CN116028930B - Defense detection method and system for energy data in Internet of things - Google Patents
Defense detection method and system for energy data in Internet of things Download PDFInfo
- Publication number
- CN116028930B CN116028930B CN202310309142.5A CN202310309142A CN116028930B CN 116028930 B CN116028930 B CN 116028930B CN 202310309142 A CN202310309142 A CN 202310309142A CN 116028930 B CN116028930 B CN 116028930B
- Authority
- CN
- China
- Prior art keywords
- energy data
- data
- virtual node
- energy
- abnormal
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Classifications
-
- Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
- Y02D—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE
- Y02D10/00—Energy efficient computing, e.g. low power processors, power management or thermal management
Landscapes
- Selective Calling Equipment (AREA)
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
Abstract
The application discloses a defense detection method and a system of energy data in the Internet of things, wherein the defense detection method of the energy data in the Internet of things specifically comprises the following steps: acquiring energy data and determining an energy data set; detecting local abnormality of the energy data set, and determining whether global abnormal data exist; if global abnormal data exists, isolating the abnormal data; if the global abnormal data does not exist, carrying out local abnormal detection on the energy data in the energy data set, and determining whether the local abnormal data exists or not; and if the local abnormal data exist, isolating the abnormal data. The method and the device can detect global abnormal data and local abnormal data, and can detect the energy data more comprehensively by detecting the whole data to the local data. Meanwhile, after the energy data are detected, abnormal energy data can be isolated, so that the abnormal data are prevented from disturbing the subsequent data processing process, and a defense effect is achieved.
Description
Technical Field
The application relates to the field of data processing, in particular to a defense detection method and system for energy data in the Internet of things.
Background
Along with explosive growth of data, the flow of data processing in the internet of things is more and more complicated. At present, in the process of data detection, abnormal detection of data is often aimed at, and an abnormal data detection task aims at identifying data objects with obvious deviations from most data objects. Conventional abnormal data detection algorithms are currently generally employed to detect abnormal data. However, due to reasons of data dimension disasters, high computational complexity and the like, the traditional abnormal data detection method cannot accurately and completely detect data, so that the detection accuracy is poor.
Therefore, how to provide a defense detection method for simultaneously ensuring detection efficiency and detection integrity is a problem that needs to be solved by those skilled in the art.
Disclosure of Invention
The application provides a defense detection method of energy data in the Internet of things, which specifically comprises the following steps: acquiring energy data and determining an energy data set; detecting local abnormality of the energy data set, and determining whether global abnormal data exist; if global abnormal data exist, isolating the abnormal data; if the global abnormal data does not exist, carrying out local abnormal detection on the energy data in the energy data set, and determining whether the local abnormal data exists or not; if the local abnormal data does not exist, the process exits;
if the local abnormal data exists, isolating the abnormal data.
As described above, the acquiring the energy data includes acquiring the energy data stored in the internet of things in a plurality of time periods, or acquiring the energy data input in real time, and defining the energy data acquired in the plurality of time periods as an energy data set.
As described above, performing local anomaly detection on the energy data set to determine whether global anomaly data exists includes regarding the energy data set as a whole, detecting the energy data set, and checking whether one or more anomalies of the plurality of energy data sets of the set exist.
As above, wherein performing local anomaly detection of an energy data set, determining whether global anomaly data exists includes the sub-steps of: constructing a virtual node; and acquiring energy data from the energy data set, and placing the energy data into the virtual node to detect abnormal data.
And the first virtual node is used for acquiring the energy data from the energy data set at the first moment, and the second virtual node is used for comparing the energy data in the two virtual nodes to finish the detection of the abnormal data.
A defending and detecting system for energy data in the Internet of things specifically comprises: the device comprises an acquisition unit, a global abnormal data determination unit, a local abnormal data determination unit and an isolation unit; the acquisition unit is used for acquiring the energy data and determining an energy data set; the global abnormal data determining unit is used for carrying out local abnormal detection on the energy data set and determining whether global abnormal data exist or not; if global abnormal data exist, the isolation unit performs isolation processing on the abnormal data; if the global abnormal data does not exist, the local abnormal data determining unit performs local abnormal detection on the energy data in the energy data set to determine whether the local abnormal data exists or not; if the local abnormal data exist, the isolation unit performs isolation processing on the abnormal data; the local abnormal data determining unit is used for carrying out local abnormal detection on the energy data in the energy data set and determining whether the local abnormal data exist.
As described above, the acquiring unit acquires the energy data includes acquiring the energy data stored in the internet of things in a plurality of time periods, or acquiring the energy data input in real time, and defining the energy data acquired in the plurality of time periods as the energy data set.
As described above, the global abnormal data determining unit performs local abnormal detection on the energy data set, and determining whether the global abnormal data exists includes regarding the energy data set as a whole, detecting the energy data set, and checking whether one or more abnormal energy data exists in the plurality of energy data sets of the set.
As described above, wherein the global abnormal data determining unit performs local abnormal detection of the energy data set, and determining whether global abnormal data exists includes the sub-steps of: constructing a virtual node; and acquiring energy data from the energy data set, and placing the energy data into the virtual node to detect abnormal data.
As described above, the global abnormal data determining unit obtains one piece of energy data in the energy data set at random at the first moment, stores the one piece of energy data in the first virtual node, still obtains the energy data from the energy data set at the second moment, and places the one piece of energy data in the second virtual node, compares the energy data in the two virtual nodes, and completes detection of the abnormal data.
The application has the following beneficial effects:
in the application, the detection mode can detect the global abnormal data and the local abnormal data, and if the global abnormal data does not exist, the local abnormal data is detected from the whole data to the local data, and the detection mode can be used for detecting the energy data more comprehensively. Meanwhile, after the energy data are detected, abnormal energy data can be isolated, so that the abnormal data are prevented from disturbing the subsequent data processing process, and the defending effect is achieved.
Drawings
In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following description will briefly introduce the drawings that are required to be used in the embodiments or the description of the prior art, and it is obvious that the drawings in the following description are only some embodiments described in the present application, and other drawings may also be obtained according to these drawings for a person having ordinary skill in the art.
Fig. 1 is a flowchart of a defense detection method for energy data in the internet of things according to an embodiment of the present application;
fig. 2 is an internal structure diagram of a defense detection system for energy data in the internet of things according to an embodiment of the present application.
Detailed Description
The following description of the embodiments of the present application, taken in conjunction with the accompanying drawings, clearly and completely describes the technical solutions of the embodiments of the present application, and it is apparent that the described embodiments are some embodiments of the present application, not all embodiments. All other embodiments, which can be made by those skilled in the art based on the embodiments herein without making any inventive effort, are intended to be within the scope of the present application.
According to the defense detection method and the system for the energy data in the Internet of things, after the energy data are acquired, abnormal conditions of the data are detected, and the abnormal data are defended, so that the data processing process can be safer through the defense and detection method.
Example 1
As shown in fig. 1, the method for defending and detecting energy data in the internet of things provided by the embodiment of the application specifically includes the following steps:
step S110: and acquiring energy data and determining an energy data set.
The energy data can comprise raw coal data, crude oil data, natural gas data, power consumption data and the like which are produced or used.
The energy data acquired in this embodiment may be data acquired in a plurality of different time periods, specifically, energy data acquired at different times and stored in the internet of things, or input of real-time input may be acquired, and defense detection processing is performed on the energy data.
The energy data stored in the internet of things and the energy data input in real time can be accessed by the outside at any time, and the acquisition in the embodiment does not mean closed detection of the data.
The acquired plurality of energy data is defined as an energy data set.
Step S120: and carrying out local abnormality detection on the energy data set, and determining whether global abnormal data exist.
The method comprises the steps of regarding an energy data set as a whole, detecting the energy data set, and checking whether one or more abnormal energy data exist in a plurality of energy data sets of the set.
If one or more abnormal energy data exist, the global abnormal data are considered to exist, the detection is completed, and the flow is exited. If there is no energy data of one or more anomalies, then it is considered that there is no global anomaly data, and step S130 is performed.
The method for detecting the local abnormality of the energy data set comprises the following substeps of:
step S1201: and constructing a virtual node.
And constructing a virtual node which is used for comparing the subsequent energy data.
Step S1202: and acquiring energy data from the energy data set, and placing the energy data into the virtual node to detect abnormal data.
Specifically, one piece of energy data in the energy data set is randomly acquired at a first moment, and is stored in a first virtual node, the energy data is still acquired from the energy data set at a second moment, and the energy data is put into a second virtual node, so that the frequency of the energy data in the first virtual node and the frequency of the energy data in the second virtual node are respectively determined.
Because the same energy data is stored in the first virtual node and the second virtual node, when the data is required to be accessed from the outside, the data can be obtained from the first virtual node or the second virtual node, and the data is accessed randomly in theory, but if the number of times of accessing the energy data of the first virtual node is larger than more in a specified period and the number of times of accessing the energy data of the second virtual node is smaller in the specified period, or the number of times of accessing the energy data of the first virtual node is larger than less, and the number of times of accessing the energy data of the second virtual node is larger in the specified period, the embodiment considers that the self of the energy data is possibly problematic and the number of times of accessing the data in the second virtual node is reduced, and considers that the energy data is abnormal data, and global abnormal data exists in the energy data set. Therefore, in this embodiment, by comparing the accessed frequencies of the energy data in the first virtual node and the second virtual node, if the difference between the accessed frequencies of the energy data in the first virtual node and the second virtual node is greater than the specified threshold, it is indicated that the number of accesses in any virtual node is greater or less, and the energy data is considered as abnormal data.
Wherein a total access period T1 is set for the first virtual node, a total access period T2 is set for the second virtual node, a plurality of time periods are included in the total access periods T1 and T2, each time period includes a plurality of times, wherein it is determined whether the energy data in the first or second virtual node in the total access period satisfies the following condition:
，
wherein the method comprises the steps ofRepresenting the number of times the energy data in the first virtual node is accessed at time t1 during the current time period,/for>Representing the number of times the energy data in the second virtual node is accessed at time t1 in a time period, +.>Representing the number of times the energy data in the first virtual node is received and accessed during the current time period,/or->Representing the number of times the energy data in the second virtual node is received during the current time period, is accessed,/or->Indicating whether the energy data in the first virtual node received multiple (access times greater than 5) access requests after the current time period,/v>Indicating whether the energy data in the second virtual node has received a plurality of access requests (access times greater than 5) after the current time period,or->Indicating that multiple access requests are received, +.>Or->Q1 represents the total number of times the energy data in the first virtual node is accessed in the total access period, Q2 represents the total number of times the energy data in the second virtual node is accessed in the total access period, K represents a preset specified threshold, and the value can be set by a worker.
If the energy data in the first virtual node and the second virtual node satisfy the above condition, the data is considered to be abnormal, and if global abnormal data is considered to exist, step S140 is executed. If the energy data in the first virtual node and the second virtual node do not satisfy the above condition, the data is considered to be abnormal, if global abnormal data is considered to be absent, step S130 is executed.
By the method, the abnormality detection of one or more pieces of energy data can be completed.
Step S130: and carrying out local abnormality detection on the energy data in the energy data set, and determining whether the local abnormality data exists.
Specifically, a part of any piece of energy data in the energy data set is randomly selected at the third moment, the part is still acquired at the fourth moment, and whether the acquired part of energy data at different moments is consistent or not is compared. Wherein the energy data acquired at the third momentDefined as->Wherein->For the data volume of a plurality of data segments in the energy data acquired at the third moment, the energy data acquired at the fourth moment is +.>Defined as->Wherein->For the data amount of a plurality of data segments in the energy data acquired at the fourth time, the similarity between any energy data acquired at the third time and the fourth time is compared +.>The concrete steps are as follows:
，
wherein the method comprises the steps ofRepresenting the +.f in the energy data acquired at the third moment>Data amount of individual data segments +.>Representing the +.f in the energy data acquired at the third moment>And the data quantity of the data segments, p, represents the number of the data segments of the acquired energy data.
If the similarity between any energy data acquired at the third time and the fourth timeIf the energy data is larger than the specified threshold value, the data segments acquired at different moments are identical, the energy data is considered to be normal data, the energy data is considered to have no abnormal data, the detection is completed, and the flow is exited.
If the similarity between any energy data acquired at the third time and the fourth timeIf the energy data is smaller than the specified threshold, the data segments acquired at different times are different, the energy data is considered to be abnormal data, if the energy data has local abnormal data, the step S140 is executed.
By the detection mode, global abnormal data and local abnormal data can be detected, if the global abnormal data does not exist, the local abnormal data is detected, and the detection mode is from the whole detection to the local data, so that the energy data can be detected more comprehensively.
Step S140: and carrying out isolation processing on the abnormal data.
If global abnormal data or local abnormal data are detected, isolating the energy data corresponding to the global abnormal data or the energy data corresponding to the local abnormal data.
Creating an abnormal node is further included before the isolating process is performed. And removing the energy data corresponding to the global abnormal data or the local abnormal data from the energy data set, and putting the energy data into an abnormal node to wait for the processing of staff.
By the method, after the energy data are detected, abnormal energy data can be isolated, the abnormal data are prevented from disturbing the subsequent data processing process, and the defending effect is achieved.
Example two
As shown in fig. 2, the system for defending and detecting energy data in the internet of things provided in the embodiment of the present application specifically includes: an acquisition unit 210, a global abnormal data determination unit 220, a local abnormal data determination unit 230, and an isolation unit 240.
Wherein the acquiring unit 210 is configured to acquire energy data and determine an energy data set.
The energy data can comprise raw coal data, crude oil data, natural gas data, power consumption data and the like which are produced or used.
The energy data acquired in this embodiment may be data acquired at a plurality of moments, specifically, energy data acquired at different moments and stored in the internet of things, or input in real time may be acquired, and defense detection processing is performed on the energy data.
The energy data stored in the internet of things and the energy data input in real time can be accessed by the outside at any time, and the acquisition in the embodiment does not mean closed detection of the data.
The acquired plurality of energy data is defined as an energy data set.
The global abnormal data determining unit 220 is configured to perform local abnormal detection on the energy data set, and determine whether global abnormal data exists.
The method comprises the steps of regarding an energy data set as a whole, detecting the energy data set, and checking whether one or more abnormal energy data exist in a plurality of energy data sets of the set.
If one or more abnormal energy data exist, the global abnormal data are considered to exist, the detection is completed, and the flow is exited. If there is no one or more abnormal energy data, it is considered that there is no global abnormal data, and the local abnormal data determining unit 230 performs local abnormal detection on the energy data in the energy data set, and determines whether there is local abnormal data.
The method for detecting the local abnormality of the energy data set comprises the following substeps of:
and constructing a virtual node.
And acquiring energy data from the energy data set, and putting the energy data into the virtual node to detect the data.
Specifically, one piece of energy data in the energy data set is randomly acquired at a first moment, and is stored in a first virtual node, the energy data is still acquired from the energy data set at a second moment, and the energy data is put into a second virtual node, so that the frequency of the energy data in the first virtual node and the frequency of the energy data in the second virtual node are respectively determined.
Because the same energy data is stored in the first virtual node and the second virtual node, when the data is required to be accessed from the outside, the data can be obtained from the first virtual node or the second virtual node, and the data is accessed randomly in theory, but if the number of times of accessing the energy data of the first virtual node is larger than more in a specified period and the number of times of accessing the energy data of the second virtual node is smaller in the specified period, or the number of times of accessing the energy data of the first virtual node is larger than less, and the number of times of accessing the energy data of the second virtual node is larger in the specified period, the embodiment considers that the self of the energy data is possibly problematic and the number of times of accessing the data in the second virtual node is reduced, and considers that the energy data is abnormal data, and global abnormal data exists in the energy data set. Therefore, in this embodiment, by comparing the accessed frequencies of the energy data in the first virtual node and the second virtual node, if the difference between the accessed frequencies of the energy data in the first virtual node and the second virtual node is greater than the specified threshold, it is indicated that the number of accesses in any virtual node is greater or less, and the energy data is considered as abnormal data.
Wherein a total access period T1 is set for the first virtual node, a total access period T2 is set for the second virtual node, a plurality of time periods are included in the total access periods T1 and T2, each time period includes a plurality of times, wherein it is determined whether the energy data in the first or second virtual node in the total access period satisfies the following condition:
，
wherein the method comprises the steps ofRepresenting the number of times the energy data in the first virtual node is accessed at time t1 during the current time period,/for>Representing the number of times the energy data in the second virtual node is accessed at time t1 in a time period, +.>Representing the number of times the energy data in the first virtual node is received and accessed during the current time period,/or->Representing the number of times the energy data in the second virtual node is received during the current time period, is accessed,/or->Indicating whether the energy data in the first virtual node received multiple (access times greater than 5) access requests after the current time period,/v>Representing energy data in a second virtual node at the current timeWhether multiple (greater than 5 accesses) access requests are received after the inter-period,or->Indicating that multiple access requests are received, +.>Or->Q1 represents the total number of times the energy data in the first virtual node is accessed in the total access period, Q2 represents the total number of times the energy data in the second virtual node is accessed in the total access period, K represents a preset specified threshold, and the value can be set by a worker.
If the energy data in the first virtual node and the second virtual node satisfy the above condition, the data is considered to be abnormal, and if global abnormal data is considered to exist, the isolation unit 240 performs the isolation processing of the global abnormal data.
If the energy data in the first virtual node and the second virtual node do not satisfy the above condition, the data is considered to be abnormal, if the data is considered to be free of global abnormal data, the local abnormal data determining unit 230 performs local abnormal detection on the energy data in the energy data set, and determines whether the local abnormal data exists.
The local abnormal data determining unit 230 performs local abnormal detection on the energy data in the energy data set, and randomly selects a part of any piece of energy data in the energy data set at a third time in the process of determining whether the local abnormal data exists, and still acquires the part at a fourth time, and compares whether the acquired part of energy data at different times is consistent. Wherein the energy data acquired at the third momentDefined as->Wherein->For the data volume of a plurality of data segments in the energy data acquired at the third moment, the energy data acquired at the fourth moment is +.>Is defined asWherein->For the data amount of a plurality of data segments in the energy data acquired at the fourth time, the similarity between any energy data acquired at the third time and the fourth time is compared +.>The concrete steps are as follows:
，
wherein the method comprises the steps ofRepresenting the +.f in the energy data acquired at the third moment>Data amount of individual data segments +.>Representing the +.f in the energy data acquired at the third moment>And the data quantity of the data segments, p, represents the number of the data segments of the acquired energy data.
If the similarity between any energy data acquired at the third time and the fourth timeIf the energy data is larger than the specified threshold value, the data segments acquired at different moments are identical, the energy data is considered to be normal data, the energy data is considered to have no abnormal data, the detection is completed, and the flow is exited.
If the similarity between any energy data acquired at the third time and the fourth timeIf the data segment acquired at different time points is smaller than the specified threshold, the data segment acquired at different time points is different, the energy data is considered to be abnormal data, if the energy data has local abnormal data, the isolation unit 240 performs isolation processing of the local abnormal data.
In the isolation processing of the abnormal data, if global abnormal data or local abnormal data is detected, the isolation unit 240 performs the isolation processing of the energy data corresponding to the global abnormal data or the energy data corresponding to the local abnormal data.
Creating an abnormal node is further included before the isolating process is performed. And removing the energy data corresponding to the global abnormal data or the local abnormal data from the energy data set, and putting the energy data into an abnormal node to wait for the processing of staff.
The application has the following beneficial effects:
according to the detection method, the global abnormal data and the local abnormal data can be detected, if the global abnormal data does not exist, the local abnormal data is detected, and the whole data is detected to the local data. Meanwhile, after the energy data are detected, abnormal energy data can be isolated, so that the abnormal data are prevented from disturbing the subsequent data processing process, and the defending effect is achieved.
Although the examples referred to in the present application are described for illustrative purposes only and not as limitations on the present application, variations, additions and/or deletions to the embodiments may be made without departing from the scope of the application.
The foregoing is merely specific embodiments of the present application, but the scope of the present application is not limited thereto, and any person skilled in the art can easily think about changes or substitutions within the technical scope of the present application, and the changes and substitutions are intended to be covered by the scope of the present application. Therefore, the protection scope of the present application shall be subject to the protection scope of the claims.
Claims (8)
1. The defense detection method for the energy data in the Internet of things is characterized by comprising the following steps of:
acquiring energy data and determining an energy data set;
detecting local abnormality of the energy data set, and determining whether global abnormal data exist;
if global abnormal data exist, isolating the abnormal data;
if the global abnormal data does not exist, carrying out local abnormal detection on the energy data in the energy data set, and determining whether the local abnormal data exists or not;
if the local abnormal data does not exist, the process exits;
if the local abnormal data exist, isolating the abnormal data;
performing local anomaly detection of the energy data set, determining whether global anomaly data exists includes the sub-steps of:
constructing a virtual node;
acquiring energy data from the energy data set, and placing the energy data into the virtual node to detect abnormal data;
randomly acquiring one piece of energy data in the energy data set at a first moment, storing the energy data in a first virtual node, still acquiring the energy data from the energy data set at a second moment, and placing the energy data in a second virtual node;
setting a total access period T1 for the first virtual node, setting a total access period T2 for the second virtual node, wherein the total access periods T1 and T2 comprise a plurality of time periods, each time period comprises a plurality of moments, and determining whether energy data in the first or second virtual node in the total access period meets the following conditions;
，
wherein the method comprises the steps ofRepresenting the number of times the energy data in the first virtual node is accessed at time t1 in the current time period,representing the number of times the energy data in the second virtual node is accessed at time t1 in a time period, +.>Representing the number of times the energy data in the first virtual node is received and accessed during the current time period,/or->Representing the number of times the energy data in the second virtual node is received during the current time period, is accessed,/or->Indicating whether the energy data in the first virtual node received multiple access requests after the current time period, is->Indicating whether the energy data in the second virtual node received multiple access requests after the current time period, is->Or->Indicating that multiple access requests are received, +.>Or->Q1 represents the total number of times the energy data in the first virtual node is accessed in the total access period, Q2 represents the total number of times the energy data in the second virtual node is accessed in the total access period, and K represents a preset specified threshold;
if the energy data in the first virtual node and the second virtual node meet the conditions, global abnormal data exist, local abnormal detection is carried out on the energy data in the energy data set, and whether the local abnormal data exist or not is determined.
2. The method for defending and detecting energy data in the internet of things according to claim 1, wherein the step of acquiring the energy data comprises acquiring the energy data stored in the internet of things in a plurality of time periods or acquiring the energy data input in real time, and the energy data acquired in the plurality of time periods is defined as an energy data set.
3. The method for defending and detecting energy data in the internet of things according to claim 1, wherein the step of performing local anomaly detection on the energy data set to determine whether global anomaly data exists comprises regarding the energy data set as a whole, detecting the energy data set, and checking whether one or more anomalies exist in a plurality of energy data sets of the set.
4. The method for defending and detecting energy data in the internet of things according to claim 1, wherein one piece of energy data in the energy data set is randomly acquired at a first moment, and is stored in a first virtual node, the energy data is still acquired from the energy data set at a second moment, the energy data is placed in a second virtual node, and the energy data in the two virtual nodes are compared to finish detection of abnormal data.
5. The utility model provides a defense detecting system of energy data in thing networking which characterized in that specifically includes: the device comprises an acquisition unit, a global abnormal data determination unit, a local abnormal data determination unit and an isolation unit;
the acquisition unit is used for acquiring the energy data and determining an energy data set;
the global abnormal data determining unit is used for carrying out local abnormal detection on the energy data set and determining whether global abnormal data exist or not;
if global abnormal data exist, the isolation unit performs isolation processing on the abnormal data;
if the global abnormal data does not exist, the local abnormal data determining unit performs local abnormal detection on the energy data in the energy data set to determine whether the local abnormal data exists or not;
if the local abnormal data exist, the isolation unit performs isolation processing on the abnormal data;
the local abnormal data determining unit is used for carrying out local abnormal detection on the energy data in the energy data set and determining whether the local abnormal data exist or not;
performing local anomaly detection of the energy data set, determining whether global anomaly data exists includes the sub-steps of:
constructing a virtual node;
acquiring energy data from the energy data set, and placing the energy data into the virtual node to detect abnormal data;
randomly acquiring one piece of energy data in the energy data set at a first moment, storing the energy data in a first virtual node, still acquiring the energy data from the energy data set at a second moment, and placing the energy data in a second virtual node;
setting a total access period T1 for the first virtual node, setting a total access period T2 for the second virtual node, wherein the total access periods T1 and T2 comprise a plurality of time periods, each time period comprises a plurality of moments, and determining whether energy data in the first or second virtual node in the total access period meets the following conditions;
，
wherein the method comprises the steps ofRepresenting the number of times the energy data in the first virtual node is accessed at time t1 in the current time period,representing the number of times the energy data in the second virtual node is accessed at time t1 in a time period, +.>Representing the number of times the energy data in the first virtual node is received and accessed during the current time period,/or->Representing the number of times the energy data in the second virtual node is received during the current time period, is accessed,/or->Indicating whether the energy data in the first virtual node received multiple access requests after the current time period, is->Indicating whether the energy data in the second virtual node received multiple access requests after the current time period, is->Or->Indicating that multiple access requests are received, +.>Or->Q1 represents the total number of times the energy data in the first virtual node is accessed in the total access period, Q2 represents the total number of times the energy data in the second virtual node is accessed in the total access period, and K represents a preset specified threshold;
if the energy data in the first virtual node and the second virtual node meet the conditions, global abnormal data exist, local abnormal detection is carried out on the energy data in the energy data set, and whether the local abnormal data exist or not is determined.
6. The defense detection system according to claim 5, wherein the acquiring unit acquires the energy data includes acquiring the energy data stored in the internet of things or acquiring the energy data input in real time for a plurality of time periods, and the energy data acquired for the plurality of time periods is defined as the energy data set.
7. The system for defending and detecting energy data in the internet of things according to claim 5, wherein the global anomaly data determination unit performs local anomaly detection of the energy data set, and determining whether global anomaly data exists includes regarding the energy data set as a whole, detecting the energy data set, and checking whether one or more anomalies of the plurality of energy data sets of the set exist.
8. The system for defending and detecting energy data in the internet of things according to claim 5, wherein the global abnormal data determining unit obtains one piece of energy data in the energy data set at random at a first moment, stores the one piece of energy data in the first virtual node, still obtains the energy data from the energy data set at a second moment, places the one piece of energy data in the second virtual node, compares the energy data in the two virtual nodes, and completes detection of the abnormal data.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202310309142.5A CN116028930B (en) | 2023-03-28 | 2023-03-28 | Defense detection method and system for energy data in Internet of things |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202310309142.5A CN116028930B (en) | 2023-03-28 | 2023-03-28 | Defense detection method and system for energy data in Internet of things |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN116028930A CN116028930A (en) | 2023-04-28 |
| CN116028930B true CN116028930B (en) | 2023-08-01 |
Family
ID=86077889
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202310309142.5A Active CN116028930B (en) | 2023-03-28 | 2023-03-28 | Defense detection method and system for energy data in Internet of things |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN116028930B (en) |
Families Citing this family (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN116613895B (en) * | 2023-07-21 | 2023-10-31 | 国网天津市电力公司信息通信公司 | Smart grid power data anomaly detection method and system |
Family Cites Families (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US7716011B2 (en) * | 2007-02-28 | 2010-05-11 | Microsoft Corporation | Strategies for identifying anomalies in time-series data |
| CN107038059A (en) * | 2016-02-03 | 2017-08-11 | 阿里巴巴集团控股有限公司 | virtual machine deployment method and device |
| CN110505179B (en) * | 2018-05-17 | 2021-02-09 | 中国科学院声学研究所 | Method and system for detecting network abnormal flow |
| CN109086131A (en) * | 2018-06-25 | 2018-12-25 | 郑州云海信息技术有限公司 | A kind of virtual machine elastic telescopic control method and control device |
| CN110401657B (en) * | 2019-07-24 | 2020-09-25 | 网宿科技股份有限公司 | Processing method and device for access log |
| CN110493817B (en) * | 2019-08-22 | 2023-01-06 | 广州大学 | Data stream monitoring method and device based on representative object, medium and equipment |
| CN111132142A (en) * | 2019-12-24 | 2020-05-08 | 中国联合网络通信集团有限公司 | Security defense method and device |
| CN114143348A (en) * | 2021-11-30 | 2022-03-04 | 中国电力科学研究院有限公司 | Electric power Internet of things security defense method and system, storage medium and server |
-
2023
- 2023-03-28 CN CN202310309142.5A patent/CN116028930B/en active Active
Non-Patent Citations (1)
| Title |
|---|
| 云计算中基于SAPA的DoS攻击防御方法;岳猛;李坤;吴志军;;通信学报(第04期);全文 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN116028930A (en) | 2023-04-28 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN116028930B (en) | Defense detection method and system for energy data in Internet of things | |
| CN107796609B (en) | Water chilling unit fault diagnosis method based on DBN model | |
| CN109539473A (en) | The fault type of air-conditioning system determines method, electronic equipment | |
| CN111080976B (en) | Method and device for monitoring natural gas leakage in real time under temperature change scene | |
| CN116049146B (en) | Database fault processing method, device, equipment and storage medium | |
| CN109882834A (en) | The operation data monitoring method and device of boiler plant | |
| CN116108604A (en) | Water supply network abnormality detection method, system, equipment and storage medium | |
| CN111737555A (en) | Method and device for selecting hot keywords and storage medium | |
| CN117237678B (en) | Method, device, equipment and storage medium for detecting abnormal electricity utilization behavior | |
| CN114765574B (en) | Network anomaly delimitation positioning method and device | |
| CN116346638B (en) | Data tampering inference method based on power grid power and alarm information interaction verification | |
| CN117585554A (en) | Equipment inspection method and inspection system | |
| US20180010982A1 (en) | Engine performance modeling based on wash events | |
| CN116168462A (en) | Safety hidden danger identification method, device and equipment based on intelligent inspection equipment | |
| Sun et al. | Satellite micro anomaly detection based on telemetry data | |
| CN114759227A (en) | Method and device for determining degradation of fuel cell performance | |
| CN116127326B (en) | Composite insulator detection method and device, electronic equipment and storage medium | |
| CN113944801B (en) | Gas pressure regulator performance detection method and device based on data analysis | |
| CN105701018B (en) | A kind of data processing method and equipment for stream calculation | |
| CN118214691B (en) | Network state abnormal data monitoring method, device, equipment, medium and product | |
| CN117367023B (en) | Energy consumption control method, system, equipment and storage medium for refrigerated cabinet | |
| CN115829543B (en) | Method for determining validity of preventive test of power equipment based on fault detection interval | |
| Oluyomi | Detecting False Data Injection in a Large-Scale Water Distribution Network | |
| CN112232115B (en) | Method, medium and equipment for implanting calculation factors | |
| CN110263426B (en) | Medium surface extraction method and device of thin-wall structure model and storage medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |