Anomaly detection of communication link of mobile internet of things based on EM algorithm

Abstract

The abnormality of communication link of mobile Internet of Things will threaten the security of communication of mobile Internet of Things, and the existing abnormality detection method is limited due to low accuracy, long time consumption and high energy consumption. To this end, the anomaly detection method of communication link of mobile Internet of Things based on EM algorithm is proposed in this study. Firstly, the anomaly range of the Internet of Things is located according to the communication node information of the data changes. Then the abnormal link of the target is judged and the anomaly feature of the communication link of the Internet of Things based on twin neural network is extracted. Finally, EM algorithm is improved with semi-supervised machine learning method to detect abnormal communication links of mobile Internet of Things. The experimental results show that the proposed method has the advantages of high precision, short time consumption and low energy consumption in the anomaly detection of communication links in the Internet of Things.

Keywords

EM algorithm mobile internet of Things communication link anomaly feature extraction anomaly detection

1. Introduction

With the rapid development of Internet of Things technology, the number and complexity of attacks on mobile Internet of Things communication networks are increasing. Attacks on Internet of Things systems are mainly aimed at stealing sensitive data, injecting false information or interfering with the normal operation of networks and businesses [1]. The single-port link of the communication network of mobile Internet of Things can no longer meet the bandwidth demand of network data traffic, and multiple egress links are needed to increase the bandwidth. Multiple egress links can effectively improve the stability of network egress [2]. However, due to the large amount of interactive data in multi-link INSTANT messages, data differentiation is obvious. Once data anomalies occur, the security of the entire network will be affected [3]. Anomaly detection of communication link of mobile Internet of Things has become a major problem in the current communication field. One of the core problems to be solved is the comprehensiveness of information acquisition and the accuracy of link information description. Since abnormal connection is extremely harmful in mobile Internet of Things, it needs to quickly and accurately detect abnormal links in mobile Internet of Things and make a reasonable response, which has become a hot issue in academic and industry circles at home and abroad.

Zhao [4] proposed an anomaly detection method for interactive data in multi-link instant communication. This method only considers the time series transformation characteristics, combines k-means clustering and particle swarm optimization algorithm to cluster the interactive abnormal data, and obtains the clustering objective function. By using particle swarm optimization, the deviation function of abnormal interactive data was obtained, and the abnormal data in multi-link was calculated to determine the abnormal interactive data in multi-link IM, so as to realize the detection of abnormal points. However, this method has poor detection accuracy although its cost is low. Zhao [5] proposed a link interruption fault detection method for hierarchical heterogeneous networks based on breakpoint data. The relationship between the network link and each node was analyzed, the transmitting power and SNR of the node information were calculated, the probability of network link interruption was calculated, and the detection range was determined. Then the samples of breakpoint data of network link were collected, the features of the sample data were extracted with time-frequency analysis method, and the feature types of breakpoint data were categorized by clustering analysis. After feature extraction and classification of breakpoint data, linear transformation and KNN algorithm were combined to classify the link data of hierarchical heterogeneous network, divide normal data from abnormal data, and complete the fault detection of link interruption. The fault detection rate of this method is high, but the detection accuracy is low and the detection time is long.

Based on this, this paper proposes an anomaly detection method of communication link of mobile Internet of Things based on EM algorithm. First, the information of network node is identified according to the data change of each communication node of mobile Internet of Things, and then anomaly range of Internet of Things is located; secondly, the anomaly features in communication link of the Internet of Things based on twin neural network are extracted according to the eigenvalues of the abnormal connection matrix by judging the location of abnormal link of the target communication link; thirdly, on the basis of the semi-supervised machine learning algorithm, the maximum likelihood algorithm is used to improve the EM algorithm by introducing the least squares penalty term into the maximum likelihood function, introducing non-negative constraint as prior information, and combining with the semi-supervised machine learning method; finally, based on the improved EM algorithm, the abnormal communication link is located, and then the abnormal communication link of mobile Internet of Things is detected.

2. Anomaly feature extraction of communication link of mobile internet of things

It is necessary to extract the anomaly characteristics of communication link of the mobile Internet of Things. This process consists of basic steps, including locating the anomaly range of the Internet of Things, judging the location of abnormal link of the target communication link, and extracting the anomaly feature of the communication link of the Internet of Things based on twin neural network. The following section will presents the extraction steps of the anomaly feature of the mobile network communication link.

2.1 The abnormal location range of Internet of Things

User access to the communication network and the operation of the sensor network node itself may cause abnormality of the network node. The use of the Internet of Things can realize the exchange of information between things and things, and locate the anomaly range of the communication network. Considering the correlation and interaction between network nodes, the network traffic transmission process is regarded as a motion process. It is known that the anchor node in the communication network may be a smartphone or a traditional mobile device. When locating the anomaly range of the network, it is assumed that the number, location and network topology of the anchor node device in the communication network are fixed [6].

When the communication network is in normal use, set one of the target nodes to 0, use $n$ mobile anchor node, calculate the location of the target node, the anchor node is 1, 2, $\ldots$ , $n$ , one of the nodes is $i\left(i=1,2,\ldots,n\right)$ , and its location is set to $p_{i}$ , and the target node to be located can be set to $p_{j}$ . In order to calculate the location information of the target node, the distance between the node and other nodes needs to be calculated. It is assumed that the anchor node needs to meet the constraints shown in Eq. (1):

$\displaystyle\sqrt{\sum\limits_{1}^{n}{(p_{j}-p_{i})}}=r_{i}$ (1)

In order to ensure the computing security of the Internet of Things, Eq. (1) is transformed into Eq. (2):

$\displaystyle\sum\limits_{1}^{n}{p^{2}_{j}-}\sum\limits_{1}^{n}{p_{i}}=r^{2}_{% 0}p_{j}$ (2)

According to the above conversion results, use the $n$ formula, subtract the $i$ formula, and eliminate the quadratic term on the left side of Eq. (2) to obtain a linear equation $X^{T}\partial=Y$ . According to the definitions of $X=\sum_{1}^{n}{p_{j}-}\sum_{1}^{n}{p_{i}}$ and $Y=r_{i}p_{i}$ in the formula, the linear equation is obtained:

$\displaystyle p^{0}=\left({X^{T}X}\right)^{-1}X^{T}Y$ (3)

The above result is the farthest distance of the abnormal node calculated by the Internet of Things with a target node as the center. The above steps are repeated to obtain the abnormality range of communication network formed by all network abnormal nodes in the communication network link. The Internet of Things completely covers and senses network links. According to the data changes of each node, the functions of information exchange and information coverage can be realized based on the information exchange function of the Internet of Things. Then the associated anchor nodes are affected and the range of abnormal nodes is located [7].

2.2 Abnormal location of communication link

When determining the location of the abnormal link of the Internet of Things. The judgment process will be interfered by the noise of the data collected by the actual environmental link. Therefore, it is necessary to judge the signal values of abnormal mutation structures confronted by the noise and the abnormal data, as shown in Fig. 1.

Figure 1.

Signal values of anomalous mutational structures confounded by noise and anomalous data.

By mutating the signal value of the structure, the noise and confounding factors affecting the diagnosis of abnormal data are analyzed, and the abnormal data is denoised. The mutation information in the data is saved, the singular values in the intrinsic attributes of the data are decomposed, and the noise reduction is performed through preprocessing to improve the signal-to-noise ratio of the mutation information in the data [8]. Thus, a new abnormal data matrix suitable for decomlocation is obtained, and the calculation formula is as follows.

$\displaystyle P=v\left[{{\begin{array}[]{cccccc}{\lambda_{1}}&&&&&\\ &{\lambda_{2}}&&&&\\ &&\ddots&&&\\ &&&{\lambda_{k}}&&\\ &&&&\ddots&\\ &&&&&{\lambda_{N}}\\ \end{array}}}\right]u\left[{{\begin{array}[]{cccccc}{\lambda_{1}}&&&&&\\ &{\lambda_{2}}&&&&\\ &&\ddots&&&\\ &&&{\lambda_{k}}&&\\ &&&&\ddots&\\ &&&&&{\lambda_{N}}\\ \end{array}}}\right]$ (4)

In the formula, the eigenvalue of the matrix is expressed as $\lambda=[\lambda_{1},\lambda_{2},\ldots,\lambda_{N}]$ , and the eigenvalue of the matrix $P$ is set to $\lambda_{k}$ . Summarize the eigenvector elements according to the eigenvalues, set the weighting matrix of the target abnormal link to $W\in P^{N\times N}$ , and judge the fluctuation range of the target abnormal link sensing data accordingly. The calculation formula is as follows:

$\displaystyle W_{ij}=\left\{{\begin{array}[]{ll}a_{ij}/X^{2},&j\neq i\\ 0,&i=j\\ \end{array}}\right.$ (5)

When the correlation degree 1 between two adjacent links $i$ and $j$ is $a_{ij}$ , there is a connection relationship between the two links. When the correlation degree $a_{ij}$ between two adjacent links $i$ and link $j$ is 0, the vector distance $k_{ij}$ between link $i$ and link $j$ can be calculated according to the formula as follows:

$\displaystyle k_{ij}=\frac{\sqrt{\left({x_{i}-x_{j}}\right)^{2}+\left({y_{i}-y% _{j}}\right)^{2}}}{W_{ij}}$ (6)

where $x_{i}$ , $x_{j}$ are the abscissa of the links $i$ and $j$ , respectively, and $y_{i}$ , $y_{j}$ are the ordinate of the links $i$ and $j$ , respectively. According to the vector distance between adjacent links, the vector elements of the eigenvalue of the target abnormal link are analyzed. It can be seen that when the eigenvalue of the matrix increases, the distance between the eigenvectors and the previous adjacent link also becomes farther.

Using the feature storage sequence of the target abnormal link, the anomaly location is obtained by the delay change of the feature vector storage sequence. First, define the decomlocation value $t_{r}$ of the eigenvector, divide it according to the element type of the eigenvector, and calculate the eigenvalue $T$ of the abnormal link matrix according to Eq. (7) as follows:

$\displaystyle T=\frac{(t_{r}+t_{w})}{t_{s}t_{r}}\times\frac{(t_{r}+t_{w})}{t_{% s}t_{w}}$ (7)

where $t_{w}$ represents the abnormal location error value generated by the delay change of the sequence, and $t_{s}$ represents the characteristic value of the sequence jointly formed by the elements in the location where the delay change anomaly occurs. According to the probability of abnormal situation, the abnormal location in the ultra-long-distance communication link of Internet of Things is locked, and a safe bypass hierarchical structure is established for the target abnormal link location.

2.3 Anomaly feature extraction of communication link of Internet of Things based on twin neural network

According to the abnormal location results of the divided communication links of Internet of Things, the problem of abnormal data feature extraction of communication links is transformed into a data similarity measurement problem, and the abnormal communication data features are extracted by twin neural network [9]. For each abnormal data set after training and classification, obtain the mapping function $f\left({\zeta,\xi}\right)$ , and carry out network learning on the mapping function $f\left({\zeta,\xi}\right)$ according to the abnormal data $\zeta$ and candidate data $\xi$ to be extracted. If the two data have the same attributes, the similarity value of mapping function $f\left({\zeta,\xi}\right)$ will be higher; on the contrary, the similarity value of the mapping function $f\left({\zeta,\xi}\right)$ is lower.

The data to be extracted $\zeta$ and the candidate data $\xi$ have the same twin neural network extraction features $\varphi\left(\zeta\right)$ and $\varphi\left(\xi\right)$ . If the similarity between the two features is evaluated by the similarity measure function $g$ , the mapping function $f\left({\zeta,\xi}\right)$ can be expressed as follow:

$\displaystyle f\left({\zeta,\xi}\right)=g\left({\varphi\left(\zeta\right),% \varphi\left(\xi\right)}\right)$ (8)

The abnormal data extraction process of the communication link of Internet of Things based on twin neural network is described as follows:

(1)

IoT communication data input twin neural network: Assuming that the abnormal data feature to be extracted in the initial data set is $\left({w,h}\right)$ and the feature compensation is $p_{z}$ , the data attribute $S_{z}$ to be extracted in the initial data set can be expressed as follows:

$\displaystyle S_{z}=\left({w+p_{z}}\right)\times\left({h+p_{z}}\right)$ (9)

The candidate data feature generated by the abnormal data to be extracted is $\left({w_{z},h_{z}}\right)$ , and the feature compensation is $p_{x}$ . The relation between the two can be expressed as Eq. (10):

$\displaystyle p_{x}=\frac{U\times S_{z}}{I}$ (10)

where $U$ , $I$ represent matrix functions related to data features.

Therefore, the following definitions of candidate data attributes $S_{x}$ are derived:

$\displaystyle S_{x}=h_{z}\left({w_{z}+p_{x}}\right)$ (11)

(2)

Feature extraction of abnormal data: since the Siamese neural network model does not have a fully connected layer, the output data of the convolutional layer is set to the extracted data features.

(3)

Similarity calculation: According to the features extracted by the Siamese neural network, the similarity between the data to be extracted and the candidate data is measured. The cross-correlation layer is adopted to measure the similarity according to Eq. (12) [10, 11]:

$\displaystyle f\left({\zeta,\xi}\right)=\varphi\left(\zeta\right)\times\varphi% \left(\xi\right)+b$ (12)

where $b$ represents the one-dimensional real vector.

If the output data of the twin neural network is $c$ and the label data is $y\in\left\{{1,-1}\right\}$ , the following logistic loss function is applied to train the network model:

$\displaystyle l\left({y,c}\right)=\log\left({\exp\left({-yc}\right)}\right)$ (13)

Combined with Eq. (12), when the number of abnormal data features in the IoT communication link is $D$ , the anomaly feature extraction of the IoT communication link can be expressed by Eq. (14):

$\displaystyle L\left({y,c}\right)=\frac{1}{\left|D\right|}l\left({y\left[u% \right],c\left[u\right]}\right)$ (14)

3. Communication link anomaly detection based on EM algorithm

The above process has completed the anomaly feature extraction of mobile IoT communication link. Next, we will improve the algorithm to detect the abnormalities of the communication link. The specific steps are as follows.

3.1 Improvement of EM algorithm based on semi-supervised machine learning

EM algorithm is a method based on gradient rise. When applied to model parameter estimation, it can ensure the increase of likelihood function after iteration. However, it can only obtain the local optimal solution, which is a big disadvantage. To this end, semi supervised machine learning method is adopted to improve EM algorithm in this study. Firstly, the least squares penalty term is added to the maximum likelihood function, and non negative constraints are introduced as a priori information; then EM algorithm is improved combined with semi supervised machine learning method so as to realize the anomaly detection of communication link.

Based on the prior theory, according to the probability penalty theorem and the binomial distribution probability function, the L log-likelihood function is expressed as:

$\displaystyle l\left(\beta\right)=\sum\limits_{0}^{i}{\sum\limits_{0}^{n}{y_{i% }}}\ln\left[{\alpha_{i}}\right]$ (15)

where, $\alpha_{i}$ is the covariate probability, and $y_{i}$ is a one-dimensional vector of $\iota\times 1$ , representing the i-th observed variable.

Adding the penalty term to the maximum likelihood function will greatly reduce the error caused by the score function. The penalty term added in this paper is the least squares penalty term [12, 13], which can be expressed by Eq. (16):

$\displaystyle i\left(k\right)=\left[{a_{1}\left(k\right)I_{0}+a_{2}\left(k% \right)I_{d}+a_{m}\left(k\right)I_{ns}}\right]\times e\left(k\right)$ (16)

It should be pointed out that $i\left(k\right)$ can be either quadratic or non-quadratic. The quadratic penalty term has a simple structure, which usually leads to data loss, while the non-quadratic penalty term can avoid this drawback. In this paper, the non-quadratic penalty term is used [14].

The one-step recursive least squares algorithm is to solve the estimated value ${I}^{\prime}$ of the unknown $I$ through the estimated value of the previous stage and the correction strategy, and the column vector is represented by coefficients $K\left({k+1,n,k}\right)$ and $K\left({k+1,n,k+n}\right)$ , respectively. Let $n=n+1$ , by adding the non-quadratic penalty factor to the maximum likelihood function, the estimation error with multiple parameters can be obtained:

$\displaystyle{I}^{\prime}\left({k,n+1}\right)=P^{-1}\left({k,n+1}\right)A^{T}% \left({k,n+1}\right)i(k)={I}^{\prime}\left({k,n}\right)+K\left({k,n+1,k+n}% \right)\left[{i\left({k+n}\right)-a^{T}\left({k+n}\right){I}^{\prime}\left({k,% n}\right)}\right]$ (17)

where the estimated values obtained from the $n$ and $n+1$ data corresponding to the $K\left({k,n+1,k+n}\right)=P^{-1}\left({k,n+1}\right)a\left({k+n}\right)$ , $k$ to $\left({k+n-1}\right)$ and $k$ to $\left({k+n}\right)$ periods are ${I}^{\prime}\left({k,n}\right)$ and ${I}^{\prime}\left({k,n+1}\right)$ , respectively.

Filter out the historical data at time $k$ , maintain the length of the data window, and add new data at time $k+n$ , the resulting estimated value ${I}^{\prime}\left({k+1,n}\right)$ is shown in Eq. (18):

$\displaystyle{I}^{\prime}\left({k+1,n}\right)=P^{-1}\left({k+1,n}\right)A^{T}% \left({k+1,n}\right)Y\left({k+1,n}\right)={I}^{\prime}\left({k,n+1}\right)-K% \left({k+1,n,k}\right)\left[{i\left(k\right)-a^{T}\left(k\right){I}^{\prime}% \left({k,n+1}\right)}\right]$ (18)

where $K\left({k+1,n,k}\right)=P^{-1}\left({k+1,n}\right)a\left(k\right)$ .

According to the above equations, the following two equations are obtained, as shown in Eqs (19) and (20):

$\displaystyle\left\{{\begin{array}[]{l}{I}^{\prime}\left({k,n+1}\right)={I}^{% \prime}\left({k,n}\right)+K\left({k,n+1,k+n}\right)\\ \left[{i\left({k+n}\right)-a^{T}\left({k+n}\right){I}^{\prime}\left({k,n}% \right)}\right]\\ k\left({k,n+1,k+n}\right)=P^{-1}\left({k,n+1}\right)a\left({k+n}\right)\\ \end{array}}\right.$ (19) $\displaystyle\left\{{\begin{array}[]{l}{I}^{\prime}\left({k+1,n}\right)={I}^{% \prime}\left({k,n+1}\right)-K\left({k+1,n,k}\right)\\ \left[{i\left(k\right)-a^{T}\left(k\right){I}^{\prime}\left({k,n+1}\right)}% \right]\\ k\left({k+1,n,k}\right)=P^{-1}\left({k+1,n}\right)a\left(k\right)\\ \end{array}}\right.$ (20)

To sum up, the least squares algorithm based on the two-step recursion is based on the estimated value ${I}^{\prime}\left({k,n}\right)$ of the data window of length $n$ at time $k$ , and the estimated value ${I}^{\prime}\left({k,n+1}\right)$ of the data window of length $n+1$ at the same time is solved by Eq. (20). The estimated value ${I}^{\prime}\left({k+1,n}\right)$ of the data window at time $k+1$ at the same length is obtained by solving the Eq. (13).

Based on the above maximum likelihood function processing, the non negative constrained prior information is introduced, and the semi supervised machine learning method is used to improve the EM algorithm. EM algorithm usually repeats step e and step m continuously until the convergence of parameters, and the local optimal value can be obtained under ideal conditions [15]. Using semi supervised machine learning method, the determined results can be introduced into the current labeled sample set at each training, and the obtained results can be used to achieve better training effect, which greatly avoids the local maximum.

In this section, this semi supervised machine learning method is used to improve the EM algorithm. To be specific, mark the determined sample data according to the results obtained in step e, and train the samples in the new training set in step M in each iteration. Then, the unlabeled sample set will be gradually reduced, which increases the iteration speed and prevents interference.

The frequent itemset mining algorithm is used to generate frequent itemsets including confidence, support and item names. Through the frequent itemsets, the basic data in the two-dimensional array is associated and mined. Perform exponential smoothing analysis and linear regression analysis on the decrypted basic data, predict the time series data of IoT communication, and use the weighted average as the final prediction result. Through exponential smoothing analysis, the development trend of basic data can be found, which is expressed by Eq. (21):

$\displaystyle G_{t}=bQ+\left({1-b}\right)G_{t-1}$ (21)

where $G_{t}$ and $G_{t-1}$ are the smoothed values at time $t$ and time $t-1$ , respectively, $b$ is the smoothing coefficient, and the weight between the current predicted value and the previous predicted value is used, and $Q$ is the observed value of the historical sequence of the basic data at time $t$ . When $b$ is close to 1, it is determined that the new predicted value has greatly corrected the error of the previous predicted value. When $b$ is close to 0, it is determined that the new predicted value has corrected the error slightly. When $b$ is equal to 0, it is determined that the new predicted value is the same as the previous predicted value. Through linear regression analysis, the least squares method is used to solve the linear regression parameters, and the linear relationship between the basic data and related variables is predicted within the confidence interval. The basic IoT communication data with time series is stored in the database. According to the needs of the basic data receiver, a semi-supervised classification label set is set, and the k-label set algorithm is used to train a multi-label classifier on the label set. Through the maximum posterior probability, the degree of correlation between the basic data association item and the label is determined. The basic data time series $k$ is calculated, the maximum posterior probability $D_{k}\left(e\right)$ containing the semi-supervised classification label $e$ is obtained:

$\displaystyle D_{k}\left(e\right)=\text{argmaxP}\left({R_{e}}\right)P\left({U_% {e}\left|{R_{e}}\right.}\right)$ (22)

where $P$ is the prior probability, $R_{e}$ is the event whose $k$ -related data item contains label $e$ , and $R_{e}$ is the event whose $k$ -nearest-neighbor associated item contains label $e$ . In the label set, the semi-supervised classification label with the largest value of $D_{k}\left(e\right)$ is selected as the corresponding label of the associated data item, and the $k$ -item set of the basic data is classified.

The semi supervised machine learning method will label the determined unlabeled samples in each iteration and put them into the labeled sample set to provide high-quality labeled samples for the subsequent process, which greatly reduces the number of cycles of the EM algorithm and avoids the problem that only the local optimal solution can be obtained.

3.2 Anomaly detection of communication link based on improved EM algorithm

The overall communication network link of the mobile IoT is set as a dynamic link. The determination of the detection range of each $\iota$ network sensor depends on the central location as the detection part. $r^{\prime}$ is used as the radius, $R$ is used as the communication radius, and the target is located in the $\iota$ th. Within the detection range of the sensor, the resulting observable measurement value is $z_{\iota}\left(\kappa\right)$ . If there are $\dot{L}$ task sensors participating in target tracking in the network in $\kappa$ time periods, the improved EM algorithm is used to determine the initial target in the initial stage of observing the target, so that the sum of the square errors of the key sequence data and the time data is minimized, which can be expressed as follow:

$\displaystyle E=\sum\limits_{\iota=1}{\left({\left\|{\hat{x}_{t}-x_{s\iota}^{% \iota}}\right\|-z_{\iota}\left(\kappa\right)}\right)^{2}}$ (23)

where $\left\|{\hat{x}_{t}-x_{s\iota}^{\iota}}\right\|$ is the Euclidean distance between the location of the dynamic link and the coordinates of the network task sensor. In the case of meeting $\dot{L}>2$ , since observation noise is involved in link abnormality detection, the optimal approximate solution of the equation system is obtained through the following equation:

$\displaystyle\hat{X}_{\dot{L}S}=\left[{x_{t}y_{t}}\right]=A^{T}z_{\iota}\left(% \kappa\right)$ (24)

where $z_{\iota}$ represents the measurement accuracy, $A^{T}$ represents the measurement matrix. When observing the target, the observation quality of each sensor is very different, and it can be approximately considered that the observation quality of the dynamic link near the target is high.

In order to improve the anomalies detection accuracy of communication link of mobile IoT, the improved EM algorithm is used to accurately locate the abnormal link, and the following formula can be obtained:

$\displaystyle\hat{X}_{\dot{L}S}=\left[{x_{t}y_{t}}\right]=\textit{WA}^{T}% \textit{Wz}_{\iota}\left(\kappa\right)$ (25)

where $W$ represents the weight matrix. Within a communication network of mobile IoT, a consistency filter can be embedded in each link of the target key sequence. The discrete-time linear consistency algorithm is adopted to make it reach the observable state, of which the expression is as follow:

$\displaystyle x_{\iota}^{\kappa+1}=x_{\iota}^{\left(\kappa\right)}+\delta\left% ({\sum\limits_{\upsilon_{j}\in N_{\iota}^{\prime}}{a_{\iota j}\left({x_{j}^{% \left(\kappa\right)}-x_{j}^{\left(\kappa\right)}}\right)}+\sum\limits_{% \upsilon_{j}\in J_{\iota}}{a_{\iota j}\left({u_{j}^{\left(\kappa\right)}-x_{% \iota}^{\left(\kappa\right)}}\right)}}\right)$ (26)

where $\delta$ denotes the step size, $x_{\iota}^{\left(\kappa\right)}$ and $x_{j}^{\left(\kappa\right)}$ denotes the current state and the next state of the $\iota$ th link, $N_{\iota}^{\prime}$ denotes the neighbor set of the $\iota$ th link, and $J_{\iota}=N_{\iota}^{\prime}\cup\left\{\iota\right\}$ denotes the set of neighbors without dynamic link $\iota$ . If the dynamic link $j$ can receive the information of the link $\iota$ , it can be determined as $a_{\iota j}=1$ , otherwise it conforms to $a_{\iota j}=0$ , and the result of the setting Eq. (26) converges to the state of $x^{\ast}=\left(c\right)^{T}$ . Based on the improved EM algorithm, the consistency protocol can be used to measure the key sequence and multiple links in the communication network of mobile IoT, and complete the detection of abnormal links.

4. Experimental analysis

The communication process of mobile animal networking is repeated on the MATLAB simulation platform. A 500 $\times$ 500 square meter area is designed by using the simulation software to simulate the IoT communication network. There are 12 highly abnormal links and 5 low-level abnormal links in the network. A comparative experiment is designed by taking the proposed method as the experimental group and the methods in Reference [4] and Reference [5] as the control group. Through the analysis of the experimental results, the application performance and effectiveness of the proposed method are verified. The method of Reference [4] is anomaly detection method of multilink instant communication interaction data, and the method of Reference [5] is anomaly detection method of hierarchical heterogeneous network link interruption.

4.1 Detection accuracy rate of abnormal links in mobile Internet of Things communication

Three methods are used to detect the abnormal links of the communication link of mobile Internet of Things, and the abnormal links obtained under various methods are detected by changing the total number of samples, and the efficiency of the detection of the abnormal links of the mobile Internet of Things communication is obtained, and the results obtained by the three methods are compared, and the specific data is shown in Table 1.

Table 1
The test results of the detection accuracy of abnormal communication links

Number of	Abnormal link detection efficiency of mobile IoT communication
samples/piece	The proposed method	The method in Reference [4]	The method in Reference [5]
100	0.02%	0.12%	0.14%
200	0.01%	0.08%	0.15%
300	0.03%	0.11%	0.18%
400	0.01%	0.10%	0.21%
500	0.02%	0.09%	0.24%
600	0.02%	0.09%	0.23%
700	0.01%	0.11%	0.21%
800	0.03%	0.10%	0.18%
900	0.01%	0.09%	0.16%
1000	0.01%	0.12%	0.20%

From the experimental results in Table 1, it can be seen that compared with the method in Reference [4] and the method in Reference [5], the proposed method has the highest accuracy when detecting abnormal communication links, and can effectively determine the abnormal operation status of the communication link of mobile IoT. The reason is that the proposed method uses the improved EM algorithm to extract the characteristics of abnormal communication links in IoT before modeling and then classify them, which effectively improves the detection accuracy of abnormal communication links in mobile IoT.

4.2 Time-consumption in detection of abnormal communication links in mobile Internet of Things

In order to effectively obtain the identification efficiency of the three anomaly detection methods, the proposed method and the two comparison methods are compared in terms of time consumption in detection of abnormal communication links in mobile Internet of Things. The final results are shown in Fig. 2.

Figure 2.

Time consumption in detection of abnormal communication link in mobile Internet of Things for three methods.

From the experimental results in Fig. 2, it can be seen that the average time consumption of the proposed method in the detection of abnormal links is 1.54 s, and the stability of each test result is good; The average time consumption of Reference [4] is 8.65 s, which is far lower than the proposed method in terms of detection efficiency; The average time consumption in the detection of abnormal communication links is 4.87 s. The method in Reference [4] and Reference [5] are in an unstable state during the whole experiment process. Among the three abnormality detection methods, the efficiency of the proposed method is the highest, which can effectively ensure the real-time detection of abnormal communication links in mobile Internet of Things.

4.3 Loss rate of abnormal nodes in mobile Internet of Things

The improved EM algorithm is used to detect the abnormality of the communication link. Compared with the two comparison methods, the loss rate of abnormal nodes under the three detection methods is recorded, and the loss rate of abnormal nodes under the three methods is calculated. The results are collated into Table 2.

Table 2
Statistical results of loss rate of abnormal nodes

Number of experiments/	Loss rate/%
second-rate	The proposed method	Method in Reference [4]	Method in Reference [5]
10	2.93	22.14	12.02
20	3.01	14.09	11.14
30	2.23	21.27	11.25
40	3.06	15.21	10.29
50	1.98	17.03	10.38
60	2.36	18.02	9.26
70	3.02	21.12	14.74
80	2.21	24.56	19.18

According to the calculation in Table 2, the highest loss rate of the proposed method is only 3.06% in multiple tests; while that of the method in Reference [4] is 24.56% in multiple tests; In multiple tests, the average loss rate reached 19.18%. It can be seen that the traditional method has larger lose rate of abnormal nodes, and the detection results seriously deviate from the reality. Those abnormal nodes that have not been discovered will seriously threaten the security of the mobile Internet of Things, and may cause leakage incidents in serious cases.

4.4 Energy consumption in abnormality detection of mobile IoT communication link

Surrounding neighbor nodes should be considered in anomaly detection of communication link of mobile IoT. With the gradual exhaustion of node energy, the application life of mobile IoT communication network will be reduced. Based on the anomaly detection method of communication link of mobile IoT, a simulation experiment is carried out on the energy consumption of adjacent nodes, and the comparison results are shown in Fig. 3.

Figure 3.

Energy consumption of neighbor nodes under different identification methods.

As can be seen from Fig. 3, the method in Reference [5] consumes a large amount of energy of neighbor nodes when identifying abnormal nodes in the network. Compared with the previous two methods, the method proposed in this paper performs better in the energy consumption of neighbor nodes. It can quickly lock and narrow the abnormal interval by extracting the features of abnormal nodes. With the assistance of neighbor nodes and updating the trust value, it can quickly detect the abnormality in the communication link of mobile Internet of Things and greatly reduce the energy consumption of neighbor nodes during identification.

Based on the previous research results, this paper improves the EM algorithm so that the analysis results are no longer limited to the local optimal solution. From the above experimental results, it can be seen that the proposed method can effectively detect the abnormality of the communication link of mobile Internet of Things, further detect the abnormal nodes in the network space, and effectively divide them, so the node loss rate is low. The above shows that the proposed method can improve the efficiency of abnormal detection of communication link of mobile Internet of Things, shorten the time consumption in detection process, reduce the loss rate of abnormal nodes, and reduce the energy consumption in the detection process. The proposed method can repair abnormal nodes in a timely manner, prevent viruses from invading the network, and maintain the communication security of Internet of Things.

5. Conclusion

With the rapid development of information technology, people’s demand for network information is increasing rapidly, and the workload of wireless communication network is also increasing day by day. In order to deal with network node failure, this paper proposes anomaly detection method of communication link of mobile Internet of Things based on EM algorithm. In this paper, the information of network nodes in mobile IoT is collected according to each communication node with data changes in the whole region. Then, the anomaly range of Internet of Things is located, and the anomaly of target link is judged. According to the eigenvalue of abnormal connection matrix, the anomaly features of Internet of Things is extracted based on twin neural network. This paper also analyzes the implementation process of EM algorithm and introduces non-negative constraint prior information. Since EM algorithm is difficult to solve global spatial optimal solution, semi-supervised machine learning mechanism is used to optimize and improve EM algorithm to prevent from falling into local optimal solution. Finally, the improved EM algorithm is used to realize abnormal detection of communication link of mobile Internet of Things. The final experimental results show that compared with the two comparison methods, the proposed method has higher detection accuracy of abnormal nodes, shorter detection time, and lower energy consumption. However, there are still some problems in the results obtained by the proposed method. Further research on smooth abnormal detection of communication link of mobile Internet of Things is needed.

Footnotes

Fundings

The research is supported by: General project of philosophy and social science research in Jiangsu Universities in 2022, Research on the cooperative education system of professional teachers and counselors in Higher Vocational Colleges from the perspective of “Curriculum Ideology and politics” 2022SJYB0908.

References

Roy

Nemade

Bhattacharjee

. Symmetry chirp modulation waveform design for LEO satellite IoT communication. IEEE Commun Lett. 2019; 23(10): 1836-1839.

Feltrin

Tsoukaneri

Condoluci

Buratti

Verdone

. Narrowband IoT: A survey on downlink and uplink perspectives. IEEE Wireless Commun. 2019; 26(1): 78-86.

Meng

Liu

Gao

Zhang

Gray

. Radio frequency identification and sensing: integration of wireless powering, sensing, and communication for IIoT innovations. IEEE Commun Magazine. 2021; 59(3): 38-44.

Zhao

. Simulation of interactive data anomaly detection in multi-link instant communication. Comput Simulation. 2019; 36(11): 445-448.

Zhao

. Hierarchical heterogeneous network link interruption fault detection simulation. Comput Simul. 2019; 36(4): 457-460.

Zhang

Han

Wang

Guizani

Fan

Shu

. A node location algorithm based on node movement prediction in underwater acoustic sensor networks. IEEE Trans Veh Technol. 2020; 69(3): 3166-3178.

Kharraz

Picard

Serhir

Lavenu

Jensen

. Measurement methods of outdoor low-voltage cable characteristics for narrowband power line communication. IEEE Trans Power Delivery. 2019; 34(5): 1818-1826.

Rahman

Hussain

. A fog-based semantic model for supporting interoperability in Internet of Things. IET Commun. 2019; 13(11): 1651-1661.

Hussain

Rodriguez-Ramos

Erbilgin

. Spatial characteristics of volatile communication in lodgepole pine trees: evidence of kin recognition and intra-species support. Sci Total Environ. 2019; 692(20): 127-135.

10.

Khattak

Farman

Jan

Din

. Toward integrating vehicular clouds with IoT for smart city services. IEEE Network. 2019; 33(2): 65-71.

11.

Baktash

Karimi

Wang

. Maximum-likelihood direction finding under elliptical noise using the EM algorithm. IEEE Commun Lett. 2019; 23(6): 1041-1044.

12.

Zhang

Truong

. Joint range and velocity estimation with Intrapulse and Intersubcarrier doppler effects for OFDM-based RadCom systems. IEEE Trans Signal Process. 2020; 68(99): 662-675.

13.

Liu

Zhang

Datcu

William

JE.

. Bayesian estimation of generalized gamma mixture model based on variational EM algorithm. Patt Recognit. 2019; 87: 269-284.

14.

Sammaknejad

Zhao

Huang

. A review of the expectation maximization algorithm in data-driven process identification. J Process Control. 2019; 73: 123-136.

15.

Mei

Gao

Yao

Zhao

. Semantic segmentation of 3D lidar data in dynamic scene using semi-supervised learning. IEEE Trans Intell Transp Syst. 2020; 21(6): 2496-2509.

Anomaly detection of communication link of mobile internet of things based on EM algorithm

Abstract

Keywords

1. Introduction

2. Anomaly feature extraction of communication link of mobile internet of things

2.1 The abnormal location range of Internet of Things

3.1 Improvement of EM algorithm based on semi-supervised machine learning

4.1 Detection accuracy rate of abnormal links in mobile Internet of Things communication

Table 1 The test results of the detection accuracy of abnormal communication links

Table 2 Statistical results of loss rate of abnormal nodes

Footnotes

Fundings

References

Table 1
The test results of the detection accuracy of abnormal communication links

Table 2
Statistical results of loss rate of abnormal nodes