Big data-based internet of things security intelligent detection system

Abstract

The application relates to the technical field of Internet of Things security detection, in particular to an Internet of Things security intelligent detection system based on big data, which comprises a security intelligent detection center, a network perception module, a behavior portrait management module, a multi-dimensional abnormality monitoring module, a multi-dimensional threat evaluation module and a detection visual module, the multi-dimensional threat evaluation module is internally provided with a device correlation unit and a time correlation unit; the application constructs a multi-dimensional baseline through normal operation data of devices, simultaneously realizes real-time optimization of dynamic behavior portraits through an incremental updating mechanism, ensures that a detection benchmark is synchronous with a device operation state, improves adaptability to changes in a device operation mode, discriminates abnormalities from three core dimensions of communication, resources and operation, combines correlation analysis between devices and time correlation analysis, accurately identifies complex threats, constructs a multi-dimensional threat level evaluation system, and improves the safety protection pertinence and effectiveness of the Internet of Things network.

Description

Technical Field

[0001] This invention relates to the field of IoT security detection technology, and in particular to an IoT security intelligent detection system based on big data. Background Technology

[0002] With the rapid development of IoT technology, IoT devices are increasingly widely used in industrial control, smart homes, public services and other fields. The number of devices connected to the IoT network continues to grow and the types of devices are becoming more diverse. Different types of devices have significant differences in communication protocols, resource configurations and operating logic, resulting in the generation of massive amounts of multi-source heterogeneous security data in the IoT network.

[0003] Current IoT security detection technologies generally suffer from the following problems: First, data processing lacks systematicity. Multi-source heterogeneous data has not undergone standardized cleaning and processing, and its direct use for detection easily leads to an increased false alarm rate. At the same time, the detection benchmark is static and fixed, and is not dynamically updated in combination with the actual operating status of the devices, making it difficult to adapt to changes in device operating modes. Second, anomaly detection is limited to a single device and a single dimension, without considering the correlation between devices and the anomaly correlation over time. It cannot accurately identify complex threats such as coordinated attacks and concentrated burst attacks. Moreover, the threat level assessment dimension is singular, judging risks based on only a single anomaly feature, which is difficult to comprehensively reflect the impact of threats on IoT networks, resulting in a lack of targeted security protection responses.

[0004] To address the aforementioned technical shortcomings, a solution is proposed. Summary of the Invention

[0005] The purpose of this invention is to provide an intelligent IoT security detection system based on big data to address the aforementioned technical deficiencies. This invention solves the problems of non-standardized data processing, static detection benchmarks, insufficient anomaly correlation analysis, and single threat assessment dimensions in existing IoT security detection by standardizing data processing, dynamicizing detection benchmarks, comprehensiveizing anomaly analysis, and refining threat assessment. It achieves accurate detection, comprehensive analysis, and tiered response to IoT security threats.

[0006] The objective of this invention can be achieved through the following technical solution: a big data-based IoT security intelligent detection system, including a security intelligent detection center, a network sensing module, a behavior profile management module, a multi-dimensional anomaly monitoring module, a multi-dimensional threat assessment module, and a detection visualization module. The multi-dimensional threat assessment module is internally equipped with a device association unit and a time association unit.

[0007] The network sensing module is used to build a multi-source data acquisition network and collect multi-source heterogeneous security data from IoT devices. It also processes the multi-source heterogeneous security data and generates a standardized data set, which is then sent to the security intelligent detection center for storage.

[0008] The behavior profile management module is used to construct and update dynamic behavior profiles of equipment from standardized datasets, and obtain autonomously updated dynamic behavior profiles of equipment.

[0009] The multidimensional anomaly monitoring module is used to process the collected operational data of IoT devices to obtain a real-time standardized data stream, and to perform anomaly dimension detection and analysis in combination with the dynamic behavior profile of the devices to obtain a global anomaly feature database.

[0010] The multi-dimensional threat assessment module is used to perform global correlation analysis and multi-dimensional threat assessment analysis on the global anomaly feature database, and output a standardized threat level assessment report;

[0011] The device association unit is used to perform inter-device association analysis on the global anomaly feature database and output a collaborative anomaly event report. The time association unit is used to perform time association analysis on the global anomaly feature database and output a time association analysis report.

[0012] Preferably, the analysis process of the behavior profile management module is as follows:

[0013] SS1: Based on the analysis of standard data of the communication layer, standard data of the resource layer, and standard data of the operation layer in the standardized data set, a baseline for communication behavior, a baseline for resource consumption, and a baseline for operation sequence are constructed within a preset normal cycle.

[0014] SS2: Construct a dynamic behavior profile of the device based on communication behavior baseline, resource consumption baseline, and operation sequence baseline;

[0015] SS3: Set the profile update cycle, integrate the latest standardized data set in real time, and incrementally update the communication behavior baseline, resource consumption baseline, and operation sequence baseline to obtain an autonomously updated dynamic behavior profile of the device.

[0016] Preferably, the analysis process of the multidimensional anomaly monitoring module is as follows:

[0017] T1: Real-time acquisition of operational data from IoT devices, format conversion and unit unification of the real-time data to obtain a real-time standardized data stream;

[0018] T2: Based on the dynamic behavior profile of the device, the real-time standardized data stream is analyzed for anomalies in three core dimensions: communication, resources and operation. The comparison results of the real-time standardized data stream in the three core dimensions of communication, resources and operation are obtained. The comparison results include communication dimension anomalies, resource dimension anomalies, operation dimension anomalies and cross-dimensional correlation detection.

[0019] Preferably, it also includes T3: extracting features from the detected abnormal data based on the comparison results;

[0020] T4: The extracted abnormal features are digitally encoded and arranged according to the preset feature dimension order to generate a fixed-length abnormal feature vector;

[0021] T5: Aggregates the abnormal feature vectors generated by all IoT devices to build a global abnormal feature database.

[0022] Preferably, the analysis process of the multi-dimensional threat assessment module is as follows:

[0023] The global correlation analysis results are obtained based on the global correlation analysis, which include collaborative abnormal event reports and time correlation analysis reports.

[0024] A multi-dimensional threat level assessment system is constructed based on the results of global correlation analysis. The quantitative values ​​of indicators in each dimension of the multi-dimensional threat level assessment system are retrieved. Based on the quantitative values ​​of each indicator and the corresponding preset weight coefficients, the weighted summation algorithm is used to calculate the comprehensive threat assessment score. The calculation formula is SW=Σ(Wg×Vg), where Wg is the quantitative value of the g-th indicator and Vg is the preset weight coefficient corresponding to the g-th indicator.

[0025] The maximum value SWmax and minimum value SWmin of the preset threat assessment comprehensive score are retrieved. The threat assessment comprehensive score SW is then processed to obtain low risk, medium risk and high risk results. Low risk, medium risk and high risk are collectively referred to as threat risk level.

[0026] A standardized threat level assessment report is generated based on the threat risk level, the list of involved devices, the conclusions of time correlation analysis, and the original values ​​of indicators in each dimension of the multi-dimensional threat level assessment system.

[0027] Preferably, the analysis process of the device association unit is as follows:

[0028] Preset a fixed time window, assign global abnormal events to the corresponding window according to timestamp, extract all involved IoT device IDs from the global abnormal feature database, and construct an IoT device set D = {d1, d2, ..., dm}, where m is the total number of devices;

[0029] Using IoT device IDs as rows and columns, construct an IoT device anomaly correlation matrix M. The matrix element M[i][j] represents the correlation degree between device i and device j when anomalies occur within the same time window. Select device pairs with correlation degree M[i][j] ≥ a preset threshold and mark them as high correlation device groups.

[0030] For highly correlated device groups, extract the intersection features of their abnormal feature vectors. If the number of intersection features is greater than or equal to a preset threshold, and the number of times the device group experiences anomalies simultaneously within the same time window is greater than or equal to a preset number, it is determined to be a multi-device collaborative anomaly.

[0031] Record the list of devices with collaborative anomalies, common anomaly characteristics, and occurrence time windows to generate a collaborative anomaly event report;

[0032] Preferably, the analysis process of the time correlation unit is as follows:

[0033] Count the number of abnormal events and the number of devices involved in each time window to generate a time-series distribution sequence S = [s1, s2, ..., sn], where sn is the number of abnormal events in the nth time window, and calculate the statistical characteristics of the time-series distribution sequence;

[0034] If the number of abnormal events sn within a certain time window is greater than or equal to the set outbreak threshold T, and the number of devices involved in the window is greater than or equal to the preset number of devices, it is determined to be a concentrated outbreak anomaly.

[0035] Further analysis of the common characteristics of explosive anomalies: Calculate the average similarity of all abnormal feature vectors within the window. If the similarity is greater than or equal to the preset similarity, it is determined to be a single type of concentrated outbreak caused by the same type of threat. If the similarity is less than the preset similarity, it is determined to be a concurrent outbreak of multiple types of threats.

[0036] Period detection is performed on the time-series distributed sequence S. The time-domain signal of the time-series distributed sequence S is converted into a frequency-domain signal, and the frequency corresponding to the peak value in the frequency domain is extracted and converted into a period.

[0037] Calculate the autocorrelation function of the time-series distributed sequence S. If the autocorrelation function has a peak value ≥ a preset peak value at lag t, and t is a fixed time interval, then t is the period of the anomalous event.

[0038] If, within three consecutive cycles, the fluctuation range of the number of abnormal events within the time window corresponding to each cycle is less than or equal to the preset fluctuation range, and the overlap of abnormal feature labels is greater than or equal to the preset threshold, it is determined to be a periodic anomaly, and the cycle duration and abnormal feature pattern are recorded.

[0039] A time correlation analysis report is constructed based on single-type concentrated outbreaks, concurrent outbreaks of multiple types of threats, and periodic anomalies.

[0040] The beneficial effects of this invention are as follows:

[0041] (1) This invention integrates heterogeneous data from all network devices through a multi-source data acquisition network, and generates a standardized data set after cleaning and standardization, laying a solid foundation for subsequent detection and analysis, reducing the risk of false alarms caused by data quality, and constructing a multi-dimensional baseline based on normal equipment operation data, and realizing real-time optimization of dynamic behavior profile through incremental update mechanism, ensuring that the detection benchmark is synchronized with the equipment operation status, and improving the adaptability to changes in equipment operation mode;

[0042] (2) This invention identifies anomalies from three core dimensions: communication, resources and operation. It combines inter-device correlation analysis and time correlation analysis to accurately identify complex threats such as collaborative anomalies, concentrated burst anomalies, and periodic anomalies. It breaks through the limitations of single device and single-dimensional detection and constructs a multi-dimensional threat level assessment system. It comprehensively considers factors such as anomaly type, device impact, time distribution, and common characteristics. It calculates a comprehensive score through a weighted summation algorithm to achieve scientific quantification of threat level, provide accurate basis for security protection response, and improve the targeting and effectiveness of security protection of IoT networks. Attached Figure Description

[0043] The invention will now be further described with reference to the accompanying drawings;

[0044] Figure 1 This is a flowchart of the system of the present invention;

[0045] Figure 2 This is a reference diagram for the global anomaly feature library analysis of this invention;

[0046] Figure 3 This is a reference image for the dynamic behavior image analysis of the device of the present invention. Detailed Implementation

[0047] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0048] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of the invention. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments;

[0049] Example 1:

[0050] Please see Figures 1 to 3 As shown, the present invention is an IoT security intelligent detection system based on big data, including a security intelligent detection center, a network sensing module, a behavior profile management module, a multi-dimensional anomaly monitoring module, a multi-dimensional threat assessment module, and a detection visualization module. The multi-dimensional threat assessment module is internally equipped with a device association unit and a time association unit.

[0051] The security intelligent detection center has a two-way communication connection with the network perception module and the behavior profile management module. The security intelligent detection center has a one-way communication connection with the multi-dimensional anomaly monitoring module. The security intelligent detection center and the multi-dimensional anomaly monitoring module have a one-way communication connection with the multi-dimensional threat assessment module. The multi-dimensional threat assessment module has a one-way communication connection with the detection visualization module.

[0052] The network sensing module is used to build a multi-source data acquisition network and collect multi-source heterogeneous security data from IoT devices. It also processes the multi-source heterogeneous security data and generates a standardized data set, which is then sent to the security intelligent detection center for storage.

[0053] The implementation steps of the network awareness module include:

[0054] S1: Construct a multi-source data acquisition network through IoT gateways, edge nodes and device management platforms to collect multi-source heterogeneous security data from all IoT devices connected to the IoT network. The multi-source heterogeneous security data includes communication layer data (such as communication address and port number), resource layer data (such as memory occupancy rate and storage utilization rate), and operation layer data (such as device instruction execution records and configuration parameter modification records).

[0055] S2: Clean and standardize the collected multi-source heterogeneous security data to generate a standardized dataset;

[0056] The behavior profile management module is used to construct and update dynamic behavior profiles of devices from standardized datasets, specifically including:

[0057] SS1: Based on the analysis of standard data of the communication layer, standard data of the resource layer, and standard data of the operation layer in the standardized dataset, a baseline of communication behavior, a baseline of resource consumption, and a baseline of operation sequence are constructed within a preset normal period (e.g., 7 days).

[0058] SS2: Construct a dynamic behavior profile of the device based on communication behavior baseline, resource consumption baseline, and operation sequence baseline;

[0059] SS3: Set the profile update cycle (e.g., 24 hours), integrate the latest standardized data set in real time, and incrementally update the communication behavior baseline, resource consumption baseline, and operation sequence baseline to obtain an autonomously updated dynamic behavior profile of the device, ensuring that the behavior profile is consistent with the actual operating status of the IoT device;

[0060] The device's dynamic behavior profile is sent to the intelligent security detection center for storage;

[0061] For example, standardized data on the communication layer, resource layer, and operation layer of IoT devices are collected from a standardized dataset within a preset normal period (e.g., 7 days). Based on the standardized data on the communication layer, a preset time series analysis method (e.g., ARIMA model) is used to fit the communication time series characteristics of IoT devices, determine the normal fluctuation range of communication behavior of IoT devices in different time periods (e.g., weekdays / rest days, peak hours / off-peak hours), and form a communication behavior baseline.

[0062] Based on standardized data at the resource layer, a pre-defined clustering algorithm (such as K-Means) is used to classify the resource consumption levels of devices, determine the normal threshold range of resource consumption in different scenarios (such as industrial control equipment / smart home equipment), and form a resource consumption baseline.

[0063] The standardized data of the operation layer of IoT devices is serialized, and operations such as instruction execution and parameter modification are arranged into operation sequences in chronological order. The operation sequences are converted into vector representations, and the semantic features of normal operation sequences are learned through a preset deep learning model (such as LSTM) to form an operation sequence baseline.

[0064] Example 2:

[0065] The multi-dimensional anomaly monitoring module processes the collected operational data from IoT devices to obtain a real-time standardized data stream. It then combines this data with dynamic behavior profiles of the devices to perform anomaly dimension detection and analysis, resulting in a global anomaly feature database, which specifically includes:

[0066] T1: Real-time acquisition of operational data from IoT devices, format conversion and unit unification of the real-time data to obtain a real-time standardized data stream;

[0067] T2: Based on the dynamic behavior profile of the device, the real-time standardized data stream is analyzed for anomalies in three core dimensions: communication, resources, and operation. The real-time communication data in the real-time standardized data stream is compared with the communication behavior baseline, the real-time resource consumption data is compared with the resource consumption baseline, and the real-time operation sequence is compared with the operation sequence baseline. The comparison results of the real-time standardized data stream in the three core dimensions of communication, resources, and operation are obtained. The comparison results include communication dimension anomalies, resource dimension anomalies, operation dimension anomalies, and cross-dimensional correlation detection (anomalies are detected in two or more dimensions).

[0068] For example: Communication dimension anomaly detection: compare real-time communication data with the communication behavior baseline. If the communication frequency or data transmission volume exceeds the normal fluctuation range, or if there are unfamiliar communication addresses / ports connected or unauthorized protocol types used, it is determined to be a communication dimension anomaly.

[0069] Resource dimension anomaly detection: Real-time resource consumption data is compared with the resource consumption baseline. If indicators such as CPU utilization and memory usage continuously (e.g., for 5 consecutive minutes) exceed the normal threshold range, or if the resource consumption rate suddenly changes (e.g., the battery power drops by 50% in 1 hour), it is determined to be a resource dimension anomaly.

[0070] Operational dimension anomaly detection: The real-time operation sequence is compared with the operation sequence baseline. If a low-frequency operation sequence, an operation that violates the operation association rules, or an unauthorized operation (such as a non-administrator account modifying core configuration) is found, it is determined to be an operational dimension anomaly.

[0071] T3: Based on the comparison results, feature extraction is performed on the detected abnormal data. The extracted abnormal features include basic abnormal features (such as abnormal occurrence time and abnormal device ID), communication abnormal features (such as abnormal communication protocol type and abnormal data transmission volume multiple), resource abnormal features (such as abnormal peak value of resource indicators and abnormal duration), and operation abnormal features (such as abnormal operation type and operation permission level).

[0072] T4: The extracted abnormal features are digitally encoded and arranged in a preset feature dimension order to generate a fixed-length abnormal feature vector. Numerical features directly use standardized values, while categorical features use one-hot encoded or label-encoded values.

[0073] T5: Aggregates the abnormal feature vectors generated by all IoT devices to build a global abnormal feature database;

[0074] The multi-dimensional threat assessment module is used to perform global correlation analysis and multi-dimensional threat assessment analysis on the global anomaly feature database, and outputs a standardized threat level assessment report, specifically including:

[0075] Based on the global anomaly feature database, a global correlation analysis is performed on the anomaly feature vectors in the global anomaly feature database. The global correlation analysis includes inter-device correlation analysis and time correlation analysis.

[0076] The global correlation analysis results are obtained based on the global correlation analysis, which include collaborative abnormal event reports and time correlation analysis reports.

[0077] A multi-dimensional threat level assessment system is constructed based on the results of global correlation analysis. The multi-dimensional threat level assessment system includes anomaly type dimension, equipment impact dimension, time distribution dimension, and common feature dimension.

[0078] Among them, the anomaly type dimension includes single device anomaly, multi-device collaborative anomaly, single type of concentrated burst anomaly, etc.

[0079] The equipment impact metrics include the number of devices involved in the anomaly and the number of highly correlated device groups.

[0080] The time distribution dimension indicators include the duration of the anomaly, the intensity of the concentrated outbreak (the multiple by which the number of anomalies exceeds the threshold), and the number of duration cycles.

[0081] Common feature dimension indicators include the similarity of abnormal feature vectors and the number of common abnormal features;

[0082] The quantitative values ​​of indicators in each dimension of the multi-dimensional threat level assessment system are retrieved. Based on the quantitative values ​​of each indicator and the corresponding preset weight coefficients, the weighted summation algorithm is used to calculate the comprehensive threat assessment score. The calculation formula is SW=Σ(Wg×Vg), where Wg is the quantitative value of the g-th indicator, Vg is the preset weight coefficient corresponding to the g-th indicator, and g is a natural number greater than zero.

[0083] Retrieve the maximum value SWmax and minimum value SWmin of the preset threat assessment comprehensive score, and perform discrimination processing on the threat assessment comprehensive score SW. If the threat assessment comprehensive score SW≤SWmin, it is judged as low risk; if SWmin<threat assessment comprehensive score SW≤SWmax, it is judged as medium risk; if the threat assessment comprehensive score SW>SWmax, it is judged as high risk.

[0084] Low-risk, medium-risk, and high-risk are collectively referred to as threat risk levels;

[0085] A standardized threat level assessment report is generated based on information such as threat risk level, list of involved devices, time correlation analysis conclusions (concentrated outbreaks (single type of concentrated outbreaks or multiple types of concurrent outbreaks) / periodic anomalies, etc.) and raw values ​​of indicators in each dimension of the multi-dimensional threat level assessment system.

[0086] The detection visualization module is used to respond to threat level assessment reports and display them immediately, so as to intuitively understand the current threat status of IoT devices, provide accurate basis for security protection response, and improve the targeting and effectiveness of IoT network security protection.

[0087] Example 3:

[0088] The device association unit is used to perform inter-device correlation analysis on the global anomaly feature database and output a collaborative anomaly event report, specifically including:

[0089] Set a fixed time window and assign global exception events to the corresponding window according to the timestamp;

[0090] Extract all involved IoT device IDs from the global anomaly feature database and construct an IoT device set D = {d1, d2, ..., dm}, where m is the total number of devices and m is a natural number greater than zero;

[0091] Using IoT device IDs as rows and columns, construct an IoT device anomaly correlation matrix M. The matrix element M[i][j] represents the correlation degree between device i and device j when anomalies occur within the same time window. The calculation method is: M[i][j] = (number of events where device i and device j both have anomalies) / (total number of times device i has anomalies + total number of times device j has anomalies - number of events where anomalies occur simultaneously), where i and j are both natural numbers greater than zero.

[0092] Filter out device pairs with a correlation degree M[i][j] ≥ a preset threshold and mark them as highly correlated device groups;

[0093] For highly correlated device groups, extract the intersection features of their abnormal feature vectors (such as common abnormal feature labels, such as "communication with the same unfamiliar IP" or "abnormal with the same protocol").

[0094] If the number of intersection features is greater than or equal to a preset threshold (e.g., 2), and the number of times the device group experiences anomalies simultaneously within the same time window (e.g., 5 minutes) is greater than or equal to a preset number, it is determined to be a multi-device collaborative anomaly.

[0095] Record the list of devices with collaborative anomalies, common anomaly characteristics, and occurrence time windows to generate a collaborative anomaly event report;

[0096] Inter-device correlation analysis significantly improves the credibility of the "attack correlation" of abnormal events through triple verification of "high correlation of multiple devices + common abnormal features + multiple synchronization anomalies", eliminates isolated anomalies caused by non-attack factors, and reduces the overall false alarm rate of detection.

[0097] The time correlation unit is used to perform time correlation analysis on the global anomaly feature database and output a time correlation analysis report, which specifically includes:

[0098] Count the number of abnormal events and the number of devices involved in each time window to generate a time-series distribution sequence S = [s1, s2, ..., sn], where sn is the number of abnormal events in the nth time window. Calculate the statistical characteristics (such as mean and variance) of the time-series distribution sequence, where n is a natural number greater than zero.

[0099] If the number of abnormal events sn within a certain time window is greater than or equal to the set outbreak threshold T, and the number of devices involved in the window is greater than or equal to the preset number of devices, it is determined to be a concentrated outbreak anomaly.

[0100] Further analysis of the common characteristics of explosive anomalies: Calculate the average similarity of all abnormal feature vectors within the window (using cosine similarity). If the similarity is greater than or equal to the preset similarity, it is determined to be a single type of concentrated outbreak caused by the same type of threat (such as a DDoS attack). If the similarity is less than the preset similarity, it is determined to be a concurrent outbreak of multiple types of threats.

[0101] Period detection is performed on the time-series distributed sequence S. The time-domain signal of the time-series distributed sequence S is converted into a frequency-domain signal, and the frequency corresponding to the peak value in the frequency domain is extracted and converted into a period (period = 1 / frequency).

[0102] Calculate the autocorrelation function of the time-series distribution sequence S. If the autocorrelation function shows a significant peak at lag t (e.g., peak value ≥ preset peak value), and t (t > 0) is a fixed time interval (e.g., 1 hour, 24 hours), then t is the period of the anomalous event.

[0103] If, within three consecutive cycles, the fluctuation range of the number of abnormal events within the time window corresponding to each cycle is less than or equal to the preset fluctuation range, and the overlap of abnormal feature labels is greater than or equal to the preset threshold, it is determined to be a periodic anomaly, and the cycle duration and abnormal feature pattern are recorded.

[0104] A time correlation analysis report is constructed based on information such as concentrated outbreaks of a single type, concurrent outbreaks of multiple types of threats, and periodic anomalies;

[0105] In summary, this invention integrates heterogeneous data from all network devices through a multi-source data acquisition network. After cleaning and standardization, a standardized data set is generated, laying a solid foundation for subsequent detection and analysis and reducing the risk of false alarms due to data quality issues. Simultaneously, a multi-dimensional baseline is constructed based on normal device operation data, and a dynamic behavior profile is optimized in real-time through an incremental update mechanism, ensuring that the detection benchmark is synchronized with the device's operating status and improving adaptability to changes in device operating modes. Anomaly detection is performed from three core dimensions: communication, resources, and operation. Combined with inter-device correlation analysis and time correlation analysis, complex threats such as collaborative anomalies, concentrated burst anomalies, and periodic anomalies are accurately identified, overcoming the limitations of single-device, single-dimensional detection. Furthermore, a multi-dimensional threat level assessment system is constructed, comprehensively considering factors such as anomaly type, device impact, time distribution, and common characteristics. A weighted summation algorithm is used to calculate a comprehensive score, achieving scientific quantification of threat levels and providing accurate basis for security protection responses, thereby improving the targeting and effectiveness of IoT network security protection.

[0106] The threshold is set for comparative analysis of results to determine whether they are good or bad. The value of the threshold is determined by a combination of large-scale model analysis of sample data and human experience. It can also be adjusted appropriately based on seasonal or common-sense influencing factors.

[0107] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A big data-based IoT security intelligent detection system, characterized in that, It includes a security intelligent detection center, a network perception module, a behavior profile management module, a multi-dimensional anomaly monitoring module, a multi-dimensional threat assessment module, and a detection visualization module. The multi-dimensional threat assessment module has a device association unit and a time association unit. The network sensing module is used to build a multi-source data acquisition network and collect multi-source heterogeneous security data from IoT devices. It also processes the multi-source heterogeneous security data and generates a standardized data set, which is then sent to the security intelligent detection center for storage. The behavior profile management module is used to construct and update dynamic behavior profiles of equipment from standardized datasets, and obtain autonomously updated dynamic behavior profiles of equipment. The multidimensional anomaly monitoring module is used to process the collected operational data of IoT devices to obtain a real-time standardized data stream, and to perform anomaly dimension detection and analysis in combination with the dynamic behavior profile of the devices to obtain a global anomaly feature database. The multi-dimensional threat assessment module is used to perform global correlation analysis and multi-dimensional threat assessment analysis on the global anomaly feature database, and output a standardized threat level assessment report; The device association unit is used to perform inter-device association analysis on the global anomaly feature database and output a collaborative anomaly event report; the time association unit is used to perform time association analysis on the global anomaly feature database and output a time association analysis report. The analysis process of the behavior profile management module is as follows: SS1: Based on the analysis of standard data of the communication layer, standard data of the resource layer, and standard data of the operation layer in the standardized data set, a baseline for communication behavior, a baseline for resource consumption, and a baseline for operation sequence are constructed within a preset normal cycle. SS2: Construct a dynamic behavior profile of the device based on communication behavior baseline, resource consumption baseline, and operation sequence baseline; SS3: Set the profile update cycle, integrate the latest standardized data set in real time, and incrementally update the communication behavior baseline, resource consumption baseline, and operation sequence baseline to obtain an autonomously updated dynamic behavior profile of the device; The analysis process of the multidimensional anomaly monitoring module is as follows: T1: Real-time acquisition of operational data from IoT devices, format conversion and unit unification of the real-time data to obtain a real-time standardized data stream; T2: Based on the dynamic behavior profile of the device, the real-time standardized data stream is analyzed for anomalies in three core dimensions: communication, resources and operation. The comparison results of the real-time standardized data stream in the three core dimensions of communication, resources and operation are obtained. The comparison results include communication dimension anomalies, resource dimension anomalies, operation dimension anomalies and cross-dimensional correlation detection. It also includes T3: based on the comparison results, feature extraction is performed on the detected abnormal data; T4: The extracted abnormal features are digitally encoded and arranged according to the preset feature dimension order to generate a fixed-length abnormal feature vector; T5: Aggregates the abnormal feature vectors generated by all IoT devices to build a global abnormal feature database; The analysis process of the device association unit is as follows: Preset a fixed time window, assign global abnormal events to the corresponding window according to timestamp, extract all involved IoT device IDs from the global abnormal feature database, and construct an IoT device set D = {d1, d2, ..., dm}, where m is the total number of devices; Using IoT device IDs as rows and columns, construct an IoT device anomaly correlation matrix M. The matrix element M[i][j] represents the correlation degree between device i and device j when anomalies occur within the same time window. Select device pairs with correlation degree M[i][j] ≥ a preset threshold and mark them as high correlation device groups. For highly correlated device groups, extract the intersection features of their abnormal feature vectors. If the number of intersection features is greater than or equal to a preset threshold, and the number of times the device group experiences anomalies simultaneously within the same time window is greater than or equal to a preset number, it is determined to be a multi-device collaborative anomaly. Record the list of devices with collaborative anomalies, common anomaly characteristics, and occurrence time windows to generate a collaborative anomaly event report.

2. The IoT security intelligent detection system based on big data according to claim 1, characterized in that, The analysis process of the multi-dimensional threat assessment module is as follows: The global correlation analysis results are obtained based on the global correlation analysis, which include collaborative abnormal event reports and time correlation analysis reports. A multi-dimensional threat level assessment system is constructed based on the results of global correlation analysis. The quantitative values ​​of indicators in each dimension of the multi-dimensional threat level assessment system are retrieved. Based on the quantitative values ​​of each indicator and the corresponding preset weight coefficients, the weighted summation algorithm is used to calculate the comprehensive threat assessment score. The calculation formula is SW=Σ(Wg×Vg), where Wg is the quantitative value of the g-th indicator and Vg is the preset weight coefficient corresponding to the g-th indicator. The maximum value SWmax and minimum value SWmin of the preset threat assessment comprehensive score are retrieved. The threat assessment comprehensive score SW is then processed to obtain low risk, medium risk and high risk results. Low risk, medium risk and high risk are collectively referred to as threat risk level. A standardized threat level assessment report is generated based on the threat risk level, the list of involved devices, the conclusions of time correlation analysis, and the original values ​​of indicators in each dimension of the multi-dimensional threat level assessment system.

3. The IoT security intelligent detection system based on big data according to claim 1, characterized in that, The analysis process of the time-related unit is as follows: Count the number of abnormal events and the number of devices involved in each time window, and generate a time-series distribution sequence S = [s1, s2, ..., sn], where sn is the number of abnormal events in the nth time window, and calculate the statistical characteristics of the time-series distribution sequence; If the number of abnormal events sn within a certain time window is greater than or equal to the set outbreak threshold T, and the number of devices involved in the window is greater than or equal to the preset number of devices, it is determined to be a concentrated outbreak anomaly. Further analysis of the common characteristics of explosive anomalies: Calculate the average similarity of all abnormal feature vectors within the window. If the similarity is greater than or equal to the preset similarity, it is determined to be a single type of concentrated outbreak caused by the same type of threat. If the similarity is less than the preset similarity, it is determined to be a concurrent outbreak of multiple types of threats. Period detection is performed on the time-series distributed sequence S. The time-domain signal of the time-series distributed sequence S is converted into a frequency-domain signal, and the frequency corresponding to the peak value in the frequency domain is extracted and converted into a period. Calculate the autocorrelation function of the time-series distributed sequence S. If the autocorrelation function has a peak value ≥ a preset peak value at lag t, and t is a fixed time interval, then t is the period of the anomalous event. If, within three consecutive periods, the fluctuation range of the number of abnormal events within the time window corresponding to each period is less than or equal to the preset fluctuation range, and the overlap of abnormal feature labels is greater than or equal to the preset threshold, it is determined to be a periodic abnormality, and the period duration and abnormal feature pattern are recorded. A time correlation analysis report is constructed based on single-type concentrated outbreaks, concurrent outbreaks of multiple types of threats, and periodic anomalies.

Images