Automata-based internet of things device traffic modeling, detection method and device

Abstract

This application proposes an automaton-based Internet of Things device traffic modeling and detection method and device, which relate to the technical field of the Internet of Things, wherein the method includes: collecting the normal traffic of the IoT device to be monitored in each working state, and generating the original traffic collection; assemble each communication data flow in the original flow collection to generate multiple flow trees, and merge multiple flow trees to generate a joint flow tree; after reducing the communication data streams in the joint flow tree, combine The data structure representing the flow of communication data in the flow tree is transformed into an automaton model. Therefore, according to the set of normal traffic generated by IoT devices, an automaton model that can accurately describe the outline of its normal communication behavior is established, and the automaton model is used for device behavior monitoring and anomaly detection. Various types of anomalies can be detected to improve the accuracy and efficiency of anomaly detection of IoT devices.

Description

technical field [0001] The present application relates to the technical field of the Internet of Things, and in particular to an automaton-based method and device for modeling and detecting Internet of Things device traffic. Background technique [0002] At present, with the rapid development of the Internet of Things technology, various types of Internet of Things devices have been deployed in large numbers in various fields of human production and life, such as smart homes, smart cities, and industrial control systems. While bringing great convenience, IoT devices are also facing various network security threats. On the one hand, IoT devices may not work properly due to the invasion of malicious attackers and form a large botnet, which can be used to launch large-scale distributed denial-of-service attacks and endanger important communication infrastructure. On the other hand, since the use of IoT devices is closely related to human production and living activities, their...

AI Technical Summary

Problems solved by technology

[0003] However, designing an anomaly detection system suitable for IoT devices usually faces the following challenges: First, IoT devices used in different fields use a variety of different communication technology systems and network scales. Designing algorithms requires a lot of expert knowledge, and the designed algorithms are not universal; secondly, IoT devices usually only have limited communication and computing resources, so the accompanying anomaly detection system should not have high overhead, and its operation The normal work of IoT devices cannot be hindered; thirdly, the security threats and attack vectors faced by IoT devices are also very extensive. Even if the intrusion of malicious attackers is not considered, improper behaviors such as device failures need to be discovered in time, so The detection goal of an intrusion detection system should not be limited to a specific type of anomaly

Images