A botnet early warning method and a device in a narrow-band internet of things

Abstract

The invention discloses a botnet early warning method in a narrow-band Internet of things, comprising the following steps: obtaining flow information in the narrow-band Internet of things; the flow information at least comprises: virus files captured by a honeypot and logs recorded by a flow monitoring gateway; analyzing traffic information according to preset multiple dimensions, and obtaining analysis results corresponding to each dimension respectively; multiple dimensions include at least: traffic characteristics, network behavior, and viruses; determining whether botnet controlled devicesexist in the narrow-band internet of things according to the analysis results corresponding to each dimension; if so, botnet alert information is generated. The method realizes the collection of traffic information including virus files and logs, and analyzes and processes the traffic information from different dimensions, thus realizes the timely early warning of botnets in narrow-band Internetof things. Accordingly, the invention discloses a botnet early warning device, a device and a readable storage medium in a narrow-band internet of things, which also have the technical effects mentioned above.

Description

technical field [0001] The present invention relates to the technical field of computer virus defense, and more specifically, to a botnet early warning method, device, equipment and readable storage medium in the narrowband Internet of Things. Background technique [0002] The NB-IoT is built on the cellular network and only needs to consume about 180KHz of bandwidth. It can be directly deployed on the GSM network, UMTS network or LTE network. It has the advantages of low deployment cost and easy upgrade and transformation. [0003] In the process of building a smart city, the support of NB-IoT is inevitable. The network can cover various urban facilities such as wells, street lamps, and fire hydrants. The types of equipment in the network are complex, low in cost, low in power consumption, and wide in coverage. It can achieve equipment coverage of 50,000 connections in a single community. Each device accesses the network based on an IoT card (a new category of SIM card). ...

AI Technical Summary

Problems solved by technology

It is precisely because of the wide coverage of NB-IoT that once it is infected with computer viruses, especially zombie viruses, if it is not dealt with and prevented in time, it may cause a wide range of network paralysis or abnormalities.

[0004] In the existing technology, due to the many and complex manufacturers of IoT cards (SIM cards), chips, modules, and equipment in the narrowband Internet of Things, the data collection in the network is chaotic, and it is impossible to extract usable information based on the chaotic data. information, so it is impossible to warn of viruses in the network in time

For example: worms and zombies, even if they have spread to a large number of devices, as long as there is no malicious behavior, it is difficult to be discovered and detected by the network control background

Images