A method for constructing security attribute portrait of power Internet of Things terminal

Abstract

The present invention relates to a method for constructing a security attribute portrait of an electric power Internet of Things terminal, comprising the following steps: step 1, obtaining device status information and basic information to form a basic attribute portrait; step 2, obtaining CSI channel data associated with the electric power Internet of Things terminal device to construct a channel attribute portrait; step 3, collecting and obtaining flow data associated with the electric power Internet of Things terminal device to construct a flow behavior attribute portrait, thereby completing the construction of a security attribute portrait of the electric power Internet of Things. The present invention can solve the problem of being unable to perceive network attack behaviors launched after the legitimate terminal identity is stolen.

Description

Technical Field

[0001] The present invention belongs to the field of information and communication technology, and relates to a method for constructing a portrait of an electric power Internet of Things terminal, and in particular to a method for constructing a security attribute portrait of an electric power Internet of Things terminal. Background Art

[0002] At present, there is a security risk of "one-time authentication, always trust" after the power Internet of Things terminal is connected through identity authentication. This is mainly because there is no relevant method to control the credibility of its network access behavior, resulting in the problem that network attacks launched by the stolen identity of the legitimate terminal cannot be detected.

[0003] The existing security attribute portraits of power Internet of Things terminals are mainly one-sidedly focused on the analysis of data traffic and the construction of traffic behavior portraits, ignoring the overall security attributes of the terminal, and the effect of traffic analysis is not ideal.

[0004] After searching, no patent documents of the prior art that are identical or similar to the present invention were found. Summary of the invention

[0005] The purpose of the present invention is to overcome the fact that the existing technology is based on experience but lacks a theoretical support system, and proposes a method for constructing a security attribute portrait of a power Internet of Things terminal, which can solve the problem of being unable to perceive network attacks launched after the legitimate terminal identity is stolen.

[0006] The present invention solves the practical problem by adopting the following technical solutions:

[0007] A method for constructing a security attribute portrait of a power Internet of Things terminal comprises the following steps:

[0008] Step 1: Obtain device status information and basic information to form a basic attribute profile;

[0009] Step 2: Obtain CSI channel data associated with the power IoT terminal device and construct a channel attribute profile;

[0010] Step 3: Collect and obtain the flow data associated with the power Internet of Things terminal equipment, build a flow behavior attribute portrait, and then complete the construction of the security attribute portrait of the power Internet of Things terminal.

[0011] Moreover, the specific steps of step 1 include:

[0012] (1) Obtaining device status information and basic information: The terminal device status information is obtained through self-test reporting information, and the basic information is obtained after successful identity authentication;

[0013] Among them, the device status information includes interface status, port status, and permission status, and the basic information includes the device identification number;

[0014] (2) Label the acquired device status information and basic information, and fill in the acquired numerical or text information values ​​to form a basic attribute profile.

[0015] Moreover, the specific steps of step 2 include:

[0016] (1) The power Internet of Things terminal device sends a signal frame, from which the edge gateway collects the channel state information CSI associated with the power Internet of Things terminal device;

[0017] Among them, the channel state information CSI associated with the power Internet of Things terminal device includes the channel impulse response (CIR) and the channel frequency response (CFR), and its calculation formula is as follows:

[0018] The expression of CIR is:

[0019]

[0020] where α l (t),φ l (t) and τ l (t) are the amplitude attenuation, phase shift and time delay of the lth path, L(t) is the total number of paths, and δ(·) is the unit pulse function.

[0021] The expression of CFR is:

[0022]

[0023] where τ max is the maximum channel delay;

[0024] (2) Label the collected CSI channel data to form a channel attribute profile.

[0025] Moreover, the specific steps of step 3 include:

[0026] (1) Generate a pcap file of the bidirectional traffic associated with the power IoT terminal device through tool capture, and then extract the pcap file of the same flow based on the quintuple;

[0027] The five-tuple includes the source IP address, the destination IP address, the source port number, the destination port number, and the protocol used.

[0028] (2) Use graph neural networks to classify traffic data, construct traffic behavior attribute portraits, and then complete the construction of security attribute portraits for power Internet of Things terminals.

[0029] Moreover, the specific steps of step 3 (2) include:

[0030] ①Data preprocessing:

[0031] Preprocess the pcap files of the same stream: for each packet in the same stream, delete the data link layer information and mask the source and destination IP addresses;

[0032] ②Build a graph including nodes, edges, and global attributes based on the preprocessed data:

[0033] Each flow represents a graph, and each data packet in a flow represents a node, which includes the original byte data of the data, and the time sequence relationship between the data packets is used to represent the edge, which is a directed edge. Finally, the global attributes use the seven metadata features commonly used in a flow.

[0034] Among them, the seven metadata features are source port number, destination port number, payload average, packet length average, payload standard deviation, packet length standard deviation, and flow duration.

[0035] ③Put the graph containing nodes, edges, and global attributes into the training model for training:

[0036] Put the graph containing nodes, edges, and global attributes into the graph neural network model for training, output the classification type, and form a terminal traffic behavior attribute portrait;

[0037] A 5-layer MLP (multi-layer perceptron) is constructed for each node, edge, and global attribute in a graph, and the predicted probability vector is obtained using the softmax function. Represents G i The probability of belonging to the traffic type is as follows:

[0038]

[0039] The loss function formula is:

[0040] in is the prediction vector, y is the true classification value, and α is the penalty weight vector.

[0041] ④ Comprehensively construct the security attribute portraits of the above three aspects, and finally complete the construction of the security attribute portrait of the power Internet of Things terminal.

[0042] Advantages and beneficial effects of the present invention:

[0043] The present invention proposes a method for constructing a security attribute portrait of an electric power Internet of Things terminal, including four parts: relevant data collection, basic attribute portrait construction, channel attribute portrait construction, and traffic behavior attribute portrait construction. The present invention is suitable for a zero-trust architecture, and can provide a good basis for continuous trust evaluation, effectively collect data, process data, and save and utilize data. The present invention constructs a basic security attribute portrait by constructing a portrait of multi-dimensional security attributes in the security of the electric power Internet of Things terminal, and can make a preliminary security judgment on the device. For the construction of channel attribute portraits, the security of the channel can be monitored in real time to ensure communication security. The use of graph neural networks to construct traffic behavior attribute portraits has better classification effects and higher accuracy, and can avoid adversarial attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 A flowchart for constructing a security attribute portrait of the power Internet of Things terminal of the present invention;

[0045] Figure 2 A flowchart for constructing a traffic behavior attribute portrait based on a graph neural network in the present invention. DETAILED DESCRIPTION

[0046] The embodiments of the present invention are further described in detail below with reference to the accompanying drawings:

[0047] A method for constructing a security attribute portrait of a power Internet of Things terminal, such as Figure 1 and Figure 2 As shown, the following steps are included:

[0048] Step 1: Obtain device status information and basic information to form a basic attribute profile;

[0049] Step 2: Obtain CSI channel data associated with the power IoT terminal device and construct a channel attribute profile;

[0050] Step 3: Collect and obtain the flow data associated with the power Internet of Things terminal equipment, build a flow behavior attribute portrait, and then complete the construction of the security attribute portrait of the power Internet of Things terminal.

[0051] The specific steps of step 1 include:

[0052] (1) Obtaining device status information and basic information: The terminal device status information is obtained through self-test reporting information, and the basic information is obtained after successful identity authentication;

[0053] Among them, the device status information includes interface status, port status, and permission status, and the basic information includes the device identification number.

[0054] (2) Label the acquired device status information and basic information, and fill in the acquired numerical or text information values ​​to form a basic attribute profile.

[0055] The specific steps of step 2 include:

[0056] (1) The power Internet of Things terminal device sends a signal frame, from which the edge gateway collects the channel state information CSI associated with the power Internet of Things terminal device;

[0057] Among them, the channel state information CSI associated with the power Internet of Things terminal device includes the channel impulse response (CIR) and the channel frequency response (CFR), and its calculation formula is as follows:

[0058] The expression of CIR is:

[0059]

[0060] where α l (t),φ l (t) and τ l (t) are the amplitude attenuation, phase shift and time delay of the lth path, L(t) is the total number of paths, and δ(·) is the unit pulse function.

[0061] The expression of CFR is:

[0062]

[0063] where τ max is the maximum channel delay.

[0064] (2) Label the collected CSI channel data to form a channel attribute profile.

[0065] The specific steps of step 3 include:

[0066] (1) Generate a pcap file of the bidirectional traffic associated with the power IoT terminal device through tool capture, and then extract the pcap file of the same flow based on the quintuple;

[0067] The five-tuple includes the source IP address, the destination IP address, the source port number, the destination port number, and the protocol used.

[0068] (2) Use graph neural networks to classify traffic data, build traffic behavior attribute portraits, and then complete the construction of security attribute portraits for power Internet of Things terminals;

[0069] The specific steps of step (2) of step 3 include:

[0070] ①Data preprocessing:

[0071] Preprocess the pcap files of the same stream: for each packet in the same stream, delete the data link layer information and mask the source and destination IP addresses;

[0072] ②Build a graph including nodes, edges, and global attributes based on the preprocessed data:

[0073] Each flow represents a graph, and each data packet in a flow represents a node, which includes the original byte data of the data, and the time sequence relationship between the data packets is used to represent the edge, which is a directed edge. Finally, the global attributes use the seven metadata features commonly used in a flow.

[0074] Among them, the seven metadata features are source port number, destination port number, payload average, packet length average, payload standard deviation, packet length standard deviation, and flow duration.

[0075] ③Put the graph containing nodes, edges, and global attributes into the training model for training:

[0076] Put the graph containing nodes, edges, and global attributes into the graph neural network model for training, output the classification type, and form a terminal traffic behavior attribute portrait;

[0077] A 5-layer MLP (multi-layer perceptron) is constructed for each node, edge, and global attribute in a graph, and the predicted probability vector is obtained using the softmax function. Represents G i The probability of belonging to the traffic type is as follows:

[0078]

[0079] The loss function formula is:

[0080] in is the prediction vector, y is the true classification value, and α is the penalty weight vector.

[0081] ④Combining the construction of the security attribute portraits of the above three aspects, finally completing the construction of the terminal entity security attribute portrait.

[0082] It should be emphasized that the embodiments of the present invention are illustrative rather than restrictive. Therefore, the present invention includes but is not limited to the embodiments described in the specific implementation modes. Any other implementation modes derived by those skilled in the art based on the technical solutions of the present invention also fall within the scope of protection of the present invention.

Claims

1. A method for constructing a security attribute portrait of a power Internet of Things terminal, characterized by: The following steps are involved: Step 1: Obtain device status information and basic information to form a basic attribute profile; Step 2: Obtain CSI channel data associated with the power IoT terminal device and construct a channel attribute profile; Step 3: Collect and obtain the flow data associated with the power Internet of Things terminal equipment, build a flow behavior attribute portrait, and then complete the construction of the security attribute portrait of the power Internet of Things; The specific steps of step 3 include: (1) Generate a pcap file of the bidirectional traffic associated with the power IoT terminal device through tool capture, and then extract the pcap file of the same flow based on the quintuple; Among them, the five-tuple includes the source IP address, the destination IP address, the source port number, the destination port number and the protocol used; (2) Use graph neural networks to classify traffic data, build traffic behavior attribute portraits, and then complete the construction of security attribute portraits for the power Internet of Things; The specific steps of step (2) of step 3 include: ①Data preprocessing: Preprocess the pcap files of the same stream: for each packet in the same stream, delete the data link layer information and mask the source and destination IP addresses; ②Build a graph including nodes, edges, and global attributes based on the preprocessed data: Each flow represents a graph, and each data packet in a flow represents a node, which includes the raw byte data of the data, and the time sequence relationship between data packets represents the edge, which is a directed edge. Finally, the global attributes use the seven metadata features common to a flow; Among them, the seven metadata features are source port number, destination port number, payload mean, packet length mean, payload standard deviation, packet length standard deviation, and flow duration; ③Put the graph containing nodes, edges, and global attributes into the training model for training: Put the graph containing nodes, edges, and global attributes into the graph neural network model for training, output the classification type, and form a terminal traffic behavior attribute portrait; ④ Comprehensively construct the security attribute portrait of the three aspects of steps 1 to 3, and finally complete the construction of the security attribute portrait of the power Internet of Things; The specific steps of step 1 include: (1) Obtaining device status information and basic information: The terminal device status information is obtained through self-test reporting information, and the basic information is obtained after successful identity authentication; Among them, the device status information includes interface status, port status, and permission status, and the basic information includes the device identification number; (2) Label the acquired device status information and basic information by attributes, and fill in the acquired numerical or text information values ​​to form a basic attribute profile; The specific steps of step 2 include: (1) The power Internet of Things terminal device sends a signal frame, from which the edge gateway collects the channel state information CSI associated with the power Internet of Things terminal device; Among them, the channel state information CSI associated with the power Internet of Things terminal device includes the channel impulse response CIR and the channel frequency response CFR, and its calculation formula is as follows: The expression of CIR is: where α l (t),φ l (t) and τ l (t) are the amplitude attenuation, phase shift and time delay of the lth path, L(t) is the total number of paths, and δ(·) is the unit pulse function; The expression of CFR is: where τ max is the maximum channel delay; (2) Label the collected CSI channel data to form a channel attribute profile.

Images