A method and system for detecting abnormal behavior of Internet of Things devices

Abstract

The invention relates to a method and system for detecting abnormal behavior of Internet of Things devices. The method includes: obtaining the normal communication flow of the Internet of Things device, and extracting all behavioral feature vectors of the communication flow; determining the behavioral feature data set according to the sample attributes in the behavioral feature vector of each Internet of Things device; performing K on the behavioral feature data set Mean value clustering learning to establish a behavior model; construct a binary classifier model according to the behavioral feature data set and behavior model; obtain the current communication traffic of the IoT device; use the binary classifier model to judge the current communication traffic, if the current communication traffic For abnormal traffic, block the current behavior of the Internet of Things device and give an alarm; if the current communication traffic is normal traffic, extract the behavioral feature vector of the current communication traffic, update the behavioral feature vector to the behavioral feature vector of the normal communication traffic, Redefine the behavioral characterization dataset. The invention can improve the detection accuracy of abnormal behavior flow.

Description

technical field [0001] The invention relates to the technical field of computer networks, in particular to a method and system for detecting abnormal behavior of Internet of Things devices. Background technique [0002] The Internet of Things is based on information carriers such as the Internet, radio and television networks, and traditional telecommunication networks, enabling all ordinary physical objects that can be independently addressed to realize interconnection and intercommunication. With the rapid development of the Internet of Things and the Internet Protocol Address (IP) of the infrastructure communication system, the interconnection of massive devices through the network will become a trend. In the public security, traffic police, electric energy and other industries, a large number of IP cameras, detectors , Radio Frequency Identification (RFID) and other IoT terminals have been deployed on a large scale in every corner of the city, and today's society has gra...

AI Technical Summary

Problems solved by technology

[0005] The purpose of the present invention is to provide a method and system for detecting abnormal behaviors of Internet of Things devices, so as to solve the problems that the traditional abnormal behavior detection technology continuously formulates update rules to judge whether there is an attack behavior, the detection time is long, and the detection accuracy is low.

Images