Internet of Things anomaly detection security optimization technology based on data tampering defense

Abstract

The invention discloses an Internet of Things anomaly detection security optimization technology based on data tampering defense, which comprises a plurality of sensing nodes and a cluster head node, and is characterized by further comprising a modeling method of a security tradeoff (ST) problem, the modeling method for the security balance (ST) problem comprises data transmission and anomaly detection, a comprehensive detection rate, a comprehensive false alarm rate and a linear programming model, an efficient, reliable and easy-to-implement ADS management strategy brings innovative technical progress for the field of Internet of Things security, and the protection capability of Internet of Things equipment in the face of complex security threats is remarkably improved.

Description

Technical Field

[0001] The present invention relates to the technical field of anomaly detection of the Internet of Things, and more specifically, to a security optimization technology for anomaly detection of the Internet of Things based on data tampering defense. Background Art

[0002] As a bridge between the physical world and the digital world, the Internet of Things (IoT) has a wide range of applications in modern society. However, due to the limited computing power and storage capacity of IoT devices, coupled with the limitation of wireless communication bandwidth, the IoT is vulnerable to a wide range of cyber attacks. In particular, real data in the IoT may be tampered with through session hijacking or physical capture, which may lead to serious consequences.

[0003] To protect IoT from data tampering (DT) attacks, signature-based and anomaly detection-based defense techniques have been developed and applied. Deploying anomaly detection systems (ADS) on some or all nodes of IoT has been shown to be an effective means of defending against DT attacks. Real-world IoT may contain many resource-constrained devices that can only use lightweight ADS to defend against DT attacks. These lightweight ADS may exhibit high false positive rates when faced with complex DT attacks. ADS can be configured to run in active or passive mode: in active mode, some real data may be discarded due to false positives from ADS; while in passive mode, all fake data will be unprocessed, which will bring various security issues. Therefore, developing a strategy to manage ADS to minimize the impact of fake data while accepting a lower probability of discarding real data has become a key requirement.

[0004] Currently, anomaly detection technologies based on machine learning are widely used in the Internet of Things. These technologies can identify anomalies and malicious behaviors by analyzing and learning normal network traffic and behavior patterns. However, although the operation of ADS can enhance the security of the Internet of Things, the presence of high false alarm rates in some ADS may cause real data to be mistakenly identified as false data, making it inaccessible and potentially interfering with the normal functions of the Internet of Things. This problem, known as the security-availability tradeoff (ST) problem, is a trade-off between the security and availability of IoT data. Therefore, finding an effective ADS management strategy that can maximize security performance without interfering with the normal operation of the Internet of Things has become the core of the present invention. Summary of the invention

[0005] 1. Technical issues to be solved

[0006] In view of the problems existing in the prior art, the present invention provides an Internet of Things anomaly detection security optimization technology based on data tampering defense to solve the technical problems mentioned in the background technology.

[0007] (II) Technical solution

[0008] To achieve the above object, the present invention provides the following technical solutions: a data tampering defense-based IoT anomaly detection security optimization technology, comprising a plurality of sensing nodes and a cluster head node, and also comprising a modeling method for a security tradeoff (ST) problem, the modeling method for the security tradeoff (ST) problem comprising data transmission and anomaly detection, a comprehensive detection rate, a comprehensive false alarm rate and a linear programming model;

[0009] Data transmission and anomaly detection: Multiple sensor nodes and cluster head nodes form a two-hop IoT system. The sensor nodes are used to collect environmental data and pass the collected environmental data to the cluster head node. The cluster head node is responsible for collecting data from multiple sensor nodes and forwarding the data to the data center. A data collection scheme is proposed to specify the data collection rate of each sensor node, and a data tampering (DT) model is further defined to describe the probability of data tampering at each sensor node.

[0010] Each area is divided into several sub-areas, each sub-area contains a cluster head, and all sensor nodes in the same sub-area are routed to the cluster head located in the sub-area.

[0011] The present invention is further configured as follows: the data collection scheme: the ADS deployed on each cluster head node has the ability to detect data tampering and can receive and process data according to a predefined data collection rate.

[0012] The present invention is further configured such that the comprehensive detection rate refers to the ratio of data correctly marked as abnormal among all false data, and this detection rate is calculated and optimized by establishing a mathematical model to ensure that as much false data as possible is detected while reducing false positives of real data.

[0013] The present invention is further configured such that the comprehensive false alarm rate refers to the ratio of data that is incorrectly marked as abnormal in all real data, and managing this ratio is crucial to ensuring that the system does not discard a large amount of real data due to false alarms, thereby causing system performance to deteriorate.

[0014] The present invention is further configured such that the linear programming model is called a running mode (RM) model, and the goal of the model is to maximize the comprehensive detection rate without exceeding a preset upper limit of the comprehensive false alarm rate. The present invention uses linear programming theory to prove that the ST model can be solved in polynomial time and can be efficiently solved using optimization tools such as MATLAB.

[0015] (III) Beneficial effects

[0016] Compared with the prior art, the present invention provides an IoT anomaly detection security optimization technology based on data tampering defense, which has the following beneficial effects:

[0017] 1. By building and solving the security tradeoff (ST) model, the operation mode of ADS is effectively managed, so that it can minimize false positives of real data while ensuring high data security. This strategy significantly improves the reliability and data integrity of the Internet of Things.

[0018] 2. Applicable to IoT environments of different scales and node densities. Through application in multiple IoT layouts, it is proved that the strategy can maintain efficient performance in various situations, showing its wide applicability and flexibility.

[0019] 3. The combination of theoretical analysis and network simulators (such as ns-3) not only verifies the effectiveness of the model in theory, but also verifies the practical application value of the model through actual data. This combination ensures the scientificity and practicality of the technical solution.

[0020] 4. The present invention supports the ability to dynamically adjust the ADS operating mode based on real-time data, so that the Internet of Things system can adaptively adjust according to the current network status and data liquidity, and effectively respond to various unknown or dynamically changing security threats.

[0021] 5. By precisely controlling the false positive and false negative rates, the present invention significantly improves the security of the entire IoT system. This has been confirmed in various simulation experiments, where the optimized detection strategy can effectively identify and respond to various data tampering attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 The layout of three two-hop IoTs;

[0023] Figure 2 For Figure 1 (a) The layout verifies the effectiveness and superiority of the ADS bank optimal operation mode proposed by the present invention in improving the detection rate;

[0024] Figure 3 For Figure 1 (b) The layout verifies the effectiveness and superiority of the ADS bank optimal operation mode proposed by the present invention in improving the detection rate;

[0025] Figure 4 For Figure 1 (c) The layout verifies the effectiveness and superiority of the ADS bank optimal operation mode proposed by the present invention in improving the detection rate. DETAILED DESCRIPTION

[0026] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application may be combined with each other. The present invention will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0027] It should be noted that, unless otherwise specified, all technical and scientific terms used in this application have the same meanings as commonly understood by ordinary technicians in the technical field to which this application belongs.

[0028] See also Figure 1-4 ,A security optimization technology for anomaly detection in the Internet of Things based on data tampering defense, including multiple sensing nodes and cluster head nodes, and also including a modeling method for the security tradeoff (ST) problem. The modeling method for the security tradeoff (ST) problem includes data transmission and anomaly detection, comprehensive detection rate, comprehensive false alarm rate and linear programming model. Data transmission and anomaly detection: Multiple sensing nodes and cluster head nodes form a two-hop Internet of Things system. The sensing nodes are used to collect environmental data and pass the collected environmental data to the cluster head node. The cluster head node is responsible for collecting data from multiple sensing nodes and forwarding the data to the data center. A data collection scheme is proposed to specify the data collection rate of each sensing node, and a data tampering (DT) model is further defined to describe the probability that the data of each sensing node is tampered with. Data collection scheme: AD deployed on each cluster head node S has the ability to detect data tampering, and can receive and process data according to a predefined data collection rate. The comprehensive detection rate refers to the ratio of data correctly marked as abnormal in all false data. This detection rate is calculated and optimized by establishing a mathematical model to ensure that as many false data as possible are detected while reducing false positives of real data. The comprehensive false positive rate refers to the ratio of data incorrectly marked as abnormal in all real data. Managing this ratio is crucial to ensure that the system does not discard a large amount of real data due to false positives, resulting in a decrease in system performance. The linear programming model is called the operating mode (RM) model. The goal of this model is to maximize the comprehensive detection rate without exceeding the preset upper limit of the comprehensive false positive rate. The present invention uses linear programming theory to prove that the ST model can be solved in polynomial time and can be efficiently solved using optimization tools such as MATLAB.

[0029] Each area is divided into several sub-areas, each sub-area contains a cluster head, and all sensor nodes in the same sub-area are routed to the cluster head located in the sub-area.

[0030] The anomaly detection system (ADS) management strategy of the present invention provides significant security performance optimization for the Internet of Things (IoT). Optimized detection strategy: By constructing and solving the security tradeoff (ST) model, the present invention effectively manages the operation mode of ADS, so that it can minimize false alarms of real data while ensuring high data security. This strategy significantly improves the reliability and data integrity of the IoT; Reduce data unavailability loss: Experimental results show that the management strategy proposed by the present invention can significantly reduce the data unavailability loss caused by high false alarm rate. Through precise operation mode optimization, ADS can control the false alarm rate at a lower level while increasing the false data detection rate, thereby maintaining the efficient operation of the system; Flexible application scope: The method of the present invention is applicable to IoT environments of different scales and different node densities. Through application in multiple IoT layouts, it is proved that the strategy can maintain high efficiency in various situations, showing its wide applicability and flexibility; Combination of theory and practice: Through the method of combining theoretical analysis with network simulators (such as ns-3), the present invention not only verifies the effectiveness of the model in theory, but also verifies the practical application value of the model through actual data. This combination ensures the scientificity and practicality of the technical solution; Dynamic adjustment and adaptive capability: The present invention supports the ability to dynamically adjust the ADS operation mode based on real-time data, so that the IoT system can adaptively adjust according to the current network status and data liquidity, and effectively respond to various unknown or dynamically changing security threats; Enhance the overall security of the system: By accurately controlling the false alarm and false alarm rates, the present invention significantly improves the security of the entire IoT system. This has been confirmed in various simulation experiments, in which the optimized detection strategy can effectively identify and respond to various data tampering attacks.

[0031] In summary, the present invention provides an efficient, reliable and easy-to-implement ADS management strategy, which brings innovative technological progress to the field of IoT security and significantly improves the protection capabilities of IoT devices in the face of complex security threats.

[0032] In summary, when the overall equipment is in use:

[0033] Sensing nodes for collecting environmental data and cluster head nodes for forwarding data from the sensing nodes to the data center. All cluster head nodes are equipped with ADS and work in the following way: first, clustering operations are performed on a set of data from different sensing nodes but with the same timestamp; second, all abnormal data are identified and discarded; finally, the remaining data is encrypted and the encrypted data is transmitted to the data center.

Claims

1. A security optimization technology for IoT anomaly detection based on data tampering defense, comprising a plurality of sensing nodes and a cluster head node, characterized in that: It also includes modeling methods for security tradeoff (ST) problems, including data transmission and anomaly detection, comprehensive detection rate, comprehensive false alarm rate, and linear programming models; Data transmission and anomaly detection: Multiple sensor nodes and cluster head nodes form a two-hop IoT system. The sensor nodes are used to collect environmental data and pass the collected environmental data to the cluster head node. The cluster head node is responsible for collecting data from multiple sensor nodes and forwarding the data to the data center. A data collection scheme is proposed to specify the data collection rate of each sensor node, and a data tampering (DT) model is further defined to describe the probability of data tampering at each sensor node. Each area is divided into several sub-areas, each sub-area contains a cluster head, and all sensor nodes in the same sub-area are routed to the cluster head located in the sub-area.

2. According to claim 1, the IoT anomaly detection security optimization technology based on data tampering defense is characterized by: The data collection scheme: The ADS deployed on each cluster head node has the ability to detect data tampering and can receive and process data according to a predefined data collection rate.

3. According to claim 1, the IoT anomaly detection security optimization technology based on data tampering defense is characterized by: The comprehensive detection rate refers to the ratio of data correctly marked as abnormal among all false data. This detection rate is calculated and optimized by establishing a mathematical model to ensure that as much false data as possible is detected while reducing false positives of real data.

4. The IoT anomaly detection security optimization technology based on data tampering defense according to claim 1 is characterized by: The comprehensive false alarm rate refers to the ratio of data that is incorrectly marked as abnormal in all real data.

5. The IoT anomaly detection security optimization technology based on data tampering defense according to claim 1 is characterized by: The linear programming model is called the running mode (RM) model. The goal of this model is to maximize the comprehensive detection rate without exceeding the preset upper limit of the comprehensive false alarm rate. The present invention uses linear programming theory to prove that the ST model can be solved in polynomial time and can be efficiently solved using optimization tools such as MATLAB.

Images