CN110417621B - Method for detecting abnormal operation state of lightweight embedded system - Google Patents

Method for detecting abnormal operation state of lightweight embedded system Download PDF

Info

Publication number
CN110417621B
CN110417621B CN201910677912.5A CN201910677912A CN110417621B CN 110417621 B CN110417621 B CN 110417621B CN 201910677912 A CN201910677912 A CN 201910677912A CN 110417621 B CN110417621 B CN 110417621B
Authority
CN
China
Prior art keywords
abnormal
value
task
frequency
calculating
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CN201910677912.5A
Other languages
Chinese (zh)
Other versions
CN110417621A (en
Inventor
马峻岩
张特
李剑龙
田叶凡
张佳雨
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Changan University
Original Assignee
Changan University
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Changan University filed Critical Changan University
Priority to CN201910677912.5A priority Critical patent/CN110417621B/en
Publication of CN110417621A publication Critical patent/CN110417621A/en
Application granted granted Critical
Publication of CN110417621B publication Critical patent/CN110417621B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/08—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
    • H04L43/0805—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters by checking availability
    • H04L43/0817—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters by checking availability by checking functioning
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/16—Threshold monitoring
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W24/00—Supervisory, monitoring or testing arrangements
    • H04W24/06—Testing, supervising or monitoring using simulated traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W84/00—Network topologies
    • H04W84/18—Self-organising networks, e.g. ad-hoc networks or sensor networks

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Environmental & Geological Engineering (AREA)
  • Complex Calculations (AREA)
  • Debugging And Monitoring (AREA)

Abstract

A method for detecting the abnormal operation state of a lightweight embedded system comprises the following steps: acquiring a node task execution sequence in a normal state; counting the frequency M of one-step transition of all tasksijSelecting and obtaining a set M of high-frequency task transfer combinations; establishing a hypothesis testing method; setting task window value w and number of samples n of u test statistics0Calculating the mean value mu of each group of high-frequency task transitions in all windows w0(ii) a Setting expected abnormal detection confidence probability alpha, and obtaining the abnormal detection confidence probability according to the alpha query standard normal distribution function table
Figure DDA0002821554240000011
Calculating an abnormal value l; and inserting the abnormal detection codes corresponding to the abnormal discriminants into the corresponding positions of the application source codes together according to the l, thereby detecting whether the application runs abnormally. The invention can effectively detect the abnormal behavior in the program execution process and accurately position the abnormal sequence.

Description

Method for detecting abnormal operation state of lightweight embedded system
Technical Field
The invention relates to the field of embedded system detection in a wireless sensor network environment, in particular to a method for detecting an abnormal running state of a lightweight embedded system, which is used for detecting abnormal behaviors occurring in a program execution process.
Background
The wireless sensor network is an important component of the internet of things, the wireless sensor network is deployed in the real physical world to acquire information of the physical world, and the deployment manner of the wireless sensor network embedded in the physical world is compact, so that the wide-range application of the wireless sensor network faces a lot of challenges. Generally, the deployment environment of the wireless sensor network is severe, and in order to improve the usability of the wireless sensor network, people need more effective and convenient wireless sensor network state monitoring and abnormality diagnosis tools, and state monitoring and abnormality diagnosis after the wireless sensor network is deployed are currently very difficult.
The abnormal operation of the wireless sensor network can be divided into two types: when the node does not conform to the expected behavior due to some program defects or hardware inherent defects, the abnormity usually needs a wireless sensor network development designer to improve the software quality or improve the reliability of the hardware; after the wireless sensor network is deployed, due to the influence of external environment inequality, the wireless sensor network shows behavior which is not in line with expectation, the root cause of the abnormality is irrelevant to software or hardware, but has a relation with the change of the environment where the node is located, and the detection and diagnosis of the abnormality are more complicated.
At present, methods for detecting and diagnosing sensor network abnormality include: the method carries out fault prediction from the whole network and is used for detecting the fault node. And establishing a mapping relation between the fault characteristics and the faults, obtaining a diagnosis result through subnet voting, and diagnosing whether the node faults are fault nodes or not from the node behavior. In addition, there is a method of extracting an execution model of a program from static code and checking for abnormal behavior that may exist in the program.
In the above prior art, the sensing node anomaly detection method cannot accurately locate the position of the fault in the source code, or cannot find the anomaly of the source code in the execution state, which has a relatively obvious defect.
Disclosure of Invention
In view of the problems in the prior art, the present invention aims to: the abnormal operation state detection method for the lightweight embedded system is used for detecting the abnormal operation state of the node according to the information of the node execution program, can effectively detect the abnormal behavior in the program execution process, is convenient to operate, can accurately position the abnormal sequence, improves the effectiveness of abnormal processing, and has small invasion to the task program.
In order to achieve the purpose, the invention has the following technical scheme:
the method comprises the following steps:
acquiring a node task execution sequence in a normal state;
counting the frequency M of one-step transition of all tasksijSelecting and obtaining a set M of high-frequency task transfer combinations;
establishing a hypothesis testing method;
setting task window value w and number of samples n of u test statistics0Calculating the mean value mu of each group of high-frequency task transitions in all windows w0(ii) a Setting expected abnormal detection confidence probability alpha, and obtaining the abnormal detection confidence probability according to the alpha query standard normal distribution function table
Figure GDA0002821554230000021
Calculating an abnormal value l; inserting the abnormal detection codes corresponding to the abnormal discriminants into corresponding positions of the application source codes together according to the l, thereby detecting whether the application runs abnormally; wherein, M, w, mu0，
Figure GDA0002821554230000022
And the anomaly detection code is coded in a hard coding mode.
Preferably, the test is performed before the deployment of the sensing nodes, and the final test result is used as the expected node task execution sequence in the normal state.
Preferably, the frequency M of the one-step transition of all tasks is countedijThe method comprises the following specific steps:
in the node task execution sequence, the node is in the process of executing the task tiState, being in execution task t through N task transitionsi+NThe frequency of the states is called from tiTo ti+NWherein when the frequency is shifted from tiTo ti+NWhen N is 1, it is called one-step transfer frequency; in a simplified representation, when t isi＝Ti，ti+1＝Tj，MijRepresents TiTo TjThe frequency is shifted in one step.
Preferably, the method for establishing the hypothesis test specifically comprises the following steps:
3-1, establishing a hypothesis testing model;
3-2. assumption of Condition H0：μ＝μ0，μ0Calculating the mean value of each group of high-frequency task transfers in all windows w;
3-3, calculating an abnormal value l;
3-4, selecting a threshold value;
for a known significance level α, it is derived from a hypothesis-tested normal distribution table
Figure GDA0002821554230000031
The value of (d) as a threshold;
3-5, judging:
if the abnormal value l obtained by calculation is less than or equal to the threshold value
Figure GDA0002821554230000032
Then assume the hypothetical condition H0If the system is not in the normal state, judging that the system state is abnormal by the abnormal value l; if l is greater than the threshold value
Figure GDA0002821554230000033
Then assume the hypothetical condition H0And if so, the system state is considered to be normal.
Preferably, the hypothesis test in step 3-1 is to make a certain hypothesis on the parent, randomly extract a subsample from the parent, and test whether the hypothesis is true using the subsample.
Preferably, step 3-3 above will be statistical quantity
Figure GDA0002821554230000034
Is changed into
Figure GDA0002821554230000035
Order to
Figure GDA0002821554230000036
Figure GDA0002821554230000037
Then
Figure GDA0002821554230000038
μ0From step 3-2, it is found thatThe window number n of values is set in step 3-1, a is calculated,
Figure GDA0002821554230000039
when the value is greater than the threshold value, calculating a plurality of subsequences of the task sequence to be detected under the operation of the sensing node.
Preferably, the method of calculating the value of a is as follows:
selecting an unsigned long type with a large value range as a variable type for calculating A, wherein the expression for calculating A is as follows:
Figure GDA00028215542300000310
Figure GDA00028215542300000311
the calculation process of A does not relate to floating point type, and the numerical calculation of A does not generate errors.
Preferably, calculating
Figure GDA00028215542300000312
The method of values of (a) is as follows:
order to
Figure GDA00028215542300000313
Then there is
Figure GDA00028215542300000314
Figure GDA00028215542300000315
Is iterated for the constructed mean value, and then obtained
Figure GDA00028215542300000316
The value of (c).
Compared with the prior art, the invention has the following beneficial effects:
the method comprises the steps of calculating the one-step task transfer probability of a task sequence to be detected, defining a task transfer abnormal value based on a u inspection theory, and inspecting the node task transfer abnormality according to the abnormal value; the invention is onlyThose few task branch combinations are of interest because they are executed more frequently and their sum occupies a significant portion of the execution time of the system during normal operation, typically. When an abnormal value l is calculated, an unsigned long type with a large value range is selected as a variable type for calculating A, and a structure is formed
Figure GDA00028215542300000317
The iterative mode effectively saves resources on the dimensionality of computing time and space in the embedded system and prevents computing overflow. The technical scheme can effectively detect the abnormal behaviors occurring in the program execution process, provides code-level help for the positioning and the repair of the abnormal behaviors, can completely run in a low-end embedded mode, and has low resource overhead.
Furthermore, when the hypothesis testing model is established, the hypothesis testing is to make a certain hypothesis on the parent, randomly extract a subsample from the parent, and test whether the hypothesis is established by using the subsample. The hypothesis testing method of the present invention is a method based on u-test improvement. The u-test can be a parametric hypothesis test on the maternal mean, which is an approximation of the t-test in a big subsample scene, and the big subsample is approximately normally distributed according to the central limit theorem. The u-test uses a biased estimate of the standard deviation of the samples instead of an unbiased estimate of the standard deviation in the t-test.
Furthermore, when the value of A is calculated, the calculation relates to accumulation and multiplication, and a hardware multiplier is arranged in the microcontroller in the calculation time, so that the multiplication speed is high, and no additional optimization is needed; in the calculation space, since A is a summation value, the optimization is difficult, and the value is always a non-negative integer, an unsigned long type with a large value range is selected as a variable type for calculating A.
Further, calculating
Figure GDA0002821554230000041
When the value is in the range of the type variable, a type variable with a larger value range needs to be defined in order to prevent overflow, and the invention constructs
Figure GDA0002821554230000042
Iteratively, the process of calculating the mean value is distributed and calculated when each window comes, so that a type with smaller RAM occupation can be used for defining
Figure GDA0002821554230000043
Drawings
In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings needed to be used in the description of the embodiments are briefly introduced below, and it is obvious that the drawings in the following description are some embodiments of the present invention, and it is obvious for those skilled in the art to obtain other drawings based on these drawings without creative efforts.
FIG. 1 is a flow chart of a method of the present invention;
FIG. 2 is an experimental environment of abnormal change in node position according to the present invention;
fig. 3(a) an interface diagram of calculated outliers detected on a node by t2 pad.u:
fig. 3(b) anomaly detection interface diagram of t2pad.u on node:
Detailed Description
The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are some, not all, embodiments of the present invention.
Based on the embodiments of the present invention, those skilled in the art can make several simple modifications and decorations without creative efforts, and all other embodiments obtained belong to the protection scope of the present invention.
The terms "first," "second," "third," and "fourth," etc. in the description and claims of the invention and in the accompanying drawings are used for distinguishing between different objects and not for describing a particular order. Furthermore, the terms "include" and "have," as well as any variations thereof, are intended to cover non-exclusive inclusions. For example, a process, method, system, article, or apparatus that comprises a list of steps or elements is not limited to only those steps or elements listed, but may alternatively include other steps or elements not listed, or inherent to such process, method, article, or apparatus.
Reference herein to "an embodiment" means that a particular feature, structure, or characteristic described in connection with the embodiment can be included in at least one embodiment of the invention. The appearances of the phrase in various places in the specification are not necessarily all referring to the same embodiment, nor are separate or alternative embodiments mutually exclusive of other embodiments. It is explicitly and implicitly understood by one skilled in the art that the embodiments described herein can be combined with other embodiments.
Referring to fig. 1, the invention provides a method for detecting an abnormal operation state of a lightweight embedded system, which comprises the following steps:
step 1: and testing before the deployment of the sensing nodes, and taking the final test result as the execution sequence of the node tasks in an expected normal state.
Step 2: counting the frequency M of one-step transition of all tasksijAnd selecting a high-frequency secondary transfer task which occupies a higher transfer frequency ratio of one step of the task so as to obtain a set M of a high-frequency secondary task transfer combination. The method comprises the following specific steps:
in the node task execution sequence, the node is in the process of executing the task tiState, being in execution task t through n task transitionsi+nThe frequency of the states is called from tiTo ti+nWherein when the frequency is shifted from tiTo ti+nWhen n is 1, it is called one-step transition frequency. For convenience of presentation, when ti＝Ti，ti+1＝Tj，MijRepresents TiTo TjThe frequency is shifted in one step.
And step 3: method for establishing hypothesis test, setting task window value w and number of samples n of u test statistics0I.e. the number of windows in which the abnormal value is calculated each time, the mean value mu of each group of high-frequency task transitions in all windows w is calculated0(ii) a Setting expected abnormal detection confidence probability alpha, and inquiring the mark according to alphaTable derivation of quasi-normal distribution function
Figure GDA0002821554230000061
An outlier/is calculated. And inserting the abnormal detection codes corresponding to the abnormal discriminants into the corresponding positions of the application source codes together according to the l, thereby detecting whether the application runs abnormally.
Wherein, M, w, mu0，
Figure GDA0002821554230000062
And the anomaly detection code is coded in a hard coding mode.
The method comprises the following specific steps:
3-1, establishing a hypothesis testing model;
the basic principle of the test method is assumed: the hypothesis test is to make a certain hypothesis on the parent, randomly extract a subsample from the parent, and test whether the hypothesis is true by using the subsample. The hypothesis testing method of the present invention is a method based on u-test improvement. The u-test can be a parametric hypothesis test on the maternal mean, which is an approximation of the t-test in a big subsample scene, and the big subsample is approximately normally distributed according to the central limit theorem. The u-test uses a biased estimate of the standard deviation of the samples instead of an unbiased estimate of the standard deviation in the t-test.
3-2, hypothesis Condition H0：μ＝μ0；
μ0Is the mean of the parents in a normal distribution, mu in the present invention0Calculating the mean value of each group of high-frequency task transfers in all windows w;
3-3, calculating an abnormal value l;
to facilitate the calculation, statistics are calculated
Figure GDA0002821554230000063
Is changed into
Figure GDA0002821554230000064
Order to
Figure GDA0002821554230000065
Figure GDA0002821554230000066
Then
Figure GDA0002821554230000067
μ0From step 3-2, the window number n of outliers is set in step 3-1, a is calculated,
Figure GDA0002821554230000068
when the value is greater than the threshold value, calculating a plurality of subsequences of the task sequence to be detected under the operation of the sensing node, specifically as follows:
3-3-1, calculating A;
the calculation involves accumulation and multiplication, and in the calculation time, a hardware multiplier is arranged in the microcontroller, so that the multiplication speed is high, and no additional optimization is needed; in the calculation space, since a itself is a summation value, it is difficult to re-optimize, and its value is always a non-negative integer, an unsigned long type with a large value range is selected as a variable type for calculating a, and then a is calculated as follows:
Figure GDA0002821554230000069
because the floating point type is not involved in the calculation process of A, errors cannot be generated in the numerical calculation of A.
3-3-2, calculation
Figure GDA00028215542300000610
To prevent overflow, a type variable with a large value range needs to be defined, and the type variable can be constructed
Figure GDA00028215542300000611
Iteratively, the process of calculating the mean value is distributed and calculated when each window comes, so that a type with smaller RAM occupation can be used for defining
Figure GDA0002821554230000071
Order to
Figure GDA0002821554230000072
Then there is
Figure GDA0002821554230000073
Then
Figure GDA0002821554230000074
Is iterated for the constructed mean value, and then obtained
Figure GDA0002821554230000075
The value of (c).
3-4, selecting a threshold value:
for a known significance level α, it is derived from a hypothesis-tested normal distribution table
Figure GDA0002821554230000076
The value of (d) is used as a threshold.
3-5, judging standard:
if the abnormal value l obtained by calculation is less than or equal to the threshold value
Figure GDA0002821554230000077
Then assume the hypothetical condition H0If the system is not in the normal state, judging that the system state is abnormal by the abnormal value l; if l is greater than the threshold value
Figure GDA0002821554230000078
Then assume the hypothetical condition H0And if so, the system state is considered to be normal.
Implementing authentication
This example serves to verify the validity of the method of the invention.
The embedded operating systems used in the embodiments are TinyOS 2.1.x and Telosb nodes. The network program is run using a Cooja simulator, which is a type of sensor network simulator with instruction level accuracy. Acquiring a task execution sequence during running by capturing a task ID before a scheduler schedules a task by modifying a TinyOS kernel code, and extracting and recording running task information of a node by modifying an interface provided by Cooja.
The invention adopts a real node test experiment, referring to fig. 2, a real node experimental environment is established in a laboratory, nodes are deployed in the laboratory to establish a test network environment, and an 802.15.4 packet grabber is established to check a network topology structure according to packet header information of an aerial data packet. As shown in table 1, 8 high-frequency task transfers are obtained by selecting a simulation experiment before deployment and selecting a high-frequency task that accounts for 77% of the task execution proportion, and the transfer mean parameter is calculated, where the confidence probability a is set to 0.05.
Table 1 task transfer parameters (w 2000, n 16)
Figure GDA0002821554230000079
And generating a T2PAD.U node abnormity detection program according to the parameters, injecting the program into a source code and operating a node, and lighting a red LED when the node abnormity is detected. During the experiment, the node No. 2 is closed, at the moment, the node No. 4 loses the father node, and the node enters an abnormal state which is not expected. As shown in fig. 3(a) and 3(b), it can be seen that t2pad.u detects abnormal behavior and turns on the LED indicator. In the analysis of this example, the task branch set M includes 8 task branch combinations shown in table 1, each task branch combination needs to define a variable of 8 bytes in total for calculation, and in addition, two counter variables of 3 in total need to be defined additionally, which allocate space of 2 bytes and 1 byte respectively.
TinyOS is applied in a sleep state where the CPU stops for most of the time, so that the CPU load, i.e., the CPU utilization, caused by the program to the node can be obtained by counting the number of active CPU machine cycles within a certain time. The invention counts the number of machine periods using the T2PAD.U and not using the T2PAD.U within a certain time to calculate the CPU utilization rate of the program, and for example, the comparison between the T2PAD.U used by the node and the T2PAD.U not used by the node in the table 2 shows that the CPU occupation of the node is slightly increased after the T2PAD.U is used. In conclusion, the T2PAD.U method has obvious low-cost superiority, and can operate an anomaly detection algorithm on nodes.
TABLE 2 CPU occupancy on nodes of T2PAD.U
Figure GDA0002821554230000081
While the invention has been described in connection with various embodiments, other variations to the disclosed embodiments can be understood and effected by those skilled in the art in practicing the claimed invention, from a review of the drawings, the disclosure, and the appended claims. In the claims, the word "comprising" does not exclude other elements or steps, and the word "a" or "an" does not exclude a plurality. The mere fact that certain measures are recited in mutually different dependent claims does not indicate that a combination of these measures cannot be used to advantage.
As will be appreciated by one skilled in the art, embodiments of the present invention may be provided as a method, apparatus (device) or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein. A computer program stored/distributed on a suitable medium supplied together with or as part of other hardware, may also take other distributed forms, such as via the Internet or other wired or wireless telecommunication systems.
The foregoing has been described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (devices) and computer program products according to embodiments of the invention. It will be understood that each flow and/or block of the flow diagrams and/or block diagrams, and combinations of flows and/or blocks in the flow diagrams and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows.
These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows.
While the invention has been described in conjunction with specific features and embodiments thereof, it will be evident that various modifications and combinations can be made thereto without departing from the spirit and scope of the invention. Accordingly, the specification and figures are merely exemplary of the invention as defined in the appended claims and are intended to cover any and all modifications, variations, combinations, or equivalents within the scope of the invention. It will be apparent to those skilled in the art that various changes and modifications may be made without departing from the spirit and scope of the invention, and these changes and modifications also fall within the scope of the claims of the invention and their equivalents.

Claims (8)

1. A method for detecting the abnormal operation state of a lightweight embedded system is characterized by comprising the following steps:
acquiring a node task execution sequence in a normal state;
counting the frequency M of one-step transition of all tasksijSelecting and obtaining a set M of high-frequency task transfer combinations;
establishing a hypothesis testing method;
setting task window value w and number of samples n of u test statistics0Computing stationMean value mu of each group of high-frequency task branches within window w0(ii) a Setting expected abnormal detection confidence probability alpha, and obtaining the abnormal detection confidence probability according to the alpha query standard normal distribution function table
Figure FDA0002821554220000011
Calculating an abnormal value l; inserting the abnormal detection codes corresponding to the abnormal discriminants into corresponding positions of the application source codes together according to the l, thereby detecting whether the application runs abnormally; wherein, M, w, mu0，
Figure FDA0002821554220000012
And the anomaly detection code is coded in a hard coding mode.
2. The method for detecting the abnormal operation state of the lightweight embedded system according to claim 1, wherein: and testing before the deployment of the sensing nodes, and taking the final test result as the execution sequence of the node tasks in an expected normal state.
3. The method for detecting the abnormal operation state of the lightweight embedded system according to claim 1, wherein:
counting the frequency M of one-step transition of all tasksijThe method comprises the following specific steps:
in the node task execution sequence, the node is in the process of executing the task tiState, being in execution task t through N task transitionsi+NThe frequency of the states is called from tiTo ti+NWherein when the frequency is shifted from tiTo ti+NWhen N is 1, it is called one-step transfer frequency; in a simplified representation, when t isi＝Ti，ti+1＝Tj，MijRepresents TiTo TjThe frequency is shifted in one step.
4. The method for detecting the abnormal operation state of the lightweight embedded system according to claim 1, wherein:
the method for establishing hypothesis testing specifically comprises the following steps:
3-1, establishing a hypothesis testing model;
3-2. assumption of Condition H0：μ＝μ0，μ0Calculating the mean value of each group of high-frequency task transfers in all windows w;
3-3, calculating an abnormal value l;
3-4, selecting a threshold value;
for a known significance level α, it is derived from a hypothesis-tested normal distribution table
Figure FDA0002821554220000013
The value of (d) as a threshold;
3-5, judging:
if the abnormal value l obtained by calculation is less than or equal to the threshold value
Figure FDA0002821554220000021
Then assume the hypothetical condition H0If the system is not in the normal state, judging that the system state is abnormal by the abnormal value l; if l is greater than the threshold value
Figure FDA0002821554220000022
Then assume the hypothetical condition H0And if so, the system state is considered to be normal.
5. The method for detecting the abnormal operation state of the lightweight embedded system according to claim 4, wherein: in the step 3-1, hypothesis testing is to make a certain hypothesis on the parent, randomly extract a subsample from the parent, and test whether the hypothesis is true by using the subsample.
6. The method for detecting the abnormal operation state of the lightweight embedded system according to claim 4, wherein:
step 3-3 will count amount
Figure FDA0002821554220000023
Is changed into
Figure FDA0002821554220000024
Order to
Figure FDA0002821554220000025
Then
Figure FDA0002821554220000026
μ0From step 3-2, the window number n of outliers is set in step 3-1, a is calculated,
Figure FDA0002821554220000027
when the value is greater than the threshold value, calculating a plurality of subsequences of the task sequence to be detected under the operation of the sensing node.
7. The method for detecting the abnormal operation state of the lightweight embedded system according to claim 6, wherein:
the method of calculating the value of a is as follows:
selecting an unsigned long type with a large value range as a variable type for calculating A, wherein the expression for calculating A is as follows:
Figure FDA0002821554220000028
Figure FDA0002821554220000029
the calculation process of A does not relate to floating point type, and the numerical calculation of A does not generate errors.
8. The method for detecting the abnormal operation state of the lightweight embedded system according to claim 6, wherein:
computing
Figure FDA00028215542200000210
The method of values of (a) is as follows:
order to
Figure FDA00028215542200000211
Then there is
Figure FDA00028215542200000212
Figure FDA00028215542200000213
Is iterated for the constructed mean value, and then obtained
Figure FDA00028215542200000214
The value of (c).
CN201910677912.5A 2019-07-25 2019-07-25 Method for detecting abnormal operation state of lightweight embedded system Active CN110417621B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201910677912.5A CN110417621B (en) 2019-07-25 2019-07-25 Method for detecting abnormal operation state of lightweight embedded system

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201910677912.5A CN110417621B (en) 2019-07-25 2019-07-25 Method for detecting abnormal operation state of lightweight embedded system

Publications (2)

Publication Number Publication Date
CN110417621A CN110417621A (en) 2019-11-05
CN110417621B true CN110417621B (en) 2021-01-12

Family

ID=68363139

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201910677912.5A Active CN110417621B (en) 2019-07-25 2019-07-25 Method for detecting abnormal operation state of lightweight embedded system

Country Status (1)

Country Link
CN (1) CN110417621B (en)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11132342B2 (en) * 2019-12-02 2021-09-28 Alibaba Group Holding Limited Periodicity detection and period length estimation in time series
CN112381110A (en) * 2020-10-10 2021-02-19 神华北电胜利能源有限公司 Coal mine production multidimensional data abnormal probability prediction method based on fuzzy rule

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2004030172A (en) * 2002-06-25 2004-01-29 Matsushita Electric Ind Co Ltd Inspection method and inspection device for usb standard communication function
CN107092582B (en) * 2017-03-31 2021-04-27 江苏方天电力技术有限公司 Online abnormal value detection and confidence evaluation method based on residual posterior
CN107947972B (en) * 2017-11-16 2021-01-15 长安大学 Detection method and detection device for sensing abnormal operation state of node

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
A Survey of Recent Achievements for Wireless Sensor Networks Testbeds;ma junyan等;《IEEE》;20171014;全文 *

Also Published As

Publication number Publication date
CN110417621A (en) 2019-11-05

Similar Documents

Publication Publication Date Title
CN109587008B (en) Method, device and storage medium for detecting abnormal flow data
US8473789B2 (en) Memory leak monitoring system and associated methods
US8140911B2 (en) Dynamic software tracing
CN108491302B (en) Method for detecting spark cluster node state
CN110417621B (en) Method for detecting abnormal operation state of lightweight embedded system
CN107193732B (en) Verification function positioning method based on path comparison
CN106997316B (en) System and method for detecting abnormal increase of memory
EP3245588A1 (en) Root cause analysis of non-deterministic tests
WO2015080742A1 (en) Production sampling for determining code coverage
JP6196196B2 (en) Inter-log causal estimation device, system abnormality detection device, log analysis system, and log analysis method
CN110347572B (en) Method, device, system, equipment and medium for outputting performance log
CN112905370A (en) Topological graph generation method, anomaly detection method, device, equipment and storage medium
CN115576831A (en) Test case recommendation method, device, equipment and storage medium
CN103577312B (en) The detection method of the time performance of a kind of software and device
CN111309584A (en) Data processing method and device, electronic equipment and storage medium
CN111382052A (en) Code quality evaluation method and device and electronic equipment
CN110442508B (en) Test task processing method, device, equipment and medium
CN110225025B (en) Method and device for acquiring abnormal network data behavior model, electronic equipment and storage medium
CN112799911A (en) Node health state detection method, device, equipment and storage medium
US7831879B2 (en) Generating test coverage bin based on simulation result
CN117493127B (en) Application program detection method, device, equipment and medium
Falai et al. Quantitative evaluation of distributed algorithms using the neko framework: The nekostat extension
CN116401113B (en) Environment verification method, device and medium for heterogeneous many-core architecture acceleration card
CN111385342A (en) Internet of things industry identification method and device, electronic equipment and storage medium
CN116016262B (en) Method and device for detecting call chain consistency in real time based on union

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant