Network detection method and device based on internet of things equipment, equipment and storage medium

Abstract

The application discloses a network detection method and device based on an Internet of Things equipment, equipment and a storage medium, and the method comprises the following steps: when a to-be-detected Internet of Things equipment accesses a network, acquiring periodic time statistical characteristics and general time statistical characteristics of the to-be-detected Internet of Things equipment; performing abnormality detection through an unsupervised abnormality detection model according to the periodic time statistical characteristics and the general time statistical characteristics, and obtaining a detection result; and determining whether the to-be-detected Internet of Things equipment is an abnormal Internet of Things equipment according to the detection result. Compared with the prior art, the application optimizes and expands the selection range of the characteristics by combining the periodic time statistical characteristics and the general time statistical characteristics to select the flow characteristics, and designs an improved clustering abnormality analysis algorithm based on a weighted distance, so that the identification accuracy of a botnet in the Internet of Things equipment is more comprehensively and reliably improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of Internet of Things security, and particularly relates to a network detection method and device based on Internet of Things equipment, an equipment and a storage medium. BACKGROUND

[0002] With the rapid development of Internet of Things technology, smart home, smart medical care and intelligent transportation and other application scenarios are emerging, and the number of Internet of Things equipment is showing an exponential growth trend. Internet of Things applications bring convenience to human life, but also pose various security threats, among which botnets are one of the most dangerous security threats in the field of Internet of Things applications. For example, the Mirai botnet broke out in October 2016, which launched a denial-of-service attack on the domain name server managed by Dyn, a US company, by controlling 100,000 Internet of Things devices, causing Amazon and Twitter websites to be inaccessible for several hours, resulting in the paralysis of half of the Internet in the United States. Unlike traditional botnets, Internet of Things botnets can easily find vulnerable target devices and form a botnet through control nodes due to the large number of devices, and spread botnet viruses among a large number of Internet of Things terminal devices. Internet of Things botnets can also affect the surrounding physical environment, with stronger destructive power and greater destruction range.

[0003] Therefore, it is necessary to detect the security of Internet of Things botnets, and there are currently three types of technical methods: honeypot-based detection technology, host behavior-based detection technology and network traffic-based detection technology, but these methods all have the problems of easy evasion and high false positive rate. SUMMARY

[0004] The main purpose of the present application is to provide a network detection method, device, equipment and storage medium based on Internet of Things equipment, which aims to solve the technical problem of how to improve the identification accuracy of abnormal Internet of Things equipment in the prior art.

[0005] To achieve the above-mentioned purpose, the present application provides a network detection method based on Internet of Things equipment, which comprises the following steps:

[0006] When the to-be-detected Internet of Things equipment accesses the network, the periodic time statistical characteristics and the general time statistical characteristics of the to-be-detected Internet of Things equipment are obtained;

[0007] According to the periodic time statistical characteristics and the general time statistical characteristics, an unsupervised anomaly detection model is used for anomaly detection to obtain a detection result;

[0008] According to the detection result, it is determined whether the to-be-detected Internet of Things equipment is an abnormal Internet of Things equipment.

[0009] Optionally, the anomaly detection according to the periodic time statistical characteristics and the general time statistical characteristics through the unsupervised anomaly detection model obtains a detection result, including:

[0010] Selecting initial clustering centers from the periodic time statistical characteristics and the general time statistical characteristics;

[0011] Respectively acquiring weighting factors corresponding to the periodic time statistical characteristics and the general time statistical characteristics;

[0012] Performing anomaly detection according to the weighting factors and the initial clustering centers through a clustering model to obtain a detection result.

[0013] Optionally, the anomaly detection according to the weighting factors and the initial clustering centers through the clustering model to obtain the detection result includes:

[0014] Clustering the periodic time statistical characteristics and the general time statistical characteristics according to the weighting factors, the initial clustering centers and the clustering model to obtain clustering distances;

[0015] According to the clustering distances, obtaining probabilities that the periodic time statistical characteristics and the general time statistical characteristics are clustering centers;

[0016] According to the probabilities of the clustering centers, determining clustering centers to divide normal samples and abnormal samples to identify network intrusion to obtain a detection result.

[0017] Optionally, the acquiring the periodic time statistical characteristics and the general time statistical characteristics of the to-be-detected Internet of Things device when the to-be-detected Internet of Things device accesses a network includes:

[0018] When the to-be-detected Internet of Things device accesses a network, acquiring traffic data of the to-be-detected Internet of Things device;

[0019] Periodic traffic extraction is performed on the traffic data to obtain periodic traffic data;

[0020] According to the periodic traffic data, periodic time statistical characteristics and general time statistical characteristics are obtained.

[0021] Optionally, the periodic traffic extraction on the traffic data to obtain periodic traffic data includes:

[0022] According to the traffic data, determining a time sequence of a number of communication traffic bytes between each pair of addresses under the same protocol output from a cache, a time shift unit of an autocorrelation function and a length of a time window;

[0023] According to the time sequence, the time shift unit of the autocorrelation function and the length of the time window, determining the autocorrelation function;

[0024] According to the autocorrelation function, the mean of the time series and the variance of the time series, an autocorrelation coefficient is obtained;

[0025] According to the autocorrelation coefficient, periodic traffic extraction is performed on the traffic data to obtain periodic traffic data.

[0026] Optionally, periodic time statistical features are obtained according to the periodic traffic data, including:

[0027] Periodic interval features, frequency features, noise coefficient features and anomaly coefficient features in the periodic traffic data are extracted;

[0028] Periodic time statistical features are constructed according to the periodic interval features, frequency features, noise coefficient features and anomaly coefficient features.

[0029] Optionally, general time statistical features are obtained according to the periodic traffic data, including:

[0030] Data packets and data streams in the periodic traffic data are extracted;

[0031] Feature information elements in the data packets and data streams are determined through a damping sliding window model;

[0032] General time statistical features are constructed according to the feature information elements.

[0033] Optionally, the determination of the feature information elements in the data packets and data streams through the damping time window model includes:

[0034] A damping increment statistical tuple is determined according to the damping time window model, wherein the damping increment statistical tuple includes a current weight, a linear sum of a current data packet, a square sum of the current data packet and a feature between outbound traffic and inbound traffic;

[0035] The feature information elements in the data packets and data streams are determined according to the current weight, the linear sum of the current data packet, the square sum of the current data packet and the feature between the outbound traffic and the inbound traffic.

[0036] Optionally, before the periodic time statistical features and the general time statistical features of the to-be-detected Internet of Things device are obtained when the to-be-detected Internet of Things device accesses the network, the method further includes:

[0037] Protocol and port number feature information of an initial Internet of Things device is obtained;

[0038] The initial Internet of Things device is classified through a random forest algorithm according to the protocol and port number feature information to obtain a classified initial Internet of Things device;

[0039] matching the feature set of the classified initial Internet of Things device with a device type sample feature set, determining a device type of the classified initial Internet of Things device;

[0040] screening the classified initial Internet of Things device according to the device type of the classified initial Internet of Things device, and determining a to-be-detected Internet of Things device.

[0041] Optionally, the feature set of the classified initial Internet of Things device is matched with the device type sample feature set through a cosine similarity formula, and the cosine similarity formula is as follows:

[0042]

[0043] wherein V represents the feature set of the classified initial Internet of Things device, S represents the device type sample feature set, and m represents a sample quantity in the device type sample feature set. j

[0044] Optionally, the screening of the classified initial Internet of Things device according to the device type of the classified initial Internet of Things device, and the determination of the to-be-detected Internet of Things device, comprise:

[0045] comparing the device type of the classified initial Internet of Things device with a device type of a white list device;

[0046] screening the classified initial Internet of Things device according to a comparison result, and determining a to-be-detected Internet of Things device.

[0047] In addition, in order to achieve the above object, the application further provides a network detection device based on an Internet of Things device, which comprises:

[0048] an acquisition module, configured to acquire periodic time statistical features and general time statistical features of a to-be-detected Internet of Things device when the to-be-detected Internet of Things device accesses a network;

[0049] a detection module, configured to perform abnormality detection through an unsupervised abnormality detection model according to the periodic time statistical features and the general time statistical features, and obtain a detection result;

[0050] the detection module is further configured to determine whether the to-be-detected Internet of Things device is an abnormal Internet of Things device according to the detection result.

[0051] ​In addition, to achieve the above object, the present application also provides a network detection device based on Internet of Things equipment, which comprises a memory, a processor and a network detection program based on Internet of Things equipment stored in the memory and executable on the processor, and the network detection program based on Internet of Things equipment is configured to implement the network detection method based on Internet of Things equipment as described above.

[0052] In addition, to achieve the above object, the present application also provides a storage medium, which stores a network detection program based on Internet of Things equipment, and the network detection program based on Internet of Things equipment implements the network detection method based on Internet of Things equipment as described above when executed by a processor.

[0053] The network detection method based on Internet of Things equipment provided by the present application can obtain periodic time statistical characteristics and general time statistical characteristics of a to-be-detected Internet of Things equipment when the to-be-detected Internet of Things equipment accesses a network, perform abnormality detection through an unsupervised abnormality detection model according to the periodic time statistical characteristics and the general time statistical characteristics, obtain a detection result, and determine whether the to-be-detected Internet of Things equipment is an abnormal Internet of Things equipment according to the detection result. Compared with the prior art, the present application optimizes and expands the selection range of features by combining periodic time statistical characteristics and general time statistical characteristics for traffic feature selection, and more comprehensively and reliably improves the identification accuracy of a botnet in Internet of Things equipment. BRIEF DESCRIPTION OF DRAWINGS

[0054] Figure 1 Fig. 1 is a network detection device structure schematic diagram of a hardware running environment related to an embodiment scheme of the present application;

[0055] Figure 2 Fig. 2 is a flowchart of a first embodiment of the network detection method based on Internet of Things equipment of the present application;

[0056] Figure 3 Fig. 3 is a flowchart of a second embodiment of the network detection method based on Internet of Things equipment of the present application;

[0057] Figure 4 Fig. 4 is a flowchart of a third embodiment of the network detection method based on Internet of Things equipment of the present application;

[0058] Figure 5 Fig. 5 is a linear relationship of a sliding window and a window time interval corresponding to data flow and time of an embodiment of the network detection method based on Internet of Things equipment of the present application;

[0059] Figure 6 Fig. 6 is a whole flow framework schematic diagram of an embodiment of the network detection method based on Internet of Things equipment of the present application;

[0060] Figure 7 Figure 1 is a functional module schematic diagram of a first embodiment of the network detection device based on Internet of Things equipment according to the present application.

[0061] The implementation, functional features and advantages of the present application will be further described with reference to the embodiments and the accompanying drawings. DETAILED DESCRIPTION

[0062] It should be understood that the specific embodiments described herein are merely illustrative of the present application and are not intended to limit the present application.

[0063] Reference Figure 1 , Figure 1 Figure 2 is a device structure schematic diagram of a hardware operating environment involved in the embodiment scheme of the present application.

[0064] As Figure 1 shown, the device can include a processor 1001, such as a CPU, a communication bus 1002, a user interface 1003, a network interface 1004, and a memory 1005. The communication bus 1002 is used to realize the connection and communication between these components. The user interface 1003 can include a display screen (Display), an input unit such as a key, and the optional user interface 1003 can further include a standard wired interface, a wireless interface. The network interface 1004 can optionally include a standard wired interface, a wireless interface (such as a Wi-Fi interface). The memory 1005 can be a high-speed RAM memory, or a stable memory (non-volatile memory), such as a magnetic disk memory. The memory 1005 can optionally be a storage device independent of the aforementioned processor 1001.

[0065] Those skilled in the art can understand that Figure 1 the device structure shown in the figure does not constitute a limitation on the network detection device based on Internet of Things equipment, and can include more or fewer components than the figure, or combine certain components, or different component arrangements.

[0066] As Figure 1 shown, the memory 1005 as a storage medium can include an operating system, a network communication module, a user interface module, and a network detection program based on Internet of Things equipment.

[0067] In Figure 1In the network detection device based on the Internet of Things device shown, the network interface 1004 is mainly used to connect the device and communicate data with the device; the user interface 1003 is mainly used to connect the user terminal and communicate data with the terminal; the network detection device based on the Internet of Things device of the present invention calls the network detection program based on the Internet of Things device stored in the memory 1005 through the processor 1001, and executes the network detection method based on the Internet of Things device provided by the embodiment of the present invention.

[0068] Based on the above hardware structure, an embodiment of a network detection method based on an Internet of Things device of the present invention is proposed.

[0069] Reference Figure 2 , Figure 2 This is a flow chart of the first embodiment of the network detection method based on Internet of Things devices of the present invention.

[0070] In a first embodiment, the network detection method based on the Internet of Things device includes the following steps:

[0071] Step S10: When the IoT device to be detected accesses the network, periodic time statistical features and general time statistical features of the IoT device to be detected are obtained.

[0072] It should be noted that the execution entity of this embodiment can be a network detection device based on an Internet of Things device, or other devices that can achieve the same or similar functions, such as a gateway or server. This embodiment does not limit this. In this embodiment, a network detection device based on an Internet of Things device is used as an example for explanation.

[0073] In this embodiment, after the IoT device to be detected is connected to the network after being screened, the traffic data of the IoT device to be detected during data interaction in the IoT is collected, and features are extracted from the traffic data to obtain periodic time statistical features and general time statistical features of the IoT device to be detected, wherein the periodic time statistical features are periodic traffic features, such as period interval T, frequency F, noise factor NF, and variation coefficient CV, etc., and may also include other periodic parameters, and the general time statistical features include parameters representing traffic bandwidth, traffic rate, and delay characteristics between data packets in different traffic generation paths, such as the mean and mean square error of the outbound traffic bandwidth, and the weight reflecting the outbound traffic packet rate, etc., and may also include other characteristic parameters, which are not limited in this embodiment.

[0074] Step S20: performing anomaly detection using an unsupervised anomaly detection model according to the periodic time statistical features and the general time statistical features to obtain a detection result.

[0075] In the embodiment, periodic traffic features and general time statistical features are extracted, wherein the periodic time statistical features are The general time statistical features are The features can be comprehensively analyzed, the botnet behavior features are more comprehensively and effectively extracted, and the botnet is abnormally detected and recognized, so that the botnet detection capability is improved. In the selection of the abnormal detection and recognition algorithm, since the supervised machine learning method needs a large amount of manual participation to mark data, the unsupervised machine learning algorithm, that is, the unsupervised anomaly detection model, is adopted in the embodiment, so that the detection efficiency is improved.

[0076] In step S30, whether the to-be-detected Internet of Things device is an abnormal Internet of Things device is determined according to the detection result.

[0077] In a specific implementation, the analyzed feature objects are mainly divided into periodic behavior features and non-periodic behavior features. For a specific type of Internet of Things device, when in a botnet, the bot host will periodically receive instructions from a C&C server in a controlled process, and traffic data will usually show a certain periodicity, while a normal program does not have periodicity in the communication process. Therefore, the features proposed in the past cannot completely and effectively depict the communication behavior of the botnet, and the botnet behavior features are more comprehensively and effectively extracted in the embodiment, the abnormal device is more comprehensively recognized through periodic time statistical features and general time statistical features, and the botnet detection capability is improved.

[0078] In the embodiment, the periodic time statistical features and the general time statistical features of the to-be-detected Internet of Things device are acquired when the to-be-detected Internet of Things device accesses a network; abnormal detection is performed through an unsupervised anomaly detection model according to the periodic time statistical features and the general time statistical features, a detection result is obtained; and whether the to-be-detected Internet of Things device is an abnormal Internet of Things device is determined according to the detection result. Compared with the prior art, the periodic time statistical features and the general time statistical features are combined to select traffic features in the application, the selection range of the features is optimized and expanded, and the recognition accuracy of the botnet in the Internet of Things device is more comprehensively and reliably improved.

[0079] In an embodiment, as shown in FIG. 2, a second embodiment of the network detection method based on the Internet of Things device is provided based on the first embodiment, and the step S20 includes the following steps. Figure 3

[0080] In step S201, an initial clustering center is selected from the periodic time statistical features and the general time statistical features.

[0081] ​For the network anomaly detection, the clustering algorithm is a higher feasibility method, which divides each sample into a group, isolates normal and abnormal samples, and further identifies network intrusion in the abnormal group.

[0082] In step S202, the periodic time statistical features and the general time statistical features are respectively obtained.

[0083] In the embodiment, the wk-means++ algorithm based on the weighted distance is used to construct the unsupervised anomaly detection model based on the device type, different weights, i.e. the weighting factors, are given to the periodic time statistical features and the general time statistical features, and different influence factors are given to the periodic time statistical features of the botnet and the general time statistical features representing the non-periodic features, so as to comprehensively consider the features of the botnet.

[0084] In step S203, the anomaly detection is performed according to the weighting factors and the initial clustering center through the clustering model, and a detection result is obtained.

[0085] For different types of Internet of Things devices, the two types of traffic features, i.e. the periodic features and the non-periodic features, usually have different influence degrees on the detection and judgment result of the botnet. In the previous feature analysis and detection and judgment process, the influence degrees of the two types of features are not specifically distinguished, which affects the accuracy of the detection result. Therefore, the contribution of each type of traffic feature to the detection of the botnet is more comprehensively analyzed, different weighting factors are given to the two types of features of the botnet, i.e. the periodic features and the non-periodic features, and the wk-means++ clustering method based on the weighted distance is used for anomaly judgment, so as to comprehensively consider the features of the botnet and improve the security detection capability of the botnet.

[0086] It can be understood that, in order to perform anomaly judgment based on the wk-means++ clustering method based on the weighted distance, the periodic time statistical features and the general time statistical features are clustered according to the weighting factors, the initial clustering center and the clustering model, and a clustering distance is obtained; the probabilities of the periodic time statistical features and the general time statistical features as the clustering center are obtained according to the clustering distance; the clustering center is determined according to the probability of the clustering center, so as to divide the normal samples and the abnormal samples, identify network intrusion, and obtain a detection result.

[0087] In a specific implementation, the wk-means++ algorithm based on the weighted distance is as follows: first, a sample is randomly selected from a sample set X as an initial clustering center, denoted as o = {u 0,1 ,...,u 0,4 ,v 0,1 ,...,v 0,23}, secondly, the distance d(x) of each sample x={u x,1 ,...,u x,4 ,v x,1 ,...,v x,23} and each cluster center is calculated and the minimum value, that is, the distance of the nearest cluster center, is recorded as D(x). The cluster distance calculation formula is:

[0088]

[0089] Wherein, c u +c v =1, c u And c v Respectively represent the periodic time statistical characteristics and the general time statistical characteristics of the weighting factor, then calculate the probability p(x) of each sample being selected as the next cluster center:

[0090]

[0091] Then the next cluster center is selected according to the roulette method, and finally the cluster distance is repeatedly calculated until k cluster centers are selected, and the detection result is obtained according to the clustering result.

[0092] In this embodiment, by comprehensively analyzing the contribution of various traffic characteristics in botnet detection, the periodic characteristics and non-periodic characteristics of botnet are assigned different weighting factors, and the abnormality is determined based on the weighted distance wk-means++ clustering method, so as to comprehensively consider the characteristics of botnet and improve the security detection ability of botnet.

[0093] In an embodiment, as shown in Figure 4 The third embodiment of the network detection method based on the Internet of Things device of the present application is proposed based on the first embodiment or the second embodiment, and the first embodiment is taken as an example for description, and the step S10 comprises:

[0094] Step S101, when the to-be-detected Internet of Things device accesses the network, the traffic data of the to-be-detected Internet of Things device is acquired.

[0095] It should be noted that in the botnet, the bot host will periodically receive instructions from the C&C server in the controlled process, and the traffic data will usually show a certain periodicity, while the normal program does not have periodicity in the communication process. By identifying the periodicity of the traffic data to preliminarily detect the bot program, then analyzing the periodic behavior of the traffic and extracting a series of features, including periodic time statistical characteristics and general time statistical characteristics, and then comprehensively utilizing these features to build a classifier, the accurate identification of the botnet can be realized.

[0096] In step S102, periodic traffic extraction is performed on the traffic data to obtain periodic traffic data.

[0097] In a specific implementation, the time sequence corresponding to the number of bytes of communication traffic between each pair of addresses under the same protocol output from the cache, the time shift unit of the autocorrelation function, and the length of the time window are determined according to the traffic data, the autocorrelation function is determined according to the time sequence, the time shift unit of the autocorrelation function, and the length of the time window, the autocorrelation coefficient is obtained according to the autocorrelation function, the mean of the time sequence, and the variance of the time sequence, the periodic traffic extraction is performed on the traffic data according to the autocorrelation coefficient, and the periodic traffic data is obtained.

[0098] In this embodiment, the time sequence is x(i), the autocorrelation function is R x (j), the time shift unit is j, and the length of the time window is L. The autocorrelation function is a function for measuring the correlation degree between values at any two different times. For a periodic discrete time sequence, within a limited time window, as the time shift increases, the autocorrelation coefficient will periodically appear a larger inflection point value and gradually decrease. Within a predetermined time interval, x(i) represents all the number of bytes of communication traffic between each pair of addresses under the same protocol output from the cache, where i = 1, 2, 3, …, L, and there are L communication address pairs. After calculating the autocorrelation function R x (j) of the discrete time sequence x(i), the autocorrelation coefficient p x (j) of the autocorrelation function R x (j) can be further calculated, where j = 0, 1, 2, …, L-1, j is the time shift unit of the autocorrelation function, u x is the mean of the sequence x(i), and s x 2 is the variance of the sequence x(i). The formula used is:

[0099]

[0100]

[0101] A set of autocorrelation coefficient sequences can be obtained through the above operations. Within a window of a specified L, for a non-periodic sequence, the autocorrelation coefficient sequence usually has a small value and quickly decays as the time shift increases, while for a periodic sequence, the autocorrelation coefficient sequence will periodically appear an inflection point of a larger value. Therefore, if the determination threshold of the autocorrelation coefficient inflection point is P, whether the communication of the address pair within this L window satisfies periodicity can be determined in combination with the following formula.

[0102]

[0103] In step S103, the periodic time statistical features and general time statistical features are obtained according to the periodic traffic data.

[0104] Further, the periodic time statistical features are obtained according to the periodic traffic data, including:

[0105] The periodic interval feature, frequency feature, noise coefficient feature and anomaly coefficient feature in the periodic traffic data are extracted, and the periodic time statistical features are constructed according to the periodic interval feature, frequency feature, noise coefficient feature and anomaly coefficient feature.

[0106] After the periodic traffic screening is completed, the periodic traffic features can be further extracted, and the periodic time statistical feature vector is constructed The abnormal analysis is performed on all data units. The periodic traffic features are extracted, and a data unit can be formed by integrating these features. The data unit can be represented by a four-tuple structure, i.e. Wherein, u1, u2, u3 and u4 are the periodic interval T, frequency F, noise coefficient NF and anomaly coefficient CV, respectively.

[0107] It should be noted that the periodic interval T is the life cycle interval of the periodic flow. The botnet usually has a relatively short periodic interval, and the bot hosts belonging to the same botnet have the same periodic interval and similar life cycle. The frequency F is the frequency of the periodic flow. In order to avoid detection by the firewall, the botnet usually needs to maintain low-frequency communication, so the frequency of the botnet is usually smaller than that of the ordinary network periodic flow. The events of the botnet flow are often repeated in multiple time windows, generating a unified frequency, and are observed in the same time interval, which reflects the automated system characteristics of the botnet. The noise coefficient NF is the noise intensity of the periodic flow. The bot host usually maintains simple and low-frequency communication in the maintenance stage to maintain a low level of connection. The botnet has a lower noise coefficient than the ordinary network periodic flow, so the noise coefficient can be used to distinguish such flow. The noise coefficient is used to describe the proportion of noise in a periodic flow. The number of noise samples and normal samples in a periodic flow are denoted as F noise and F, respectively. The noise coefficient NF can be expressed as:

[0108]

[0109] Abnormal coefficient CV: that is, the degree of change of the periodic traffic data exchange. The ordinary Internet of Things traffic is usually not stable in the amount of data exchange in each cycle, and the sender and receiver will adjust the amount of data transmission according to the demand, while the botnet tends to be stable in the amount of data exchange in each cycle, and occasionally there is an extreme increase. Therefore, the abnormal coefficient can be used to measure the change of the amount of data exchange in each cycle of the periodic flow, so as to identify the botnet behavior. The abnormal coefficient CV can be obtained by calculating the quotient of the standard deviation and the average of the data traffic exchange amount of all connections in the connection set. Let the data traffic exchange amount in a connection set be n, and the data traffic exchange amount be C i (i = 1, 2, …, n), then the abnormal coefficient CV can be expressed as:

[0110]

[0111] Further, the general time statistical characteristics are obtained according to the periodic traffic data, including:

[0112] The data packets and data streams in the periodic traffic data are extracted, the feature information elements in the data packets and data streams are determined by the damping sliding window model, and the general time statistical characteristics are constructed according to the feature information elements.

[0113] It should be noted that in the Internet of Things anomaly detection, it is very important to capture the context information and destination features of the data packets in the network. The feature information element is defined as a basic element that can represent the basic characteristics of the traffic data packets and data streams, and can generate other composite features through some operations. For example, the size of a single data packet, the IP address, mac address, port number of the data packet, the number of data packets in a certain data stream, etc. When a data packet arrives, the data packet feature element information includes the source MAC address, the source IP address, the source TCP / UDP socket, the destination TCP / UDP socket, and the weight w. Based on these feature information elements, the characteristics of the transmission characteristics of the data packets are constructed, which represent the sender of the data packet and the traffic characteristics between the sender and the receiver of the data packet. The feature information elements in the data stream include the traffic generated by the source MAC address and the source IP address, the traffic generated by the source IP, the traffic transmitted between the source IP and the destination IP, and the traffic between the source TCP / UDP socket and the destination TCP / UDP socket. From the above traffic data packets, 23 statistical characteristics shown in the following table can be extracted to form a feature vector The general time statistical characteristic list is shown in Table 1 as follows.

[0114] By comprehensively considering the periodic and aperiodic nature of botnet communication traffic, this paper further optimizes feature selection and proposes a more comprehensive and robust method for selecting and combining botnet communication features. By establishing a damped sliding window to extract general temporal statistical features and combining them with the periodic characteristics of IoT device traffic, this approach provides a better foundation for botnet detection and analysis, helping to improve the accuracy of identifying botnets within IoT devices.

[0115] Considering the massive heterogeneity and resource constraints of IoT devices, lightweight, time-dependent statistical features can be used for anomaly detection to minimize computational energy consumption. To ensure that the statistical features represent the most recent behavior of the data stream, the data stream must discard relatively old packets. The most common approach is to maintain a sliding window. However, maintaining a window of packet data from each device model and continuously calculating statistics for these packets would result in a large memory footprint. To reduce memory consumption, this embodiment maintains incremental statistical information on a damping window, performing high-speed feature extraction based on temporal statistics on a dynamic number of data streams.

[0116] Table 1 List of general time statistical characteristics

[0117]

[0118] It should be noted that in the damped sliding window, the weight of the older value will gradually decrease exponentially over time. Let λ be the decay factor and t be the observation sequence S i The time interval from the last observation value to the current moment, the decay function can be defined as follows:

[0119] d λ (t) = 2 -λt ,λ>0

[0120] The damped sliding window specifies that the time interval of each window is fixed to Δt, and the data packets in the window are C Δt ={x1,x2,...,x n}, where n corresponds to the number of packets within different Δt. Each packet x i The corresponding weight is w i =d λ (t) = 2 -λt , so the weight sequence generated in different Δt is W Δt ={w1,w2,...,w n},like Figure 5 The linear relationship between the data stream and the sliding window corresponding to the time and the window time interval is shown.

[0121] Based on periodic traffic, the characteristics of botnet traffic are selected, general time statistical characteristics are extracted by establishing a damping sliding window, and the periodic characteristics of the traffic of the Internet of Things device are combined to further optimize and expand the selection of characteristics, thereby laying a better foundation for the detection and analysis of botnets and helping to improve the recognition accuracy of botnets in the Internet of Things device.

[0122] Further, the determination of the feature information element in the data packet and the data stream through the damping time window model comprises:

[0123] According to the damping time window model, a damping increment statistical tuple is determined, wherein the damping increment statistical tuple comprises a current weight, a linear sum of the current data packet, a square sum of the current data packet, and a feature between outbound traffic and inbound traffic, and the feature information element in the data packet and the data stream is determined according to the current weight, the linear sum of the current data packet, the square sum of the current data packet, and the feature between the outbound traffic and the inbound traffic.

[0124] In a specific implementation, since the sliding window model will cause high operation and storage complexity, in combination with the design of the damping time window, the damping increment statistical tuple can be defined as IS i,λ =(w,LS,SS,SR i,j ,T last ), wherein w is a current weight, T last represents a timestamp of the last update of IS i,λ , LS and SS are a linear sum and a square sum of the current data packet respectively, and SR i,j is used to calculate a statistical feature between outbound traffic i and inbound traffic j. The window updates data every time a new data packet is generated. The composite statistical feature is calculated as follows:

[0125] μ si =LS / w

[0126]

[0127]

[0128]

[0129]

[0130]

[0131] After the IoT device is identified as a device in the whitelist and is allowed to access the network, the device model is associated with the MAC address and IP address, and the anomaly detection model performs device model-based shunting on the traffic features according to the device model and the corresponding MAC and IP address information. In the next step, different device model-based traffic features can be used for corresponding device-based anomaly detection.

[0132] In this embodiment, based on periodic traffic, the zombie network traffic feature selection is performed, the general time statistical feature is extracted by establishing a damping sliding window, and it is combined with the periodic feature of the IoT device traffic, thereby further optimizing and expanding the selection of features, laying a better foundation for the detection and analysis of the zombie network, and helping to improve the identification accuracy of the zombie network in the IoT device.

[0133] Further, before the step S10, the method further comprises:

[0134] obtaining protocol and port number feature information of an initial IoT device; performing classification on the protocol and port number feature information by using a random forest algorithm to obtain a classified initial IoT device; performing similarity matching on a feature set of the classified initial IoT device and a device type sample feature set to determine a device type of the classified initial IoT device; and performing screening on the classified initial IoT device according to the device type of the classified initial IoT device to determine a to-be-detected IoT device.

[0135] It should be noted that when detecting the zombie network based on the network traffic of the IoT device, preliminary detection and filtering can be performed by identifying the device type. When a malicious IoT device type with vulnerabilities is accessed, its own vulnerabilities are easy to be exploited and produce zombie network attacks, etc. Therefore, device type identification at the beginning of IoT malicious device access can avoid the use of malicious device types and kill the zombie network threat at the source, which has good security defense effect.

[0136] According to the above analysis, a double high-precision detection strategy for IoT devices is designed to identify the IoT device type. First, the traffic features of the IoT device are extracted and a fingerprint is constructed, and a random forest algorithm is used to identify the device model once. Then, for similar device types that are difficult to distinguish, an improved cosine similarity calculation method is used for secondary identification, so as to obtain higher precision identification effect. After obtaining the device classification, the white list can be used to control the access of various devices, and the devices outside the white list are blocked outside to avoid the access of devices containing high-risk vulnerabilities, such as Figure 6 The overall flow framework diagram is shown in FIG. 1.

[0137] When the Internet of Things device first connects to the network and communicates with the gateway, the device will follow the device or vendor specific setting process to communicate. The embodiment adopts the traffic data format as the original pcap file, and extracts the traffic features in the pcap file from two aspects of protocol and port, such as link layer protocol (2): address resolution protocol (ARP) / logical link control (LLC), network layer protocol (4): IP / ICMP / ICMPV6 / EAP over LAN (EAPoL), transport layer protocol (2): TCP / UDP, application layer protocol (8): HTTP / HTTPS / DHCP / Bootstrap protocol (BOOTP) / simple service discovery protocol (SSDP) / domain name system (DNS) / multicast DNS (MDNS) / network time protocol (NTP), source / destination port number (2).

[0138] Since the above extracted features are packet header information, such a method can be used for encrypted traffic. In processing the extracted features, first, the protocol and port number are analyzed, and a one-dimensional feature vector f = {protocol, port} = {f1, f2,..., f 18} is obtained by corresponding value of each protocol and different port number. 16} is obtained by corresponding value of each protocol and different port number. i f 17 ∈{0,1} and port = {f 18 ,f i} f n ∈{0,3}

[0139] For port features, the port interval modeling method can be used to obtain:

[0140] where i = 0, 1, 2,..., 16

[0141] where i = 17, 18

[0142] The communication sequence in the setting process of different devices has differences. When a new device communicates with the gateway, the gateway records n communication data traffic packets p = {p1, p2,..., pn} of the device setting stage, and each packet extracts 18 features to form a vector p n . i= {f 1,i ,f 2,i ,...,f 18,i} where i∈{1,2,...,n}, the fingerprint of each device can be a 18*n matrix composed of the feature vector of n packets:

[0143]

[0144] Since the feature fingerprint belongs to high-dimensional data, in order to facilitate subsequent analysis, the row vectors of the feature matrix are spliced to obtain a one-dimensional row vector {f 1,1 ,f 1,2 ,...,f 1,n ,f 2,1 ,f 2,2 ,...,f 2,n ,...,f 18,n}. Then the feature fingerprint set of the device model in the training set is learned, the model is established and the training effect is evaluated by using the test set. We use the random forest algorithm to establish the detection model, and identify the type of Internet of Things device according to the traffic characteristics. The basis for selecting the random forest algorithm is that it is an integrated learning algorithm, which combines the classification results of multiple classifiers to classify the class of test samples, has better classification effect and generalization ability; secondly, randomly select a subset of features, without feature selection, can handle high-dimensional data; finally, each decision tree is independent in the algorithm training process, and the training speed is fast.

[0145] Further, the feature set of the classified initial Internet of Things device and the device type sample feature set are matched in similarity by a cosine similarity formula, and the cosine similarity formula is:

[0146]

[0147] wherein V represents the feature set of the classified initial Internet of Things device, S j represents the device type sample feature set, and m represents the number of samples in the device type sample feature set.

[0148] Continuing as shown in Figure 5 , in the secondary identification, the cosine similarity is selected as the similarity calculation index. For a device type sample set S = {S1, S2, S3,..., Sm} containing m samples, the feature quantity of S j ,...,S m} is {S j , S j1 , S j2 ,...,S j3 ,...,S ji ,...,S jn}, where n is the number of features. The device sample to be identified is recorded as V = {v1, v2, v3,..., vn}, and the calculation formula of the cosine similarity is: i ,...,v n} and the calculation formula of the cosine similarity is:

[0149]

[0150] For the above cosine similarity calculation process, the complexity of the algorithm is O(nm), and there is a problem of low calculation efficiency. Since each sample type has a certain number of devices, the feature vector of the device to be tested needs to be calculated with all the devices of each type, and then the average similarity of the device to be tested and each type is calculated and compared, which consumes a lot of calculation cost. Usually n is fixed, which can be reduced by feature screening, but the sample set used to optimize the algorithm is constantly expanding, so m becomes the bottleneck of the algorithm performance. Therefore, the sample can be preprocessed to reduce the complexity of the algorithm to O(n), and the improved cosine similarity calculation formula is:

[0151]

[0152] In summary, the improved cosine similarity can be used as an evaluation index for secondary classification to identify the type of Internet of Things devices with higher accuracy.

[0153] On the one hand, in the cosine similarity calculation, feature screening is used to simplify the calculation process, reducing the complexity of the algorithm from O(nm) to O(n), improving the calculation efficiency and reducing the time cost. On the other hand, in the anomaly detection analysis process, an unsupervised algorithm is used to establish an anomaly detection model, which does not require a large amount of manual data labeling and can save time and cost.

[0154] Further, the filtering of the classified initial Internet of Things devices according to the device type of the classified initial Internet of Things devices to determine the Internet of Things device to be detected comprises:

[0155] Comparing the device type of the classified initial Internet of Things device with the device type of the white list device; filtering the classified initial Internet of Things device according to the comparison result to determine the Internet of Things device to be detected.

[0156] In the embodiment, after the device is identified as a white list device and allowed to access the network, further continuous detection needs to be made for the security risks in the running process, so that the detection of the Internet of Things device is more targeted. Through the white list, malicious devices are screened and filtered, and effective security detection of the device access stage is realized. In the next step of anomaly analysis, only the devices in the white list need to be detected, which is more targeted and can reduce the subsequent workload.

[0157] Continuing as shown in Figure 5 , first, the Internet of Things device traffic is collected, feature extraction and fingerprint construction are performed, and an Internet of Things device double detection strategy based on improved cosine similarity calculation is designed, so as to realize high-precision identification of the device type, and according to the identification device type result, the white list is collated, and the devices not belonging to the white list are screened out. Further, the devices in the white list range still have security risks, which need to be further detected and analyzed, the self-similarity algorithm is used to extract periodic traffic, and a damping sliding window is established to obtain general time statistical features, which are comprehensively analyzed with periodic features, and a wk-means++ clustering algorithm based on weighted distance is designed for Internet of Things device anomaly detection and identification, forming a complete Internet of Things device traffic feature-based botnet detection scheme.

[0158] In the embodiment, an Internet of Things device double detection strategy based on similarity calculation is proposed to identify the device with high precision. First, the traffic features of different types of devices are extracted from the protocol and port levels, and a random forest algorithm is used to identify and classify different types of Internet of Things devices. Then, an improved cosine similarity calculation method is used to more accurately identify and distinguish similar devices. After completing the device type identification, malicious devices are screened and filtered through the white list, and effective security detection of the Internet of Things device access stage is realized.

[0159] The application further provides a network detection device based on an Internet of Things device.

[0160] Referring to Figure 7 , Figure 7 is a functional module schematic diagram of the first embodiment of the network detection device based on the Internet of Things device of the application.

[0161] In the first embodiment of the network detection device based on the Internet of Things device of the application, the network detection device based on the Internet of Things device comprises:

[0162] The acquisition module 10 is configured to acquire periodic time statistical features and general time statistical features of the Internet of Things device to be detected when the Internet of Things device to be detected accesses the network.

[0163] In the embodiment, after the to-be-detected Internet of Things device accesses the Internet of Things after being screened, traffic data of the to-be-detected Internet of Things device in the process of data interaction in the Internet of Things is collected, and the traffic data is subjected to feature extraction to obtain periodic time statistical features and general time statistical features of the to-be-detected Internet of Things device. The periodic time statistical features are periodic traffic features, for example, periodic interval T, frequency F, noise coefficient NF, and variation coefficient CV, and other periodic parameters can also be included. The general time statistical features include parameters representing traffic bandwidth, traffic rate, and inter-packet delay features in different traffic generation paths, for example, mean and mean square deviation reflecting outbound traffic bandwidth, and weight reflecting outbound traffic packet rate, and other feature parameters can also be included. The embodiment does not limit this.

[0164] The detection module 20 is configured to perform anomaly detection by using an unsupervised anomaly detection model according to the periodic time statistical features and the general time statistical features, to obtain a detection result.

[0165] In the embodiment, periodic traffic features and general time statistical features are extracted. The periodic time statistical features are periodic traffic features, for example, periodic interval T, frequency F, noise coefficient NF, and variation coefficient CV, and other periodic parameters can also be included. The general time statistical features include parameters representing traffic bandwidth, traffic rate, and inter-packet delay features in different traffic generation paths, for example, mean and mean square deviation reflecting outbound traffic bandwidth, and weight reflecting outbound traffic packet rate, and other feature parameters can also be included. The general time statistical features include parameters representing traffic bandwidth, traffic rate, and inter-packet delay features in different traffic generation paths, for example, mean and mean square deviation reflecting outbound traffic bandwidth, and weight reflecting outbound traffic packet rate, and other feature parameters can also be included. These features can be comprehensively analyzed, and the behavior features of the botnet are more comprehensively and effectively extracted, and anomaly detection and identification of the botnet are performed, thereby improving the botnet detection capability. In the selection of the anomaly detection and identification algorithm, since a supervised machine learning method needs a large amount of manual participation for marking data, the embodiment adopts an unsupervised machine learning algorithm, that is, an unsupervised anomaly detection model, thereby improving the detection efficiency.

[0166] The acquisition module 10 is further configured to determine whether the to-be-detected Internet of Things device is an abnormal Internet of Things device according to the detection result.

[0167] In a specific implementation, the analyzed feature objects are mainly divided into periodic behavior features and non-periodic behavior features. For a specific type of Internet of Things device, when in the botnet, the bot master will periodically receive instructions from the C&C server in the controlled process, and the traffic data will usually exhibit a certain periodicity, while the normal program does not usually have periodicity in the communication process. Therefore, the features proposed in the past cannot completely and effectively depict the communication behavior of the botnet, and the embodiment further more comprehensively and effectively extracts the behavior features of the botnet, and performs abnormal device identification through the periodic time statistical features and the general time statistical features, thereby improving the botnet detection capability.

[0168] In the embodiment, the periodic time statistical features and the general time statistical features of the to-be-detected Internet of Things device are acquired when the to-be-detected Internet of Things device accesses a network; the unsupervised anomaly detection model is used for anomaly detection according to the periodic time statistical features and the general time statistical features, and a detection result is obtained; and whether the to-be-detected Internet of Things device is an abnormal Internet of Things device is determined according to the detection result. Compared with the prior art, the periodic time statistical features and the general time statistical features are combined to select traffic features, the selection range of the features is optimized and expanded, and the identification accuracy of the botnet in the Internet of Things device is more comprehensively and reliably improved.

[0169] In an embodiment, the detection module 20 is further configured to select an initial clustering center from the periodic time statistical features and the general time statistical features.

[0170] The weighting factors corresponding to the periodic time statistical features and the general time statistical features are respectively acquired.

[0171] The anomaly detection is performed according to the weighting factors and the initial clustering center through a clustering model, and a detection result is obtained.

[0172] In an embodiment, the detection module 20 is further configured to cluster the periodic time statistical features and the general time statistical features according to the weighting factors, the initial clustering center and the clustering model, and obtain a clustering distance.

[0173] The probability that the periodic time statistical features and the general time statistical features are the clustering center is obtained according to the clustering distance.

[0174] The clustering center is determined according to the probability of the clustering center, so as to divide the normal samples and the abnormal samples, identify network intrusion, and obtain a detection result.

[0175] In an embodiment, the acquisition module 10 is further configured to acquire traffic data of a to-be-detected Internet of Things device when the to-be-detected Internet of Things device accesses a network.

[0176] The periodic traffic of the traffic data is extracted, and periodic traffic data is obtained.

[0177] The periodic time statistical features and the general time statistical features are obtained according to the periodic traffic data.

[0178] In an embodiment, the acquisition module 10 is further configured to determine, according to the traffic data, a time sequence of the number of communication traffic bytes between each pair of addresses under the same protocol output from a cache, a time shift unit of an autocorrelation function and the length of a time window.

[0179] determining the autocorrelation function according to the time series, a time shift unit of the autocorrelation function and a length of the time window;

[0180] obtaining an autocorrelation coefficient according to the autocorrelation function, a mean of the time series and a variance of the time series;

[0181] extracting periodic traffic from the traffic data according to the autocorrelation coefficient to obtain periodic traffic data.

[0182] In an embodiment, the obtaining module 10 is further configured to extract periodic interval features, frequency features, noise coefficient features and anomaly coefficient features from the periodic traffic data;

[0183] constructing periodic time statistical features according to the periodic interval features, the frequency features, the noise coefficient features and the anomaly coefficient features.

[0184] In an embodiment, the obtaining module 10 is further configured to extract data packets and data flows from the periodic traffic data;

[0185] determining feature information elements in the data packets and the data flows by a damping sliding window model;

[0186] constructing general time statistical features according to the feature information elements.

[0187] In an embodiment, the obtaining module 10 is further configured to determine damping increment statistical tuples according to the damping time window model, wherein the damping increment statistical tuples include a current weight, a linear sum of a current data packet, a square sum of the current data packet and a feature between outbound traffic and inbound traffic;

[0188] determining the feature information elements in the data packets and the data flows according to the current weight, the linear sum of the current data packet, the square sum of the current data packet and the feature between the outbound traffic and the inbound traffic.

[0189] In an embodiment, the obtaining module 10 is further configured to obtain protocol and port number feature information of an initial Internet of Things device;

[0190] classifying the initial Internet of Things device according to the protocol and the port number feature information by a random forest algorithm to obtain a classified initial Internet of Things device;

[0191] performing similarity matching between a feature set of the classified initial Internet of Things device and a device type sample feature set to determine a device type of the classified initial Internet of Things device;

[0192] screening the classified initial Internet of Things device according to the device type of the classified initial Internet of Things device to determine a to-be-detected Internet of Things device.

[0193] In an embodiment, the classified initial Internet of Things device feature set and the device type sample feature set are matched in similarity by a cosine similarity formula, the cosine similarity formula being:

[0194]

[0195] wherein V represents the classified initial Internet of Things device feature set, S j represents the device type sample feature set, and m represents the number of samples in the device type sample feature set.

[0196] In an embodiment, the acquisition module 10 is further configured to compare the device type of the classified initial Internet of Things device with the device type of the white list device.

[0197] The classified initial Internet of Things device is screened according to the comparison result, and a to-be-detected Internet of Things device is determined.

[0198] In addition, to achieve the above object, the present application further provides a network detection device based on an Internet of Things device, which comprises a memory, a processor, and a network detection program based on an Internet of Things device stored in the memory and executable on the processor, and the network detection program based on an Internet of Things device is configured to implement the network detection method based on an Internet of Things device as described above.

[0199] Since the network detection device based on an Internet of Things device adopts all the technical solutions of the above embodiments, it at least has all the beneficial effects brought by the technical solutions of the above embodiments, which will not be repeated here.

[0200] In addition, the present application further provides a storage medium, which stores a network detection program based on an Internet of Things device, and the network detection program based on an Internet of Things device is executed by a processor to implement the network detection method based on an Internet of Things device as described above.

[0201] Since the storage medium adopts all the technical solutions of the above embodiments, it at least has all the beneficial effects brought by the technical solutions of the above embodiments, which will not be repeated here.

[0202] It should be noted that, in this document, the terms "comprises", "comprising", or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can also include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element preceded by "comprises... a" does not, without more constraints, foreclose the existence of additional identical elements in the process, method, article, or apparatus that comprises the recited element.

[0203] The above-mentioned embodiment numbers of the present application are only for description, and do not represent the advantages and disadvantages of the embodiments.

[0204] From the above description of the embodiments, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be realized by means of software and the necessary general hardware platform, of course, they can also be realized by hardware, but in many cases the former is a better embodiment. Based on such understanding, the technical solutions of the present application can be embodied in the form of a software product, which is stored in a computer readable storage medium (such as a ROM / RAM, a magnetic disk, or an optical disk) as described above, and includes a number of instructions for causing an intelligent terminal (which can be a mobile phone, a computer, a device, an air conditioner, or a network device, etc.) to perform the methods described in the various embodiments of the present application.

[0205] The above is only the preferred embodiment of the present application, and does not limit the patent scope of the present application, and any equivalent structure or equivalent process transformation, or direct or indirect application in other related technical fields, is also included in the patent protection scope of the present application.

Claims

1. A network detection method based on an Internet of Things device, characterized in that, The network detection method based on the Internet of Things device comprises: When a to-be-detected Internet of Things device accesses a network, periodic time statistical features and general time statistical features of the to-be-detected Internet of Things device are acquired, the periodic time statistical features at least comprising periodic interval features, frequency features, noise coefficient features and anomaly coefficient features, the general time statistical features at least comprising a mean value reflecting an outbound traffic bandwidth, a mean square error reflecting the outbound traffic bandwidth and a weight reflecting an outbound traffic packet rate, the anomaly coefficient features being a change degree of periodic traffic data exchange; abnormality detection is performed through an unsupervised abnormality detection model according to the periodic time statistical features and the general time statistical features, and a detection result is obtained; whether the to-be-detected Internet of Things device is an abnormal Internet of Things device is determined according to the detection result; The acquisition of the periodic time statistical features and the general time statistical features of the to-be-detected Internet of Things device when the to-be-detected Internet of Things device accesses the network comprises: when the to-be-detected Internet of Things device accesses the network, traffic data of the to-be-detected Internet of Things device is acquired; periodic traffic is extracted from the traffic data, and periodic traffic data is obtained; the periodic time statistical features and the general time statistical features are obtained according to the periodic traffic data; wherein the general time statistical features are obtained according to the periodic traffic data, comprising: data packets and data streams in the periodic traffic data are extracted; a damping increment statistical tuple is determined according to a damping time window model, the damping increment statistical tuple comprising a current weight, a linear sum of current data packets, a square sum of the current data packets and a feature between outbound traffic and inbound traffic; feature information elements in the data packets and the data streams are determined according to the current weight, the linear sum of the current data packets, the square sum of the current data packets and the feature between the outbound traffic and the inbound traffic; the general time statistical features are constituted according to the feature information elements; The abnormality detection through the unsupervised abnormality detection model according to the periodic time statistical features and the general time statistical features, and the obtaining of the detection result, comprise: initial clustering centers are selected from the periodic time statistical features and the general time statistical features; weighting factors corresponding to the periodic time statistical features and the general time statistical features are respectively acquired; According to the weighting factor, the initial clustering center and the clustering model, the periodic time statistical features and the general time statistical features are clustered to obtain a clustering distance, and a calculation formula of the clustering distance D(x) is x is a sample in the sample set X, x={u x,1 ,...,u x,4 ,v x,1 ,...,v x,23}, u x,i and v x,i are the ith periodic time statistical feature and the general time statistical feature respectively, c u and c v are the weighting factors of the periodic time statistical feature and the general time statistical feature respectively, c u +c v =1, u 0,i and v 0,i represent the initial clustering center; According to the clustering distance, the periodic time statistical feature and the probability that the general time statistical feature is a clustering center are obtained, and a calculation formula of the probability p(x) that the periodic time statistical feature and the general time statistical feature are clustering centers is the clustering centers are determined according to probabilities of the clustering centers, so as to divide normal samples and abnormal samples, identify network intrusion and obtain the detection result.

2. The Internet of Things device based network detection method of claim 1, wherein, The periodic traffic extraction from the traffic data, and the obtaining of the periodic traffic data, comprise: time series corresponding to communication traffic byte numbers between each pair of addresses under the same protocol output from a cache, a time shift unit of an autocorrelation function and a length of a time window are determined according to the traffic data; the autocorrelation function is determined according to the time series, the time shift unit of the autocorrelation function and the length of the time window; an autocorrelation coefficient is obtained according to the autocorrelation function, a mean value of the time series and a variance of the time series; the periodic traffic is extracted from the traffic data according to the autocorrelation coefficient, and the periodic traffic data is obtained.

3. The Internet of Things device based network detection method of any one of claims 1 or 2, wherein, Before the periodic time statistical characteristics and the general time statistical characteristics of the to-be-detected Internet of Things device are acquired when the to-be-detected Internet of Things device accesses a network, the method further includes: acquiring protocol and port number characteristic information of an initial Internet of Things device; performing classification according to the protocol and port number characteristic information through a random forest algorithm to obtain a classified initial Internet of Things device; performing similarity matching of a feature set of the classified initial Internet of Things device with a device type sample feature set to determine a device type of the classified initial Internet of Things device; performing screening of the classified initial Internet of Things device according to the device type of the classified initial Internet of Things device to determine a to-be-detected Internet of Things device.

4. The Internet of Things device based network detection method of claim 3, wherein, The similarity matching of the feature set of the classified initial Internet of Things device with the device type sample feature set is performed through a cosine similarity formula, and the cosine similarity formula is: wherein V represents the feature set of the classified initial Internet of Things device, S j represents the device type sample feature set, and m represents the number of samples in the device type sample feature set.

5. The Internet of Things device based network detection method of claim 3, wherein, The screening of the classified initial Internet of Things device according to the device type of the classified initial Internet of Things device to determine a to-be-detected Internet of Things device includes: comparing the device type of the classified initial Internet of Things device with a device type of a white list device; performing screening of the classified initial Internet of Things device according to a comparison result to determine a to-be-detected Internet of Things device.

6. An Internet of Things device based network detection apparatus, comprising: The network detection device based on an Internet of Things device includes: an acquisition module, configured to acquire periodic time statistical characteristics and general time statistical characteristics of a to-be-detected Internet of Things device when the to-be-detected Internet of Things device accesses a network, wherein the periodic time statistical characteristics at least include periodic interval characteristics, frequency characteristics, noise coefficient characteristics, and anomaly coefficient characteristics, the general time statistical characteristics at least include a mean value reflecting an outbound traffic bandwidth, a mean square error reflecting the outbound traffic bandwidth, and a weight reflecting an outbound traffic packet rate, and the anomaly coefficient characteristics are a change degree of periodic traffic data exchange; a detection module, configured to perform abnormality detection through an unsupervised abnormality detection model according to the periodic time statistical characteristics and the general time statistical characteristics to obtain a detection result; the detection module is further configured to determine whether the to-be-detected Internet of Things device is an abnormal Internet of Things device according to the detection result; the acquisition module is further configured to acquire traffic data of the to-be-detected Internet of Things device when the to-be-detected Internet of Things device accesses the network; periodic traffic is extracted from the traffic data to obtain periodic traffic data; the periodic time statistical characteristics and the general time statistical characteristics are obtained according to the periodic traffic data; the acquisition module is further configured to extract data packets and data streams in the periodic traffic data; a damping increment statistical tuple is determined according to a damping time window model, and the damping increment statistical tuple includes a current weight, a linear sum of current data packets, a square sum of the current data packets, and characteristics between outbound traffic and inbound traffic; feature information elements in the data packets and the data streams are determined according to the current weight, the linear sum of the current data packets, the square sum of the current data packets, and the characteristics between the outbound traffic and the inbound traffic; the general time statistical characteristics are constituted according to the feature information elements. The detection module is further configured to select an initial clustering center from the periodic time statistical features and the general time statistical features; Weighting factors corresponding to the periodic time statistical features and the general time statistical features are respectively acquired; According to the weighting factor, the initial clustering center and the clustering model, the periodic time statistical features and the general time statistical features are clustered to obtain a clustering distance, and a calculation formula of the clustering distance D(x) is x is a sample in the sample set X, x={u x,1 ,...,u x,4 ,v x,1 ,...,v x,23}, u x,i and v x,i are the ith periodic time statistical feature and the general time statistical feature respectively, c u and c v are the weighting factors of the periodic time statistical feature and the general time statistical feature respectively, c u +c v =1, u 0,i and v 0,i represent the initial clustering center; According to the clustering distance, the periodic time statistical feature and the probability that the general time statistical feature is a clustering center are obtained, and a calculation formula of the probability p(x) that the periodic time statistical feature and the general time statistical feature are clustering centers is A clustering center is determined according to the probability of the clustering center, so as to divide normal samples and abnormal samples, identify network intrusion, and obtain a detection result.

7. An Internet of Things device based network detection device, comprising: The network detection device based on the Internet of Things device comprises a memory, a processor, and a network detection program based on the Internet of Things device stored on the memory and capable of running on the processor. The network detection program based on the Internet of Things device is configured to implement the network detection method based on the Internet of Things device according to any one of claims 1 to 5.

8. A storage medium, characterized by The storage medium stores a network detection program based on the Internet of Things device. The network detection program based on the Internet of Things device is executed by the processor to implement the network detection method based on the Internet of Things device according to any one of claims 1 to 5.

Images