A method and system for monitoring and protecting security of an Internet of Things terminal

Abstract

A method for monitoring and protecting the security of an Internet of Things terminal is provided, which identifies the type of the Internet of Things terminal device; performs trustworthy verification on the Internet of Things terminal device; constructs a behavior profile of the Internet of Things terminal device behavior; creates a security boundary based on a policy, divides permissions, and performs authorization management on the designated resources of the Internet of Things terminal. Feature mapping is used to reduce the dimension of the feature data of the Internet of Things terminal device, and these data are displayed in a low-dimensional space through geometric relationships.

Description

Technical Field

[0001] The present invention belongs to the field of Internet of Things security, and is an Internet of Things terminal security monitoring and protection method and system. Background Art

[0002] With the development of digitalization and industrial digitalization, the number of massive heterogeneous terminals is increasing day by day, increasing the risk of secure access. Since the forms of IoT terminals vary greatly and their functions vary greatly, there are both general-purpose intelligent terminals and simple function terminals, so they need to be handled differently.

[0003] For general-purpose smart terminals, they generally have high hardware configuration, large storage space, operating systems, and support for multiple network access methods. To build an end-to-end secure and trusted Internet of Things system, in addition to implementing security protection measures on the Internet of Things terminals themselves, it is also necessary to include communication networks, servers, etc., and carry out trusted transformation and security enhancement from multiple angles such as self-protection and security management to comprehensively improve the overall security of the system. Summary of the invention

[0004] One of the embodiments of the present invention discloses a method for security monitoring and protection of an IoT terminal in a cloud-edge collaboration scenario, comprising the following steps:

[0005] 1) IoT terminal device identification method based on stream processing and classification algorithm;

[0006] 2) No difference in trusted verification mapping between heterogeneous resources;

[0007] 3) Behavioral profiling for perception networks;

[0008] 4) Software-defined boundaries for embedded environments. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] The above and other objects, features and advantages of the exemplary embodiments of the present invention will become readily understood by reading the detailed description below with reference to the accompanying drawings. In the accompanying drawings, several embodiments of the present invention are shown in an exemplary and non-limiting manner, in which:

[0010] Figure 1 A flow chart of a stream processing model training method based on a classification algorithm according to one embodiment of the present invention.

[0011] Figure 2 Schematic diagram of the data processing mechanism of the Internet of Things terminal security monitoring and protection system according to one embodiment of the present invention.

[0012] Figure 3 A flow chart of traffic data processing of an Internet of Things terminal security monitoring and protection system according to one embodiment of the present invention.

[0013] Figure 4Operation flow chart of the IoT terminal security monitoring and protection system according to one embodiment of the present invention.

[0014] Figure 5 Schematic diagram of the deployment of the IoT terminal security detection and protection system under the cloud-edge collaborative architecture according to one embodiment of the present invention. DETAILED DESCRIPTION

[0015] The amount of data in IoT terminals is huge and involves production control, with a lot of sensitive information. Currently, there is no strong secure and reliable link to support the business. In order to better monitor and ensure the reliable operation of IoT terminals, while meeting the requirements of implementing comprehensive cloud-edge collaborative IoT security protection specifications, the security and trustworthiness of IoT devices are carried out to comprehensively improve the security management and protection level of IoT. The IoT terminal security system of the present invention, by creating a high-confidence system that integrates a set of trusted technologies with the Internet of Things, establishes an adaptive generation and distribution mechanism of strategies and a dynamic deployment mechanism of security services at the system level, and essentially solves the security problems caused by the characteristics of the Internet of Things such as limited device resources, massive, heterogeneous, dispersed, unattended, complex application scenarios, and large differences in security requirements.

[0016] According to one or more embodiments, a method for monitoring and protecting IoT terminal security in a cloud-edge collaboration scenario includes the following steps:

[0017] (1) An IoT terminal device identification method based on flow processing and classification algorithms, which analyzes and identifies traffic and discovers and identifies the device through the corresponding MAC address and device characteristics;

[0018] (2) Based on the heterogeneous resource indifferent trusted verification mapping technology, all objects with active or passive identification are identified and authenticated, and their physical and information attributes are abstracted and analyzed;

[0019] (3) Based on the behavioral profiling technology for perception networks, the business, workflow and device behavior are characterized;

[0020] (4) Software-defined boundary technology based on embedded environments creates security boundaries based on policies and defines permissions so that only authorized users can access specified resources;

[0021] (5) Based on the SOM neural network technology, feature mapping is used to achieve data dimensionality reduction, and the data are presented in a low-dimensional space through clear geometric relationships.

[0022] Furthermore, the information of the device is discovered and identified through traffic analysis algorithms of multiple protocols, and the device type is distinguished by the acquired device traffic and the device IP range.

[0023] Through the device middleware, all objects with active or passive identification are identified and authenticated, and their physical and information properties are abstracted and analyzed.

[0024] The network behavior of the terminal is characterized in different dimensions. Qualitative analysis includes working environment, workflow, network communication, etc. Quantitative analysis is the statistical analysis and calculation of the characteristics. Using big data technology, the terminal information is labeled and structured to abstract the overall picture of the terminal.

[0025] Based on the concept of zero trust, user permissions are differentiated, and only authorized users can access protected resources through authorized devices. Security boundaries are created based on policies to isolate services from insecure networks.

[0026] The feature mapping of SOM neural network technology is used to achieve data dimensionality reduction, and the data are displayed in low-dimensional space through clear geometric relationships, which is conducive to the visualization of high-dimensional data.

[0027] According to one or more embodiments, in order to overcome the security defects existing in the cloud-edge collaborative architecture, a method for monitoring and protecting IoT terminals in a cloud-edge collaborative scenario provides accurate discovery and identification of massive IoT terminal devices through the collection of traffic information and analysis of device characteristics, and divides boundaries based on behavior and visualizes them, thereby improving the security and maintainability of IoT terminal devices. Therefore, a method for monitoring and protecting IoT terminals in a cloud-edge collaborative scenario uses the following technologies:

[0028] (1) IoT terminal device identification method based on stream processing and classification algorithm;

[0029] (2) Heterogeneous resource indifferent trusted verification mapping technology.

[0030] (3) Behavioral profiling technology for perception networks;

[0031] (4) Software-defined boundary technology for embedded environments;

[0032] (5)SOM neural network technology.

[0033] This method utilizes the collection and analysis of traffic information to optimize the recognition mode of IoT terminal devices, greatly improving the accuracy of IoT terminal device recognition and the accuracy of detecting abnormal behaviors in business scenarios.

[0034] Furthermore, the specific contents of the IoT terminal device identification method based on stream processing and classification algorithm in step (1) are as follows.

[0035] IoT terminal device identification method based on stream processing:

[0036] Divide data according to the MAC addresses of different terminals:

[0037] ①Use the MAC address as the unique identifier of the terminal;

[0038] ② Organize the data related to the MAC address and create a fingerprint table;

[0039] The data in the table serves as the fingerprint of the terminal.

[0040] When a new log enters the terminal fingerprint table:

[0041] ① If the relevant MAC address in the log already exists in the table, modify the terminal fingerprint feature corresponding to the MAC address;

[0042] ② If a MAC address related to the log does not exist in the table, a new terminal fingerprint is generated using the data related to the MAC address in the log.

[0043] IoT terminal type identification algorithm based on classification algorithm

[0044] An algorithm for identifying device types in the Internet of Things was developed through the Internet of Things terminal security monitoring and protection software, which mainly consists of three parts: fingerprint generation, model training and type identification through model, and online learning.

[0045] 1) Device fingerprint generation

[0046] The terminal's fingerprint is generated by analyzing and counting the terminal's behavioral characteristics within a certain period of time. Fingerprints are divided into two categories based on their sources: traffic fingerprints and scanning fingerprints.

[0047] ① Traffic fingerprint is to extract the terminal’s fingerprint from the traffic log generated by mirroring and passing through the switch using bypass analysis.

[0048] ② Scanning fingerprints means actively scanning using the probe server according to the user-specified IP range. According to different transmission protocols, different protocol instructions are actively sent to the terminals in the network to obtain detailed information of the terminals in the network and generate traffic logs to extract the fingerprints of the terminals.

[0049] 2) Model training

[0050] First, we use feature engineering methods to screen and process them. Feature processing includes data cleaning, data normalization, and feature derivation and extraction. Feature screening uses filtering, packaging, and embedding methods. By comparing the model's requirements for feature distribution, model robustness, model resource consumption, model updatability, and model out-of-sample accuracy, we choose XGBoost based on Boosting and tree models. The model training process is as follows: Figure 1As shown in the figure, the device type is determined based on the match with the model.

[0051] 4) Online learning

[0052] In order to better adapt to the actual situation in different real scenarios and improve the adaptability of the algorithm, this embodiment adds the feature of online learning in addition to the basic model prediction function for scenarios with user interaction. When the terminal type determined by the model does not match the user's expectations, the user simply updates the terminal type on the interactive page, thereby correcting the terminal type on the one hand and updating the model on the other. The model update logic is as follows:

[0053] Determine whether the user has updated the terminal type;

[0054] If the user updates the terminal type, record the fingerprint of the device in different time periods;

[0055] When fingerprint data accumulates to a certain extent, the model is further trained based on the original model, and the weight of the latest fingerprint data is increased.

[0056] Furthermore, the heterogeneous resources in step (2) are mapped in a trustworthy manner, and the specific contents are as follows.

[0057] Through device middleware, all objects with active or passive identification are identified and authenticated, and their physical and information properties are abstracted and analyzed to achieve unified, reliable, objective and comprehensive scientific modeling, complete the mapping from the access object's own attributes to the Internet of Things network space information, build a unified trusted access capability, and realize heterogeneous ubiquitous and indifferent access.

[0058] Based on the application environment, usage habits and resource characteristics of the access object, the protection strategy is dynamically generated according to the security protection strength required by the object and the security threats it faces. The distributed security management center deployment method is adopted to implement real-time issuance and update of security strategies based on network resource configuration and real-time network threats.

[0059] Furthermore, step (3) is oriented towards the behavioral profiling of the perception network, and the specific contents are as follows.

[0060] Network behavior profiling is a method that combines qualitative and quantitative methods to characterize the network behavior of the terminal in different dimensions. Qualitative methods include: working environment, work flow, network communication, etc., while quantitative methods are statistical analysis and calculation of features. Using big data technology, terminal information is labeled and structured to perfectly abstract the overall picture of the terminal. Intrusion detection technology can actively detect attack behaviors and prevent them from causing large-scale damage. Network behavior profiling generated based on data mining can help the intrusion detection system detect and locate intrusion behaviors and intruders more accurately, with the characteristics of high degree of automation, good intelligence and strong scalability.

[0061] In addition, there are three methods for constructing behavioral portraits: traffic behavior portraits, connection behavior portraits, and protocol behavior portraits.

[0062] 1. Traffic behavior profile

[0063] The terminal's traffic behavior specifically includes the total amount of traffic inflow, the total amount of traffic outflow, the trend of traffic inflow / outflow, and the trend of traffic packet sending / receiving. The calculation method of the total amount of traffic inflow is shown in formula (1), and the calculation method of the total amount of traffic outflow is shown in formula (2):

[0064] flow in =dest.bytes as.src +src.bytes as.dest Formula (1)

[0065] flow out =src.bytes as.src +dest.bytes as.dest Formula (2)

[0066] By observing the total amount of data inflow / outflow of different terminals, three traffic behavior patterns can be obtained: data output type, data input type, and data input and output balance type. Different terminals are suitable for different traffic behavior patterns. For example, the camera needs to continuously send video stream data to the storage device, which belongs to the data output type. Therefore, when the camera's traffic behavior pattern changes to the data input and output balance type, it can be determined that the camera has an abnormality, which may be a disconnection between the camera and the storage device, a camera failure, etc. When the camera's traffic behavior pattern changes to the data input type, it can be determined that the camera is attacked or used incorrectly.

[0067] By observing the terminal's traffic inflow / outflow trends and traffic packet sending / receiving trends, we can not only clarify the terminal's behavior patterns, but also promptly discover and locate the terminal's traffic anomalies.

[0068] For a specific terminal, the number of bytes contained in its data packets is relatively stable and follows a regular pattern. Therefore, in addition to individual observations, the traffic packet sending / receiving trend can also be combined with the traffic inflow / outflow trend to depict a rough outline of the amount of information contained in each data packet of the terminal, thereby assisting in judgment.

[0069] 2. Connect Behavior Profiles

[0070] The connection behavior of a terminal is mainly reflected in the number of devices connected to the terminal.

[0071] The trend in the number of terminal connected devices has the following two main effects:

[0072] On the one hand, it can effectively characterize the active mode of the terminal, such as a large number of connections during working hours and a small number of connections during standby hours.

[0073] On the other hand, it can effectively identify whether the device has been attacked or operated incorrectly. Taking lateral movement as an example, if a terminal is compromised, it will be used as a springboard by the attacker to continue to access or control other intranet machines, resulting in an abnormal increase in the number of terminal connections.

[0074] 3. Protocol Behavior Profile

[0075] The protocol behavior of the terminal includes the number of transport layer protocols, the number of application layer protocols, the trend of transport layer protocols, and the trend of application layer protocols.

[0076] Transport layer protocols include TCP, UDP and ICMP. For a specific terminal, the number of transport layer protocols and the proportion of each transport layer protocol should be relatively stable.

[0077] Application layer protocols include HTTP, SSH, DNS, DHCP, etc. For a specific terminal, the number of application layer protocols and the proportion of each application layer protocol should also be relatively stable. At the same time, for different terminals, the application layer protocols that may be involved are also different. For example, for a terminal that only opens web access, application layer protocols such as HTTP and SSL may be involved, but protocols such as SSH and MySQL should not be involved. When the terminal has an application layer protocol that is not within the expected range, it can be basically determined that the terminal is under attack or is used incorrectly.

[0078] Furthermore, step (4) software defines the boundaries of the embedded environment, and the specific contents are as follows.

[0079] Through the IoT terminal security monitoring and protection system, permissions for different devices or user groups are differentiated based on behavioral portraits. When access is initiated, the access permissions will be analyzed and combined with whether there are abnormal behaviors to determine whether authorization can be obtained. Only authorized users can access protected resources through authorized devices. Create security boundaries based on policies to isolate services from insecure networks. It is designed to provide on-demand, dynamic air-gap networks (secure isolation networks) that authenticate users and devices before authorization to facilitate secure connections to isolated services. Unauthorized users and devices cannot connect to protected resources. Software-defined boundary technology makes extensive use of encryption, including mutual TLS for communication between components, and HMAC in SPA authorization packets. Software-defined boundary technology is designed to defend against network-based attacks.

[0080] The main features of software-defined perimeter technology are authentication devices, authentication and authorization of users to access dynamically configured services. For mutual TLS, the client and server need to exchange certificates with each other, which is safer than traditional SSL access. Software-defined perimeter technology provides zero visibility and zero connection to the outside world. Connections can only be established after endpoints prove that they can be trusted. A real-time encrypted connection access channel is established between the endpoint and the application infrastructure platform, allowing legitimate traffic to pass. This method can basically prevent all network-based attacks and reduce user access costs.

[0081] Furthermore, the specific content of step (5) SOM neural network is as follows.

[0082] SOM neural network uses feature mapping to achieve data dimensionality reduction, and displays these data in low-dimensional space through clear geometric relationships, which is conducive to the visualization of high-dimensional data. SOM neural network has the characteristics of visualization, self-organization, good clustering effect, and high computational efficiency. These characteristics have attracted considerable attention in scientific research and engineering application fields, and have also promoted the continuous optimization of traditional SOM algorithms.

[0083] The advantages of SOM network are reflected in the following four aspects:

[0084] 1. Compared with other non-neural network clustering algorithms, such as K-medoids clustering algorithm, SOM clustering system often has better robustness.

[0085] 2. The network clusters data based on similarity, so it may happen that one cluster center represents multiple inputs.

[0086] 3. The input nodes can still remain adjacent to each other when mapped to the output space, that is, the similarity of the features will not be destroyed due to the mapping.

[0087] 4. The original data may obey a certain probability distribution, and this distribution feature can also be reflected in the corresponding area on the mapping diagram.

[0088] It is worth noting that, although the foregoing content has described the spirit and principle of the invention with reference to several specific embodiments, it should be understood that the invention is not limited to the disclosed specific embodiments, and the division of various aspects does not mean that the features in these aspects cannot be combined, and such division is only for the convenience of expression. The invention is intended to cover various modifications and equivalent arrangements included in the spirit and scope of the appended claims.

Claims

1. A method for security monitoring and protection of IoT terminals, based on a cloud-edge collaboration scenario, comprising the following steps: (1) IoT terminal device identification method based on stream processing and classification algorithm; (2) Heterogeneous resource indifferent trusted verification mapping technology; (3) Behavioral profiling technology for perception networks; (4) Software-defined boundary technology for embedded environments; (5) SOM neural network technology; Among them, in the method for identifying an IoT terminal device based on stream processing and classification algorithm in step (1), the method for identifying an IoT terminal device based on stream processing includes: Divide data according to the MAC addresses of different terminals: ①Use the MAC address as the unique identifier of the terminal; ② Organize the data related to the MAC address to establish a fingerprint table, and the data in the fingerprint table is used as the fingerprint of the terminal; When a new log enters the terminal fingerprint table: ① If the relevant MAC address in the log already exists in the table, modify the terminal fingerprint feature corresponding to the MAC address; ② If a MAC address related to the log does not exist in the table, a new terminal fingerprint is generated based on the data related to the MAC address in the log; The IoT terminal type recognition method based on classification algorithm consists of three steps: fingerprint generation, model training and type recognition through model, and online learning. 1) Device fingerprint generation, By analyzing and counting the behavioral characteristics of the terminal within a certain period of time, the terminal's fingerprint is generated. The fingerprint is divided into two categories according to the source: traffic fingerprint and scanning fingerprint. Here, Traffic fingerprinting is to extract the terminal fingerprint from the traffic log generated by mirroring and passing through the switch using bypass parsing; Scanning fingerprints means actively scanning using the probe server according to the user-specified IP range. According to different transmission protocols, different protocol instructions are actively sent to the terminals in the network to obtain detailed information of the terminals in the network and generate traffic logs, from which the fingerprints of the terminals are extracted. 2) Model training, First, the feature engineering method is used to screen and process the data, where feature processing includes data cleaning, data normalization, and feature derivation and extraction; Feature screening uses filtering, packaging and embedding methods; By comparing the model's requirements for feature distribution, model robustness, model resource consumption, model updatability, and model out-of-sample accuracy, we selected XGBoost based on Boosting and tree models. 3) Online learning, When the terminal type determined by the model does not match the user's expectations, the user simply updates the terminal type on the interactive page, thereby correcting the terminal type and updating the model. The model update logic is as follows: Determine whether the user has updated the terminal type; If the user updates the terminal type, record the fingerprint of the device in different time periods; When fingerprint data accumulates to a certain extent, the model is further trained based on the original model, and the weight of the latest fingerprint data is increased; Step (3) is to create a behavioral profile for the perception network, including: Network behavior profiling is a method that combines qualitative and quantitative analysis to characterize the network behavior of the terminal in different dimensions. Qualitative analysis includes: working environment, workflow, and network communication, while quantitative analysis and calculation of the characteristics are performed. Using big data technology, terminal information is labeled and structured to perfectly abstract the overall picture of the terminal; there are three methods for constructing network behavior portraits: traffic behavior portraits, connection behavior portraits, and protocol behavior portraits.

1. Traffic behavior portrait, The terminal's traffic behavior specifically includes the total amount of traffic inflow, the total amount of traffic outflow, the trend of traffic inflow / outflow, and the trend of traffic packet sending / receiving. in, The calculation method of the total inflow volume is shown in formula (1), and the calculation method of the total outflow volume is shown in formula (2): flow in = dest.bytes as.src +src.bytes as.dest Formula(1) flow out = src.bytes as.src +dest.bytes as.dest Formula (2) By observing the total amount of data inflow / outflow from different terminals, three traffic behavior patterns can be obtained: data output type, data input type, and data input and output are balanced type. Different terminals are suitable for different traffic behavior patterns. The camera is a data output type. When the camera's traffic behavior pattern changes to a data input-output balance type, it can be determined that the camera is abnormal, including disconnection between the camera and the storage device, and the camera itself is faulty. When the camera's traffic behavior pattern changes to a data input type, it can be determined that the camera is attacked or used incorrectly. By observing the terminal's traffic inflow / outflow trends and traffic packet sending / receiving trends, we can identify the terminal's behavior patterns and promptly locate abnormal traffic points on the terminal. For a specific terminal, the number of bytes contained in its data packets is relatively stable and regular. The trend of its traffic packets sent / received is combined with the trend of traffic inflow / outflow to depict the general outline of the amount of information contained in each data packet of the terminal.

2. Connect behavioral portraits, The connection behavior of a terminal is represented by the number of devices connected to the terminal. The number of devices connected to the terminal has the following two functions: On the one hand, it can effectively characterize the active mode of the terminal, with a large number of connections during working and a small number of connections during standby; On the other hand, it can effectively identify whether the device has been attacked or operated incorrectly. If the terminal is compromised, it will be used as a springboard by the attacker to continue to access or control other intranet machines, resulting in an abnormal increase in the number of terminal connections.

3. Protocol behavior profile, When the terminal displays an application layer protocol that is not within the expected range, it can be determined that the terminal is under attack or is being used incorrectly; Step (4) software-defined boundaries of the embedded environment, specifically including: Through the IoT terminal security monitoring and protection system, permissions for different devices or user groups are differentiated based on behavioral profiling. When access is initiated, the access permissions will be analyzed and combined with whether there are abnormal behaviors to determine whether authorization can be granted. Only authorized users can access protected resources through authorized devices. Create security boundaries based on policies to isolate services from insecure networks. Authenticate users and devices before authorization to facilitate secure connections to isolated services. Unauthorized users and devices cannot connect to protected resources. Step (5) SOM neural network specifically includes: Feature mapping is used to achieve data dimensionality reduction, and the data are presented in a low-dimensional space through clear geometric relationships.

2. An Internet of Things terminal security monitoring and protection system, comprising a plurality of Internet of Things terminals and an Internet of Things security server, characterized in that: The IoT security server has a memory; and A processor coupled to the memory, the processor being configured to execute instructions stored in the memory to implement the method of claim 1.

3. The Internet of Things terminal security monitoring and protection system according to claim 2 is characterized in that: Feature mapping is used to perform dimensionality reduction operations on the characteristic data of the Internet of Things terminal device, and these data are presented in a low-dimensional space through geometric relationships.

Images