CN115776393A - Method, device and system for detecting abnormality, communication equipment and storage medium - Google Patents

Abstract

The application discloses a method, a device and a system for detecting abnormity, communication equipment and a storage medium. Wherein, the method comprises the following steps: determining the data transmission condition between the communication module and the service node; and determining whether the data transmitted between the service node and the communication module is intercepted or not according to the data transmission condition between the communication module and the service node. Through the method and the device, the technical problem that potential safety hazards of data transmission cannot be detected in the related technology can be solved.

Description

Method, device and system for detecting abnormality, communication equipment and storage medium

Technical Field

The present application relates to the field of communications technologies, and in particular, to a method, an apparatus, and a system for detecting an anomaly, a communication device, and a storage medium.

Background

In a conventional monitoring system, a local Network is built to realize data communication between physical devices, a can (short for Controller Area Network) and an rs-485 (a half-duplex working mode is adopted to support multipoint data communication, and a bus Network topology generally adopts a bus structure matched with a terminal.

Aiming at the technical problem that the potential safety hazard of data transmission cannot be detected in the related technology, an effective solution is not provided at present.

Disclosure of Invention

The embodiment of the application provides an anomaly detection method, an anomaly detection device, an anomaly detection system, communication equipment and a storage medium, and aims to solve the technical problem that potential safety hazards of data transmission cannot be detected in the related technology.

To solve the above technical problem, according to an aspect of an embodiment of the present application, there is provided an abnormality detection system including: a service node for collecting data; and the communication module is used for determining whether the data transmitted between the service node and the communication module is intercepted according to the data transmission condition between the communication module and the service node.

Optionally, the detection system further comprises: and the server is in communication connection with the communication module and is used for finishing the change of a key pair through interaction with the communication module under the condition that data transmitted between the service node and the communication module is intercepted, wherein the key pair is used for communication between the server and the communication module.

According to another aspect of the embodiments of the present application, there is also provided a method for detecting an abnormality, including: determining the data transmission condition between the communication module and the service node; and determining whether the data transmitted between the service node and the communication module is intercepted or not according to the data transmission condition between the communication module and the service node.

Optionally, determining a data transmission status between the communication module and the service node includes: measuring a first average reply time interval t of the service node by transmitting a broadcast frame to the service node; and under the condition that the time interval between the time and the previous measurement time reaches the specified duration, measuring a second average reply time interval t' of the service node by sending a broadcast frame to the service node again.

Optionally, the measuring a first average reply time interval of the service node by sending a broadcast frame to the service node includes: transmitting a broadcast frame to the service node; counting the number of nodes replying to the broadcast frame and the time interval of replying to each service node; taking the ratio of the sum of time intervals of all the service node replies counted this time to the number of the nodes counted this time as the first average reply time interval when the number of the nodes counted this time is the same as the number of the nodes counted last time and the change rate of the average reply time interval of the service node compared with the average reply time interval of the last time is less than k%, wherein k is greater than 0; and under the condition that the number of the nodes counted at this time is different from the number of the nodes counted at the previous time and/or the change rate of the average reply time interval of the service nodes compared with the average reply time interval at the previous time is not less than k%, continuously sending the broadcast frame to all the service nodes.

Optionally, determining whether data transmitted between the service node and the communication module is intercepted according to a data transmission status between the communication module and the service node, includes: determining that data transmitted between the service node and the communication module is intercepted under the condition that 100% of a change rate | (t '-t)/t | > between the first average reply time interval t and the second average reply time interval t' reaches L%; and under the condition that the change rate I (t '-t)/t I100% between the first average reply time interval t and the second average reply time interval t' is less than L%, determining that the data transmitted between the service node and the communication module is not intercepted.

Optionally, after determining that the data transmitted between the service node and the communication module is intercepted, the detection method further includes: and finishing the change of the key pair through the interaction between the communication module and the server, wherein the key pair is used for communication between the server and the communication module.

Optionally, the changing of the key pair is completed through interaction between the communication module and the server, including: changing the key pair of the communication module from an old first key pair to a new second key pair through interaction between the communication module and the server; and/or changing the key pair of the server from an old third key pair to a new fourth key pair through interaction between the communication module and the server.

According to another aspect of the embodiments of the present application, there is also provided an abnormality detection apparatus, including: the determining unit is used for determining the data transmission condition between the communication module and the service node; and the detection unit is used for determining whether the data transmitted between the service node and the communication module is intercepted according to the data transmission condition between the communication module and the service node.

Optionally, the determining unit is further configured to: measuring a first average reply time interval t of the service node by transmitting a broadcast frame to the service node; and under the condition that the time interval between the time and the previous measurement time reaches the specified duration, measuring a second average reply time interval t' of the service node by sending a broadcast frame to the service node again.

Optionally, the determining unit is further configured to: transmitting a broadcast frame to the service node; counting the number of nodes replying the broadcast frame and the time interval of replying each service node; taking the ratio of the sum of time intervals of all the service node replies counted this time to the number of the nodes counted this time as the first average reply time interval when the number of the nodes counted this time is the same as the number of the nodes counted last time and the change rate of the average reply time interval of the service node compared with the average reply time interval of the last time is less than k%, wherein k is greater than 0; and under the condition that the number of the nodes counted at this time is different from the number of the nodes counted at the previous time and/or the change rate of the average reply time interval of the service nodes compared with the average reply time interval at the previous time is not less than k%, continuously sending the broadcast frame to all the service nodes.

Optionally, the detection unit is further configured to: determining that data transmitted between the service node and the communication module is intercepted under the condition that 100% of a change rate | (t '-t)/t |) between the first average reply time interval t and the second average reply time interval t' reaches L%; and under the condition that the change rate I (t '-t)/t I100% between the first average reply time interval t and the second average reply time interval t' is less than L%, determining that the data transmitted between the service node and the communication module is not intercepted.

Optionally, the detection unit is further configured to: and after the data transmitted between the service node and the communication module is determined to be intercepted, the key pair is changed through the interaction between the communication module and the server, wherein the key pair is used for communication between the server and the communication module.

Optionally, the detection unit is further configured to: changing the key pair of the communication module from an old first key pair to a new second key pair through interaction between the communication module and the server; and/or changing the key pair of the server from an old third key pair to a new fourth key pair through interaction between the communication module and the server.

According to another aspect of the embodiments of the present application, there is also provided a communication device including the above abnormality detection apparatus.

According to another aspect of embodiments of the present application, there is also provided a computer-readable storage medium including a stored program which, when executed by a processor, implements the method described above.

According to another aspect of the embodiments of the present application, there is also provided an electronic device, including: one or more processors; a storage device for storing one or more programs which, when executed by the one or more processors, cause the one or more processors to implement the method described above.

According to an aspect of the application, a computer program product or computer program is provided, comprising computer instructions, the computer instructions being stored in a computer readable storage medium. The processor of the computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions to cause the computer device to perform the steps of any of the embodiments of the method described above.

By applying the technical scheme, whether the data transmitted between the service node and the communication module is intercepted or not can be determined according to the data transmission condition between the communication module and the service node, and the technical problem that the potential safety hazard of data transmission cannot be detected in the related technology can be solved.

Drawings

FIG. 1 is a schematic diagram of an alternative anomaly detection system according to an embodiment of the present application;

FIG. 2 is a flow chart of an alternative anomaly detection method according to an embodiment of the present application;

FIG. 3 is a schematic view of an alternative anomaly detection device according to an embodiment of the present application;

fig. 4 is a block diagram of a terminal according to an embodiment of the present application.

Detailed Description

In order to make the objects, technical solutions and advantages of the present application clearer, the present application will be described in further detail with reference to the accompanying drawings, and it is obvious that the described embodiments are only a part of the embodiments of the present application, and not all embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present application.

The terminology used in the embodiments of the present application is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. As used in the examples of this application and the appended claims, the singular forms "a", "an", and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise, and "a plurality" typically includes at least two.

It should be understood that the term "and/or" as used herein is merely one type of association that describes an associated object, meaning that three relationships may exist, e.g., a and/or B may mean: a exists alone, A and B exist simultaneously, and B exists alone. In addition, the character "/" herein generally indicates that the former and latter related objects are in an "or" relationship.

It should be understood that although the terms first, second, third, etc. may be used in the embodiments of the present application to describe certain features, these features should not be limited to these terms. These terms are only used to distinguish these technical features.

The words "if", as used herein, may be interpreted as "at … …" or "at … …" or "in response to a determination" or "in response to a detection", depending on the context. Similarly, the phrases "if determined" or "if detected (a stated condition or event)" may be interpreted as "when determined" or "in response to a determination" or "when detected (a stated condition or event)" or "in response to a detection (a stated condition or event)", depending on the context.

It is also noted that the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that an article or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such article or apparatus. Without further limitation, an element defined by the phrase "comprising one … …" does not exclude the presence of another identical element in a good or device that comprises the element.

Example 1

According to the scheme, the data interception can be detected in the local network through the communication module, the data interception can be rapidly known, and measures can be rapidly taken to deal with the data interception. The communication module realizes node data acquisition and uploads the node data to the server. The communication between the communication module and the server and the communication between the communication module and the node are both bidirectional, the node can be a specific source storage network charge device (which is a combined abbreviation of 'power source', 'power grid', 'load' and 'energy storage', the devices improve the power dynamic balance operation of the power system in a more economical, more efficient and safer way through a plurality of interaction forms such as source-source complementation, source-network coordination, network-load interaction, network storage interaction, source-load interaction and the like). As shown in fig. 1, the system includes:

a plurality of service nodes 11 (e.g., nodes 1 to n in fig. 1) for collecting data;

and the communication module 12 is configured to determine whether data transmitted between the service node and the communication module is intercepted according to a data transmission status between the service node and the communication module, where the data transmission status may be loss, increase or decrease of a data packet, change of transmission duration, and the like.

The more the number of data points of the local network is, the more the transmission rate will be affected, on the contrary, if the transmission rate becomes slower, the number of data points may be increased, that is, there is a case of abnormal listening point.

Optionally, the detection system may further include: and the server 13 is in communication connection with the communication module and is used for finishing the change of the key pair through the interaction with the communication module under the condition that the data transmitted between the service node and the communication module is intercepted, wherein the key pair is used for communication between the server and the communication module.

In the security data transmission scheme based on the asymmetric encryption algorithm, the asymmetric encryption algorithm can be adopted to encrypt data transmission, a public key in a key pair is used for exchange and private key privacy, the private key supports irregular updating, and a carrier actively triggering private key change comprises a communication module and a server.

By the scheme, whether the data transmitted between the service node and the communication module is intercepted or not can be determined according to the data transmission condition between the communication module and the service node, and the technical problem that the potential safety hazard of data transmission cannot be detected in the related technology can be solved.

Example 2

According to the scheme, the communication module can detect the intercepted data in the local network, so that the data can be quickly known to be intercepted, and measures can be quickly taken to deal with the intercepted data. Fig. 2 is a flow chart of an alternative anomaly detection method according to an embodiment of the present application, as shown in fig. 2, the method includes the following steps:

step S101, determining the data transmission state between the communication module and the service node.

1) A first average reply time interval t of the service node is measured by transmitting a broadcast frame to the service node.

Optionally, a broadcast frame may be sent to the service node; the service nodes reply after receiving the broadcast frame, and count the number m of the nodes replying the broadcast frame and the time interval t of each service node reply _x (0<x<= m, namely the time interval from the sending of the broadcast frame to the receipt of the reply of the xth node by the communication module), when the network is stable, the number of the replied nodes and the time interval tend to be stable, that is, when the number of the nodes counted this time is the same as the number of the nodes counted last time and the average reply time interval t of the service nodes is less than the change | (t-t ")/t" | 100% of the average reply time interval t "of the service nodes previous time, the value of k is preset, for example, 1), the ratio of the sum of the time intervals replied by all the service nodes counted this time to the number of the nodes counted this time is used as the first average reply time interval, and k is greater than 0; and under the condition that the number of the nodes counted at this time is different from the number of the nodes counted at the previous time and/or the change rate of the average reply time interval of the service nodes compared with the average reply time interval at the previous time is not less than k%, continuously sending the broadcast frame to all the service nodes.

2) And under the condition that the time interval between the time and the previous measurement time reaches the specified time length, measuring a second average reply time interval t' of the service node by sending the broadcast frame to the service node again. The manner of counting the second average recovery time interval t' is similar to that described above, and will not be described herein again.

Step S102, according to the data transmission state between the communication module and the service node, determining whether the data transmitted between the service node and the communication module is intercepted.

The data transmission status may be loss, increase or decrease of a data packet, change of transmission duration, and the like, and taking the latter as an example, when the rate of change | (t '-t)/t | 100% between the first average reply time interval t and the second average reply time interval t' reaches L%, it is determined that data transmitted between the service node and the communication module is intercepted; and under the condition that the change rate I (t '-t)/t I100% between the first average reply time interval t and the second average reply time interval t' is less than L%, determining that the data transmitted between the service node and the communication module is not intercepted.

Optionally, after it is determined that the data transmitted between the service node and the communication module is intercepted, the key pair is changed through interaction between the communication module and the server, and the key pair is used for communication between the server and the communication module.

If so, changing the key pair of the communication module from the old first key pair to the new second key pair through the interaction between the communication module and the server; and/or changing the key pair of the server from the old third key pair to the new fourth key pair through interaction between the communication module and the server.

1) And generating a second key pair at the communication module, for example, starting a key generation program at the communication module, randomly selecting two prime numbers from a preset data set, and generating the second key pair by using a key pair generation algorithm.

2) And encrypting the public key in the second key pair by using the public key in the third key pair to obtain the change request.

3) And sending a change request to a server, wherein the server is used for decrypting the change request by using a private key in the third key pair and carrying out check code calculation on a public key in the second key pair obtained by decryption to obtain a first check code.

4) And receiving a first message returned by the server, wherein the first message is obtained by encrypting the first check code by the server by using the public key in the first key pair.

And under the condition that the first check code obtained by decrypting the first message by using the private key in the first key pair is incorrect, disconnecting the communication module from the server.

5) And under the condition that the first check code obtained by decrypting the first message by using the private key in the first key pair is correct, the key pair of the communication module is changed.

Similarly, the server may also complete the change of the key pair according to the above process, where the first message also carries a public key in a fourth key pair generated by the server (the server may start a key generation program, randomly select two prime numbers from a preset data set, and generate the fourth key pair by using a key pair generation algorithm), and through interaction between the communication module and the server, the key pair of the server is changed from an old third key pair to a new fourth key pair, including: decrypting the first message by using a private key in the first key pair to obtain a public key in the fourth key pair; under the condition that the first check code is correct, carrying out check code calculation on the public key in the fourth key pair to obtain a second check code; sending a second message obtained by encrypting the second check code by using a public key in the third key pair to the server, wherein the server is used for decrypting the second message by using a private key in the third key pair and returning a confirmation message when the second check code is correct; and when the confirmation message returned by the server is received, the key pair of the server is changed.

Through the steps, whether the data transmitted between the service node and the communication module is intercepted or not can be determined according to the data transmission condition between the communication module and the service node, and the technical problem that the potential safety hazard of data transmission cannot be detected in the related technology can be solved.

Example 3

In the monitoring system, a communication module collects data of each node in a local network, if the number of local network nodes is more, data transmission is affected, otherwise, if the data transmission is affected, a disguised abnormal data collection node may exist. As an alternative example, the following detailed description is provided to further describe the technical solution of the present application.

The local network is started for the first time, the communication module firstly sends a broadcast frame, records the number of the nodes replied and the time interval of each node replying.

After the local network is in stable communication, the node position is fixed, so that the node cannot move at will, and the difference between the success rate and the transmission rate of each transmission is small regardless of whether the communication mode is wired or wireless. Therefore, the above operations can be repeated until the number of the nodes to reply is not changed (namely, the nodes enter a stable communication state), and the difference of the average reply time interval of each node is less than k percent (0)<＝k<The smaller the =1,k is, the higher the accuracy is), the communication is stable, and the number m of the node replies and the time interval t of each node reply are recorded _x (0<＝x<= m, i.e. time t at which the x-th node reply frame is received _r -time t at which the communication module transmits the broadcast frame _s ) And calculating the sum T =sigmat of all return time intervals of the node _x (0<＝x<= m), the average reply time interval T = T/m for individual nodes.

After the time interval H is set (H is not too large or too small, and is preferably a plurality of hours), the communication module starts a data interception detection program, sends a broadcast frame, records the number of node replies and the time interval of each node reply, and repeats the operation for a plurality of times until the number of the node replies is unchanged, and the difference of the average reply time interval of each node is less than k percent (0)<＝k<The smaller the =1,k the higher the accuracy), the number n of node replies is recorded, and the time interval t 'of each node reply' _x (0<＝x<N, i.e. the time t 'at which the xth node reply frame is received' _r -the communication module sends the broadcastTime t 'of frame' _s ) Sum of all node reply time intervals T '= Σ T' _x (0<＝x<= n), the individual nodes average recovery time interval T '= T'/n.

And solving that the difference between the average reply time interval of the single node at the current time and the average reply time interval of the single node at the last time is X% = | (t' -t)/t | 100%, and if X > L (L can be set to be 3 or more), indicating that the front and back transmission rates are obviously changed and the risk of data interception exists.

And updating the data acquired this time to the last data, and counting down again to start the data interception detection service.

It should be noted that, for simplicity of description, the above-mentioned method embodiments are described as a series of acts or combination of acts, but those skilled in the art will recognize that the present application is not limited by the order of acts described, as some steps may occur in other orders or concurrently depending on the application. Further, those skilled in the art should also appreciate that the embodiments described in the specification are preferred embodiments and that the acts and modules referred to are not necessarily required in this application.

Through the description of the foregoing embodiments, it is clear to those skilled in the art that the method according to the foregoing embodiments may be implemented by software plus a necessary general hardware platform, and certainly may also be implemented by hardware, but the former is a better implementation mode in many cases. Based on such understanding, the technical solutions of the present application may be embodied in the form of a software product, which is stored in a storage medium (e.g., ROM/RAM, magnetic disk, optical disk) and includes instructions for enabling a terminal device (e.g., a mobile phone, a computer, a server, or a network device) to execute the method according to the embodiments of the present application.

Example 4

According to another aspect of the embodiments of the present application, there is also provided an abnormality detection apparatus for implementing the above abnormality detection method. Fig. 3 is a schematic diagram of an alternative anomaly detection apparatus according to an embodiment of the present application, which may include, as shown in fig. 3:

a determining unit 31, configured to determine a data transmission status between the communication module and the service node; the detecting unit 32 is configured to determine whether data transmitted between the service node and the communication module is intercepted according to a data transmission status between the communication module and the service node.

Through the module, whether the data transmitted between the service node and the communication module is intercepted or not can be determined according to the data transmission condition between the communication module and the service node, and the technical problem that the potential safety hazard of data transmission cannot be detected in the related technology can be solved.

Optionally, the determining unit is further configured to: measuring a first average reply time interval t of the service node by transmitting a broadcast frame to the service node; and under the condition that the time interval between the time and the previous measurement time reaches the specified time length, measuring a second average reply time interval t' of the service node by sending the broadcast frame to the service node again.

Optionally, the determining unit is further configured to: transmitting a broadcast frame to a service node; counting the number of nodes replying to the broadcast frame and the time interval of replying of each service node; under the condition that the number of the nodes counted at this time is the same as the number of the nodes counted at the previous time and the change rate of the average reply time interval of the service nodes compared with the average reply time interval at the previous time is less than k%, taking the ratio of the sum of the time intervals replied by all the service nodes counted at this time to the number of the nodes counted at this time as a first average reply time interval, wherein k is greater than 0; and under the condition that the number of the nodes counted at this time is different from the number of the nodes counted at the previous time and/or the change rate of the average reply time interval of the service nodes is not less than k% compared with the average reply time interval at the previous time, continuously sending the broadcast frame to all the service nodes.

Optionally, the detection unit is further configured to: determining that data transmitted between the service node and the communication module is intercepted under the condition that 100% of a change rate (| (t '-t)/t |) between the first average reply time interval t and the second average reply time interval t' reaches L%; and under the condition that the change rate I (t '-t)/t I100% between the first average reply time interval t and the second average reply time interval t' is less than L%, determining that the data transmitted between the service node and the communication module is not intercepted.

Optionally, the detection unit is further configured to: and after the data transmitted between the service node and the communication module is intercepted, the key pair is changed through the interaction between the communication module and the server, wherein the key pair is used for communication between the server and the communication module.

Optionally, the detection unit is further configured to: through the interaction between the communication module and the server, the key pair of the communication module is changed from the old first key pair to the new second key pair; and/or changing the key pair of the server from the old third key pair to the new fourth key pair through interaction between the communication module and the server.

It should be noted here that the modules described above are the same as the examples and application scenarios implemented by the corresponding steps, but are not limited to the disclosure of the above embodiments. It should be noted that the modules as a part of the apparatus may run in a corresponding hardware environment, and may be implemented by software, or may be implemented by hardware, where the hardware environment includes a network environment.

Example 5

According to another aspect of the embodiments of the present application, there is also provided a communication device, including the above-mentioned abnormality detection apparatus, that is, a device in which the communication module is located.

Example 6

This embodiment provides an electronic device, electronic device includes: processor 201, memory 203, and transmission means 205, as shown in fig. 4, the terminal may further include an input-output device 207; wherein:

the memory 203 may be used to store software programs and modules, such as program instructions/modules corresponding to the methods and apparatuses in the embodiments of the present application, and the processor 201 executes various functional applications and data processing by executing the software programs and modules stored in the memory 203, so as to implement the above-described methods. The memory 203 may include high speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 203 can further include memory located remotely from the processor 201, which can be connected to the terminal over a network. Examples of such networks include, but are not limited to, the internet, intranets, local area networks, mobile communication networks, and combinations thereof.

The transmission device 205 is used for receiving or sending data via a network, and can also be used for data transmission between a processor and a memory. Examples of the network may include a wired network and a wireless network. In one example, the transmission device 205 includes a Network adapter (NIC) that can be connected to a router via a Network cable and other Network devices to communicate with the internet or a local area Network. In one example, the transmission device 205 is a Radio Frequency (RF) module, which is used for communicating with the internet in a wireless manner.

Wherein the memory 203 is specifically used for storing application programs.

The processor 201 may call the application stored in the memory 203 through the transmission means 205 to perform the steps in the above embodiments.

Example 7

The embodiment of the present application provides software for implementing the technical solutions described in the above embodiments and preferred embodiments.

Embodiments of the present application provide a non-volatile computer storage medium, where the computer storage medium stores computer-executable instructions, and the computer-executable instructions may execute the method for editing content in a document in any of the method embodiments described above.

The storage medium stores the software, and the storage medium includes but is not limited to: optical disks, floppy disks, hard disks, erasable memory, etc.

The product can execute the method provided by the embodiment of the application, and has the corresponding functional modules and beneficial effects of the execution method. For technical details that are not described in detail in this embodiment, reference may be made to the methods provided in the embodiments of the present application.

The electronic device of the embodiments of the present application exists in various forms, including but not limited to:

(1) Mobile communication devices, which are characterized by mobile communication capabilities and are primarily targeted at providing voice and data communications. Such terminals include smart phones (e.g., iphones), multimedia phones, functional phones, and low-end phones, among others.

(2) Ultra mobile personal computer device: the equipment belongs to the category of personal computers, has calculation and processing functions and generally has the characteristic of mobile internet access. Such terminals include: PDA, MID, and UMPC devices, etc., such as ipads.

(3) A portable entertainment device: such devices can display and play multimedia content. Such devices include audio and video players (e.g., ipods), handheld game consoles, electronic books, as well as smart toys and portable car navigation devices.

(4) The server is similar to a general computer architecture, but has higher requirements on processing capability, stability, reliability, safety, expandability, manageability and the like because of the need of providing highly reliable services.

(5) And other electronic devices with data interaction functions, such as televisions, large vehicle-mounted screens and the like.

The above-described embodiments of the apparatus are merely illustrative, and the units described as separate parts may or may not be physically separate, and parts displayed as units may or may not be physical units, may be located in one position, or may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of the present embodiment.

Through the above description of the embodiments, those skilled in the art will clearly understand that each embodiment may be implemented by software plus a necessary general hardware platform, and may also be implemented by hardware. With this understanding in mind, the above-described technical solutions may be embodied in the form of a software product, which can be stored in a computer-readable storage medium such as ROM/RAM, magnetic disk, optical disk, etc., and includes instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute the methods described in the embodiments or some parts of the embodiments.

Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, and not to limit the same; although the present application has been described in detail with reference to the foregoing embodiments, it should be understood by those of ordinary skill in the art that: the technical solutions described in the foregoing embodiments may still be modified, or some technical features may be equivalently replaced; and such modifications or substitutions do not depart from the spirit and scope of the corresponding technical solutions in the embodiments of the present application.

Claims (12)

1. An anomaly detection system, comprising:

a service node for collecting data;

and the communication module is used for determining whether the data transmitted between the service node and the communication module is intercepted according to the data transmission condition between the communication module and the service node.

2. The detection system of claim 1, further comprising:

the server is in communication connection with the communication module and is used for finishing the change of a key pair through interaction with the communication module under the condition that data transmitted between the service node and the communication module is intercepted, wherein the key pair is used for communication between the server and the communication module.

3. A method of detecting an abnormality, the method comprising:

determining the data transmission condition between the communication module and the service node;

and determining whether the data transmitted between the service node and the communication module is intercepted or not according to the data transmission condition between the communication module and the service node.

4. The method of claim 3, wherein determining the data transmission status between the communication module and the service node comprises:

measuring a first average reply time interval t of the service node by transmitting a broadcast frame to the service node;

and under the condition that the time interval between the time and the previous measurement time reaches the specified time length, measuring a second average reply time interval t' of the service node by sending a broadcast frame to the service node again.

5. The method of claim 4, wherein measuring the first average reply time interval of the service node by sending a broadcast frame to the service node comprises:

transmitting a broadcast frame to the service node;

counting the number of nodes replying the broadcast frame and the time interval of replying each service node;

taking the ratio of the sum of the time intervals replied by all the service nodes counted this time to the number of the nodes counted this time as the first average reply time interval under the conditions that the number of the nodes counted this time is the same as the number of the nodes counted last time and the change rate of the average reply time interval of the service nodes compared with the average reply time interval of the last time is less than k%, wherein k is greater than 0;

and under the condition that the number of the nodes counted at this time is different from the number of the nodes counted at the previous time and/or the change rate of the average reply time interval of the service nodes compared with the average reply time interval at the previous time is not less than k%, continuously sending the broadcast frame to all the service nodes.

6. The method according to claim 4 or 5, wherein determining whether the data transmitted between the service node and the communication module is intercepted according to a data transmission status between the communication module and the service node comprises:

determining that data transmitted between the service node and the communication module is intercepted under the condition that 100% of a change rate | (t '-t)/t | > between the first average reply time interval t and the second average reply time interval t' reaches L%;

and determining that the data transmitted between the service node and the communication module is not intercepted under the condition that the change rate | t (t '-t)/t | 100% between the first average reply time interval t and the second average reply time interval t' is less than L%.

7. The method of claim 3, wherein after determining that the data transmitted between the service node and the communication module is intercepted, the method further comprises:

and finishing the change of the key pair through the interaction between the communication module and the server, wherein the key pair is used for communication between the server and the communication module.

8. The method of claim 7, wherein the changing the key pair is accomplished via interaction between the communication module and the server, comprising:

changing the key pair of the communication module from an old first key pair to a new second key pair through interaction between the communication module and the server; and/or the presence of a gas in the gas,

and changing the key pair of the server from the old third key pair to the new fourth key pair through the interaction between the communication module and the server.

9. An abnormality detection device, characterized in that the detection device comprises:

the determining unit is used for determining the data transmission condition between the communication module and the service node;

and the detection unit is used for determining whether the data transmitted between the service node and the communication module is intercepted according to the data transmission condition between the communication module and the service node.

10. A communication apparatus comprising the abnormality detection device according to claim 9.

11. A computer-readable storage medium, on which a computer program is stored which, when being executed by a processor, carries out the method according to any one of claims 3 to 8.

12. An electronic device, comprising:

one or more processors;

storage means for storing one or more programs which, when executed by the one or more processors, cause the one or more processors to carry out the method of any one of claims 3 to 8.

Images