CN117555489A - Internet of things data storage transaction anomaly detection method, system, equipment and medium - Google Patents
Internet of things data storage transaction anomaly detection method, system, equipment and medium Download PDFInfo
- Publication number
- CN117555489A CN117555489A CN202410037854.0A CN202410037854A CN117555489A CN 117555489 A CN117555489 A CN 117555489A CN 202410037854 A CN202410037854 A CN 202410037854A CN 117555489 A CN117555489 A CN 117555489A
- Authority
- CN
- China
- Prior art keywords
- node
- nodes
- model
- network
- attribute
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000001514 detection method Methods 0.000 title claims abstract description 87
- 238000013500 data storage Methods 0.000 title claims abstract description 48
- 238000010586 diagram Methods 0.000 claims abstract description 68
- 239000013598 vector Substances 0.000 claims abstract description 47
- 230000002159 abnormal effect Effects 0.000 claims abstract description 34
- 238000000034 method Methods 0.000 claims abstract description 32
- 230000004927 fusion Effects 0.000 claims abstract description 23
- 230000004931 aggregating effect Effects 0.000 claims abstract description 9
- 238000003860 storage Methods 0.000 claims abstract description 6
- 230000005856 abnormality Effects 0.000 claims description 29
- 101001014572 Homo sapiens MARCKS-related protein Proteins 0.000 claims description 15
- 238000012549 training Methods 0.000 claims description 15
- 102100028187 ATP-binding cassette sub-family C member 6 Human genes 0.000 claims description 13
- 101000986621 Homo sapiens ATP-binding cassette sub-family C member 6 Proteins 0.000 claims description 13
- 102100028162 ATP-binding cassette sub-family C member 3 Human genes 0.000 claims description 9
- 101000986633 Homo sapiens ATP-binding cassette sub-family C member 3 Proteins 0.000 claims description 9
- 238000013140 knowledge distillation Methods 0.000 claims description 5
- 230000007246 mechanism Effects 0.000 claims description 5
- 230000006855 networking Effects 0.000 claims 1
- 238000004422 calculation algorithm Methods 0.000 description 9
- 230000008569 process Effects 0.000 description 7
- 238000005516 engineering process Methods 0.000 description 4
- 239000011159 matrix material Substances 0.000 description 4
- 238000004364 calculation method Methods 0.000 description 3
- 102100032514 MARCKS-related protein Human genes 0.000 description 2
- 238000013459 approach Methods 0.000 description 2
- 238000013528 artificial neural network Methods 0.000 description 2
- 238000011161 development Methods 0.000 description 2
- 238000012986 modification Methods 0.000 description 2
- 230000004048 modification Effects 0.000 description 2
- 238000012706 support-vector machine Methods 0.000 description 2
- 238000012360 testing method Methods 0.000 description 2
- 230000009466 transformation Effects 0.000 description 2
- 230000004913 activation Effects 0.000 description 1
- 230000002776 aggregation Effects 0.000 description 1
- 238000004220 aggregation Methods 0.000 description 1
- 238000013473 artificial intelligence Methods 0.000 description 1
- 230000006399 behavior Effects 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 230000005540 biological transmission Effects 0.000 description 1
- 238000004891 communication Methods 0.000 description 1
- 230000001010 compromised effect Effects 0.000 description 1
- 238000003066 decision tree Methods 0.000 description 1
- 238000004821 distillation Methods 0.000 description 1
- 238000009826 distribution Methods 0.000 description 1
- 238000000605 extraction Methods 0.000 description 1
- 230000006870 function Effects 0.000 description 1
- 230000007774 longterm Effects 0.000 description 1
- 238000010801 machine learning Methods 0.000 description 1
- 238000004519 manufacturing process Methods 0.000 description 1
- 238000005457 optimization Methods 0.000 description 1
- 238000007781 pre-processing Methods 0.000 description 1
- 238000012545 processing Methods 0.000 description 1
- 238000007637 random forest analysis Methods 0.000 description 1
- 238000011160 research Methods 0.000 description 1
Abstract
The invention discloses a method, a system, equipment and a medium for detecting abnormal data storage and transaction of the Internet of things, which relate to the technical field of abnormal data detection of the Internet of things in industry, and are used for acquiring characteristics of each node by aggregating neighborhood characteristic information of a network diagram after the network diagram is constructed; constructing an observation diagram of each layer according to the characteristics of each node; obtaining an optimal diagram according to the network diagram and the observation diagram learning, and replacing node attribute features of the optimal diagram with position coding features; obtaining structural feature embedded knowledge transferred from the teacher model to the student model according to the optimal diagram and the teacher model after feature replacement; the student model learns knowledge transmitted by the simulated teacher model, and obtains the structural characteristics and the attribute characteristics of the nodes according to the position codes of the nodes of the network map and the node attributes; fusing the structural features and the attribute features of the nodes to obtain fusion embedded vectors of the nodes; and obtaining an abnormal detection result of the node according to the fusion embedded vector of the node. The accuracy of detecting abnormal storage transaction is improved.
Description
Technical Field
The invention relates to the technical field of industrial Internet of things data anomaly detection, in particular to an Internet of things data storage transaction anomaly detection method, system, equipment and medium.
Background
The statements in this section merely provide background information related to the present disclosure and may not necessarily constitute prior art.
The internet of things (IoT) refers to one or more groups of closely connected devices that form a network through wireless or wired communication technologies and cooperate to achieve a common goal for their users. With the rapid development of 5G technology, the data volume generated by connecting equipment in an industrial Internet of things mode is greatly increased in industry 4.0, the data has great value in the fields of science and technology, economy, energy, smart cities and the like, and more individuals and organizations recognize the transaction value of the Internet of things data, so that the Internet of things data storage transaction platform has very wide application and development prospects.
Under an industrial scene, as the industrial internet of things data is more and more emphasized, the storage transaction of the industrial internet of things data becomes a high-risk field of network security, and if nodes with malicious behaviors, namely malicious nodes, appear, the nodes may steal the storage transaction information of the industrial internet of things data. Leakage of these data can cause a series of problems. First, such leakage may lead to violations of corporate secrets and personal privacy. Second, the acquisition of important business secrets by an attacker would pose a threat to the competitiveness and long-term sustainability of an enterprise. Most importantly, the availability of industrial internet of things systems can be compromised, which can lead to equipment losing control or performing incorrect operations, causing damage or loss to the production process, and thus ensuring the safety of industrial data is critical.
A graph neural network-based method is now commonly used to identify and control malicious nodes in a network. At present, most of the GNN algorithms directly input an original network diagram into a GNN model for training test, however, the original network diagram may not be optimal, and virtual false edges and missing edges may exist, which results in poor performance of the GNN model which is directly trained by using the original network diagram, and most of the GNN algorithms at present rely on a message transmission principle, which makes training and execution speed of the GNN model slower, and the trained model has a larger scale, and cannot be directly applied to industrial application scenes with limited memory and need rapid reasoning.
Disclosure of Invention
In order to solve the problems, the invention provides a method, a system, equipment and a medium for detecting the abnormal data storage transaction of the Internet of things, which improve the accuracy and the calculation efficiency of detecting the abnormal data storage transaction of the Internet of things.
In order to achieve the above purpose, the invention adopts the following technical scheme:
in a first aspect, a method for detecting abnormal data storage transaction of the internet of things is provided, including:
acquiring an industrial Internet of things data storage transaction data set;
utilizing industrial Internet of things data to store a transaction data set, training a constructed abnormality detection model to obtain a trained abnormality detection model, wherein the abnormality detection model comprises a teacher model and a student model, the abnormality detection model constructs a network diagram for storing the transaction data set, and the characteristics of each node are obtained by aggregating neighborhood characteristic information of the network diagram through a GAT network; constructing an observation diagram of each layer of the GAT network according to the characteristics of each node; according to the network graph, the observation graphs of all layers, the characteristics of each node and the real labels of the nodes, learning by a Bayesian graph structure learner to obtain an optimal graph; determining the position coding characteristic of each node in the optimal graph, and replacing the node attribute characteristic of the optimal graph with the position coding characteristic; according to the optimal diagram and the teacher model of which the node attribute characteristics are replaced by the position coding characteristics, obtaining the structure characteristic embedded knowledge transferred from the teacher model to the student model; the student model learns knowledge transmitted by the simulated teacher model, and obtains the structural characteristics and the attribute characteristics of the nodes according to the position codes of the nodes of the network map and the node attributes; fusing the structural features and the attribute features of the nodes to obtain fusion embedded vectors of the nodes; obtaining an abnormal detection result of the node according to the fusion embedded vector of the node;
and carrying out anomaly detection on the industrial Internet of things data storage transaction by using the trained anomaly detection model to obtain an anomaly detection result.
In a second aspect, an internet of things data storage transaction anomaly detection system is provided, including:
the data set acquisition module is used for acquiring an industrial Internet of things data storage transaction data set;
the model training module is used for storing a transaction data set by utilizing industrial Internet of things data, training the constructed abnormality detection model to obtain a trained abnormality detection model, wherein the abnormality detection model comprises a teacher model and a student model, the abnormality detection model constructs a network diagram for storing the transaction data set, and the characteristics of each node are obtained by aggregating neighborhood characteristic information of the network diagram through a GAT network; constructing an observation diagram of each layer of the GAT network according to the characteristics of each node; according to the network graph, the observation graphs of all layers, the characteristics of each node and the real labels of the nodes, learning by a Bayesian graph structure learner to obtain an optimal graph; determining the position coding characteristic of each node in the optimal graph, and replacing the node attribute characteristic of the optimal graph with the position coding characteristic; according to the optimal diagram and the teacher model of which the node attribute characteristics are replaced by the position coding characteristics, obtaining the structure characteristic embedded knowledge transferred from the teacher model to the student model; the student model learns knowledge transmitted by the simulated teacher model, and obtains the structural characteristics and the attribute characteristics of the nodes according to the position codes of the nodes of the network map and the node attributes; fusing the structural features and the attribute features of the nodes to obtain fusion embedded vectors of the nodes; obtaining an abnormal detection result of the node according to the fusion embedded vector of the node;
the data anomaly detection module is used for carrying out anomaly detection on the industrial Internet of things data storage transaction by utilizing the trained anomaly detection model to obtain an anomaly detection result.
In a third aspect, an electronic device is provided, including a memory, a processor, and computer instructions stored on the memory and running on the processor, where the computer instructions, when executed by the processor, perform the steps of the method for detecting an anomaly in data storage transactions of the internet of things.
In a fourth aspect, a computer readable storage medium is provided for storing computer instructions that, when executed by a processor, perform the steps of a method for detecting anomalies in data storage transactions of the internet of things.
Compared with the prior art, the invention has the beneficial effects that:
1. after a network diagram for storing a transaction data set is constructed, the neighborhood characteristic information of the network diagram is aggregated through a GAT network to obtain the characteristics of each node; constructing an observation diagram of each layer of the GAT network according to the characteristics of each node; according to the network graph, the observation graphs of all layers, the characteristics of each node and the real labels of the nodes, learning is carried out to obtain an optimal graph, and the optimal graph is utilized to train a teacher model and a student model, so that the trained model has optimal performance, and the accuracy of detecting abnormal data transaction of the industrial Internet of things can be improved.
2. The abnormal detection model comprises a teacher model and a student model, after the optimal graph is obtained, the node attribute features of the optimal graph are replaced by the position coding features, then the optimal graph and the teacher model after the node attribute features are replaced by the position coding features are utilized to obtain the structural feature embedded knowledge transmitted by the teacher model to the student model, the student model learns the knowledge transmitted by the simulated teacher model through a knowledge distillation method, so that the structural features and the attribute features of the nodes can be obtained according to the position coding and the node attribute of any node, the attribute features and the structural features are fused to obtain the fusion embedded vector of the node, the abnormal detection result of the node is obtained according to the coding vector of the node, and the challenges in terms of expandability and deployment caused by the data dependence of the traditional GNN model in an industrial environment are eliminated, so that the abnormal detection model can be deployed in a memory-limited application program needing quick reasoning.
3. The invention adopts the self-adaptive attention mechanism to fuse the structural features and the attribute features of the nodes, thereby learning the importance of different features, and carrying out weighted fusion on the two features according to the importance of the features, so as to fully embody the feature information of the nodes.
Additional aspects of the invention will be set forth in part in the description which follows and, in part, will be obvious from the description, or may be learned by practice of the invention.
Drawings
The accompanying drawings, which are included to provide a further understanding of the application and are incorporated in and constitute a part of this application, illustrate embodiments of the application and together with the description serve to explain the application and do not constitute an undue limitation to the application.
Fig. 1 is a flowchart of a method for detecting abnormal data storage transactions of the internet of things disclosed in embodiment 1.
Detailed Description
The invention will be further described with reference to the drawings and examples.
It should be noted that the following detailed description is illustrative and is intended to provide further explanation of the present application. Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs.
Example 1
Most of the existing GNN algorithms for carrying out anomaly detection on the data storage transaction of the Internet of things directly input a network diagram constructed by the data storage transaction data of the Internet of things into a GNN model for training test, however, experimental researches find that the topological structure of the originally obtained network diagram is not optimal, and the problems of long tail distribution, low homogeneity and short average path length exist, so that the GNN model directly trained by using the original network diagram has poor performance. Secondly, it is known by analyzing the principle of the GNN algorithm that the conventional GNN algorithm relies on the principle of message passing, i.e. the (multi-hop) neighborhood aggregation feature of the slave node, so that the success of GNN relies on aggregating a large amount of neighbor information, which makes the training and execution speed of the GNN model slower and the trained model scale larger, and this feature of GNN can ensure that it obtains good results on node classification tasks, but it is only suitable for the scene of industrial application in situations where the memory and speed are not limited. Because of the data dependencies and the large memory requirements of conventional GNNs, scalability and deployment challenges can be presented, which makes GNNs difficult to deploy into memory-constrained scenarios requiring fast reasoning. At present, algorithms for detecting malicious nodes in the data storage transaction process of the Internet of things are rare and can be used accurately and efficiently.
To solve the above technical problem, in this embodiment, a method for detecting abnormal data storage transaction of the internet of things is disclosed, as shown in fig. 1, including:
acquiring an industrial Internet of things data storage transaction data set;
utilizing industrial Internet of things data to store a transaction data set, training a constructed abnormality detection model to obtain a trained abnormality detection model, wherein the abnormality detection model comprises a teacher model and a student model, the abnormality detection model constructs a network diagram for storing the transaction data set, and the characteristics of each node are obtained by aggregating neighborhood characteristic information of the network diagram through a GAT network; constructing an observation diagram of each layer of the GAT network according to the characteristics of each node; according to the network graph, the observation graphs of all layers, the characteristics of each node and the real labels of the nodes, learning by a Bayesian graph structure learner to obtain an optimal graph; determining the position coding characteristic of each node in the optimal graph, and replacing the node attribute characteristic of the optimal graph with the position coding characteristic; according to the optimal diagram and the teacher model of which the node attribute characteristics are replaced by the position coding characteristics, obtaining the structure characteristic embedded knowledge transferred from the teacher model to the student model; the student model learns knowledge transmitted by the simulated teacher model, and obtains the structural characteristics and the attribute characteristics of the nodes according to the position codes of the nodes of the network map and the node attributes; fusing the structural features and the attribute features of the nodes to obtain fusion embedded vectors of the nodes; obtaining an abnormal detection result of the node according to the fusion embedded vector of the node;
and carrying out anomaly detection on the industrial Internet of things data storage transaction by using the trained anomaly detection model to obtain an anomaly detection result.
After the industrial internet of things data storage transaction data set is obtained, preprocessing the data set, inputting the preprocessed industrial internet of things data storage transaction data set into a constructed anomaly detection model, training the anomaly detection model, wherein the anomaly detection model comprises a teacher model and a student model, and the process of the anomaly detection model for processing the input industrial internet of things data storage transaction data set is as follows:
s1: constructing a network diagram for storing a transaction data set, and acquiring the characteristics of each node by aggregating neighborhood characteristic information of the network diagram through a GAT network; constructing an observation diagram of each layer of the GAT network according to the characteristics of each node; according to the network graph, the observation graphs of all layers, the characteristics of each node and the real labels of the nodes, the optimal graph is obtained through learning of a Bayesian graph structure learner, and the process comprises the following steps:
s1.1: the anomaly detection model constructs a network graph G= (V, A, X, Y) of the industrial Internet of things data storage transaction according to the input data set, wherein V is a node set, A is an adjacent matrix of the nodes, X is a node attribute set, and Y is a node label set.
S1.2: and acquiring the characteristics of each node by aggregating the neighborhood characteristic information of the network map through the GAT network.
Specifically, the network graph G is input into a network device havinglIn the GAT network of the layer, the neighborhood characteristic information of each node in the network diagram G is aggregated to generate a characteristic embedded vector of each node, and Z is used for representing the first nodelThe features of all nodes of the layer are embedded into the vector set. Wherein, each layer of feature extraction process can be expressed as: 。wherein A is an adjacency matrix of nodes, < ->Is the firstlFeature embedding vector of each node generated in the layer,/->Is the firstl-a feature embedding vector for each node generated in layer 1. />Is the firstl-1 normalized weight parameters generated by layer. />Is a feature embedding vector set of a k-layer node,>，/>is the function of the activation and,Z =/>。
s1.3: and calculating to obtain an observation diagram of each layer of the GAT network according to the characteristics of each node in each layer of the GAT network by adopting a KNN approach diagram mode.
Node representations in different layers of the GAT network can reveal different multi-level neighborhood information, so that local to global information is provided for a model, and feature embedding vector sets of the nodes in different layers of the GAT network are utilizedConstructing an observation map of each layer->. Observation pattern->Graph structures from different hierarchical views can be reflected to integrate inferences into a more reliable graph structure.
In this embodiment, a KNN approach graph is adopted, and an observation graph is obtained by calculation, specifically: according to the characteristics of the nodes, calculating the similarity of any two nodes in each layer; and according to the similarity of any two nodes, selecting the first k similar nodes for each node to construct a connecting edge, obtaining a KNN adjacent graph of each layer, and obtaining an observation graph of each layer.
The method for calculating the similarity between any two nodes comprises the following steps:. In (1) the->And->Is the node in the k layeriFeatures and nodes of (a)jIs characterized by (1)>Is a nodeiAnd nodejSimilarity between them.
S1.4: and learning by a Bayesian graph structure learner according to the network graph, the observation graphs of all layers, the characteristics of each node and the real labels of the nodes to obtain an optimal graph.
The present embodiment will look at each layerAnd the original network diagram G forms an observation set O= { G, which contains multi-order neighborhood similarity>}。
Based on the Bayesian graph structure learner, the output embedding Z of the observation set O, GAT and the real label Y of each node are put into the Bayesian graph structure learner, and the optimal graph Q which is most in line with the actual situation is estimated through continuous iterative optimization according to the information provided by the data.
S2: replacing the node attribute features of the optimal graph with position coding features; according to the optimal diagram and the teacher model with the node attribute characteristics replaced by the position coding characteristics, obtaining the structure characteristic embedded knowledge transferred from the teacher model to the student model, wherein the process comprises the following steps:
s2.1: in order to ensure that the knowledge transmitted from the teacher model to the student model only contains the topology information of the learned optimal diagram without the influence of attribute features. The present embodiment employs a position-coding (PE) vector to replace the node attribute features of the optimal graph Q.
Firstly, determining the position code of each node in the optimal diagram Q; and then, determining the position coding characteristic of each node in the optimal graph Q according to the position coding of each node. Preferably, the position code of each node in the optimal graph Q is determined through one-hot coding. The specific calculation formula of the position coding features is as follows:. In (1) the->Coding features for the position of node v, +.>Is a learnable parameter matrix, b is a bias vector,>is the position code of the node v determined by the one-hot code.
S2.2: and (3) replacing the node attribute features with the optimal diagrams of the position coding features, and inputting the optimal diagrams into a teacher model to obtain the structural feature embedding knowledge transferred from the teacher model to the student model.
The teacher model of the embodiment adopts a multi-layer GNN network, takes an optimal diagram with node attribute characteristics replaced by position coding characteristics as input, and embeds knowledge into structural characteristics of output nodes, specifically:. In the method, in the process of the invention,knowledge is embedded for the structural features that the teacher model delivers to the student model,Qis learned by a Bayesian graph structure learnerThe best view of the present invention is that,PEis a set of position encodings of the node.
S3: the student model learns knowledge transmitted by the simulated teacher model, and obtains structural features and attribute features of the nodes based on the position coding features of the nodes.
The student model of the embodiment comprises an MLP1 module and an MLP2 module, wherein the input of the MLP1 module is the position code of the node of the network diagram G; the MLP2 module is the node attribute of the network graph G; the MLP1 module learns knowledge transmitted by the simulated teacher model and obtains the structural characteristics of the nodes according to the position codes of the nodes of the network diagram G; the MLP2 module obtains attribute characteristics of the nodes according to the node attributes of the network graph G; and fusing the structural features and the attribute features of the nodes to obtain fused embedded vectors of the nodes, and obtaining an abnormality detection result of the nodes according to the fused embedded vectors of the nodes.
Together, two MLP modules are included in the student model. Wherein the MLP1 module is used for simulating knowledge transmitted by a learning teacher model to enable the knowledge to have the capability similar to the teacher model, and the MLP2 module is used for learning node attributes and generating embedded vectors representing the node attribute characteristics.
Preferably, the MLP1 module learns knowledge transmitted by the simulated teacher model by adopting a knowledge distillation method, so that the MLP1 module has the capability of generating structural feature embedding of any given node。
For node v: 。wherein, the loss of distillation is:. In (1) the->Is the position coding of node v of network graph G, is->Is MLP1 modeBlock imitate teacher model GNN network generated structural feature embedding +.>Is the structural feature embedded knowledge of node v transmitted by the teacher model GNN network,/I>Is the label prediction of the MLP1 module to the node v in the student model,/for the node v>Is the true label of node v, +.>Is a hyper-parameter that balances the two losses.
The MLP2 module is a conventional MLP module, and learns an embedded vector containing node attribute characteristics by inputting node attributes of the network graph G：/>. In (1) the->Is the node V attribute feature of the network graph G, corresponding to X, _in = (V, a, X, Y) in G = (V, a, X, Y)>Is the attribute feature embedding vector of the generated node v.
S4: and fusing the structural features and the attribute features of the nodes to obtain the fused embedded vector of the nodes.
In the embodiment, the structural features and the attribute features of the nodes are fused by a self-adaptive attention mechanism, so that the fused embedded vector of the nodes is obtained. Specific: and respectively fusing the structural feature embedded vector generated by the MLP1 module and the node attribute feature embedded vector generated by the MLP2 module based on the self-adaptive attention mechanism, learning the importance of different embeddings, and selecting the feature information with the greatest influence on the downstream task. The process comprises the following steps:
s4.1, determining attention coefficients respectively corresponding to the structural features and the attribute features of the nodes.
Features for node v []Learning the attention coefficient [ -for each feature>]/>. The method comprises the following steps: first of all to the feature [ ]>]Non-linear transformation is performed, after which features are derived using a shared attention vector]The attention coefficient of (2) is calculated as follows: />. In (1) the->Is the feature [ -of node v>]By nonlinear transformation [ ] obtained>]，/>Is a trainable weight matrix, b is a paranoid parameter,>is a shared attention vector, +.>Is characterized by [>]Corresponding attention coefficient [ ->]。
S4.2, after the attention coefficient corresponding to the structural feature and the attention coefficient corresponding to the attribute feature are obtained, respectively taking the attention coefficient corresponding to the structural feature and the attention coefficient corresponding to the attribute feature as weights of the structural feature and the attribute feature of the node, and carrying out weighted summation on the structural feature and the attribute feature of the node to obtain a fusion embedded vector of the node, wherein the fusion embedded vector specifically comprises the following steps:. In (1) the->The vector is embedded for the fusion of node v.
S5: and obtaining an abnormal detection result of the node according to the fusion embedded vector of the node.
In this embodiment, the fusion embedded vectors of the nodes are input into the classifier to classify, and based on the classification result, whether the node is an abnormal node can be determined. Classifiers include, but are not limited to, single class support vector machines (One Class Support Vector Machines, one class SVM), naive bayes, decision trees, random forests.
When the industrial Internet of things data storage transaction data set is utilized, training is carried out on the constructed anomaly detection model, and after the trained anomaly detection model is obtained, anomaly detection can be carried out on the industrial Internet of things data storage transaction by utilizing the trained anomaly detection model, so that an anomaly detection result is obtained.
According to the detection method disclosed by the embodiment, when an anomaly detection model is trained, a network diagram for storing a transaction data set is constructed, and then neighborhood feature information of the network diagram is aggregated through a GAT network to obtain the feature of each node; constructing an observation diagram of each layer of the GAT network according to the characteristics of each node; according to the network graph, the observation graphs of all layers, the characteristics of each node and the real labels of the nodes, learning is carried out to obtain an optimal graph, and the optimal graph is utilized to train a teacher model and a student model, so that the trained model has optimal performance, and the accuracy of detecting abnormal data transaction of the industrial Internet of things can be improved.
The abnormal detection model comprises a teacher model and a student model, after the optimal graph is obtained, the node attribute features of the optimal graph are replaced by the position coding features, then the optimal graph and the teacher model after the node attribute features are replaced by the position coding features are utilized to obtain the structural feature embedded knowledge transmitted by the teacher model to the student model, the student model learns the knowledge transmitted by the simulated teacher model through a knowledge distillation method, so that the structural features and the attribute features of the nodes can be obtained according to the position coding of the nodes and the node attribute, the attribute features and the structural features are fused to obtain the fused embedded vectors of the nodes, the abnormal detection results of the nodes are obtained according to the fused embedded vectors of the nodes, and the challenges in terms of expandability and deployment caused by the data dependence of the traditional GNN model in an industrial environment are eliminated, so that the abnormal detection model can be deployed in a memory-limited application program needing quick reasoning.
According to the embodiment, the self-adaptive attention mechanism is adopted, the structural features and the attribute features of the nodes are fused, so that the importance of different features is learned, the two features are weighted and fused according to the importance of the features, the feature information of the nodes can be fully reflected, and the accuracy of node abnormality detection is ensured when the fused embedded vector of the nodes obtained by the method is used for carrying out node abnormality detection.
According to the detection method disclosed by the embodiment, artificial intelligence and a machine learning algorithm are introduced, and the data storage transaction network of the Internet of things and the graph neural network are combined to utilize a series of technologies such as a graph structure learning algorithm, a knowledge distillation algorithm, a graph attention network, meta learning and the like, so that the abnormal nodes in the data storage transaction process of the Internet of things are accurately and efficiently identified and monitored.
Example 2
In this embodiment, an internet of things data storage transaction anomaly detection system is disclosed, comprising:
the data set acquisition module is used for acquiring an industrial Internet of things data storage transaction data set;
the model training module is used for storing a transaction data set by utilizing industrial Internet of things data, training the constructed abnormality detection model to obtain a trained abnormality detection model, wherein the abnormality detection model comprises a teacher model and a student model, the abnormality detection model constructs a network diagram for storing the transaction data set, the characteristics of each node in the network diagram are obtained, an observation diagram of each layer of the network diagram is constructed according to the characteristics of each node, an optimal diagram is selected from all the observation diagrams and the network diagram, the position coding characteristics of each node in the optimal diagram are determined, and the node attribute characteristics of the optimal diagram are replaced by the position coding characteristics; according to the optimal diagram and the teacher model of which the node attribute characteristics are replaced by the position coding characteristics, obtaining the structure characteristic embedded knowledge transferred from the teacher model to the student model; the student model learns knowledge transmitted by the simulated teacher model, and obtains structural features and attribute features of the nodes based on the position coding features of the nodes; fusing the structural features and the attribute features of the nodes to obtain fusion embedded vectors of the nodes; obtaining an abnormal detection result of the node according to the fusion embedded vector of the node;
the data anomaly detection module is used for carrying out anomaly detection on the industrial Internet of things data storage transaction by utilizing the trained anomaly detection model to obtain an anomaly detection result.
The invention also provides an electronic device, which comprises a memory, a processor and computer instructions stored on the memory and running on the processor, wherein the computer instructions, when being run by the processor, complete the steps of the method for detecting the abnormality of the data storage transaction of the Internet of things disclosed in the embodiment 1.
The invention also provides a computer readable storage medium for storing computer instructions which, when executed by a processor, perform the steps of the method for detecting abnormal data storage transactions of the internet of things disclosed in embodiment 1.
Finally, it should be noted that: the above embodiments are only for illustrating the technical aspects of the present invention and not for limiting the same, and although the present invention has been described in detail with reference to the above embodiments, it should be understood by those of ordinary skill in the art that: modifications and equivalents may be made to the specific embodiments of the invention without departing from the spirit and scope of the invention, and any modifications and equivalents are intended to be included within the scope of the invention.
Claims (10)
1. The method for detecting the abnormal transaction of the data storage of the Internet of things is characterized by comprising the following steps:
acquiring an industrial Internet of things data storage transaction data set;
utilizing industrial Internet of things data to store a transaction data set, training a constructed abnormality detection model to obtain a trained abnormality detection model, wherein the abnormality detection model comprises a teacher model and a student model, the abnormality detection model constructs a network diagram for storing the transaction data set, and the characteristics of each node are obtained by aggregating neighborhood characteristic information of the network diagram through a GAT network; constructing an observation diagram of each layer of the GAT network according to the characteristics of each node; according to the network graph, the observation graphs of all layers, the characteristics of each node and the real labels of the nodes, learning by a Bayesian graph structure learner to obtain an optimal graph; determining the position coding characteristic of each node in the optimal graph, and replacing the node attribute characteristic of the optimal graph with the position coding characteristic; according to the optimal diagram and the teacher model of which the node attribute characteristics are replaced by the position coding characteristics, obtaining the structure characteristic embedded knowledge transferred from the teacher model to the student model; the student model learns knowledge transmitted by the simulated teacher model, and obtains the structural characteristics and the attribute characteristics of the nodes according to the position codes of the nodes of the network map and the node attributes; fusing the structural features and the attribute features of the nodes to obtain fusion embedded vectors of the nodes; obtaining an abnormal detection result of the node according to the fusion embedded vector of the node;
and carrying out anomaly detection on the industrial Internet of things data storage transaction by using the trained anomaly detection model to obtain an anomaly detection result.
2. The method for detecting abnormal data storage transaction of the internet of things according to claim 1, wherein the observation diagram of each layer of the GAT network is calculated and obtained according to the characteristics of each node in each layer of the GAT network by adopting a mode of a KNN proximity diagram.
3. The method for detecting abnormal data storage transaction of the internet of things according to claim 2, wherein the similarity of any two nodes in each layer is calculated according to the characteristics of the nodes; and according to the similarity of any two nodes, selecting the first k similar nodes for each node to construct a connecting edge, obtaining a KNN adjacent graph of each layer, and obtaining an observation graph of each layer.
4. The method for detecting abnormal data storage transaction of the internet of things according to claim 1, wherein the student model comprises an MLP1 module and an MLP2 module, and the input of the MLP1 module is the position code of the node of the network graph G; the MLP2 module is the node attribute of the network graph G; the MLP1 module learns knowledge transmitted by the simulated teacher model and obtains the structural characteristics of the nodes according to the position codes of the nodes of the network diagram G; the MLP2 module obtains attribute characteristics of the nodes according to the node attributes of the network graph G; and fusing the structural features and the attribute features of the nodes to obtain fused embedded vectors of the nodes, and obtaining an abnormality detection result of the nodes according to the fused embedded vectors of the nodes.
5. The method of claim 4, wherein the MLP1 module learns knowledge transmitted by the simulated teacher model by using a knowledge distillation method.
6. The method for detecting abnormal data storage and transaction of the internet of things according to claim 4, wherein the structural features and the attribute features of the nodes are fused by a self-adaptive attention mechanism to obtain fusion embedded vectors of the nodes.
7. The method for detecting abnormal data storage transaction of the internet of things according to claim 6, wherein attention coefficients respectively corresponding to structural features and attribute features of the nodes are determined; and respectively taking the attention coefficient corresponding to the structural feature and the attention coefficient corresponding to the attribute feature as weights of the structural feature and the attribute feature of the node, and carrying out weighted summation on the structural feature and the attribute feature of the node to obtain a fusion embedded vector of the node.
8. The abnormal detection system of thing networking data storage trade, its characterized in that includes:
the data set acquisition module is used for acquiring an industrial Internet of things data storage transaction data set;
the model training module is used for storing a transaction data set by utilizing industrial Internet of things data, training the constructed abnormality detection model to obtain a trained abnormality detection model, wherein the abnormality detection model comprises a teacher model and a student model, the abnormality detection model constructs a network diagram for storing the transaction data set, and the characteristics of each node are obtained by aggregating neighborhood characteristic information of the network diagram through a GAT network; constructing an observation diagram of each layer of the GAT network according to the characteristics of each node; according to the network graph, the observation graphs of all layers, the characteristics of each node and the real labels of the nodes, learning by a Bayesian graph structure learner to obtain an optimal graph; determining the position coding characteristic of each node in the optimal graph, and replacing the node attribute characteristic of the optimal graph with the position coding characteristic; according to the optimal diagram and the teacher model of which the node attribute characteristics are replaced by the position coding characteristics, obtaining the structure characteristic embedded knowledge transferred from the teacher model to the student model; the student model learns knowledge transmitted by the simulated teacher model, and obtains the structural characteristics and the attribute characteristics of the nodes according to the position codes of the nodes of the network map and the node attributes; fusing the structural features and the attribute features of the nodes to obtain fusion embedded vectors of the nodes; obtaining an abnormal detection result of the node according to the fusion embedded vector of the node;
the data anomaly detection module is used for carrying out anomaly detection on the industrial Internet of things data storage transaction by utilizing the trained anomaly detection model to obtain an anomaly detection result.
9. An electronic device comprising a memory and a processor, and computer instructions stored on the memory and running on the processor, which when executed by the processor, perform the steps of the internet of things data storage transaction anomaly detection method of any one of claims 1-7.
10. A computer readable storage medium storing computer instructions which, when executed by a processor, perform the steps of the internet of things data storage transaction anomaly detection method of any one of claims 1-7.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202410037854.0A CN117555489A (en) | 2024-01-11 | 2024-01-11 | Internet of things data storage transaction anomaly detection method, system, equipment and medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202410037854.0A CN117555489A (en) | 2024-01-11 | 2024-01-11 | Internet of things data storage transaction anomaly detection method, system, equipment and medium |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN117555489A true CN117555489A (en) | 2024-02-13 |
Family
ID=89815068
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202410037854.0A Pending CN117555489A (en) | 2024-01-11 | 2024-01-11 | Internet of things data storage transaction anomaly detection method, system, equipment and medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN117555489A (en) |
Citations (11)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110020023A (en) * | 2018-12-19 | 2019-07-16 | 大连理工大学 | Net with attributes based on fusion structure feature indicates learning method |
| US20200387782A1 (en) * | 2019-06-07 | 2020-12-10 | Tata Consultancy Services Limited | Sparsity constraints and knowledge distillation based learning of sparser and compressed neural networks |
| US20220147695A1 (en) * | 2021-09-09 | 2022-05-12 | Beijing Baidu Netcom Science Technology Co., Ltd. | Model training method and apparatus, font library establishment method and apparatus, and storage medium |
| JP2022090760A (en) * | 2020-12-08 | 2022-06-20 | 株式会社アイシン | Learning device, creation method of learning data, learning method and learning program |
| KR20230018927A (en) * | 2021-07-30 | 2023-02-07 | 서울대학교산학협력단 | Method for compressing graph convolution network model through knowledge distillation, and apparatus for performing the same |
| CN115761654A (en) * | 2022-11-11 | 2023-03-07 | 中南大学 | Map-oriented neural network accelerated MLP (Multi-level Path) construction method and vehicle re-identification method |
| CN115861903A (en) * | 2023-02-16 | 2023-03-28 | 合肥工业大学智能制造技术研究院 | Weak surveillance video anomaly detection method and system and model training method |
| CN116361719A (en) * | 2023-03-27 | 2023-06-30 | 烟台大学 | Detection method and system for Ethernet phishing user |
| CN116975686A (en) * | 2023-07-21 | 2023-10-31 | 支付宝(杭州)信息技术有限公司 | Method for training student model, behavior prediction method and device |
| CN117150416A (en) * | 2023-10-27 | 2023-12-01 | 烟台大学 | Method, system, medium and equipment for detecting abnormal nodes of industrial Internet |
| CN117315331A (en) * | 2023-09-04 | 2023-12-29 | 中孚安全技术有限公司 | Dynamic graph anomaly detection method and system based on GNN and LSTM |
-
2024
- 2024-01-11 CN CN202410037854.0A patent/CN117555489A/en active Pending
Patent Citations (11)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110020023A (en) * | 2018-12-19 | 2019-07-16 | 大连理工大学 | Net with attributes based on fusion structure feature indicates learning method |
| US20200387782A1 (en) * | 2019-06-07 | 2020-12-10 | Tata Consultancy Services Limited | Sparsity constraints and knowledge distillation based learning of sparser and compressed neural networks |
| JP2022090760A (en) * | 2020-12-08 | 2022-06-20 | 株式会社アイシン | Learning device, creation method of learning data, learning method and learning program |
| KR20230018927A (en) * | 2021-07-30 | 2023-02-07 | 서울대학교산학협력단 | Method for compressing graph convolution network model through knowledge distillation, and apparatus for performing the same |
| US20220147695A1 (en) * | 2021-09-09 | 2022-05-12 | Beijing Baidu Netcom Science Technology Co., Ltd. | Model training method and apparatus, font library establishment method and apparatus, and storage medium |
| CN115761654A (en) * | 2022-11-11 | 2023-03-07 | 中南大学 | Map-oriented neural network accelerated MLP (Multi-level Path) construction method and vehicle re-identification method |
| CN115861903A (en) * | 2023-02-16 | 2023-03-28 | 合肥工业大学智能制造技术研究院 | Weak surveillance video anomaly detection method and system and model training method |
| CN116361719A (en) * | 2023-03-27 | 2023-06-30 | 烟台大学 | Detection method and system for Ethernet phishing user |
| CN116975686A (en) * | 2023-07-21 | 2023-10-31 | 支付宝(杭州)信息技术有限公司 | Method for training student model, behavior prediction method and device |
| CN117315331A (en) * | 2023-09-04 | 2023-12-29 | 中孚安全技术有限公司 | Dynamic graph anomaly detection method and system based on GNN and LSTM |
| CN117150416A (en) * | 2023-10-27 | 2023-12-01 | 烟台大学 | Method, system, medium and equipment for detecting abnormal nodes of industrial Internet |
Non-Patent Citations (2)
| Title |
|---|
| WENQING WAN, ET AL.: "Graph-Based Model Compression for HSR Bogies Fault Diagnosis at IoT Edge via Adversarial Knowledge Distillation", IEEE TRANSACTIONS ON INTELLIGENT TRANSPORTATION SYSTEMS, vol. 25, no. 2, 27 September 2023 (2023-09-27), pages 1787, XP011959465, DOI: 10.1109/TITS.2023.3316793 * |
| ZHAOWEI LIU，ET AL: ""Adaptive multi-channel Bayesian graph attention network for IoT transaction security"", 《DIGITAL COMMUNICATIONS AND NETWORKS》, 16 December 2022 (2022-12-16), pages 1 - 20 * |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN112464292B (en) | Method and device for training neural network based on privacy protection | |
| Wu et al. | Attentive prototype few-shot learning with capsule network-based embedding | |
| Kök et al. | Explainable artificial intelligence (xai) for internet of things: a survey | |
| WO2023010502A1 (en) | Method and apparatus for anomaly detection on graph | |
| Li et al. | A cloud-fog-edge closed-loop feedback security risk prediction method | |
| Gavel et al. | Distributed intrusion detection scheme using dual-axis dimensionality reduction for Internet of things (IoT) | |
| Chen et al. | Generative dynamic link prediction | |
| Talaei Khoei et al. | Deep learning: Systematic review, models, challenges, and research directions | |
| Ugendhar et al. | A novel intelligent-based intrusion detection system approach using deep multilayer classification | |
| Geng et al. | Applying the blockchain-based deep reinforcement consensus algorithm to the intelligent manufacturing model under internet of things | |
| Shadroo et al. | Survey on the application of deep learning in the Internet of Things | |
| Nie et al. | Data and domain knowledge dual‐driven artificial intelligence: Survey, applications, and challenges | |
| Song et al. | Spammer detection using graph-level classification model of graph neural network | |
| Wei et al. | Towards self-explainable graph convolutional neural network with frequency adaptive inception | |
| CN114900435B (en) | Connection relation prediction method and related equipment | |
| CN117555489A (en) | Internet of things data storage transaction anomaly detection method, system, equipment and medium | |
| Wu et al. | Learning deep networks with crowdsourcing for relevance evaluation | |
| Haque et al. | Wireless sensor networks anomaly detection using machine learning: a survey | |
| CN113297500A (en) | Social network isolated node link prediction method | |
| Zhijun et al. | A Novel Learning-Based Attack Detection System for Enhancing Security in Cyber-Physical Environments | |
| Nan et al. | Optimized Extreme Learning Machine by an Improved Harris Hawks Optimization Algorithm for Mine Fire Flame Recognition | |
| Singh et al. | Hybrid optimization algorithm for community and fraud detection in complex networks for high immunity towards link and node failures | |
| Li et al. | Online transferable representation with heterogeneous sources | |
| Arul Jothi et al. | Rule-Based Outlier Detection with a Modified Variational AutoEncoder for Enhancing Data Accuracy in Wireless Sensor Networks | |
| Kalnoor et al. | A Framework Using Markov-Bayes’ Model for Intrusion Detection in Wireless Sensor Network |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |