Internet of Things network security supervision system based on edge computing

Abstract

The invention belongs to the technical field of network security, and discloses an Internet of Things network security supervision system based on edge computing, which realizes active defense through cooperation of multiple modules. Firstly, a data acquisition module collects a network data packet, and a behavior analysis module generates a communication sequence diagram based on the network data packet and generates an equipment behavior mode identification vector by using the communication sequence diagram; when the abnormity identification module judges that the behavior mode identification vector is abnormal, an equipment authentication request is generated; a main node of the equipment authentication module generates an authentication proposal and broadcasts the authentication proposal to an edge node trust anchor point pool, the identity of the equipment is verified through a distributed consensus mechanism, and a tamper-proof authentication result is generated; and finally, the risk isolation module dynamically isolates illegal equipment according to an authentication result. And the threat response speed and the protection accuracy are obviously improved.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and more specifically, to an IoT network security monitoring system based on edge computing. Background Technology

[0002] With the widespread application of IoT technology, hundreds of millions of smart devices have been deployed in critical infrastructure, industrial manufacturing, and daily life. To meet the demand for low-latency and high-bandwidth data processing, edge computing has become the mainstream architecture supporting IoT applications. It pushes computing and analysis capabilities down to the network edge, making it possible to achieve real-time security monitoring.

[0003] However, existing regulatory systems struggle to detect covert attacks that exploit legitimate identities. After compromising an IoT device, attackers steal its legitimate software identity credentials. Using this credible masquerade, they then initiate malicious communications such as stealthy commands (establishing connections with unknown servers at extremely low frequencies, slowly receiving instructions or sending back status) and control and low-rate data leakage (breaking stolen data into tiny packets, disguising them as normal business traffic like heartbeats, and slowly transmitting them over a very long period). This composite attack strategy circumvents both of the existing security pillars: firstly, the authentication system, having verified legitimate digital credentials, determines the device as trustworthy and allows it to proceed directly; secondly, the behavior detection system fails to identify the attack because the attack traffic's short-term statistical characteristics, such as rate and packet size, are almost indistinguishable from normal business traffic like heartbeats. This results in a serious security blind spot, as existing security systems cannot effectively correlate a device's digital identity with its long-term, subtle behavioral patterns over time and relationships. This allows these illegitimate devices, disguised as legitimate ones, to remain dormant for extended periods and cause continuous harm. In view of this, the present invention proposes an IoT network security monitoring system based on edge computing to solve the above problems. Summary of the Invention

[0004] To overcome the aforementioned shortcomings of the prior art and to achieve the above objectives, the present invention provides the following technical solution: an IoT network security monitoring system based on edge computing, comprising:

[0005] The data acquisition module is used to acquire network data packets from IoT devices;

[0006] The behavior analysis module is used to construct a communication timing diagram of IoT devices based on network data packets; and to analyze the communication behavior of IoT devices based on the communication timing diagram to obtain the behavior pattern identifier vector of IoT devices.

[0007] The anomaly detection module is used to determine the legality of behavior pattern identifier vectors and generate a device authentication request when the determination result is invalid.

[0008] The device authentication module includes a master node and a trust anchor pool consisting of multiple edge nodes. The master node receives a device authentication request, generates an authentication proposal data packet, and broadcasts the authentication proposal data packet to the edge nodes in the trust anchor pool. The edge nodes in the trust anchor pool verify the legitimacy of the IoT device based on the authentication proposal data packet through a distributed authentication mechanism and generate an authentication result.

[0009] The risk isolation module is used to isolate the IoT device based on the authentication result.

[0010] Furthermore, the methods for constructing communication timing diagrams for IoT devices include:

[0011] The acquired network data packets are divided into several subsets according to a preset time window;

[0012] Based on the network quintuple information, network data packets in the subset are aggregated to obtain several micro-flow events;

[0013] The total number of network packets and the average interval between network packets in the micro-stream event are calculated to obtain the packet behavior characteristics of the micro-stream event;

[0014] Calculate the mean and standard deviation of network packet size in each micro-flow event to obtain the packet size distribution characteristics of the micro-flow event;

[0015] After encoding the data packet behavior features and data packet size distribution features, the two are concatenated into a micro-flow feature vector;

[0016] Using the MAC address and / or IP address of IoT devices as the central node, the MAC address and / or IP address of the target communication device as the neighboring nodes, and the micro-flow feature vector as the weighted edges, a communication time sequence diagram of the subset is constructed.

[0017] Furthermore, the methods for obtaining the behavior pattern identifier vectors of IoT devices include:

[0018] Obtain the device attributes of the central node and the service attributes of the neighboring nodes in the communication timing diagram;

[0019] The device attributes of the central node and the service attributes of the neighboring nodes are encoded to obtain the device feature vector of the central node and the service feature vector of the neighboring nodes.

[0020] Based on device feature vectors, service feature vectors, and microflow feature vectors, the association strength between the central node and each neighboring node is calculated, and the association strength is converted into weight values ​​through the softmax function.

[0021] The service feature vectors of each neighboring node are weighted and summed based on the weight values ​​to generate a fused feature vector.

[0022] The fused feature vector is concatenated with the device feature vector of the central node, and the concatenation result is linearly transformed to obtain the behavior feature vector of the central node.

[0023] Based on the time sequence, the behavioral feature vectors of the central nodes of each communication time sequence diagram are sorted to obtain the communication time sequence of IoT devices;

[0024] The communication time sequence is input into a pre-built recurrent neural network to obtain a behavior pattern identifier vector.

[0025] Furthermore, the methods for determining the legality of behavioral pattern identifier vectors include:

[0026] Calculate the density distance between the behavior pattern identifier vector and each working mode in the pre-constructed behavior baseline library; the density distance is calculated based on the Gaussian distribution parameters of the corresponding working mode, the Gaussian distribution parameters include the mean vector and the covariance matrix;

[0027] The minimum value among the density distances is selected as the anomaly score of the current behavior pattern identifier vector, and its corresponding working mode is determined.

[0028] The anomaly determination threshold of the corresponding working mode is retrieved from the behavior baseline library; the anomaly score is compared with the anomaly determination threshold, and if the anomaly score is greater than the anomaly determination threshold, the behavior corresponding to the behavior pattern identifier vector is determined to be illegal.

[0029] Furthermore, the methods for obtaining the Gaussian distribution parameters and anomaly detection thresholds for each working mode include:

[0030] During the initial period after the first connection of the IoT device, the behavioral pattern identification vector of its normal working state is continuously collected and recorded as the training sample set.

[0031] The behavioral pattern identifier vectors in the training sample set are modeled using a Gaussian mixture model to obtain multiple operating modes of the Internet of Things device, and the Gaussian distribution parameters of each operating mode are estimated by the expectation-maximization algorithm.

[0032] For each identified working mode, an anomaly detection threshold is determined based on its corresponding Gaussian distribution parameters and preset percentiles.

[0033] The Gaussian distribution parameters of each working mode and the corresponding anomaly detection threshold are stored in the behavior baseline library.

[0034] Furthermore, the methods for obtaining the authentication proposal data packet include:

[0035] After receiving the device authentication request, the master node sends probe task execution instructions and signal acquisition task execution instructions to the IoT device;

[0036] The IoT device generates a corresponding software fingerprint based on the software feature information generated when performing the probe task and its own hardware information, and sends the software fingerprint to the master node;

[0037] The master node uses the edge node closest to the IoT device as the signal acquisition node. The signal acquisition node collects the electromagnetic radiation signals generated by the IoT device when it performs signal acquisition tasks, thereby generating a physical fingerprint, and then sends the physical fingerprint to the master node.

[0038] The master node integrates the device authentication request, software fingerprint, and physical fingerprint to generate an authentication proposal data packet.

[0039] Furthermore, methods for obtaining software fingerprints include:

[0040] IoT devices extract preset feature fields from their own hardware information to generate a standardized hardware identifier;

[0041] Execute a probe task containing a series of preset memory allocation requests, and capture a preset number of low-order bits for each memory address returned by the memory manager during the execution of the probe task;

[0042] The captured low-order bits are combined to generate a memory allocation pattern string;

[0043] Perform a bitwise XOR fusion operation on the standardized hardware identifier and the memory allocation pattern string to obtain fused data;

[0044] The fused data is input into a cryptographic hash function, and its output hash digest is used as the software fingerprint.

[0045] Furthermore, methods for obtaining physical fingerprints include:

[0046] The signal acquisition node performs bandpass filtering on the acquired electromagnetic radiation signal to obtain an effective time-domain signal;

[0047] The effective time-domain signal is divided into multiple signal segments according to a preset length, and each signal segment is processed by short-time Fourier transform to obtain a series of spectrum diagrams.

[0048] Extract the amplitude spectrum of each spectrogram, arrange the amplitude spectrograms in chronological order, and construct a two-dimensional feature matrix with rows corresponding to frequency components and columns corresponding to time slices;

[0049] The two-dimensional feature matrix is ​​subjected to singular value decomposition to obtain a set of singular values;

[0050] From the set of singular values, the top K largest singular values ​​are selected to form a feature vector, and the feature vector is normalized to obtain the physical fingerprint.

[0051] Furthermore, methods for verifying the legitimacy of IoT devices through distributed authentication mechanisms include:

[0052] The edge node obtains the registration fingerprint of the IoT device based on the device authentication request in the authentication proposal data packet. The registration fingerprint includes the registration software fingerprint and the registration physical fingerprint.

[0053] Edge nodes compare software fingerprints and physical fingerprints with registered fingerprints to obtain comparison results, and generate authentication decisions based on the comparison results;

[0054] Edge nodes attach digital signatures to authentication decisions, create authentication messages, and broadcast the authentication messages to the remaining edge nodes in the trust anchor pool;

[0055] After broadcasting the authentication message, the edge node collects and verifies the authentication messages of the remaining edge nodes in the trust anchor pool;

[0056] If the number of authentication messages received by an edge node that contain valid digital signatures and whose authentication decision content is consistent with its own reaches a preset first consensus threshold, then a confirmation message with an attached digital signature is generated and the confirmation message is broadcast to the remaining edge nodes in the trust anchor pool.

[0057] If any edge node in the trust anchor pool receives confirmation messages with a valid digital signature and whose content is consistent with its own, the number of such messages reaches a preset second consensus threshold. Then, the edge node generates the final authentication result and sends the final authentication result to the master node.

[0058] Furthermore, the methods for comparing software fingerprints and physical fingerprints with registered fingerprints to obtain comparison results, and generating authentication decisions based on these results, include:

[0059] Determine whether the software fingerprint is completely identical to the registered software fingerprint; if they are completely identical, the software fingerprint verification is deemed successful; otherwise, the software fingerprint is deemed incorrect.

[0060] Calculate the Euclidean distance between the physical fingerprint and the registered physical fingerprint, and determine whether the Euclidean distance is less than a preset distance threshold. If it is, the physical fingerprint verification is deemed successful; otherwise, the physical fingerprint is deemed incorrect.

[0061] If the software fingerprint verification fails but the physical fingerprint verification succeeds, an authentication decision indicating a software fingerprint error is generated.

[0062] If the software fingerprint verification passes but the physical fingerprint verification fails, an authentication decision for a physical fingerprint error is generated.

[0063] If both the software fingerprint verification and the physical fingerprint verification pass, an authentication decision is generated indicating that the authentication has passed.

[0064] If both software fingerprint verification and physical fingerprint verification fail, an authentication decision for an unknown device is generated.

[0065] This invention addresses the core challenge of identifying covert attacks disguised by identity spoofing, a core difficulty in existing technologies. It provides a high-precision online detection and intelligent, reliable handling solution. The system first constructs a communication time sequence graph and combines it with a recurrent neural network to deeply understand the long-term behavioral patterns of IoT devices across time and relationships. This allows for the accurate identification of advanced threats such as stealthy communications mimicking normal traffic and low-rate data leakage. Upon identifying such suspicious behavior, the system further verifies the device's identity through an innovative multimodal authentication mechanism. This mechanism combines software fingerprints reflecting runtime state with physical fingerprints representing physical entities, effectively penetrating software-level identity spoofing and providing a highly reliable verification of the device's authenticity and integrity. To ensure the fairness and reliability of this crucial decision, the authentication conclusion is reached by edge computing nodes through a distributed consensus mechanism, and precise risk isolation is automatically executed based on the final result. In complex attack scenarios such as advanced persistent threats, its detection accuracy and system stability are improved compared to traditional solutions. Attached Figure Description

[0066] Figure 1 This is a schematic diagram of the IoT network security monitoring system based on edge computing according to the present invention;

[0067] Figure 2 This is a schematic diagram of the distributed authentication of the present invention. Detailed Implementation

[0068] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0069] Example 1

[0070] Please see Figure 1 As shown in this embodiment, the IoT network security monitoring system based on edge computing includes:

[0071] The data acquisition module is used to acquire network data packets from IoT devices;

[0072] The behavior analysis module is used to construct a communication timing diagram of IoT devices based on network data packets; and to analyze the communication behavior of IoT devices based on the communication timing diagram to obtain the behavior pattern identifier vector of IoT devices.

[0073] The anomaly detection module is used to determine the legality of behavior pattern identifier vectors and generate a device authentication request when the determination result is invalid.

[0074] The device authentication module includes a master node and a trust anchor pool consisting of multiple edge nodes. The master node receives a device authentication request, generates an authentication proposal data packet, and broadcasts the authentication proposal data packet to the edge nodes in the trust anchor pool. The edge nodes in the trust anchor pool verify the legitimacy of the IoT device based on the authentication proposal data packet through a distributed authentication mechanism and generate an authentication result.

[0075] The risk isolation module is used to isolate the IoT device based on the authentication result.

[0076] Network data packets are the basic units of information transmitted in a network, containing different types of data generated by various devices. By monitoring the network interfaces of these edge nodes, the system can capture and process large amounts of network data packets in real time, providing basic data for subsequent data parsing and anomaly analysis. Edge nodes are servers located at the network edge (such as edge gateways and computing servers), responsible for data identification, processing, and forwarding. They are key components and the core of data flow and processing in IoT networks. The master node is the control center of the device authentication module, used only to receive device authentication requests and coordinate the authentication process. The trust anchor pool consists of multiple edge nodes trusted by the system (i.e., confirming that the edge node is in a secure state), with a minimum of three nodes. The security of the edge nodes in the pool is verified at fixed intervals (e.g., once a day), thereby dynamically modifying the number of edge nodes in the pool. There are various security verification processes, which will not be detailed here.

[0077] Furthermore, the methods for constructing communication timing diagrams for IoT devices include:

[0078] The network data packets captured by the data acquisition module are divided into a series of time-sorted subsets according to a preset time window (e.g., 3 minutes).

[0079] Within each time window subset, network packets in the subset are aggregated based on the five-tuple information of network communication (i.e., source IP address, destination IP address, source port number, destination port number, and transport layer protocol). Each aggregated cluster of network packets (with consistent five-tuple information) constitutes a micro-flow event, which represents a brief but complete end-to-end communication session.

[0080] For each micro-flow event, feature extraction is performed to quantify its communication characteristics. Specifically, two types of key features are extracted: packet behavior features and packet size distribution features. Among them, packet behavior features include the total number of network packets in the micro-flow event and the average interval between network packets; packet size distribution features include the mean and standard deviation of the size of all network packets in the micro-flow event.

[0081] To facilitate subsequent mathematical modeling, the extracted multi-dimensional original features are encoded (through a pre-defined information mapping table), and then the processed data packet behavior features are concatenated with the data packet size distribution features to form a unified microflow feature vector.

[0082] A communication timing diagram is constructed based on this micro-flow feature vector. In this communication timing diagram, the MAC address or IP address of the monitored IoT device is used as the central node, and the MAC address or IP address of the target device communicating with it is used as the neighboring node. The micro-flow feature vector, which characterizes the communication characteristics of the two, is used as the weighted edge connecting the central node and the neighboring node. Thus, a communication timing diagram that can intuitively reflect the overall communication of the devices within a specific time window is constructed.

[0083] This method abstracts massive packet-level data into a structured graph representation, enabling functional aggregation and graph construction to be completed at the edge. This preserves key communication semantics while significantly reducing computational and storage overhead, thereby providing high-quality input for subsequent behavior modeling and improving real-time performance and interpretability.

[0084] Furthermore, the methods for obtaining the behavior pattern identifier vectors of IoT devices include:

[0085] The device attributes of the central node and the service attributes of the neighboring nodes in the communication timing diagram are obtained. Semantic information is assigned to the nodes in the communication timing diagram, and this attribute information is encoded into device feature vectors and service feature vectors through one-hot encoding and other methods. Among them, device attributes refer to the static or semi-static information of the device, such as manufacturer, model, firmware version, device role, and interface type; service attributes refer to the network service information provided by the neighboring nodes, such as port, protocol family, application fingerprint, and encryption status.

[0086] Based on the device feature vector of the central node, the service feature vectors of neighboring nodes, and the micro-flow feature vectors connecting them, a pre-defined attention network is used to calculate the association strength between the central node and each neighboring node. Then, the association strength is converted into weight values ​​(0-1) using the softmax function. Based on these weight values, the service feature vectors of all neighboring nodes are weighted and summed to generate a fused feature vector, which condenses the device's current main external interaction information.

[0087] Subsequently, the fused feature vector is concatenated with the device feature vector of the central node itself, and the concatenated high-dimensional vector is subjected to dimensionality reduction and feature re-fusion through a linear transformation (such as a fully connected layer) to finally obtain the behavior feature vector of the central node under this time window, which serves as a snapshot of the device's static behavior at that moment.

[0088] To capture the temporal continuity of device behavior, the behavioral feature vectors of the central nodes need to be arranged in chronological order to form a communication time sequence. This communication time sequence is then input into a pre-trained recurrent neural network (RNN) (or its variants such as LSTM or GRU). The RNN can effectively capture the temporal dependencies in the sequence data, and its final hidden layer state output is a behavioral pattern identifier vector that can characterize the complex dynamic behavior patterns of the device over a period of time.

[0089] This method highlights key communication relationships through attention-based weighted fusion and captures periodic and burst features by combining temporal modeling to generate robust and discriminative behavioral representations. This provides inputs with higher signal-to-noise ratios for anomaly identification, reduces false alarms, and improves cross-scenario generalization capabilities.

[0090] Furthermore, the methods for determining the legality of behavioral pattern identifier vectors include:

[0091] Calculate the density distance between the current behavior pattern identifier vector and each normal working mode recorded in the pre-built behavior baseline library; this density distance effectively considers the correlation between various feature dimensions and eliminates the influence of dimensions, making anomaly measurement more accurate; the formula for calculating the density distance is: Among them, P k(x) represents the density distance of the behavior pattern identifier vector x in the k-th working mode; x represents the pattern identifier vector; k is the index of the working mode; d is the dimension of the behavior pattern identifier vector; μ k Represents the mean vector of the k-th working mode; ∑ k This represents the covariance matrix of the k-th operating mode; The inverse matrix of the covariance matrix of the k-th working mode; |∑ k | represents the determinant of the covariance matrix; T is the vector transpose symbol.

[0092] After calculating the density distance to all operating modes, the system selects the minimum value as the anomaly score of the current behavior; this score intuitively represents the degree of deviation between the current behavior and the closest normal mode; at the same time, the operating mode corresponding to the minimum value is determined as the most likely state of the device at present.

[0093] The system retrieves an anomaly threshold corresponding to the defined working mode from the behavior baseline library. This threshold is customized for that specific mode, offering higher adaptability. The calculated anomaly score is compared to this threshold. If the anomaly score exceeds the threshold, it indicates that the current behavior has significantly deviated from all known normal patterns. The system then determines that the behavior corresponding to this behavior pattern identifier vector is illegal and generates a device authentication request to initiate deep verification. This decision-making process is simple, transparent, easy to interpret and configure, and has low computational overhead at the edge. It can accurately identify both obvious anomalies and subtle, persistent deviations, contributing to early warning and reducing false alarm rates.

[0094] It should be noted that the behavior baseline library is a distributed database (implemented based on Apache Cassandra) deployed on an edge computing node cluster. It is primarily built and initialized by the behavior analysis module and is used to store Gaussian distribution parameters and anomaly detection thresholds for the operating modes of IoT devices. The data in the behavior baseline library includes device MAC or IP addresses, Gaussian distribution parameters, anomaly detection thresholds, and data version identifiers. It is written to the local storage partition of the edge nodes via the gRPC interface and interacts with the system module through the two-way authenticated mTLS protocol. The behavior analysis module automatically initiates an incremental update process monthly, updating the data in the behavior baseline library when an anomaly detection threshold drift exceeds 10%. For example, after a device firmware upgrade or after a period of operation, if an anomaly detection threshold drift is detected, retrained data is used to overwrite historical data to adapt to the change in behavior patterns.

[0095] Furthermore, the methods for obtaining the Gaussian distribution parameters and anomaly detection thresholds for each working mode include:

[0096] During the initial learning period after an IoT device first connects to the network or is reset, the system assumes that all its behaviors are normal. During this period, the behavior analysis module continuously generates behavioral pattern identifier vectors for the device and aggregates these vectors to form a training sample set for modeling.

[0097] Since IoT devices typically operate in multiple different states (such as standby, data reporting, firmware updates, etc.), the system uses a Gaussian Mixture Model (GMM) to model the training sample set. GMM can automatically cluster data points into different Gaussian distributions, with each Gaussian distribution cluster representing a working mode of the device. The system then uses the Expectation-Maximization (EM) algorithm to iteratively estimate the Gaussian distribution parameters of each working mode, namely the mean vector and covariance matrix, thereby accurately identifying multiple working modes of the device.

[0098] After identifying all working modes and obtaining their Gaussian distribution parameters, the system independently sets an anomaly detection threshold for each mode. This anomaly detection threshold is based on the Gaussian distribution (or its corresponding chi-square distribution) of the mode to determine a preset percentile (e.g., 99% or 99.5%). Any behavior that deviates from this percentile will be considered a potential anomaly.

[0099] Finally, the Gaussian distribution parameters (mean vector and covariance matrix) of each identified working mode, along with the anomaly detection threshold calculated for it, are stored as a complete data entry in the behavior baseline library for quick querying and comparison by the anomaly detection module during runtime.

[0100] Furthermore, the methods for obtaining the authentication proposal data packet include:

[0101] When the master node receives a device authentication request, it initiates the device authentication process. Specifically, the master node first issues two types of serial task instructions to the IoT device: probe task execution instructions and signal acquisition task execution instructions.

[0102] Based on the software feature information generated during the execution of probe tasks and its own hardware information, IoT devices generate corresponding software fingerprints and send these fingerprints to the master node. Upon receiving the probe task execution instruction, the IoT device executes a preset probe task. The core of this task is to initiate a series of carefully designed memory allocation requests to the IoT device's memory manager. In real-world scenarios, even if two devices have identical firmware, their internal states during actual operation exhibit subtle but measurable differences, particularly in memory management. Their allocation strategies and returned addresses are influenced by various dynamic factors such as current system load, memory fragmentation, and process scheduling, forming a chaotic, unpredictable yet relatively stable pattern for a specific device under a specific task. This behavioral pattern can serve as a unique software-level feature, which, combined with the device's own hardware information, generates a unique software fingerprint for each device.

[0103] The master node determines and selects the closest (physically closest) edge node to the IoT device as the signal acquisition node. The signal acquisition node collects the electromagnetic radiation signals generated by the IoT device during signal acquisition, thereby generating a physical fingerprint, which is then sent to the master node. Because each semiconductor chip has minute, unavoidable physical differences during manufacturing, their power consumption, clock jitter, and electromagnetic radiation characteristics exhibit stable and unique fingerprints when performing the same computational task. These physical differences are inherent to the hardware and are virtually impossible to clone. Therefore, after the probe task is completed, the IoT device continues to execute a preset signal acquisition task. This task is a standardized computational load with deterministic calculations and repeatable processes (e.g., repeatedly executing a specific encryption algorithm). This causes the IoT device's processor to generate electromagnetic radiation signals with stable and unique patterns. These signals are captured and processed by nearby edge nodes and used as the IoT device's physical fingerprint.

[0104] The master node integrates the device authentication request, software fingerprint, and physical fingerprint to generate an authentication proposal data packet, and broadcasts the authentication proposal data packet to the edge nodes in the trust anchor pool for distributed authentication to obtain the final authentication result.

[0105] like Figure 2As shown, this embodiment distributes the authority to authenticate devices to a trust anchor pool composed of multiple trusted edge nodes. The master node does not participate in authentication decisions, but is only responsible for initiating tasks and distributing information (integrating device authentication requests, software fingerprints, and physical fingerprints into an authentication proposal data packet and broadcasting it to all other edge nodes in the trust anchor pool). All nodes complete authentication through a distributed process of collaborative verification, which not only eliminates the cascading effects of single-node failures, but also significantly increases the difficulty of spoofing attacks through a multi-node cross-verification mechanism, fundamentally strengthening the security barrier for network access.

[0106] Furthermore, methods for obtaining software fingerprints include:

[0107] IoT devices first access their underlying hardware interfaces to obtain hardware information about the central processing unit (CPU), including CPU model, manufacturer ID, family, stepping, and a unique serial number for a specific architecture. From the obtained hardware information, a set of key feature fields are extracted according to preset rules. For example, the CPU model, manufacturer ID, and serial number are selected uniformly.

[0108] The extracted feature fields are concatenated in a fixed order (such as by CPU model, manufacturer ID, and serial number) to form a fixed-length binary string; this binary string is the standardized hardware identifier, which represents the static identity of the core computing unit of the IoT device.

[0109] The device executes a pre-defined, standardized probe task. At its core is a memory allocation loop. In each loop, a request is sent to the device's operating system kernel or memory manager to allocate a block of memory of random size (within a pre-defined range, such as 1KB to 4KB). Upon successful allocation, the memory manager returns a memory address (a pointer) pointing to the beginning of the memory block. The device immediately captures this returned address and extracts a pre-defined number of its least significant bits; for example, for a 32-bit address, the lowest 16 bits (bits 0 to 15) can be extracted. These least significant bits reflect the dynamic behavior of the memory allocator.

[0110] The low-order bits captured in each loop are concatenated in the order of execution to form a binary string (length P×16 bits, where P is the number of loops). This binary string is the memory allocation pattern string, which is like an electrocardiogram of the device's memory behavior when performing this standard task, recording the unique characteristics of its memory allocation pattern.

[0111] To tightly bind static hardware identity with dynamic memory behavior, a bitwise XOR operation is performed on the hardware identifier and memory allocation pattern string to obtain fused data. During this process, if the two are of different lengths, the shorter one can be padded cyclically to match the longer length. The XOR operation ensures that the final result depends on both inputs simultaneously, and a change in either one will lead to a significant change in the result. The fused data obtained after XOR fusion is then fed into a standard cryptographic hash function, such as SHA-256. This hash function outputs a 256-bit hash digest, which is the final, highly concentrated, and difficult-to-forge software fingerprint.

[0112] Furthermore, methods for obtaining physical fingerprints include:

[0113] After completing the probe task, the IoT device loads a signal acquisition task, which is a computationally intensive program with a deterministic computation process, no external dependencies, and precise repeatability; for example, using a fixed key and a fixed plaintext block, it repeatedly performs one or all rounds of the AES encryption algorithm S times (e.g., S=10000).

[0114] Before performing the task, the device sends a synchronization signal to the signal acquisition node via the network to ensure that the signal acquisition time window is precisely aligned with the task execution time window. The signal acquisition node uses a high-sensitivity near-field electromagnetic probe or antenna to acquire electromagnetic radiation signals at a high sampling rate (GSa / s) within a preset frequency band (such as near a multiple of the CPU core clock frequency) and within the synchronized time window.

[0115] The signal acquisition node performs bandpass filtering on the acquired electromagnetic radiation signal to filter out environmental noise and interference from irrelevant frequency bands, obtaining an effective time-domain signal; then, the effective time-domain signal is divided into multiple signal segments according to a preset length (e.g., the time corresponding to a single cycle of the fingerprint excitation task);

[0116] Perform a short-time Fourier transform on each signal segment to convert it from the time domain to the frequency domain, resulting in a series of spectrograms. Extract the amplitude spectrum of each spectrogram and arrange the amplitude spectrograms in chronological order to construct a two-dimensional feature matrix with rows corresponding to frequency components and columns corresponding to time slices. The rows of this two-dimensional feature matrix represent different frequency points, and the columns represent different time slices. Each element value in the matrix represents the signal energy intensity at that time and frequency.

[0117] Singular value decomposition (SVD) is performed on a two-dimensional feature matrix to obtain a set of singular values. Singular value decomposition can decompose a matrix into the product of three matrices, in which the middle diagonal matrix contains a set of singular values ​​ordered by size. These singular values ​​represent the principal energy components of the original signal in different orthogonal directions.

[0118] From the obtained set of singular values, select the top K largest singular values ​​(e.g., K = 50). These singular values ​​contain the vast majority of the signal energy (≥90%) and reflect the operating characteristics of the device.

[0119] Arrange these K singular values ​​in descending order to form a K-dimensional feature vector. Normalize the feature vector using the L2 norm to eliminate the influence of signal strength, thus obtaining a normalized K-dimensional feature vector. This vector is the final physical fingerprint that can represent the unique physical characteristics of the device.

[0120] Furthermore, the edge nodes in the trust anchor pool verify the legitimacy of IoT devices through a distributed authentication mechanism based on authentication proposal data packets, including the following methods:

[0121] After receiving the authentication proposal data packet, the edge node queries the device's registration fingerprint generated when it first accessed the system from its local synchronized or accessible private chain, based on the device identification information (MAC address or IP address) in the authentication proposal. The registration fingerprint includes the registration software fingerprint and the registration physical fingerprint.

[0122] The software fingerprint and physical fingerprint are compared with the registered fingerprint to obtain the comparison results, and an authentication decision is generated based on the comparison results.

[0123] Edge nodes attach their own digital signature (such as ID information or MAC address) to the authentication decision to prove the source and integrity of the decision, thereby creating an authentication message (such as a software fingerprint error of the device); and broadcast this authentication message to all the remaining edge nodes in the trust anchor pool;

[0124] Meanwhile, after broadcasting the authentication message, the edge node begins to collect and verify authentication messages from other edge nodes in the trust anchor pool. For each received authentication message, it verifies the validity of its digital signature (verifies whether it is from an edge node in the trust anchor pool). The authentication message is considered valid only when the signature verification passes. Messages that fail verification will be discarded and will not be included in subsequent statistics.

[0125] When the number of authentication messages received by an edge node that have valid digital signatures and are identical to its own authentication message reaches a pre-set first consensus threshold (e.g., accounting for 2 / 3 of the total number of nodes in the trust anchor pool), the edge node considers that its judgment has been initially recognized by the majority in the trust anchor pool, and generates a confirmation message representing that the initial consensus has been reached (e.g., authentication passed, unknown device, software fingerprint error, or physical fingerprint error), attaches a digital signature, and broadcasts it to the trust anchor pool again.

[0126] When any edge node in the trust anchor pool receives a number of confirmation messages with valid digital signatures that are identical to its own confirmation message, reaching the second consensus threshold (which can also be 2 / 3), the edge node can be certain that the entire network has reached a final consensus on this authentication result (such as authentication passed). The edge node that has reached the final consensus takes this consensus result as the final authentication result and sends it back to the master node.

[0127] The above method uses a two-phase consensus mechanism similar to Byzantine fault tolerance. Edge nodes reach a consensus on the final authentication result by broadcasting authentication and confirmation messages with digital signatures. Only when the vast majority of edge nodes agree on a result is the result considered final and valid. This method ensures that even if a small number of nodes in the pool are attacked or malfunction, the decision result of the entire authentication system is still correct and reliable. The final authentication result no longer depends on any single edge node, but is based on the mathematical consensus of the entire decentralized network, resulting in a higher level of trust.

[0128] Furthermore, the methods for comparing software fingerprints and physical fingerprints with registered fingerprints to obtain comparison results, and generating authentication decisions based on these results, include:

[0129] Edge nodes determine whether the received software fingerprint and the registered software fingerprint (hash digest) are completely identical at the bit level. The software fingerprint verification passes if and only if the two are completely identical at the binary level. If there is any difference in any bit, the verification fails and the software fingerprint is judged to be incorrect. This strict verification method makes full use of the avalanche effect of cryptographic hash functions. Any small, unauthorized modification to the underlying software or operating environment of the device will lead to subtle changes in memory allocation behavior, thereby generating a completely different software fingerprint hash value, ensuring the integrity and authenticity of the software layer.

[0130] Calculate the Euclidean distance between the physical fingerprint and the registered physical fingerprint, and determine whether the Euclidean distance is less than a preset distance threshold (the value is 0.15, obtained based on statistical analysis of historical data); if so, the physical fingerprint verification is deemed successful; otherwise, the physical fingerprint is deemed incorrect.

[0131] It should be noted that Euclidean distance can effectively quantify the absolute difference between physical fingerprint vectors and focus on the authenticity of hardware energy distribution. The calculated Euclidean distance value is a real number greater than or equal to 0. The lower the Euclidean distance value, the closer the spatial positions of the two physical fingerprints in the feature space, that is, the more consistent the hardware physical state they represent.

[0132] If the software fingerprint verification fails but the physical fingerprint verification succeeds, an authentication decision indicating a software fingerprint error is generated.

[0133] If the software fingerprint verification passes but the physical fingerprint verification fails, an authentication decision for a physical fingerprint error is generated.

[0134] If both the software fingerprint verification and the physical fingerprint verification pass, an authentication decision is generated indicating that the authentication has passed.

[0135] If both software fingerprint verification and physical fingerprint verification fail, an authentication decision for an unknown device is generated.

[0136] By combining precise verification with distance measurement, this composite decision-making method not only captures deterministic changes caused by malicious tampering, but also tolerates reasonable signal fluctuations in the physical world. This ensures high security while greatly improving the reliability and practicality of the entire authentication scheme in real industrial environments.

[0137] If the authentication result is successful, it indicates that the device has passed the verification in terms of software integrity and hardware authenticity; the master node will grant it full and normal network access permissions, including configuring its network port to the correct business domain and allowing it in the security policy.

[0138] If the authentication result is a software fingerprint error, it indicates that there is an anomaly at the software level of the device, which may have been tampered with. The system will immediately isolate the device from the network, place it in a restricted network that can only communicate with the security analysis server, and generate a medium-priority alarm for further investigation and analysis.

[0139] If the authentication result is an incorrect physical fingerprint, it indicates that the physical entity of the device is not the initially registered device and there is a very high risk of counterfeiting or cloning. In response, the system will block all communication of the device at the network level, generate a high-priority alarm, and send the security event to the monitoring display terminal to remind the security person in charge to take action on the device.

[0140] If the authentication result is an unknown device (i.e., neither the software nor the hardware fingerprint matches), the device is considered a high-risk unknown entity. The system will permanently block all communication of the device at the network level, generate a corresponding security incident report, and immediately notify the administrator to handle the device.

[0141] This differentiated handling process, which is closely linked to the certification results, forms a complete security closed loop from in-depth certification to precise execution, ensuring a rapid, effective, and risk-appropriate response to different types of security threats.

[0142] This invention addresses the core challenge of identifying covert attacks disguised by identity spoofing, a core difficulty in existing technologies. It provides a high-precision online detection and intelligent, reliable handling solution. The system first constructs a communication time sequence graph and combines it with a recurrent neural network to deeply understand the long-term behavioral patterns of IoT devices across time and relationships. This allows for the accurate identification of advanced threats such as stealthy communications mimicking normal traffic and low-rate data leakage. Upon identifying such suspicious behavior, the system further verifies the device's identity through an innovative multimodal authentication mechanism. This mechanism combines software fingerprints reflecting runtime state with physical fingerprints representing physical entities, effectively penetrating software-level identity spoofing and providing a highly reliable verification of the device's authenticity and integrity. To ensure the fairness and reliability of this crucial decision, the authentication conclusion is reached by edge computing nodes through a distributed consensus mechanism, and precise risk isolation is automatically executed based on the final result. In complex attack scenarios such as advanced persistent threats, its detection accuracy and system stability are improved compared to traditional solutions.

[0143] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technical features. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

[0144] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0145] In the description of this invention, it should be understood that the terms "first," "second," etc., are used only for distinguishing descriptions and should not be construed as indicating or implying relative importance.

[0146] In the description of this invention, unless otherwise stated, "a plurality of" means two or more.

[0147] In the description of this invention, "several" means one or more, and "a large number" means two or more.

[0148] In the description of this specification, references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0149] All formulas in this manual are dimensionless and calculated numerically. The formulas are derived from software simulations based on a large amount of collected data to obtain the most recent real-world results. The preset parameters and thresholds in the formulas are set by those skilled in the art according to the actual situation.

[0150] Although embodiments of the invention have been shown and described, those skilled in the art will understand that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the claims and their equivalents.

Claims

1. An IoT network security monitoring system based on edge computing, characterized in that, include: The data acquisition module is used to acquire network data packets from IoT devices; The behavior analysis module is used to construct communication timing diagrams for IoT devices based on network data packets from IoT devices. Based on the analysis of communication time sequence diagrams, the communication behavior of IoT devices is analyzed to obtain the behavior pattern identification vector of IoT devices. The anomaly detection module is used to determine the legality of behavior pattern identifier vectors and generate a device authentication request when the determination result is invalid. The device authentication module includes a master node and a trust anchor pool consisting of multiple edge nodes. The master node receives a device authentication request, generates an authentication proposal data packet, and broadcasts the authentication proposal data packet to the edge nodes in the trust anchor pool. The edge nodes in the trust anchor pool verify the legitimacy of the IoT device based on the authentication proposal data packet through a distributed authentication mechanism and generate an authentication result. The risk isolation module is used to isolate the IoT device based on the authentication result.

2. The IoT network security monitoring system based on edge computing according to claim 1, characterized in that, The methods for constructing communication timing diagrams for IoT devices include: The acquired network data packets are divided into several subsets according to a preset time window; Based on the network quintuple information, network data packets in the subset are aggregated to obtain several micro-flow events; The total number of network packets and the average interval between network packets in the micro-stream event are calculated to obtain the packet behavior characteristics of the micro-stream event; Calculate the mean and standard deviation of network packet size in each micro-flow event to obtain the packet size distribution characteristics of the micro-flow event; After encoding the data packet behavior features and data packet size distribution features, the two are concatenated into a micro-flow feature vector; Using the MAC address and / or IP address of IoT devices as the central node, the MAC address and / or IP address of the target communication device as the neighboring nodes, and the micro-flow feature vector as the weighted edges, a communication time sequence diagram of the subset is constructed.

3. The IoT network security monitoring system based on edge computing according to claim 2, characterized in that, The methods for obtaining the behavior pattern identifier vectors of IoT devices include: Obtain the device attributes of the central node and the service attributes of the neighboring nodes in the communication timing diagram; The device attributes of the central node and the service attributes of the neighboring nodes are encoded to obtain the device feature vector of the central node and the service feature vector of the neighboring nodes. Based on device feature vectors, service feature vectors, and microflow feature vectors, the association strength between the central node and each neighboring node is calculated, and the association strength is converted into weight values ​​through the softmax function. The service feature vectors of each neighboring node are weighted and summed based on the weight values ​​to generate a fused feature vector. The fused feature vector is concatenated with the device feature vector of the central node, and the concatenation result is linearly transformed to obtain the behavior feature vector of the central node. Based on the time sequence, the behavioral feature vectors of the central nodes of each communication time sequence diagram are sorted to obtain the communication time sequence of IoT devices; The communication time sequence is input into a pre-built recurrent neural network to obtain a behavior pattern identifier vector.

4. The IoT network security monitoring system based on edge computing according to claim 3, characterized in that, The methods for determining the validity of behavior pattern identifier vectors include: Calculate the density distance between the behavior pattern identifier vector and each working mode in the pre-constructed behavior baseline library; the density distance is calculated based on the Gaussian distribution parameters of the corresponding working mode, the Gaussian distribution parameters include the mean vector and the covariance matrix; The minimum value among the density distances is selected as the anomaly score of the current behavior pattern identifier vector, and its corresponding working mode is determined. The anomaly determination threshold of the corresponding working mode is retrieved from the behavior baseline library; the anomaly score is compared with the anomaly determination threshold, and if the anomaly score is greater than the anomaly determination threshold, the behavior corresponding to the behavior pattern identifier vector is determined to be illegal.

5. The IoT network security monitoring system based on edge computing according to claim 4, characterized in that, The methods for obtaining the Gaussian distribution parameters and anomaly detection thresholds for each working mode include: During the initial period after the first connection of the IoT device, the behavioral pattern identification vector of its normal working state is continuously collected and recorded as the training sample set. The behavioral pattern identifier vectors in the training sample set are modeled using a Gaussian mixture model to obtain multiple operating modes of the Internet of Things device, and the Gaussian distribution parameters of each operating mode are estimated by the expectation-maximization algorithm. For each identified working mode, an anomaly detection threshold is determined based on its corresponding Gaussian distribution parameters and preset percentiles. The Gaussian distribution parameters of each working mode and the corresponding anomaly detection threshold are stored in the behavior baseline library.

6. The IoT network security monitoring system based on edge computing according to claim 5, characterized in that, The authentication proposal data packet can be obtained in the following ways: After receiving the device authentication request, the master node sends probe task execution instructions and signal acquisition task execution instructions to the IoT device; The IoT device generates a corresponding software fingerprint based on the software feature information generated when performing the probe task and its own hardware information, and sends the software fingerprint to the master node; The master node uses the edge node closest to the IoT device as the signal acquisition node. The signal acquisition node collects the electromagnetic radiation signals generated by the IoT device when it performs signal acquisition tasks, thereby generating a physical fingerprint, and then sends the physical fingerprint to the master node. The master node integrates the device authentication request, software fingerprint, and physical fingerprint to generate an authentication proposal data packet.

7. The IoT network security monitoring system based on edge computing according to claim 6, characterized in that, Software fingerprints can be obtained in the following ways: IoT devices extract preset feature fields from their own hardware information to generate a standardized hardware identifier; Execute a probe task containing a series of preset memory allocation requests, and capture a preset number of low-order bits for each memory address returned by the memory manager during the execution of the probe task; The captured low-order bits are combined to generate a memory allocation pattern string; Perform a bitwise XOR fusion operation on the standardized hardware identifier and the memory allocation pattern string to obtain fused data; The fused data is input into a cryptographic hash function, and its output hash digest is used as the software fingerprint.

8. The IoT network security monitoring system based on edge computing according to claim 7, characterized in that, Methods for obtaining physical fingerprints include: The signal acquisition node performs bandpass filtering on the acquired electromagnetic radiation signal to obtain an effective time-domain signal; The effective time-domain signal is divided into multiple signal segments according to a preset length, and each signal segment is processed by short-time Fourier transform to obtain a series of spectrum diagrams. Extract the amplitude spectrum of each spectrogram, arrange the amplitude spectrograms in chronological order, and construct a two-dimensional feature matrix with rows corresponding to frequency components and columns corresponding to time slices; The two-dimensional feature matrix is ​​subjected to singular value decomposition to obtain a set of singular values; From the set of singular values, the top K largest singular values ​​are selected to form a feature vector, and the feature vector is normalized to obtain the physical fingerprint.

9. The IoT network security monitoring system based on edge computing according to claim 8, characterized in that, Methods for verifying the legitimacy of IoT devices through distributed authentication mechanisms include: The edge node obtains the registration fingerprint of the IoT device based on the device authentication request in the authentication proposal data packet. The registration fingerprint includes the registration software fingerprint and the registration physical fingerprint. Edge nodes compare software fingerprints and physical fingerprints with registered fingerprints to obtain comparison results, and generate authentication decisions based on the comparison results; Edge nodes attach digital signatures to authentication decisions, create authentication messages, and broadcast the authentication messages to the remaining edge nodes in the trust anchor pool; After broadcasting the authentication message, the edge node collects and verifies the authentication messages of the remaining edge nodes in the trust anchor pool; If the number of authentication messages received by an edge node that contain valid digital signatures and whose authentication decision content is consistent with its own reaches a preset first consensus threshold, then a confirmation message with an attached digital signature is generated and the confirmation message is broadcast to the remaining edge nodes in the trust anchor pool. If any edge node in the trust anchor pool receives confirmation messages with a valid digital signature and whose content is consistent with its own, the number of such messages reaches a preset second consensus threshold. Then, the edge node generates the final authentication result and sends the final authentication result to the master node.

10. The IoT network security monitoring system based on edge computing according to claim 9, characterized in that, Methods for comparing software fingerprints and physical fingerprints with registered fingerprints, obtaining comparison results, and generating authentication decisions based on these results include: Determine whether the software fingerprint is completely identical to the registered software fingerprint; if they are completely identical, the software fingerprint verification is deemed successful; otherwise, the software fingerprint is deemed incorrect. Calculate the Euclidean distance between the physical fingerprint and the registered physical fingerprint, and determine whether the Euclidean distance is less than a preset distance threshold. If it is, the physical fingerprint verification is deemed successful; otherwise, the physical fingerprint is deemed incorrect. If the software fingerprint verification fails but the physical fingerprint verification succeeds, an authentication decision indicating a software fingerprint error is generated. If the software fingerprint verification passes but the physical fingerprint verification fails, an authentication decision for a physical fingerprint error is generated. If both software fingerprint verification and physical fingerprint verification pass, an authentication decision is generated indicating successful authentication; if both software fingerprint verification and physical fingerprint verification fail, an authentication decision for an unknown device is generated.

Images