Security risk assessment system and method based on Internet of Things

Abstract

The invention discloses a security risk assessment system and method based on the Internet of Things, and relates to the technical field of digital information transmission. According to the security risk assessment method based on the Internet of Things, whether hardware equipment can work normally or not is judged, and if the hardware equipment cannot work normally, early warning prompt is carried out; if the hardware equipment can work normally, evaluating the vulnerability degree of the Internet of Things platform; according to the method, the security risk of the Internet of Things platform is evaluated, the security risk level is obtained, and equipment faults and potential security vulnerabilities are found in time through systematic hardware and software evaluation. By judging the normal working state of hardware equipment, early warning can be effectively carried out, occurrence of security events can be reduced, and the vulnerability degree, the recovery capability and the data security of the platform can be comprehensively known, so that scientific risk level assessment is provided for enterprises, the enterprises are helped to formulate corresponding security measures and optimization strategies, security risks are effectively reduced, and the safety of the enterprises is improved. And the user data and privacy are protected.

Description

Technical Field

[0001] The present invention relates to the technical field of digital information transmission, and in particular to a security risk assessment system and method based on the Internet of Things. Background Art

[0002] Network security risk assessment is a type of active defense technology, which includes the entire process of risk identification, risk analysis and risk evaluation. The basic purpose of risk assessment is to control network risks within an acceptable range. Effectively evaluating the risk factors in the network is an effective way to solve security problems.

[0003] The Chinese invention patent application with publication number CN115664744A discloses a method for assessing the network security risk of the electric power Internet of Things, including obtaining threat intelligence information, asset information and protective measures information and identifying the threat elements, vulnerability elements, asset elements and security measures elements required for risk assessment; calculating the vulnerability index value, asset index value and security measures index value; calculating the threat possibility index, asset value index and asset impact index; calculating the security risk value of the electric power Internet of Things to be assessed and completing the network security risk assessment. The present invention also discloses a system for implementing the method for assessing the network security risk of the electric power Internet of Things. The present invention can more accurately assess network security risks, takes into account protective measures factors, and conducts targeted design of quantitative indicators, so as to more scientifically assess the security risks faced by the electric power Internet of Things; therefore, the present invention has high reliability, good accuracy and is objective and scientific.

[0004] However, existing technologies have the problem of difficulty in combining multi-faceted assessments to promptly detect equipment failures and potential security vulnerabilities. Summary of the invention

[0005] In view of the deficiencies of the prior art, the present invention provides a security risk assessment system and method based on the Internet of Things, which solves the problem that it is difficult to combine multi-faceted assessments to timely discover equipment failures and potential security vulnerabilities in the prior art.

[0006] To achieve the above objectives, the present invention is implemented through the following technical solutions: a security risk assessment method based on the Internet of Things, comprising the following steps: performing a security assessment on the hardware equipment of the Internet of Things platform to determine whether the hardware equipment can work normally, and if the hardware equipment cannot work normally, issuing an early warning prompt; if the hardware equipment can work normally, evaluating the vulnerability of the Internet of Things platform; obtaining the software security data of the Internet of Things platform, evaluating the security risk of the Internet of Things platform, and obtaining a security risk level, the software security data including the successful interception rate of the attack, the CPU occupancy rate when the platform recovers after the attack, the recovery time of the platform after the attack, and the average data loss after the attack; the obtaining of the software security data of the Internet of Things platform, evaluating the security risk of the Internet of Things platform, and obtaining a security risk level, comprising the following steps: obtaining safe operation deviation data, the security The operation deviation data includes the allowed deviation rate of successful interception of the attack and the CPU occupancy deviation when the platform recovers after the attack; the software security reference data stored in the database is obtained, and the software security reference data includes the reference interception rate of successful attack, the reference CPU occupancy when the platform recovers after the attack, the reference recovery time of the platform after the attack, and the average reference data loss after the attack; the operation status index of the hardware device is obtained; the operation status index of the hardware device, the software security reference data and the software security data stored in the database are comprehensively analyzed to obtain a security risk assessment value; the security risk assessment value is compared with each security risk matching assessment value stored in the database. If the security risk assessment value is equal to a security risk matching assessment value stored in the database, the security risk level corresponding to the security risk matching assessment value stored in the database is obtained as the security risk level of the security risk assessment value.

[0007] Furthermore, the security assessment of the hardware devices of the Internet of Things platform to determine whether the hardware devices can work normally includes the following steps: obtaining the actual location information of the hardware devices; comparing the actual location information of the hardware devices obtained with the set location information of the hardware devices stored in the database to determine whether the actual location information of the hardware devices is consistent with the set location information of the hardware devices stored in the database: if the actual location information of the hardware devices is inconsistent with the set location information of the hardware devices stored in the database, it is determined that the hardware devices cannot work normally and an early warning is issued; if the actual location information of the hardware devices is consistent with the set location information of the hardware devices stored in the database, the hardware devices are obtained. The operating data of the device includes the data flow rate flowing through the hardware device within a set time, the operating temperature of the hardware device and the power consumption of the hardware device within the set time; obtaining the operating status index of the hardware device based on the operating data of the hardware device; comparing the operating status index of the hardware device with the operating status evaluation threshold of the hardware device stored in the database: if the operating status index of the hardware device is greater than the operating status evaluation threshold of the hardware device stored in the database, it is determined that the hardware device cannot work normally and an early warning prompt is issued; if the operating status index of the hardware device is not greater than the operating status evaluation threshold of the hardware device stored in the database, it is determined that the hardware device can work normally.

[0008] Furthermore, the obtaining of the operating status index of the hardware device based on the operating data of the hardware device includes the following steps: obtaining operating reference data corresponding to the hardware device stored in a database, the operating reference data including a reference flow rate of data flowing through the hardware device within a set time, an operating reference temperature of the hardware device, and a reference power consumption within a set range of the hardware device; fusing and analyzing the operating data of the hardware device with the operating reference data corresponding to the hardware device stored in the database to obtain the operating status index of the hardware device.

[0009] Furthermore, the calculation formula of the operating status index of the hardware device is as follows: ; In the formula, is the operating status index, The data flow through the hardware device within the set time. is the operating temperature of the hardware device, Set the power consumption of hardware devices within a certain time period. The reference flow of data flowing through the hardware device within the set time. is the operating reference temperature of the hardware device. Set the reference power consumption for the hardware device within a certain period. is a natural constant.

[0010] Furthermore, the vulnerability of the Internet of Things platform is evaluated, including the following steps: obtaining the attacked data of the Internet of Things platform, the attacked data including the attack frequency and the average attack duration within a set time; obtaining the attack definition data stored in the database, the attack definition data including the attack definition frequency and the average attack definition duration within a set time; fusing and analyzing the attacked data of the Internet of Things platform with the attack definition data stored in the database to obtain a vulnerability index; comparing the vulnerability index with each vulnerability matching index stored in the database, if the vulnerability index is equal to a certain vulnerability matching index stored in the database, obtaining the vulnerability level corresponding to the vulnerability matching index stored in the database as the vulnerability level of the Internet of Things platform.

[0011] Furthermore, the calculation formula of the vulnerability index is as follows: ; In the formula, is the vulnerability index, is the attack frequency within the set time. is the average attack duration, Define the frequency of being attacked within a set time. Define the average attack duration, is the attack frequency weight factor set in the database, It is the weight factor of the average attack duration set in the database.

[0012] Furthermore, the obtaining of safe operation deviation data comprises the following steps: comparing the vulnerability index with each safe operation deviation index stored in a database; if the vulnerability index is equal to a safe operation deviation index stored in the database, obtaining the safe operation deviation data corresponding to the safe operation deviation index stored in the database.

[0013] Furthermore, the calculation formula of the security risk assessment value is as follows: ; In the formula, is the security risk assessment value, is the successful interception rate of the attack, is the CPU usage when the platform recovers after being attacked. It is the time it takes for the platform to recover after being attacked. is the average amount of data lost after the attack, The allowed deviation rate for successful interception of the attack, It is the CPU usage deviation when the platform recovers after being attacked. The interception rate for successful attack is referenced by: It is the reference CPU usage when the platform recovers after being attacked. It is the reference recovery time of the platform after being attacked. is the average reference loss of data after the attack, is a natural constant, is the operating status index of the hardware device. The operating status index weight factor of the hardware device set in the database. The software data weight factor set for the database.

[0014] A security risk assessment system based on the Internet of Things is applied to the above-mentioned security risk assessment method based on the Internet of Things, including a hardware device assessment module, a vulnerability assessment module and a security risk assessment module, wherein: the hardware device assessment module is used to perform a security assessment on the hardware devices of the Internet of Things platform, determine whether the hardware devices can work normally, and issue an early warning if the hardware devices cannot work normally; the vulnerability assessment module is used to assess the vulnerability of the Internet of Things platform if the hardware devices can work normally; the security risk assessment module is used to obtain software security data of the Internet of Things platform, assess the security risk of the Internet of Things platform, and obtain a security risk level, wherein the software security data includes the successful interception rate of attacks, the platform recovery time after attacks, and the average data loss after attacks; the software security data of the Internet of Things platform is obtained, the security risk of the Internet of Things platform is assessed, and the security risk level is obtained , including the following steps: obtaining safe operation deviation data, the safe operation deviation data including the allowed deviation rate of successful interception of attacks and the deviation of CPU occupancy rate when the platform recovers after being attacked; obtaining software security reference data stored in a database, the software security reference data including the reference interception rate of successful attacks, the reference CPU occupancy rate when the platform recovers after being attacked, the reference recovery time of the platform after being attacked and the average reference amount of data lost after being attacked; obtaining the operation status index of the hardware device; comprehensively analyzing the operation status index of the hardware device, the software security reference data and the software security data stored in the database to obtain a security risk assessment value; comparing the security risk assessment value with each security risk matching assessment value stored in the database, if the security risk assessment value is equal to a certain security risk matching assessment value stored in the database, then obtaining the security risk level corresponding to the security risk matching assessment value stored in the database as the security risk level of the security risk assessment value.

[0015] The present invention has the following beneficial effects: This IoT-based security risk assessment method can timely discover equipment failures and potential security vulnerabilities through systematic hardware and software assessments. By judging the normal working status of hardware devices, it can effectively warn and reduce the occurrence of security incidents; and by analyzing software security data, it can fully understand the platform's vulnerability, recovery capabilities and data security, thereby providing enterprises with scientific risk level assessments, helping them formulate corresponding security measures and optimization strategies, effectively reducing security risks, and protecting user data and privacy, aiming to improve the overall security of the IoT platform.

[0016] Of course, any product implementing the present invention does not necessarily need to achieve all of the advantages described above at the same time. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 This is a flow chart of the security risk assessment method based on the Internet of Things of the present invention.

[0018] Figure 2 This is a flowchart of the security risk assessment system based on the Internet of Things of the present invention. DETAILED DESCRIPTION

[0019] The embodiments of the present application improve the overall security of the Internet of Things platform through a security risk assessment method and system based on the Internet of Things, and timely discover device failures and potential security vulnerabilities through systematic hardware and software evaluation.

[0020] See also Figure 1 The embodiment of the present invention provides a technical solution: a security risk assessment method based on the Internet of Things, comprising the following steps: performing a security assessment on the hardware devices of the Internet of Things platform to determine whether the hardware devices can work normally, and if the hardware devices cannot work normally, issuing an early warning prompt; if the hardware devices can work normally, assessing the vulnerability of the Internet of Things platform; obtaining software security data of the Internet of Things platform, assessing the security risk of the Internet of Things platform, and obtaining a security risk level, wherein the software security data includes a successful interception rate of attacks, a CPU occupancy rate when the platform recovers after an attack, a platform recovery time after an attack, and an average amount of data lost after an attack.

[0021] The successful interception rate of attacks is obtained through the logs of security tools such as firewalls, intrusion detection systems (IDS), and intrusion prevention systems (IPS). The CPU usage rate when the platform recovers after the attack is recorded through monitoring logs and performance dashboards, and the peak CPU usage rate after the attack is recorded. The platform recovery time after the attack is recorded through monitoring and logging to ensure the timestamps of the start of the attack event and the completion of recovery. The average amount of data loss after the attack is calculated by monitoring and recording the amount of data lost due to the attack after the attack occurs, including the number of lost records or business indicators (such as transaction data), and then calculating the average loss.

[0022] The successful interception rate of attacks directly affects the security of the platform. If the interception rate is high, it means that the platform has good protection capabilities and reduces the probability of successful attacks, which will affect the complexity and resource consumption of subsequent recovery. The CPU usage rate when the platform recovers after being attacked is related to the successful interception rate of attacks. If the interception rate is high, the CPU usage rate may be low during the recovery process due to the successful interception of the attack; conversely, if the attack is successful, the system may consume more resources for recovery and repair. The recovery time of the platform after being attacked is related to the CPU usage rate when the platform recovers after being attacked. If the CPU usage rate is high, it often leads to a longer recovery time because the system needs more time to process related requests. The average amount of data lost after being attacked is closely related to the nature of the attack and the speed of recovery. If the interception rate is low and the recovery time is long, the data loss may be more serious. Therefore, these parameters can jointly reflect the security risk and recovery ability of the platform.

[0023] First of all, we should start from the hardware level and ensure that all devices are working properly. This is the basis for ensuring the security of the entire IoT platform. By monitoring the device status in real time, we can promptly discover potential faults and abnormal conditions and avoid the expansion of potential safety hazards. When the hardware is normal, we should focus on analyzing the security data at the software level, including the successful interception rate, recovery capability and data loss, so as to comprehensively assess the security risks of the platform. According to the assessment results, we can determine the security risk level and provide a basis for subsequent decision-making.

[0024] Specifically, the security assessment of the hardware devices of the Internet of Things platform to determine whether the hardware devices can work normally includes the following steps: obtaining the actual location information of the hardware devices; comparing the obtained actual location information of the hardware devices with the set location information of the hardware devices stored in the database to determine whether the actual location information of the hardware devices is consistent with the set location information of the hardware devices stored in the database: if the actual location information of the hardware devices is inconsistent with the set location information of the hardware devices stored in the database, it is determined that the hardware devices cannot work normally, and an early warning prompt is issued.

[0025] If the actual location information of the hardware device is consistent with the set location information of the hardware device stored in the database, the operation data of the hardware device is obtained, and the operation data includes the data flow through the hardware device within the set time, the operating temperature of the hardware device, and the power consumption of the hardware device within the set time. The data flow through the hardware device within the set time monitors the amount of data transmitted by the device within the set time through a network interface (such as Ethernet, Wi-Fi, cellular network, etc.). The data flow can be recorded using a network monitoring tool or the built-in statistical function of the device. The operating temperature of the hardware device monitors the temperature inside or outside the device in real time through a temperature sensor (such as a thermocouple, thermistor, etc.). The sensor is usually connected to the control unit of the device and can transmit the temperature data to the monitoring system in real time. The power consumption of the hardware device within the set time monitors the power consumption of the device through a current sensor and a voltage sensor. Devices such as a power meter or a smart socket can be used to record the total power consumption of the device within the set time.

[0026] Generally speaking, the greater the data flow of a device, the higher the power consumption will be. This is because the device consumes more power when processing and transmitting data. Especially under high load conditions, the CPU and network module of the device will increase the work intensity, resulting in increased power consumption. There is also a certain relationship between the operating temperature of the device and power consumption. Generally speaking, when the device is in a high temperature state, it may cause the cooling system (such as fans) to work extra, thereby increasing power consumption. In addition, high temperature may affect the performance of the device, causing it to require more power to maintain normal operation. The operating temperature of the device may affect its ability to process data. Under high temperature conditions, the device may enter a frequency reduction mode, resulting in a decrease in the data processing speed, thereby affecting data flow. At the same time, excessively high temperatures may cause the device to malfunction, directly affecting its normal operation and data flow.

[0027] An operation status index of the hardware device is obtained based on the operation data of the hardware device; the operation status index of the hardware device is compared with the operation status evaluation threshold of the hardware device stored in the database: if the operation status index of the hardware device is greater than the operation status evaluation threshold of the hardware device stored in the database, it is determined that the hardware device cannot work normally, and an early warning prompt is issued; if the operation status index of the hardware device is not greater than the operation status evaluation threshold of the hardware device stored in the database, it is determined that the hardware device can work normally.

[0028] The operating status assessment thresholds of the hardware device stored in the database are obtained by analyzing historical data. This process includes statistics and modeling of key performance indicators of the device in normal operation and failure state to identify the normal range and trend of each indicator. Regression analysis is performed using historical data to extract thresholds that reflect the health status of the equipment. These thresholds serve as the basis for subsequent monitoring and early warning, so as to timely discover potential problems and take maintenance measures.

[0029] In this implementation scheme, first, the actual location information of the hardware device is obtained through GPS, network or other positioning technologies. This is the first step to ensure that the device is working normally at the predetermined location. The actual location information obtained is compared with the set location information stored in the database. If the two are inconsistent, it means that the device may have been moved or physically attacked, and it is judged to be abnormal, and an early warning prompt is issued. If the location information is consistent, the operation data of the device continues to be obtained, including the data flow of the hardware device, the operating temperature of the hardware device, and the power consumption of the hardware device within the set time. Data flow: reflects the workload and network activity of the device. Operating temperature: monitors the thermal state of the device, which may affect its performance. Power consumption: evaluates the energy efficiency and working status of the device.

[0030] Based on the collected operation data, the operation status index of the hardware device is calculated. This index is a comprehensive evaluation of the performance and health of the device. The calculated operation status index is compared with the evaluation threshold stored in the database. If the operation status index is greater than the evaluation threshold, it means that the device may be abnormal and an early warning prompt needs to be issued. If the operation status index is not greater than the evaluation threshold, it is determined that the device can work normally, otherwise it is abnormal.

[0031] By real-time monitoring of the location information and operating status of equipment, potential security risks can be discovered in a timely manner and the risk of being attacked or tampered with can be reduced. The collected operating data can provide a basis for subsequent maintenance and optimization, helping companies to formulate more reasonable equipment management strategies. By implementing a strict security assessment mechanism, users' trust in the IoT platform can be enhanced, thereby improving user experience and satisfaction.

[0032] Specifically, the operation status index of the hardware device is obtained based on the operation data of the hardware device, including the following steps: obtaining the operation reference data corresponding to the hardware device stored in the database, the operation reference data including the data reference flow rate flowing through the hardware device within the set time, the operation reference temperature of the hardware device and the reference power consumption within the set time of the hardware device; fusing and analyzing the operation data of the hardware device with the operation reference data corresponding to the hardware device stored in the database to obtain the operation status index of the hardware device. The operation reference data is established by long-term monitoring and recording the operation data of the equipment, including the flow rate, temperature and power consumption of the equipment under different working conditions, and statistical analysis is performed on the historical data to calculate the average value or median under normal operating conditions. These values ​​are usually regarded as reference values.

[0033] The calculation formula of the operating status index of the hardware device is as follows: ; In the formula, is the operating status index, The data flow through the hardware device within the set time. is the operating temperature of the hardware device, Set the power consumption of hardware devices within a certain time period. The reference flow of data flowing through the hardware device within the set time. is the operating reference temperature of the hardware device. Set the reference power consumption for the hardware device within a certain period. is a natural constant.

[0034] In this embodiment, Indicates the difference between the actual data flow rate SL of the device and the reference data flow rate cSL. , which emphasizes the impact of flow differences. The larger the difference, the higher the operating status index, indicating that there may be problems with the equipment. The relationship between the difference in operating temperature and power consumption and the reference value is considered. The difference in temperature and power consumption is normalized to ensure that the relative importance of these two factors in the status assessment is reasonably reflected. The natural logarithm is used to convert the above comprehensive indicators into a more understandable scale and avoid the influence of extreme values ​​on the results, making the index value smoother.

[0035] This formula provides a comprehensive assessment of the device's operating status by simultaneously considering data flow, temperature, and power consumption, and can more accurately reflect the health of the device. The square and exponential operations of flow differences in the formula design make it very sensitive to small deviations, and can promptly detect potential problems and reduce the risk of failures. The calculated operating status index can serve as the basis for an early warning mechanism, helping operation and maintenance personnel to take timely measures to optimize equipment operation and reduce maintenance costs.

[0036] Specifically, evaluating the vulnerability of an Internet of Things platform includes the following steps: obtaining the attacked data of the Internet of Things platform, the attacked data including the attack frequency and the average attack duration within a set time; obtaining the attack definition data stored in a database, the attack definition data including the attack definition frequency and the average attack definition duration within a set time; fusing and analyzing the attacked data of the Internet of Things platform with the attack definition data stored in the database to obtain a vulnerability index; comparing the vulnerability index with each vulnerability matching index stored in the database, if the vulnerability index is equal to a certain vulnerability matching index stored in the database, obtaining the vulnerability level corresponding to the vulnerability matching index stored in the database as the vulnerability level of the Internet of Things platform.

[0037] The attack frequency within a set time is obtained by recording the number of attacks on the IoT platform within a set time range, which can be obtained through monitoring system logs, intrusion detection systems (IDS) and other tools. The average attack duration is obtained by calculating the average duration of each attack, usually by analyzing the start and end time of the attack event. The frequency of attack events within a set time is extracted from the database. These events include identified attack patterns, vulnerability exploits, etc., and the average duration of these defined events is calculated.

[0038] A high frequency of attacks usually means that the attacker is interested in the system and may show its potential value or vulnerability. If a system is frequently attacked, its security strategy should be given priority. If the attack event lasts for a long time, it may indicate that the attacker has successfully penetrated the primary defense measures and is active inside the system, which usually indicates a more serious security risk. For example, a long attack may lead to more serious data leakage or system damage. A high frequency of attacks and a short average attack duration may mean that the attacker is trying to use quick and temporary attack methods, which may reflect the rapidity and breadth of the attack behavior, but lacks deep penetration. On the other hand, if the attack frequency is low but the average attack duration is long, it may indicate that the attacker is quietly lurking in the system and deeply penetrating, which may lead to more serious security incidents. The combination of these two parameters helps to analyze specific patterns. For example, if a certain type of attack is attacked frequently but the attack duration is short, it may mean that the attack is easy to detect and prevent, thereby providing the security team with a direction for defense.

[0039] The acquired attacked data and the attacked definition data are integrated, and weighted average, standardization and other methods may be used to comprehensively consider the impact of the two, and a comprehensive vulnerability index is obtained. The calculated vulnerability index is compared with each vulnerability matching index stored in the database, and an equal matching index is found to obtain the corresponding vulnerability level (for example, the vulnerability matching indexes stored in the database are 1, 2 and 3, where 1 corresponds to level 1, 2 corresponds to level 2, and 3 corresponds to level 3. When the vulnerability index is 2, the obtained vulnerability level is level 2). Based on the comparison results, the vulnerability level of the IoT platform is determined to help decision makers evaluate security.

[0040] The calculation formula of the vulnerability index is as follows: ; In the formula, is the vulnerability index, is the attack frequency within the set time. is the average attack duration, Define the frequency of being attacked within a set time. Define the average attack duration, is the attack frequency weight factor set in the database, It is the weight factor of the average attack duration set in the database.

[0041] Weight Factor and It is obtained from the database and the weight factor is established through the historical measurement of attack frequency and average attack duration. and The mapping set of the attack frequency and the average attack duration in the current set time is obtained. and .

[0042] In this implementation scheme, the relative vulnerability of the system can be evaluated by comparing the attack frequency and attack duration with the benchmark value. If Ps and Ts are higher than the benchmark value, the vulnerability index Ysg will increase, otherwise it will decrease. The weight factor allows the system to adjust the importance of the attack frequency and attack duration according to the specific situation. This means that in some environments, frequent small-scale attacks may be more important, while in other environments, a small number of but continuous attacks may be more worthy of attention. Using the tanh function can limit the calculation results to a reasonable range, which is convenient for subsequent analysis and decision-making, and avoids excessively extreme values ​​from affecting the judgment.

[0043] The formula comprehensively considers two key factors: attack frequency and attack duration, and provides a comprehensive vulnerability assessment indicator. By monitoring and analyzing the vulnerability index, potential security risks can be identified in a timely manner, preventive measures can be taken, and the possibility and impact of attacks can be reduced.

[0044] Specifically, the software security data of the IoT platform is obtained, the security risk of the IoT platform is evaluated, and the security risk level is obtained, including the following steps: obtaining safe operation deviation data, the safe operation deviation data is obtained from the database, and by deploying IDS, the activities of the network and system can be monitored in real time, and potential security vulnerabilities or violations can be detected. IDS can identify activities that are different from the normal operation mode, thereby generating deviation data. The safe operation deviation data includes the deviation rate allowed by the successful interception of the attack and the deviation of the CPU occupancy rate when the platform recovers after the attack; obtaining the software security reference data stored in the database, the software security reference data includes the successful reference interception rate of the attack, the reference CPU occupancy rate when the platform recovers after the attack, the reference recovery time of the platform after the attack, and the average reference amount of data lost after the attack. The software security reference data is obtained by analyzing historical attack events, using performance monitoring tools, performing recovery tests and data integrity monitoring. Specifically, the successful interception rate can be obtained by the intrusion detection system and firewall records, the CPU occupancy rate during recovery is counted by the performance monitoring tool, and the recovery time and data loss are evaluated by disaster recovery testing and log analysis. In addition, industry reports and laboratory tests also provide valuable references for relevant data. These combined approaches contribute to comprehensive safety performance indicators.

[0045] Obtain the operating status index of the hardware device; conduct a comprehensive analysis on the operating status index of the hardware device, the safe operation deviation data, the software safety reference data and the software safety data stored in the database to obtain a security risk assessment value; compare the security risk assessment value with each security risk matching assessment value stored in the database; if the security risk assessment value is equal to a security risk matching assessment value stored in the database, obtain the security risk level corresponding to the security risk matching assessment value stored in the database as the security risk level of the security risk assessment value.

[0046] Obtain the allowable deviation rate involving successful interception of attacks and the deviation of CPU occupancy when the platform recovers after an attack. Obtain key software security reference data from the database, including the reference interception rate of successful attacks, the reference CPU occupancy when the platform recovers after an attack, the reference recovery time of the platform after an attack, and the average reference loss of data after an attack. These data are used to set a benchmark to facilitate the comparison of the gap between actual performance and theoretical expectations. Comprehensively analyze the security operation deviation data and the reference data to form a security risk assessment value. Compare the calculated security risk assessment value with the security risk matching assessment values ​​stored in the database. If a security risk assessment value is found to be equal to a known assessment value, the security risk level corresponding to the assessment value can be obtained. This step ensures the standardization and repeatability of risk assessment.

[0047] By regularly acquiring and analyzing data, real-time monitoring of the security status of the IoT platform can be achieved, and potential security risks can be discovered in a timely manner. The security risk assessment value obtained through data analysis provides a basis for decision makers, so that security strategies and emergency responses can be based on objective data rather than relying solely on subjective judgment. By comparing with the security risk matching assessment value in the database, it can ensure that the assessment results of different cases are consistent and comparable, and help effective communication between different teams or systems.

[0048] The obtaining of the safe operation deviation data comprises the following steps: comparing the vulnerability index with each safe operation deviation index stored in a database; if the vulnerability index is equal to a safe operation deviation index stored in the database, obtaining the safe operation deviation data corresponding to the safe operation deviation index stored in the database.

[0049] The calculation formula of the security risk assessment value is as follows: ; In the formula, is the security risk assessment value, is the successful interception rate of the attack, is the CPU usage when the platform recovers after being attacked. It is the time it takes for the platform to recover after being attacked. is the average amount of data lost after the attack, The allowed deviation rate for successful interception of the attack, It is the CPU usage deviation when the platform recovers after being attacked. The interception rate for successful attack is referenced by: It is the reference CPU usage when the platform recovers after being attacked. It is the reference recovery time of the platform after being attacked. is the average reference loss of data after the attack, is a natural constant, is the operating status index of the hardware device. The operating status index weight factor of the hardware device set in the database. The software data weight factor set for the database.

[0050] and It is obtained from the database and established through historically measured software data and operating status index. and The mapping set of the current software data and the corresponding running status index is obtained. and .

[0051] In this implementation, the use of logarithmic and hyperbolic tangent functions, as well as exponential functions in the formula, allows for a smoother response to changes in various variables, avoiding over-amplification of small changes. The formula integrates a variety of relevant indicators (such as interception rate, CPU occupancy, recovery time, and data loss) to form a comprehensive risk assessment, helping to more accurately identify system weaknesses. By allowing for deviations, the formula can flexibly adapt to different environments and needs, enhancing flexibility in practical applications. By considering the hardware operating status and corresponding weights, the evaluation can provide a more accurate analysis of the performance of specific devices, extending the simple software data analysis to the performance of the entire platform.

[0052] A security risk assessment system based on the Internet of Things is applied to the above-mentioned security risk assessment method based on the Internet of Things, such as Figure 2As shown, it includes a hardware device evaluation module, a vulnerability evaluation module and a security risk evaluation module, wherein: the hardware device evaluation module is used to perform a security evaluation on the hardware devices of the Internet of Things platform, to determine whether the hardware devices can work normally, and to issue an early warning if the hardware devices cannot work normally; the vulnerability evaluation module is used to evaluate the vulnerability of the Internet of Things platform if the hardware devices can work normally; the security risk evaluation module is used to obtain the software security data of the Internet of Things platform, evaluate the security risks of the Internet of Things platform, and obtain the security risk level, wherein the software security data includes the successful interception rate of attacks, the platform recovery time after attacks, and the average data loss after attacks.

[0053] An electronic device includes: a processor and a memory, wherein computer program instructions are stored in the memory, and when the computer program instructions are executed by the processor, the processor executes the security risk assessment method based on the Internet of Things as described above.

[0054] A computer-readable storage medium is used to store a program, and when the program is executed by a processor, the security risk assessment method based on the Internet of Things as described above is implemented.

[0055] In summary, this application has at least the following effects: Through systematic hardware and software evaluation, equipment failures and potential security vulnerabilities can be discovered in a timely manner. By judging the normal working status of hardware equipment, it can effectively warn and reduce the occurrence of security incidents; and through the analysis of software security data, it can fully understand the platform's vulnerability, recovery capabilities and data security, thereby providing enterprises with scientific risk level assessments, helping them to formulate corresponding security measures and optimization strategies, effectively reducing security risks, protecting user data and privacy, and aiming to improve the overall security of the IoT platform.

[0056] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0057] The present invention is described with reference to flowcharts and / or block diagrams of systems, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0058] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0059] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0060] Although the preferred embodiments of the present invention have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0061] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A security risk assessment method based on the Internet of Things, characterized in that: The following steps are involved: Conduct security assessments on the hardware devices of the IoT platform to determine whether the hardware devices can work normally. If the hardware devices cannot work normally, issue warning prompts. If the hardware device can work normally, then evaluate the vulnerability of the IoT platform; Obtain software security data of the IoT platform, evaluate the security risk of the IoT platform in combination with the hardware device status of the IoT platform, and obtain a security risk level. The software security data includes the successful interception rate of attacks, the CPU occupancy rate when the platform recovers after an attack, the platform recovery time after an attack, and the average amount of data lost after an attack. The step of obtaining the software security data of the IoT platform and evaluating the security risk of the IoT platform in combination with the hardware device status of the IoT platform to obtain the security risk level includes the following steps: Acquire safe operation deviation data, wherein the safe operation deviation data includes an allowable deviation rate of successful interception of an attack and a CPU occupancy rate deviation when the platform recovers after the attack; Obtain software security reference data stored in a database, wherein the software security reference data includes a reference interception rate of successful attacks, a reference CPU occupancy rate when the platform recovers after an attack, a reference recovery time of the platform after an attack, and an average reference amount of data loss after an attack; Get the operating status index of the hardware device; Comprehensively analyze the operating status index of hardware equipment, safe operation deviation data, software safety reference data and software safety data stored in the database to obtain a safety risk assessment value; The security risk assessment value is compared with each security risk matching assessment value stored in the database. If the security risk assessment value is equal to a security risk matching assessment value stored in the database, the security risk level corresponding to the security risk matching assessment value stored in the database is obtained as the security risk level of the security risk assessment value.

2. The security risk assessment method based on the Internet of Things according to claim 1 is characterized in that: The security assessment of the hardware devices of the IoT platform to determine whether the hardware devices can work normally includes the following steps: Get the actual location information of the hardware device; Compare the acquired actual location information of the hardware device with the set location information of the hardware device stored in the database to determine whether the actual location information of the hardware device is consistent with the set location information of the hardware device stored in the database: If the actual location information of the hardware device is inconsistent with the set location information of the hardware device stored in the database, it is determined that the hardware device cannot work normally and an early warning prompt is issued; If the actual location information of the hardware device is consistent with the set location information of the hardware device stored in the database, then the operation data of the hardware device is obtained, and the operation data includes the data flow flowing through the hardware device within the set time, the operating temperature of the hardware device and the power consumption of the hardware device within the set time; Acquire an operation status index of the hardware device based on the operation data of the hardware device; Compare the operating status index of the hardware device with the operating status assessment threshold of the hardware device stored in the database: If the operating status index of the hardware device is greater than the operating status evaluation threshold of the hardware device stored in the database, it is determined that the hardware device cannot work normally and an early warning prompt is issued; If the operating status index of the hardware device is not greater than the operating status evaluation threshold of the hardware device stored in the database, it is determined that the hardware device can work normally.

3. The security risk assessment method based on the Internet of Things according to claim 2 is characterized in that: The step of obtaining the operating status index of the hardware device based on the operating data of the hardware device comprises the following steps: Obtaining operation reference data corresponding to the hardware device stored in a database, wherein the operation reference data includes a reference flow rate of data flowing through the hardware device within a set time, an operation reference temperature of the hardware device, and a reference power consumption within a set time of the hardware device; The operation data of the hardware device is integrated and analyzed with the operation reference data corresponding to the hardware device stored in the database to obtain the operation status index of the hardware device.

4. The security risk assessment method based on the Internet of Things according to claim 3 is characterized in that: The calculation formula of the operating status index of the hardware device is as follows: ； In the formula, is the operating status index, The data flow through the hardware device within the set time. is the operating temperature of the hardware device, Set the power consumption of hardware devices within a certain time period. The reference flow of data flowing through the hardware device within the set time. is the operating reference temperature of the hardware device. Set the reference power consumption for the hardware device within a certain period. is a natural constant.

5. The security risk assessment method based on the Internet of Things according to claim 1 is characterized in that: Assessing the vulnerability of an IoT platform includes the following steps: Obtaining attack data of the IoT platform, wherein the attack data includes the attack frequency and average attack duration within a set time; Acquire the attack definition data stored in the database, wherein the attack definition data includes the attack definition frequency and the average attack definition duration within a set time; The attacked data of the IoT platform is integrated and analyzed with the attacked definition data stored in the database to obtain the vulnerability index; The vulnerability index is compared with each vulnerability matching index stored in the database. If the vulnerability index is equal to a certain vulnerability matching index stored in the database, the vulnerability level corresponding to the vulnerability matching index stored in the database is obtained as the vulnerability level of the Internet of Things platform.

6. The security risk assessment method based on the Internet of Things according to claim 5 is characterized in that: The calculation formula of the vulnerability index is as follows: ； In the formula, is the vulnerability index, is the attack frequency within the set time. is the average attack duration, Define the frequency of being attacked within a set time. Define the average attack duration, is the attack frequency weight factor set in the database, It is the weight factor of the average attack duration set in the database.

7. The security risk assessment method based on the Internet of Things according to claim 1 is characterized in that: The step of obtaining the safe operation deviation data comprises the following steps: The vulnerability index is compared with each safe operation deviation index stored in the database. If the vulnerability index is equal to a safe operation deviation index stored in the database, the safe operation deviation data corresponding to the safe operation deviation index stored in the database is obtained.

8. The security risk assessment method based on the Internet of Things according to claim 1 is characterized in that: The calculation formula of the security risk assessment value is as follows: ； In the formula, is the security risk assessment value, is the successful interception rate of the attack, is the CPU usage when the platform recovers after being attacked. It is the time it takes for the platform to recover after being attacked. is the average amount of data lost after the attack, The allowed deviation rate for successful interception of the attack, It is the CPU usage deviation when the platform recovers after being attacked. The interception rate for successful attack is referenced by: It is the reference CPU usage when the platform recovers after being attacked. It is the reference recovery time of the platform after being attacked. is the average reference loss of data after the attack, is a natural constant, is the operating status index of the hardware device. The operating status index weight factor of the hardware device set in the database. The software data weight factor set for the database.

9. A security risk assessment system based on the Internet of Things, applied to the security risk assessment method based on the Internet of Things according to any one of claims 1 to 8, characterized in that: It includes hardware equipment assessment module, vulnerability assessment module and security risk assessment module, among which: The hardware device evaluation module is used to perform a security evaluation on the hardware devices of the IoT platform to determine whether the hardware devices can work normally. If the hardware devices cannot work normally, an early warning prompt is issued; The vulnerability assessment module is used to assess the vulnerability of the Internet of Things platform if the hardware device can work normally; The security risk assessment module is used to obtain software security data of the Internet of Things platform, assess the security risk of the Internet of Things platform, and obtain the security risk level. The software security data includes the successful interception rate of attacks, the platform recovery time after attacks, and the average amount of data loss after attacks; The step of obtaining the software security data of the IoT platform and evaluating the security risk of the IoT platform in combination with the hardware device status of the IoT platform to obtain the security risk level includes the following steps: Acquire safe operation deviation data, wherein the safe operation deviation data includes an allowable deviation rate of successful interception of an attack and a CPU occupancy rate deviation when the platform recovers after the attack; Obtain software security reference data stored in a database, wherein the software security reference data includes a reference interception rate of successful attacks, a reference CPU occupancy rate when the platform recovers after an attack, a reference recovery time of the platform after an attack, and an average reference amount of data loss after an attack; Get the operating status index of the hardware device; Comprehensively analyze the operating status index of hardware equipment, safe operation deviation data, software safety reference data and software safety data stored in the database to obtain a safety risk assessment value; The security risk assessment value is compared with each security risk matching assessment value stored in the database. If the security risk assessment value is equal to a security risk matching assessment value stored in the database, the security risk level corresponding to the security risk matching assessment value stored in the database is obtained as the security risk level of the security risk assessment value.

Images