Iot lightweight event authentication method and device

Abstract

The application relates to the technical field of electric digital data processing, in particular to a lightweight event authentication method and device for an Internet of Things, wherein the method comprises the following steps: adding a label to an event according to an event log record to obtain an event triple containing the label, and performing windowing on a sensor data sequence to obtain a plurality of sensor feature vectors; generating a sensor set through a preset importance measurement strategy based on the plurality of sensor feature vectors; calculating the features of the sensors according to the sensor data sequence and the sensor set, and obtaining an event fingerprint according to the features of the sensors; and training an event authentication model for judging the authenticity of the event according to the event fingerprint and the label in the event triple. Therefore, the technical problem that the number of sensors deployed additionally is large, the communication burden of deployment is large, and the importance measurement strategy for the sensors is simple, thereby causing the loss of event authentication accuracy in the prior art is solved.

Description

Technical Field

[0001] This application relates to the field of electronic digital data processing technology, and in particular to a lightweight event authentication method and apparatus for the Internet of Things. Background Technology

[0002] The Internet of Things (IoT) comprises various sensors and smart devices, which are made intelligent through top-level control and decision-making logic. An event is a special type of message within an IoT system, sent by a smart device to the top-level control system to inform it of state changes; it is a core means for the control system to perceive device status and the physical environment. Event security issues seriously affect the security of IoT systems. Errors and false events caused by device malfunctions or malicious injection by attackers can trigger unexpected logic, leading to uncontrollable system behavior. Therefore, a method for IoT event authentication is needed.

[0003] Given the diversity and vulnerability of IoT devices, traditional cryptographic methods are difficult to implement. Sensor data-based IoT event authentication schemes can overcome the high network environment requirements of traffic data-based event authentication schemes, thereby ensuring the availability and effectiveness of the scheme.

[0004] However, the event authentication schemes based on sensor data in related technologies require the additional deployment of trusted environmental sensors to collect physical environment data in real time and verify whether the device status has actually changed, which brings additional deployment and communication burden to the system. In addition, the importance measurement strategies of related technologies are relatively simple, resulting in a loss of event authentication accuracy, which urgently needs to be improved. Summary of the Invention

[0005] This application provides a lightweight event authentication method and apparatus for the Internet of Things (IoT) to address the technical problems in related technologies, such as the large number of additionally deployed sensors leading to a heavy communication burden and the relatively simple sensor importance measurement strategies resulting in a loss of event authentication accuracy.

[0006] The first aspect of this application provides a lightweight event authentication method for the Internet of Things (IoT), comprising the following steps: adding tags to events based on event log records to obtain event triples containing the tags, and windowing sensor data sequences to obtain multiple sensor feature vectors; generating a sensor set based on the multiple sensor feature vectors using a preset importance measurement strategy; calculating sensor features based on the sensor data sequences and the sensor set, and obtaining event fingerprints based on the sensor features; and training an event authentication model for determining the authenticity of events based on the event fingerprints and the tags in the event triples.

[0007] Optionally, in one embodiment of this application, the method further includes: obtaining an event fingerprint of the event to be authenticated; inputting the event fingerprint of the event to be authenticated into the event authentication model to obtain the event authenticity authentication result of the event to be authenticated.

[0008] Optionally, in one embodiment of this application, the step of adding tags to events based on event log records to obtain event triples containing tags, and windowing the sensor data sequence to obtain multiple sensor feature vectors, includes: based on any IoT event in the events, marking the occurrence time and non-occurrence time of any IoT event on the time axis, and respectively recording the occurrence time and non-occurrence time as positive and negative, generating the event triples represented in triple form; based on any IoT event and multiple sensors, selecting the corresponding optimal time window according to the relative mutual information index; and calculating the feature vector of each sensor based on the optimal time window to obtain the multiple sensor feature vectors.

[0009] Optionally, in one embodiment of this application, the feature vector includes at least one of the minimum, maximum, mean, sum, and standard deviation of the data sequence within the optimal time window.

[0010] Optionally, in one embodiment of this application, a sensor set is generated based on the plurality of sensor feature vectors using a preset importance measurement strategy, including: aggregating the plurality of sensor feature vectors to obtain feature vectors; calculating the importance vector of the feature vectors; and selecting the sensor set according to the importance vector.

[0011] Optionally, in one embodiment of this application, the step of training an event authentication model for determining the authenticity of an event based on the event fingerprint and the labels in the event triples includes: using the feature vector as the feature of the sample, combining it with the labels obtained from the event triples, training an SVM (Support Vector Machine) classifier to obtain the event authentication model.

[0012] A second aspect of this application provides a lightweight event authentication device for the Internet of Things (IoT), comprising: a labeling module, configured to add tags to events based on event log records to obtain event triples containing the tags, and to window sensor data sequences to obtain multiple sensor feature vectors; a generation module, configured to generate a sensor set based on the multiple sensor feature vectors using a preset importance measurement strategy; a feature conversion module, configured to calculate sensor features based on the sensor data sequences and the sensor set, and to obtain an event fingerprint based on the sensor features; and a training module, configured to train an event authentication model for determining the authenticity of events based on the event fingerprint and the tags in the event triples.

[0013] Optionally, in one embodiment of this application, it further includes: an acquisition module, used to acquire an event fingerprint of the event to be authenticated; and an authentication module, used to input the event fingerprint of the event to be authenticated into the event authentication model to obtain the event authenticity authentication result of the event to be authenticated.

[0014] Optionally, in one embodiment of this application, the annotation module includes: an annotation unit, configured to annotate the occurrence time and non-occurrence time of any IoT event on a time axis based on any IoT event in the event, and record the occurrence time and non-occurrence time as positive and negative respectively, generating the event triplet represented in triplet form; a first selection unit, configured to select the corresponding optimal time window based on the any IoT event and multiple sensors according to the relative mutual information index; and a first calculation unit, configured to calculate the feature vector of each sensor based on the optimal time window to obtain the feature vector of the multiple sensors.

[0015] Optionally, in one embodiment of this application, the feature vector includes at least one of the minimum, maximum, mean, sum, and standard deviation of the data sequence within the optimal time window.

[0016] Optionally, in one embodiment of this application, the generation module includes: an aggregation unit for aggregating the feature vectors of the plurality of sensors to obtain a feature vector; a second calculation unit for calculating the importance vector of the feature vector; and a second selection unit for selecting the sensor set according to the importance vector.

[0017] Optionally, in one embodiment of this application, the training module includes: a training unit, used to train an SVM classifier by using the feature vector as the feature of the sample and combining it with the label obtained from the event triples to obtain an event authentication model.

[0018] A third aspect of this application provides an electronic device, including: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the lightweight Internet of Things event authentication method as described in the above embodiments.

[0019] A fourth aspect of this application provides a computer-readable storage medium having a computer program stored thereon, the program being executed by a processor to implement the lightweight event authentication method for the Internet of Things as described in any one of claims 1-6.

[0020] This application's embodiments can window sensor data sequences based on event triples containing tags to obtain multiple sensor feature vectors. A sensor set is generated using an importance measurement strategy, enabling the assessment of sensor importance based on sensor features. During event authentication, only valid and informative sensors are retained, thereby improving event authentication accuracy while reducing system load. Sensor features are calculated based on the sensor data sequences and sensor set to obtain event fingerprints. These fingerprints are then used to train an event authentication model for determining event authenticity, combining the tags from the event triples. This ensures the authenticity of IoT events and detects fake events, improving the security of the IoT system. Therefore, this addresses the technical problems in related technologies where a large number of additional sensors leads to a heavy communication burden, and the simplistic sensor importance measurement strategies result in a loss of event authentication accuracy.

[0021] Additional aspects and advantages of this application will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of this application. Attached Figure Description

[0022] The above and / or additional aspects and advantages of this application will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein:

[0023] Figure 1 This is a flowchart of a lightweight event authentication method for the Internet of Things provided according to an embodiment of this application;

[0024] Figure 2 A flowchart illustrating the feature vector acquisition of a lightweight event authentication method for the Internet of Things according to an embodiment of this application;

[0025] Figure 3 A flowchart illustrating the acquisition of a sensor set in a lightweight event authentication method for the Internet of Things according to an embodiment of this application;

[0026] Figure 4 This is a schematic diagram of the neural network structure of a lightweight event authentication method for the Internet of Things according to an embodiment of this application;

[0027] Figure 5 This is a flowchart of a lightweight event authentication method for the Internet of Things according to an embodiment of this application;

[0028] Figure 6 This is a schematic diagram of the structure of a lightweight event authentication device for the Internet of Things provided according to an embodiment of this application;

[0029] Figure 7 This is a schematic diagram of the structure of an electronic device provided according to an embodiment of this application. Detailed Implementation

[0030] The embodiments of this application are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain this application, and should not be construed as limiting this application.

[0031] The following description, with reference to the accompanying drawings, illustrates a lightweight IoT event authentication method and apparatus according to embodiments of this application. Addressing the technical problems mentioned in the background section regarding the large number of additionally deployed sensors leading to a heavy communication burden and the relatively simple sensor importance measurement strategies, resulting in a loss of event authentication accuracy, this application provides a lightweight IoT event authentication method. In this method, sensor data sequences are windowed based on event triples containing tags to obtain multiple sensor feature vectors. A sensor set is generated using an importance measurement strategy, enabling the evaluation of sensor importance based on sensor features. During event authentication, only valid and information-rich sensors are retained, thereby improving event authentication accuracy while reducing system burden. Sensor features are calculated based on the sensor data sequences and sensor set to obtain event fingerprints. These fingerprints are then used to train an event authentication model for determining the authenticity of events, combining the tags in the event triples. This model ensures the authenticity of IoT events and detects fake events, improving the security of the IoT system. This solves the technical problems in related technologies, such as the large number of additional sensors deployed, which leads to a heavy communication burden and a relatively simple strategy for measuring the importance of sensors, resulting in a loss of accuracy in event authentication.

[0032] Specifically, Figure 1 This is a flowchart illustrating a lightweight event authentication method for the Internet of Things (IoT) provided in an embodiment of this application.

[0033] like Figure 1 As shown, this lightweight event authentication method for the Internet of Things includes the following steps:

[0034] In step S1, the events are tagged according to the event log records to obtain event triples containing the tags, and the sensor data sequence is windowed to obtain multiple sensor feature vectors.

[0035] In actual implementation, the embodiments of this application can designate a certain IoT time that requires event authentication as E. The event log of event E can contain n records, and the timestamps can be represented as t1,…,t. nFurthermore, in embodiments of this application, k trusted candidate environmental sensors that can be used for event authentication in an IoT system can also be represented as S1,…,S k The time series of sensor data are represented as S1(t),…,S k (t).

[0036] Furthermore, in this embodiment, events can be tagged according to event log records to obtain event triples containing tags, and the sensor data sequence can be windowed to obtain multiple sensor feature vectors, which facilitates the subsequent generation of a sensor set. The importance of sensors can be judged based on sensor features, and only valid and information-rich sensors can be retained during the event authentication process, thereby improving the accuracy of event authentication while reducing the system burden.

[0037] Optionally, in one embodiment of this application, events are tagged according to event log records to obtain event triples containing tags, and the sensor data sequence is windowed to obtain multiple sensor feature vectors, including: based on any IoT event, marking the occurrence time and non-occurrence time of any IoT event on the time axis, and recording the occurrence time and non-occurrence time as positive and negative respectively, generating an event triple in the form of a triple; based on any IoT event and multiple sensors, selecting the corresponding optimal time window according to the relative mutual information index; calculating the feature vector of each sensor based on the optimal time window to obtain multiple sensor feature vectors.

[0038] Specifically, embodiments of this application obtain multiple sensor feature vectors, such as... Figure 2 As shown, the following steps may be included:

[0039] S11: In this embodiment of the application, for a certain IoT event E, the times when the event occurred and when it did not occur can be marked on the timeline, denoted as positive and negative respectively, and represented as a triple (E, t, l), where l∈{0, 1}. The times when the event occurred are directly referenced from the IoT event log records, while the times when the event did not occur are manually generated in other parts of the timeline.

[0040] Specifically, the event triplet can be divided into two aspects: constructing positive samples based on the timestamps of the events in the event log, where t is set to the corresponding timestamp and l is set to 1; and uniformly setting negative samples at certain time intervals in the gaps between the positive samples, where t is set to the corresponding timestamp and l is set to 0.

[0041] After constructing n event triples through the above process, this embodiment of the application can arrange them in ascending order of timestamps to form an ordered sequence of event triples (E,t1,l1),...,(E,t... n ,l n ).

[0042] S12: This application embodiment can target a specific IoT event E and sensor S. i The optimal time window is selected using a grid search method and a certain metric. That is, the window starts before the event occurs. Seconds, the endpoint is located after the event occurs. Second.

[0043] S13: In this embodiment of the application, each sensor S can be configured... i The data sequence is windowed according to the timestamps in the event triples, and m feature values ​​are calculated for the data sequence within the window to obtain the feature vector.

[0044] This application embodiment can select a time range of a window. Where N is a set of integers, the following calculation is performed for all candidate time windows:

[0045] Calculate the feature values ​​of events under this window: This application embodiment can calculate the feature values ​​of event triples (E,t) j ,l j ), in sensor data sequence S i (t) at timestamp t j Add a window nearby and extract the sensor data sequence within the window area.

[0046] Furthermore, embodiments of this application can calculate m feature values ​​of this sequence, denoted as... And concatenate them to obtain the feature vector And for all n event triples (E,t) j ,l j Repeat the above operation for each pair of events to obtain the feature matrix that corresponds one-to-one with the event triples:

[0047]

[0048] Furthermore, embodiments of this application can extract the event triple sequence (E,t1,l1),...,(E,t... n ,l n The label elements in the () are used to obtain the label sequence l = {l1, ..., l) n}

[0049] Furthermore, embodiments of this application can extract a feature matrix. Each column in the array serves as a feature sequence that corresponds one-to-one with an event triple, for example, extracting sensor S. i The m-th feature, whose sequence is the matrix. The m-th column is denoted as

[0050] Furthermore, embodiments of this application can be applied to sensor S. i Given all m features, obtain their feature sequences. RMI (Relative Mutual Information) is used as the evaluation metric for windows.

[0051] Specifically, embodiments of this application can target a specific IoT event E and sensor S. i Its RMI is determined by the maximum RMI of all m feature sequences under this sensor, and the calculation process is as follows:

[0052]

[0053] Where I(·) represents the mutual information between the two sequences, and H(·) represents the information entropy.

[0054] Furthermore, in this embodiment of the application, after performing the above calculations on all candidate time windows, the candidate with the largest RMI can be selected as the optimal time window, denoted as...

[0055] Furthermore, embodiments of this application can specify each event triple (E, t) j , l j For all k sensors, j∈{1,2,...,n}, the following operation is performed:

[0056] Calculate the feature value of an event within the optimal time window: In this embodiment of the application, the optimal time window can be denoted as... For the event triple (E,t) j ,l j ), in sensor data sequence S i (t) at timestamp t j Add a window nearby and extract the sensor data sequence within the window area. Repeat the above calculation method to calculate the m feature values ​​of this sequence, denoted as . And concatenate them to obtain the feature vector

[0057] Optionally, in one embodiment of this application, the feature vector includes at least one of the minimum, maximum, mean, sum, and standard deviation of the data sequence within the optimal time window.

[0058] It is understood that, in order to ensure the representativeness of the feature vector, the feature vector in this embodiment may include at least one of the minimum, maximum, mean, sum and standard deviation of the data sequence within the optimal time window, so as to facilitate subsequent steps to generate a sensor set based on the feature vector, and then realize the training of the event authentication model.

[0059] In step S2, a sensor set is generated based on multiple sensor feature vectors using a preset importance measurement strategy.

[0060] In actual implementation, the embodiments of this application can measure the importance of all features based on multiple sensor feature vectors through a preset importance highlighting strategy, thereby obtaining a set of sensors for event authentication, selecting a more efficient sensor combination for classification tasks, improving model accuracy, and reducing the number of sensors used for event authentication tasks, thereby reducing the deployment and computing costs of IoT sensors.

[0061] It should be noted that the preset importance measurement strategy will be explained in detail later.

[0062] Optionally, in one embodiment of this application, a sensor set is generated based on multiple sensor feature vectors using a preset importance measurement strategy, including: aggregating multiple sensor feature vectors to obtain feature vectors; calculating the importance vector of the feature vectors; and selecting the sensor set according to the importance vector.

[0063] Here, we will elaborate on the pre-defined importance measurement strategy.

[0064] like Figure 3 As shown, this embodiment of the application generates a sensor set based on multiple sensor feature vectors through a preset importance measurement strategy, which may include the following steps:

[0065] S21: Embodiments of this application can handle event triples (E,t) j ,l j By aggregating sensor features, a feature vector is obtained.

[0066] Specifically, in this embodiment, the feature vectors of all k sensors can be concatenated to obtain a triple (E,t) describing this event. j ,l j The total eigenvector of )

[0067]

[0068] S22: Calculate the feature importance vector by training a neural network. This application embodiment can use the l in the event triplet. j As a label, use As input, the feature importance vector is calculated by training the neural network.

[0069] Specifically, embodiments of this application may use a specific neural network for feature selection to reduce the number of sensors. The specific neural network structure is as follows: Figure 4 As shown.

[0070] The input layer accepts input as The number of nodes is m*k. In this embodiment, a pair of layers with L1 regularization containing m*k nodes can be used, followed by two fully connected layers with ReLU activation functions. The output layer has one node and contains a Sigmoid activation function. The purpose is to compress the output to between 0 and 1, representing the classification score. The classification threshold is set to 0.5. If the classification score is higher than this threshold, it is determined to be a positive sample, and if it is lower than this threshold, it is determined to be a negative sample.

[0071] In training this neural network, this embodiment of the application may use feature vectors. As input, use the label l of the event triple. j As a result of the band fitting, the BCE (Binary Cross Entropy) loss function was used, and the SGD-L1 (clipping) optimization algorithm was employed, which is an improvement on the SGD (stochastic gradient descent) algorithm.

[0072] Furthermore, embodiments of this application may assume that the output predicted label is The real label is y i The weight in a one-to-one node is represented as The cost function of the neural network can then be:

[0073]

[0074] in, Here, λ is the L1 regularization term, and ||·|| represents the L1 norm, which is the sum of the weights of the nodes in a one-to-one relationship. The BCE loss function can be expressed as:

[0075]

[0076] Due to the existence of L1 regularization, ω′ can be trained to obtain a sparse vector.

[0077] In this embodiment of the application, in order to prevent the cost function from becoming nondifferentiable due to L1 regularization, the SGD-L1 (clipping) optimization algorithm can be used.

[0078] Specifically, in each iteration, the embodiments of this application can guarantee Each weight in the set will not exceed 0. If the weight of a node in the k-th iteration is represented by ω... k The weights for the next round are calculated using SGD. Then we have: If but if but

[0079] The embodiments of this application can use the SGD-L1 (clipping) optimization algorithm to ensure that the weights converge to 0 more easily during the iteration process, rather than oscillating around 0.

[0080] Furthermore, embodiments of this application can obtain an m*k dimensional weight vector that is as sparse as possible using the above method:

[0081]

[0082] It should be noted that each dimension of the weight vector above represents the importance of the m*k dimensional features. An importance of 0 means that the feature in this dimension is completely useless. Therefore, in the embodiments of this application, these features can be discarded.

[0083] S23: Select the sensor set S for event authentication based on the feature importance vector. v In this embodiment, the set of all sensors containing the remaining features can be selected, i.e., the set of sensors used for event authentication, denoted as S. v .

[0084] In step S3, the characteristics of the sensors are calculated based on the sensor data sequence and the sensor set, and the event fingerprint is obtained based on the sensor characteristics.

[0085] In actual implementation, embodiments of this application can use sensor data sequences and the sensor set for event authentication obtained through the above steps, and utilize the feature vectors calculated in the above steps. The method calculates the features of the sensor and aggregates them to obtain a feature vector. As an event fingerprint, it is beneficial for subsequent training of event authentication models, thereby ensuring the authenticity of IoT events and detecting fake events, and improving the security of IoT systems.

[0086] In step S4, an event authentication model for determining the authenticity of an event is trained based on the event fingerprint and the labels in the event triple.

[0087] As one possible implementation, embodiments of this application can be based on event fingerprints and tags in event triples. The machine learning model is trained using the sample features and labels respectively, and then an event authentication model is obtained to determine the authenticity of an event, enabling it to determine the authenticity of an event through event fingerprints.

[0088] Optionally, in one embodiment of this application, an event authentication model for determining the authenticity of an event is trained based on the event fingerprint and the labels in the event triples, including: using the feature vector as the feature of the sample, combining it with the labels obtained from the event triples, training an SVM classifier to obtain the event authentication model.

[0089] In this embodiment of the application, S can be used v The sensor calculates features and uses l in the event triplet. j The labels are used to train a linear SVM classifier, which is then used as a model to determine the authenticity of events.

[0090] It should be noted that the significance of using an SVM classifier in this embodiment is to reduce the complexity of the method when performing online event authentication.

[0091] Specifically, after the training phase ends, in order to authenticate event E, this embodiment of the application may retain only three types of parameters: optimal time window. Sensor set S for authentication v And a trained SVM classifier model.

[0092] Optionally, in one embodiment of this application, the method further includes: obtaining the event fingerprint of the event to be authenticated; inputting the event fingerprint of the event to be authenticated into the event authentication model to obtain the event authenticity authentication result of the event to be authenticated.

[0093] In actual implementation, the embodiments of this application can achieve the purpose of event authentication by collecting relevant sensor data, combining the optimal time window, selecting feature values ​​within a predetermined range, and using a pre-trained SVM classifier to give a judgment result on the authenticity of the event after training the event authentication model and when the IoT system detects an event.

[0094] This application implements authentication of IoT events. It starts from trusted environmental sensors around the IoT event source device, models and describes the impact of the event on the sensors, thereby authenticating untrusted event messages. By training a neural network to fit the importance of environmental sensors, candidate environmental sensors are selected, thereby reducing the number of sensors and achieving a lightweight approach. By performing feature calculations on the selected environmental sensors and training a machine learning classifier to determine the authenticity of events, the authenticity of IoT events is guaranteed and fake events are detected, thus improving the security of the IoT system.

[0095] The following is combined Figures 2 to 5 As shown, the working principle of the IoT lightweight event authentication method of this application embodiment is explained in detail with a specific example.

[0096] like Figure 5 As shown, embodiments of this application may include the following steps:

[0097] Step S501: Based on the event log records and sensor data sequences, add labels to the events to obtain event triples. At the same time, window the sensor data sequences and select the optimal window for feature calculation to obtain feature vectors.

[0098] In actual implementation, the embodiments of this application can designate a certain IoT time that requires event authentication as E. The event log of event E can contain n records, and the timestamps can be represented as t1,…,t. n Furthermore, in embodiments of this application, k trusted candidate environmental sensors that can be used for event authentication in an IoT system can also be represented as S1,…,S k The time series of sensor data are represented as S1(t),…,S k (t).

[0099] Specifically, embodiments of this application obtain multiple sensor feature vectors, such as... Figure 2 As shown, the following steps may be included:

[0100] S11: In this embodiment of the application, for a certain IoT event E, the times when the event occurred and when it did not occur can be marked on the timeline, denoted as positive and negative respectively, and represented as a triple (E, t, l) l∈{0, 1}. The times when the event occurred are directly referenced from the IoT event log records, while the times when the event did not occur are manually generated in other parts of the timeline.

[0101] Specifically, the event triplet can be divided into two aspects: constructing positive samples based on the timestamps of the events in the event log, where t is set to the corresponding timestamp and l is set to 1; and uniformly setting negative samples at certain time intervals in the gaps between the positive samples, where t is set to the corresponding timestamp and l is set to 0.

[0102] After constructing n event triples through the above process, this embodiment of the application can arrange them in ascending order of timestamps to form an ordered sequence of event triples (E,t1,l1),...,(E,t... n ,l n ).

[0103] S12: This application embodiment can target a specific IoT event E and sensor S. iThe optimal time window is selected using a grid search method and a certain metric. That is, the window starts before the event occurs. Seconds, the endpoint is located after the event occurs. Second.

[0104] S13: In this embodiment of the application, each sensor S can be configured... i The data sequence is windowed according to the timestamps in the event triples, and m feature values ​​are calculated for the data sequence within the window to obtain the feature vector.

[0105] Specifically, in this application embodiment, a time range of a window can be selected. Where N is a set of integers, the following calculation is performed for all candidate time windows:

[0106] Calculate the feature values ​​of events under this window: This application embodiment can calculate the feature values ​​of event triples (E,t) j ,l j ), in sensor data sequence S i (t) at timestamp t j Add a window nearby and extract the sensor data sequence within the window area.

[0107] Furthermore, embodiments of this application can calculate m feature values ​​of this sequence, denoted as... And concatenate them to obtain the feature vector And for all n event triples (E,t) j ,l j Repeat the above operation for each pair of events to obtain the feature matrix that corresponds one-to-one with the event triples:

[0108]

[0109] Furthermore, embodiments of this application can extract the event triple sequence (E,t1,l1),...,(E,t... n ,l n The label elements in the () are used to obtain the label sequence l = {l1, ..., l) n}

[0110] Furthermore, embodiments of this application can extract a feature matrix. Each column in the array serves as a feature sequence that corresponds one-to-one with an event triple, for example, extracting sensor S. i The m-th feature, whose sequence is the matrix. The m-th column is denoted as

[0111] Furthermore, embodiments of this application can be applied to sensor S. iGiven all m features, obtain their feature sequences. Use RMI as the evaluation metric for the window.

[0112] Specifically, embodiments of this application can target a specific IoT event E and sensor S. i Its RMI is determined by the maximum RMI of all m feature sequences under this sensor, and the calculation process is as follows:

[0113]

[0114] Where I(·) represents the mutual information between the two sequences, and H(·) represents the information entropy.

[0115] Furthermore, in this embodiment of the application, after performing the above calculations on all candidate time windows, the candidate with the largest RMI can be selected as the optimal time window, denoted as...

[0116] Furthermore, embodiments of this application can specify each event triple (E, t) j , l j For all k sensors, j∈{1,2,...,n}, the following operation is performed:

[0117] Calculate the feature value of an event within the optimal time window: In this embodiment of the application, the optimal time window can be denoted as... For the event triple (E,t) j ,l j ), in sensor data sequence S i (t) at timestamp t j Add a window nearby and extract the sensor data sequence within the window area. Repeat the above calculation method to calculate the m feature values ​​of this sequence, denoted as . And concatenate them to obtain the feature vector The features include minimum value, maximum value, mean, sum, and standard deviation.

[0118] Step S502: Based on the sensor feature vectors, measure the importance of all features to obtain the sensor set used for event authentication.

[0119] like Figure 3 As shown, this embodiment of the application generates a sensor set based on multiple sensor feature vectors through a preset importance measurement strategy, which may include the following steps:

[0120] S21: Embodiments of this application can handle event triples (E,t) j ,l j By aggregating sensor features, a feature vector is obtained.

[0121] Specifically, in this embodiment, the feature vectors of all k sensors can be concatenated to obtain a triple (E,t) describing this event. j ,l j The total eigenvector of )

[0122]

[0123] S22: Calculate the feature importance vector by training a neural network. This application embodiment can use the l in the event triplet. j As a label, use As input, the feature importance vector is calculated by training the neural network.

[0124] Specifically, embodiments of this application may use a specific neural network for feature selection to reduce the number of sensors. The specific neural network structure is as follows: Figure 4 As shown.

[0125] The input layer accepts input as The number of nodes is m*k. In this embodiment, a pair of layers with L1 regularization containing m*k nodes can be used, followed by two fully connected layers with ReLU activation functions. The output layer has one node and contains a Sigmoid activation function. The purpose is to compress the output to between 0 and 1, representing the classification score. The classification threshold is set to 0.5. If the classification score is higher than this threshold, it is determined to be a positive sample, and if it is lower than this threshold, it is determined to be a negative sample.

[0126] In training this neural network, this embodiment of the application may use feature vectors. As input, use the label l of the event triple. j As a result of the band fitting, the BCE (Binary Cross Entropy) loss function was used, and the SGD-L1 (clipping) optimization algorithm was employed, which is an improvement on the SGD (stochastic gradient descent) algorithm.

[0127] Furthermore, embodiments of this application may assume that the output predicted label is The real label is y i The weight in a one-to-one node is represented as The cost function of the neural network can then be:

[0128]

[0129] in, Here, λ is the L1 regularization term, and ||·|| represents the L1 norm, which is the sum of the weights of the nodes in a one-to-one relationship. The BCE loss function can be expressed as:

[0130]

[0131] Due to the existence of L1 regularization, ω′ can be trained to obtain a sparse vector.

[0132] In this embodiment of the application, in order to prevent the cost function from becoming nondifferentiable due to L1 regularization, the SGD-L1 (clipping) optimization algorithm can be used.

[0133] Specifically, in each iteration, the embodiments of this application can guarantee Each weight in the set will not exceed 0. If the weight of a node in the k-th iteration is represented by ω... k The weights for the next round are calculated using SGD. Then we have: If but if but

[0134] The embodiments of this application can use the SGD-L1 (clipping) optimization algorithm to ensure that the weights converge to 0 more easily during the iteration process, rather than oscillating around 0.

[0135] Furthermore, embodiments of this application can obtain an m*k dimensional weight vector that is as sparse as possible using the above method:

[0136]

[0137] It should be noted that each dimension of the weight vector above represents the importance of the m*k dimensional features. An importance of 0 means that the feature in this dimension is completely useless. Therefore, in the embodiments of this application, these features can be discarded.

[0138] S23: Select the sensor set S for event authentication based on the feature importance vector. v In this embodiment, the set of all sensors containing the remaining features can be selected, i.e., the set of sensors used for event authentication, denoted as S. v .

[0139] Step S503: Calculate the sensor characteristics based on the sensor data sequence and the set of sensors used for event authentication to obtain the event fingerprint.

[0140] In actual implementation, embodiments of this application can use sensor data sequences and the sensor set for event authentication obtained through the above steps, and utilize the feature vectors calculated in the above steps. The method calculates the features of the sensor and aggregates them to obtain a feature vector. As an event fingerprint, it is beneficial for subsequent training of event authentication models, thereby ensuring the authenticity of IoT events and detecting fake events, and improving the security of IoT systems.

[0141] Step S504: Train a machine learning model based on the event fingerprint and the label in the event triple, so that it has the ability to authenticate the authenticity of the event through the event fingerprint.

[0142] In this embodiment of the application, S can be used v The sensor calculates features and uses l in the event triplet. j The labels are used to train a linear SVM classifier, which is then used as a model to determine the authenticity of events.

[0143] It should be noted that the significance of using an SVM classifier in this embodiment is to reduce the complexity of the method when performing online event authentication.

[0144] Specifically, after the training phase ends, in order to authenticate event E, this embodiment of the application may retain only three types of parameters: optimal time window. Sensor set S for authentication v And a trained SVM classifier model.

[0145] In actual implementation, after training the event authentication model through the above steps, when the IoT system detects an event, this embodiment of the application can collect relevant sensor data, combine it with the optimal time window, select feature values ​​within a predetermined range, and use a pre-trained SVM classifier to give a judgment result on the authenticity of the event, thereby achieving the purpose of event authentication.

[0146] The lightweight event authentication method for IoT proposed in this application can window sensor data sequences based on event triples containing tags to obtain multiple sensor feature vectors. A sensor set is generated using an importance measurement strategy, enabling the evaluation of sensor importance based on sensor features. During event authentication, only valid and informative sensors are retained, thereby improving event authentication accuracy while reducing system load. Sensor features are calculated based on the sensor data sequences and sensor set to obtain event fingerprints. These fingerprints are then used to train an event authentication model for determining event authenticity, combining the tags from the event triples. This model ensures the authenticity of IoT events and detects fake events, improving the security of the IoT system. Therefore, this method solves the technical problems in related technologies where a large number of additional sensors are deployed, leading to a heavy communication burden, and the simplistic sensor importance measurement strategy results in a loss of event authentication accuracy.

[0147] Next, a lightweight event authentication device for the Internet of Things (IoT) according to an embodiment of this application is described with reference to the accompanying drawings.

[0148] Figure 6 This is a block diagram of a lightweight IoT event authentication device according to an embodiment of this application.

[0149] like Figure 6 As shown, the lightweight IoT event authentication device 10 includes: a labeling module 100, a generation module 200, a feature conversion module 300, and a training module 400.

[0150] Specifically, the labeling module 100 is used to add labels to events based on event log records, obtain event triples containing labels, and window the sensor data sequence to obtain multiple sensor feature vectors.

[0151] The generation module 200 is used to generate a sensor set based on multiple sensor feature vectors and through a preset importance measurement strategy.

[0152] The feature conversion module 300 is used to calculate the features of the sensor based on the sensor data sequence and the sensor set, and to obtain the event fingerprint based on the sensor features.

[0153] Training module 400 is used to train an event authentication model for determining the authenticity of an event based on the event fingerprint and the labels in the event triple.

[0154] Optionally, in one embodiment of this application, the IoT lightweight event authentication device 10 further includes an acquisition module and an authentication module.

[0155] The acquisition module is used to acquire the event fingerprint of the event to be authenticated.

[0156] The authentication module is used to input the event fingerprint of the event to be authenticated into the event authentication model to obtain the event authenticity authentication result.

[0157] Optionally, in one embodiment of this application, the annotation module 100 includes: an annotation unit, a first selection unit, and a first calculation unit.

[0158] The annotation unit is used to annotate the occurrence time and non-occurrence time of any IoT event on the timeline based on any IoT event, and to record the occurrence time and non-occurrence time as positive and negative respectively, generating an event triplet represented as a triplet.

[0159] The first selection unit is used to select the corresponding optimal time window based on any IoT event and multiple sensors, according to the relative mutual information index.

[0160] The first computing unit is used to calculate the feature vector of each sensor based on the optimal time window, thereby obtaining multiple sensor feature vectors.

[0161] Optionally, in one embodiment of this application, the feature vector includes at least one of the minimum, maximum, mean, sum, and standard deviation of the data sequence within the optimal time window.

[0162] Optionally, in one embodiment of this application, the generation module 200 includes: an aggregation unit, a second calculation unit, and a second selection unit.

[0163] The aggregation unit is used to aggregate feature vectors from multiple sensors to obtain a feature vector.

[0164] The second computational unit is used to calculate the importance vector of the feature vector.

[0165] The second selection unit is used to select a set of sensors based on the importance vector.

[0166] Optionally, in one embodiment of this application, the training module 400 includes a training unit.

[0167] The training unit is used to train an SVM classifier by taking the feature vector as the feature of the sample and combining it with the label obtained from the event triplet, thus obtaining the event authentication model.

[0168] It should be noted that the foregoing explanation of the embodiment of the IoT lightweight event authentication method also applies to the IoT lightweight event authentication device of this embodiment, and will not be repeated here.

[0169] The lightweight IoT event authentication device proposed in this application can window sensor data sequences based on event triples containing tags to obtain multiple sensor feature vectors. It then generates a sensor set using an importance measurement strategy, enabling the evaluation of sensor importance based on sensor features. During event authentication, only valid and informative sensors are retained, thereby improving event authentication accuracy while reducing system load. Sensor features are calculated based on the sensor data sequences and sensor set to obtain event fingerprints. These fingerprints are then used to train an event authentication model for determining event authenticity, combining the tags from the event triples. This ensures the authenticity of IoT events and detects fake events, improving the security of the IoT system. Therefore, this addresses the technical problems in related technologies where a large number of additional sensors are deployed, leading to a heavy communication burden, and the simplistic sensor importance measurement strategy results in a loss of event authentication accuracy.

[0170] Figure 7 A schematic diagram of the structure of an electronic device provided in an embodiment of this application. The electronic device may include:

[0171] The memory 701, the processor 702, and the computer program stored on the memory 701 and executable on the processor 702.

[0172] When the processor 702 executes the program, it implements the lightweight IoT event authentication method provided in the above embodiments.

[0173] Furthermore, electronic devices also include:

[0174] Communication interface 703 is used for communication between memory 701 and processor 702.

[0175] The memory 701 is used to store computer programs that can run on the processor 702.

[0176] The memory 701 may include high-speed RAM memory, and may also include non-volatile memory, such as at least one disk storage device.

[0177] If the memory 701, processor 702, and communication interface 703 are implemented independently, then the communication interface 703, memory 701, and processor 702 can be interconnected via a bus to complete communication between them. The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of representation, Figure 7 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0178] Optionally, in a specific implementation, if the memory 701, processor 702, and communication interface 703 are integrated on a single chip, then the memory 701, processor 702, and communication interface 703 can communicate with each other through an internal interface.

[0179] The processor 702 may be a central processing unit (CPU), an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of this application.

[0180] This embodiment also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described lightweight IoT event authentication method.

[0181] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0182] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this application, "N" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0183] Any process or method described in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more N executable instructions for implementing custom logic functions or processes, and the scope of the preferred embodiments of this application includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved, as should be understood by those skilled in the art to which embodiments of this application pertain.

[0184] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of computer-readable media include: an electrical connection having one or more wires (electronic device), a portable computer disk drive (magnetic device), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Alternatively, the computer-readable medium may be paper or other suitable media on which the program can be printed, since the program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in a computer memory.

[0185] It should be understood that the various parts of this application can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiments, the N steps or methods can be implemented using software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0186] Those skilled in the art will understand that all or part of the steps of the methods in the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, the program includes one or a combination of the steps of the method embodiments.

[0187] Furthermore, the functional units in the various embodiments of this application can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into a module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium.

[0188] The storage medium mentioned above can be a read-only memory, a disk, or an optical disk, etc. Although embodiments of this application have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting this application. Those skilled in the art can make changes, modifications, substitutions, and variations to the above embodiments within the scope of this application.

Claims

1. A lightweight event authentication method for the Internet of Things, characterized in that, Includes the following steps: The events are tagged based on the event log records to obtain event triples containing the tags, and the sensor data sequences are windowed to obtain multiple sensor feature vectors. Based on the feature vectors of the multiple sensors, a sensor set is generated using a preset importance measurement strategy; The characteristics of the sensors are calculated based on the sensor data sequence and the sensor set, and the event fingerprint is obtained based on the sensor characteristics. as well as An event authentication model for determining the authenticity of an event is trained based on the event fingerprint and the labels in the event triples. The process involves adding tags to events based on event log records to obtain event triples containing the tags, and then windowing the sensor data sequence to obtain multiple sensor feature vectors, including: Based on any IoT event in the event, mark the occurrence time and non-occurrence time of any IoT event on the timeline, and record the occurrence time and non-occurrence time as positive and negative respectively, and generate the event triplet represented as a triplet; Based on any IoT event and multiple sensors, the corresponding optimal time window is selected according to the relative mutual information content index. Based on the optimal time window, the feature vector of each sensor is calculated to obtain the feature vectors of the multiple sensors; The feature vector includes at least one of the minimum, maximum, mean, sum, and standard deviation of the data sequence within the optimal time window.

2. The method according to claim 1, characterized in that, Also includes: Obtain the event fingerprint of the event to be authenticated; The event fingerprint of the event to be authenticated is input into the event authentication model to obtain the event authenticity authentication result of the event to be authenticated.

3. The method according to claim 1, characterized in that, Based on the feature vectors of the multiple sensors, a sensor set is generated through a preset importance measurement strategy, including: By aggregating the feature vectors from the multiple sensors, a feature vector is obtained; Calculate the importance vector of the feature vector; The sensor set is selected based on the importance vector.

4. The method according to claim 3, characterized in that, The event authentication model trained based on the event fingerprint and the labels in the event triples to determine the authenticity of the event includes: The feature vector is used as the feature of the sample, and combined with the label obtained from the event triple, an SVM classifier is trained to obtain the event authentication model.

5. A lightweight event authentication device for the Internet of Things, characterized in that, include: The labeling module is used to add labels to events based on event log records, obtain event triples containing labels, and window the sensor data sequence to obtain multiple sensor feature vectors; The generation module is used to generate a sensor set based on the feature vectors of the multiple sensors and through a preset importance measurement strategy. The feature conversion module is used to calculate the features of the sensors based on the sensor data sequence and the sensor set, and to obtain the event fingerprint based on the sensor features; as well as The training module is used to train an event authentication model for judging the authenticity of an event based on the event fingerprint and the labels in the event triples. The process involves adding tags to events based on event log records to obtain event triples containing the tags, and then windowing the sensor data sequence to obtain multiple sensor feature vectors, including: Based on any IoT event in the event, mark the occurrence time and non-occurrence time of any IoT event on the timeline, and record the occurrence time and non-occurrence time as positive and negative respectively, and generate the event triplet represented as a triplet; Based on any IoT event and multiple sensors, the corresponding optimal time window is selected according to the relative mutual information content index. Based on the optimal time window, the feature vector of each sensor is calculated to obtain the feature vectors of the multiple sensors; The feature vector includes at least one of the minimum, maximum, mean, sum, and standard deviation of the data sequence within the optimal time window.

6. The apparatus according to claim 5, characterized in that, Also includes: The acquisition module is used to obtain the event fingerprint of the event to be authenticated; The authentication module is used to input the event fingerprint of the event to be authenticated into the event authentication model to obtain the event authenticity authentication result of the event to be authenticated.

7. An electronic device, characterized in that, include: A memory, a processor, and a computer program stored in the memory and executable on the processor, the processor executing the program to implement the lightweight event authentication method for the Internet of Things as described in any one of claims 1-4.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, The program is executed by the processor to implement the lightweight event authentication method for the Internet of Things as described in any one of claims 1-4.

Images