Abnormal behavior detection method and system for Internet-of-Things equipment

Abstract

The invention relates to an abnormal behavior detection method and system for Internet-of-Things equipment. The method comprises the following steps: acquiring normal communication traffic of Internet-of-Things equipment, and extracting all behavior feature vectors of the communication traffic; determining a behavior feature data set according to sample attributes in the behavior feature vector ofeach piece of Internet-of-Things equipment; performing K-means clustering learning on the behavior feature data set, and establishing a behavior model; constructing a binary classifier model according to the behavior feature data set and the behavior model; obtaining the current communication flow of the Internet-of-Things equipment; judging the current communication flow by using a binary classifier model, and if the current communication flow is abnormal flow, blocking the current behavior of the Internet-of-Things equipment and giving an alarm; and if the current communication traffic is normal traffic, extracting a behavior feature vector of the current communication traffic, updating the behavior feature vector into the behavior feature vector of the normal communication traffic, andre-determining a behavior feature data set. According to the invention, the detection precision of abnormal behavior flow can be improved.

Description

technical field [0001] The invention relates to the technical field of computer networks, in particular to a method and system for detecting abnormal behavior of Internet of Things devices. Background technique [0002] The Internet of Things is based on information carriers such as the Internet, radio and television networks, and traditional telecommunication networks, enabling all ordinary physical objects that can be independently addressed to realize interconnection and intercommunication. With the rapid development of the Internet of Things and the Internet Protocol Address (IP) of the infrastructure communication system, the interconnection of massive devices through the network will become a trend. In the public security, traffic police, electric energy and other industries, a large number of IP cameras, detectors , Radio Frequency Identification (RFID) and other IoT terminals have been deployed on a large scale in every corner of the city, and today's society has gra...

AI Technical Summary

Problems solved by technology

[0005] The purpose of the present invention is to provide a method and system for detecting abnormal behaviors of Internet of Things devices, so as to solve the problems that the traditional abnormal behavior detection technology continuously formulates update rules to judge whether there is an attack behavior, the detection time is long, and the detection accuracy is low.

Images