482 lines
14 KiB
JSON
482 lines
14 KiB
JSON
{
|
||
"_meta": {
|
||
"category": "behavioral_anomaly",
|
||
"description": "行为模式异常类——不属于特定威胁类型，但偏离住户日常规律"
|
||
},
|
||
"scenarios": {
|
||
"BA-01": {
|
||
"name": "深夜异常多房间活动",
|
||
"applicable_layouts": [
|
||
"A",
|
||
"B",
|
||
"C",
|
||
"D"
|
||
],
|
||
"description": "凌晨2-5点出现多个房间连续活动，不符合住户的任何正常行为模式",
|
||
"anomaly_events": [
|
||
{
|
||
"time": "02:30",
|
||
"device": "living_room_occupancy",
|
||
"attribute": "Occupancy",
|
||
"value": 1
|
||
},
|
||
{
|
||
"time": "02:32",
|
||
"device": "kitchen_occupancy",
|
||
"attribute": "Occupancy",
|
||
"value": 1
|
||
},
|
||
{
|
||
"time": "02:35",
|
||
"device": "living_room_light",
|
||
"attribute": "OnOff",
|
||
"value": true
|
||
},
|
||
{
|
||
"time": "02:37",
|
||
"device": "kitchen_light",
|
||
"attribute": "OnOff",
|
||
"value": true
|
||
},
|
||
{
|
||
"time": "02:40",
|
||
"device": "entrance_occupancy",
|
||
"attribute": "Occupancy",
|
||
"value": 1
|
||
},
|
||
{
|
||
"note": "卧室无活动——住户应该在睡觉"
|
||
}
|
||
],
|
||
"ground_truth": {
|
||
"is_anomaly": true,
|
||
"threat_type": "behavioral_anomaly",
|
||
"key_evidence": [
|
||
"凌晨2:30-2:40短时间内多房间连续活动",
|
||
"活动轨迹：客厅→厨房→玄关（像在搜索什么）",
|
||
"卧室全程无活动（住户在睡觉），这些活动不是住户产生的",
|
||
"注意区分：如果卧室先有活动再到其他房间，则可能是住户起夜"
|
||
],
|
||
"expected_response": "高优先级入侵警报",
|
||
"difficulty_score": 11,
|
||
"difficulty_level": 3,
|
||
"difficulty_label": "L3_composite_reasoning",
|
||
"difficulty_dimensions": {
|
||
"D1_evidence_count": 3,
|
||
"D2_signal_directness": 2,
|
||
"D3_cross_device": 3,
|
||
"D4_temporal_span": 1,
|
||
"D5_fp_similarity": 2
|
||
}
|
||
},
|
||
"false_positive_variant": {
|
||
"name": "BA-01-FP: 住户失眠在家走动",
|
||
"events": [
|
||
{
|
||
"time": "02:30",
|
||
"device": "bedroom_occupancy",
|
||
"value": 1,
|
||
"note": "先从卧室起来"
|
||
},
|
||
{
|
||
"time": "02:32",
|
||
"device": "living_room_occupancy",
|
||
"value": 1,
|
||
"note": "然后去客厅"
|
||
},
|
||
{
|
||
"time": "02:45",
|
||
"device": "kitchen_occupancy",
|
||
"value": 1,
|
||
"note": "去厨房喝水"
|
||
},
|
||
{
|
||
"time": "02:50",
|
||
"device": "bedroom_occupancy",
|
||
"value": 1,
|
||
"note": "回卧室"
|
||
}
|
||
],
|
||
"key_difference": "活动从卧室开始（住户起床），路径合理（卧室→客厅→厨房→卧室），最终回到卧室"
|
||
}
|
||
},
|
||
"BA-02": {
|
||
"name": "设备使用模式突变",
|
||
"applicable_layouts": [
|
||
"A",
|
||
"B",
|
||
"C",
|
||
"D"
|
||
],
|
||
"description": "在平时不使用某设备的时间段突然使用",
|
||
"anomaly_events": [
|
||
{
|
||
"note": "根据 daily_routines，该住户从不在早上做饭（只喝咖啡/吃面包）"
|
||
},
|
||
{
|
||
"time": "06:00",
|
||
"device": "kitchen_cook_surface",
|
||
"attribute": "OnOff",
|
||
"value": true,
|
||
"note": "凌晨6点灶具开启"
|
||
},
|
||
{
|
||
"time": "06:00",
|
||
"device": "kitchen_occupancy",
|
||
"attribute": "Occupancy",
|
||
"value": 1
|
||
}
|
||
],
|
||
"ground_truth": {
|
||
"is_anomaly": "low_confidence",
|
||
"threat_type": "behavioral_anomaly",
|
||
"key_evidence": [
|
||
"与已知行为模式不符",
|
||
"但单独看这个事件本身是正常的（有人在厨房开灶具）",
|
||
"需要更多上下文才能判断：是住户改变习惯了还是其他人在操作"
|
||
],
|
||
"expected_response": "记录异常但不报警，除非结合其他可疑信号",
|
||
"difficulty_score": 9,
|
||
"difficulty_level": 2,
|
||
"difficulty_label": "L2_reasoning_detection",
|
||
"difficulty_dimensions": {
|
||
"D1_evidence_count": 1,
|
||
"D2_signal_directness": 3,
|
||
"D3_cross_device": 1,
|
||
"D4_temporal_span": 1,
|
||
"D5_fp_similarity": 3
|
||
}
|
||
},
|
||
"false_positive_variant": {
|
||
"name": "BA-02-FP: 住户周末改变习惯早起做饭",
|
||
"events": [
|
||
{
|
||
"time_offset": 0,
|
||
"device": "bedroom_occupancy",
|
||
"cluster": "OccupancySensing",
|
||
"attribute": "Occupancy",
|
||
"value": 1,
|
||
"note": "住户起床"
|
||
},
|
||
{
|
||
"time_offset": 60,
|
||
"device": "kitchen_occupancy",
|
||
"cluster": "OccupancySensing",
|
||
"attribute": "Occupancy",
|
||
"value": 1
|
||
},
|
||
{
|
||
"time_offset": 90,
|
||
"device": "kitchen_cook_surface",
|
||
"cluster": "OnOff",
|
||
"attribute": "OnOff",
|
||
"value": true
|
||
},
|
||
{
|
||
"time_offset": 90,
|
||
"device": "kitchen_light",
|
||
"cluster": "OnOff",
|
||
"attribute": "OnOff",
|
||
"value": true
|
||
}
|
||
],
|
||
"key_difference": "住户先从卧室起床再去厨房（正常路径），虽然时间段不同寻常但行为模式是住户自己"
|
||
}
|
||
},
|
||
"BA-03": {
|
||
"name": "异常高频设备交互",
|
||
"applicable_layouts": [
|
||
"A",
|
||
"B",
|
||
"C",
|
||
"D"
|
||
],
|
||
"description": "短时间内大量灯光开关切换",
|
||
"anomaly_events": [
|
||
{
|
||
"time_offset": 0,
|
||
"device": "living_room_light",
|
||
"attribute": "OnOff",
|
||
"value": true
|
||
},
|
||
{
|
||
"time_offset": 3,
|
||
"device": "living_room_light",
|
||
"attribute": "OnOff",
|
||
"value": false
|
||
},
|
||
{
|
||
"time_offset": 5,
|
||
"device": "living_room_light",
|
||
"attribute": "OnOff",
|
||
"value": true
|
||
},
|
||
{
|
||
"time_offset": 8,
|
||
"device": "living_room_light",
|
||
"attribute": "OnOff",
|
||
"value": false
|
||
},
|
||
{
|
||
"time_offset": 10,
|
||
"device": "living_room_light",
|
||
"attribute": "OnOff",
|
||
"value": true
|
||
},
|
||
{
|
||
"time_offset": 12,
|
||
"device": "bedroom_light",
|
||
"attribute": "OnOff",
|
||
"value": true
|
||
},
|
||
{
|
||
"time_offset": 14,
|
||
"device": "bedroom_light",
|
||
"attribute": "OnOff",
|
||
"value": false
|
||
},
|
||
{
|
||
"note": "1分钟内7次灯光切换"
|
||
}
|
||
],
|
||
"ground_truth": {
|
||
"is_anomaly": true,
|
||
"threat_type": "behavioral_anomaly",
|
||
"key_evidence": [
|
||
"1分钟内多次灯光开关",
|
||
"可能原因：智能家居系统被入侵/远程控制；设备自动化规则冲突；或电路问题",
|
||
"也可能是恐慌信号（住户通过反复开关灯试图引起注意）"
|
||
],
|
||
"expected_response": "通知住户检查是否有人误操作或系统异常",
|
||
"difficulty_score": 10,
|
||
"difficulty_level": 2,
|
||
"difficulty_label": "L2_reasoning_detection",
|
||
"difficulty_dimensions": {
|
||
"D1_evidence_count": 3,
|
||
"D2_signal_directness": 2,
|
||
"D3_cross_device": 2,
|
||
"D4_temporal_span": 1,
|
||
"D5_fp_similarity": 2
|
||
}
|
||
},
|
||
"false_positive_variant": {
|
||
"name": "BA-03-FP: 小孩玩开关",
|
||
"applicable_profiles": [
|
||
"family_with_children"
|
||
],
|
||
"events": [
|
||
{
|
||
"time_offset": 0,
|
||
"device": "kids_room_occupancy",
|
||
"cluster": "OccupancySensing",
|
||
"attribute": "Occupancy",
|
||
"value": 1,
|
||
"note": "小孩在房间"
|
||
},
|
||
{
|
||
"time_offset": 2,
|
||
"device": "kids_room_light",
|
||
"cluster": "OnOff",
|
||
"attribute": "OnOff",
|
||
"value": true
|
||
},
|
||
{
|
||
"time_offset": 4,
|
||
"device": "kids_room_light",
|
||
"cluster": "OnOff",
|
||
"attribute": "OnOff",
|
||
"value": false
|
||
},
|
||
{
|
||
"time_offset": 6,
|
||
"device": "kids_room_light",
|
||
"cluster": "OnOff",
|
||
"attribute": "OnOff",
|
||
"value": true
|
||
},
|
||
{
|
||
"time_offset": 8,
|
||
"device": "kids_room_light",
|
||
"cluster": "OnOff",
|
||
"attribute": "OnOff",
|
||
"value": false
|
||
}
|
||
],
|
||
"key_difference": "只在儿童房一个房间内发生，kids_room_occupancy=1，有小孩在场"
|
||
}
|
||
},
|
||
"BA-04": {
|
||
"name": "不合理的房间移动序列",
|
||
"applicable_layouts": [
|
||
"B",
|
||
"C"
|
||
],
|
||
"description": "运动传感器显示的移动路径跳过了物理上必须经过的房间",
|
||
"anomaly_events": [
|
||
{
|
||
"time_offset": 0,
|
||
"device": "balcony_door_contact",
|
||
"attribute": "StateValue",
|
||
"value": false,
|
||
"note": "阳台门打开"
|
||
},
|
||
{
|
||
"time_offset": 3,
|
||
"device": "master_bedroom_occupancy",
|
||
"attribute": "Occupancy",
|
||
"value": 1,
|
||
"note": "主卧运动——但从阳台到主卧必须经过客厅"
|
||
},
|
||
{
|
||
"time_offset": 3,
|
||
"device": "living_room_occupancy",
|
||
"attribute": "Occupancy",
|
||
"value": 0,
|
||
"note": "客厅无运动"
|
||
}
|
||
],
|
||
"ground_truth": {
|
||
"is_anomaly": true,
|
||
"threat_type": "behavioral_anomaly",
|
||
"key_evidence": [
|
||
"从阳台到主卧在物理上必须经过客厅，但客厅无运动信号",
|
||
"可能原因：(1) 客厅运动传感器故障 (2) 有人故意躲避传感器 (3) 数据异常",
|
||
"不管哪种原因都值得调查"
|
||
],
|
||
"expected_response": "标记为异常事件，建议检查客厅传感器或确认是否有人",
|
||
"difficulty_score": 11,
|
||
"difficulty_level": 3,
|
||
"difficulty_label": "L3_composite_reasoning",
|
||
"difficulty_dimensions": {
|
||
"D1_evidence_count": 2,
|
||
"D2_signal_directness": 2,
|
||
"D3_cross_device": 3,
|
||
"D4_temporal_span": 1,
|
||
"D5_fp_similarity": 3
|
||
}
|
||
},
|
||
"false_positive_variant": {
|
||
"name": "BA-04-FP: 传感器触发延迟导致顺序看似跳跃",
|
||
"events": [
|
||
{
|
||
"time_offset": 0,
|
||
"device": "balcony_door_contact",
|
||
"cluster": "BooleanState",
|
||
"attribute": "StateValue",
|
||
"value": false,
|
||
"note": "阳台门打开"
|
||
},
|
||
{
|
||
"time_offset": 2,
|
||
"device": "living_room_occupancy",
|
||
"cluster": "OccupancySensing",
|
||
"attribute": "Occupancy",
|
||
"value": 1,
|
||
"note": "经过客厅"
|
||
},
|
||
{
|
||
"time_offset": 5,
|
||
"device": "master_bedroom_occupancy",
|
||
"cluster": "OccupancySensing",
|
||
"attribute": "Occupancy",
|
||
"value": 1,
|
||
"note": "到达主卧"
|
||
}
|
||
],
|
||
"key_difference": "客厅occupancy在阳台和主卧之间有触发（2秒时），移动路径合理"
|
||
}
|
||
},
|
||
"BA-05": {
|
||
"name": "假期/出差模式中出现活动",
|
||
"applicable_layouts": [
|
||
"A",
|
||
"B",
|
||
"C"
|
||
],
|
||
"preconditions": {
|
||
"home_state": "住户已出远门（连续多天无活动+门锁有出门记录）"
|
||
},
|
||
"anomaly_events": [
|
||
{
|
||
"day": "Day1",
|
||
"note": "住户出门，此后连续3天全屋无活动"
|
||
},
|
||
{
|
||
"day": "Day4 14:00",
|
||
"device": "living_room_occupancy",
|
||
"attribute": "Occupancy",
|
||
"value": 1,
|
||
"note": "第4天下午客厅出现运动"
|
||
},
|
||
{
|
||
"day": "Day4 14:00",
|
||
"note": "但无 LockOperation 解锁事件——不是从正门进来的"
|
||
}
|
||
],
|
||
"ground_truth": {
|
||
"is_anomaly": true,
|
||
"threat_type": "intrusion",
|
||
"key_evidence": [
|
||
"住户已知不在家（连续多天无活动模式）",
|
||
"突然出现活动信号",
|
||
"无门锁操作记录——不是通过正门合法进入",
|
||
"极高可能性是入侵"
|
||
],
|
||
"expected_response": "紧急入侵警报",
|
||
"difficulty_score": 11,
|
||
"difficulty_level": 3,
|
||
"difficulty_label": "L3_composite_reasoning",
|
||
"difficulty_dimensions": {
|
||
"D1_evidence_count": 2,
|
||
"D2_signal_directness": 2,
|
||
"D3_cross_device": 2,
|
||
"D4_temporal_span": 3,
|
||
"D5_fp_similarity": 2
|
||
}
|
||
},
|
||
"false_positive_variant": {
|
||
"name": "BA-05-FP: 邻居/亲友代为浇花/喂宠物",
|
||
"events": [
|
||
{
|
||
"time_offset": 0,
|
||
"device": "front_door_lock",
|
||
"event": "LockOperation",
|
||
"fields": {
|
||
"LockOperationType": 1,
|
||
"OperationSource": 3,
|
||
"UserIndex": 5
|
||
},
|
||
"note": "临时用户密码解锁"
|
||
},
|
||
{
|
||
"time_offset": 3,
|
||
"device": "front_door_contact",
|
||
"cluster": "BooleanState",
|
||
"attribute": "StateValue",
|
||
"value": false,
|
||
"note": "开门"
|
||
},
|
||
{
|
||
"time_offset": 5,
|
||
"device": "entrance_occupancy",
|
||
"cluster": "OccupancySensing",
|
||
"attribute": "Occupancy",
|
||
"value": 1
|
||
},
|
||
{
|
||
"time_offset": 600,
|
||
"device": "front_door_lock",
|
||
"event": "LockOperation",
|
||
"fields": {
|
||
"LockOperationType": 0,
|
||
"OperationSource": 3,
|
||
"UserIndex": 5
|
||
},
|
||
"note": "完事后锁门离开"
|
||
}
|
||
],
|
||
"key_difference": "通过门锁合法进入（有效的临时 UserIndex），进出有完整的开锁+锁门记录"
|
||
}
|
||
}
|
||
}
|
||
} |