Detection processing method of Internet of Things

Abstract

The invention discloses a detection processing method of the Internet of Things. The method comprises the following steps: carrying out architecture control management on a detection processing system of the Internet of Things; carrying out transverse cooperation and real-time control on the Internet of Things detection processing system; carrying out analysis processing control on the Internet of Things detection processing system; performing acquisition detection management of the Internet of Things detection processing system; the architecture control management of the Internet of Things detection processing system comprises the steps that the Internet of Things detection processing system is controlled and managed through an edge computing structure, the edge computing structure is divided into three layers including a cloud layer, an edge computing layer and a terminal layer, network services are provided between the cloud layer and an edge node layer through a set core network, and the network services are provided between the edge node layer and the cloud layer. Each node is connected to the cloud, each device is connected to an edge node, and the edge nodes can communicate with each other to form a set honeycomb shape. The device has the characteristics of high safety and high stability.

Description

Technical Field

[0001] The present invention relates to the technical field of Internet of Things, and in particular to a detection and processing method of Internet of Things. Background Art

[0002] Based on the traditional Internet, the Internet of Things technology has been rapidly improved by connecting objects closely through intelligent sensors. In 2019, the number of consumer-grade IoT devices in the world reached 8.1 billion. In 2019, the number of consumer-grade IoT terminals in China accounted for 29.6% of the world, and the compound annual growth rate is expected to reach 28% from 2019 to 2022. With the continuous growth of IoT devices, the threats faced by the Internet of Things have attracted widespread attention. The vulnerability growth rate of IoT terminals exceeded 20% in 2019. It is predicted that the vulnerability of IoT devices will be 14.7% higher than the overall vulnerability in the next few years. The security situation is not optimistic, and it is urgent to improve the security of IoT devices. Attackers attack IoT infrastructure through malicious network behaviors, including man-in-the-middle attacks, denial of service and botnets. In severe cases, the entire network will be paralyzed. Therefore, it is necessary to design a detection and processing method for the Internet of Things with high security and strong stability. Summary of the invention

[0003] The purpose of the present invention is to provide a detection and processing method for the Internet of Things to solve the problems raised in the above background technology.

[0004] In order to solve the above technical problems, the present invention provides the following technical solutions: a detection and processing method of the Internet of Things, comprising: Carry out architecture control and management of the Internet of Things detection and processing system; Conduct horizontal coordination and real-time control of IoT detection and processing systems; Conduct analysis, processing and control of the Internet of Things detection and processing system; Carry out collection and detection management of the Internet of Things detection and processing system; The architecture control and management of the Internet of Things detection and processing system includes: The edge computing structure is used to control and manage the Internet of Things detection and processing system. The edge computing structure is divided into three layers, namely cloud layer, edge computing layer, and terminal layer. At the same time, between the cloud layer and the edge node layer, network services are provided through the set core network. Each node is connected to the cloud, and each device is connected to the edge node. The edge nodes can communicate with each other to form a set honeycomb shape.

[0005] According to the above technical solution, the horizontal coordination and real-time control of the IoT detection and processing system includes: When a single IoT device is attacked, other IoT devices collect information to determine whether it has suffered a security incident, and update the rule base of OSSEC of the IoT device where the security incident occurred, forming horizontal collaboration between IoT devices; When the shared data volume captures data, it automatically distributes the data to the network traffic detection engine and the system call detection engine according to the file suffix. Files with the suffix txt are sent to the system call detection engine, and files with the suffix pcap are sent to the network traffic detection engine, thereby realizing system adaptive data processing.

[0006] According to the above technical solution, the analysis and processing control of the Internet of Things detection and processing system includes: The SMOTE+OSS+RANDOM hybrid sampling method is used for data balancing. First, the majority class samples are randomly sampled, and the random sampling value that meets the settings is obtained through analytical experiments. Then, the boundary noise points are eliminated through the unilateral selection method, and finally the balance of the data set is achieved through SMOTE upsampling.

[0007] According to the above technical solution, the analysis and processing control of the Internet of Things detection and processing system further includes: Vectorize the pcap native data by converting characters into ASCII codes and then into binary data to obtain the corresponding 1*316 data. Then, use linear interpolation to transform it into 318-dimensional data. Finally, convert the 318-dimensional data into an 18*18 matrix, and further convert the data into a grayscale image using Python's PIL library. The analysis and control processing of the CNN network intrusion detection model is performed so that the CNN model includes an input layer, three convolutional layers, three pooling layers and an output layer.

[0008] According to the above technical solution, the collection and detection management of the Internet of Things detection and processing system includes: Collect network traffic data of the IoT detection and processing system in real time and transmit it to the workbench for management personnel to analyze and review; Terminal detection uses OSSEC for rule matching to complete the detection of malicious behavior. It includes a packet decoder and a data analysis engine. The data information captured from the network card is first decoded by the packet decoder, and then analyzed by the data analysis engine to obtain the results and generate an alarm notification.

[0009] According to the above technical solution, a detection and processing system of the Internet of Things includes: Management and control module, used for management and control of the Internet of Things detection and processing system; Analysis and processing module, used for optimizing analysis and processing of IoT detection and processing system; The collection and detection module is used for collection and detection management of the Internet of Things detection and processing system.

[0010] According to the above technical solution, the management control module includes: Architecture management module, used for architecture control design of IoT detection and processing system; Horizontal collaboration module, used for horizontal collaborative management of IoT devices; The real-time processing module is used for real-time adaptive processing of data information.

[0011] According to the above technical solution, the analysis and processing module includes: Data balance module, used for data balance management of data information; An imaging module is used for imaging data information; The management and analysis module is used to manage, analyze and control the intrusion detection model.

[0012] According to the above technical solution, the acquisition and detection module includes: Collection management module, used for collection and management of data information; The terminal detection module is used to perform IoT terminal detection processing.

[0013] Compared with the prior art, the beneficial effects achieved by the present invention are as follows: the present invention, by providing a management control module, an analysis and processing module and a collection and detection module, can extend cloud computing to the edge of the network, and transmit data to the cloud layer according to a set cycle, thereby effectively improving the analysis and processing efficiency of the network, reducing the request response time, and efficiently detecting missed reports, thereby reducing the missed report rate and enhancing the ability to discover and detect network attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings: Figure 1 This is a flow chart of a detection and processing method of the Internet of Things provided by Embodiment 1 of the present invention; Figure 2 This is a module structure diagram of a detection and processing system for the Internet of Things provided in Embodiment 2 of the present invention. DETAILED DESCRIPTION

[0015] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0016] Embodiment 1: Figure 1 This is a flow chart of a detection and processing method of the Internet of Things provided in Embodiment 1 of the present invention. This embodiment can be applied to an Internet of Things detection and processing system. The method can be executed by an Internet of Things detection and processing system provided in an embodiment of the present invention. The system is composed of multiple software and hardware modules, such as Figure 1 As shown, the method specifically comprises the following steps: S101. Perform architecture control and management of the Internet of Things detection and processing system; Exemplarily, in an embodiment of the present invention, an edge computing structure is used to control and manage the Internet of Things detection and processing system, wherein the edge computing structure is divided into three layers, namely, a cloud layer, an edge computing layer, and a terminal layer. At the same time, between the cloud layer and the edge node layer, network services are provided through a set core network, each node is connected to the cloud, and each device is connected to the edge node, and the edge nodes can communicate with each other to form a set honeycomb shape; in this step, the terminal layer is composed of mobile and fixed Internet of Things devices (communication media, Raspberry Pi, and smart phones, etc.), and each device is connected to an edge node. The locally collected data is first transmitted to the edge node. The edge node prioritizes processing of the data information and then uploads the result to the cloud layer. The data information that the edge node cannot process is directly uploaded to the cloud layer for processing. The edge computing layer is composed of a large number of edge nodes, wherein the edge layer devices (such as routers, switches, etc.) have certain computing and processing capabilities, and their main function is to extend cloud computing to the edge of the network and transmit data to the cloud layer according to a set cycle, effectively improving the analysis and processing efficiency of the network and reducing the request response time.

[0017] S102, perform horizontal coordination and real-time control on the Internet of Things detection and processing system; Exemplarily, in an embodiment of the present invention, when a single IoT device is attacked, other IoT devices collect information to determine whether it has suffered a security incident, and update and upgrade the rule base of the OSSEC of the IoT device where the security incident occurred, so as to form horizontal collaboration between IoT devices and devices; in this step, when a single device in the IoT environment generates an alarm at the terminal and confirms the attack event at the edge computing layer, other IoT devices will obtain the alarm information of the edge computing layer. If the status of other devices is also abnormal, they will start to capture network data and host process information, and upload them to the integrated detection engine corresponding to the edge computing layer for detection. Taking the specific scenario where Raspberry Pia is attacked by remote control and then uses Raspberry Pia to attack Raspberry Pib with DoS as an example, the integrated detection engine a of the edge computing layer detects that Raspberry Pia has suffered a remote control attack, generates an alarm, and notifies Raspberry Pib. After Raspberry Pib is attacked by DoS, it is detected that the CPU status is abnormal, but the OSSEC of Raspberry Pib does not generate an alarm due to the abnormal behavior detected. Raspberry Pib will transmit the collected network traffic and system call sequence data to the integrated detection engine b at the edge computing layer for in-depth detection, thereby forming horizontal collaboration between Raspberry Pia and Raspberry Pib, which can efficiently detect missed reports, reduce the missed report rate, and enhance the ability to discover and detect network attacks.

[0018] When the shared data volume captures data, it automatically distributes the data to the network traffic detection engine and the system call detection engine according to the file suffix. Files with the suffix txt are sent to the system call detection engine, and files with the suffix pcap are sent to the network traffic detection engine, thereby realizing system adaptive data processing.

[0019] S103, performing analysis, processing and control of the Internet of Things detection and processing system; Exemplarily, in an embodiment of the present invention, a SMOTE+OSS+RANDOM hybrid sampling method is used to balance data. First, the majority class samples are randomly sampled, and a random sampling value that meets the setting is obtained through analysis experiments. Then, the boundary noise points are eliminated through a unilateral selection method, and finally, the balance of the data set is achieved through SMOTE upsampling. Since the majority class samples only depend on the sample distribution and not on any distance information, only by randomly eliminating the number of majority class samples can a higher accuracy be achieved with a small loss of original information. Therefore, this step can effectively improve the efficiency and accuracy of data balance analysis and processing.

[0020] The pcap native data is vectorized by converting characters into ASCII codes and then into binary data to obtain the corresponding 1*316 data. Then, it is transformed into 318-dimensional data through linear interpolation. Finally, the 318-dimensional data is converted into an 18*18 matrix, and the data is further converted into a grayscale image through Python's PIL library. Due to the different methods used to convert images, the detection accuracy also has different changes. The mainstream image conversion method has certain defects, which will cause distortion of the converted image information. Therefore, this step can effectively improve the accuracy of IoT detection analysis and processing, and effectively avoid the occurrence of analysis and processing errors.

[0021] The analysis and control processing of the CNN network intrusion detection model is carried out, so that the CNN model includes an input layer, three convolution layers, three pooling layers and an output layer; in this step, the input layer is used to convert the stream data into a matrix form with a dimension of two dimensions, and the convolution layer uses 16 filters with zero padding to extract the received data. The other two convolution layers are similar to the CNN model, except that the number of convolution kernels becomes 32, the maximum pooling layer uses 9*9 downsampling with a step size of 2, and the other two pooling layers use 3*3 downsampling with a step size of 1. The fully connected layer is used as the last layer and is used as the output, and the multi-classifier finally outputs 5 elements.

[0022] S104, performing collection and detection management of the Internet of Things detection and processing system; Exemplarily, in an embodiment of the present invention, network traffic data is collected in real time from the IoT detection and processing system, and transmitted to a workbench for analysis and review by management personnel; Terminal detection uses OSSEC for rule matching to complete the detection of malicious behavior. It includes a packet decoder and a data analysis engine. The data information captured from the network card is first decoded by the packet decoder, and then analyzed by the data analysis engine to obtain the results and generate an alarm notification.

[0023] Embodiment 2: Embodiment 2 of the present invention provides a detection and processing system for the Internet of Things. Figure 2 A schematic diagram of the module structure of a detection and processing system for the Internet of Things provided in the second embodiment is shown in FIG. Figure 2 As shown, the system includes: Management and control module, used for management and control of the Internet of Things detection and processing system; Analysis and processing module, used for optimizing analysis and processing of IoT detection and processing system; The collection and detection module is used for collection and detection management of the Internet of Things detection and processing system.

[0024] In some embodiments of the present invention, the management control module includes: Architecture management module, used for architecture control design of IoT detection and processing system; Horizontal collaboration module, used for horizontal collaborative management of IoT devices; The real-time processing module is used for real-time adaptive processing of data information.

[0025] In some embodiments of the present invention, the analysis and processing module includes: Data balance module, used for data balance management of data information; An imaging module is used for imaging data information; The management and analysis module is used to manage, analyze and control the intrusion detection model.

[0026] In some embodiments of the present invention, the acquisition and detection module includes: Collection management module, used for collection and management of data information; The terminal detection module is used to perform IoT terminal detection processing.

[0027] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0028] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art can still modify the technical solutions described in the aforementioned embodiments or replace some of the technical features therein by equivalents. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A detection and processing method for the Internet of Things, characterized in that: include: Carry out architecture control and management of the Internet of Things detection and processing system; Conduct horizontal coordination and real-time control of IoT detection and processing systems; Conduct analysis, processing and control of the Internet of Things detection and processing system; Carry out collection and detection management of the Internet of Things detection and processing system; The architecture control and management of the Internet of Things detection and processing system includes: The edge computing structure is used to control and manage the Internet of Things detection and processing system. The edge computing structure is divided into three layers, namely cloud layer, edge computing layer, and terminal layer. At the same time, between the cloud layer and the edge node layer, network services are provided through the set core network. Each node is connected to the cloud, and each device is connected to the edge node. The edge nodes can communicate with each other to form a set honeycomb shape.

2. The detection and processing method of the Internet of Things according to claim 1, characterized in that: The horizontal coordination and real-time control of the IoT detection and processing system includes: When a single IoT device is attacked, other IoT devices collect information to determine whether it has suffered a security incident, and update the rule base of OSSEC of the IoT device where the security incident occurred, forming horizontal collaboration between IoT devices; When the shared data volume captures data, it automatically distributes the data to the network traffic detection engine and the system call detection engine according to the file suffix. Files with the suffix txt are sent to the system call detection engine, and files with the suffix pcap are sent to the network traffic detection engine, thereby realizing system adaptive data processing.

3. The detection and processing method of the Internet of Things according to claim 1, characterized in that: The analysis and processing control of the Internet of Things detection and processing system includes: The SMOTE+OSS+RANDOM hybrid sampling method is used for data balancing. First, the majority class samples are randomly sampled, and the random sampling value that meets the settings is obtained through analytical experiments. Then, the boundary noise points are eliminated through the unilateral selection method, and finally the balance of the data set is achieved through SMOTE upsampling.

4. The detection and processing method of the Internet of Things according to claim 1, characterized in that: The analysis and processing control of the Internet of Things detection and processing system further includes: Vectorize the pcap native data by converting characters into ASCII codes and then into binary data to obtain the corresponding 1*316 data. Then, use linear interpolation to transform it into 318-dimensional data. Finally, convert the 318-dimensional data into an 18*18 matrix, and further convert the data into a grayscale image using Python's PIL library. The analysis and control processing of the CNN network intrusion detection model is performed so that the CNN model includes an input layer, three convolutional layers, three pooling layers and an output layer.

5. The detection and processing method of the Internet of Things according to claim 1, characterized in that: The collection and detection management of the Internet of Things detection and processing system includes: Collect network traffic data of the IoT detection and processing system in real time and transmit it to the workbench for management personnel to analyze and review; Terminal detection uses OSSEC for rule matching to complete the detection of malicious behavior. It includes a packet decoder and a data analysis engine. The data information captured from the network card is first decoded by the packet decoder, and then analyzed by the data analysis engine to obtain the results and generate an alarm notification.

6. A detection and processing system for the Internet of Things, characterized in that: include: Management and control module, used for management and control of the Internet of Things detection and processing system; Analysis and processing module, used for optimizing analysis and processing of IoT detection and processing system; The collection and detection module is used for collection and detection management of the Internet of Things detection and processing system.

7. The detection and processing system of the Internet of Things according to claim 6, characterized in that: The management control module includes: Architecture management module, used for architecture control design of IoT detection and processing system; Horizontal collaboration module, used for horizontal collaborative management of IoT devices; The real-time processing module is used for real-time adaptive processing of data information.

8. The detection and processing system of the Internet of Things according to claim 6, characterized in that: The analysis and processing module comprises: Data balance module, used for data balance management of data information; An imaging module is used for imaging data information; The management and analysis module is used to manage, analyze and control the intrusion detection model.

9. The detection and processing system of the Internet of Things according to claim 6, characterized in that: The acquisition and detection module comprises: Collection management module, used for collection and management of data information; The terminal detection module is used to perform IoT terminal detection processing.

Images