P NB-IoT devices to be tested;
The test data server classifies the P NB-IoT devices to be tested based on test data types according to the unique identification code Di to obtain C categories, generates C test data corresponding to the C categories, and forwards the C test data to the corresponding NB-IoT devices to be tested in a radio frequency induction mode, wherein C is less than or equal to P;
after the P to-be-tested NB-IoT devices receive the respective test data, analyzing the test data, generating interactive communication flow through interaction with the test data server, attaching the unique identification code Di to the interactive communication flow, packaging the interactive communication flow to be used as a test response message, and sending the test response message to an NB-IoT platform corresponding to the NB-IoT device in the radio frequency induction mode;
the NB-IoT platform collects the test response message from the NB-IoT device associated with the NB-IoT platform and forwards the test response message to an edge server with an association relationship, and the edge server locally pre-processes the test response message to obtain test result traffic ti in a standard format corresponding to the test data type;
The edge server sends the test result flow ti and the unique identification code Di to the core network as test result messages { ti, di } in a standard format after being packaged, the core network analyzes flow characteristic information Ki from the test result flow ti, and sends a characteristic sequence { Ki, di } to the PC server side so as to determine abnormal current wave data and corresponding NB-IoT equipment.
According to the system of the second aspect of the present invention, the PC server determines the P NB-IoT devices to be tested according to the test requirements, and obtains the unique identification codes Di of the P NB-IoT devices to be tested.
According to the system of the second aspect of the present invention, different test data types correspond to different test data, the manners in which different NB-IoT devices parse the test data of the same class are different, and the generated interactive communication traffic is also different; the PC server side located in the central decision layer, the test data server located in the upper layer of the edge layer and the L edge servers all maintain the corresponding relation between the unique identification code Di of each NB-IoT device and the test data type locally.
According to the system of the second aspect of the present invention, the test data server determines the test data type corresponding to the unique identification code Di by searching based on the correspondence maintained locally, obtains the C categories by classification, forwards C test data corresponding to the C categories to the corresponding NB-IoT device to be tested, and the test data is derived from a kdcup 99 dataset or a standard NB-IoT dataset.
According to the system of the second aspect of the invention, each edge server corresponds to a plurality of NB-IoT platforms, each NB-IoT platform corresponds to a plurality of NB-IoT devices; in the step S4, after receiving the test response message, the edge server searches for and determines a test data type corresponding to the unique identification code Di based on the correspondence maintained locally, obtains a standard format corresponding to the determined test data type, and pre-processes the interactive communication traffic in the test response message according to the self-calculation force of the edge server, so as to edit the interactive communication traffic into a test result traffic ti in the standard format, where the pre-processing at least includes: dimensionality reduction processing, noise reduction processing, data clipping, data cleaning and normalization processing.
According to the system of the second aspect of the invention, the core network analyzes the test result flow ti, and calculates the information entropy, the relative entropy and the information gain of the test result flow ti to determine the flow characteristic information Ki thereof; the PC server side extracts the flow characteristic information Ki and the unique identification code Di from the characteristic sequence { Ki, di }, determines a test data type corresponding to the unique identification code Di locally by searching, and acquires a characteristic information threshold interval [ Kmin, kmax ] corresponding to the determined test data type; if the flow characteristic information Ki is E [ Kmin, kmax ], the interactive communication flow generated by the NB-IoT device is a normal flow; otherwise, recording a unique identification code Di of the NB-IoT device corresponding to the abnormal traffic, listing the NB-IoT device corresponding to the abnormal traffic as an abnormal NB-IoT device, and sending an alarm to an edge server and an NB-IoT platform associated with the abnormal NB-IoT device.
According to the system of the second aspect of the invention, the radio frequency induction mode means that the data to be transmitted is encoded on the radio frequency by using the radio frequency induction panel and then transmitted to the receiver.
A third aspect of the invention discloses an electronic device. The electronic device comprises a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to realize the steps in the NB-IoT abnormal data testing method based on edge calculation according to the first aspect of the invention.
A fourth aspect of the invention discloses a computer-readable storage medium. The computer readable storage medium stores a computer program which, when executed by a processor, implements the steps in an NB-IoT anomaly data testing method based on edge computation according to the first aspect of the present invention.
In summary, in the technical scheme of the invention, the narrowband internet of things technology and the edge computing technology are combined, and the data processing is performed through the edge server to improve the testing speed of network abnormal data of the narrowband internet of things and the use safety of the terminal equipment.
Drawings
In order to more clearly illustrate the embodiments of the invention or the technical solutions in the prior art, the drawings which are required in the description of the embodiments or the prior art will be briefly described, it being obvious that the drawings in the description below are some embodiments of the invention and that other drawings may be obtained from these drawings without inventive effort for a person skilled in the art.
Fig. 1 is a network composition diagram of NB-IoT in accordance with an embodiment of the present invention;
FIG. 2 is a composition diagram of an NB-IoT anomaly data test system in accordance with an embodiment of the present invention;
fig. 3 is a block diagram of an electronic device according to an embodiment of the present invention.
Detailed Description
For the purpose of making the objects, technical solutions and advantages of the embodiments of the present invention more apparent, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention, and it is apparent that the described embodiments are only some embodiments of the present invention, not all embodiments of the present invention. All other embodiments, which can be made by those skilled in the art based on the embodiments of the invention without making any inventive effort, are intended to be within the scope of the invention.
In consideration of limited processing capacity of NB-IoT terminal equipment, the method combines the narrowband internet of things technology with the edge computing technology, and improves the testing speed of network anomaly data of the narrowband internet of things and improves the use safety of the terminal equipment by performing data processing through the edge server. Meanwhile, the invention can test the required NB-IoT terminal equipment according to the unique identification code of the equipment in the same time. In the case of multiple NB-IoT terminal devices in the system, the responses of the different types of NB-IoT terminal devices to the test data are also different, and the basis for determining whether the test data is abnormal data is also different. By utilizing the edge server, different judging bases can be established, so that the test system can judge whether the test data is abnormal data for the multi-NB-IoT terminal device at the same time. Meanwhile, under specific conditions, whether the NB-IoT terminal device is tampered by a person or not can be judged according to the response to the test data.
In view of the shortcomings of the prior art, the invention provides an NB-IoT anomaly data testing scheme based on edge calculation for researching detection of anomaly data from outside of an NB-IoT network in order to solve the defects and shortcomings of the prior art. In general, the detected network data has a relatively large data size and a relatively high complexity, and when a large number of terminal devices exist in the network and need communication test, the conventional central data processing mode cannot meet the requirement of rapid detection. Therefore, the characteristic that the edge computing technology is close to a data source is utilized, the data transmission time delay can be effectively reduced, the computing pressure of a central network is lightened, and meanwhile, the detection efficiency can be improved. The same type of judgment can be carried out on different terminal devices in the system by utilizing the edge computing technology to preprocess the data. The transmission quality of the narrowband internet of things is met, and meanwhile the safety of the narrowband internet of things is improved, so that the problems that the narrowband internet of things is attacked and sensitive data are stolen are solved to a certain extent.
The invention discloses an NB-IoT abnormal data testing method based on edge calculation. As shown in fig. 1, the NB-IoT is a narrowband internet of things, and includes a central decision layer, a cloud center layer, an edge layer, and a device layer; wherein: deploying a PC server side in the central decision layer, deploying a core network in the cloud central layer, deploying a test data server and L edge servers in an upper layer of the edge layer, deploying M NB-IoT platforms in a lower layer of the edge layer, and deploying N NB-IoT devices in the device layer, wherein L is less than or equal to M is less than or equal to N; the central decision layer is communicated with the cloud center layer, the cloud center layer is communicated with the edge layer, and the upper layer and the lower layer of the edge layer by high-speed Ethernet, and the edge layer is communicated with the equipment layer, and the test data server is communicated with the equipment layer by radio frequency induction.
The method comprises the following steps:
step S1, the PC server side issues a test request, the test request is received by the test data server through the core network, and the test request comprises unique identification codes Di of P NB-IoT devices to be tested, i is {1, 2.., P };
s2, classifying the P NB-IoT devices to be tested based on test data types by the test data server according to the unique identification code Di to obtain C categories, generating C test data corresponding to the C categories, and forwarding the C test data to the corresponding NB-IoT devices to be tested in a radio frequency induction mode, wherein C is less than or equal to P;
step S3, after the P to-be-tested NB-IoT devices receive the respective test data, analyzing the test data, generating interactive communication flow through interaction with the test data server, adding the unique identification code Di into the interactive communication flow, packaging the interactive communication flow, and sending the test response message to an NB-IoT platform corresponding to the NB-IoT device in a radio frequency induction mode as a test response message;
step S4, the NB-IoT platform collects the test response message from the NB-IoT device associated with the test response message and forwards the test response message to an edge server with an association relationship, and the edge server locally preprocesses the test response message to obtain test result traffic ti in a standard format corresponding to the test data type;
And S5, the edge server sends the test result flow ti and the unique identification code Di which are packaged to the core network as test result messages { ti, di } in a standard format, the core network analyzes flow characteristic information Ki from the test result flow ti, and sends a characteristic sequence { Ki, di } to the PC server side so as to determine abnormal current data and corresponding NB-IoT equipment.
In some embodiments, in the step S1, the PC server determines the P NB-IoT devices to be tested according to a test requirement, and obtains unique identifiers Di of the P NB-IoT devices to be tested.
In some embodiments, different test data types correspond to different test data, the manners in which different NB-IoT devices parse the test data of the same category are different, and the generated interactive communication traffic is also different; the PC server side located in the central decision layer, the test data server located in the upper layer of the edge layer and the L edge servers all maintain the corresponding relation between the unique identification code Di of each NB-IoT device and the test data type locally.
In some embodiments, in the step S2, the test data server determines, by looking up, a test data type corresponding to the unique identification code Di based on the correspondence maintained locally, obtains the C categories by classification, forwards C test data corresponding to the C categories to a corresponding NB-IoT device to be tested, the test data originating from a kdcup 99 dataset or a standard NB-IoT dataset.
In some embodiments, each edge server corresponds to a number of NB-IoT platforms, each NB-IoT platform corresponding to a number of NB-IoT devices; in the step S4, after receiving the test response message, the edge server searches for and determines a test data type corresponding to the unique identification code Di based on the correspondence maintained locally, obtains a standard format corresponding to the determined test data type, and pre-processes the interactive communication traffic in the test response message according to the self-calculation force of the edge server, so as to edit the interactive communication traffic into a test result traffic ti in the standard format, where the pre-processing at least includes: dimensionality reduction processing, noise reduction processing, data clipping, data cleaning and normalization processing.
In some embodiments, in said step S5: the core network analyzes the test result flow ti, and calculates the information entropy, the relative entropy and the information gain of the test result flow ti to determine the flow characteristic information Ki of the test result flow ti; the PC server side extracts the flow characteristic information Ki and the unique identification code Di from the characteristic sequence { Ki, di }, determines a test data type corresponding to the unique identification code Di locally by searching, and acquires a characteristic information threshold interval [ Kmin, kmax ] corresponding to the determined test data type; if the flow characteristic information Ki is E [ Kmin, kmax ], the interactive communication flow generated by the NB-IoT device is a normal flow; otherwise, recording a unique identification code Di of the NB-IoT device corresponding to the abnormal traffic, listing the NB-IoT device corresponding to the abnormal traffic as an abnormal NB-IoT device, and sending an alarm to an edge server and an NB-IoT platform associated with the abnormal NB-IoT device.
In some embodiments, the radio frequency induction means that the data to be transmitted is encoded on the radio frequency by using the radio frequency induction panel and then transmitted to the receiving party.
Specifically, the NB-IoT (narrowband internet of things) is divided into four layers, namely a central decision layer, a cloud center layer, an edge layer and a device layer, wherein:
(1) The central decision layer is the main body of the test system and sends out test instructions when test demands exist. The layer stores the characteristic values of the normal data and the data after the interactive communication of the NB-IoT device, and finally plays a role in judging the abnormal data through the characteristic values. Typically, the central decision-making layer may be a PC, and in some cases a smartphone.
(2) The cloud-centric layer possesses powerful computing power, but is remote from the data source terminal (i.e., NB-IoT devices), which is typically used to forward, analyze and store data.
(3) There are many edge servers and NB-IoT platforms in the edge layer, including the necessary facilities for network communications, such as gateways and base stations, etc., which are typically in the vicinity of the data source terminals and have some computing power and data storage capability at which the data can be simply analyzed and processed; the NB-IoT platform is capable of communicating with the NB-IoT device, collecting and forwarding necessary data; the test data server is one of edge servers for analyzing data from the core network and generating specific test data traffic;
(4) The device layer contains a large number of NB-IoT devices, and has very limited computing power, so that communication interaction occurs between the terminal to be tested and the test data server. Different layers in the system framework are sequentially in communication connection, wherein a central decision layer, a cloud center layer and an edge layer are communicated through a high-speed Ethernet port, and the edge layer and a device layer are communicated through radio frequency induction between an NB-IoT platform and NB-IoT devices.
Specifically, the specific operation flow of the abnormal data testing method of the NB-IoT network is as follows:
the PC sends out a test instruction and sends the test instruction to the test data server: and the PC positioned in the central decision layer sends out a test request instruction according to the requirement, and the test request instruction is transmitted to the test data server through the forwarding of the core network. Wherein the test request instruction carries a unique identification code Di of the NB-IoT device to be tested.
Generating test data traffic, forwarding to NB-IoT devices: after receiving the test request instruction from the PC, the test server at the edge layer generates a corresponding number of test data flows according to the number of the unique identification codes Di, and forwards the test data flows to the NB-IoT devices corresponding to the unique identification codes Di in a radio frequency induction mode to communicate with the corresponding NB-IoT devices.
Generating a test communication message and forwarding the test communication message to the NB-IoT platform in a radio frequency induction mode: after each NB-IoT device located in the device layer receives the test data traffic from the test server, a corresponding interactive communication traffic is obtained through calculation, and meanwhile, a unique identification code Di of the NB-IoT device is reserved in the interactive communication traffic to form a final test communication message. The test communication message is then forwarded to the NB-IoT platform by means of radio frequency induction. The NB-IoT device can be resolved by the unique identification code Di.
The NB-IoT platform collects test communication messages from the devices and sends the messages to the corresponding edge servers: the NB-IoT platform at the edge layer collects test communication messages of different NB-IoT devices and sends the messages to the corresponding edge server.
The edge server preprocesses the test communication message and forwards the test communication message to a core network: and the small-sized edge server positioned at the edge layer performs test communication message preprocessing. In the field of network abnormal data testing, preprocessing of data has an important influence on the performance of abnormal detection. When the NB-IoT devices in the tested system are of different types, the results obtained by interactive communication with the test traffic are different, so that the data preprocessing at this time can well improve the performance of the detector and can also improve the processing data. And each edge server performs data preprocessing, such as data dimension reduction and the like, on the test communication message according to the self computing capacity. At this time, a corresponding test result flow ti is obtained, and the obtained test result flow ti is forwarded to the core network. The corresponding unique identification code Di in the test communication message is forwarded together while the test result traffic ti is forwarded. Such as the forwarding sequence ti, di.
The core network analyzes the characteristic information and forwards the result to the PC: the core network analyzes the characteristic information of the received sequence { ti, di } according to the test result flow ti. The extraction of the characteristic information is not unique, and in some test cases, the entropy value, the relative entropy value, the information gain and the like of the calculated data can be selected to extract the characteristic information. The corresponding characteristic information may be denoted by Ki. At the same time, the central network forwards the analysis result to the PC. The result contains the Ki value and unique identification code information Di of the device.
And finally judging by the PC: and after the PC receives the result of the central network, judging whether the result is within a threshold value. And the PC stores the characteristic information of the corresponding communication messages obtained by the normal data flow. The characteristic information obtained by analyzing the same NB-IoT device after the normal data traffic passes through the same NB-IoT device constitutes a threshold interval, such as [ Kmin, kmax ], that is, if the characteristic value is within the interval, the normal data traffic is obtained. The PC then judges whether Ki is in a { Kmin, kmax } interval, if not, the corresponding test data flow is judged to be abnormal data; the system gives out that the corresponding NB-IoT device receives the abnormal data by judging the characteristic information and the unique identification code, and the system gives out an alarm.
The second aspect of the invention discloses an NB-IoT anomalous data testing system based on edge computation. The system comprises a central decision layer, a cloud central layer, an edge layer and an equipment layer; wherein: deploying a PC server side in the central decision layer, deploying a core network in the cloud central layer, deploying a test data server and L edge servers in an upper layer of the edge layer, deploying M NB-IoT platforms in a lower layer of the edge layer, and deploying N NB-IoT devices in the device layer, wherein L is less than or equal to M is less than or equal to N; the central decision layer is communicated with the cloud center layer, the cloud center layer is communicated with the edge layer, and the upper layer and the lower layer of the edge layer by high-speed Ethernet, and the edge layer is communicated with the equipment layer, and the test data server is communicated with the equipment layer by radio frequency induction.
The system is in a working state:
the PC server side issues a test request, the test request is received by the test data server through the core network, and the test request comprises unique identification codes Di, i epsilon {1,2, & gt, P } of P NB-IoT devices to be tested;
The test data server classifies the P NB-IoT devices to be tested based on test data types according to the unique identification code Di to obtain C categories, generates C test data corresponding to the C categories, and forwards the C test data to the corresponding NB-IoT devices to be tested in a radio frequency induction mode, wherein C is less than or equal to P;
after the P to-be-tested NB-IoT devices receive the respective test data, analyzing the test data, generating interactive communication flow through interaction with the test data server, attaching the unique identification code Di to the interactive communication flow, packaging the interactive communication flow to be used as a test response message, and sending the test response message to an NB-IoT platform corresponding to the NB-IoT device in the radio frequency induction mode;
the NB-IoT platform collects the test response message from the NB-IoT device associated with the NB-IoT platform and forwards the test response message to an edge server with an association relationship, and the edge server locally pre-processes the test response message to obtain test result traffic ti in a standard format corresponding to the test data type;
The edge server sends the test result flow ti and the unique identification code Di to the core network as test result messages { ti, di } in a standard format after being packaged, the core network analyzes flow characteristic information Ki from the test result flow ti, and sends a characteristic sequence { Ki, di } to the PC server side so as to determine abnormal current wave data and corresponding NB-IoT equipment.
In some embodiments, the PC server determines the P NB-IoT devices to be tested according to the test requirements, and obtains unique identifiers Di of the P NB-IoT devices to be tested.
In some embodiments, different test data types correspond to different test data, the manners in which different NB-IoT devices parse the test data of the same category are different, and the generated interactive communication traffic is also different; the PC server side located in the central decision layer, the test data server located in the upper layer of the edge layer and the L edge servers all maintain the corresponding relation between the unique identification code Di of each NB-IoT device and the test data type locally.
In some embodiments, the test data server determines, by looking up, a test data type corresponding to the unique identification code Di based on the correspondence maintained locally, obtains the C categories by classification, forwards C test data corresponding to the C categories to corresponding NB-IoT devices to be tested, the test data originating from a kdcup 99 dataset or a standard NB-IoT dataset.
In some embodiments, each edge server corresponds to a number of NB-IoT platforms, each NB-IoT platform corresponding to a number of NB-IoT devices; in the step S4, after receiving the test response message, the edge server searches for and determines a test data type corresponding to the unique identification code Di based on the correspondence maintained locally, obtains a standard format corresponding to the determined test data type, and pre-processes the interactive communication traffic in the test response message according to the self-calculation force of the edge server, so as to edit the interactive communication traffic into a test result traffic ti in the standard format, where the pre-processing at least includes: dimensionality reduction processing, noise reduction processing, data clipping, data cleaning and normalization processing.
In some embodiments, the core network analyzes the test result traffic ti, and calculates the information entropy, the relative entropy and the information gain of the test result traffic ti to determine the traffic characteristic information Ki thereof; the PC server side extracts the flow characteristic information Ki and the unique identification code Di from the characteristic sequence { Ki, di }, determines a test data type corresponding to the unique identification code Di locally by searching, and acquires a characteristic information threshold interval [ Kmin, kmax ] corresponding to the determined test data type; if the flow characteristic information Ki is E [ Kmin, kmax ], the interactive communication flow generated by the NB-IoT device is a normal flow; otherwise, recording a unique identification code Di of the NB-IoT device corresponding to the abnormal traffic, listing the NB-IoT device corresponding to the abnormal traffic as an abnormal NB-IoT device, and sending an alarm to an edge server and an NB-IoT platform associated with the abnormal NB-IoT device.
In some embodiments, the radio frequency induction means that the data to be transmitted is encoded on the radio frequency by using the radio frequency induction panel and then transmitted to the receiving party.
Specifically, in other embodiments, the NB-IoT network anomaly data testing system has the following modules specifically applied to the edge layer and the central decision layer (as shown in fig. 2):
(1) The test request generation module 301. The module is positioned in the central decision layer and can send out a test request instruction to the test system according to the test requirement. The test request instruction includes a unique identification number corresponding to the NB-IoT device. For a network system of multiple NB-IoT devices, the network system can be tested on demand without any impact on the NB-IoT devices that do not need to be tested.
(2) The test traffic generation module 302. The module is located in the edge layer of the test data server, which is also essentially a small network server, containing the necessary facilities for communication, such as base stations and gateways, and also containing radio frequency sensing circuitry, capable of communicating with NB-IoT devices. After receiving the test request instruction from the PC, the module generates corresponding test data flow according to the test data set through analyzing the instruction. The choice of test set is not unique and the kdcup 99 dataset and or the N-BaIoT dataset may be chosen in some test cases as desired.
(3) And a forwarding module 303. The forwarding module is used for forwarding test request instructions, test data traffic, interactive communication messages and characteristic value sequences, and exists in all network levels, wherein the forwarding module can comprise a high-speed Ethernet port and a radio frequency sensing circuit.
(4) Message processing module 304. The module is located at the edge layer and the cloud center layer. And analyzing and processing the test communication message. When receiving the test communication message, the edge server pre-processes the test communication message and then analyzes the characteristic information by the core network. The preprocessing of the data reduces the calculation load of the core network, improves the detection performance of the whole system and greatly increases the utilization efficiency of resources in the system. The extraction of the characteristic information is not unique, and in some test cases, the entropy value, the relative entropy value, the information gain and the like of the calculated data can be selected to extract the characteristic information.
(5) And a judgment module 305. The module is located in a central decision layer. Typically a set of judgment procedures in a PC. May be written in the c# -language. The module also stores the characteristic information of the normal data, and the information can be updated according to the difference of NB-IoT devices and test data sets.
A third aspect of the invention discloses an electronic device. The electronic device comprises a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to realize the steps in the NB-IoT abnormal data testing method based on edge calculation according to the first aspect of the invention.
FIG. 3 is a block diagram of an electronic device according to an embodiment of the invention; as shown in fig. 3, the electronic device includes a processor, a memory, a communication interface, a display screen, and an input device connected by a system bus. Wherein the processor of the electronic device is configured to provide computing and control capabilities. The memory of the electronic device includes a nonvolatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The communication interface of the electronic device is used for conducting wired or wireless communication with an external terminal, and the wireless communication can be achieved through WIFI, an operator network, near Field Communication (NFC) or other technologies. The display screen of the electronic equipment can be a liquid crystal display screen or an electronic ink display screen, and the input device of the electronic equipment can be a touch layer covered on the display screen, can also be keys, a track ball or a touch pad arranged on the shell of the electronic equipment, and can also be an external keyboard, a touch pad or a mouse and the like.
Those skilled in the art will appreciate that the structure shown in fig. 3 is merely a structural diagram of a portion related to the technical solution of the present disclosure, and does not constitute a limitation of the electronic device to which the present application is applied, and that a specific electronic device may include more or less components than those shown in the drawings, or may combine some components, or have different component arrangements.
A fourth aspect of the invention discloses a computer-readable storage medium. The computer readable storage medium stores a computer program which, when executed by a processor, implements the steps in an NB-IoT anomaly data testing method based on edge computation according to the first aspect of the present invention.
In summary, in the technical scheme of the invention, the narrowband internet of things technology and the edge computing technology are combined, and the data processing is performed through the edge server to improve the testing speed of network abnormal data of the narrowband internet of things and the use safety of the terminal equipment.
Note that the technical features of the above embodiments may be arbitrarily combined, and all possible combinations of the technical features in the above embodiments are not described for brevity of description, however, as long as there is no contradiction between the combinations of the technical features, they should be regarded as the scope of the description. The above examples merely represent a few embodiments of the present application, which are described in more detail and are not to be construed as limiting the scope of the invention. It should be noted that it would be apparent to those skilled in the art that various modifications and improvements could be made without departing from the spirit of the present application, which would be within the scope of the present application. Accordingly, the scope of protection of the present application is to be determined by the claims appended hereto.

Claims (10)

1. An NB-IoT anomaly data testing method based on edge computation, characterized in that:
the NB-IoT is a narrowband internet of things and comprises a central decision layer, a cloud center layer, an edge layer and a device layer; wherein:
deploying a PC server side in the central decision layer, deploying a core network in the cloud central layer, deploying a test data server and L edge servers in an upper layer of the edge layer, deploying M NB-IoT platforms in a lower layer of the edge layer, and deploying N NB-IoT devices in the device layer, wherein L is less than or equal to M is less than or equal to N;
the central decision layer is communicated with the cloud center layer, the cloud center layer is communicated with the edge layer, and the upper layer and the lower layer of the edge layer by high-speed Ethernet, and the edge layer is communicated with the equipment layer, and the test data server is communicated with the equipment layer by radio frequency induction;
the method comprises the following steps:
step S1, the PC server side issues a test request, the test request is received by the test data server through the core network, and the test request comprises unique identification codes Di of P NB-IoT devices to be tested, i is {1, 2.., P };
S2, classifying the P NB-IoT devices to be tested based on test data types by the test data server according to the unique identification code Di to obtain C categories, generating C test data corresponding to the C categories, and forwarding the C test data to the corresponding NB-IoT devices to be tested in a radio frequency induction mode, wherein C is less than or equal to P;
step S3, after the P to-be-tested NB-IoT devices receive the respective test data, analyzing the test data, generating interactive communication flow through interaction with the test data server, adding the unique identification code Di into the interactive communication flow, packaging the interactive communication flow, and sending the test response message to an NB-IoT platform corresponding to the NB-IoT device in a radio frequency induction mode as a test response message;
step S4, the NB-IoT platform collects the test response message from the NB-IoT device associated with the test response message and forwards the test response message to an edge server with an association relationship, and the edge server locally preprocesses the test response message to obtain test result traffic ti in a standard format corresponding to the test data type;
And S5, the edge server sends the test result flow ti and the unique identification code Di which are packaged to the core network as test result messages { ti, di } in a standard format, the core network analyzes flow characteristic information Ki from the test result flow ti, and sends a characteristic sequence { Ki, di } to the PC server side so as to determine abnormal current data and corresponding NB-IoT equipment.
2. The method for testing NB-IoT abnormal data based on edge computation according to claim 1, wherein in step S1, the PC server determines the P NB-IoT devices to be tested according to a test requirement, and obtains unique identification codes Di of the P NB-IoT devices to be tested.
3. The edge computing-based NB-IoT anomaly data testing method of claim 2, wherein:
different test data types correspond to different test data, the analysis modes of different NB-IoT devices on the test data of the same category are different, and the generated interactive communication traffic is also different;
the PC server side located in the central decision layer, the test data server located in the upper layer of the edge layer and the L edge servers all maintain the corresponding relation between the unique identification code Di of each NB-IoT device and the test data type locally.
4. The NB-IoT anomaly data testing method based on edge computation according to claim 3, wherein in the step S2, the test data server determines a test data type corresponding to the unique identification code Di by searching based on the correspondence maintained locally, obtains the C categories by classification, forwards C test data corresponding to the C categories to a corresponding NB-IoT device to be tested, and the test data originates from a kdcup 99 dataset or a standard NB-IoT dataset.
5. The edge computing-based NB-IoT anomaly data testing method of claim 4, wherein each edge server corresponds to a number of NB-IoT platforms, each NB-IoT platform corresponding to a number of NB-IoT devices; in the step S4, after receiving the test response message, the edge server searches for and determines a test data type corresponding to the unique identification code Di based on the correspondence maintained locally, obtains a standard format corresponding to the determined test data type, and pre-processes the interactive communication traffic in the test response message according to the self-calculation force of the edge server, so as to edit the interactive communication traffic into a test result traffic ti in the standard format, where the pre-processing at least includes: dimensionality reduction processing, noise reduction processing, data clipping, data cleaning and normalization processing.
6. The edge computing-based NB-IoT anomaly data test method of claim 5, wherein in the step S5:
the core network analyzes the test result flow ti, and calculates the information entropy, the relative entropy and the information gain of the test result flow ti to determine the flow characteristic information Ki of the test result flow ti;
the PC server side extracts the flow characteristic information Ki and the unique identification code Di from the characteristic sequence { Ki, di }, determines a test data type corresponding to the unique identification code Di locally by searching, and acquires a characteristic information threshold interval [ Kmin, kmax ] corresponding to the determined test data type;
if the flow characteristic information Ki is E [ Kmin, kmax ], the interactive communication flow generated by the NB-IoT device is a normal flow; otherwise, recording a unique identification code Di of the NB-IoT device corresponding to the abnormal traffic, listing the NB-IoT device corresponding to the abnormal traffic as an abnormal NB-IoT device, and sending an alarm to an edge server and an NB-IoT platform associated with the abnormal NB-IoT device.
7. The method for testing NB-IoT anomaly data based on edge computation of claim 6, wherein the manner of rf sensing is to encode the data to be transmitted on the rf by using an rf sensing panel before transmitting the encoded data to the receiver.
8. An NB-IoT abnormal data testing system based on edge calculation, wherein the NB-IoT is a narrowband internet of things, and the system is characterized by comprising a central decision layer, a cloud center layer, an edge layer and a device layer; wherein:
deploying a PC server side in the central decision layer, deploying a core network in the cloud central layer, deploying a test data server and L edge servers in an upper layer of the edge layer, deploying M NB-IoT platforms in a lower layer of the edge layer, and deploying N NB-IoT devices in the device layer, wherein L is less than or equal to M is less than or equal to N;
the central decision layer is communicated with the cloud center layer, the cloud center layer is communicated with the edge layer, and the upper layer and the lower layer of the edge layer by high-speed Ethernet, and the edge layer is communicated with the equipment layer, and the test data server is communicated with the equipment layer by radio frequency induction;
the system is in a working state:
the PC server side issues a test request, the test request is received by the test data server through the core network, and the test request comprises unique identification codes Di, i epsilon {1,2, & gt, P } of P NB-IoT devices to be tested;
The test data server classifies the P NB-IoT devices to be tested based on test data types according to the unique identification code Di to obtain C categories, generates C test data corresponding to the C categories, and forwards the C test data to the corresponding NB-IoT devices to be tested in a radio frequency induction mode, wherein C is less than or equal to P;
after the P to-be-tested NB-IoT devices receive the respective test data, analyzing the test data, generating interactive communication flow through interaction with the test data server, attaching the unique identification code Di to the interactive communication flow, packaging the interactive communication flow to be used as a test response message, and sending the test response message to an NB-IoT platform corresponding to the NB-IoT device in the radio frequency induction mode;
the NB-IoT platform collects the test response message from the NB-IoT device associated with the NB-IoT platform and forwards the test response message to an edge server with an association relationship, and the edge server locally pre-processes the test response message to obtain test result traffic ti in a standard format corresponding to the test data type;
The edge server sends the test result flow ti and the unique identification code Di to the core network as test result messages { ti, di } in a standard format after being packaged, the core network analyzes flow characteristic information Ki from the test result flow ti, and sends a characteristic sequence { Ki, di } to the PC server side so as to determine abnormal current wave data and corresponding NB-IoT equipment.
9. An electronic device comprising a memory storing a computer program and a processor that, when executing the computer program, performs the steps of a method for NB-IoT anomaly data testing based on edge computation as in any of claims 1 to 7.
10. A computer readable storage medium, characterized in that it has stored thereon a computer program, which when executed by a processor, implements the steps of a NB-IoT anomaly data test method based on edge computation according to any of claims 1 to 7.
CN202310365622.3A 2023-04-07 2023-04-07 NB-IoT abnormal data testing method and system based on edge calculation Pending CN116346824A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202310365622.3A CN116346824A (en) 2023-04-07 2023-04-07 NB-IoT abnormal data testing method and system based on edge calculation

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202310365622.3A CN116346824A (en) 2023-04-07 2023-04-07 NB-IoT abnormal data testing method and system based on edge calculation

Publications (1)

Publication Number Publication Date
CN116346824A true CN116346824A (en) 2023-06-27

Family

ID=86894857

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202310365622.3A Pending CN116346824A (en) 2023-04-07 2023-04-07 NB-IoT abnormal data testing method and system based on edge calculation

Country Status (1)

Country Link
CN (1) CN116346824A (en)

Similar Documents

Publication Publication Date Title
CN112367680B (en) External communication test method and device based on intelligent ammeter and computer equipment
CN112541022A (en) Abnormal object detection method, abnormal object detection device, storage medium and electronic equipment
CN110390202A (en) For detecting method, apparatus, system, equipment and the medium of service logic loophole
KR20090038189A (en) Apparatus and method for managing terminal users
CN114050979A (en) Industrial control protocol safety test system and device
Tabrizi et al. A model for security analysis of smart meters
Mohammed et al. (HIADIoT): Hardware intrinsic attack detection in Internet of Things; leveraging power profiling
Singh et al. A review on cyber physical system attacks: Issues and challenges
Shang et al. A machine learning based golden-free detection method for command-activated hardware Trojan
CN111711664A (en) Information safety testing method and system of intelligent vehicle-road cooperative system
CN112437163A (en) Communication processing method and system based on block chain and big data
CN110365625B (en) Internet of things security detection method and device and storage medium
Peng et al. An internet of vehicles intrusion detection system based on a convolutional neural network
CN109167703A (en) unmanned vehicle data monitoring method, device, equipment and storage medium
CN116346824A (en) NB-IoT abnormal data testing method and system based on edge calculation
EP4102772B1 (en) Method and apparatus of processing security information, device and storage medium
CN114785574B (en) AI-assisted remote vulnerability accurate verification method
Sathar et al. Mitigating IEC-60870-5-104 vulnerabilities: Anomaly detection in smart grid based on LSTM autoencoder
CN112953975A (en) Network security situation awareness system and method
Liu et al. Topology sensing of wireless networks based on Hawkes process
Shyu et al. A multiagent-based intrusion detection system with the support of multi-class supervised classification
CN112417462B (en) Network security vulnerability tracking method and system
CN114727298B (en) Sharing method and system of wireless network without honeycomb unit, medium and electronic equipment
CN111130926B (en) State monitoring method, system and device suitable for encryption machine and storage medium
CN113343124B (en) Training method, detecting method and device for generating countermeasure network

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination