CN117093447A - Internet of things edge equipment abnormality detection method, federal learning system and storage medium - Google Patents
Internet of things edge equipment abnormality detection method, federal learning system and storage medium Download PDFInfo
- Publication number
- CN117093447A CN117093447A CN202311055636.1A CN202311055636A CN117093447A CN 117093447 A CN117093447 A CN 117093447A CN 202311055636 A CN202311055636 A CN 202311055636A CN 117093447 A CN117093447 A CN 117093447A
- Authority
- CN
- China
- Prior art keywords
- detection model
- abnormality detection
- data set
- training
- anomaly detection
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000001514 detection method Methods 0.000 title claims abstract description 212
- 230000005856 abnormality Effects 0.000 title claims abstract description 109
- 238000012549 training Methods 0.000 claims abstract description 107
- 230000002776 aggregation Effects 0.000 claims abstract description 91
- 238000004220 aggregation Methods 0.000 claims abstract description 91
- 238000000034 method Methods 0.000 claims abstract description 59
- 230000002457 bidirectional effect Effects 0.000 claims abstract description 18
- 239000000284 extract Substances 0.000 claims abstract description 8
- 238000012545 processing Methods 0.000 claims description 24
- 238000000605 extraction Methods 0.000 claims description 18
- 238000004590 computer program Methods 0.000 claims description 17
- 238000007781 pre-processing Methods 0.000 claims description 10
- 230000008569 process Effects 0.000 claims description 7
- 238000004364 calculation method Methods 0.000 claims description 6
- 238000010606 normalization Methods 0.000 claims description 6
- 238000009825 accumulation Methods 0.000 claims description 5
- 238000013473 artificial intelligence Methods 0.000 abstract description 2
- 238000010586 diagram Methods 0.000 description 8
- 230000006835 compression Effects 0.000 description 6
- 238000007906 compression Methods 0.000 description 6
- 230000006870 function Effects 0.000 description 6
- 230000007246 mechanism Effects 0.000 description 6
- 238000004891 communication Methods 0.000 description 5
- 230000010354 integration Effects 0.000 description 4
- 230000004044 response Effects 0.000 description 4
- 238000013515 script Methods 0.000 description 4
- 230000002159 abnormal effect Effects 0.000 description 2
- 238000004458 analytical method Methods 0.000 description 2
- 238000011161 development Methods 0.000 description 2
- 238000012986 modification Methods 0.000 description 2
- 230000004048 modification Effects 0.000 description 2
- 230000004075 alteration Effects 0.000 description 1
- 238000003491 array Methods 0.000 description 1
- 238000004422 calculation algorithm Methods 0.000 description 1
- 239000003795 chemical substances by application Substances 0.000 description 1
- 238000013461 design Methods 0.000 description 1
- 230000004069 differentiation Effects 0.000 description 1
- 235000019800 disodium phosphate Nutrition 0.000 description 1
- 238000005516 engineering process Methods 0.000 description 1
- 239000011159 matrix material Substances 0.000 description 1
- 230000005012 migration Effects 0.000 description 1
- 238000013508 migration Methods 0.000 description 1
- 230000003287 optical effect Effects 0.000 description 1
- 238000006467 substitution reaction Methods 0.000 description 1
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/3003—Monitoring arrangements specially adapted to the computing system or computing system component being monitored
- G06F11/3006—Monitoring arrangements specially adapted to the computing system or computing system component being monitored where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/3065—Monitoring arrangements determined by the means or processing involved in reporting the monitored data
- G06F11/3072—Monitoring arrangements determined by the means or processing involved in reporting the monitored data where the reporting involves data filtering, e.g. pattern matching, time or event triggered, adaptive or policy-based reporting
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/24—Classification techniques
- G06F18/243—Classification techniques relating to the number of classes
- G06F18/2433—Single-class perspective, e.g. one-against-all classification; Novelty detection; Outlier detection
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F9/00—Arrangements for program control, e.g. control units
- G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
- G06F9/46—Multiprogramming arrangements
- G06F9/50—Allocation of resources, e.g. of the central processing unit [CPU]
- G06F9/5061—Partitioning or combining of resources
- G06F9/5072—Grid computing
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N20/00—Machine learning
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Software Systems (AREA)
- Data Mining & Analysis (AREA)
- Computing Systems (AREA)
- Mathematical Physics (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Quality & Reliability (AREA)
- Artificial Intelligence (AREA)
- Evolutionary Computation (AREA)
- Medical Informatics (AREA)
- Life Sciences & Earth Sciences (AREA)
- Bioinformatics & Cheminformatics (AREA)
- Bioinformatics & Computational Biology (AREA)
- Evolutionary Biology (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The invention discloses an anomaly detection method of an Internet of things edge device, a federal learning system and a storage medium, which relate to the technical fields of artificial intelligence and the Internet of things, and the method comprises the following steps: the cloud aggregation server sends the initial global anomaly detection model to each edge device; the edge equipment preprocesses the acquired time sequence data to obtain a local data set; the edge equipment carries out iterative training on the localized initial global anomaly detection model by utilizing a local data set to obtain a training gradient, and uploads the processed training gradient to a cloud aggregation server; the cloud aggregation server obtains a global anomaly detection model according to the processed training gradient and the initial global anomaly detection model, and sends the global anomaly detection model to each edge device; the edge equipment extracts the data set through the localized target abnormality detection model and the depth bidirectional converter to perform abnormality detection on the edge equipment to obtain an abnormality detection result. The invention can improve the generalization capability of the model and the accuracy of anomaly detection.
Description
Technical Field
The embodiment of the invention relates to the technical fields of artificial intelligence and the Internet of things, in particular to an anomaly detection method for edge equipment of the Internet of things, a federal learning system and a storage medium.
Background
With the development of the Internet of things technology, massive information sensing devices and Internet of things edge devices are connected to form a huge Internet of things network. Meanwhile, the occurrence rate of faults or anomalies of the edge equipment of the Internet of things is increased due to the fact that a large number of edge equipment of the Internet of things is connected, the functions of related products in the Internet of things are seriously affected by the faults or anomalies of the edge equipment of the Internet of things, and even potential safety hazards are caused, so that it becomes more and more important to accurately and timely detect the anomalies of the edge equipment of the Internet of things.
In the current anomaly detection scene of the internet of things, data are naturally generated at the edge side, the migration cost is high, and the generated data possibly contain privacy data of users, so that challenges are presented to the current anomaly detection method, meanwhile, the data are core assets of clients, and enterprises are not willing to share the core data assets of the enterprises; even if enterprise clients are willing to share data, the data volume of a single Internet of things client is likely to be relatively small, and the data volume is insufficient for training alone to obtain an expected model; moreover, the computing resources at the edge side are limited, so that the training task of the complex model cannot be carried. The three technical challenges of few edge samples, heterogeneous edge data and data island are presented, and development bottleneck and difficult problems are brought to the related industries of the Internet of things for improving the quality of an AI model and realizing the scale expansion of AI services. In addition, most of the existing anomaly detection schemes are distributed anomaly detection schemes based on federal learning distributed training, the data generated by equipment are regarded as normal data, the randomness of the anomaly data is ignored, the influence of the anomaly data in model training cannot be evaluated, and the differentiation of the model on heterogeneous equipment detection cannot be met. Therefore, when data distribution is uneven, model training cannot be optimized, model feature extraction capability is weak, and the model feature extraction capability is not suitable for certain specific scenes, so that generalization capability of an anomaly detection model is poor, and the accuracy of anomaly detection is low.
Disclosure of Invention
The embodiment of the invention provides an anomaly detection method of an edge device of the Internet of things, a federal learning system and a storage medium, and aims to solve the problem of low anomaly detection accuracy caused by poor generalization capability of an anomaly detection model.
In a first aspect, an embodiment of the present invention provides a method for detecting an anomaly of an internet of things edge device, which is applied to a federal learning system, where the federal learning system includes a cloud aggregation server and a plurality of edge devices, and the method includes:
the cloud aggregation server sends an initial global anomaly detection model to each edge device;
the edge equipment takes the received initial global anomaly detection model as an initial anomaly detection model, and preprocesses the acquired time sequence data to obtain a local data set;
the edge equipment carries out iterative training on the initial anomaly detection model by utilizing the local data set to obtain a training gradient, and the training gradient after being processed is uploaded to the cloud aggregation server;
the cloud aggregation server aggregates the processed training gradients to obtain aggregation gradients, obtains a global abnormality detection model according to the aggregation gradients and the initial global abnormality detection model, and transmits the global abnormality detection model to each edge device;
The edge equipment takes the received global abnormality detection model as a target abnormality detection model, and extracts the local data set through the target abnormality detection model and a depth bidirectional converter to perform abnormality detection on the edge equipment to obtain an abnormality detection result.
In a second aspect, an embodiment of the present invention further provides a federal learning system, where the federal learning system includes a cloud aggregation server and a plurality of edge devices, including: a transmitting unit and an aggregation issuing unit which are configured in the cloud aggregation server, and a receiving and acquiring unit, a training uploading unit and a detecting unit which are configured in the edge equipment, wherein,
the sending unit is used for sending the initial global anomaly detection model to each edge device by the cloud aggregation server;
the receiving and acquiring unit is used for the edge equipment to take the received initial global abnormality detection model as an initial abnormality detection model, and preprocesses the acquired time sequence data to obtain a local data set;
the training uploading unit is used for carrying out iterative training on the initial anomaly detection model by the edge equipment through the local data set to obtain a training gradient, and uploading the training gradient after processing to the cloud aggregation server;
The aggregation issuing unit is used for the cloud aggregation server to aggregate the processed training gradient to obtain an aggregation gradient, a global abnormality detection model is obtained according to the aggregation gradient and the initial global abnormality detection model, and the global abnormality detection model is issued to each edge device;
the detection unit is used for the edge equipment to take the received global abnormality detection model as a target abnormality detection model, and the local data set is extracted through the target abnormality detection model and the depth bidirectional converter so as to perform abnormality detection on the edge equipment to obtain an abnormality detection result.
In a third aspect, an embodiment of the present invention further provides a federal learning system, where the federal learning system includes a cloud aggregation server and a plurality of edge devices, where the cloud aggregation server and the edge devices include a memory and a processor connected to the memory; the memory is used for storing a computer program; the processor is configured to run the computer program to perform the method of the first aspect described above.
In a fourth aspect, embodiments of the present invention provide a computer readable storage medium storing a computer program which, when executed by a processor, implements the method of the first aspect described above.
The embodiment of the invention provides an anomaly detection method for edge equipment of the Internet of things, a federal learning system and a storage medium. Wherein the method comprises the following steps: the cloud aggregation server sends an initial global anomaly detection model to each edge device; the edge equipment takes the received initial global anomaly detection model as an initial anomaly detection model, and preprocesses the acquired time sequence data to obtain a local data set; the edge equipment carries out iterative training on the initial anomaly detection model by utilizing the local data set to obtain a training gradient, and the training gradient after being processed is uploaded to the cloud aggregation server; the cloud aggregation server aggregates the processed training gradients to obtain aggregation gradients, obtains a global abnormality detection model according to the aggregation gradients and the initial global abnormality detection model, and transmits the global abnormality detection model to each edge device; the edge equipment takes the received global abnormality detection model as a target abnormality detection model, and extracts the local data set through the target abnormality detection model and a depth bidirectional converter to perform abnormality detection on the edge equipment to obtain an abnormality detection result. According to the technical scheme, a federal learning system is built through the cloud aggregation server and the plurality of edge devices, the edge devices of the Internet of things are trained to obtain training gradients through initial global anomaly detection based on the built federal learning system, the processed training gradients are uploaded to the cloud aggregation server, the cloud aggregation server obtains a global anomaly detection model according to the training gradients based on the processing, anomaly detection is carried out on the extracted local data set through the global anomaly detection model to obtain an anomaly detection result, a depth bidirectional converter and a gradient aggregation compression mechanism are combined on the basis of the federal learning system, generalization capability of the anomaly detection model of the Internet of things is improved, and accordingly anomaly detection accuracy is improved.
Drawings
In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for the description of the embodiments will be briefly described below, and it is obvious that the drawings in the following description are some embodiments of the present invention, and other drawings may be obtained according to these drawings without inventive effort for a person skilled in the art.
FIG. 1 is an overall block diagram of a federal learning system according to an embodiment of the present invention;
fig. 2 is a schematic flow chart of an anomaly detection method for an edge device according to an embodiment of the present invention;
fig. 3 is a schematic sub-flowchart of an edge device anomaly detection method according to an embodiment of the present invention;
fig. 4 is a schematic sub-flowchart of an edge device anomaly detection method according to an embodiment of the present invention;
fig. 5 is a schematic sub-flowchart of an edge device anomaly detection method according to an embodiment of the present invention;
FIG. 6 is a schematic diagram of a deep bi-directional converter according to an embodiment of the present invention;
FIG. 7 is a schematic block diagram of a federal learning system according to an embodiment of the present invention;
fig. 8 is a schematic block diagram of a computer device according to an embodiment of the present invention.
Detailed Description
The following description of the embodiments of the present invention will be made clearly and fully with reference to the accompanying drawings, in which it is evident that the embodiments described are some, but not all embodiments of the invention. All other embodiments, which can be made by those skilled in the art based on the embodiments of the invention without making any inventive effort, are intended to be within the scope of the invention.
It should be understood that the terms "comprises" and "comprising," when used in this specification and the appended claims, specify the presence of stated features, integers, steps, operations, elements, and/or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and/or groups thereof.
It is also to be understood that the terminology used in the description of the invention herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. As used in this specification and the appended claims, the singular forms "a," "an," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise.
It should be further understood that the term "and/or" as used in the present specification and the appended claims refers to any and all possible combinations of one or more of the associated listed items, and includes such combinations.
As used in this specification and the appended claims, the term "if" may be interpreted as "when..once" or "in response to a determination" or "in response to detection" depending on the context. Similarly, the phrase "if a determination" or "if a [ described condition or event ] is detected" may be interpreted in the context of meaning "upon determination" or "in response to determination" or "upon detection of a [ described condition or event ]" or "in response to detection of a [ described condition or event ]".
Referring to fig. 1, fig. 1 is an overall structure diagram of a federal learning system according to an embodiment of the present invention. The federal learning system includes a cloud aggregation server and a plurality of edge devices. The edge device is a device with communication functions, such as an agent and a client, for example, an intelligent terminal, an industrial sensor, an edge gateway and the like. As shown in fig. 1, a global model is stored on the cloud aggregation service, the global model is an initial global anomaly model, and after training gradients are aggregated, the global model is a global anomaly detection model; the local abnormality detection models are stored in the edge devices, and the local abnormality detection models are target abnormality detection models. In this embodiment, the cloud aggregation server is a server with strong computing power and abundant computing resources; the method mainly comprises two functions, wherein the first function is that a global model is initialized to obtain an initial global abnormal model, and the initial global abnormal model is issued to edge equipment; the second function is to aggregate the gradient uploaded by the edge devices until convergence. In this embodiment, the edge device and the cloud aggregation server communicate with each other, so that a depth bidirectional converter and a gradient aggregation compression mechanism are combined on the basis of the federal learning system, the generalization capability of an anomaly detection model of the internet of things device is improved, and the accuracy of anomaly detection is further improved.
Fig. 2 is a flow chart of an anomaly detection method for an edge device according to an embodiment of the present invention. The edge equipment abnormality detection method provided by the embodiment of the invention can be applied to a federal learning system, for example, the edge equipment abnormality detection method can be realized through a software program configured on the federal learning system, so that the generalization capability of an abnormality detection model is improved, and the accuracy of abnormality detection is improved. As shown in fig. 2, the method includes the following steps S100 to S140.
And S100, the cloud aggregation server sends an initial global anomaly detection model to each edge device.
In the embodiment of the invention, the federal learning system comprises a cloud aggregation server and a plurality of internet of things edge devices, wherein the cloud aggregation server is connected with the internet of things edge devices, and the cloud aggregation server transmits an initial global anomaly detection model to each edge device. In the embodiment of the present invention, before the cloud aggregation server and the internet of things edge device are connected to each other to perform anomaly detection, the cloud aggregation server and the edge device initialize respective related parameters and configure corresponding scripts respectively. Specifically, the cloud aggregation server initializes relevant parameters and configures corresponding scripts during model aggregation, and the edge device initializes relevant parameters and configures corresponding scripts of a gradient compression mechanism.
S110, the edge device takes the received initial global anomaly detection model as an initial anomaly detection model, and preprocesses the acquired time series data to obtain a local data set.
In the embodiment of the invention, after receiving an initial global anomaly detection model issued by the cloud aggregation server, the edge device localizes the initial global anomaly detection model into an initial anomaly detection model and acquires and preprocesses local time sequence data to obtain a local data set, wherein the preprocessing comprises feature similarity calculation, feature alignment and encoding, feature binning and feature missing value filling. It should be noted that, in the embodiment of the present invention, after receiving the initial global anomaly detection model issued by the cloud aggregation server, the edge device needs to locally deploy the initial global anomaly detection model in the edge device for use.
In some embodiments, such as the present embodiment, the step S110 may include steps S111-S115, as shown in fig. 3.
S111, obtaining time sequence data, and carrying out similarity calculation and coding processing on the time sequence data to obtain local data similarity and coding results;
S112, aligning the time sequence data with the local data similarity exceeding a preset similarity threshold and the consistent coding result to obtain coding time sequence data;
s113, if the time series data contains continuous values, converting the time series data containing the continuous values into discrete values by utilizing a preset binning strategy to obtain discrete time series data;
s114, if the features in the time series data are missing, filling the time series data with the missing features according to a preset filling method to obtain filling time series data;
s115, using the encoded time series data, the discrete time series data, and the padded time series data as the local data set.
In the embodiment of the invention, time sequence data is acquired, and similarity calculation and coding processing are carried out on the time sequence data to obtain local data similarity and coding results; and comparing the local data similarity with a preset similarity threshold, taking the time sequence data corresponding to the local data similarity exceeding the preset similarity threshold as the same characteristic data, and then taking the time sequence data with the consistent coding result as the same characteristic data, and carrying out alignment processing on the same characteristic data to obtain the coding time sequence data. If the time series data contains continuous values, converting the time series data containing the continuous values into discrete values by using a preset box division strategy to obtain discrete time series data; if the time series data contains continuous numerical values, converting the time series data containing the continuous numerical values into discrete numerical values by using a preset box dividing strategy to obtain discrete time series data, wherein the determining basis of the preset box dividing strategy is weight and information quantity; it can be appreciated that if the missing value exists in the time-series data feature, the missing value of the time-series data needs to be filled according to a preset filling method to obtain the filled time-series data, where the preset filling method may be at least one of a median filling method, a mode filling method, an average filling method and a 0-value filling method. The encoded time series data, the discrete time series data and the padding time series data are used together as the local data set.
S120, the edge equipment carries out iterative training on the initial anomaly detection model by utilizing the local data set to obtain a training gradient, and the training gradient after processing is uploaded to the cloud aggregation server.
In an embodiment of the present invention, as shown in fig. 4, the step S120 may include steps S121 to S123: s121, the edge equipment carries out iterative training on the initial anomaly detection model by using the local data set through a gradient accumulation method; s122, acquiring the training gradient generated in each iterative training process, and sequentially accumulating the training gradient to obtain a local training gradient; and S123, if the absolute value of the local training gradient is larger than a preset gradient threshold, integrating the local training gradient with the rest training gradients to obtain an integrated training gradient, and uploading the compressed integrated training gradient to the cloud aggregation server.
Specifically, in the actual use process, the local data set is utilized to perform iterative training on the initial anomaly detection model through a gradient accumulation method, the training gradients generated in the iterative training process are obtained, the training gradients are sequentially accumulated to obtain local training gradients, the absolute value of the local training gradients is judged because the gradients have a certain sparsity, when the absolute value of the local training gradients is larger than a preset gradient threshold value, the sparsity of the gradients is larger, the gradients are required to be compressed, the local training gradients and the rest training gradients are integrated to obtain an integrated training gradient, the integrated training gradient is compressed, and the compressed integrated training gradient is uploaded to the cloud aggregation server; understandably, if the absolute value of the local training gradient is not greater than the preset gradient threshold, it indicates that the sparseness of the gradient is smaller, and the accumulated local training gradient is directly uploaded to the cloud aggregation server without compressing the gradient. In this embodiment, the byte size of the gradient matrix can be reduced by compressing the gradient, that is, by a gradient compression mechanism, and the number of gradients exchanged between the edge device and the cloud aggregation server can be reduced, so that the communication efficiency is improved.
S130, the cloud aggregation server aggregates the processed training gradient to obtain an aggregate gradient, obtains a global abnormality detection model according to the aggregate gradient and the initial global abnormality detection model, and transmits the global abnormality detection model to each edge device.
In the embodiment of the invention, after receiving the training gradients after the processing uploaded by each edge device, the cloud aggregation server aggregates the integrated training gradients to obtain an aggregate gradient, and modifies model parameters corresponding to an initial global anomaly detection model through the aggregate gradient until the initial global anomaly detection model converges to obtain a global anomaly detection model, and the cloud aggregation server transmits the global anomaly detection model to each edge device again.
And S140, the edge equipment takes the received global abnormality detection model as a target abnormality detection model, and extracts the local data set through the target abnormality detection model and a depth bidirectional converter so as to perform abnormality detection on the edge equipment to obtain an abnormality detection result.
In an embodiment of the present invention, as shown in fig. 5, the step S140 may include steps S141 to S142: s141, performing feature extraction and preprocessing on the local data set through the target abnormality detection model to obtain a vector data set; and S142, performing feature extraction on the vector data set through the depth bidirectional converter so as to perform anomaly detection on the edge equipment to obtain an anomaly detection result.
In the embodiment of the invention, after the target abnormality detection model is deployed locally, the edge device performs first feature extraction on the local data set through the target abnormality detection model to obtain an extracted feature data set, and performs normalization and numerical processing on the extracted feature data set to obtain a vector data set, wherein the vector data set comprises a numerical vector, a time vector and a position vector. And extracting the second characteristic of the vector data set through the depth bidirectional converter so as to perform anomaly detection on the edge equipment to obtain an anomaly detection result, wherein the depth bidirectional converter comprises an encoding input layer, a decoding input layer, an encoder, a decoder and a full connection layer, and the encoders and the decoders are mutually connected and can extract time sequence characteristics of different time scales based on a self-attention mechanism as shown in fig. 6. Specifically, the vector data set is input to the encoder and the decoder connected to each other through the encoding input layer and the decoding input layer, respectively; capturing fine granularity features in the vector data set with the encoder and the decoder, and extracting timing features of different time scales in the vector data set; and inputting the fine granularity characteristic and the time sequence characteristic into the full-connection layer to perform abnormality detection to obtain an abnormality detection score, and determining an abnormality detection result according to the abnormality detection score and a preset classification result. It should be noted that, the full connection layer may classify the abnormality to obtain a classification result, and if the classification result is that no abnormality is detected, the abnormality detection score is 100 minutes; if the classification result detects mild abnormality, the abnormality detection score is 80-99 points; if the classification result detects moderate abnormality, the abnormality detection score is 60-79; if the classification result detects severe abnormality, the abnormality detection score is 0 to 59 points, and it is found that the lower the abnormality detection score is, the more serious the abnormality is.
For ease of understanding, examples are as follows: 1. the initialization federal learning system comprises a cloud aggregation server and a plurality of Internet of things edge devices, wherein the cloud aggregation server and the Internet of things edge devices initialize federal learning distributed training related parameters and configuration scripts respectively, and the cloud aggregation server initializes an initial anomaly detection model for anomaly detection and transmits the initial anomaly detection model to all the edge devices. 2. The edge equipment starts a data preprocessing process, wherein the preprocessing comprises feature similarity analysis, feature alignment, feature binning and feature missing value filling. The corresponding relation between the features is determined through similarity analysis, feature alignment processing is carried out, a binning strategy is determined according to evidence weight and information quantity, and filling missing values such as median filling, mode filling, average filling, 0-value filling and the like are used. 3. And the edge equipment carries out local iterative training on the initial anomaly detection model. Each edge device respectively uses own locally preprocessed training data to carry out local iterative training on an initial anomaly detection model, carries out gradient compression on weight parameters of the initial anomaly detection model after the local training, and uploads the weight parameters to a cloud aggregation server; 4. the cloud aggregation server aggregates the weight parameters uploaded by all the edge devices, obtains a global abnormality detection model according to the aggregated weight parameters and the initial global abnormality detection module, and sends the global abnormality detection model to each edge device. 5. Extracting and preprocessing the characteristics of the local data set through the target abnormality detection model to obtain a vector data set; and extracting features of the vector data set through the depth bidirectional converter so as to perform anomaly detection on the edge equipment to obtain an anomaly detection result. In the embodiment, based on the federal learning system, a depth bidirectional converter is used for extracting time sequence features, so that generalization capability and accuracy of a model are improved, and a gradient compression mechanism is utilized to reduce the number of parameter exchanges between a cloud aggregation server and edge equipment and improve communication efficiency and timeliness.
Fig. 7 is a schematic block diagram of a federal learning system 200 provided in an embodiment of the present invention. As shown in fig. 7, the federal learning-based system 200 includes a unit for executing the above-described method for detecting an anomaly of an edge device of the internet of things, corresponding to the above method for detecting an anomaly of an edge device of the internet of things applied to the cloud aggregation server and the edge terminal. Specifically, referring to fig. 7, the federal learning system 200 based on the internet of things includes a transmitting unit 101 and an aggregation issuing unit 102 configured in a cloud aggregation server, and an acceptance acquiring unit 201, a training uploading unit 202 and a detecting unit 203 configured in an edge device 20.
The sending unit 101 is configured to send an initial global anomaly detection model to each of the edge devices by using the cloud aggregation server; the receiving and acquiring unit 201 is configured to take the received initial global anomaly detection model as an initial anomaly detection model by using the edge device, and perform preprocessing on acquired time-series data to obtain a local data set; the training uploading unit 202 is configured to perform iterative training on the initial anomaly detection model by using the local data set by using the edge device to obtain a training gradient, and upload the training gradient after processing to the cloud aggregation server; the aggregation issuing unit 102 is configured to aggregate the processed training gradient by using the cloud aggregation server to obtain an aggregate gradient, obtain a global anomaly detection model according to the aggregate gradient and the initial global anomaly detection model, and issue the global anomaly detection model to each edge device; the detecting unit 203 is configured to take the received global anomaly detection model as a target anomaly detection model, and extract the local dataset through the target anomaly detection model and a depth bidirectional converter to perform anomaly detection on the edge device to obtain an anomaly detection result.
In some embodiments, for example, the receiving and acquiring unit 201 includes a similarity calculating subunit, an encoding subunit, a discrete subunit, a padding subunit, and an integrated data unit.
The similarity calculation subunit is used for acquiring time sequence data, and performing similarity calculation and coding processing on the time sequence data to obtain local data similarity and coding results; the coding subunit is used for carrying out alignment processing on the time sequence data with the local data similarity exceeding a preset similarity threshold and the consistent coding result to obtain coding time sequence data; the discrete subunit is configured to, if the time-series data includes a continuous value, convert the time-series data including the continuous value into a discrete value by using a preset binning policy to obtain discrete time-series data; the filling subunit is configured to obtain filling time series data according to the time series data with missing features in the time series data, where the preset filling method is at least one of a median filling method, a mode filling method, an average filling method, and a 0-value filling method; the integration data unit is configured to take the encoded time series data, the discrete time series data, and the padded time series data as the local data set.
In some embodiments, for example, the training uploading unit 202 includes an iterative training unit, a gradient accumulating unit, and an integrated uploading unit.
The generation training unit is used for performing iterative training on the initial anomaly detection model by the edge equipment through a gradient accumulation method by utilizing the local data set; the gradient accumulation unit is used for acquiring the training gradient generated in each iterative training process and sequentially accumulating the training gradient to obtain a local training gradient; and the integration uploading unit is used for integrating the local training gradient and the rest training gradients to obtain an integration training gradient if the absolute value of the local training gradient is larger than a preset gradient threshold, and uploading the compressed integration training gradient to the cloud aggregation server.
In some embodiments, for example, the detection unit 203 includes a first extraction unit and a second extraction unit.
The first extraction unit is used for extracting features of the local data set through the target abnormality detection model to obtain an extracted feature data set; the second extraction unit is used for carrying out normalization and numerical processing on the extracted characteristic data set to obtain a vector data set.
In some embodiments, for example, in this embodiment, the second extraction unit includes an input unit, a third year extraction unit, and a classification judgment unit.
Wherein the input unit is configured to input the vector data set to the encoder and the decoder connected to each other through the encoding input layer and the decoding input layer, respectively; the third extraction unit is used for capturing fine granularity features in the vector data set by using the encoder and the decoder and extracting timing features of different time scales in the vector data set; the classification judging unit is used for inputting the fine granularity characteristic and the time sequence characteristic into the full-connection layer to perform abnormality detection to obtain an abnormality detection score, and determining an abnormality detection result according to the abnormality detection score and a preset classification result.
In some embodiments, for example, the first extraction unit includes a fourth extraction unit and a normalization processing unit.
The fourth extraction unit is used for extracting features of the local data set through the target abnormality detection model to obtain an extracted feature data set; the normalization processing unit is used for carrying out normalization and numerical processing on the extracted characteristic data set to obtain a vector data set
It should be noted that, as those skilled in the art can clearly understand, the specific implementation process of the federal learning system 200 and each unit may refer to the corresponding description in the foregoing method embodiments, and for convenience and brevity of description, the description is omitted here.
The federal learning system described above can be implemented in the form of a computer program that can run on a computer device as shown in fig. 8.
Referring to fig. 8, fig. 8 is a schematic block diagram of a computer device according to an embodiment of the present application. The computer device 900 is a device built with a federal learning system.
With reference to fig. 8, the computer device 900 includes a processor 902, a memory and an interface 907 connected by a system bus 901, wherein the memory may include a storage medium 903 and an internal memory 904.
The storage medium 903 may store an operating system 9031 and a computer program 9032. The computer program 9032, when executed, may cause the processor 902 to perform a method for detecting an anomaly of an edge device of the internet of things.
The processor 902 is operable to provide computing and control capabilities to support the operation of the overall computer device 900.
The internal memory 904 provides an environment for running the computer program 9032 in the storage medium 903, and when the computer program 9032 is executed by the processor 902, the processor 902 can be caused to execute a method for detecting an abnormality of an edge device of the internet of things.
The interface 905 is used to communicate with other devices. It will be appreciated by those skilled in the art that the architecture shown in fig. 8 is merely a block diagram of some of the architecture relevant to the present inventive arrangements and is not limiting of the computer device 900 to which the present inventive arrangements may be implemented, and that a particular computer device 900 may include more or less components than those shown, or may combine some components, or have a different arrangement of components.
The processor 902 of each of the edge device and the cloud aggregation server is configured to execute a computer program 9032 stored in a memory, so as to implement the following steps: the cloud aggregation server sends an initial global anomaly detection model to each edge device; the edge equipment takes the received initial global anomaly detection model as an initial anomaly detection model, and preprocesses the acquired time sequence data to obtain a local data set; the edge equipment carries out iterative training on the initial anomaly detection model by utilizing the local data set to obtain a training gradient, and the training gradient after being processed is uploaded to the cloud aggregation server; the cloud aggregation server aggregates the processed training gradients to obtain aggregation gradients, obtains a global abnormality detection model according to the aggregation gradients and the initial global abnormality detection model, and transmits the global abnormality detection model to each edge device; the edge equipment takes the received global abnormality detection model as a target abnormality detection model, and extracts the local data set through the target abnormality detection model and a depth bidirectional converter to perform abnormality detection on the edge equipment to obtain an abnormality detection result.
In some embodiments, for example, in this embodiment, when implementing the step of preprocessing the acquired time-series data to obtain a local data set, the processor 902 specifically implements any embodiment of the method for detecting an anomaly of an edge device of the internet of things.
It should be appreciated that in an embodiment of the application, the processor 902 may be a central processing unit (Central Processing Unit, CPU), the processor 902 may also be other general purpose processors, digital signal processors (Digital Signal Processor, DSPs), application specific integrated circuits (terminals lication Specific Integrated Circuit, ASICs), off-the-shelf programmable gate arrays (Field-Programmable Gate Array, FPGAs) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or the like. Wherein the general purpose processor may be a microprocessor or the processor may be any conventional processor or the like.
Those skilled in the art will appreciate that all or part of the flow in a method embodying the above described embodiments may be accomplished by computer programs instructing the relevant hardware. The computer program may be stored in a storage medium that is a computer readable storage medium. The computer program is executed by at least one processor in the wireless communication system to implement the flow steps of the embodiments of the method described above.
Accordingly, the present invention also provides a storage medium. The storage medium may be a computer readable storage medium. The storage medium stores a computer program. The computer program, when executed by the processor, causes the processor to execute any embodiment of the method for detecting the abnormality of the edge device of the internet of things.
The storage medium may be a U-disk, a removable hard disk, a Read-Only Memory (ROM), a magnetic disk, or an optical disk, or other various computer-readable storage media that can store program codes.
Those of ordinary skill in the art will appreciate that the various illustrative elements and algorithm steps described in connection with the embodiments disclosed herein may be implemented as electronic hardware, wireless communication software, or combinations of both, and that the various illustrative elements and steps have been described above generally in terms of functionality in order to clearly illustrate the interchangeability of hardware and software. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the solution. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present invention.
In the several embodiments provided by the present invention, it should be understood that the disclosed systems and methods may be implemented in other ways. For example, the system embodiments described above are merely illustrative. For example, the division of each unit is only one logic function division, and there may be another division manner in actual implementation. For example, multiple units or components may be combined or may be integrated into another system, or some features may be omitted, or not performed.
The steps in the method of the embodiment of the invention can be sequentially adjusted, combined and deleted according to actual needs. The units in the system of the embodiment of the invention can be combined, divided and deleted according to actual needs. In addition, each functional unit in the embodiments of the present invention may be integrated in one processing unit, or each unit may exist alone physically, or two or more units may be integrated in one unit.
The integrated unit may be stored in a storage medium if implemented in the form of a software functional unit and sold or used as a stand-alone product. Based on such understanding, the technical solution of the present invention is essentially or a part contributing to the prior art, or all or part of the technical solution may be embodied in the form of a software product stored in a storage medium, comprising several instructions for causing a computer device (which may be a personal wireless communication, a terminal, or a network device, etc.) to perform all or part of the steps of the method according to the embodiments of the present invention.
In the foregoing embodiments, the descriptions of the embodiments are focused on, and for those portions of one embodiment that are not described in detail, reference may be made to the related descriptions of other embodiments.
It will be apparent to those skilled in the art that various modifications and variations can be made to the present invention without departing from the spirit or scope of the invention. Thus, it is intended that the present invention also include such modifications and alterations insofar as they come within the scope of the appended claims or the equivalents thereof.
While the invention has been described with reference to certain preferred embodiments, it will be understood by those skilled in the art that various changes and substitutions of equivalents may be made and equivalents will be apparent to those skilled in the art without departing from the scope of the invention. Therefore, the protection scope of the invention is subject to the protection scope of the claims.
Claims (10)
1. The method for detecting the abnormality of the edge equipment of the Internet of things is applied to a federal learning system, and the federal learning system comprises a cloud aggregation server and a plurality of edge equipment, and is characterized by comprising the following steps:
the cloud aggregation server sends an initial global anomaly detection model to each edge device;
The edge equipment takes the received initial global anomaly detection model as an initial anomaly detection model, and preprocesses the acquired time sequence data to obtain a local data set;
the edge equipment carries out iterative training on the initial anomaly detection model by utilizing the local data set to obtain a training gradient, and the training gradient after being processed is uploaded to the cloud aggregation server;
the cloud aggregation server aggregates the processed training gradients to obtain aggregation gradients, obtains a global abnormality detection model according to the aggregation gradients and the initial global abnormality detection model, and transmits the global abnormality detection model to each edge device;
the edge equipment takes the received global abnormality detection model as a target abnormality detection model, and extracts the local data set through the target abnormality detection model and a depth bidirectional converter to perform abnormality detection on the edge equipment to obtain an abnormality detection result.
2. The method for detecting the anomaly of the edge device of the internet of things according to claim 1, wherein the preprocessing the acquired time-series data to obtain the local data set includes:
Obtaining time sequence data, and carrying out similarity calculation and coding processing on the time sequence data to obtain local data similarity and coding results;
performing alignment processing on the time sequence data with the local data similarity exceeding a preset similarity threshold and the consistent coding result to obtain coding time sequence data;
if the time series data contains continuous values, converting the time series data containing the continuous values into discrete values by using a preset box division strategy to obtain discrete time series data;
if the features in the time sequence data are missing, filling the time sequence data with the missing features according to a preset filling method to obtain filling time sequence data;
the encoded time series data, the discrete time series data and the padded time series data are taken as the local data set.
3. The method for detecting an anomaly in an edge device of the internet of things according to claim 2, wherein the preset filling method is at least one of a median filling method, a mode filling method, an average filling method and a 0-value filling method.
4. The method for detecting an anomaly of an edge device of the internet of things according to claim 1, wherein the edge device iteratively trains the initial anomaly detection model using the local data set to obtain a training gradient, and uploads the training gradient after processing to the cloud aggregation server, comprising:
The edge equipment carries out iterative training on the initial anomaly detection model by utilizing the local data set through a gradient accumulation method;
acquiring the training gradient generated in each iterative training process, and sequentially accumulating the training gradient to obtain a local training gradient;
if the absolute value of the local training gradient is larger than a preset gradient threshold, integrating the local training gradient and the rest training gradients to obtain an integrated training gradient, and uploading the compressed integrated training gradient to the cloud aggregation server.
5. The method for detecting an anomaly of an edge device of the internet of things according to claim 1, wherein the extracting the local data set through the target anomaly detection model and the depth bidirectional converter to perform anomaly detection on the edge device to obtain an anomaly detection result comprises:
extracting and preprocessing the characteristics of the local data set through the target abnormality detection model to obtain a vector data set;
and extracting features of the vector data set through the depth bidirectional converter so as to perform anomaly detection on the edge equipment to obtain an anomaly detection result.
6. The method for detecting an anomaly of an edge device of the internet of things according to claim 5, wherein the depth bi-directional converter includes an encoding input layer, a decoding input layer, an encoder, a decoder, and a full connection layer, the feature extraction is performed on the vector data set by the depth bi-directional converter to perform anomaly detection on the edge device to obtain an anomaly detection result, and the method includes:
inputting the vector data set to the encoder and the decoder connected to each other through the encoding input layer and the decoding input layer, respectively;
capturing fine granularity features in the vector data set with the encoder and the decoder, and extracting timing features of different time scales in the vector data set;
and inputting the fine granularity characteristic and the time sequence characteristic into the full-connection layer to perform abnormality detection to obtain an abnormality detection score, and determining an abnormality detection result according to the abnormality detection score and a preset classification result.
7. The method for detecting an anomaly of an edge device of the internet of things according to claim 5, wherein the feature extraction and preprocessing of the local data set by the target anomaly detection model to obtain a vector data set includes:
Performing feature extraction on the local data set through the target abnormality detection model to obtain an extracted feature data set;
and carrying out normalization and numerical processing on the extracted characteristic data set to obtain a vector data set.
8. A federal learning system including a cloud aggregation server and a plurality of edge devices, comprising: a transmitting unit and an aggregation issuing unit which are configured in the cloud aggregation server, and a receiving and acquiring unit, a training uploading unit and a detecting unit which are configured in the edge equipment, wherein,
the sending unit is used for sending the initial global anomaly detection model to each edge device by the cloud aggregation server;
the receiving and acquiring unit is used for the edge equipment to take the received initial global abnormality detection model as an initial abnormality detection model, and preprocesses the acquired time sequence data to obtain a local data set;
the training uploading unit is used for carrying out iterative training on the initial anomaly detection model by the edge equipment through the local data set to obtain a training gradient, and uploading the training gradient after processing to the cloud aggregation server;
The aggregation issuing unit is used for the cloud aggregation server to aggregate the processed training gradient to obtain an aggregation gradient, a global abnormality detection model is obtained according to the aggregation gradient and the initial global abnormality detection model, and the global abnormality detection model is issued to each edge device;
the detection unit is used for the edge equipment to take the received global abnormality detection model as a target abnormality detection model, and the local data set is extracted through the target abnormality detection model and the depth bidirectional converter so as to perform abnormality detection on the edge equipment to obtain an abnormality detection result.
9. The federal learning system is characterized by comprising a cloud aggregation server and a plurality of edge devices, wherein the cloud aggregation server and the edge devices comprise a memory and a processor connected with the memory; the memory is used for storing a computer program; the processor being adapted to run the computer program to perform the steps of the method according to any of claims 1-7.
10. A computer-readable storage medium, characterized in that the storage medium stores a computer program which, when executed by a processor, implements the steps of the method according to any of claims 1-7.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202311055636.1A CN117093447A (en) | 2023-08-21 | 2023-08-21 | Internet of things edge equipment abnormality detection method, federal learning system and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202311055636.1A CN117093447A (en) | 2023-08-21 | 2023-08-21 | Internet of things edge equipment abnormality detection method, federal learning system and storage medium |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN117093447A true CN117093447A (en) | 2023-11-21 |
Family
ID=88774793
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202311055636.1A Pending CN117093447A (en) | 2023-08-21 | 2023-08-21 | Internet of things edge equipment abnormality detection method, federal learning system and storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN117093447A (en) |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN118233220A (en) * | 2024-05-24 | 2024-06-21 | 广州河东科技有限公司 | Remote access authentication system of intelligent home control system |
-
2023
- 2023-08-21 CN CN202311055636.1A patent/CN117093447A/en active Pending
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN118233220A (en) * | 2024-05-24 | 2024-06-21 | 广州河东科技有限公司 | Remote access authentication system of intelligent home control system |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| AU2017389535A1 (en) | Image tampering detection method and system, electronic apparatus and storage medium | |
| CN117093447A (en) | Internet of things edge equipment abnormality detection method, federal learning system and storage medium | |
| CN113095370B (en) | Image recognition method, device, electronic equipment and storage medium | |
| CN111104954B (en) | Object classification method and device | |
| CN117421684A (en) | Abnormal data monitoring and analyzing method based on data mining and neural network | |
| WO2023169274A1 (en) | Data processing method and device, and storage medium and processor | |
| CN112364388B (en) | Sensor data authentication method and device based on block chain | |
| CN115062706A (en) | Forest fire monitoring method and device, storage medium and electronic equipment | |
| CN115131695B (en) | Training method of video detection model, video detection method and device | |
| CN114338129B (en) | Message anomaly detection method, device, equipment and medium | |
| CN111797174A (en) | Method and apparatus for managing spatiotemporal data | |
| CN110889445B (en) | Video CDN hotlinking detection method and device, electronic equipment and storage medium | |
| CN117112039A (en) | Transmission optimization system and operation method of data center | |
| EP4254241A1 (en) | Method and device for image-based malware detection, and artificial intelligence-based endpoint detection and response system using same | |
| CN115276228A (en) | Method, system, storage device and computing device for synchronously uploading power data | |
| CN114925740A (en) | Construction method of industrial control intrusion detection system based on adversarial domain adaptation | |
| EP3690670A1 (en) | Data processing system | |
| CN112950222A (en) | Resource processing abnormity detection method and device, electronic equipment and storage medium | |
| CN115017962B (en) | Riding number detection method, target characteristic sequence determination method and device | |
| CN117152564B (en) | Target detection method, target detection device, electronic equipment and storage medium | |
| CN113407428B (en) | Reliability evaluation method and device for artificial intelligence system and computer equipment | |
| CN115017014B (en) | Highway electromechanical monitoring system and method | |
| KR102624325B1 (en) | System and method for anomaly detection using siamese network and class activation map with discretization and computer program for the same | |
| CN114138546B (en) | Data backup method, device, computing equipment and computer storage medium | |
| CN106652453A (en) | Traffic information management system on basis of neural networks |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |