A security threat monitoring and defense system and method for an Internet of Things system

Abstract

The invention discloses an Internet of Things system security threat monitoring and defending system. The system comprises a traffic abnormality analysis system, an Internet of Things terminal abnormality analysis system, a service abnormality analysis system, an HTTP abnormality analysis system and a threat detection and information generation system. The threat detection and information generation system is electrically connected with the flow abnormity analysis system, the Internet of Things terminal abnormity analysis system, the service abnormity analysis system and the HTTP abnormity analysis system. The system provided by the invention can simultaneously solve the own safety problems of the equipment terminals, the terminal-cloud interaction safety problem and the own safety problemof a cloud, including the interaction safety problem of a third-party cloud, in an Internet of Things.

Description

technical field [0001] The invention relates to the technical field of Internet of Things security, in particular to a system and method for monitoring and defending security threats of an Internet of Things system. Background technique [0002] With the rapid development of the Internet of Things, the development of the country has entered the era of intelligent Internet of Things. In various physical environments such as homes, corporate offices, factory production, traffic management, aviation halls, hospital halls, etc., the Internet of Things is almost everywhere, and the Internet of Things is safe. Threats are also growing. [0003] At present, in the Internet of Things environment, there are more and more security issues in the Internet of Things, and the devices in the Internet of Things are becoming more and more complex. Self-owned networks and third-party networks exist at the same time, and it is difficult to discover and defend security through certain devices o...

AI Technical Summary

Problems solved by technology

[0005] (1) The traffic detection scheme has the following defects: incomplete support for IoT-specific protocols, no support for multiple traffic security detections, no global linkage analysis, and difficulties in finding security threats in separate deployments;

[0006] (2) The asset equipment agent solution has the following defects: the installation of the agent program on the asset equipment requires the asset equipment to have a certain computing power, and there are problems such as poor compatibility and difficulty in finding security threats when deployed separately;

[0007] (3) The WEB application firewall solution has the following defects: Deploying a WEB application firewall on the front end of the WEB service / API service requires a certain amount of server resources, and deploying alone cannot discover the security issues of the terminal itself, the security issues of the terminal and the third-party network

Images