A connection status monitoring method and system based on Internet of Things device communication access

Abstract

The present invention discloses a connection status monitoring method and system based on the communication access of Internet of Things devices, which relates to the field of communication status monitoring technology, including: obtaining historical communication data of the communication process of Internet of Things devices, and learning to obtain a standard communication status library of Internet of Things devices; obtaining real-time communication connection data; comparing the real-time communication connection data with the standard communication status library of Internet of Things devices to determine whether there is a connection communication anomaly in the Internet of Things device; performing a device connection status test on the abnormal device, and determining whether there is a hijacking risk for the abnormal device based on the device connection status test result. The advantages of the present invention are: this scheme can accurately identify when lawbreakers invade and hijack Internet of Things devices and send abnormal connection access behaviors through Internet of Things devices, and protect the Internet of Things network, which can effectively improve the communication data security of the Internet of Things network.

Description

Technical Field

[0001] The present invention relates to the technical field of communication status monitoring, and in particular to a connection status monitoring method and system based on Internet of Things device communication access to the network. Background Art

[0002] The Internet of Things refers to the use of various devices and technologies such as information sensors, radio frequency identification technology, global positioning system, infrared sensors, laser scanners, etc. to collect any objects or processes that need to be monitored, connected, and interacted in real time, and collect various required information such as sound, light, heat, electricity, mechanics, chemistry, biology, and location. Through various possible network access, it realizes ubiquitous connection between objects and objects and between objects and people, and realizes intelligent perception, identification, and management of objects and processes. The Internet of Things is an information carrier based on the Internet, traditional telecommunications networks, etc. It allows all ordinary physical objects that can be independently addressed to form an interconnected network.

[0003] With the development of Internet of Things technology, the concept of the Internet of Everything has gradually entered various fields. However, the existing technology lacks effective means to monitor the connection status of Internet of Things devices connected to the communication network, and lacks effective identification of abnormal connection status of Internet of Things devices. When Internet of Things devices are invaded and hijacked by criminals, there are great risks to the security of network connection. Summary of the invention

[0004] In order to solve the above technical problems, a connection status monitoring method and system based on the communication network access of Internet of Things devices are provided. This technical solution solves the problem that in the above-mentioned prior art, there is a lack of effective connection status monitoring means for Internet of Things devices connected to the communication network, and there is a lack of effective identification of abnormal connection status of Internet of Things devices. When the Internet of Things devices are invaded and hijacked by criminals, there are great risks in network connection security.

[0005] In order to achieve the above purpose, the technical solution adopted by the present invention is:

[0006] A method for monitoring the connection status of an IoT device based on communication access to a network, comprising:

[0007] Obtain historical communication data of the IoT device communication process, and learn based on the historical communication data of the IoT device communication process to obtain a standard communication status library of the IoT device;

[0008] Acquire real-time communication connection data during the communication process of the IoT device, which is recorded as real-time communication connection data;

[0009] Based on the comparison between the real-time communication connection data and the standard communication status library of the IoT device, it is determined whether there is any abnormality in the connection communication of the IoT device. If so, the IoT device is marked as an abnormal device. If not, no response is given.

[0010] Perform a device connection status test on the abnormal device, and determine whether the abnormal device has a hijacking risk based on the device connection status test result. If so, cut off the network communication connection of the abnormal device; if not, remove the abnormal device mark of the IoT device.

[0011] Preferably, the acquiring of historical communication data of the IoT device communication process, and learning based on the historical communication data of the IoT device communication process, to acquire a standard communication status library of the IoT device specifically includes:

[0012] Perform access feature splitting on each piece of historical communication data to obtain a number of access features corresponding to each piece of historical communication data, which are recorded as sample access features;

[0013] Count all sample access features and establish a set of access features that correspond to IoT devices one by one;

[0014] A feature correlation algorithm is used to calculate the correlation rationality between any two access features in the access feature set;

[0015] The access feature set and the correlation rationality between any two access features in the access feature set are encapsulated into a standard communication state library with one-to-one correspondence between IoT devices.

[0016] Preferably, the feature correlation algorithm is specifically:

[0017] Selecting a sample access feature from the access feature set as an analysis feature, and obtaining a number of historical communication data in which the analysis feature appears as first sample communication data;

[0018] Obtaining the quantity of first sample communication data;

[0019] Perform access feature splitting on each piece of first sample communication data to obtain a plurality of access features corresponding to each piece of first sample communication data, which are recorded as relevant access features corresponding to the analysis features;

[0020] Determine a number of communication data having relevant access features in the first sample communication data, and record them as second sample communication data corresponding to the relevant access features;

[0021] Acquire the second sample communication data quantity corresponding to the relevant access feature;

[0022] The correlation rationality between the analysis feature and the related access feature is calculated by using the correlation calculation formula;

[0023] Traversing all sample access features in the access feature set, and calculating the correlation rationality between each sample access feature and the related access feature corresponding to the sample access feature;

[0024] Wherein, the correlation calculation formula is:

[0025]

[0026] Wherein, X is the correlation rationality between the analysis feature and the relevant access feature, K1 is the number of first sample communication data, and K2 is the number of second sample communication data corresponding to the relevant access feature.

[0027] Preferably, comparing the real-time communication connection data with a standard communication status library of the IoT device to determine whether there is a connection communication anomaly in the IoT device specifically includes:

[0028] Performing access feature splitting on the real-time communication connection data to obtain real-time access features, and counting all the real-time access features to establish a real-time access feature set corresponding to the real-time communication connection data;

[0029] Retrieve from the access feature set corresponding to the IoT device and obtain the sample access feature corresponding to each real-time access feature;

[0030] Based on the standard communication status library and real-time access feature set corresponding to the IoT devices, the communication rationality index calculation formula is used to calculate the communication rationality index of the real-time communication connection data;

[0031] Determine whether the communication rationality index is greater than a preset value. If so, it is determined that there is no connection communication abnormality in the IoT device. If not, it is determined that there is a connection communication abnormality in the IoT device.

[0032] The calculation formula of the communication rationality index is specifically as follows:

[0033]

[0034] Where H is the communication rationality index of real-time communication connection data, n is the total number of real-time access features, and K i is the number of the first sample communication data corresponding to the i-th real-time access feature, K0 is the total number of historical communication data, X ij is the correlation rationality between the ith real-time access feature and the jth real-time access feature in the real-time access feature set except the ith real-time access feature.

[0035] Preferably, the performing a device connection status test on the abnormal device specifically includes:

[0036] Obtain the historical communication delay of the abnormal device, and analyze the historical communication delay of the abnormal device to determine the standard communication delay of the abnormal device;

[0037] Send communication test data to the abnormal device and wait for the abnormal device to return the test message;

[0038] Determine whether the received test message is complete. If so, it means that the abnormal device has a risk of communication hijacking. If not, determine whether the interval between sending communication test data and receiving the test message returned by the abnormal device is less than the standard communication delay of the abnormal device. If so, it is determined that the abnormal device does not have a risk of communication hijacking. If not, it is determined that the abnormal device has a risk of communication hijacking.

[0039] Preferably, the analyzing based on the historical communication delay of the abnormal device to determine the standard communication delay of the abnormal device specifically includes:

[0040] Based on the skewness-kurtosis test method, the abnormal delay fluctuation of the historical communication delay of abnormal equipment is identified, and the abnormal delay fluctuation in the historical communication delay of abnormal equipment is eliminated to obtain the standard communication delay data;

[0041] Calculate the standard communication delay of abnormal equipment based on the standard communication delay data;

[0042] Wherein, the expression of the skewness-kurtosis test method is:

[0043]

[0044] Where n is the ordinal number of the historical communication delay to be tested in the order of small to large among all historical communication delays, D i is the i-th historical communication delay that is ranked before the historical communication delay to be tested in ascending order among all historical communication delays, is the average value of all historical communication delays, bp(n) is the critical value of the skewness-kurtosis test, if the expression of the skewness-kurtosis test method is satisfied, it means that the historical communication delay to be tested and the historical communication delays that are ranked after the historical communication delay to be tested in ascending order are all abnormal delay fluctuations;

[0045] The standard communication delay of the abnormal device is specifically:

[0046]

[0047] Among them, B0 is the standard communication delay of abnormal equipment, is the average value of all standard communication delay data, m is the total number of all standard communication delay data, d j is the j-th standard communication delay data.

[0048] Furthermore, a connection status monitoring system based on Internet of Things device communication access to the network is proposed, which is used to implement the connection status monitoring method based on Internet of Things device communication access to the network as mentioned above, including:

[0049] A deep learning module, wherein the deep learning module is used to obtain historical communication data of the communication process of the IoT device, and to learn based on the historical communication data of the communication process of the IoT device to obtain a standard communication status library of the IoT device;

[0050] A real-time communication acquisition module, which is used to obtain real-time communication connection data during the communication process of the Internet of Things device, recorded as real-time communication connection data;

[0051] A communication action analysis module, the communication action analysis module is electrically connected to the deep learning module and the real-time communication acquisition module, and the communication action analysis module is used to compare the real-time communication connection data with the standard communication status library of the Internet of Things device to determine whether there is a connection communication anomaly of the Internet of Things device;

[0052] A communication test module is used to perform a device connection status test on an abnormal device and determine whether the abnormal device has a hijacking risk based on the device connection status test result.

[0053] Optionally, the deep learning module includes:

[0054] A first feature splitting unit, the first feature splitting unit is used to split the access features of each piece of historical communication data, obtain a number of access features corresponding to each piece of historical communication data, record them as sample access features, count all sample access features, and establish an access feature set corresponding to the IoT device one by one;

[0055] A correlation calculation unit, wherein the correlation calculation unit is used to calculate the correlation rationality between any two access features in the access feature set using a feature correlation algorithm, and encapsulate the access feature set and the correlation rationality between any two access features in the access feature set into a standard communication state library with a one-to-one correspondence between IoT devices.

[0056] Optionally, the communication action analysis module includes:

[0057] A second feature splitting unit, the second feature splitting unit is used to perform access feature splitting on the real-time communication connection data to obtain real-time access features, and to count all real-time access features to establish a real-time access feature set corresponding to the real-time communication connection data;

[0058] A retrieval unit, the retrieval unit is used to retrieve from the access feature set corresponding to the IoT device, and obtain a sample access feature corresponding to each real-time access feature;

[0059] A calculation unit, the calculation unit is used to calculate the communication rationality index of the real-time communication connection data using a communication rationality index calculation formula based on a standard communication state library and a real-time access feature set corresponding to the Internet of Things device;

[0060] The judgment unit is used to judge whether the communication rationality index is greater than a preset value. If so, it is determined that there is no connection communication abnormality in the Internet of Things device. If not, it is determined that there is a connection communication abnormality in the Internet of Things device.

[0061] Optionally, the communication test module specifically includes:

[0062] A standard learning unit, wherein the standard learning unit is used to obtain a historical communication delay of an abnormal device, and analyze the historical communication delay of the abnormal device to determine a standard communication delay of the abnormal device;

[0063] A test execution unit, the test execution unit is used to send communication test data to the abnormal device and wait for the abnormal device to return a test message;

[0064] A data integrity verification unit, the data integrity verification unit is used to determine whether the received test message is complete;

[0065] A delay verification unit is used to determine whether the interval between sending communication test data and receiving the test message returned by the abnormal device is less than the standard communication delay of the abnormal device.

[0066] Compared with the prior art, the present invention has the following beneficial effects:

[0067] The present invention proposes a connection status monitoring scheme based on the communication access of Internet of Things devices. The scheme learns based on the normal connection access actions of Internet of Things devices, obtains the standard communication status library of Internet of Things devices, and analyzes various communication connection behaviors during the connection process of Internet of Things devices based on the standard communication status library of Internet of Things devices. When the Internet of Things device has abnormal connection access behavior, the connection status of the Internet of Things device is tested. In this way, when lawbreakers invade and hijack Internet of Things devices and send abnormal connection access behaviors through Internet of Things devices, accurate identification can be performed, and the Internet of Things network can be protected, which can effectively improve the communication data security of the Internet of Things network. BRIEF DESCRIPTION OF THE DRAWINGS

[0068] Figure 1 This is a flow chart of the connection status monitoring method based on the communication access of the Internet of Things device proposed by the present invention;

[0069] Figure 2 A flow chart of the method for obtaining a standard communication status library of an Internet of Things device in the present invention;

[0070] Figure 3 is a method flow chart of the feature correlation algorithm in the present invention;

[0071] Figure 4This is a flow chart of the method for determining whether there is a connection communication anomaly in an IoT device in the present invention;

[0072] Figure 5 A flow chart of a method for testing the device connection status of an abnormal device in the present invention;

[0073] Figure 6 This is a flow chart of the method for determining the standard communication delay of an abnormal device in the present invention. DETAILED DESCRIPTION

[0074] The following description is used to disclose the present invention so that those skilled in the art can implement the present invention. The preferred embodiments described below are only examples, and those skilled in the art may think of other obvious variations.

[0075] Reference Figure 1 As shown, a connection status monitoring method based on Internet of Things device communication access to the network includes:

[0076] Obtain historical communication data of the IoT device communication process, and learn based on the historical communication data of the IoT device communication process to obtain a standard communication status library of the IoT device;

[0077] Acquire real-time communication connection data during the communication process of the IoT device, which is recorded as real-time communication connection data;

[0078] Based on the comparison between the real-time communication connection data and the standard communication status library of the IoT device, it is determined whether there is any abnormality in the connection communication of the IoT device. If so, the IoT device is marked as an abnormal device. If not, no response is given.

[0079] Perform a device connection status test on the abnormal device, and determine whether the abnormal device has a hijacking risk based on the device connection status test result. If so, cut off the network communication connection of the abnormal device; if not, remove the abnormal device mark of the IoT device.

[0080] This solution is based on learning the normal connection access actions of IoT devices, obtaining the standard communication status library of IoT devices, and analyzing the various communication connection behaviors during the connection process of IoT devices based on the standard communication status library of IoT devices. When the IoT device has abnormal connection access behavior, the connection status of the IoT device is tested.

[0081] Reference Figure 2 As shown, the historical communication data of the IoT device communication process is obtained, and learning is performed based on the historical communication data of the IoT device communication process. The standard communication status library of the IoT device is obtained, which specifically includes:

[0082] Perform access feature splitting on each piece of historical communication data to obtain a number of access features corresponding to each piece of historical communication data, which are recorded as sample access features;

[0083] Count all sample access features and establish a set of access features that correspond to IoT devices one by one;

[0084] A feature correlation algorithm is used to calculate the correlation rationality between any two access features in the access feature set;

[0085] The access feature set and the correlation rationality between any two access features in the access feature set are encapsulated into a standard communication state library with one-to-one correspondence between IoT devices.

[0086] Reference Figure 3 As shown, the feature correlation algorithm is specifically:

[0087] Selecting a sample access feature from the access feature set as an analysis feature, and obtaining a number of historical communication data in which the analysis feature appears as first sample communication data;

[0088] Obtaining the quantity of first sample communication data;

[0089] Perform access feature splitting on each piece of first sample communication data to obtain a plurality of access features corresponding to each piece of first sample communication data, which are recorded as relevant access features corresponding to the analysis features;

[0090] Determine a number of communication data having relevant access features in the first sample communication data, and record them as second sample communication data corresponding to the relevant access features;

[0091] Acquire the second sample communication data quantity corresponding to the relevant access feature;

[0092] The correlation rationality between the analysis feature and the related access feature is calculated by using the correlation calculation formula;

[0093] Traversing all sample access features in the access feature set, and calculating the correlation rationality between each sample access feature and the related access feature corresponding to the sample access feature;

[0094] The correlation calculation formula is:

[0095]

[0096] Wherein, X is the correlation rationality between the analysis feature and the relevant access feature, K1 is the number of first sample communication data, and K2 is the number of second sample communication data corresponding to the relevant access feature.

[0097] It is understandable that IoT devices usually have their own unique access characteristics during normal operation. For example, surveillance cameras usually only have access characteristics such as monitoring image acquisition, image data writing, and image screen analysis during normal operation. Based on this, this solution conducts access feature learning on the historical communication data of each IoT device during its historical operation, obtains the standard access feature library of IoT devices, and calculates the correlation and rationality between the access features, which is used as a benchmark sample library for analyzing the communication behavior of IoT devices.

[0098] Reference Figure 4 As shown, based on the comparison between the real-time communication connection data and the standard communication status library of the IoT device, it is determined whether there is a connection communication anomaly of the IoT device, specifically including:

[0099] Performing access feature splitting on the real-time communication connection data to obtain real-time access features, and counting all the real-time access features to establish a real-time access feature set corresponding to the real-time communication connection data;

[0100] Retrieve from the access feature set corresponding to the IoT device and obtain the sample access feature corresponding to each real-time access feature;

[0101] Based on the standard communication status library and real-time access feature set corresponding to the IoT devices, the communication rationality index calculation formula is used to calculate the communication rationality index of the real-time communication connection data;

[0102] Determine whether the communication rationality index is greater than a preset value. If so, it is determined that there is no connection communication abnormality in the IoT device. If not, it is determined that there is a connection communication abnormality in the IoT device.

[0103] Among them, the calculation formula of communication rationality index is as follows:

[0104]

[0105] Where H is the communication rationality index of real-time communication connection data, n is the total number of real-time access features, and K i is the number of the first sample communication data corresponding to the i-th real-time access feature, K0 is the total number of historical communication data, X ij is the correlation rationality between the ith real-time access feature and the jth real-time access feature in the real-time access feature set except the ith real-time access feature.

[0106] In this solution, it can be understood that when criminals invade and hijack IoT devices, they usually make abnormal communication access behaviors in the IoT network that are inconsistent with the normal operation of IoT devices through IoT devices. For example, when a surveillance camera is hijacked, abnormal communication access that affects data transmission will usually occur. The traffic consumption of data transmission will be much greater than the traffic consumption of normal uploading of data to the IoT cloud. Based on this, this solution analyzes the access behavior of real-time communication connection data and calculates the rationality of access features for each behavior data of real-time communication connection data. This part of the calculation consists of two parts. One part is the proportion of access features in historical communication data, that is, This value represents whether the access feature is a regular access action of the IoT device. The other part is That is, the comprehensive rationality of the access feature and other access features in the real-time communication connection data is calculated. The larger the value, the higher the rationality of the simultaneous appearance of all access features in the real-time communication connection data. The rationality of all access features is averaged as the communication rationality index of the real-time communication connection data. The larger the index, the closer the real-time communication connection data is to the standard communication state of the Internet of Things device represented by the standard communication state library, and the lower the security risk of the real-time communication connection data.

[0107] Reference Figure 5 As shown in the figure, the device connection status test for the abnormal device specifically includes:

[0108] Obtain the historical communication delay of the abnormal device, and analyze the historical communication delay of the abnormal device to determine the standard communication delay of the abnormal device;

[0109] Send communication test data to the abnormal device and wait for the abnormal device to return the test message;

[0110] Determine whether the received test message is complete. If so, it means that the abnormal device has a risk of communication hijacking. If not, determine whether the interval between sending communication test data and receiving the test message returned by the abnormal device is less than the standard communication delay of the abnormal device. If so, it is determined that the abnormal device does not have a risk of communication hijacking. If not, it is determined that the abnormal device has a risk of communication hijacking.

[0111] Reference Figure 6 As shown, based on the analysis of the historical communication delay of the abnormal device, the standard communication delay of the abnormal device is determined to include:

[0112] Based on the skewness-kurtosis test method, the abnormal delay fluctuation of the historical communication delay of abnormal equipment is identified, and the abnormal delay fluctuation in the historical communication delay of abnormal equipment is eliminated to obtain the standard communication delay data;

[0113] Calculate the standard communication delay of abnormal equipment based on the standard communication delay data;

[0114] Among them, the expression of the skewness-kurtosis test method is:

[0115]

[0116] Where n is the ordinal number of the historical communication delay to be tested in the order of small to large among all historical communication delays, D i is the i-th historical communication delay that is ranked before the historical communication delay to be tested in ascending order among all historical communication delays, is the average value of all historical communication delays, bp(n) is the critical value of the skewness-kurtosis test, if the expression of the skewness-kurtosis test method is satisfied, it means that the historical communication delay to be tested and the historical communication delays that are ranked after the historical communication delay to be tested in ascending order are all abnormal delay fluctuations;

[0117] The standard communication delay of abnormal equipment is as follows:

[0118]

[0119] Among them, B0 is the standard communication delay of abnormal equipment, is the average value of all standard communication delay data, m is the total number of all standard communication delay data, d j is the j-th standard communication delay data.

[0120] It is understandable that when criminals invade and hijack IoT devices, they usually intercept data in the IoT network through IoT devices. Based on this, when conducting a device connection status test, this solution first determines the integrity of the test message. If the test guarantee is incomplete, it means that there is a risk of data leakage in the communication process of the IoT device. In addition, a communication delay test is also performed to determine the standard communication delay of the abnormal device based on the standard delay data of the IoT device during normal communication, and to identify the delay test data of the IoT device's network access communication, in order to determine whether the IoT device has data leakage risks such as data outflow or data duplication.

[0121] Further, based on the same inventive concept as the above-mentioned connection status monitoring method based on the communication access of the Internet of Things device, the present solution also proposes a connection status monitoring system based on the communication access of the Internet of Things device, including:

[0122] A deep learning module is used to obtain historical communication data of the communication process of IoT devices, and to learn based on the historical communication data of the communication process of IoT devices to obtain a standard communication status library of IoT devices;

[0123] A real-time communication acquisition module is used to obtain real-time communication connection data during the communication process of the IoT device, which is recorded as real-time communication connection data;

[0124] A communication action analysis module, which is electrically connected to the deep learning module and the real-time communication acquisition module. The communication action analysis module is used to compare the real-time communication connection data with the standard communication status library of the IoT device to determine whether there is a connection communication anomaly in the IoT device;

[0125] The communication test module is used to test the device connection status of abnormal devices and determine whether the abnormal device has a hijacking risk based on the device connection status test results.

[0126] The deep learning modules include:

[0127] A first feature splitting unit, which is used to split access features of each piece of historical communication data, obtain a number of access features corresponding to each piece of historical communication data, record them as sample access features, count all sample access features, and establish an access feature set corresponding to the IoT device one by one;

[0128] The correlation calculation unit is used to calculate the correlation rationality between any two access features in the access feature set using a feature correlation algorithm, and encapsulate the access feature set and the correlation rationality between any two access features in the access feature set into a standard communication state library that corresponds one to one with the Internet of Things devices.

[0129] The communication action analysis module includes:

[0130] A second feature splitting unit, the second feature splitting unit is used to split the access feature of the real-time communication connection data to obtain real-time access features, and count all real-time access features to establish a real-time access feature set corresponding to the real-time communication connection data;

[0131] A retrieval unit, the retrieval unit is used to retrieve from the access feature set corresponding to the IoT device, and obtain a sample access feature corresponding to each real-time access feature;

[0132] A calculation unit, the calculation unit is used to calculate the communication rationality index of the real-time communication connection data by using a communication rationality index calculation formula based on a standard communication state library and a real-time access feature set corresponding to the IoT device;

[0133] The judgment unit is used to judge whether the communication rationality index is greater than a preset value. If so, it is determined that there is no connection communication abnormality in the Internet of Things device. If not, it is determined that there is a connection communication abnormality in the Internet of Things device.

[0134] The communication test module specifically includes:

[0135] A standard learning unit, which is used to obtain the historical communication delay of the abnormal device, and analyze the historical communication delay of the abnormal device to determine the standard communication delay of the abnormal device;

[0136] A test execution unit, the test execution unit is used to send communication test data to the abnormal device and wait for the abnormal device to return a test message;

[0137] A data integrity verification unit, the data integrity verification unit is used to determine whether the received test message is complete;

[0138] The delay verification unit is used to determine whether the interval between sending communication test data and receiving the test message returned by the abnormal device is less than the standard communication delay of the abnormal device.

[0139] The usage process of the above-mentioned connection status monitoring system based on the communication of IoT devices to the network is as follows:

[0140] Step 1: The first feature splitting unit performs access feature splitting on each piece of historical communication data, obtains a number of access features corresponding to each piece of historical communication data, records them as sample access features, counts all sample access features, and establishes an access feature set corresponding to each IoT device one by one;

[0141] Step 2: The correlation calculation unit uses a feature correlation algorithm to calculate the correlation rationality between any two access features in the access feature set, and encapsulates the access feature set and the correlation rationality between any two access features in the access feature set into a standard communication state library with one-to-one correspondence between IoT devices;

[0142] Step 3: The real-time communication acquisition module obtains the real-time communication connection data during the communication process of the IoT device, which is recorded as the real-time communication connection data;

[0143] Step 4: The second feature splitting unit performs access feature splitting on the real-time communication connection data to obtain real-time access features, and counts all real-time access features to establish a real-time access feature set corresponding to the real-time communication connection data;

[0144] Step 5: The retrieval unit retrieves the access feature set corresponding to the IoT device to obtain a sample access feature corresponding to each real-time access feature;

[0145] Step 6: The calculation unit calculates the communication rationality index of the real-time communication connection data using a communication rationality index calculation formula based on the standard communication state library and the real-time access feature set corresponding to the IoT device;

[0146] Step 7: The judgment unit judges whether the communication rationality index is greater than a preset value. If so, it is determined that there is no connection communication abnormality in the IoT device. If not, it is determined that there is a connection communication abnormality in the IoT device.

[0147] Step 8: The standard learning unit obtains the historical communication delay of the abnormal device, and analyzes the historical communication delay of the abnormal device to determine the standard communication delay of the abnormal device;

[0148] Step 9: The test execution unit sends communication test data to the abnormal device and waits for the abnormal device to return a test message;

[0149] Step 10: The data integrity verification unit determines whether the received test message is complete;

[0150] Step 11: The delay verification unit determines whether the interval between sending the communication test data and receiving the test message returned by the abnormal device is less than the standard communication delay of the abnormal device.

[0151] To sum up, the advantages of the present invention are: this solution can accurately identify when criminals invade and hijack IoT devices and send abnormal connection access behaviors through IoT devices, and protect the IoT network, which can effectively improve the communication data security of the IoT network.

[0152] The above shows and describes the basic principles, main features and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The above embodiments and descriptions only describe the principles of the present invention. The present invention may be subject to various changes and improvements without departing from the spirit and scope of the present invention. These changes and improvements fall within the scope of the present invention. The scope of protection claimed by the present invention is defined by the attached claims and their equivalents.

Claims

1. A method for monitoring the connection status of an Internet of Things device based on communication access to the network, characterized in that: include: Obtain historical communication data of the IoT device communication process, and learn based on the historical communication data of the IoT device communication process to obtain a standard communication status library of the IoT device; Acquire real-time communication connection data during the communication process of the IoT device, which is recorded as real-time communication connection data; Based on the comparison between the real-time communication connection data and the standard communication status library of the IoT device, it is determined whether there is any abnormality in the connection communication of the IoT device. If so, the IoT device is marked as an abnormal device. If not, no response is given. Perform a device connection status test on the abnormal device, and determine whether the abnormal device has a hijacking risk based on the device connection status test result. If so, cut off the network communication connection of the abnormal device; if not, remove the abnormal device mark of the IoT device; The obtaining of historical communication data of the IoT device communication process, and learning based on the historical communication data of the IoT device communication process to obtain a standard communication status library of the IoT device specifically includes: Perform access feature splitting on each piece of historical communication data to obtain a number of access features corresponding to each piece of historical communication data, which are recorded as sample access features; Count all sample access features and establish a set of access features that correspond to IoT devices one by one; A feature correlation algorithm is used to calculate the correlation rationality between each sample access feature in the access feature set and the related access feature corresponding to the sample access feature; Encapsulate the access feature set and the correlation rationality between each sample access feature in the access feature set and the related access feature corresponding to the sample access feature into a standard communication state library corresponding to one of the IoT devices; The feature correlation algorithm is specifically: Selecting a sample access feature from the access feature set as an analysis feature, and obtaining a number of historical communication data in which the analysis feature appears as first sample communication data; Obtaining the quantity of first sample communication data; Perform access feature splitting on each piece of first sample communication data to obtain a plurality of access features corresponding to each piece of first sample communication data, which are recorded as relevant access features corresponding to the analysis features; Determine a number of communication data having relevant access features in the first sample communication data, and record them as second sample communication data corresponding to the relevant access features; Acquire the second sample communication data quantity corresponding to the relevant access feature; The correlation rationality between the analysis feature and the related access feature is calculated by using the correlation calculation formula; Traversing all sample access features in the access feature set, and calculating the correlation rationality between each sample access feature and the related access feature corresponding to the sample access feature; Wherein, the correlation calculation formula is: In the formula, To analyze the reasonableness of the correlation between features and related access features, is the number of first sample communication data, is the amount of second sample communication data corresponding to the relevant access feature; The comparison between the real-time communication connection data and the standard communication status library of the IoT device to determine whether the IoT device has a connection communication anomaly specifically includes: Performing access feature splitting on the real-time communication connection data to obtain real-time access features, and counting all the real-time access features to establish a real-time access feature set corresponding to the real-time communication connection data; Retrieve from the access feature set corresponding to the IoT device and obtain the sample access feature corresponding to each real-time access feature; Based on the standard communication status library and real-time access feature set corresponding to the IoT devices, the communication rationality index calculation formula is used to calculate the communication rationality index of the real-time communication connection data; Determine whether the communication rationality index is greater than a preset value. If so, it is determined that there is no connection communication abnormality in the IoT device. If not, it is determined that there is a connection communication abnormality in the IoT device. The calculation formula of the communication rationality index is specifically as follows: In the formula, Communication reasonable indicators for real-time communication connection data, is the total number of real-time access features, is the number of the first sample communication data corresponding to the i-th real-time access feature, is the total amount of historical communication data, is the correlation rationality between the ith real-time access feature and the jth real-time access feature in the real-time access feature set except the ith real-time access feature.

2. According to claim 1, a method for monitoring the connection status of an IoT device based on communication access to the network is characterized in that: The device connection status test is performed on the abnormal device, and judging whether the abnormal device has a hijacking risk based on the device connection status test result specifically includes: Obtain the historical communication delay of the abnormal device, and analyze the historical communication delay of the abnormal device to determine the standard communication delay of the abnormal device; Send communication test data to the abnormal device and wait for the abnormal device to return the test message; Determine whether the received test message is complete. If so, it means that the abnormal device has a risk of communication hijacking. If not, determine whether the interval between sending communication test data and receiving the test message returned by the abnormal device is less than the standard communication delay of the abnormal device. If so, it is determined that the abnormal device does not have a risk of communication hijacking. If not, it is determined that the abnormal device has a risk of communication hijacking.

3. A method for monitoring the connection status of an IoT device based on communication access to a network according to claim 2, characterized in that: The analyzing based on the historical communication delay of the abnormal device to determine the standard communication delay of the abnormal device specifically includes: Based on the skewness-kurtosis test method, the abnormal delay fluctuation of the historical communication delay of abnormal equipment is identified, and the abnormal delay fluctuation in the historical communication delay of abnormal equipment is eliminated to obtain the standard communication delay data; Calculate the standard communication delay of abnormal equipment based on the standard communication delay data; Wherein, the expression of the skewness-kurtosis test method is: Where n is the ordinal number of the historical communication delay to be tested in the order of small to large among all historical communication delays, is the i-th historical communication delay that is ranked before the historical communication delay to be tested in ascending order among all historical communication delays, is the average value of all historical communication delays, is the critical value of the skewness-kurtosis test. If the expression of the skewness-kurtosis test method is satisfied, it means that the historical communication delay to be tested and the historical communication delays that are arranged in ascending order after the historical communication delay to be tested are all abnormal delay fluctuations; The standard communication delay of the abnormal device is specifically: in, is the standard communication delay for abnormal devices, is the average value of all standard communication delay data, is the total number of all standard communication delay data, is the j-th standard communication delay data.

4. A connection status monitoring system based on Internet of Things device communication access to the network, used to implement the connection status monitoring method based on Internet of Things device communication access to the network as described in any one of claims 1-3, characterized in that: include: A deep learning module, wherein the deep learning module is used to obtain historical communication data of the communication process of the IoT device, and to learn based on the historical communication data of the communication process of the IoT device to obtain a standard communication status library of the IoT device; A real-time communication acquisition module, which is used to obtain real-time communication connection data during the communication process of the Internet of Things device, recorded as real-time communication connection data; A communication action analysis module, the communication action analysis module is electrically connected to the deep learning module and the real-time communication acquisition module, and the communication action analysis module is used to compare the real-time communication connection data with the standard communication status library of the Internet of Things device to determine whether there is a connection communication anomaly of the Internet of Things device; A communication test module is used to perform a device connection status test on an abnormal device and determine whether the abnormal device has a hijacking risk based on the device connection status test result.

5. A connection status monitoring system based on Internet of Things device communication access according to claim 4, characterized in that: The deep learning module includes: A first feature splitting unit, the first feature splitting unit is used to split the access features of each piece of historical communication data, obtain a number of access features corresponding to each piece of historical communication data, record them as sample access features, count all sample access features, and establish an access feature set corresponding to the IoT device one by one; A correlation calculation unit, wherein the correlation calculation unit is used to calculate the correlation rationality between each sample access feature in the access feature set and the related access feature corresponding to the sample access feature by using a feature correlation algorithm, and encapsulate the access feature set and the correlation rationality between each sample access feature in the access feature set and the related access feature corresponding to the sample access feature into a standard communication status library with one-to-one correspondence between IoT devices.

6. A connection status monitoring system based on Internet of Things device communication access according to claim 5, characterized in that: The communication action analysis module comprises: A second feature splitting unit, the second feature splitting unit is used to perform access feature splitting on the real-time communication connection data to obtain real-time access features, and to count all real-time access features to establish a real-time access feature set corresponding to the real-time communication connection data; A retrieval unit, the retrieval unit is used to retrieve from the access feature set corresponding to the IoT device, and obtain a sample access feature corresponding to each real-time access feature; A calculation unit, the calculation unit is used to calculate the communication rationality index of the real-time communication connection data using a communication rationality index calculation formula based on a standard communication state library and a real-time access feature set corresponding to the Internet of Things device; The judgment unit is used to judge whether the communication rationality index is greater than a preset value. If so, it is determined that there is no connection communication abnormality in the Internet of Things device. If not, it is determined that there is a connection communication abnormality in the Internet of Things device.

7. A connection status monitoring system based on Internet of Things device communication access according to claim 6, characterized in that: The communication test module specifically includes: A standard learning unit, wherein the standard learning unit is used to obtain a historical communication delay of an abnormal device, and analyze the historical communication delay of the abnormal device to determine a standard communication delay of the abnormal device; A test execution unit, the test execution unit is used to send communication test data to the abnormal device and wait for the abnormal device to return a test message; A data integrity verification unit, the data integrity verification unit is used to determine whether the received test message is complete; A delay verification unit is used to determine whether the interval between sending communication test data and receiving the test message returned by the abnormal device is less than the standard communication delay of the abnormal device.

Images