TWI777676B - Data inspection system for inspecting operating situations of multiple iot devices in a plurality of target iot systems - Google Patents

Abstract

A data inspection system includes: a communication circuit arranged to operably communicate data with a plurality of attributes filtering devices to receive multiple activity records which are generated by the plurality of attributes filtering devices and corresponding to multiple IoT devices in a plurality of target IoT systems; a storage circuit arranged to operably store the multiple activity records received by the communication circuit; and a data classification circuit coupled with the storage circuit and arranged to operably classify each of the multiple activity records received by the communication circuit based on N attributes to form M data groups; wherein N is 2 or an integer greater than 2, while M is at least two times of N.

Description

A data detection system for detecting the operation of a plurality of IoT devices in a plurality of target IoT systems

The present invention relates to the Internet of Things (IoT), in particular to a data detection system for detecting the operation conditions of a plurality of Internet of Things devices in a plurality of target Internet of Things systems.

With the development of technology, various applications related to the massive Internet of Things (mIoT) are becoming more and more popular. In many large-scale IoT applications, telecommunication networks, mobile communication networks, the Internet, or various wireless communication mechanisms are usually used to transmit the relevant operation data of many IoT terminal devices deployed in different locations to remote locations. data center for aggregation and analysis. In other words, between the numerous IoT terminal devices and the data center, various communication infrastructures need to be used as the medium for data transmission.

If there is a problem with some IoT terminal devices or some links in the communication infrastructure, the analysis results of the data center will be biased. Therefore, if abnormal conditions cannot be detected quickly, it is difficult to determine the root cause of problems in large-scale IoT applications, which will greatly reduce the overall system performance and application value of large-scale IoT applications.

In view of this, how to alleviate or eliminate the deficiencies in the above-mentioned related fields is a problem to be solved.

This specification provides an embodiment of an IoT operation monitoring system for monitoring a plurality of The operation of multiple IoT devices in the target IoT system. The Internet of Things operation monitoring system includes: a plurality of attribute filtering devices configured to receive a plurality of packet messages corresponding to the plurality of Internet of Things devices generated by one or more packet gateway devices, and generate according to the plurality of packet messages A plurality of activity records respectively corresponding to the plurality of Internet of Things devices; and a data detection system, which includes: a communication circuit configured to communicate data with the plurality of attribute filtering devices through a network to receive the plurality of attribute filtering devices the multiple activity records generated by an attribute filtering device; a storage circuit configured to store the multiple activity records received by the communication circuit; and a data classification circuit coupled to the storage circuit configured to store the multiple activity records received by the communication circuit Each activity record in the multiple activity records is classified according to the content of the N attributes to form M data groups, and the M data groups are stored in the storage circuit; wherein, N is 2 or greater than An integer of 2, and M is at least twice N.

The present specification further provides an embodiment of a data detection system used in an IoT operation monitoring system, which is used to detect the operation conditions of a plurality of IoT devices in a plurality of target IoT systems. The data detection system includes: a communication circuit configured to communicate data with a plurality of attribute filtering devices through a network, so as to receive a plurality of activities generated by the plurality of attribute filtering devices and corresponding to the plurality of Internet of Things devices record; a storage circuit configured to store the multiple activity records received by the communication circuit; and a data classification circuit, coupled to the storage circuit, configured to store each activity record in the multiple activity records, Classify according to the contents of the N attributes to form M data groups, and store the M data groups in the storage circuit; wherein, N is an integer of 2 or greater, and M is at least two of N times.

One of the advantages of the above embodiment is that the data classification circuit is used to classify multiple activity records corresponding to multiple IoT devices into different data groups according to the content of multiple attributes, which can greatly reduce the subsequent analysis of individual data groups. The computational load and complexity required for the data aspect of the activity record, and the analysis speed of the data aspect is improved.

Another advantage of the above-mentioned embodiment is the aforementioned classification of the plurality of activity records into different data groups The method of grouping can also greatly reduce the amount of computation required for subsequent anomaly detection, which helps to improve the efficiency and speed of anomaly detection.

Other advantages of the present invention will be explained in more detail in conjunction with the following description and drawings.

100: IoT operations monitoring system

101, 102, 103: target IoT system

104, 105, 106: IoT device

110: data inspection system

111: Communication circuit (communication circuit)

112: Data interpreting circuit

113: storage circuit

114: data classification circuit (data classification circuit)

115: Data pattern analysis circuit

116: Abnormal inspection circuit

117: user graphical interface generating circuit (user graphical interface generating circuit)

120, 130, 140: attributes filtering device

122, 132, 142: data processing circuit (data processing circuit)

124, 134, 144: data transmission circuit (data transmission circuit)

150, 160, 170: packet gateway device

152, 162, 172: base station

154, 164, 174, 182, 184: network (network)

192, 194: user device (client device)

202~220, 402~414, 502~514, 602~610, 1002~1022, 1212~1222: Operation process (operation)

310, 1110: packet message (packet message)

311, 1111: header (header)

312~316, 1112~1116: attribute

320~326, 1120: activity record

330~334, 1130~1134: data group

340~344, 1140~1144, 1160~1164: reference data set

710~730, 810~830, 910~930: Statistic graph

712~732, 812~832, 912~932: data statistic result

FIG. 1 is a simplified functional block diagram of an IoT operation monitoring system according to an embodiment of the present invention.

FIG. 2 is a simplified flowchart of an embodiment of a method for classifying and analyzing attributes of IoT devices according to the present invention.

FIG. 3 is a simplified schematic diagram of data flow according to an embodiment of the present invention for classifying and analyzing attributes of IoT devices.

FIG. 4 is a simplified flowchart of an embodiment of a method for classifying multiple activity records according to content of attributes according to an embodiment of the present invention.

FIG. 5 is a simplified flow chart of another embodiment of the method for classifying multiple activity records according to the content of attributes according to the present invention.

FIG. 6 is a simplified flowchart of a method for generating reference data sets corresponding to individual data groups according to an embodiment of the present invention.

7 to 9 are simplified schematic diagrams of statistical charts corresponding to different embodiments of the reference data set generated by the present invention.

FIG. 10 is a simplified flowchart of an embodiment of a method for detecting whether an Internet of Things operation is abnormal according to an embodiment of the present invention.

FIG. 11 is a simplified schematic diagram of data flow according to an embodiment of the present invention for detecting whether the operation of the Internet of Things is abnormal.

FIG. 12 is a simplified flowchart of another embodiment of the method for detecting whether the operation of the Internet of Things is abnormal according to the present invention.

The embodiments of the present invention will be described below with reference to the relevant drawings. In the drawings, the same reference numbers refer to the same or similar elements or method flows.

FIG. 1 is a simplified functional block diagram of an IoT operation monitoring system 100 according to an embodiment of the present invention. The IoT operation monitoring system 100 includes a data detection system 110 and a plurality of attribute filtering devices (eg, the exemplary attribute filtering devices 120 , 130 , and 140 in FIG. 1 ). The IoT operation monitoring system 100 is used to monitor the operation of a plurality of IoT devices in a plurality of different target IoT systems (eg, the exemplary target IoT systems 101 , 102 , and 103 in FIG. 1 ). As shown in Figure 1, each target IoT system includes multiple IoT devices. For example, the target IoT system 101 includes multiple IoT devices 104 , the target IoT system 102 includes multiple IoT devices 105 , and the target IoT system 103 includes multiple IoT devices 106 .

The term "target IoT system" referred to in the description and the scope of the patent application refers to the use of multiple IoT devices deployed in different locations to detect, collect, or generate specific types of data to achieve specific Various IoT application systems for various purposes, such as smart electricity meter system, smart gas meter system, smart street light system, traffic sign management system, logistics monitoring system, smart manufacturing system, remote health monitoring system, infectious disease epidemic statistics system, etc. .

The term "Internet of Things device" as referred to in the specification and the scope of the patent application refers to the ability to detect, collect, or generate specific types of data, and to communicate data with neighboring base stations using wireless access technology Various electronic devices, such as smart electricity meters, smart gas meters, smart street lights, traffic signal monitoring circuits, electronic labels in logistics monitoring systems, mobile communication devices in logistics monitoring systems, and machine operation monitoring devices in smart manufacturing systems , wearable health monitoring devices, epidemic data receiving devices, etc.

In practical applications, the applications of the aforementioned target IoT systems 101 , 102 , and 103 may be different, and the number of IoT devices in different target IoT systems may also be different. The target IoT systems 101, 102, and 103 can all be IoT systems of various scales, and the number of IoT devices in each target IoT system ranges from single digits, dozens, hundreds, or even more. Thousands or more are possible. In other words, The target IoT systems 101, 102, and 103 may also be various types of massive Internet of Things (mIoT) systems.

All IoT devices in each target IoT system may be located in the same geographic area (eg, same building, same block, same street, same township, same city, etc.), or are scattered in different geographic areas (eg, different buildings, different blocks, different streets, different townships, or different cities, etc.). In addition, individual IoT devices can be installed in fixed locations or on moving objects.

During the operation of the aforementioned target IoT systems 101 , 102 , and 103 , individual IoT devices can use Radio Access Technology (RAT) to directly connect to nearby base stations for various data communications, or Through other communication equipment, it is indirectly connected to the neighboring base station for various data communication. The base station transmits the data from the individual IoT devices to the back-end IoT operation monitoring system 100 via the relevant packet gateway device for processing and analysis. The aforementioned wireless access technologies can be various 2nd Generation (2G) mobile communication technologies, various 3rd Generation (3G) mobile communication technologies, and various 4th Generation (4G) mobile communication technologies , various 5th Generation (5G) mobile communication technologies, various Internet-of-Thing (IoT) communication technologies, various Narrow Band Internet of Things (NB-IoT) communication technologies, various vehicle International (Vehicle-to-Vehicle) communication technology, various Vehicle-to-Everything (V2X) communication technologies, various satellite communication technologies, or various wireless communication technologies released by other standard-setting organizations.

For example, in the embodiment of FIG. 1 , the individual IoT devices 104 in the target IoT system 101 can be directly or indirectly connected to a base station 152 for data communication, and the base station 152 transmits data from the IoT device 104 The data is transmitted to the back-end IoT operation monitoring system 100 through a packet gateway device 150 for processing and analysis. Individual IoT devices 105 in the target IoT system 102 may be directly or indirectly connected to a base station 162 for For data communication, the base station 162 transmits the data from the IoT device 105 to the back-end IoT operation monitoring system 100 via the packet gateway device 160 for processing and analysis. The individual IoT devices 106 in the target IoT system 103 can be directly or indirectly connected to a base station 172 for data communication, and the base station 172 transmits data from the IoT device 106 through a packet gateway device 170 It is sent to the back-end IoT operation monitoring system 100 for processing and analysis.

In other words, the aforementioned packet gateway devices 150 - 170 and the base stations 152 - 172 jointly play the role of a data transmission bridge between the IoT operation monitoring system 100 and the target IoT systems 101 , 102 , and 103 .

Please note that the number of attribute filtering devices, the number of target IoT systems, the number of IoT devices in individual target IoT systems, the number of base stations, and the number of packet gateway devices shown in FIG. 1 are only It is not intended that the number of the aforementioned devices or systems be limited to a particular number in order to facilitate the illustrative examples of the drawings. For example, in practical applications, there may be multiple base stations and/or multiple packet gateway devices serving as data transmission bridges between each target IoT system and the IoT operation monitoring system 100 .

As shown in FIG. 1 , the data detection system 110 in the IoT operation monitoring system 100 includes a communication circuit 111 , a data interpretation circuit 112 , a storage circuit 113 , a data classification circuit 114 , and a data pattern analysis circuit 115 , an abnormality detection circuit 116 , and a user graphic interface generation circuit 117 . The attribute filtering device 120 includes a data processing circuit 122 and a data transmission circuit 124 . The attribute filtering device 130 includes a data processing circuit 132 and a data transmission circuit 134 . The attribute filtering device 140 includes a data processing circuit 142 and a data transmission circuit 144 .

The attribute filtering devices 120, 130, and 140 are all configured to receive a plurality of packet messages corresponding to a plurality of Internet of Things devices generated by one or more packet gateway devices, and can generate a plurality of packet messages according to the received plurality of packet messages. Multiple activity records corresponding to multiple IoT devices. In practical applications, multiple packet messages generated by each packet gateway device may correspond to different IoT devices in a single target IoT system, or may are different IoT devices in the multiple target IoT systems. In other words, the multiple packet messages received by each attribute filtering device may correspond to different IoT devices in a single target IoT system, or may correspond to different IoT devices in multiple target IoT systems .

For example, the attribute filtering device 120 can receive, through the network 154 , a plurality of packet messages corresponding to the plurality of IoT devices 104 generated by one or more packet gateway devices 150 corresponding to the target IoT system 101 , and can receive a plurality of packet messages corresponding to the plurality of IoT devices 104 . A plurality of received packet messages generate a plurality of activity records corresponding to the plurality of IoT devices 104 respectively. The attribute filtering device 130 can receive, through the network 164, a plurality of packet messages corresponding to the plurality of IoT devices 105 generated by one or more packet gateway devices 160 corresponding to the target IoT system 102, The plurality of packet messages generate a plurality of activity records corresponding to the plurality of IoT devices 105 respectively. The attribute filtering device 140 can receive, through the network 174, a plurality of packet messages corresponding to the plurality of IoT devices 106 generated by one or more packet gateway devices 170 corresponding to the target IoT system 103, The plurality of packet messages generate a plurality of activity records corresponding to the plurality of IoT devices 106 respectively.

In practice, the aforementioned networks 154, 164, and 174 can be implemented by various private networks (eg, the intranet of a telecommunication company, or other dedicated communication networks, etc.), or the Internet can be used. to fulfill.

The data detection system 110 can detect the operation status of a plurality of IoT devices in the target IoT systems 101 , 102 , and 103 according to the activity records generated by the attribute filtering devices 120 , 130 , and 140 .

In the data detection system 110, the communication circuit 111 is configured to perform data communication with the aforementioned attribute filtering devices 120, 130, and 140 through the network 182, so as to receive multiple activities generated by the attribute filtering devices 120, 130, and 140. record. The aforementioned network 182 can be implemented by various private networks (eg, the intranet of a telecommunication company, or other dedicated communication networks, etc.), and can also be implemented by the Internet.

The data interpretation circuit 112 is coupled to the communication circuit 111 and configured to be capable of deciphering the communication circuit 111 The information received to obtain the above-mentioned multiple activity records.

The storage circuit 113 is coupled to the communication circuit 111 and configured to store the activity records received by the communication circuit 111 .

The data classification circuit 114 is coupled to the storage circuit 113, and is configured to classify each activity record in the plurality of activity records according to the content of a certain number of attributes to form a plurality of data groups.

The data pattern analysis circuit 115 is coupled to the storage circuit 113, and is configured to analyze the data patterns of a plurality of activity records in an individual data group during a data collection period, so as to generate one or more data patterns corresponding to the individual data groups. A reference data set is generated, and the generated reference data set is stored in the storage circuit 113 .

The abnormality detection circuit 116 is coupled to the storage circuit 113 , and is configured to detect whether the operation of a plurality of IoT devices in the aforementioned target IoT systems 101 , 102 , and 103 occurs according to the reference data set stored in the storage circuit 113 . exception, and generate corresponding one or more alarm messages when an abnormal situation occurs.

The user graphic interface generating circuit 117 is coupled to the communication circuit 111 , the storage circuit 113 , and the abnormality detection circuit 116 , and is configured to present the alarm information generated by the abnormality detection circuit 116 to the user in an appropriate visual manner.

In the embodiment of FIG. 1 , the data detection system 110 may also receive data related to a plurality of IoT devices in the target IoT system 101 , 102 , or 103 from other external devices.

For example, an operator, administrator, and/or other user of the target IoT system 101 , 102 , or 103 may connect a plurality of IoTs in the target IoT system 101 , 102 , or 103 to the Internet of Things The device is divided into a plurality of sites (sites) according to the geographical location, and different corresponding identification data (hereinafter referred to as site identification data, site ID) are respectively assigned to the IoT devices in different sites. Operators, managers, and/or other users of the aforementioned subject IoT systems 101 , 102 , or 103 may utilize suitable user devices (eg, exemplary user devices 192 and/or 194 in FIG. 1 ) through the Internet Road 184 is connected to the data detection system 110, and provides the target IoT systems 101, 102, Or the case identification data corresponding to the individual IoT devices in 103 are sent to the data detection system 110 . The aforementioned network 184 may be implemented by the Internet, and may also be implemented by various private networks (eg, the intranet of a telecommunication company, or other dedicated communication networks, etc.).

In this case, the communication circuit 111 and the data interpretation circuit 112 will receive and process the case identification data of the individual IoT devices transmitted from the user devices 192 and/or 194, and will correspond to different cases of different IoT devices. The identification data is stored in the storage circuit 113 .

In some embodiments, operators, managers, auditors, and/or other users of the aforementioned subject IoT systems 101 , 102 , or 103 may also utilize suitable user devices (eg, FIG. The exemplary user device 192 or 194 in 1) is connected to the data detection system 110 through the network 184 to inquire about the operation status of the relevant target IoT system, or to the aforementioned target IoT system 101, 102 or 103 issues various control commands. In this case, the communication circuit 111 of the data detection system 110 can perform data communication with these user devices through the network 184, so as to provide the webpage or control interface generated by the user graphic interface generation circuit 117 to these user devices, so that the individual target Operators, managers, auditors, and/or other users of the IoT system can perform related operations on these web pages or control interfaces.

In practice, the communication circuit 111 can be implemented by various wired transmission circuits, wireless transmission circuits, a hybrid circuit integrating the aforementioned two communication mechanisms, or a cloud communication system.

The data interpretation circuit 112 can use various packet demodulation circuits, digital operation circuits, microprocessors, combinations of microprocessors, application specific integrated circuits (ASICs), or cloud applications with packet analysis capabilities module to achieve. In practice, the data interpretation circuit 112 can also be integrated into the communication circuit 111 or the data classification circuit 114 .

The data classification circuit 114, the data pattern analysis circuit 115, and the anomaly detection circuit 116 can all use a single processor module with data computing capability, a combination of multiple processor modules, a single computer system, a combination of multiple computer systems, It can be implemented by a single server, a combination of multiple servers, or a cloud computing system.

The storage circuit 113 can be implemented by various non-volatile storage devices, database systems, or cloud storage systems.

The user graphic interface generation circuit 117 can use various single processor module with image processing capability, combination of multiple processor modules, single image processing circuit, combination of multiple image processing circuits, single computer system, combination of multiple computer systems, It can be implemented by a single server, a combination of multiple servers, or a cloud processing system.

In practice, the different functional blocks in the aforementioned data detection system 110 can be implemented by different circuits or different cloud application modules respectively, and can also be integrated into a single server system or a single cloud computing system.

The data processing circuits 122, 132, and 142 can be implemented by various single computer systems with data communication capability and data processing capability, a combination of multiple computer systems, a single server, a combination of multiple servers, or a cloud computing system .

The data transmission circuits 124 , 134 , and 144 can be implemented by various wired transmission circuits, wireless transmission circuits, hybrid circuits integrating the aforementioned two communication mechanisms, or cloud communication systems.

In practice, different functional blocks in the aforementioned individual attribute filtering devices can be implemented by different circuits or different cloud application modules, or can be integrated into a single computer system, a single server system, or a single cloud computing system. .

In addition, the above-mentioned user devices 192 and 194 can be implemented by devices that have networking capabilities and can execute browsers or related applications to log in to the data detection system 110 for operation, such as various computers, servers, mobile communication devices ( such as smart phones, wearable devices), or other similar devices.

2 to 3 to further illustrate the manner in which the IoT operation monitoring system 100 collects and classifies the relevant operation data of the multiple IoT devices in the target IoT systems 101 , 102 , and 103 . FIG. 2 is a simplified flowchart of an embodiment of a method for classifying and analyzing attributes of IoT devices according to the present invention. FIG. 3 is a simplified schematic diagram of data flow according to an embodiment of the present invention for classifying and analyzing attributes of IoT devices.

In the flowchart of FIG. 2 , the process in the column to which a specific device belongs represents the process performed by the specific device. For example, the part marked in the "Packet Gateway Device" field is the process performed by the packet gateway devices 150, 160, and 170; the part marked in the "Attribute Filter Device" field is filtered by the attribute The process performed by the devices 120 , 130 , and 140 ; the part marked in the “Data Detection System” field is the process performed by the data detection system 110 . The aforementioned logic is also applicable to other subsequent flowcharts.

For the convenience of description, the operation method of FIG. 2 will be described below by taking the manner in which the IoT operation monitoring system 100 collects and classifies the related operation data of the multiple IoT devices in the target IoT system 101 as an example.

During operation, the individual IoT devices 104 in the target IoT system 101 will generate and transmit relevant authentication requests to the neighboring base stations 152 to request authorization for network use. At this time, the base station 152 will transmit the authentication request from the individual IoT device 104 to the relevant packet gateway device 150 for processing.

In this case, the packet gateway device 150 will perform the process 202 in FIG. 2 to receive an authentication request generated by the individual IoT device 104 through the base station 152 .

In the process 204, the packet gateway device 150 may perform an authentication procedure of the individual IoT device 104 according to the received authentication request. After the authentication process is completed, the individual IoT devices 104 in the target IoT system 101 can obtain the authorization qualification for network use, and communicate with the remote background system (back -end system) for various data communication or command transmission. The aforementioned background system may be the data detection system 110 or other application control systems (not shown in FIG. 1 ).

In practice, different IoT devices in the target IoT system 101 may perform the authentication procedure in the same time period, or may perform the authentication procedure in different time periods.

During the operation of the target IoT system 101, the packet gateway device 150 will receive intermittent The process 206 is also performed intermittently for the relevant data transmitted to the individual IoT devices 104 .

In the process 206 , the packet gateway device 150 generates and transmits a packet message including multiple attributes of the individual IoT device 104 to the corresponding attribute filtering device 120 . The packet gateway device 150 can integrate various attributes related to the individual IoT device 104 into a packet message 310 in an appropriate data format. In other words, each packet message 310 corresponds to a certain IoT device 104 in the target IoT system 101 . As shown in FIG. 3, the packet message 310 includes a header 311 and various attributes (eg, the exemplary attributes 312, 313, 314, 315, and 316 shown in FIG. 3) stored in different data fields.

The attributes recorded in the packet message 310 by the packet gateway device 150 may include a packet time, a session ID, a network address of the IoT device 104, A device identification data (device ID) of the Internet-connected device 104 , a user identification data (group ID) corresponding to the IoT device 104 , a device status data (device status) of the IoT device 104 , and an uplink of the IoT device 104 Uplink throughput, downlink throughput of the IoT device 104, a base station ID of the base station 152, and/or a service type of the IoT device 104, etc. Various related information. The aforementioned user identification data may also be an access point name (APN). In addition, in the embodiment in which a subscriber identity module (SIM) is built in the IoT device 104, the aforementioned device identification data may also be the number (SIM number) of the subscriber identity module.

In some embodiments, the attributes of the packet gateway device 150 recorded in the packet message 310 may also include a packet gateway ID of the packet gateway device 150 and/or the data of the IoT device 104 . A connection time (session time). The aforementioned packet gateway identification data may also be the network address of the packet gateway device 150 .

In practice, the packet gateway device 150 may also record other attributes or data related to the individual IoT device 104 in the packet message 310 according to the application purpose of the target IoT system 101 . The packet gateway device 150 may include multiple attributes of an individual IoT device 104 The packetized message 310 is implemented in various suitable forms of packets. For example, in some embodiments, the packet message 310 generated by the packet gateway device 150 may be implemented in the form of an Accounting-Request Packet.

For the convenience of understanding the description of the following process, it is assumed here that the multiple attributes included in the packet message 310 generated by the packet gateway device 150 in the process 206 are the same as those of a certain IoT device 104 in the target IoT system 101 (hereinafter referred to as It is an attribute related to the target IoT device 104).

In the process 208 , the data processing circuit 122 of the attribute filtering device 120 receives and parses the packet message 310 transmitted from the packet gateway device 150 through the network 154 .

Next, the data processing circuit 122 may perform the process 210 to generate an activity record 320 corresponding to the target IoT device 104 according to some attributes in the packet information 310 .

As shown in FIG. 3 , after receiving the packet message 310 from the attribute filtering device 120 , the data processing circuit 122 parses and extracts the aforementioned multiple attributes recorded in the packet message 310 . Next, the data processing circuit 122 filters out some attributes (eg, the exemplary attributes 313, 314, and 316 shown in FIG. 3) from the multiple attributes extracted, and generates corresponding objects according to these attributes. Activity log 320 of networked device 104 .

In other words, the activity record 320 generated by the data processing circuit 122 does not include all the attributes recorded in the packet information 310 , but only includes some attributes recorded in the packet information 310 .

For example, the data processing circuit 122 can process a device identification data of the target IoT device 104 recorded in the packet message 310, a user identification data corresponding to the target IoT device 104, a device status data of the target IoT device 104, An upstream traffic of the target IoT device 104 , downstream traffic of the target IoT device 104 , and a base station identification data of the base station 152 are integrated into an activity record 320 corresponding to the target IoT device 104 in an appropriate data format.

In some embodiments, the data processing circuit 122 may further convert the packet gateway identification data of the packet gateway device 150 recorded in the packet message 310 and/or the target IoT device 104 The connection time of the target IoT device 104 is also integrated into the activity record 320 corresponding to the target IoT device 104 .

Obviously, the number of attributes recorded in the activity record 320 generated by the data processing circuit 122 will be less than the number of attributes recorded in the packet message 310 .

In the process 212 , the data transmission circuit 124 of the attribute filtering device 120 can transmit one or more activity records generated by the data processing circuit 122 to the data detection system 110 through the network 182 .

In this case, the communication circuit 111 of the data detection system 110 will perform the process 214 to receive one or more activity records from the attribute filtering device 120 . As mentioned above, the data interpretation circuit 112 can interpret the activity records received by the communication circuit 111 to extract relevant data in each activity record, that is, the aforementioned multiple attributes recorded in each activity record.

In practice, each time the data processing circuit 122 generates an activity record, the data transmission circuit 124 can immediately perform the process 212 to transmit the activity record to the data detection system 110 .

Alternatively, the data transmission circuit 124 can also wait until the activity records generated by the data processing circuit 122 are accumulated to a predetermined number, and then perform the aforementioned process 212 in batches. For example, the data transmission circuit 124 may be configured to accumulate 10, 30, 50, 100, 300, 500, 700, 1000, 1500, or 2000 activity records generated by the data processing circuit 122 These activity records are transmitted to the data detection system 110 in batches only when the pen is written.

Alternatively, the data transmission circuit 124 may also perform the activity record transmission operation of the process 212 intermittently or periodically. For example, the data transmission circuit 124 may be set to every 1 second, 3 seconds, 5 seconds, 10 seconds, 15 seconds, 30 seconds, 60 seconds, 100 seconds, 3 minutes, 5 minutes, 10 minutes, 20 minutes, 30 minutes, At a suitable time interval such as 1 hour or 1.5 hours, the activity records accumulated at that time are periodically transmitted to the data detection system 110 .

In the embodiment of FIG. 3 , the data transmission circuit 124 is generated by the data processing circuit 122 A plurality of activity records (eg, the exemplary activity records 320 , 322 , 324 , and 326 shown in FIG. 3 ) are transmitted to the data detection system 110 via the network 182 in batches.

The packet gateway device 150 repeats the aforementioned processes 202 to 206 to generate and transmit a number of packet messages corresponding to other IoT devices in the target IoT system 101 to the attribute filtering device 120 . The attribute filtering device 120 also repeats the aforementioned process 208 to process 212 to generate and transmit to the data detection system 110 many activity records corresponding to other IoT devices in the target IoT system 101 .

On the other hand, other packet gateway devices (eg, the aforementioned packet gateway devices 160 and 170 ) and other attribute filtering devices (eg, the aforementioned attribute filtering devices 130 and 140 ) in the IoT operation monitoring system 100 can be Work in the same way as before.

For example, the packet gateway device 160 may repeat the process 202 to the process 206 according to the operation mode of the packet gateway device 150 described above, so as to generate and transmit a number of packet messages corresponding to the plurality of IoT devices 105 in the target IoT system 102 to Attribute filtering means 130 . The attribute filtering device 130 can repeat the process 208 to the process 212 according to the operation mode of the aforementioned attribute filtering device 120 to generate and transmit a number of activity records corresponding to the multiple IoT devices 105 in the target IoT system 102 to the data detection system 110.

For another example, the packet gateway device 170 may repeat the process 202 to the process 206 according to the operation mode of the packet gateway device 150 to generate and transmit a number of packet messages corresponding to the multiple IoT devices 106 in the target IoT system 103 to the attribute filtering means 140. The attribute filtering device 140 can repeat the process 208 to the process 212 according to the operation mode of the aforementioned attribute filtering device 120 to generate and transmit a number of activity records corresponding to the multiple IoT devices 106 in the target IoT system 103 to the data detection system 110.

Therefore, the communication circuit 111 of the data detection system 110 will successively receive many activity records generated by the attribute filtering devices 120 , 130 , and 140 .

On the other hand, the data classification circuit 114 will perform the process 216 to classify each activity record among the plurality of activity records successively received by the communication circuit 111 according to the content of the plurality of attributes to form a plurality of data groups .

The operation of the data classification circuit 114 to classify the plurality of activity records according to the content of the attributes in the process 216 will be further described below with reference to FIG. 4 and FIG. 5 . FIG. 4 is a simplified flowchart of an embodiment of a method for classifying multiple activity records according to content of attributes according to an embodiment of the present invention. FIG. 5 is a simplified flow chart of another embodiment of the method for classifying multiple activity records according to the content of attributes according to the present invention.

When the data classification circuit 114 performs the aforementioned process 216, the method shown in FIG. 4 can be used to classify the plurality of activity records successively received by the communication circuit 111 according to the content of the plurality of attributes to form a plurality of data groups.

In order to facilitate the description with the data flow diagram of FIG. 3 , it is assumed that the multiple activity records to be classified by the data classification circuit 114 also include the aforementioned activity records 320 , 322 , 324 , and 326 .

In practice, the data classification circuit 114 can use some attributes recorded in each activity record as the classification basis of the activity record.

For example, in some embodiments, the data classification circuit 114 may use two attributes of the base station identification data and the user identification data recorded in each activity record as the classification basis.

In other embodiments, the data classification circuit 114 may use three attributes of base station identification data, user identification data, and packet gateway identification data recorded in each activity record as the classification basis.

In the process 402, the data classification circuit 114 may select one of the plurality of activity records received by the communication circuit 111 as a current activity record.

In the process 404, the data classification circuit 114 may select one of the attributes of the current activity record as a selected attribute. In operation, the data classification circuit 114 can select one of the attributes in the current activity record that can be used as the basis for classification as the selected attribute.

In the process 406 , the data classification circuit 114 can determine whether the storage circuit 113 exists with the The data group corresponding to the content of the selected attribute. If a data group corresponding to the content of the selected attribute already exists in the storage circuit 113 at that time, the data classification circuit 114 may proceed to the process 408 . On the contrary, if the data group corresponding to the content of the selected attribute does not exist in the storage circuit 113 at that time, the data classification circuit 114 may proceed to the process 410 .

In process 408, the data classification circuit 114 may classify the current activity record into data groups corresponding to the content of the selected attribute.

In process 410, the data classification circuit 114 may create a new data group corresponding to the content of the selected attribute, and classify the current activity record into the newly created data group.

After performing the aforementioned process 408 or process 410 , if there are other attributes to be used as a basis for classification in the current activity record, the data classification circuit 114 may proceed to process 412 . On the contrary, if there are no other attributes used as the basis for the classification in the current activity record, the data classification circuit 114 may proceed to the process 414 .

In the process 412, the data classification circuit 114 may select another attribute in the current activity record as the selected attribute, and then repeat the aforementioned process 406 and subsequent processes.

In the process 414, the data classification circuit 114 may select the next activity record as the new current activity record, and then repeat the foregoing process 404 and subsequent processes.

For example, the data classification circuit 114 may select the activity record 320 as the current activity record in the process 402 , and may select the base station identification data recorded in the activity record 320 as the selected attribute in the process 404 .

Assuming that the content of the base station identification data recorded in the activity record 320 is the base station identification data BS-152 corresponding to the base station 152, the data classification circuit 114 will check whether the storage circuit 113 already exists and selected in the process 406. The content of the attribute (eg, the base station identification data BS-152 in this example) corresponds to the data group.

If a data group 330 corresponding to the base station identification data BS-152 already exists in the storage circuit 113 at that time, the data classification circuit 114 can perform the process 408 to record the current activity (eg, the activity record 320 in this example). ) into the data group 330. On the contrary, if the storage circuit 113 does not have the base station identification data RS-152 at that time the corresponding data group, the data classification circuit 114 can perform the process 410 to create a new data group 330 corresponding to the base station identification data BS-152, and record the current activity (eg, the activity record 320 in this example) ) into the newly created data group 330.

In this example, since the activity record 320 also has other attributes to be used as the basis for classification, the data classification circuit 114 can further perform the process 412 to select the activity record 320 after classifying the activity record 320 into the data group 330 . Another attribute that can be used as the basis for classification is used as the selected attribute, and the foregoing process 406 and subsequent processes are repeated.

For the convenience of description, it is assumed here that the data classification circuit 114 selects the user identification data recorded in the activity record 320 as the selected attribute in the process 412, and the content of the user identification data corresponds to a first specific user (for example, a certain user). Identification data APN-A of a power company, a logistics company, a street light management agency, etc.). In this case, the data classification circuit 114 checks whether there is a data group corresponding to the identification data APN-A in the storage circuit 113 at that time in the process 406 .

If a data group 332 corresponding to the identification data APN-A already exists in the storage circuit 113 at that time, the data classification circuit 114 can perform the process 408 to classify the activity record 320 into the data group 332 . On the contrary, if the data group corresponding to the identification data APN-A does not exist in the storage circuit 113 at that time, the data classification circuit 114 may perform the process 410 to create a new data group 332 corresponding to the identification data APN-A, and Activity records 320 are sorted into newly created data groups 332 .

If the activity record 320 also records the packet gateway identification data that can be used as the basis for classification, the data classification circuit 114 may perform the process 412 again after classifying the activity record 320 into the data group 332 to select the activity record 320 The packet gateway identification data recorded in is used as the selected attribute, and the foregoing process 406 and subsequent processes are repeated according to the foregoing method. In this way, the activity records 320 are finally classified into three different data groups.

As can be seen from the foregoing description, if the data classification circuit 114 is based on the records in the activity record 320 The activity records 320 are classified by the N attributes contained therein, and then the activity records 320 are finally classified into N different data groups.

As mentioned above, if there are no other attributes in the activity record 320 as the basis for classification, the data classification circuit 114 can perform the process 414 to select the next activity record as the new current activity record, and then repeat the above-mentioned process process 404 and subsequent processes.

For example, the data classification circuit 114 may select the activity record 322 as the new current activity record in the process 402 , and may select the base station identification data recorded in the activity record 322 as the selected attribute in the process 404 .

Here, it is assumed that the content of the base station identification data recorded in the activity log 322 is the identification data BS-152 of the base station 152 . In the process 406, the data classification circuit 114 checks whether a data group corresponding to the content of the selected attribute (eg, the identification data BS-152 of the base station 152 in this example) already exists in the storage circuit 113 at that time.

Since the data group 330 corresponding to the identification data BS-152 already exists in the storage circuit 113 at that time, the data classification circuit 114 can perform the process 408 to classify the activity record 322 into the data group 330 .

Since there are other attributes in the activity record 322 to be used as the basis for classification, the data classification circuit 114 can further perform the process 412 after classifying the activity record 322 into the data group 330 to select the activity record 322 that can be used for classification Another basic attribute is used as the selected attribute, and the foregoing process 406 and subsequent processes are repeated.

For ease of description, it is assumed here that the data classification circuit 114 selects the user identification data recorded in the activity record 322 as the selected attribute in the process 412, and the content of the user identification data is the identification data APN- corresponding to a second specific user. B. In this case, in the process 406, the data classification circuit 114 checks whether the data group corresponding to the identification data APN-B already exists in the storage circuit 113 at that time.

If a data group 334 corresponding to the identification data APN-B already exists in the storage circuit 113 at that time, the data classification circuit 114 can perform the process 408 to classify the activity record 322 into the data group 334 . On the contrary, if the storage circuit 113 does not exist and identify A data group corresponding to the data APN-B, the data classification circuit 114 may perform the process 410 to create a new data group 334 corresponding to the identification data APN-B, and classify the activity record 322 into the newly created data group 334 middle.

Similarly, if the activity record 322 also records the packet gateway identification data that can be used as the basis for classification, the data classification circuit 114 may perform the process 412 again after classifying the activity record 322 into the data group 334 to select The packet gateway identification data recorded in the activity record 322 is used as the selected attribute, and the aforementioned process 406 and subsequent processes are repeated according to the aforementioned method. In this way, the activity records 322 are finally classified into three different data groups.

The data classification circuit 114 can use the method of FIG. 4 to classify other activity records received by the communication circuit 111 in the same manner as described above.

For example, as shown in FIG. 3, if the content of the base station identification data in the activity record 324 is the base station identification data BS-152, and the content of the user identification data in the activity record 324 is the identification data APN-B, the data classification The circuit 114 classifies the activity records 324 into the data group 330 and the data group 334 according to the aforementioned classification method.

For another example, if the content of the base station identification data in the activity record 326 is the base station identification data BS-152, and the content of the user identification data in the activity record 326 is the identification data APN-A, the data classification circuit 114 will Activity records 326 are classified into data group 330 and data group 332 according to the classification method.

In addition to the aforementioned method in FIG. 4 , the data classification circuit 114 may also use other methods to perform the aforementioned process 216 . For example, FIG. 5 is a simplified flow chart of another embodiment of the method for classifying multiple activity records according to the content of attributes of the present invention. Another operation of the data classification circuit 114 to classify the plurality of activity records according to the content of the attribute in the process 216 will be further described below with reference to FIG. 5 .

In the embodiment of FIG. 5, the data classification circuit 114 can also use some attributes recorded in the activity record (for example, the aforementioned base station identification data, user identification data, and/or packet gateway identification data, etc.) The classification basis for activity records.

In the process 502, the data classification circuit 114 may select one of the aforementioned attributes to be used as the basis for classifying the activity record as the first selected attribute. For example, the data classification circuit 114 may select the aforementioned user identification data as the first selected attribute.

In the process 504, the data classification circuit 114 may generate a plurality of corresponding data groups according to different contents of the first selected attribute, and classify the plurality of activity records received by the communication circuit 111 into the plurality of data groups, to ensure that the content of the first selected attribute is the same in all activity records within the same data group.

During operation, the data classification circuit 114 can check how many different contents of the first selected attribute recorded in the plurality of activity records, and then create a corresponding number of data groups. For example, if the first selected attribute is user identification data, and the user identification data recorded in the multiple activity records has a total of 10 different contents, the data classification circuit 114 can establish user identification data corresponding to the 10 different contents respectively. 10 data groups (hereinafter referred to as the first attribute data group). Next, the data classification circuit 114 can classify the activity records with different contents of the user identification data into different first attribute data groups, so that the content of the user identification data in all the activity records in the same first attribute data group all the same. Under normal circumstances, each first attribute data group contains a plurality of activity records, but the number of activity records in different first attribute data groups may be different.

In process 506, the data classification circuit 114 may select another attribute to be used as a basis for classification as a second selected attribute. For example, the data classification circuit 114 may select the aforementioned base station identification data as the second selected attribute.

In the process 508, the data classification circuit 114 may generate a plurality of corresponding data groups according to different contents of the second selected attribute, and classify the plurality of activity records received by the communication circuit 111 into the plurality of data groups, to ensure that the content of the second selected attribute is the same in all activity records within the same data group.

For example, if the second selected attribute is base station identification data, and the base station identification data recorded in the plurality of activity records has five different contents, the data classification circuit 114 may Five data groups (hereinafter referred to as second attribute data groups) corresponding to the base station identification data of the five different contents are established. Next, the data classification circuit 114 can classify the activity records with different contents of the base station identification data into different second attribute data groups, so that the base station identifications in all the activity records in the same second attribute data group The content of the data is the same. Likewise, under normal circumstances, each second attribute data group contains a plurality of activity records, but the number of activity records in different second attribute data groups may be different.

After performing the aforementioned process 508, the data classification circuit 114 will determine whether there are other attributes to be used as the basis for classifying the data group. If there are no other attributes on which to base the data group classification, the data classification circuit 114 may proceed to process 510 . Conversely, if there are other attributes to be used as a basis for classifying the data group, the data classification circuit 114 may proceed to process 512 .

In process 510 , the data classification circuit 114 may wait for other activity records from the attribute filtering devices 120 , 130 , and 140 .

In process 512, the data classification circuit 114 may select another attribute to be used as a basis for classification as the next selected attribute.

In the process 514, the data classification circuit 114 may generate a plurality of corresponding data groups according to different contents of the next selected attribute, and classify the plurality of activity records received by the communication circuit 111 into the plurality of data groups, to ensure that the content of the next selected attribute is the same in all activity records within the same data group.

For example, if the multiple activity records received by the communication circuit 111 also record the packet gateway identification data that can be used as the basis for classification, the data classification circuit 114 can perform the process 512 to select the packet gateway identification data as the following a selected attribute. If there are three different contents of the packet gateway identification data recorded in the multiple activity records, the data classification circuit 114 may create three data corresponding to the packet gateway identification data of the three different contents in the process 514 respectively. group (hereinafter referred to as the third attribute data group). Then, the data classification circuit 114 can classify the activity records with different contents of the packet gateway identification data into They are classified into different third attribute data groups, so that the content of the packet gateway identification data in all activity records in the same third attribute data group is the same. Likewise, under normal circumstances, each third attribute data group contains a plurality of activity records, but the number of activity records in different third attribute data groups may be different.

After the process 514 is performed, the data classification circuit 114 will again determine whether there are other attributes to be used as the basis for classifying the data group. If there are no other attributes on which to base the data group classification, the data classification circuit 114 may proceed to process 510 . On the contrary, if there are other attributes to be used as the basis for classifying the data group, the data classification circuit 114 can repeat the operations of the aforementioned process 512 and process 514, and continue to classify the multiple data received by the communication circuit 111 according to the content of the other attributes. Activity records are sorted until all attributes to be used as a basis for sorting are used up.

The data classification circuit 114 can use the method of FIG. 5 to classify other activity records subsequently received by the communication circuit 111 in the same manner as described above.

It can be seen from the flow charts in FIGS. 4 and 5 that the content of the same attribute recorded in different activity records may be different, so the data classification circuit 114 filters the attributes generated by the attribute filtering devices 120 , 130 and 140 . After each activity record is classified according to the contents of the N attributes, M data groups will be formed, wherein N is an integer of 2 or greater, and M is at least twice as large as N. If there are more than two possibilities for the content of individual attributes in different activity records, M will be a higher multiple of N.

As mentioned above, the data detection system 110 may receive data related to the target IoT system 101 , 102 , or 103 from the external user devices 192 and/or 194 . When performing the process 216 of FIG. 2 , the data classification circuit 114 may also use the data provided by the user devices 192 and/or 194 as an additional classification basis for the aforementioned multiple activity records.

For example, in some embodiments in which data detection system 110 receives field identification data from user devices 192 and/or 194 corresponding to individual IoT devices in target IoT systems 101 , 102 , or 103 , data classification Circuit 114 may treat the scene identification data as An additional attribute that can be used as the basis for the classification of the aforementioned multiple activity records.

If the data classification circuit 114 uses the method of FIG. 4 to classify multiple activity records, then when the data classification circuit 114 is classifying each current activity record, the data classification circuit 114 can determine whether the storage circuit 113 exists. The data group corresponding to the content of the scene identification data in the current activity record. If a data group corresponding to the content of the crime scene identification data already exists in the storage circuit 113 at that time, the data classification circuit 114 may proceed to process 408 to classify the current activity record into a data group corresponding to the content of the crime scene identification data middle. On the contrary, if the data group corresponding to the content of the field identification data does not exist in the storage circuit 113 at that time, the data classification circuit 114 may proceed to the process 410 to create a new data group corresponding to the content of the field identification data, And classify the current activity record into the newly created data group.

If the data classification circuit 114 uses the method shown in FIG. 5 to classify multiple activity records, the data classification circuit 114 can check the number of different contents of the case identification data recorded in the multiple activity records, and then establish The corresponding number of multiple data groups. For example, assuming that there are 120 different contents of the crime scene identification data recorded in the multiple activity records, the data classification circuit 114 can create 120 data groups corresponding to the crime scene identification data of the 120 different contents (the following It is called the fourth attribute data group). Next, the data classification circuit 114 can classify the activity records with different contents of the crime scene identification data into different fourth attribute data groups, so that the crime scene identification in all the activity records in the same fourth attribute data group The content of the data is the same. Similar to the above description, each fourth attribute data group will contain a plurality of activity records, but the number of activity records in different fourth attribute data groups may be different.

In practice, the aforementioned classification operation performed by the data classification circuit 114 for each activity record can be realized by copying the activity record into a plurality of corresponding data groups, or by setting each activity record with multiple data groups. It can be realized by means of tags corresponding to the data groups, or it can also be realized by adding annotation data to each activity record.

With the passage of time, the attribute filtering devices 120, 130, and 140 will successively generate many activity records related to different IoT devices in the target IoT systems 101, 102, and 103, and the data detection system 110 will follow the aforementioned steps. In this way, many activity records generated by the attribute filtering devices 120, 130, and 140 are successively classified. The period during which the data detection system 110 receives the activity records generated by the attribute filtering devices 120, 130, and 140 may be referred to as a data collection period.

During operation, the data pattern analysis circuit 115 of the data detection system 110 determines whether the aforementioned data collection period has reached a predetermined time length. In practice, the data aspect analysis circuit 115 can set the aforementioned predetermined time length to a suitable length, for example, 1 day, 3 days, 5 days, 7 days, 10 days, 14 days, 21 days, 28 days, or 30 days and so on.

As shown in FIG. 2 , before the data collection period reaches a predetermined length of time, the attribute filtering devices 120 , 130 , and 140 will continue to generate more activity records according to the packet information sent from the packet gateway devices 150 , 160 , and 170 . The communication circuit 111 will successively receive more activity records generated by the attribute filtering devices 120 , 130 and 140 ; and the data classification circuit 114 will successively classify many activity records received by the communication circuit 111 .

After the data collection period reaches the aforementioned predetermined length of time, the attribute filtering devices 120 , 130 , and 140 , the communication circuit 111 , and the data classification circuit 114 will continue to repeat the aforementioned operations, and the data pattern analysis circuit 115 will perform Process 218 and Process 220 in 2.

In the process 218 , the data pattern analysis circuit 115 of the data detection system 110 analyzes the data patterns of the plurality of activity records in the individual data groups generated by the data classification circuit 114 during the data collection period to generate individual data One or more reference datasets corresponding to the group.

As can be seen from the description of the aforementioned process 216, the data classification circuit 114 will classify the multiple activity records generated by the attribute filtering devices 120, 130, and 140 according to the content of a plurality of attributes to form a plurality of data groups, and each Each data group contains multiple activity records. Different data groups correspond to different attribute contents, but the same The content of an attribute recorded in all activity records in the data group will be the same.

In process 220 , the data aspect analysis circuit 115 stores the generated one or more reference data sets in the storage circuit 113 . In practice, the data aspect analysis circuit 115 can perform the process 218 and the process 220 at the same time.

The operation of the data pattern analysis circuit 115 in the process 218 to analyze the data patterns of the individual data groups to generate the corresponding reference data sets will be further described below with reference to FIG. 6 . FIG. 6 is a simplified flowchart of a method for generating reference data sets corresponding to individual data groups according to an embodiment of the present invention.

When the data pattern analysis circuit 115 performs the aforementioned process 218, the method of FIG. 6 can be used to analyze the data patterns of the activity records in the individual data groups, so as to generate one or more reference data corresponding to the individual data groups set.

In order to facilitate the description with the data flow diagram of FIG. 3 , it is assumed that the data groups to be analyzed by the data aspect analysis circuit 115 also include the data groups 330 , 332 , and 334 in FIG. 3 .

In practice, the data aspect analysis circuit 115 can use some attributes recorded in a plurality of activity records in the same data group as the analysis basis of the data group.

For example, the data profile analysis circuit 115 can use the three attributes of device status data, upstream traffic, and/or downstream traffic recorded in these activity records as the basis for analysis.

In the aforementioned embodiment where the connection time of the related IoT device is also recorded in the aforementioned activity record, in addition to the aforementioned three attributes, the data pattern analysis circuit 115 can also use the connection time recorded in the activity record to determine as the basis for analysis.

If the aforementioned activity record does not record the connection time of the relevant IoT device, the data pattern analysis circuit 115 can also estimate the connection time of the relevant IoT device according to the content of the device status data recorded in different activity records. . This is because in the same data group, different activity records with the same content of device identification data all correspond to the same IoT device. Therefore, if there are two device identifiers in the same data group, activity records with the same content (representing corresponding to the same IoT device), and the content of the device status data recorded in one of the activity records is "Stop", and the other activity record is a prior (prior) activity If the content of the device status data recorded in the record is "Start", the data pattern analysis circuit 115 can calculate the difference between the reception times of the two activity records, and use the calculation result to estimate the two activities Record the connection time of the corresponding IoT device.

In the process 602, the data aspect analysis circuit 115 may select one of the plurality of data groups generated by the data classification circuit 114 as a current data group. As can be seen from the above description, the current data group will contain a plurality of activity records.

In the process 604, the data aspect analysis circuit 115 can analyze the content of a target attribute (hereinafter referred to as the first target attribute) in the plurality of activity records in the current data group. A variation of the statistical period to generate one or more reference data sets of the current data group with respect to the first target attribute.

In the process 606, the data aspect analysis circuit 115 may analyze the content of another target attribute (hereinafter referred to as the second target attribute) in the plurality of activity records in the current data group. Variations in different statistical periods are used to generate a reference data set for the second target attribute of the current data group.

In practice, the aforementioned first target attribute and second target attribute are selected from the aforementioned attributes that can be used as an analysis basis (eg, device status data, upstream traffic, downstream traffic, and/or connection time).

After performing the aforementioned process 606 , if there are other attributes to be used as the basis for analysis in the current data group, the data aspect analysis circuit 115 may proceed to process 610 . On the contrary, if there are no other attributes that are the basis for analysis in the current data group, the data aspect analysis circuit 115 may proceed to process 608 .

In process 608 , the data pattern analysis circuit 115 may select the data generated by the data classification circuit 114 Another data group is created as a new current data group, and then the foregoing process 604 and process 606 and subsequent processes are repeated for the new current data group.

In the process 610 , the data pattern analysis circuit 115 can analyze the content of the next target attribute in the current data group, and the change patterns in a plurality of different statistical periods during the data collection period, so as to generate the information about the next target attribute of the current data group. One or more reference data sets for a target attribute.

After performing the aforementioned process 610 , if there are other attributes to be used as the basis for analysis in the current data group, the data aspect analysis circuit 115 can repeat the process 610 . On the contrary, if there are no other attributes that are the basis for analysis in the current data group, the data aspect analysis circuit 115 may proceed to process 608 .

For example, the data aspect analysis circuit 115 can select the data group 330 in FIG. 3 as the current data group in the process 602, and select the device state data recorded in the activity record in the data group 330 in the process 604 as the current data group. is the first target attribute, and in the process 606, the upstream traffic recorded in the activity record in the data group 330 is selected as the second target attribute. It can be seen from the above-mentioned flowchart of FIG. 4 that the data group 330 is a data group corresponding to the base station identification data BS-152, and the data group 330 includes the above-mentioned activity records 320, 322, and 326. Multiple activity records.

As can be seen from the foregoing description, the content of the device status data recorded in each activity record represents the operation status of the corresponding Internet of Things device. For example, the content of the device status data recorded in the activity record 320 in the data group 330 represents the operation status of a corresponding IoT device 104 . In addition, the content of the upstream traffic recorded in each activity record represents the upstream traffic of the corresponding IoT device. For example, the content of the upstream traffic recorded in the activity record 320 in the data group 330 represents the size of the upstream traffic of a corresponding IoT device 104 within a certain period of time.

In practical applications, different IoT devices may have different operating states, so the content of the device state data recorded in different activity records in the same data group may be different. For example, in the data group 330, the content of the device status data recorded in some activity records may be "starting operation", and some activity records may record The content of the device status data is "Stopped", and the content of the device status data recorded in some activity records is "Alive".

In the process 604, the data aspect analysis circuit 115 can divide all the activity records in the data group 330 into a plurality of subgroups corresponding to a plurality of different statistical periods in the data collection period according to the receiving time of the individual activity records (sub-group), wherein the sum of the time lengths of the aforementioned multiple different statistical periods may be equal to or less than the time length of the data collection period. For example, in embodiments where the data aspect analysis circuit 115 sets the length of the data collection period to 1 day, 3 days, 5 days, 7 days, 10 days, 14 days, 21 days, 28 days, or 30 days, The data aspect analysis circuit 115 can divide all the activity records in the data group 330 into 24 subgroups corresponding to the 24 hours of each day, respectively corresponding to 12 statistical periods of each day (each statistical period is 2 hours). ), or 8 subgroups corresponding to 8 statistical periods of each day (each statistical period is 3 hours). For another example, in the embodiment in which the data aspect analysis circuit 115 sets the time length of the data collection period to 7 days, 14 days, 21 days, or 28 days, the data aspect analysis circuit 115 may also All activity records of are divided into 7 subgroups corresponding to the 7 days of each week.

Next, the data aspect analysis circuit 115 can respectively calculate the sum or moving sum of the number of activity records whose device state data has a specific content in each subgroup, and combine the calculation of the different subgroups The results are consolidated to form a set of statistics that serve as a reference data set for the data group 330 for a particular operating state, presenting the sum or moving sum of the number of activity records for device state data with a particular content, Changes over a number of different statistical periods during the data collection period.

For example, the data aspect analysis circuit 115 can separately calculate the sum or the moving sum of the number of activity records whose content of the device status data in each subgroup is "starting operation", and aggregate the calculation results of the different subgroups to form A first set of statistical data, used to present the sum or shift of the number of activity records whose device status data content is "starting operation" and, changes over a number of different statistical periods during the data collection period.

For another example, the data aspect analysis circuit 115 can separately calculate the sum or moving sum of the number of activity records whose content of the device status data in each subgroup is "stopped", and aggregate the calculation results of the different subgroups A second set of statistical data is formed, which is used to present the total or moving sum of the number of activity records whose device status data content is "stopped operation", and changes in a plurality of different statistical periods during the data collection period.

For another example, the data aspect analysis circuit 115 can separately calculate the sum or moving sum of the number of activity records whose content of the device state data in each subgroup is "in operation", and aggregate the calculation results of the different subgroups A third group of statistical data is formed for presenting the total or moving sum of the number of activity records whose device status data content is "in operation", and changes in a plurality of different statistical periods during the data collection period.

In practice, the data aspect analysis circuit 115 can generate one of the aforementioned first set of statistical data, second set of statistical data, and third set of statistical data in the process 604 as the data group 330 about the device A set of reference materials for a specific content of state materials. Alternatively, the data aspect analysis circuit 115 may generate two of the aforementioned first set of statistical data, second set of statistical data, and third set of statistical data in the process 604 as the device status of the data group 330, respectively. Two sets of reference materials for two different contents of the material. Alternatively, the data aspect analysis circuit 115 may generate the aforementioned first set of statistical data, second set of statistical data, and third set of statistical data in the process 604 as the three types of device status data in the data group 330 respectively. Three sets of reference materials for different content.

On the other hand, in the process 606, the data aspect analysis circuit 115 can also divide all the activity records in the data group 330 into a plurality of different statistical periods corresponding to the data collection period according to the receiving time of the individual activity records. of multiple subgroups. Please note that the division method of the statistical period in the process 606 by the data aspect analysis circuit 115 may be the same as that in the foregoing process 604 , or may be different from that in the foregoing process 604 . In other words, the number of subgroups divided by the data aspect analysis circuit 115 in the process 606 may be the same as the number of subgroups divided in the aforementioned process 604 Similarly, the number of subgroups divided in the foregoing process 604 may also be different.

In this embodiment, the data aspect analysis circuit 115 can calculate the sum, average, moving sum, or a moving average, and aggregate the results of the calculations for the different subgroups to form a fourth set of statistics that serve as a set of reference data sets for data group 330 on upstream traffic to present all activity The sum, average, moving sum, or moving average of the upstream traffic recorded in the record, over multiple different statistical periods during the data collection period.

Please note that the specific contents of the first target attribute and the second target attribute analyzed by the data aspect analysis circuit 115 in the process 604 and the process 606 are only examples for the convenience of description, and do not limit the actual implementation of the present invention. . In practice, the data aspect analysis circuit 115 can also exchange the attributes analyzed in the aforementioned process 604 and the process 606 with each other, or select other attributes recorded in the activity records in the data group 330 to replace the aforementioned first one. The target attribute and the second target attribute.

In other words, the order of the analysis basis used by the data aspect analysis circuit 115 when performing the data aspect analysis on the current data group is not particularly limited.

As mentioned above, after the process 606 is performed, if there are other attributes in the current data group (in this case, the data group 330) to be used as the basis for analysis, the data aspect analysis circuit 115 can then proceed to Process 610. On the other hand, if there are no other attributes that serve as the basis for analysis in the current data group, the data aspect analysis circuit 115 may proceed to process 608 to select another data group as the new current data group, and then analyze the For the new current data group, the foregoing process 604 and process 606 and subsequent processes are repeated.

For example, if the data aspect analysis circuit 115 also analyzes the downstream traffic in the data group 330, the process 610 can be performed to calculate the sum of the downstream traffic recorded in all the activity records in the individual subgroups respectively. , average, moving sum, or moving average, and aggregate the calculations for the different subgroups to form a fifth set of statistics, As a set of reference data sets for data group 330 about downstream traffic, it is used to present the sum, average, moving sum, or moving average of downstream traffic recorded in all activity records, and the number of times during the data collection period. changes in different statistical periods.

For another example, if the data aspect analysis circuit 115 also analyzes the connection time in the data group 330, the process 610 can be performed to calculate the connections recorded in all the activity records in the individual subgroups respectively. The sum, average, moving sum, or moving average of time, and the calculation results of different subgroups are aggregated to form a sixth set of statistical data, which is used as a set of reference data for data group 330 regarding connection time Set to present the sum, average, moving sum, or moving average of the connection time recorded in all activity records over multiple different statistical periods during the data collection period.

Please note that the division manner of the statistical period in the process 610 by the data aspect analysis circuit 115 may be the same as that in the foregoing process 604 or 606, or may be different. In other words, the number of subgroups divided by the data aspect analysis circuit 115 in process 610 may be the same as the number of subgroups divided in process 604 or process 606, or may be different.

Similarly, after the process 610 is performed, if there are other attributes in the data group 330 to be used as the basis for analysis, the data aspect analysis circuit 115 may repeat the process 610 to target all the attributes in the data group 330 . Other attributes recorded in the activity record are analyzed by data aspect. On the contrary, if there are no other attributes that are the basis for analysis in the data group 330, the data aspect analysis circuit 115 can proceed to the aforementioned process 608.

The data pattern analysis circuit 115 can use the method of FIG. 6 to perform the process 218 in FIG. 2 to analyze the data patterns of the plurality of activity records in the data group 330 during the data collection period to generate a data group Multiple reference data sets corresponding to 330 (eg, exemplary reference data sets 340, 342, and 344 in FIG. 3).

As can be seen from the foregoing description, the content of each reference data set corresponding to the data group 330 is a set of statistical data, and this set of statistical data can be equivalently described in the form of a corresponding statistical chart. In order to help understanding, the following will be combined with the examples of Figure 7 to Figure 9 to do further step-by-step instructions. 7 to 9 are simplified schematic diagrams of statistical charts corresponding to different embodiments of the reference data set generated by the present invention.

For example, in the embodiment of FIG. 7 , the data aspect analysis circuit 115 may divide all activity records in the data group 330 into 24 subgroups corresponding to the 24 hours of each day. The data aspect analysis circuit 115 can separately calculate the sum of the number of activity records whose content of the device status data in each subgroup is "in operation", and aggregate the calculation results of the 24 subgroups to form a set of statistical data, As a reference data set 340 for the data group 330 regarding the "in operation" state. The content of the reference data set 340 can be described in the form of the statistical chart 710 in FIG. 7 equivalently, and the statistical results 712 of the data presented in the form of bars in the statistical chart 710 represent the device status data in a specific statistical period The content of is the sum of the number of "active" activity records. As shown in FIG. 7 , the statistical graph 710 shows that the heights of the data statistics results 712 in different statistical periods are all around a first value, which represents the number of activity records whose content of the device status data is “in operation” in different statistical periods The sums are very close to the first value. Such an analysis result means that among the plurality of IoT devices corresponding to the data group 330 , the sum of the number of IoT devices in the “operational” state is stably maintained around the first value in different statistical periods.

In addition, the data aspect analysis circuit 115 can separately calculate the sum of the number of activity records whose content of the device status data in each subgroup is "starting operation", and can aggregate the calculation results of the aforementioned 24 subgroups to form another A set of statistics to be used as reference data set 342 for data group 330 regarding the "starting operation" state. The content of the reference data set 342 can be described in the form of the statistical chart 720 in FIG. 7 equivalently, and the statistical results 722 of the data presented in the form of bars in the statistical chart 720 represent the device status data in a specific statistical period The content of is the sum of the number of activity records that are "running". As shown in FIG. 7 , the statistics chart 720 shows that the heights of the data statistics results 722 in different statistics periods are similar and low, which represent the number of activity records whose content of the device status data is “starting operation” in different statistics periods The sums are equally small. Such an analysis result means that among the multiple IoT devices corresponding to the data group 330, the sum of the number of IoT devices entering the "starting operation" state is very low in different statistical periods.

Furthermore, the data aspect analysis circuit 115 can separately calculate the sum of the downlink traffic recorded in all the activity records in the individual subgroups, and aggregate the calculation results of the aforementioned 24 subgroups to form another set of statistical data. , as the reference data set 344 of the data group 330 regarding "downlink traffic". The content of the reference data set 344 can be described in the form of the statistical chart 730 in FIG. 7 equivalently, and the statistical results 732 of the data presented in the form of long bars in the statistical chart 730 represent all activity records in a specific statistical period. The sum of recorded downstream traffic. As shown in FIG. 7 , the statistical chart 730 displays the data statistical results 732 from around 7:00 to 9:00 in the morning and from 5:00 to 7:00 in the afternoon, which are significantly higher than the data statistical results 732 in other statistical periods, representing The sum of the downlink traffic recorded in the activity records from 7:00 to 9:00 in the morning and from 5:00 to 7:00 in the afternoon will be significantly higher than other statistical periods. Such an analysis result means that the downlink traffic of the multiple IoT devices corresponding to the data group 330 is significantly higher than that in other statistical periods every day at around 7:00 am to 9:00 pm and around 5:00 pm to 7:00 pm.

If the multiple activity records in the aforementioned data group 330 correspond to multiple IoT devices 104 in the target IoT system 101 respectively, and the target IoT system 101 is a traffic sign management system, and the target IoT system 101 The many IoT devices 104 are divided into a plurality of traffic signal monitoring circuits located in different locations, so the statistical charts 710, 720, and 730 shown in FIG. 7 can be used to present the traffic signal management to some extent. Numerous traffic signals in the system characterize behavior under normal operating conditions.

For another example, in the embodiment of FIG. 8 , the data aspect analysis circuit 115 can divide all the activity records in the data group 330 into 12 corresponding to 12 statistical periods of each day (each statistical period is 2 hours). subgroups. The data aspect analysis circuit 115 can separately calculate the average value of the connection time recorded in all the activity records in the individual subgroups, and aggregate the calculation results of the 12 subgroups to form a set of statistical data as capital The reference data set 340 of the material group 330 for "connection time". The content of the reference data set 340 can be described in the form of the statistical chart 810 in FIG. 8 equivalently, and the statistical results 812 of the data presented in the form of long bars in the statistical chart 810 represent all activity records in a specific statistical period The average of the recorded connection times. As shown in FIG. 8 , the statistical chart 810 shows that the heights of the data statistics results 812 in different statistical periods are all around a second value, which means that the average value of the connection time recorded in the activity records in different statistical periods is very close to the first and second values. binary value. Such an analysis result means that the average connection time of the plurality of IoT devices corresponding to the data group 330 in different statistical periods is stably maintained around the second value.

In addition, the data aspect analysis circuit 115 can separately calculate the sum of the number of activity records whose content of the device status data in each subgroup is "stopped operation", and can aggregate the calculation results of the aforementioned 12 subgroups to form another A set of statistics to be used as reference data set 342 for data group 330 regarding the "out of service" state. The content of the reference data set 342 can be described in the form of the statistical chart 820 in FIG. 8 equivalently, and the statistical results 822 of the data presented in the form of bars in the statistical chart 820 represent the device status data in a specific statistical period is the sum of the number of "defunct" activity records. As shown in FIG. 8 , the statistical graph 820 shows that the heights of the data statistics results 822 in different statistical periods are similar and low, which represent the number of activity records whose device status data content is “stopped” in different statistical periods The sums are equally small. Such an analysis result means that among the IoT devices corresponding to the data group 330 , the sum of the number of IoT devices entering the "stop operation" state is very low in different statistical periods.

Furthermore, the data aspect analysis circuit 115 can separately calculate the sum of the upstream traffic recorded in all the activity records in the individual subgroups, and aggregate the calculation results of the aforementioned 12 subgroups to form another set of statistical data. , as the reference data set 344 of the data group 330 regarding "upstream traffic". The content of the reference material set 344 can be equivalently described in the form of the statistical chart 830 in FIG. 8, and in the statistical chart 830 in the form of bars The presented data statistics result 832 represents the sum of the upstream traffic recorded in all activity records in a specific statistical period. As shown in FIG. 8 , the statistical chart 830 shows the statistical results 832 of data from 12:00 am to 8:00 am and from 6:00 pm to 12:00 midnight every day, which are significantly higher than the statistical results 832 of data in other statistical periods. , which means that the sum of the upstream traffic recorded in the activity records from 6:00 pm to 8:00 am the next day will be significantly higher than other statistical periods. Such an analysis result means that for the multiple IoT devices corresponding to the data group 330 , the upstream traffic from 6:00 pm to 8:00 am the next day is significantly higher than other statistical periods.

If the multiple activity records in the aforementioned data group 330 respectively correspond to multiple IoT devices 104 in the target IoT system 101 , and the target IoT system 101 is a smart street light system, and many IoT devices in the target IoT system 101 The IoT device 104 is a plurality of smart street lamps located at different locations, so the statistical charts 810, 820, and 830 shown in FIG. Behavioral characteristics under normal operating conditions.

For another example, in the embodiment of FIG. 9 , the data aspect analysis circuit 115 may divide all activity records in the data group 330 into 7 subgroups corresponding to the 7 days of each week. The data aspect analysis circuit 115 can separately calculate the sum of the number of activity records whose content of the device status data in each subgroup is "in operation", and aggregate the calculation results of the seven subgroups to form a set of statistical data, As a reference data set 340 for the data group 330 regarding the "in operation" state. The content of the reference data set 340 can be described in the form of the statistical chart 910 in FIG. 9 equivalently, and the statistical results 912 of the data presented in the form of bars in the statistical chart 910 represent the device status data in a specific statistical period The content of is the sum of the number of "active" activity records. As shown in FIG. 9 , the statistics chart 910 shows that the heights of the data statistics results 912 in different statistics periods are all around a third value, which represents the number of activity records whose content of the device status data is “in operation” in different statistics periods The sums are very close to the third value. Such an analysis result means that among the multiple IoT devices corresponding to the data group 330, the The sum of the number of IoT devices in the "in-progress" state is stable at around the third value in different statistical periods.

In addition, the data aspect analysis circuit 115 can separately calculate the sum of the number of activity records whose content of the device status data in each subgroup is "stopped operation", and can aggregate the calculation results of the aforementioned seven subgroups to form another A set of statistics to be used as reference data set 342 for data group 330 regarding the "out of service" state. The content of the reference data set 342 can be described in the form of the statistical chart 920 in FIG. 9 equivalently, and the statistical results 922 of the data presented in the form of bars in the statistical chart 920 represent the device status data in a specific statistical period is the sum of the number of "defunct" activity records. As shown in FIG. 9 , the statistics chart 920 shows that the heights of the data statistics results 922 in different statistical periods are similar and low, which represent the number of activity records whose content of the device status data is “stopped” in different statistical periods The sums are equally small. Such an analysis result means that among the IoT devices corresponding to the data group 330 , the sum of the number of IoT devices entering the "stop operation" state is very low in different statistical periods.

Furthermore, the data aspect analysis circuit 115 can separately calculate the sum of the upstream traffic recorded in all the activity records in the individual subgroups, and aggregate the calculation results of the aforementioned seven subgroups to form another set of statistical data. , as the reference data set 344 of the data group 330 regarding "upstream traffic". The content of the reference data set 344 can be described in the form of the statistical chart 930 in FIG. 9 equivalently, and the statistical results 932 of the data presented in the form of bars in the statistical chart 930 represent all activity records in a specific statistical period. The sum of recorded upstream traffic. As shown in FIG. 9 , the statistical chart 930 shows that the statistical results 932 of data on Saturday and Sunday are significantly lower than the statistical results 932 of data in the other 5 days, which represents that the upward traffic recorded in the activity records on Saturday and Sunday is less than The sum will be significantly lower than other statistical periods. Such an analysis result means that for the IoT devices corresponding to the data group 330, the upstream traffic on Saturday and Sunday is significantly lower than the other 5 days.

If the multiple activity records in the aforementioned data group 330 respectively correspond to multiple IoT devices 104 in the target IoT system 101 , and the target IoT system 101 is a smart meter system, and many IoT devices in the target IoT system 101 The IoT device 104 is a plurality of smart meters that are located in different buildings, so the statistical charts 910 , 920 , and 930 shown in FIG. 9 can be used to present the wisdom in the smart meter system to some extent. Behavioural characteristics of an electricity meter under typical normal operating conditions.

As can be seen from the foregoing description, each reference data set corresponding to the data group 330 can be used to present a relevant statistical result (eg , sum, average, moving sum, or moving average), the pattern of change over multiple different statistical periods during the data collection period.

The data aspect analysis circuit 115 can use the method shown in FIG. 6 to analyze the data aspects of the activity records in other data groups during the data collection period in the same manner as described above, so as to generate reference data sets corresponding to individual data groups. For example, the data pattern analysis circuit 115 can use the method shown in FIG. 6 to analyze the data patterns of a plurality of activity records in the data group 332 during the data collection period, so as to generate a plurality of reference data sets corresponding to the data group 332 . Similarly, the data pattern analysis circuit 115 can use the method shown in FIG. 6 to analyze the data patterns of the plurality of activity records in the data group 334 during the data collection period, so as to generate a plurality of reference data corresponding to the data group 334 set.

As mentioned above, the data aspect analysis circuit 115 can store the plurality of reference data sets corresponding to the individual data groups in the storage circuit 113 in an appropriate data format.

After establishing one or more reference data sets corresponding to individual data groups, the IoT operation monitoring system 100 can dynamically detect the operation status of multiple IoT devices in the target IoT systems 101 , 102 , and 103 .

10 and FIG. 11 will be used to further illustrate the operation mode of the IoT operation monitoring system 100 to dynamically detect whether the operation of the target IoT systems 101 , 102 , and 103 is abnormal. FIG. 10 is a simplified flowchart of an embodiment of a method for detecting whether an Internet of Things operation is abnormal according to an embodiment of the present invention. FIG. 11 is the method for detecting whether the operation of the Internet of Things is abnormal according to the present invention. A schematic diagram of a simplified data flow according to an embodiment.

For the sake of convenience, the following is an example of the operation of detecting whether the IoT device 104 in the target IoT system 101 is abnormal.

During operation, the packet gateway device 150 will perform the process 1002 in FIG. 10 for subsequent interaction with the individual IoT devices 104 in the target IoT system 101 through the base station 152 . The operation of the packet gateway device 150 in the process 1002 is similar to the operation of the process 202 and the process 204 in the aforementioned FIG. 2 , and for the sake of brevity, the description is not repeated here.

During the operation of the target IoT system 101 , the packet gateway device 150 will intermittently receive relevant data from different IoT devices 104 , and the process 1004 will also be performed intermittently.

In the process 1004, the packet gateway device 150 generates a new packet message 1110 including multiple attributes of a certain IoT device 104 (hereinafter referred to as the target IoT device 104), and transmits the new packet message 1110 to the corresponding Attribute filtering means 120. The packet gateway device 150 can integrate various attributes related to the target IoT device 104 into a new packet message 1110 corresponding to the target IoT device 104 in an appropriate data format. As shown in FIG. 11, the new packet message 1110 includes a header 1111 and various attributes stored in different data fields (eg, the exemplary attributes 1112, 1113, 1114, 1115, and 1116 shown in FIG. 11) .

The manner in which the packet gateway device 150 generates the new packet message 1110 in the process 1004 may be the same as the manner in which the packet message 310 is generated in the aforementioned process 206 . In other words, the attributes of the packet gateway device 150 recorded in the new packet message 1110 may include a packet time, a connection identification data, a network address of the target IoT device 104 , and a device identification of the target IoT device 104 Data, a user identification data (eg, an access point name) corresponding to the target IoT device 104 , a device status data of the target IoT device 104 , an upstream traffic of the target IoT device 104 , the target IoT device 104 The downlink traffic of the base station 152 , a base station identification data of the base station 152 , and/or a service type of the target IoT device 104 and other related data. Built into target IoT device 104 In the embodiment of a user identity module, the aforementioned device identification data may also be the number of the user identity module.

In some embodiments, the attributes of the packet gateway device 150 recorded in the new packet message 1110 may also include a packet gateway identification data of the packet gateway device 150 (eg, the network address of the packet gateway device 150 ). ), and/or a connection time of the target IoT device 104 .

In practice, the packet gateway device 150 may also record other attributes or data related to the target IoT device 104 in the new packet message 1110 according to the application purpose of the target IoT system 101 . The packet gateway device 150 may implement the new packet message 1110 containing various attributes of the target IoT device 104 in various suitable forms of packets. Similar to the aforementioned embodiment of FIG. 2 , the new packet message 1110 generated by the packet gateway device 150 may be implemented in the form of an Accounting-Request Packet.

In the process 1006 , the data processing circuit 122 of the attribute filtering device 120 receives and parses the new packet message 1110 transmitted from the packet gateway device 150 through the network 154 .

Next, the data processing circuit 122 may perform the process 1008 to generate a new activity record 1120 corresponding to the target IoT device 104 according to some attributes in the new packet message 1110 .

The manner in which the data processing circuit 122 generates the new activity record 1120 in the process 1008 may be the same as the manner in which the activity record 320 is generated in the aforementioned process 210 . As shown in FIG. 11 , after receiving the new packet message 1110 , the data processing circuit 122 parses and extracts the aforementioned properties recorded in the new packet message 1110 . Next, the data processing circuit 122 filters out some attributes (eg, the exemplary attributes 1113, 1114, and 1116 shown in FIG. 11 ) from the multiple attributes extracted, and generates corresponding objects according to these attributes. New activity record 1120 for networked device 104 .

In other words, the new activity record 1120 generated by the data processing circuit 122 does not include all the attributes recorded in the new packet message 1110 , but only includes some of the attributes recorded in the new packet message 1110 .

For example, the data processing circuit 122 can integrate the device identification data, user identification data, device status data, upstream traffic, downstream traffic, and base station identification data recorded in the new packet message 1110 into a corresponding target in an appropriate data format. New activity record 1120 for IoT device 104 .

In some embodiments, the data processing circuit 122 can also integrate the packet gateway identification data and/or the connection time recorded in the new packet message 1110 into the new activity corresponding to the target IoT device 104 . Record 1120.

Obviously, the number of attributes recorded in the new activity record 1120 generated by the data processing circuit 122 will be less than the number of attributes recorded in the new packet message 1110 .

In the process 1010 , the data transmission circuit 124 of the attribute filtering device 120 can transmit the new activity record 1120 generated by the data processing circuit 122 to the data detection system 110 through the network 182 .

In this case, the communication circuit 111 of the data detection system 110 will perform the process 1012 to receive the new activity record 1120 from the attribute filtering device 120 . The data interpretation circuit 112 can interpret the new activity record 1120 to extract various attributes recorded in the new activity record 1120 .

In practice, the data transmission circuit 124 can transmit the new activity record 1120 to the data detection system 110 immediately after the data processing circuit 122 generates the new activity record 1120 .

Alternatively, the data transmission circuit 124 can also wait until the new activity records generated by the data processing circuit 122 are accumulated to a predetermined number (eg, 10, 30, 50, 100, 300, 500, 700, 1000 records) , 1500, or 2000, etc.), the new activity record 1120 and other new activity records are sent to the data detection system 110 in batches.

Alternatively, the data transmission circuit 124 may perform the process 1010 intermittently or periodically. For example, the data transmission circuit 124 may be set to every 1 second, 3 seconds, 5 seconds, 10 seconds, 15 seconds, 30 seconds, 60 seconds, 100 seconds, 3 minutes, 5 minutes, 10 minutes, 20 minutes, 30 minutes, 1 hour, or 1.5 hours and other suitable time intervals, periodically record new activities 1120 is transmitted to the data detection system 110 along with other new activity records accumulated at that time.

In the process 1014, the anomaly detection circuit 116 can find from the storage circuit 113 one or more data groups corresponding to the content of the one or more selected attributes in the new activity record 1120 as one or more benchmarks Data group (baseline data group).

As mentioned above, the data classification circuit 114 will classify the multiple activity records generated by the attribute filtering devices 120, 130, and 140 according to a number of attributes (eg, the aforementioned base station identification data, user identification data) that can be used as a basis for classification. , packet gateway identification data, and/or case site identification data) to form multiple data groups, so that different data groups correspond to different attribute contents, but the same data group The content of a selected attribute recorded in all activity records will be the same.

For example, in the aforementioned embodiment, the data group 330 generated by the data classification circuit 114 is the data group corresponding to the base station identification data BS-152, and all the activity records in the data group 330 record the base station The content of the identification data is the base station identification data BS-152. The data group 332 is a data group corresponding to the identification data APN-A, and the contents of the user identification data recorded in all the activity records in the data group 332 are the identification data APN-A. The data group 334 is a data group corresponding to the identification data APN-B, and the contents of the user identification data recorded in all the activity records in the data group 334 are the identification data APN-B.

The selected attribute in process 1014 is selected from the aforementioned attributes that can be used as a basis for classification (eg, base station identification data, user identification data, packet gateway identification data, and/or site identification data). During operation, the abnormality detection circuit 116 can determine the specific items and quantity of the selected attribute according to a predetermined rule or a comparison object selected by the user, and find the corresponding reference data group from the storage circuit 113 according to the content of the selected attribute Group.

For example, if the selected attribute is user identification data, and the content of the user identification data recorded in the new activity record 1120 is the identification data APN-A corresponding to the first specific user, the anomaly detection circuit 116 may find the user identification data from the storage circuit 113 The output corresponds to the identification data APN-A The data group is used as a benchmark data group.

For another example, if the selected attribute is the case identification data, and the content of the case identification data recorded in the new activity record 1120 is the case identification data S1-ID corresponding to a case field S1, the abnormality detection circuit 116 can obtain A data group corresponding to the case identification data S1-ID is found in the storage circuit 113 as a reference data group.

For another example, if the selected attribute is the base station identification data, and the content of the base station identification data recorded in the new activity record 1120 is the base station identification data BS-152 corresponding to the base station 152, the anomaly detection circuit 116 can store the The circuit 113 finds a data group corresponding to the base station identification data BS-152 as a reference data group.

For another example, if the selected attribute is the packet gateway identification data, and the content of the packet gateway identification data recorded in the new activity record 1120 is the gateway identification data GW-150 corresponding to the packet gateway device 150, the abnormality detection circuit 116 can find out the data group corresponding to the gateway identification data GW-150 from the storage circuit 113 as a reference data group.

The activity records in each benchmark data group are the objects of comparison when the new activity record 1120 is subsequently analyzed for abnormality.

For the convenience of the following description, it is assumed here that the abnormality detection circuit 116 finds a plurality of corresponding reference data groups from the storage circuit 113 according to the content of the plurality of selected attributes in the new activity record 1120 (for example, in FIG. 11 , Exemplary benchmark data groups 1130, 1132, and 1134 are depicted).

In process 1016, the anomaly detection circuit 116 may associate the content of one or more target attributes in the new activity record 1120 with the reference data groups 1130, 1132, and 1134 found in process 1014 about the one or more target attributes The reference data set of the target attribute is compared to determine whether there is an abnormality.

As mentioned above, the data aspect analysis circuit 115 performs data aspect analysis on the activity records in the individual data groups, and generates one or more reference data sets corresponding to the individual data groups, and each reference data set The content is a set of statistical data that can be used to present a certain target attribute (eg For example, a relevant statistical result (eg, sum, average, moving sum, or moving average, etc.) of device status data, upstream traffic, downstream traffic, and/or connection time), multiple Changes in different statistical periods.

Therefore, the reference data groups 1130 , 1132 , and 1134 found by the abnormality detection circuit 116 in the process 1014 also each have one or more corresponding reference data sets, which can be used to present the activity records in each reference data group. A related statistical result of a certain target attribute in the data collection period in a plurality of different statistical periods of change patterns.

The target attribute referred to in the process 1016 is selected from the aforementioned attributes that can be used as a basis for analysis (eg, device status data, upstream traffic, downstream traffic, and/or connection time). During operation, the abnormality detection circuit 116 can determine the specific items and quantity of the target attribute according to a predetermined rule or an analysis item selected by the user, and find the reference data set corresponding to the target attribute from the storage circuit 113 .

As shown in FIG. 11 , assuming that the object to be compared by the anomaly detection circuit 116 is the activity records in the reference data group 1130 , the anomaly detection circuit 116 can take the attribute to be analyzed in the new activity record 1120 as a target attribute 1113 and extract the A reference data set 1140 about the target attribute 1113 of the reference data group 1130 is found in the storage circuit 113 . Next, the abnormality detection circuit 116 can compare the content of the target attribute 1113 recorded in the new activity record 1120 with the statistical data of the reference data set 1140 to determine the content of the target attribute 1113 and the relevant statistics in the reference data set 1140 Whether the gap between the statistical data of the time period exceeds a predetermined threshold.

For example, if the item to be analyzed is upstream traffic and the object to be compared is the activity records in the reference data group 1130 , the abnormality detection circuit 116 can take the upstream traffic as a target attribute and find out from the storage circuit 113 The reference data set of the reference data group 1130 regarding the upstream traffic (eg, the reference data set 1142 in FIG. 11 , which is referred to as the first reference data set herein). Next, the abnormality detection circuit 116 can compare the content of the upstream traffic recorded in the new activity record 1120 with the statistical data of the first reference data set to determine the content of the upstream traffic and the relevant statistical period in the first reference data set registration Whether the gap between the data exceeds a first predetermined threshold (eg, 10%, 15%, 20%, 30%, 40%, 50%, or a specific flow rate, etc.).

After comparing the content of the upstream traffic recorded in the new activity record 1120 with the statistical data of the first reference data set, if there are other items to be analyzed in the new activity record 1120, the abnormality detection circuit 116 can compare the above-mentioned way to compare.

For example, if the item to be analyzed is upstream traffic and the object to be compared is the activity records in the reference data group 1132 , the abnormality detection circuit 116 can take the upstream traffic as a target attribute and find out from the storage circuit 113 The reference data set of the reference data group 1132 regarding upstream traffic (referred to herein as the second reference data set). Next, the abnormality detection circuit 116 can compare the content of the upstream traffic recorded in the new activity record 1120 with the statistical data of the second reference data set to determine the content of the upstream traffic and the relevant statistical period in the second reference data set Whether the gap between the statistical data exceeds the aforementioned first critical value.

For another example, if the item to be analyzed is downlink traffic, and the object to be compared is the activity records in the reference data group 1130 , the abnormality detection circuit 116 can take the downlink traffic as a target attribute and find it from the storage circuit 113 . The reference data set of the reference data group 1130 about downlink traffic (for example, the reference data set 1144 in FIG. 11 , which is referred to as the third reference data set herein) is output. Next, the anomaly detection circuit 116 can compare the content of the downstream traffic recorded in the new activity record 1120 with the statistical data of the third reference data set to determine the content of the downstream traffic and the relevant statistical period in the third reference data set Whether the gap between the statistical data exceeds a second threshold (eg, 5%, 10%, 15%, 20%, 25%, 30%, 40%, or a specific traffic size, etc.).

For another example, if the item to be analyzed is downlink traffic, and the object to be compared is the activity records in the reference data group 1134 , the abnormality detection circuit 116 can take the downlink traffic as a target attribute and find it from the storage circuit 113 . A reference data set (herein referred to as a fourth reference data set) of the reference data group 1134 about downlink traffic is output. Next, the abnormality detection circuit 116 can compare the content of the downstream traffic recorded in the new activity record 1120 with the first The statistical data of the four benchmark data sets are compared to determine whether the difference between the content of the downlink traffic and the statistical data of the relevant statistical period in the fourth benchmark data set exceeds the aforementioned second threshold.

For another example, if the item to be analyzed is the connection time, and the object to be compared is the activity records in the reference data group 1132 , the abnormality detection circuit 116 can use the connection time as a target attribute, and store the data from the storage circuit 113 Find out the reference data set (herein referred to as the fifth reference data set) of the reference data group 1132 about the connection time. Next, the abnormality detection circuit 116 can compare the content of the connection time recorded in the new activity record 1120 with the statistical data of the fifth reference data set to determine the correlation between the content of the connection time and the fifth reference data set Whether the gap between the statistical data of the statistical period exceeds a third threshold (for example, 15%, 20%, 30%, 50%, 80%, 100%, or a specific time value, etc.).

For another example, if the item to be analyzed is connection time and the object to be compared is the activity records in the reference data group 1134 , the abnormality detection circuit 116 can use the connection time as a target attribute, and store the data from the storage circuit 113 Find the reference data set (herein referred to as the sixth reference data set) of the reference data group 1134 about the connection time. Next, the abnormality detection circuit 116 can compare the content of the connection time recorded in the new activity record 1120 with the statistical data of the sixth reference data set to determine the correlation between the content of the connection time and the sixth reference data set Whether the gap between the statistical data in the statistical period exceeds the aforementioned third threshold.

If the item to be analyzed is other attributes, the abnormality detection circuit 116 can perform the related comparison in the aforementioned manner.

In one embodiment, the anomaly detection circuit 116 may determine that the new activity record 1120 has an abnormality when the difference between the content of the single target attribute recorded in the new activity record 1120 and a single corresponding reference data set exceeds a relevant threshold. The operation of the corresponding target IoT device 104 is abnormal.

In another embodiment, the anomaly detection circuit 116 may be recorded in the new activity log 1120 Only when the difference between the content of the single target attribute and the plurality of corresponding reference data sets exceeds the relevant threshold, it is determined that the operation of the target IoT device 104 corresponding to the new activity record 1120 is abnormal.

In another embodiment, the anomaly detection circuit 116 may determine a new activity only when the difference between the content of the plurality of target attributes recorded in the new activity record 1120 and the plurality of corresponding reference data sets exceeds a relevant threshold value The operation of the target IoT device 104 corresponding to the record 1120 is abnormal.

If the abnormality detection circuit 116 determines that the operation of the target IoT device 104 is not abnormal, the target IoT system 101 , the packet gateway device 150 , the attribute filtering device 120 , and the data detection system 110 can repeat the aforementioned process in FIG. 10 . On the contrary, if the abnormality detection circuit 116 determines that the operation of the target IoT device 104 is abnormal, the process 1018 in FIG. 10 will be performed.

In the process 1018 , the abnormality detection circuit 116 generates one or more alarm messages corresponding to the target IoT device 104 or the target IoT system 101 . The user graphic interface generation circuit 117 presents the alarm information generated by the abnormality detection circuit 116 to the user in an appropriate visual manner. For example, the user graphic interface generation circuit 117 can generate relevant warning texts, warning patterns, and/or warning images, and transmit them to the user device 192 and/or the user device 194 through the network 184, so as to enable the operation of the target IoT system 101 users, managers, auditors, and/or other users.

On the other hand, after the abnormality detection circuit 116 finds a plurality of reference data groups 1130, 1132, and 1134 corresponding to the contents of the plurality of selected attributes in the new activity record 1120 in the aforementioned process 1014, the data classification circuit 114 The process 1020 in FIG. 10 will also be performed, and the data aspect analysis circuit 115 will also perform the process 1022 in FIG. 10 .

In the process 1020 , the data classification circuit 114 can classify the new activity record 1120 according to the content of a plurality of attributes that can be used as a basis for classification, so as to use the new activity record 1120 to update the reference data groups 1130 , 1132 , and 1134 including the aforementioned The contents of a plurality of corresponding data groups including . The data classification circuit 114 can compare the new process 216 to The activity record 1120 is classified according to the content of the multiple attributes that can be used as the basis for classification, finds a plurality of data groups corresponding to the new activity record 1120, adds the new activity record 1120 to the individual data group, and simultaneously moves the data group. Except for the oldest activity record in the individual data group. For example, the data sorting circuit 114 may add a new activity record 1120 to the reference data group 1130 and remove the oldest one activity record in the reference data group 1130 . For another example, the data classification circuit 114 may add a new activity record 1120 to the reference data group 1132 and remove the oldest one activity record in the reference data group 1132 . Likewise, the data sorting circuit 114 may add the new activity record 1120 to the reference data group 1134 and remove the oldest one activity record in the reference data group 1134 .

The data classification circuit 114 stores the updated corresponding data groups in the storage circuit 113 for the abnormality detection circuit 116 to perform abnormality analysis at subsequent time points.

In the process 1022 , the data aspect analysis circuit 115 may update the plurality of reference data sets corresponding to the corresponding data groups of the new activity record 1120 . The data aspect analysis circuit 115 can perform data aspect analysis again on the activity records in the individual data groups after the new activity record 1120 is included in the operation mode of the aforementioned process 218, and update one or more data corresponding to the individual data groups. a reference set. For example, the data aspect analysis circuit 115 may perform data aspect analysis again on the activity records in the updated reference data group 1130, and generate one or more updated reference data sets corresponding to the reference data group 1130 ( For example, the exemplary reference data sets 1160, 1162, and 1164 in FIG. 11) to replace the original reference data set of the reference data group 1130. The data aspect analysis circuit 115 can perform data aspect analysis on the activity records in the updated reference data group 1132 again, and generate one or more updated reference data sets corresponding to the reference data group 1132 to replace Delete the original reference data set of the reference data group 1132. Similarly, the data aspect analysis circuit 115 can perform data aspect analysis on the activity records in the updated reference data group 1134 again, and generate one or more updated reference data sets corresponding to the reference data group 1134 , to replace the original reference data set of the reference data group 1134.

The data pattern analysis circuit 115 stores the updated relevant reference data set in the storage battery. in the path 113 for the abnormality detection circuit 116 to perform abnormality analysis at a subsequent time point.

As time passes, the data classification circuit 114 will continuously update the activity records in all data groups. In this way, the activity records in each benchmark data group will be continuously updated by the data classification circuit 114 in a rolling manner, so that the activity records in each benchmark data group belong to the activity records generated relatively recently.

On the other hand, the data aspect analysis circuit 115 also continuously updates the reference data sets corresponding to all the data groups. In this way, the reference data set corresponding to each reference data group will be continuously updated by the data pattern analysis circuit 115 in a rolling manner, so that the reference data set corresponding to each reference data group can reflect the relatively recently generated reference data set. Statistical results of target attributes in the activity log.

From another point of view, the reference data group on which the abnormality detection circuit 116 performs abnormality analysis at subsequent time points, and the reference data set corresponding to the reference data group are both determined by the data classification circuit 114 and the data aspect analysis. The circuit 115 repeats the operations of the process 1020 and the process 1022 to adaptively update to a newer version.

As can be seen from the foregoing description, the data detection system 110 can determine whether the single target IoT device 104 is operating by comparing the content of the single new activity record 1120 with the reference data set corresponding to the relevant reference data group. Abnormal. However, this is only an exemplary embodiment and does not limit the actual implementation of the present invention. In practice, the data detection system 110 can also simultaneously analyze whether the operation of a group of IoT devices with a specific correlation is abnormal according to the contents of multiple activity records.

For example, FIG. 12 is a simplified flow chart of another embodiment of the method for detecting whether the operation of the Internet of Things is abnormal according to the present invention.

In the embodiment of FIG. 12 , the operation modes of the individual packet gateway devices and the individual attribute filtering devices are the same as those of the embodiment of FIG. 10 . Therefore, the operations of the processes 1002 to 1010 in FIG. 12 are the same as the corresponding processes in the aforementioned FIG. 10 , and for the sake of brevity, the description is not repeated here.

As previously mentioned, attribute filtering devices 120, 130, and 140 meet over time A number of activity records related to the different IoT devices in the target IoT systems 101 , 102 , and 103 continue to be generated. Therefore, the data detection system 110 may perform the process 1212 in FIG. 12 .

In the process 1212, the communication circuit 111 of the data detection system 110 will successively receive multiple data with the same content of the selected attribute (eg, base station identification data, user identification data, packet gateway identification data, and/or site identification data). New activity record. In this case, the abnormality detection circuit 116 can find out one or more corresponding reference data groups from the storage circuit 113 according to the content of the selected attribute according to the method of the aforementioned process 1014 .

In the process 1214, the anomaly detection circuit 116 can calculate the content corresponding to one or more target attributes (eg, device status data, upstream traffic, downstream traffic, and/or connection time) in the aforementioned multiple new activity records statistics. For example, the abnormality detection circuit 116 can calculate the statistical results (eg, sum, average, moving sum, or moving average, etc.) of a certain target attribute in the aforementioned multiple new activity records in a specific statistical period.

Next, the abnormality detection circuit 116 may perform a process 1216 to compare the calculated statistical data with the reference data sets of one or more reference data groups regarding the target attribute to determine whether an abnormality occurs. Assuming that the object to be compared by the anomaly detection circuit 116 is the aforementioned reference data group 1130 , the anomaly detection circuit 116 can find out from the storage circuit 113 a reference data set (herein referred to as reference data) of the reference data group 1130 about the target attribute set). Next, the abnormality detection circuit 116 can compare the statistical data calculated in the process 1214 with the statistical data of the reference data set to determine whether the statistical results of the target attributes in the multiple new activity records in a specific statistical period are whether Significant deviations from the statistical data of the corresponding statistical period in the benchmark data set.

If the abnormality detection circuit 116 determines that the statistical data of the aforementioned multiple new activity records is abnormal, the process 1218 will be performed to generate a plurality of IoT devices or target IoT systems corresponding to the aforementioned multiple new activity records. One or more warning messages. Similarly, the user graphic interface generation circuit 117 will generate the notification generated by the abnormality detection circuit 116 alert information, and present it to relevant users in an appropriate visual manner, such as operators, managers, auditors, and/or other users of the relevant subject IoT system.

For example, it is assumed that the target IoT system 101 is a smart street light system, and the plurality of IoT devices 104 in the target IoT system 101 are a plurality of smart street lights disposed in different sites. If the data detection system 110 wants to determine a certain target site (herein referred to as the first target site, and the site identification data is assumed to be ST-ID1) in the target Internet of Things system 101, a plurality of smart street lights (also known as ST-ID1) That is, whether the multiple IoT devices 104) operate normally, the communication circuit 111 can successively receive multiple new activity records whose content is ST-ID1 generated by the relevant attribute filtering device in the aforementioned process 1212.

For the convenience of description, it is assumed here that the reference data group corresponding to the first target site has three reference data sets corresponding to the connection time, the "stop operation" status, and the upstream traffic, which are called reference data sets respectively. R1, reference set R2, and reference set R3. Under normal circumstances, the smart street lights in the first target field will remain in a turn-on state from 6:00 pm to 6:00 am the next day. Therefore, the statistical charts corresponding to the reference data set R1 , the reference data set R2 , and the reference data set R3 are respectively similar to the statistical charts 810 , 820 , and 830 shown in FIG. 8 .

As mentioned above, the abnormality detection circuit 116 can calculate the statistical data corresponding to the content of the device status data in the multiple new activity records received by the communication circuit 111 in the process 1214 , and compare the statistical data with the reference data in the process 1216 . Groups are compared against a reference set of device status data.

If an error occurs when the aforementioned smart street light system performs a large-scale IoT device firmware update, causing multiple smart street lights in the first target site to fail to operate normally, these smart street lights may continuously try to communicate with the back-end servers. Connected, and the content of the device status data recorded in many new activity records of ST-ID1 with the identification data of the crime scene appears "starting operation" or "stopping operation". In this way, the statistical data generated by the abnormality detection circuit 116 in the process 1214 will show the phenomenon that the number of activity records whose content of the device status data is "stopped operation" increases significantly in a short period of time.

Since such a situation is quite different from the data pattern presented by the reference data set R2 (eg, the statistical graph 820 shown in FIG. 8 ), the abnormality detection circuit 116 can determine the plurality of An abnormal situation occurs in the operation of the smart street light, and related alarm information is generated.

For another example, it is assumed that the target IoT system 102 is a smart electricity meter system, and the plurality of IoT devices 105 in the target IoT system 102 are a plurality of smart electricity meters installed in different operation sites. If the data detection system 110 needs to determine the multiple smart meters (also called the second target site) in a certain target site (herein referred to as the second target site, and the site identification data is assumed to be ST-ID2) in the target Internet of Things system 102 That is, whether the multiple IoT devices 105) operate normally, the communication circuit 111 can successively receive multiple new activity records whose content is ST-ID2 generated by the relevant attribute filtering device in the aforementioned process 1212.

For the convenience of description, it is assumed here that the reference data group corresponding to the second target site has three reference data sets corresponding to the “in operation” state, the “stop operation” state, and the upstream traffic, which are respectively referred to as reference data sets. Data set R4, reference data set R5, and reference data set R6. Under normal circumstances, the smart meters in the second target field are all connected to the power supply, so the smart meters are usually in the "operational" state all day long, and rarely enter the "stopped operation" state during operation. Therefore, the statistical charts corresponding to the reference data set R4 , the reference data set R5 , and the reference data set R6 are respectively similar to the statistical charts 910 , 920 , and 930 shown in FIG. 9 .

As mentioned above, the abnormality detection circuit 116 can calculate the statistical data corresponding to the content of the device status data in the multiple new activity records received by the communication circuit 111 in the process 1214 , and compare the statistical data with the reference data in the process 1216 . Groups are compared against a reference set of device status data.

If the network environment of the second target site fails, so that multiple smart meters in the second target site cannot transmit data to the back-end server smoothly, these smart meters may continuously try to communicate with the back-end server. connected to the device, resulting in the content of the site identification data being the content of the device status data recorded in many new activity records of ST-ID2. Rong is rarely "in operation" and many new activity records record low up traffic. In this way, the statistical data generated by the abnormality detection circuit 116 in the process 1214 will show that the number of activity records whose content of the device status data is "in operation" is greatly reduced in a short period of time, and the number of activity records recorded in the activity records is greatly reduced in a short period of time. The phenomenon that the upstream traffic is greatly reduced in a short period of time.

Since such a situation is quite different from the data patterns presented by the reference data sets R4 and R6 (eg, the statistical charts 910 and 930 shown in FIG. 9 ), the abnormality detection circuit 116 can determine the second target case field The operation of multiple smart meters in the system is abnormal, and related alarm information is generated.

For another example, it is assumed that the target IoT system 103 is a traffic sign management system, and the plurality of IoT devices 106 in the target IoT system 103 are a plurality of traffic signal monitoring circuits arranged in different work sites. If the data detection system 110 wants to determine the monitoring of multiple traffic signs in a certain target case (herein referred to as the third target case, and the case identification data is assumed to be ST-ID3) in the target IoT system 103 Whether the circuit (ie, the plurality of IoT devices 106 ) operates normally, the communication circuit 111 can successively receive multiple new records of ST-ID3 generated by the relevant attribute filtering device in the aforementioned process 1212 . activity record.

For the convenience of description, it is assumed here that the reference data group corresponding to the third target site has three reference data sets corresponding to the “in operation” state, the “starting operation” state, and the downlink traffic, which are referred to as reference respectively. Data Set R7, Reference Data Set R8, and Reference Data Set R9. Under normal circumstances, the traffic signal monitoring circuit in the third target field is connected to the power supply, so the traffic signal monitoring circuit is usually in the "operational" state all day long, and rarely enters the "stopped" state during operation. Operational status or Start Operational status. Therefore, the statistical charts corresponding to the reference data set R7 , the reference data set R8 , and the reference data set R9 are respectively similar to the statistical charts 710 , 720 , and 730 shown in FIG. 7 .

As previously described, the anomaly detection circuit 116 may calculate the communication circuit 111 reception in process 1214 Statistical data corresponding to the content of the device status data in the multiple new activity records obtained, and in the process 1216, the statistical data is compared with the reference data set of the reference data group on the device status data.

If the power supply in the vicinity of the aforementioned third target site fails, and the plurality of traffic signal monitoring circuits in the third target site cannot remain in the "operational" state, these traffic signal monitoring circuits may be continuously After rebooting and trying to connect with the backend server, the content of the identification data of the crime scene is ST-ID3. The content of the device status data recorded in many new activity records rarely appears "in operation", but often appears "Start Operation" or "Stop Operation". In this way, the statistical data generated by the abnormality detection circuit 116 in the process 1214 will show that the number of activity records whose content of the device status data is "in operation" is greatly reduced in a short period of time. Instead, the content of the device status data is: A phenomenon in which the number of "running" activity records has increased significantly in a short period of time.

Since such a situation is quite different from the data patterns presented by the reference data sets R7 and R8 (eg, the statistical charts 710 and 720 shown in FIG. 7 ), the abnormality detection circuit 116 can determine the third target case field The operation of a plurality of traffic signal monitoring circuits in the system is abnormal, and related alarm information is generated.

On the other hand, after the abnormality detection circuit 116 calculates the statistical data corresponding to the content of the target attributes in the multiple new activity records in the aforementioned process 1214, the data classification circuit 114 will also perform the process 1220 in FIG. 12, and The data aspect analysis circuit 115 also performs the process 1222 in FIG. 12 .

In the process 1220, the data classification circuit 114 can update the content of the plurality of corresponding data groups by using the above-mentioned multiple new activity records according to the method of the above-mentioned process 1020. The data classification circuit 114 can classify each new activity record according to the content of a plurality of attributes that can be used as a basis for classification, find out a plurality of data groups corresponding to each new activity record, and Adds a new activity record to the individual data group, and removes the oldest activity record in the individual data group at the same time. In addition, data The classification circuit 114 also stores the updated corresponding data groups in the storage circuit 113 for the abnormality detection circuit 116 to perform abnormality analysis at a subsequent time point.

In the process 1222, the data aspect analysis circuit 115 may update the reference data sets corresponding to the corresponding data groups of each new activity record. The data aspect analysis circuit 115 can perform data aspect analysis again on the activity records in the individual data groups after the new activity records are included in the method of the aforementioned process 1020, and update one or more references corresponding to the individual data groups dataset. Likewise, the data pattern analysis circuit 115 also stores the updated relevant reference data set in the storage circuit 113 for the abnormality detection circuit 116 to perform abnormality analysis at a subsequent time point.

Similar to the above-mentioned embodiment of FIG. 10 , the data classification circuit 114 will continuously update the activity records in all the data groups with the passage of time, and the data pattern analysis circuit 115 will also continuously update the references corresponding to all the data groups. dataset.

In this way, the activity records in each benchmark data group will be continuously updated by the data classification circuit 114 in a rolling manner, so that the activity records in each benchmark data group belong to the activity records generated relatively recently.

On the other hand, the reference data set corresponding to each reference data group will be continuously updated by the data pattern analysis circuit 115 in a rolling manner, so that the reference data set corresponding to each reference data group can reflect the more recently generated reference data sets. Statistical results of target attributes in the activity log.

Therefore, the reference data group that the abnormality detection circuit 116 relies on when performing abnormality analysis at subsequent time points, and the reference data set corresponding to the reference data group will repeat the process because the data classification circuit 114 and the data aspect analysis circuit 115 repeat the process. 1220 and the operation of process 1222 are adaptively updated to a newer version.

As can be seen from the foregoing description, using the data classification circuit 114 to classify multiple activity records corresponding to multiple IoT devices into different data groups according to the content of multiple attributes can greatly reduce the subsequent analysis of individual data by the data pattern analysis circuit 115 . The computational load and complexity required for the data aspect of the activity records in the group, and the analysis speed of the data aspect is improved.

In addition, the method of classifying a large number of activity records into different data groups can also greatly reduce the amount of computation required by the abnormality detection circuit 116 for subsequent abnormality detection, which helps to improve the efficiency and speed of abnormality detection.

As we all know, the number of IoT devices in large-scale IoT applications is often huge, so monitoring these IoT devices often requires a lot of resources. If every IoT device were to be checked for anomalies at any time, the required data transmission bandwidth and analysis resources would be unrealistically high. Moreover, when the number of IoT devices reaches a certain level, even if the system has the ability to monitor the operation status of each terminal device in real time, a large amount of abnormal alarm information will be generated, which will cause the monitoring personnel of the system to be fatigued and bombarded with a large amount of information. It is difficult to quickly analyze and diagnose which part of the system is wrong.

The aforementioned attribute filtering devices 120 , 130 , and 140 will preliminarily filter the attribute data in numerous packet messages generated by the packet gateway devices 150 , 160 , and 170 , so as to effectively reduce the amount of data that the data detection system 110 needs to process. , which helps to improve the overall operation performance of the data detection system 110 .

Since the aforementioned data detection system 110 can automatically group a large number of activity records according to different classification bases, and perform comparative analysis according to different analysis bases, it can quickly find out possible problems in large-scale IoT applications.

Furthermore, the data classification circuit 114 and the data aspect analysis circuit 115 will update the reference data group and the reference data set corresponding to the reference data group on which the abnormality detection circuit 116 relies when performing abnormality analysis at subsequent time points in a rolling manner. Therefore, the reference data group on which the abnormality detection circuit 116 performs abnormality analysis, and the reference data set corresponding to the reference data group will be continuously adaptively adjusted over time, which can greatly reduce the need for human intervention to adjust relevant parameters or The hassle of comparing benchmarks.

According to the research of cognitive science, it can be found that the human's comprehension efficiency of image information is much higher than that of plain text content. Since the data detection system 110 can present the abnormal analysis results to the relevant users in a visual manner, it is helpful to Significantly reduces the time users spend on analyzing the root cause of anomalies, thereby effectively improving the efficiency of diagnosing the root cause of the target IoT system problem.

In addition, since the data detection system 110 can perform anomaly analysis from different aspects and cross-comparison the analysis results, it can correctly clarify the attribution of responsibilities when an abnormality occurs in an IoT application, thereby greatly reducing the differences in co-constructing various IoT applications. Potential for disputes between partners.

Certain terms are used in the description and the scope of the claims to refer to specific elements, and those skilled in the art may refer to the same elements by different terms. This specification and the scope of the patent application do not use the difference in name as a way to distinguish elements, but use the difference in function of the elements as a criterion for distinguishing. The "comprising" mentioned in the description and the scope of the patent application is an open-ended term, and should be interpreted as "including but not limited to". In addition, the term "coupled" herein includes any direct and indirect means of connection. Therefore, if it is described in the text that the first element is coupled to the second element, it means that the first element can be directly connected to the second element through electrical connection or signal connection such as wireless transmission or optical transmission, or through other elements or connections. The means is indirectly electrically or signally connected to the second element.

The descriptions of "and/or" used in the specification include any combination of one or more of the listed items. In addition, unless otherwise specified in the specification, any term in the singular also includes the meaning in the plural.

The above are only preferred embodiments of the present invention, and all equivalent changes and modifications made according to the claims of the present invention shall fall within the scope of the present invention.

100: IoT Operation Monitoring System

101, 102, 103: Target IoT systems

104, 105, 106: IoT Devices

110: Data detection system

111: Communication circuit

112: Data interpretation circuit

113: Storage circuit

114: Data classification circuit

115: Data Pattern Analysis Circuit

116: Abnormal detection circuit

117: User Graphics Interface Generation Circuit

120, 130, 140: attribute filtering device

122, 132, 142: Data processing circuit

124, 134, 144: Data transmission circuit

150, 160, 170: Packet gateway device

152, 162, 172: base station

154, 164, 174, 182, 184: Internet

192, 194: User device

Claims (8)

A data detection system (110) used in an IoT operation monitoring system (100) for detecting a plurality of IoT devices (104, 105, 106) in a plurality of target IoT systems (101, 102, 103) ), the data detection system (110) includes: a communication circuit (111) configured to communicate data with a plurality of attribute filtering devices (120, 130, 140) through a network to receive the plurality of attributes A plurality of activity records (320, 322, 324, 326) generated by the filtering device (120, 130, 140) and corresponding to the plurality of IoT devices (104, 105, 106); a storage circuit (113), configured to store the plurality of activity records (320, 322, 324, 326) received by the communication circuit (111); a data classification circuit (114), coupled to the storage circuit (113), configured to Each activity record in the multiple activity records (320, 322, 324, 326) is classified according to the content of the N attributes to form M data groups (330, 332, 334), and the M data The groups (330, 332, 334) are stored in the storage circuit (113), wherein N is an integer of 2 or greater, and M is at least twice as large as N; a data pattern analysis circuit (115) coupled to connected to the storage circuit (113), and configured to analyze the data patterns of a plurality of activity records in the individual data group (330) during a data collection period, so as to generate an or a plurality of reference data sets (340, 342, 344), storing the one or more reference data sets (340, 342, 344) in the storage circuit (113); and an abnormality detection circuit (116) coupled to Connected to the storage circuit (113); wherein, a target IoT device (104) and one or more packet gateway devices (150, 160, 170) in the plurality of IoT devices (104, 105, 106) ) after the subsequent interaction, the one or more packet gateway devices (150, 160, 170) will A new packet message (1110) containing multiple attributes of the target IoT device (104) is generated, and the multiple attribute filtering devices (120, 130, 140) are based on some attributes in the new packet information (1110) , generating a new activity record (1120) corresponding to the target IoT device (104); wherein, the communication circuit (111) is further configured to receive the data generated by the plurality of attribute filtering devices (120, 130, 140). a new activity record (1120), and the anomaly detection circuit (116) is configured to associate the content of one or more target attributes (1113) in the new activity record (1120) with a corresponding data group (1130) about the One or more reference data sets (1140, 1142, 1144) of one or more target attributes are compared to determine whether an abnormality occurs, and if the abnormality detection circuit (116) determines that an abnormality occurs after the comparison, then One or more corresponding alarm messages will be generated. The data detection system (110) of claim 1, wherein the data pattern analysis circuit (115) generates the operation of one or more reference data sets (340, 342, 344) corresponding to individual data groups, Including: selecting one of the M data groups as a current data group; analyzing the content of a first target attribute in a plurality of activity records in the current data group, during the data collection period changes in a plurality of different statistical periods to generate a first reference data set of the current data group about the first target attribute; and analyze a second one of the plurality of activity records in the current data group The content of the target attribute, and the changes in a plurality of different statistical periods during the data collection period, are used to generate a second reference data set of the current data group with respect to the second target attribute. The data detection system (110) according to claim 2, wherein the content of the first target attribute is an uplink throughput (uplink throughput), downlink throughput (downlink throughput), and a device status of a corresponding IoT device (status), or a connection time (session time). The data detection system (110) according to claim 3, wherein the first reference data set is used to present one of the following analysis results of a plurality of activity records in the current data group: device status data with specific content The sum or moving sum of the number of activity records, changes in multiple different statistical periods during the data collection period; the sum, average, moving sum, or moving average of the downlink traffic recorded in the plurality of activity records , the changes in multiple different statistical periods during the data collection period; the sum, average, moving sum, or moving average of the upstream traffic recorded in the plurality of activity records, during the data collection period Changes in different statistical periods; and the sum, average, moving sum, or moving average of the connection times recorded in the multiple activity records, and changes in multiple different statistical periods during the data collection period. The data detection system (110) according to claim 1, wherein the operation of the data classification circuit (114) for classifying the plurality of activity records (320, 322, 324, 326) comprises: selecting the plurality of activities One of the records (320, 322, 324, 326) is used as a current activity record; one of the multiple attributes of the current activity record is selected as a first selected attribute; Any data group corresponding to the content of the selected attribute, create a first data group corresponding to the content of the first selected attribute; classify the current activity record into the first data group; select the current activity record Another attribute of is used as a second selected attribute; if there is no any data group corresponding to the content of the second selected attribute at that time, a second data group corresponding to the content of the second selected attribute is established; and classifying the current activity record into the second data group. The data detection system (110) according to claim 1, wherein the operation of the data classification circuit (114) for classifying the plurality of activity records (320, 322, 324, 326) includes: selecting the N attributes One of them is used as a first selected attribute; according to the different contents of the first selected attribute, a plurality of corresponding first attribute data groups are generated, and the multiple activity records (320, 322, 324, 326 ) into the plurality of first attribute data groups to ensure that the content of the first selected attribute in all activity records in the same first attribute data group is the same; select another one of the N attributes item attribute as a second selected attribute; and according to the different contents of the second selected attribute, generate corresponding multiple second attribute data groups, and record the multiple activities (320, 322, 324, 326) Sorting into the plurality of second attribute data groups to ensure that the content of the second selected attribute in all activity records in the same second attribute data group is the same. The data detection system (110) of claim 1, wherein the data classification circuit (114) is further configured to classify the new activity record (1120) according to the content of the N attributes, so as to utilize the new activity record (1120) Update a plurality of corresponding data groups (1130, 1132, 1134). The data detection system (110) according to claim 7, wherein the data pattern analysis circuit (115) is further configured to update a plurality of reference data corresponding to the plurality of corresponding data groups (1130, 1132, 1134) Sets (1160, 1162, 1164).

Images